Preserve the host's FREEZE_IN_SMM setting by stuffing GUEST_DEBUGCTL, so that
SMM activity doesn't bleed into PMU events while running the guest.

Along the way, enforce the supported set of DEBUGCTL bits when processing
vmcs12.GUEST_DEBUGCTL, as KVM can't rely on hardware to reject an MSR value
that is supported in hardware.

To minimize the probability of the nVMX fix breaking existing setups, allow
the guest to use DEBUGCTL.RTM_DEBUG if RTM is exposed to the guest.

v6:
 - WARN in tdx_vcpu_run() if KVM requests DR6 load.
 - Ignore unsupported-but-suppressed DEBUGCTL bits when doing consistency
   check on vmcs12.
 - Add support for DEBUGCTL.RTM_DEBUG.
 - Use accessors in all paths.
 - Add a dedicated vmx_reload_guest_debugctl().

v5: https://lore.kernel.org/all/20250522005555.55705-1-mlevitsk@redhat.com

Maxim Levitsky (3):
  KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter
  KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs
  KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the
    guest

Sean Christopherson (5):
  KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's
    DEBUGCTL
  KVM: x86: Convert vcpu_run()'s immediate exit param into a generic
    bitmap
  KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag
  KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported
  KVM: VMX: Extract checking of guest's DEBUGCTL into helper

 arch/x86/include/asm/kvm-x86-ops.h |  1 -
 arch/x86/include/asm/kvm_host.h    | 15 ++++++--
 arch/x86/include/asm/msr-index.h   |  1 +
 arch/x86/kvm/svm/svm.c             | 14 ++++----
 arch/x86/kvm/vmx/common.h          |  2 --
 arch/x86/kvm/vmx/main.c            | 17 +++------
 arch/x86/kvm/vmx/nested.c          | 21 ++++++++---
 arch/x86/kvm/vmx/pmu_intel.c       |  8 ++---
 arch/x86/kvm/vmx/tdx.c             | 24 ++++++-------
 arch/x86/kvm/vmx/vmx.c             | 57 ++++++++++++++++++------------
 arch/x86/kvm/vmx/vmx.h             | 26 ++++++++++++++
 arch/x86/kvm/vmx/x86_ops.h         |  4 +--
 arch/x86/kvm/x86.c                 | 25 ++++++++++---
 13 files changed, 140 insertions(+), 75 deletions(-)


base-commit: 61374cc145f4a56377eaf87c7409a97ec7a34041
-- 
2.50.0.rc0.642.g800a2b2222-goog

On Tue, 10 Jun 2025 16:20:02 -0700, Sean Christopherson wrote:
> Preserve the host's FREEZE_IN_SMM setting by stuffing GUEST_DEBUGCTL, so that
> SMM activity doesn't bleed into PMU events while running the guest.
> 
> Along the way, enforce the supported set of DEBUGCTL bits when processing
> vmcs12.GUEST_DEBUGCTL, as KVM can't rely on hardware to reject an MSR value
> that is supported in hardware.
> 
> [...]

Applied to kvm-x86 misc, thanks!

[1/8] KVM: TDX: Use kvm_arch_vcpu.host_debugctl to restore the host's DEBUGCTL
      https://github.com/kvm-x86/linux/commit/7d390a9da823
[2/8] KVM: x86: Convert vcpu_run()'s immediate exit param into a generic bitmap
      https://github.com/kvm-x86/linux/commit/2478b1b220c4
[3/8] KVM: x86: Drop kvm_x86_ops.set_dr6() in favor of a new KVM_RUN flag
      https://github.com/kvm-x86/linux/commit/80c64c7afea1
[4/8] KVM: VMX: Allow guest to set DEBUGCTL.RTM_DEBUG if RTM is supported
      https://github.com/kvm-x86/linux/commit/17ec2f965344
[5/8] KVM: VMX: Extract checking of guest's DEBUGCTL into helper
      https://github.com/kvm-x86/linux/commit/8a4351ac302c
[6/8] KVM: nVMX: Check vmcs12->guest_ia32_debugctl on nested VM-Enter
      https://github.com/kvm-x86/linux/commit/095686e6fcb4
[7/8] KVM: VMX: Wrap all accesses to IA32_DEBUGCTL with getter/setter APIs
      https://github.com/kvm-x86/linux/commit/7d0cce6cbe71
[8/8] KVM: VMX: Preserve host's DEBUGCTLMSR_FREEZE_IN_SMM while running the guest
      https://github.com/kvm-x86/linux/commit/6b1dd26544d0

--
https://github.com/kvm-x86/kvm-unit-tests/tree/next