KVM: SVM: Add support for CR8 write traps for an SEV-ES guest

For SEV-ES guests, the interception of control register write access
is not recommended. Control register interception occurs prior to the
control register being modified and the hypervisor is unable to modify
the control register itself because the register is located in the
encrypted register state.

SEV-ES guests introduce new control register write traps. These traps
provide intercept support of a control register write after the control
register has been modified. The new control register value is provided in
the VMCB EXITINFO1 field, allowing the hypervisor to track the setting
of the guest control registers.

Add support to track the value of the guest CR8 register using the control
register write trap so that the hypervisor understands the guest operating
mode.

Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Message-Id: <5a01033f4c8b3106ca9374b7cadf8e33da852df1.1607620209.git.thomas.lendacky@amd.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

diff --git a/arch/x86/include/uapi/asm/svm.h b/arch/x86/include/uapi/asm/svm.h
index c4152689ea936fcdd73a29d4fdedd070780e99de..554f75fe013cf13c14e4092d859957270fb8cd55 100644 (file)
--- a/arch/x86/include/uapi/asm/svm.h
+++ b/arch/x86/include/uapi/asm/svm.h
@@ -204,6 +204,7 @@
        { SVM_EXIT_EFER_WRITE_TRAP,     "write_efer_trap" }, \
        { SVM_EXIT_CR0_WRITE_TRAP,      "write_cr0_trap" }, \
        { SVM_EXIT_CR4_WRITE_TRAP,      "write_cr4_trap" }, \
+       { SVM_EXIT_CR8_WRITE_TRAP,      "write_cr8_trap" }, \
        { SVM_EXIT_INVPCID,     "invpcid" }, \
        { SVM_EXIT_NPF,         "npf" }, \
        { SVM_EXIT_AVIC_INCOMPLETE_IPI,         "avic_incomplete_ipi" }, \

diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index 4b3d935a1325ebb14a25d1860196a7d2ae736455..0f4b496399556e05fd108e76f66ab503e2a01302 100644 (file)
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -2455,6 +2455,7 @@ static int cr_trap(struct vcpu_svm *svm)
        struct kvm_vcpu *vcpu = &svm->vcpu;
        unsigned long old_value, new_value;
        unsigned int cr;
+       int ret = 0;
 
        new_value = (unsigned long)svm->vmcb->control.exit_info_1;
 
@@ -2472,13 +2473,16 @@ static int cr_trap(struct vcpu_svm *svm)
 
                kvm_post_set_cr4(vcpu, old_value, new_value);
                break;
+       case 8:
+               ret = kvm_set_cr8(&svm->vcpu, new_value);
+               break;
        default:
                WARN(1, "unhandled CR%d write trap", cr);
                kvm_queue_exception(vcpu, UD_VECTOR);
                return 1;
        }
 
-       return kvm_complete_insn_gp(vcpu, 0);
+       return kvm_complete_insn_gp(vcpu, ret);
 }
 
 static int dr_interception(struct vcpu_svm *svm)
@@ -3030,6 +3034,7 @@ static int (*const svm_exit_handlers[])(struct vcpu_svm *svm) = {
        [SVM_EXIT_EFER_WRITE_TRAP]              = efer_trap,
        [SVM_EXIT_CR0_WRITE_TRAP]               = cr_trap,
        [SVM_EXIT_CR4_WRITE_TRAP]               = cr_trap,
+       [SVM_EXIT_CR8_WRITE_TRAP]               = cr_trap,
        [SVM_EXIT_INVPCID]                      = invpcid_interception,
        [SVM_EXIT_NPF]                          = npf_interception,
        [SVM_EXIT_RSM]                          = rsm_interception,