Re: [PATCH v2 hci-8.0/hci-8.1 3/6] i386: keep spec-ctrl for AMD guests on vz machine types up to vz9.2.0 #VSTOR-151770

[Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>]

> Since kernel commit de572491a975 ("KVM: x86: AMD's IBPB is not
> equivalent to Intel's IBPB") KVM offers spec-ctrl on AMD hosts only
> with IBPB_RET, which Zen 1-3 lack. A guest started under an older
> kernel has spec-ctrl in its CPUID, and QEMU filters it on the new
> host, so migration, restore and snapshot revert fail (VSTOR-151770).
> 
> Add x-spec-ctrl-compat and turn it on in pc_vz_9_2_compat: an AMD
> guest keeps a requested spec-ctrl when the host still provides
> amd-ibpb and one of amd-ibrs, amd-stibp and amd-ssbd. KVM then keeps
> MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD available to the guest
> through those bits (kernel commits 39485ed95d6b, 841c2be09fe4).
> 
> Signed-off-by: Denis V. Lunev <den@openvz.org>
>
> diff --git a/hw/i386/pc.c b/hw/i386/pc.c
> index 25b17866103..95ff2e7860e 100644
> --- a/hw/i386/pc.c
> +++ b/hw/i386/pc.c
> @@ -550,6 +550,7 @@ const size_t pc_vz_compat_len = G_N_ELEMENTS(pc_vz_compat);
>  
>  GlobalProperty pc_vz_9_2_compat[] = {
>      { TYPE_X86_CPU, "x-tsx-compat", "on" },
> +    { TYPE_X86_CPU, "x-spec-ctrl-compat", "on" },
>  };
>  const size_t pc_vz_9_2_compat_len = G_N_ELEMENTS(pc_vz_9_2_compat);
>  
> diff --git a/target/i386/cpu.c b/target/i386/cpu.c
> index 5ff5644dee9..872c00fc983 100644
> --- a/target/i386/cpu.c
> +++ b/target/i386/cpu.c
> @@ -9116,6 +9116,19 @@ static uint64_t x86_cpu_compat_kept_features(X86CPU *cpu, FeatureWord w)
>              kept = CPUID_7_0_EBX_HLE | CPUID_7_0_EBX_RTM;
>          }
>          break;
> +    case FEAT_7_0_EDX:
> +        if (cpu->spec_ctrl_compat && IS_AMD_CPU(env)) {
> +            uint32_t ebx = kvm_arch_get_supported_cpuid(kvm_state, 0x80000008,
> +                                                        0, R_EBX);
> +
> +            if ((ebx & CPUID_8000_0008_EBX_IBPB) &&
> +                (ebx & (CPUID_8000_0008_EBX_IBRS |
> +                        CPUID_8000_0008_EBX_STIBP |
> +                        CPUID_8000_0008_EBX_AMD_SSBD))) {
> +                kept = CPUID_7_0_EDX_SPEC_CTRL;
> +            }
> +        }
> +        break;

Failure case. -cpu EPYC-IBPB,spec-ctrl=on on an old node: KVM offered
SPEC_CTRL there, so the guest booted with it and used the MSR freely.
Move it to a Zen 1 to 3 node on 6.12. The host still has amd-ibpb plus
amd-ssbd, so the guard keeps spec-ctrl and libvirt is happy. But
EPYC-IBPB carries only ibpb in leaf 0x80000008 EBX, no stibp, ibrs or
ssbd.  Every guest wrmsr IA32_SPEC_CTRL now returns 1 from svm_set_msr and
the guest takes #GP where it used to succeed.  Linux logs "unchecked MSR
access error" once per CPU at AP bring-up and on any later STIBP or SSBD
toggle. A host-model or host-passthrough guest is not affected, since it
always carries the host's AMD bits.

Proposed fix: require the same bits in the guest's requested features, not
only in the host's:

    uint64_t guest = env->features[FEAT_8000_0008_EBX];
    uint32_t host = kvm_arch_get_supported_cpuid(kvm_state, 0x80000008,
                                                 0, R_EBX);
    uint64_t msrs = guest & host;

    if ((msrs & CPUID_8000_0008_EBX_IBPB) &&
        (msrs & (CPUID_8000_0008_EBX_IBRS |
                 CPUID_8000_0008_EBX_STIBP |
                 CPUID_8000_0008_EBX_AMD_SSBD))) {
        kept = CPUID_7_0_EDX_SPEC_CTRL;
    }

-- 
Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>