[PATCH] KVM: SVM: Stub out MSR_VM_CR to return VM_CR.LOCK and ignore writes

[PATCH] KVM: SVM: Stub out MSR_VM_CR to return VM_CR.LOCK and ignore writes

[Jim Mattson]

Commit 4a810181c8bc ("KVM: SVM: Implement emulation of vm_cr msr") added
svm_set_vm_cr() and svm->nested.vm_cr_msr solely because Hyper-V wrote
to MSR_VM_CR when running under nested SVM [1]. At the time, Avi Kivity
noted that the MSR needed to be exposed to userspace for save/restore
[2], but it was never added to KVM_GET_MSR_INDEX_LIST.

Moreover, KVM's emulation of MSR_VM_CR does not actually wire up any of
its five defined bits (DPD, R_INIT, DIS_A20M, LOCK, SVMDIS) to their
architectural behaviors (not even checking VM_CR.SVMDIS on writes to
MSR_EFER), checks the wrong bit (SVMDIS instead of LOCK) when locking
bits 4:3, and never resets vm_cr_msr on vCPU reset/INIT.

Replace svm->nested.vm_cr_msr and svm_set_vm_cr() with a simple stub
that returns SVM_VM_CR_SVM_LOCK_MASK on reads (matching typical
bare-metal state after platform firmware enables and locks SVM) and
silently ignores all writes. Document the lack of MSR_VM_CR
virtualization and the missing #GP faults on writes in
Documentation/virt/kvm/x86/errata.rst.

Link: https://lore.kernel.org/all/1267034360-5907-1-git-send-email-joerg.roedel@amd.com [1]
Link: https://lore.kernel.org/all/4B8650CF.6@redhat.com [2]
Signed-off-by: Jim Mattson <jmattson@google.com>
---
 Documentation/virt/kvm/x86/errata.rst |  9 ++++++++-
 arch/x86/kvm/svm/svm.c                | 29 ++-------------------------
 arch/x86/kvm/svm/svm.h                |  1 -
 3 files changed, 10 insertions(+), 29 deletions(-)

diff --git a/Documentation/virt/kvm/x86/errata.rst b/Documentation/virt/kvm/x86/errata.rst
index a9cf0e004651..8dc9c3435752 100644
--- a/Documentation/virt/kvm/x86/errata.rst
+++ b/Documentation/virt/kvm/x86/errata.rst
@@ -84,4 +84,11 @@ memory.
 
 Note, this erratum does not affect AMD CPUs, which fully virtualize CR0.CD in
 hardware, i.e. put the CPU caches into "no fill" mode when CR0.CD=1, even when
-running in the guest.
\ No newline at end of file
+running in the guest.
+
+VM_CR
+-----
+KVM does not virtualize VM_CR (MSR_VM_CR) on AMD CPUs.  RDMSR always returns
+VM_CR.LOCK (bit 3) set and all other bits clear, and WRMSR silently ignores all
+writes without raising a #GP if reserved bits (bits 63:5) are set or if
+VM_CR.SVMDIS (bit 4) is set while EFER.SVME is set.
\ No newline at end of file
diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index 136069dfcd44..be9de34ea6b5 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -2954,7 +2954,7 @@ static int svm_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info)
 		msr_info->data = svm->nested.hsave_msr;
 		break;
 	case MSR_VM_CR:
-		msr_info->data = svm->nested.vm_cr_msr;
+		msr_info->data = SVM_VM_CR_SVM_LOCK_MASK;
 		break;
 	case MSR_IA32_SPEC_CTRL:
 		if (!msr_info->host_initiated &&
@@ -3015,31 +3015,6 @@ static int svm_complete_emulated_msr(struct kvm_vcpu *vcpu, int err)
 	return 1;
 }
 
-static int svm_set_vm_cr(struct kvm_vcpu *vcpu, u64 data)
-{
-	struct vcpu_svm *svm = to_svm(vcpu);
-	int svm_dis, chg_mask;
-
-	if (data & ~SVM_VM_CR_VALID_MASK)
-		return 1;
-
-	chg_mask = SVM_VM_CR_VALID_MASK;
-
-	if (svm->nested.vm_cr_msr & SVM_VM_CR_SVM_DIS_MASK)
-		chg_mask &= ~(SVM_VM_CR_SVM_LOCK_MASK | SVM_VM_CR_SVM_DIS_MASK);
-
-	svm->nested.vm_cr_msr &= ~chg_mask;
-	svm->nested.vm_cr_msr |= (data & chg_mask);
-
-	svm_dis = svm->nested.vm_cr_msr & SVM_VM_CR_SVM_DIS_MASK;
-
-	/* check for svm_disable while efer.svme is set */
-	if (svm_dis && (vcpu->arch.efer & EFER_SVME))
-		return 1;
-
-	return 0;
-}
-
 static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)
 {
 	struct vcpu_svm *svm = to_svm(vcpu);
@@ -3262,7 +3237,7 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)
 		svm->nested.hsave_msr = data & PAGE_MASK;
 		break;
 	case MSR_VM_CR:
-		return svm_set_vm_cr(vcpu, data);
+		return 0;
 	case MSR_VM_IGNNE:
 		kvm_pr_unimpl_wrmsr(vcpu, ecx, data);
 		break;
diff --git a/arch/x86/kvm/svm/svm.h b/arch/x86/kvm/svm/svm.h
index 6d0242966dc8..91acddf12082 100644
--- a/arch/x86/kvm/svm/svm.h
+++ b/arch/x86/kvm/svm/svm.h
@@ -214,7 +214,6 @@ struct vmcb_ctrl_area_cached {
 struct svm_nested_state {
 	struct kvm_vmcb_info vmcb02;
 	u64 hsave_msr;
-	u64 vm_cr_msr;
 	u64 vmcb12_gpa;
 	u64 last_vmcb12_gpa;
 	u64 last_bus_lock_rip;
-- 
2.56.0.317.g454f8302e1-goog