From nobody Sat Apr 5 15:07:28 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass header.i=@intel.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1743515328; cv=none; d=zohomail.com; s=zohoarc; b=Sxy8Uo8LCLoRu3ojy7E1qLxfvIez8Xvp3vhRMTeLRna9MwUM2dEoGIxVoPIX4SndDRUa0mUkQRVf0VxFo8FKQ1pCMTW3kik0wbGoMsjDkQ51/Bsh9hXk0ECftLglm2T00PWMDfPoh3lB+eXoasgJ0aDsciVC54DxXeD26xLAMTM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1743515328; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=tul3Lx31VDwyrGM72ajii5fLj3RD5kpk024LmkNNSEA=; b=XfCkAzUDrvwvhyVWywj3O+yjDI6W7sXcu5vXOFexSrsaPjtAfiah9qo/BnWhY3C5qAlkAp/VO1BQdWHymFuD8tDQg2q79hWpSNEGHTf7yRuvd8UOZMFngaSVg0fE1/ywusBOGZCCO9z1vdo3dXXzTpRVKGSGYB2kZ6DAN+bGU2E= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=@intel.com; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1743515328274259.38164125733067; Tue, 1 Apr 2025 06:48:48 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1tzbyp-0005D1-7E; Tue, 01 Apr 2025 09:48:39 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1tzbul-00014d-Qu for qemu-devel@nongnu.org; Tue, 01 Apr 2025 09:44:29 -0400 Received: from mgamail.intel.com ([192.198.163.16]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1tzbui-0006ZP-J2 for qemu-devel@nongnu.org; Tue, 01 Apr 2025 09:44:27 -0400 Received: from fmviesa008.fm.intel.com ([10.60.135.148]) by fmvoesa110.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 01 Apr 2025 06:43:05 -0700 Received: from lxy-clx-4s.sh.intel.com ([10.239.48.52]) by fmviesa008.fm.intel.com with ESMTP; 01 Apr 2025 06:43:02 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1743515064; x=1775051064; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=dCqogoyYG6qGaIWRDdW3DG5t0kRWSGhPDSbOwdRrrSk=; b=bIuKlxho8NSsN48AFwJxC8DDpXXWeYFEl8gocjIjryfxe2iFMOh+/6h9 rtZzf5ii0AS6H4TDXhzWKPszvYEUvvIIuiUUBqbrKaTZcTP/IsUyJkBun QrD2oL8BWIxoRmvSKBP/uExLHKUpRfl4Uge6hs+t5QH59wxA2vRr1vUVX R8jeLEODGLGIxAVU3DbNbnv/wkWeLELwahXOaSX3SdcEwbMnYTbT8zpde T2kZU90cZNwy2sdxizL7eEW75L7ZgckdK8IOJNd1KR4p3yaTs/7gkmrpS T1QESSLvW601ppoAcDRi82l30rTmWB9Kyxt3YVEjb0A8JCMUlY4oVSv1h A==; X-CSE-ConnectionGUID: 2W1ZzjQESvG8OfNo+rFM/A== X-CSE-MsgGUID: ThBA7TLUT6+oEcuK24GHkw== X-IronPort-AV: E=McAfee;i="6700,10204,11391"; a="32433529" X-IronPort-AV: E=Sophos;i="6.14,293,1736841600"; d="scan'208";a="32433529" X-CSE-ConnectionGUID: cfaMfFdgQ5KpGkX2jBRt8g== X-CSE-MsgGUID: wMJvDbbhS+WP6gaC8mFz0A== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.14,293,1736841600"; d="scan'208";a="126640233" From: Xiaoyao Li To: Paolo Bonzini , =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Cc: "Michael S. Tsirkin" , Markus Armbruster , Francesco Lavra , Marcelo Tosatti , qemu-devel@nongnu.org, =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= , Rick Edgecombe , Xiaoyao Li Subject: [PATCH v8 45/55] i386/tdx: Add TDX fixed1 bits to supported CPUIDs Date: Tue, 1 Apr 2025 09:01:55 -0400 Message-Id: <20250401130205.2198253-46-xiaoyao.li@intel.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250401130205.2198253-1-xiaoyao.li@intel.com> References: <20250401130205.2198253-1-xiaoyao.li@intel.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=192.198.163.16; envelope-from=xiaoyao.li@intel.com; helo=mgamail.intel.com X-Spam_score_int: -43 X-Spam_score: -4.4 X-Spam_bar: ---- X-Spam_report: (-4.