Received-SPF: pass (google.com: domain of linux-kernel+bounces-118619-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Message-ID: <51b4e33c-c9b3-46c9-8a95-c0450b0e6826@amd.com>
Date: Tue, 26 Mar 2024 14:41:15 +0530
User-Agent: Mozilla Thunderbird
Reply-To: nikunj@amd.com
Subject: Re: [PATCH] KVM: SEV-ES: Don't intercept MSR_IA32_DEBUGCTLMSR for
 SEV-ES guests
To: Ravi Bangoria <ravi.bangoria@amd.com>, seanjc@google.com,
 pbonzini@redhat.com, thomas.lendacky@amd.com
Cc: tglx@linutronix.de, mingo@redhat.com, bp@alien8.de,
 dave.hansen@linux.intel.com, x86@kernel.org, hpa@zytor.com,
 michael.roth@amd.com, nikunj.dadhania@amd.com, kvm@vger.kernel.org,
 linux-kernel@vger.kernel.org, santosh.shukla@amd.com
References: <20240326081143.715-1-ravi.bangoria@amd.com>
Content-Language: en-US
From: "Nikunj A. Dadhania" <nikunj@amd.com>
In-Reply-To: <20240326081143.715-1-ravi.bangoria@amd.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	=?utf-8?B?d2hTblQwTlJ1Q1RDTjFtZXpKL0dHK1RTNFgxaXBRL0tlUHdPcUlGaVJ1Qmhn?=
 =?utf-8?B?T2hBQlYrZVU1NmpDczk2MnlzdDVPcVJoODF6MUx3WTU5TERnY3NpWnRXbGtU?=
 =?utf-8?B?aE1zeVJMT3NwSmJiVWFRUjB0Wm9YbDd2SnRqd05Ud2ZWWHhHN1Yzb3c5Mm1v?=
 =?utf-8?B?bWZOVkExSGE3WlZhbmIyeFRocGFsWTVuaDRPT3F6aGViVGFJTjdIR2xyM0Rt?=
 =?utf-8?B?T2M1dVJtbUF3K0wxbG1MZWQzdFR6RUxOK0h0bXUyelZwR1ZjaC9INHlFV2Vu?=
 =?utf-8?B?dGI4U0M2ZUlEY0VQckJTV1VKcWpxZ2V4Q0VrSUl5MWRZK2dDREFPcEIyTFRy?=
 =?utf-8?B?THZsVTl4VG04VWgxOFlhbkIrQ041Lzg0NGo2Y1BpV1NTZXRvNGlGb1pIMmJX?=
 =?utf-8?B?eWFFRW96aTZjc05TQVV4R1QwUDBjdERqclR3eTlBdFBBVkVrZzdJeUhzRDZ3?=
 =?utf-8?B?TnBVblMvdmE5NnZ5N1lFdVY2RkdLRElpNkEzeTJxMGlWZFpxNmp0TTFlOXBo?=
 =?utf-8?B?U3hRUDIyVWNpUDk0YzlETERBd2c1YXZ4U2FTSW40eWJQcUVWbXk5Nk52WU5t?=
 =?utf-8?B?QkdibGFFbzY0MjlvY0JKZzBiTGpTa1VVWFFYTjY3VlVoeDc5cnkzQXp3VTl3?=
 =?utf-8?B?ZEZ0VmQ0UlVCa1Y0eWMxZG5ZeUZGck5pOUszNFJtWXY0Nk1JUk1CdEU2UlJY?=
 =?utf-8?B?cTY1amxMNTcxaGVjOU01QnZpVnpuaFlPVUIvcTN1cjN5M1pISm9oK05XUDUz?=
 =?utf-8?B?UnE4Rjd4Ui83S3hKNk1zNGpsWkI5Uk8vQnhoV1JBeEFzT2czamYvWEFRS21H?=
 =?utf-8?B?Wm0xQk0xczl2VHhBbEY1Tk81RU1ZVHcrUDd5WGJzUWk2V0NVU1ViK2JiS2lY?=
 =?utf-8?B?cXNwQkNIK05GM2QwdEpERmFhT0tnM0RNOW1GQVBOVCtOZXQzN3EwYmVmRThS?=
 =?utf-8?B?LzBYQlAyQkxDYzFUQXdJcXY4REJ3UVUxaWhtODhHUDduWm5ZTFJ2WnE2Y2kz?=
 =?utf-8?B?WXc5Ui9RSEpKR1ZrczVjU0ZTTXdmVStLNEZvbW5LZWZXYzFQTVQyNnpQeGo0?=
 =?utf-8?B?RFFrL1hwWTdxM1k0eXFqcWZWYjl0THJpM000RkpuUk1SYTM0M09mUkZoampF?=
