Commit 0b0be065 authored by Sean Christopherson's avatar Sean Christopherson Committed by Paolo Bonzini
Browse files

KVM: SVM: Don't intercept #GP for SEV guests 



Never intercept #GP for SEV guests as reading SEV guest private memory
will return cyphertext, i.e. emulating on #GP can't work as intended.

Cc: stable@vger.kernel.org
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Brijesh Singh <brijesh.singh@amd.com>
Signed-off-by: default avatarSean Christopherson <seanjc@google.com>
Reviewed-by: default avatarLiam Merwick <liam.merwick@oracle.com>
Message-Id: <20220120010719.711476-4-seanjc@google.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent 31c25585

arch/x86/kvm/svm/svm.c

+8 −3
Original line number Diff line number Diff line
@@ -312,7 +312,11 @@ int svm_set_efer(struct kvm_vcpu *vcpu, u64 efer) 
				return ret;

			}



			if (svm_gp_erratum_intercept)

			/*

			 * Never intercept #GP for SEV guests, KVM can't

			 * decrypt guest memory to workaround the erratum.

			 */

			if (svm_gp_erratum_intercept && !sev_guest(vcpu->kvm))

				set_exception_intercept(svm, GP_VECTOR);

		}

	}
@@ -1010,9 +1014,10 @@ static void init_vmcb(struct kvm_vcpu *vcpu) 
	 * Guest access to VMware backdoor ports could legitimately

	 * trigger #GP because of TSS I/O permission bitmap.

	 * We intercept those #GP and allow access to them anyway

	 * as VMware does.

	 * as VMware does.  Don't intercept #GP for SEV guests as KVM can't

	 * decrypt guest memory to decode the faulting instruction.

	 */

	if (enable_vmware_backdoor)

	if (enable_vmware_backdoor && !sev_guest(vcpu->kvm))

		set_exception_intercept(svm, GP_VECTOR);



	svm_set_intercept(svm, INTERCEPT_INTR);