KVM: SVM: Always intercept ICEBP to workaround AMD ICEBP+TASK_SWITCH flaws

Unconditionally intercept and emulate ICEBP, i.e. INT1 #DBs, on SVM to
workaround a bug/misfeature in current AMD CPUs.  AMD CPUs don't provide
information to allow software to distinguish instruction-induced #DBs (i.e.
ICEBP) from exception-induced #DBs (all others), and also don't report an
instruction length for an ICEBP-induced TASK_SWITCH.

On an intercepted TASK_SWITCH (which always has fault semantics), KVM
(any hypervisor, really) looks at the vectoring event type to decide
whether it was logically caused by a trap, and therefore whether to
advance guest RIP before entering the new task.  If the guest IDT is
configured to deliver #DBs via a task gate, then the guest will see broken
behavior for ICEBP #DB because KVM doesn't have enough information to
detect and skip the ICEBP.

The typical workaround is to intercept ICEBP unconditionally and handle the
FAULT=>TRAP conversion in the hypervisor, at which point the #DB-induced
TASK_SWITCH occurs with RIP on the correct instruction boundary regardless
of whether it was instruction-induced or exception-induced.

As a bonus, intercepting ICEBP more or less aligns SVM with VMX (KVM always
intercepts #DBs on VMX, and ICEBP #DB VM-Exits on Intel have fault-like
behavior).

Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Link: https://patch.msgid.link/e03f092dfbb7d391a6bf2797ba01e122ba080bcd.camel@infradead.org
[sean: drop selftest, reword changelog to provide more details]
Signed-off-by: Sean Christopherson <seanjc@google.com>

0 files changed, 0 insertions, 0 deletions