linux-kernel - Re: [PATCH 1/6] KVM: SVM: Mark VMCB_LBR dirty when MSR_IA32

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b46bfeef-c728-4598-a047-fcdad2d42d6e@redhat.com>
Date: Sun, 9 Nov 2025 08:42:50 +0100
From: Paolo Bonzini <pbonzini@...hat.com>
To: Yosry Ahmed <yosry.ahmed@...ux.dev>,
 Sean Christopherson <seanjc@...gle.com>
Cc: Jim Mattson <jmattson@...gle.com>, Maxim Levitsky <mlevitsk@...hat.com>,
 kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
 Matteo Rizzo <matteorizzo@...gle.com>, evn@...gle.com
Subject: Re: [PATCH 1/6] KVM: SVM: Mark VMCB_LBR dirty when
 MSR_IA32_DEBUGCTLMSR is updated

On 11/8/25 01:45, Yosry Ahmed wrote:
> Clear the VMCB_LBR clean bit when MSR_IA32_DEBUGCTLMSR is updated, as
> the only valid bit is DEBUGCTLMSR_LBR.
> 
> The history is complicated, it was correctly cleared for L1 before
> commit 1d5a1b5860ed ("KVM: x86: nSVM: correctly virtualize LBR msrs when
> L2 is running"), then the latter relied on svm_update_lbrv() to clear
> it, but it only did so for L2. Go back to clearing it directly in
> svm_set_msr().

Slightly more accurate:

The APM lists the DbgCtlMsr field as being tracked by the VMCB_LBR clean
bit.  Always clear the bit when MSR_IA32_DEBUGCTLMSR is updated.

The history is complicated, it was correctly cleared for L1 before
commit 1d5a1b5860ed ("KVM: x86: nSVM: correctly virtualize LBR msrs when
L2 is running").  At that point svm_set_msr() started to rely on
svm_update_lbrv() to clear the bit, but when nested virtualization
is enabled the latter does not always clear it even if MSR_IA32_DEBUGCTLMSR
changed. Go back to clearing it directly in svm_set_msr().

Paolo

> Fixes: 1d5a1b5860ed ("KVM: x86: nSVM: correctly virtualize LBR msrs when L2 is running")
> Reported-by: Matteo Rizzo <matteorizzo@...gle.com>
> Reported-by: evn@...gle.com
> Co-developed-by: Jim Mattson <jmattson@...gle.com>
> Signed-off-by: Jim Mattson <jmattson@...gle.com>
> Signed-off-by: Yosry Ahmed <yosry.ahmed@...ux.dev>
> ---
>   arch/x86/kvm/svm/svm.c | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
> index 55bd7aa5cd743..d25c56b30b4e2 100644
> --- a/arch/x86/kvm/svm/svm.c
> +++ b/arch/x86/kvm/svm/svm.c
> @@ -3009,7 +3009,11 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)
>   		if (data & DEBUGCTL_RESERVED_BITS)
>   			return 1;
>   
> +		if (svm_get_lbr_vmcb(svm)->save.dbgctl == data)
> +			break;
> +
>   		svm_get_lbr_vmcb(svm)->save.dbgctl = data;
> +		vmcb_mark_dirty(svm->vmcb, VMCB_LBR);
>   		svm_update_lbrv(vcpu);
>   		break;
>   	case MSR_VM_HSAVE_PA: