On 11/8/25 01:45, Yosry Ahmed wrote:
> Clear the VMCB_LBR clean bit when MSR_IA32_DEBUGCTLMSR is updated, as
> the only valid bit is DEBUGCTLMSR_LBR.
>
> The history is complicated, it was correctly cleared for L1 before
> commit 1d5a1b5860ed ("KVM: x86: nSVM: correctly virtualize LBR msrs when
> L2 is running"), then the latter relied on svm_update_lbrv() to clear
> it, but it only did so for L2. Go back to clearing it directly in
> svm_set_msr().
Slightly more accurate:
The APM lists the DbgCtlMsr field as being tracked by the VMCB_LBR clean
bit. Always clear the bit when MSR_IA32_DEBUGCTLMSR is updated.
The history is complicated, it was correctly cleared for L1 before
commit 1d5a1b5860ed ("KVM: x86: nSVM: correctly virtualize LBR msrs when
L2 is running"). At that point svm_set_msr() started to rely on
svm_update_lbrv() to clear the bit, but when nested virtualization
is enabled the latter does not always clear it even if MSR_IA32_DEBUGCTLMSR
changed. Go back to clearing it directly in svm_set_msr().
Paolo
> Fixes: 1d5a1b5860ed ("KVM: x86: nSVM: correctly virtualize LBR msrs when L2 is running")
> Reported-by: Matteo Rizzo <matteorizzo@google.com>
> Reported-by: evn@google.com
> Co-developed-by: Jim Mattson <jmattson@google.com>
> Signed-off-by: Jim Mattson <jmattson@google.com>
> Signed-off-by: Yosry Ahmed <yosry.ahmed@linux.dev>
> ---
> arch/x86/kvm/svm/svm.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
> index 55bd7aa5cd743..d25c56b30b4e2 100644
> --- a/arch/x86/kvm/svm/svm.c
> +++ b/arch/x86/kvm/svm/svm.c
> @@ -3009,7 +3009,11 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)
> if (data & DEBUGCTL_RESERVED_BITS)
> return 1;
>
> + if (svm_get_lbr_vmcb(svm)->save.dbgctl == data)
> + break;
> +
> svm_get_lbr_vmcb(svm)->save.dbgctl = data;
> + vmcb_mark_dirty(svm->vmcb, VMCB_LBR);
> svm_update_lbrv(vcpu);
> break;
> case MSR_VM_HSAVE_PA: