Fix a long-lurking bug in SVM where KVM runs the guest with the host's
DEBUGCTL if LBR virtualization is disabled. AMD CPUs rather stupidly
context switch DEBUGCTL if and only if LBR virtualization is enabled (not
just supported, but fully enabled).
The bug has gone unnoticed because until recently, the only bits that
KVM would leave set were things like BTF, which are guest visible but
won't cause functional problems unless guest software is being especially
particular about #DBs.
The bug was exposed by the addition of BusLockTrap ("Detect" in the kernel),
as the resulting #DBs due to split-lock accesses in guest userspace (lol
Steam) get reflected into the guest by KVM.
v2:
- Load the guest's DEBUGCTL instead of simply zeroing it on VMRUN.
- Drop bits 5:3 from guest DEBUGCTL so that KVM doesn't let the guest
unintentionally enable BusLockTrap (AMD repurposed bits). [Ravi]
- Collect a review. [Xiaoyao]
- Make bits 5:3 fully reserved, in a separate not-for-stable patch.
v1: https://lore.kernel.org/all/20250224181315.2376869-1-seanjc@xxxxxxxxxx
Sean Christopherson (5):
KVM: SVM: Drop DEBUGCTL[5:2] from guest's effective value
KVM: x86: Snapshot the host's DEBUGCTL in common x86
KVM: SVM: Manually context switch DEBUGCTL if LBR virtualization is
disabled
KVM: x86: Snapshot the host's DEBUGCTL after disabling IRQs
KVM: SVM: Treat DEBUGCTL[5:2] as reserved
arch/x86/include/asm/kvm_host.h | 1 +
arch/x86/kvm/svm/svm.c | 15 +++++++++++++++
arch/x86/kvm/svm/svm.h | 2 +-
arch/x86/kvm/vmx/vmx.c | 8 ++------
arch/x86/kvm/vmx/vmx.h | 2 --
arch/x86/kvm/x86.c | 2 ++
6 files changed, 21 insertions(+), 9 deletions(-)
base-commit: fed48e2967f402f561d80075a20c5c9e16866e53
--
2.48.1.711.g2feabab25a-goog
