Re: [PATCH v3 9/9] KVM: SVM: Add newly added IBS capabilities and MSRs

[Jim Mattson <jmattson@google.com>]

On Tue, Mar 10, 2026 at 06:00:21AM +0000, Manali Shukla wrote:
> IBS on upcoming microarch introduced two new control MSRs and a couple of
> new features. Define macros for them. Add these newly added IBS
> capabilities to KVM-only leaf 0x8000001b, so that when IBS feature bit
> is enabled on the guest, these newly added features can be used by
> guests if the hardware and guest os supports it.
>
>  - X86_FEATURE_IBS_DISABLE: Independent IBS disable capability to
>    avoid RMW race
>  - X86_FEATURE_IBS_FETCHLATFIL: Fetch Latency filtering
>  - X86_FEATURE_IBS_ADDRFILTER: Address Bit 63 based filtering
>  - X86_FEATURE_IBS_STRMST_RMTSOCKET: Streaming store filter and
>    indicator. Remote socket indicator.
>  - X86_FEATURE_IBS_BUFFER1: IBS buffering v1
>  - X86_FEATURE_IBS_MEMPROFILER: IBS memory profiler

APM vol. 2 (rev. 3.45), section 13.3.7, says, "Hardware virtualization and
IBS Buffering are not supported for IBS Memory Profiler Version 1."
Moreover, the memory profiler requires additional MSRs
(C001_0380h-C001_0386h), which are not in the list of IBS virtualization
state in section 15.38.

KVM should not advertise X86_FEATURE_IBS_MEMPROFILER.

IBS buffering *is* virtualized (IBS_BUFFER_BASE, IBS_BUFFER_SIZE, and
IBS_BUFFER_TAIL at offsets 7D8h-7E4h in Table B-2). However, this series
does not add these fields to struct vmcb_save_area, and it does not disable
interception of MSRs C001_0390h-C001_0392h. svm_get_msr() and svm_set_msr()
do not emulate these MSRs, so a guest cannot really use IBS buffering.

KVM should not advertise X86_FEATURE_IBS_BUFFER1.

> Extend VMCB save area to include to the newly added MSRs:
> MSR_AMD64_IBSFETCHCTL2 and MSR_AMD64_IBSOPCTL2.

s/include to/include/

As with the other IBS MSRs (see my comment on patch 6/9), svm_get_msr() and
svm_set_msr() do not handle IBS_FETCH_CTL2 and IBS_OP_CTL2, which breaks
KVM_{GET,SET}_MSRS and KVM_FEP. (And to correct what I wrote on patch 6/9:
even if we disable interception of MSR_AMD64_IBSFETCHPHYSAD and
MSR_AMD64_IBSDCPHYSAD so that hardware handles native guest accesses,
svm_get_msr() and svm_set_msr() still must handle those two MSRs as well,
for KVM_FEP if nothing else.)

> Signed-off-by: Manali Shukla <manali.shukla@amd.com>
> ---

[...]

> diff --git a/arch/x86/kvm/reverse_cpuid.h b/arch/x86/kvm/reverse_cpuid.h
> index 22cfdb331e9e..1af2ba207b8a 100644
> --- a/arch/x86/kvm/reverse_cpuid.h
> +++ b/arch/x86/kvm/reverse_cpuid.h
> @@ -89,6 +89,12 @@
>  #define X86_FEATURE_IBS_FETCHCTLEXTD		KVM_X86_FEATURE(CPUID_8000_001B_EAX, 9)
>  #define X86_FEATURE_IBS_ZEN4_EXT		KVM_X86_FEATURE(CPUID_8000_001B_EAX, 11)
>  #define X86_FEATURE_IBS_LOADLATFIL		KVM_X86_FEATURE(CPUID_8000_001B_EAX, 12)
> +#define X86_FEATURE_IBS_DISABLE			KVM_X86_FEATURE(CPUID_8000_001B_EAX, 13)
> +#define X86_FEATURE_IBS_FETCHLATFIL		KVM_X86_FEATURE(CPUID_8000_001B_EAX, 14)
> +#define X86_FEATURE_IBS_ADDRFILTER		KVM_X86_FEATURE(CPUID_8000_001B_EAX, 15)
> +#define X86_FEATURE_IBS_STRMST_RMTSOCKET	KVM_X86_FEATURE(CPUID_8000_001B_EAX, 16)
> +#define X86_FEATURE_IBS_BUFFER1			KVM_X86_FEATURE(CPUID_8000_001B_EAX, 17)
> +#define X86_FEATURE_IBS_MEMPROFILER		KVM_X86_FEATURE(CPUID_8000_001B_EAX, 18)