 =?utf-8?B?K1dpWi9LQ3BWUjNTN2NKSWRPaW9IZ3pSdWtialNHWklzaEVGSThzTVkvRmpr?=
 =?utf-8?B?NWxKTXVKSjkrN1hQd1dSc1E2SnZBV25tQUVyQ1hzTmVsOFpCVDhnTllaRkZl?=
 =?utf-8?B?TkxHYVNGQU1EanpIQllaenZtK0M0U3JNVzZ3VEYxYnNDTlhGT2crMk5lUm41?=
 =?utf-8?B?Z3FnWVQwamt2QngzbTRkRlB0Wldid0dPNEg4SUg4TlcyNzB2elZ5b2wwSGp4?=
 =?utf-8?B?V2NhZU5XTU5ha2IvNnJKejFCSDlqZmRPM0d4S1FDZFdSeEhQQmtrb3ZtdmFU?=
 =?utf-8?B?NlB1cG1Qd2xZak1vaE1xSzBBS0x1Rm1nREVkcWNBWkF3VVVWSG9SOGhJWTZs?=
 =?utf-8?B?UDNybW91Z2EwUlBmZjdRQkZwZDhJY0VnZkQ4MUZBNjJnbDUwSGQ4MlpCUWEy?=
 =?utf-8?B?d2luRm01Qmd0RDN6aFJ3TWc2SWVUTTgva01NRDZqR1hpaldyTWc0V1ZLcFJk?=
 =?utf-8?B?WHZSVVNrbnpXdmdCcDQ5RzJiYjFNY3lkMnZaWGdOV3RvVFRQYmVLdnphNFJH?=
 =?utf-8?B?dzNMV3NGUmdpUnluLzVpRmQ5eVRZbngyQzd5cVkydDZKWGRxd0F5YStROFdi?=
 =?utf-8?B?dWdZa0FRM2VSY2phME8rVlIrTUdUNXBMMnMyRTdnd1g3NEpJNWxrWlBYNkpv?=
 =?utf-8?B?bXB0NGY0RzFMV3ZSM0NiV1BDZ3YwbDBYUk1Kc3NTNThuMGN5dUlhQzhONTM2?=
 =?utf-8?B?TDV2UEttM0dGbUFWZEQ5cDlIalBpcHZWZnFsOWRwZFFxRUJoUnc1Q09QQ3Jq?=
 =?utf-8?B?ZmRvbXI0bkpWMTNnWlZhaG9UUG4wOTkxVFlzTjZ3MjJ4UkpxUHBrdHN1WUdN?=
 =?utf-8?B?NDN4YXVOQisxdzdtM2VMRUVwcU80QWR0aHVkNmk1aDYrczVoUTMyYkI1WllJ?=
 =?utf-8?B?dndIOHJUU01PU2ZGSGNpREVoRkRaNHZWQ2lza0ZUTkduL3BLUEVnSUZhdXVV?=
 =?utf-8?Q?Shbf/yumNO7D88e8jR6qwazTl?=
X-OriginatorOrg: amd.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 19f609b3-768e-40af-e63d-08dc4d74cab0
X-MS-Exchange-CrossTenant-AuthSource: DS7PR12MB6309.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Mar 2024 09:11:59.5733
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: J6T39t4AvyPqCfAsdzs4wGX+tM5NZE3Ms3DVjQfNODeYn/jvuPwFMOvXhubBxmALZMuDbVsktAAJcwIGmsimTA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM4PR12MB6565

On 3/26/2024 1:41 PM, Ravi Bangoria wrote:
> Currently, LBR Virtualization is dynamically enabled and disabled for
> a vcpu by intercepting writes to MSR_IA32_DEBUGCTLMSR. This helps by
> avoiding unnecessary save/restore of LBR MSRs when nobody is using it
> in the guest. However, SEV-ES guest mandates LBR Virtualization to be
> _always_ ON[1] and thus this dynamic toggling doesn't work for SEV-ES
> guest, in fact it results into fatal error:
> 
> SEV-ES guest on Zen3, kvm-amd.ko loaded with lbrv=1
> 
>   [guest ~]# wrmsr 0x1d9 0x4
>   KVM: entry failed, hardware error 0xffffffff
>   EAX=00000004 EBX=00000000 ECX=000001d9 EDX=00000000
>   ...
