Commit c2690b5f authored by Alexey Kardashevskiy's avatar Alexey Kardashevskiy Committed by Sean Christopherson
Browse files

KVM: SVM/SEV/SEV-ES: Rework intercepts 



Currently SVM setup is done sequentially in
init_vmcb() -> sev_init_vmcb() -> sev_es_init_vmcb()
and tries keeping SVM/SEV/SEV-ES bits separated. One of the exceptions
is DR intercepts which is for SEV-ES before sev_es_init_vmcb() runs.

Move the SEV-ES intercept setup to sev_es_init_vmcb(). From now on
set_dr_intercepts()/clr_dr_intercepts() handle SVM/SEV only.

No functional change intended.

Suggested-by: default avatarSean Christopherson <seanjc@google.com>
Signed-off-by: default avatarAlexey Kardashevskiy <aik@amd.com>
Reviewed-by: default avatarSantosh Shukla <santosh.shukla@amd.com>
Reviewed-by: default avatarTom Lendacky <thomas.lendacky@amd.com>
Link: https://lore.kernel.org/r/20230615063757.3039121-6-aik@amd.com


[sean: drop comment about intercepting DR7]
Signed-off-by: default avatarSean Christopherson <seanjc@google.com>
parent 2837dd00

arch/x86/kvm/svm/sev.c

+6 −0
Original line number Diff line number Diff line
@@ -2951,6 +2951,7 @@ int sev_es_string_io(struct vcpu_svm *svm, int size, unsigned int port, int in) 


static void sev_es_init_vmcb(struct vcpu_svm *svm)

{

	struct vmcb *vmcb = svm->vmcb01.ptr;

	struct kvm_vcpu *vcpu = &svm->vcpu;



	svm->vmcb->control.nested_ctl |= SVM_NESTED_CTL_SEV_ES_ENABLE;
@@ -2979,6 +2980,11 @@ static void sev_es_init_vmcb(struct vcpu_svm *svm) 
	svm_set_intercept(svm, TRAP_CR4_WRITE);

	svm_set_intercept(svm, TRAP_CR8_WRITE);



	vmcb->control.intercepts[INTERCEPT_DR] = 0;

	vmcb_set_intercept(&vmcb->control, INTERCEPT_DR7_READ);

	vmcb_set_intercept(&vmcb->control, INTERCEPT_DR7_WRITE);

	recalc_intercepts(svm);



	/* Can't intercept XSETBV, HV can't modify XCR0 directly */

	svm_clr_intercept(svm, INTERCEPT_XSETBV);

arch/x86/kvm/svm/svm.c

+14 −23
Original line number Diff line number Diff line
@@ -681,7 +681,6 @@ static void set_dr_intercepts(struct vcpu_svm *svm) 
{

	struct vmcb *vmcb = svm->vmcb01.ptr;



	if (!sev_es_guest(svm->vcpu.kvm)) {

	vmcb_set_intercept(&vmcb->control, INTERCEPT_DR0_READ);

	vmcb_set_intercept(&vmcb->control, INTERCEPT_DR1_READ);

	vmcb_set_intercept(&vmcb->control, INTERCEPT_DR2_READ);
@@ -696,8 +695,6 @@ static void set_dr_intercepts(struct vcpu_svm *svm) 
	vmcb_set_intercept(&vmcb->control, INTERCEPT_DR4_WRITE);

	vmcb_set_intercept(&vmcb->control, INTERCEPT_DR5_WRITE);

	vmcb_set_intercept(&vmcb->control, INTERCEPT_DR6_WRITE);

	}



	vmcb_set_intercept(&vmcb->control, INTERCEPT_DR7_READ);

	vmcb_set_intercept(&vmcb->control, INTERCEPT_DR7_WRITE);
@@ -710,12 +707,6 @@ static void clr_dr_intercepts(struct vcpu_svm *svm) 


	vmcb->control.intercepts[INTERCEPT_DR] = 0;



	/* DR7 access must remain intercepted for an SEV-ES guest */

	if (sev_es_guest(svm->vcpu.kvm)) {

		vmcb_set_intercept(&vmcb->control, INTERCEPT_DR7_READ);

		vmcb_set_intercept(&vmcb->control, INTERCEPT_DR7_WRITE);

	}



	recalc_intercepts(svm);

}