Three of these names are different from the IBS_CAPS_* names for the same
bits in asm/perf_event.h: IBS_DISABLE (IBS_CAPS_DIS), IBS_FETCHLATFIL
(IBS_CAPS_FETCHLAT), and IBS_ADDRFILTER (IBS_CAPS_BIT63_FILTER). Please
standardize on the existing names.

>  #define X86_FEATURE_IBS_ZEN4_DTLBSTAT		KVM_X86_FEATURE(CPUID_8000_001B_EAX, 19)
>
>  struct cpuid_reg {
> diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
> index 421a929398da..9bf0d5f66239 100644
> --- a/arch/x86/kvm/svm/svm.c
> +++ b/arch/x86/kvm/svm/svm.c
> @@ -800,6 +800,13 @@ static void svm_recalc_ibs_msr_intercepts(struct kvm_vcpu *vcpu)
>  	svm_set_intercept_for_msr(vcpu, MSR_AMD64_IBSDCLINAD, MSR_TYPE_RW, intercept);
>  	svm_set_intercept_for_msr(vcpu, MSR_AMD64_IBSBRTARGET, MSR_TYPE_RW, intercept);
>  	svm_set_intercept_for_msr(vcpu, MSR_AMD64_ICIBSEXTDCTL, MSR_TYPE_RW, intercept);
> +
> +	if (guest_cpu_cap_has(vcpu, X86_FEATURE_IBS_DISABLE)) {
> +		svm_set_intercept_for_msr(vcpu, MSR_AMD64_IBSFETCHCTL2, MSR_TYPE_RW,
> +				intercept);
> +		svm_set_intercept_for_msr(vcpu, MSR_AMD64_IBSOPCTL2, MSR_TYPE_RW,
> +				intercept);
> +	}

First, this function never re-enables the intercepts for
MSR_AMD64_IBSFETCHCTL2 and MSR_AMD64_IBSOPCTL2. If KVM_RUN recalculates the
intercepts but returns to userspace before VMRUN (e.g. due to a pending
signal), userspace can still clear X86_FEATURE_IBS_DISABLE with
KVM_SET_CPUID2, and the intercepts stay disabled. Call
svm_set_intercept_for_msr() unconditionally with the computed intercept
state, as svm_recalc_pmu_msr_intercepts() does.

Second, IbsDis (bit 13) is not the only CPUID bit that enumerates fields in
these MSRs. Per APM vol. 2 (rev. 3.45), section 13.3:

- IbsFetchCtl2[IbsFetchLatFilter] depends on IbsFetchLatencyFiltering
  (bit 14).

- IbsFetchCtl2[IbsFetchExclAddr63Eq{0,1}] and IbsOpCtl2[IbsOpExclRip63Eq{0,1}]
  depend on IbsAddrBit63Filtering (bit 15).

- IbsOpCtl2[IbsOpStrmStFilter] depends on IbsStrmStAndRmtSocket (bit 16).

The Linux IBS driver already uses these MSRs for IBS_CAPS_BIT63_FILTER
without IBS_CAPS_DIS (see perf_ibs_init()). If userspace gives the guest
any of bits 14-16 without bit 13, these MSRs stay intercepted,
svm_set_msr() rejects the guest's writes, and KVM synthesizes a #GP.