lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 1 Nov 2017 16:17:22 -0500 From: Brijesh Singh <brijesh.singh@....com> To: kvm@...r.kernel.org, linux-kernel@...r.kernel.org Cc: bp@...en8.de, Brijesh Singh <brijesh.singh@....com>, Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>, "H. Peter Anvin" <hpa@...or.com>, Paolo Bonzini <pbonzini@...hat.com>, Radim Krčmář <rkrcmar@...hat.com>, Joerg Roedel <joro@...tes.org>, Borislav Petkov <bp@...e.de>, Tom Lendacky <thomas.lendacky@....com>, x86@...nel.org Subject: [Part2 PATCH v7 37/38] KVM: SVM: Do not install #UD intercept when SEV is enabled On #UD, x86_emulate_instruction() fetches the data from guest memory and decodes the instruction bytes to assist further. When SEV is enabled, the instruction bytes will be encrypted using the guest-specific key and the hypervisor will no longer able to fetch the instruction bytes to assist UD handling. By not installing intercept we let the guest receive and handle #UD. Cc: Thomas Gleixner <tglx@...utronix.de> Cc: Ingo Molnar <mingo@...hat.com> Cc: "H. Peter Anvin" <hpa@...or.com> Cc: Paolo Bonzini <pbonzini@...hat.com> Cc: "Radim Krčmář" <rkrcmar@...hat.com> Cc: Joerg Roedel <joro@...tes.org> Cc: Borislav Petkov <bp@...e.de> Cc: Tom Lendacky <thomas.lendacky@....com> Cc: x86@...nel.org Cc: kvm@...r.kernel.org Cc: linux-kernel@...r.kernel.org Reviewed-by: Borislav Petkov <bp@...e.de> Signed-off-by: Brijesh Singh <brijesh.singh@....com> --- arch/x86/kvm/svm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c index a0e5e22bb661..29c30ecde780 100644 --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -1421,8 +1421,10 @@ static void init_vmcb(struct vcpu_svm *svm) svm->vmcb->control.int_ctl |= V_GIF_ENABLE_MASK; } - if (sev_guest(svm->vcpu.kvm)) + if (sev_guest(svm->vcpu.kvm)) { svm->vmcb->control.nested_ctl |= SVM_NESTED_CTL_SEV_ENABLE; + clr_exception_intercept(svm, UD_VECTOR); + } mark_all_dirty(svm->vmcb); -- 2.9.5
Powered by blists - more mailing lists