> 
> Fix this by never intercepting MSR_IA32_DEBUGCTLMSR for SEV-ES guests.
> 
> [1]: AMD64 Architecture Programmer's Manual Pub. 40332, Rev. 4.07 - June
>      2023, Vol 2, 15.35.2 Enabling SEV-ES.
>      https://bugzilla.kernel.org/attachment.cgi?id=304653
> 
> Fixes: 376c6d285017 ("KVM: SVM: Provide support for SEV-ES vCPU creation/loading")
> Signed-off-by: Ravi Bangoria <ravi.bangoria@amd.com>

Reviewed-by: Nikunj A Dadhania <nikunj@amd.com>

> ---
>  arch/x86/kvm/svm/sev.c | 1 +
>  arch/x86/kvm/svm/svm.c | 1 +
>  arch/x86/kvm/svm/svm.h | 2 +-
>  3 files changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> index a8ce5226b3b5..ef932a7ff9bd 100644
> --- a/arch/x86/kvm/svm/sev.c
> +++ b/arch/x86/kvm/svm/sev.c
> @@ -3073,6 +3073,7 @@ static void sev_es_init_vmcb(struct vcpu_svm *svm)
>  	/* Clear intercepts on selected MSRs */
>  	set_msr_interception(vcpu, svm->msrpm, MSR_EFER, 1, 1);
>  	set_msr_interception(vcpu, svm->msrpm, MSR_IA32_CR_PAT, 1, 1);
> +	set_msr_interception(vcpu, svm->msrpm, MSR_IA32_DEBUGCTLMSR, 1, 1);
>  	set_msr_interception(vcpu, svm->msrpm, MSR_IA32_LASTBRANCHFROMIP, 1, 1);
>  	set_msr_interception(vcpu, svm->msrpm, MSR_IA32_LASTBRANCHTOIP, 1, 1);
>  	set_msr_interception(vcpu, svm->msrpm, MSR_IA32_LASTINTFROMIP, 1, 1);
> diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
> index e90b429c84f1..5a82135ae84e 100644
> --- a/arch/x86/kvm/svm/svm.c
> +++ b/arch/x86/kvm/svm/svm.c
> @@ -99,6 +99,7 @@ static const struct svm_direct_access_msrs {
>  	{ .index = MSR_IA32_SPEC_CTRL,			.always = false },
>  	{ .index = MSR_IA32_PRED_CMD,			.always = false },
>  	{ .index = MSR_IA32_FLUSH_CMD,			.always = false },
> +	{ .index = MSR_IA32_DEBUGCTLMSR,		.always = false },
>  	{ .index = MSR_IA32_LASTBRANCHFROMIP,		.always = false },
>  	{ .index = MSR_IA32_LASTBRANCHTOIP,		.always = false },
>  	{ .index = MSR_IA32_LASTINTFROMIP,		.always = false },
> diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h
> index 8ef95139cd24..7a1b60bcebff 100644
> --- a/arch/x86/kvm/svm/svm.h
> +++ b/arch/x86/kvm/svm/svm.h
> @@ -30,7 +30,7 @@
>  #define	IOPM_SIZE PAGE_SIZE * 3
>  #define	MSRPM_SIZE PAGE_SIZE * 2
>  
> -#define MAX_DIRECT_ACCESS_MSRS	47
> +#define MAX_DIRECT_ACCESS_MSRS	48
>  #define MSRPM_OFFSETS	32
>  extern u32 msrpm_offsets[MSRPM_OFFSETS] __read_mostly;
>  extern bool npt_enabled;