From: Tom Lendacky Date: Thu, 10 Dec 2020 17:09:45 +0000 (-0600) Subject: KVM: SVM: Cannot re-initialize the VMCB after shutdown with SEV-ES X-Git-Tag: v5.11-rc1~50^2~26 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8164a5ffe4c65291efecc03a590c978fd14c240f;p=thirdparty%2Fkernel%2Flinux.git KVM: SVM: Cannot re-initialize the VMCB after shutdown with SEV-ES When a SHUTDOWN VMEXIT is encountered, normally the VMCB is re-initialized so that the guest can be re-launched. But when a guest is running as an SEV-ES guest, the VMSA cannot be re-initialized because it has been encrypted. For now, just return -EINVAL to prevent a possible attempt at a guest reset. Signed-off-by: Tom Lendacky Message-Id: Signed-off-by: Paolo Bonzini --- diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index cade703d6edbe..19d1c9707fb72 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -2010,6 +2010,13 @@ static int shutdown_interception(struct vcpu_svm *svm) { struct kvm_run *kvm_run = svm->vcpu.run; + /* + * The VM save area has already been encrypted so it + * cannot be reinitialized - just terminate. + */ + if (sev_es_guest(svm->vcpu.kvm)) + return -EINVAL; + /* * VMCB is undefined after a SHUTDOWN intercept * so reinitialize it.