KVM: x86: Suppress code #DBs on Intel if MOV/POP SS blocking is active

Suppress code breakpoints if MOV/POP SS blocking is active and the guest
CPU is Intel, i.e. if the guest thinks it's running on an Intel CPU.
Intel CPUs inhibit code #DBs when MOV/POP SS blocking is active, whereas
AMD (and its descendents) do not.

Signed-off-by: Sean Christopherson <seanjc@google.com>
Link: https://lore.kernel.org/r/20220830231614.3580124-6-seanjc@google.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index a7ae08e68582e733ba6fefcbf8752e3d36fb345d..ee22264ab471d2e3279bf3d5059d42bec89fafa8 100644 (file)
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -8554,6 +8554,23 @@ int kvm_skip_emulated_instruction(struct kvm_vcpu *vcpu)
 }
 EXPORT_SYMBOL_GPL(kvm_skip_emulated_instruction);
 
+static bool kvm_is_code_breakpoint_inhibited(struct kvm_vcpu *vcpu)
+{
+       u32 shadow;
+
+       if (kvm_get_rflags(vcpu) & X86_EFLAGS_RF)
+               return true;
+
+       /*
+        * Intel CPUs inhibit code #DBs when MOV/POP SS blocking is active,
+        * but AMD CPUs do not.  MOV/POP SS blocking is rare, check that first
+        * to avoid the relatively expensive CPUID lookup.
+        */
+       shadow = static_call(kvm_x86_get_interrupt_shadow)(vcpu);
+       return (shadow & KVM_X86_SHADOW_INT_MOV_SS) &&
+              guest_cpuid_is_intel(vcpu);
+}
+
 static bool kvm_vcpu_check_code_breakpoint(struct kvm_vcpu *vcpu,
                                           int emulation_type, int *r)
 {
@@ -8596,7 +8613,7 @@ static bool kvm_vcpu_check_code_breakpoint(struct kvm_vcpu *vcpu,
        }
 
        if (unlikely(vcpu->arch.dr7 & DR7_BP_EN_MASK) &&
-           !(kvm_get_rflags(vcpu) & X86_EFLAGS_RF)) {
+           !kvm_is_code_breakpoint_inhibited(vcpu)) {
                unsigned long eip = kvm_get_linear_rip(vcpu);
                u32 dr6 = kvm_vcpu_check_hw_bp(eip, 0,
                                           vcpu->arch.dr7,