[v8] QEMU TDX support

[PATCH v8 41/55] i386/apic: Skip kvm_apic_put() for TDX

Posted by Xiaoyao Li 10 months, 2 weeks ago

KVM neithers allow writing to MSR_IA32_APICBASE for TDs, nor allow for
KVM_SET_LAPIC[*].

Note, KVM_GET_LAPIC is also disallowed for TDX. It is called in the path

  do_kvm_cpu_synchronize_state()
  -> kvm_arch_get_registers()
     -> kvm_get_apic()

and it's already disllowed for confidential guest through
guest_state_protected.

[*] https://lore.kernel.org/all/Z3w4Ku4Jq0CrtXne@google.com/

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
---
Changes in v8:
- Fix the coding style; (Francesco)
---
 hw/i386/kvm/apic.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/i386/kvm/apic.c b/hw/i386/kvm/apic.c
index 757510600098..cb65fca49586 100644
--- a/hw/i386/kvm/apic.c
+++ b/hw/i386/kvm/apic.c
@@ -17,6 +17,7 @@
 #include "system/hw_accel.h"
 #include "system/kvm.h"
 #include "kvm/kvm_i386.h"
+#include "kvm/tdx.h"
 
 static inline void kvm_apic_set_reg(struct kvm_lapic_state *kapic,
                                     int reg_id, uint32_t val)
@@ -141,6 +142,10 @@ static void kvm_apic_put(CPUState *cs, run_on_cpu_data data)
     struct kvm_lapic_state kapic;
     int ret;
 
+    if (is_tdx_vm()) {
+        return;
+    }
+
     kvm_put_apicbase(s->cpu, s->apicbase);
     kvm_put_apic_state(s, &kapic);
 
-- 
2.34.1

Re: [PATCH v8 41/55] i386/apic: Skip kvm_apic_put() for TDX

Posted by Zhao Liu 9 months, 1 week ago

On Tue, Apr 01, 2025 at 09:01:51AM -0400, Xiaoyao Li wrote:
> Date: Tue,  1 Apr 2025 09:01:51 -0400
> From: Xiaoyao Li <xiaoyao.li@intel.com>
> Subject: [PATCH v8 41/55] i386/apic: Skip kvm_apic_put() for TDX
> X-Mailer: git-send-email 2.34.1
> 
> KVM neithers allow writing to MSR_IA32_APICBASE for TDs, nor allow for
> KVM_SET_LAPIC[*].
> 
> Note, KVM_GET_LAPIC is also disallowed for TDX. It is called in the path
> 
>   do_kvm_cpu_synchronize_state()
>   -> kvm_arch_get_registers()
>      -> kvm_get_apic()
> 
> and it's already disllowed for confidential guest through
> guest_state_protected.
> 
> [*] https://lore.kernel.org/all/Z3w4Ku4Jq0CrtXne@google.com/
> 
> Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
> ---
> Changes in v8:
> - Fix the coding style; (Francesco)
> ---
>  hw/i386/kvm/apic.c | 5 +++++
>  1 file changed, 5 insertions(+)

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>