Commit 29de732c authored by Alexey Kardashevskiy's avatar Alexey Kardashevskiy Committed by Sean Christopherson
Browse files

KVM: SEV: Move SEV's GP_VECTOR intercept setup to SEV 



Currently SVM setup is done sequentially in
init_vmcb() -> sev_init_vmcb() -> sev_es_init_vmcb() and tries
keeping SVM/SEV/SEV-ES bits separated. One of the exceptions
is #GP intercept which init_vmcb() skips setting for SEV guests and
then sev_es_init_vmcb() needlessly clears it.

Remove the SEV check from init_vmcb(). Clear the #GP intercept in
sev_init_vmcb(). SEV-ES will use the SEV setting.

No functional change intended.

Suggested-by: default avatarSean Christopherson <seanjc@google.com>
Signed-off-by: default avatarAlexey Kardashevskiy <aik@amd.com>
Reviewed-by: default avatarCarlos Bilbao <carlos.bilbao@amd.com>
Reviewed-by: default avatarTom Lendacky <thomas.lendacky@amd.com>
Reviewed-by: default avatarSantosh Shukla <santosh.shukla@amd.com>
Link: https://lore.kernel.org/r/20230615063757.3039121-3-aik@amd.com


Signed-off-by: default avatarSean Christopherson <seanjc@google.com>
parent b265ee7b

arch/x86/kvm/svm/sev.c

+6 −3
Original line number Diff line number Diff line
@@ -2974,9 +2974,6 @@ static void sev_es_init_vmcb(struct vcpu_svm *svm) 
	svm_set_intercept(svm, TRAP_CR4_WRITE);

	svm_set_intercept(svm, TRAP_CR8_WRITE);



	/* No support for enable_vmware_backdoor */

	clr_exception_intercept(svm, GP_VECTOR);



	/* Can't intercept XSETBV, HV can't modify XCR0 directly */

	svm_clr_intercept(svm, INTERCEPT_XSETBV);
@@ -3002,6 +2999,12 @@ void sev_init_vmcb(struct vcpu_svm *svm) 
	svm->vmcb->control.nested_ctl |= SVM_NESTED_CTL_SEV_ENABLE;

	clr_exception_intercept(svm, UD_VECTOR);



	/*

	 * Don't intercept #GP for SEV guests, e.g. for the VMware backdoor, as

	 * KVM can't decrypt guest memory to decode the faulting instruction.

	 */

	clr_exception_intercept(svm, GP_VECTOR);



	if (sev_es_guest(svm->vcpu.kvm))

		sev_es_init_vmcb(svm);

}

arch/x86/kvm/svm/svm.c

+2 −3
Original line number Diff line number Diff line
@@ -1243,10 +1243,9 @@ static void init_vmcb(struct kvm_vcpu *vcpu) 
	 * Guest access to VMware backdoor ports could legitimately

	 * trigger #GP because of TSS I/O permission bitmap.

	 * We intercept those #GP and allow access to them anyway

	 * as VMware does.  Don't intercept #GP for SEV guests as KVM can't

	 * decrypt guest memory to decode the faulting instruction.

	 * as VMware does.

	 */

	if (enable_vmware_backdoor && !sev_guest(vcpu->kvm))

	if (enable_vmware_backdoor)

		set_exception_intercept(svm, GP_VECTOR);



	svm_set_intercept(svm, INTERCEPT_INTR);