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.997, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HK_RANDOM_ENVFROM=0.001, HK_RANDOM_FROM=0.999, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED=0.001, RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @intel.com) X-ZM-MESSAGEID: 1743515330369019100 Content-Type: text/plain; charset="utf-8" TDX architecture forcibly sets some CPUID bits for TD guest that VMM cannot disable it. They are fixed1 bits. Fixed1 bits are not covered by tdx_caps.cpuid (which only contians the directly configurable bits), while fixed1 bits are supported for TD guest obviously. Add fixed1 bits to tdx_supported_cpuid. Besides, set all the fixed1 bits to the initial set of KVM's support since KVM might not report them as supported. Signed-off-by: Xiaoyao Li --- target/i386/cpu.h | 2 + target/i386/kvm/kvm_i386.h | 7 ++ target/i386/kvm/tdx.c | 132 +++++++++++++++++++++++++++++++++++++ target/i386/sev.c | 5 -- 4 files changed, 141 insertions(+), 5 deletions(-) diff --git a/target/i386/cpu.h b/target/i386/cpu.h index 42ef77789ded..115137279a1a 100644 --- a/target/i386/cpu.h +++ b/target/i386/cpu.h @@ -924,6 +924,8 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu= , FeatureWord w); #define CPUID_7_0_EDX_FSRM (1U << 4) /* AVX512 Vector Pair Intersection to a Pair of Mask Registers */ #define CPUID_7_0_EDX_AVX512_VP2INTERSECT (1U << 8) + /* "md_clear" VERW clears CPU buffers */ +#define CPUID_7_0_EDX_MD_CLEAR (1U << 10) /* SERIALIZE instruction */ #define CPUID_7_0_EDX_SERIALIZE (1U << 14) /* TSX Suspend Load Address Tracking instruction */ diff --git a/target/i386/kvm/kvm_i386.h b/target/i386/kvm/kvm_i386.h index 484a1de84d51..c1bafcfc9b63 100644 --- a/target/i386/kvm/kvm_i386.h +++ b/target/i386/kvm/kvm_i386.h @@ -13,8 +13,15 @@ =20 #include "system/kvm.h" =20 +#include + #define KVM_MAX_CPUID_ENTRIES 100 =20 +typedef struct KvmCpuidInfo { + struct kvm_cpuid2 cpuid; + struct kvm_cpuid_entry2 entries[KVM_MAX_CPUID_ENTRIES]; +} KvmCpuidInfo; + /* always false if !CONFIG_KVM */ #define kvm_pit_in_kernel() \ (kvm_irqchip_in_kernel() && !kvm_irqchip_is_split()) diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c index b9a96c2e392d..49a94d8ffe7d 100644 --- a/target/i386/kvm/tdx.c +++ b/target/i386/kvm/tdx.c @@ -369,6 +369,131 @@ static Notifier tdx_machine_done_notify =3D { .notify =3D tdx_finalize_vm, }; =20 +/* + * Some CPUID bits change from fixed1 to configurable bits when TDX module + * supports TDX_FEATURES0.VE_REDUCTION. e.g., MCA/MCE/MTRR/CORE_CAPABILITY. + * + * To make QEMU work with all the versions of TDX module, keep the fixed1 = bits + * here if they are ever fixed1 bits in any of the version though not fixe= d1 in + * the latest version. Otherwise, with the older version of TDX module, QE= MU may + * treat the fixed1 bit as unsupported. + * + * For newer TDX module, it does no harm to keep them in tdx_fixed1_bits e= ven + * though they changed to configurable bits. Because tdx_fixed1_bits is us= ed to + * setup the supported bits. + */ +KvmCpuidInfo tdx_fixed1_bits =3D { + .cpuid.nent =3D 8, + .entries[0] =3D { + .function =3D 0x1, + .index =3D 0, + .ecx =3D CPUID_EXT_SSE3 | CPUID_EXT_PCLMULQDQ | CPUID_EXT_DTES64 | + CPUID_EXT_DSCPL | CPUID_EXT_SSSE3 | CPUID_EXT_CX16 | + CPUID_EXT_PDCM | CPUID_EXT_PCID | CPUID_EXT_SSE41 | + CPUID_EXT_SSE42 | CPUID_EXT_X2APIC | CPUID_EXT_MOVBE | + CPUID_EXT_POPCNT | CPUID_EXT_AES | CPUID_EXT_XSAVE | + CPUID_EXT_RDRAND | CPUID_EXT_HYPERVISOR, + .edx =3D CPUID_FP87 | CPUID_VME | CPUID_DE | CPUID_PSE | CPUID_TSC= | + CPUID_MSR | CPUID_PAE | CPUID_MCE | CPUID_CX8 | CPUID_APIC | + CPUID_SEP | CPUID_MTRR | CPUID_PGE | CPUID_MCA | CPUID_CMOV= | + CPUID_PAT | CPUID_CLFLUSH | CPUID_DTS | CPUID_MMX | CPUID_F= XSR | + CPUID_SSE | CPUID_SSE2, + }, + .entries[1] =3D { + .function =3D 0x6, + .index =3D 0, + .eax =3D CPUID_6_EAX_ARAT, + }, + .entries[2] =3D { + .function =3D 0x7, + .index =3D 0, + .flags =3D KVM_CPUID_FLAG_SIGNIFCANT_INDEX, + .ebx =3D CPUID_7_0_EBX_FSGSBASE | CPUID_7_0_EBX_FDP_EXCPTN_ONLY | + CPUID_7_0_EBX_SMEP | CPUID_7_0_EBX_INVPCID | + CPUID_7_0_EBX_ZERO_FCS_FDS | CPUID_7_0_EBX_RDSEED | + CPUID_7_0_EBX_SMAP | CPUID_7_0_EBX_CLFLUSHOPT | + CPUID_7_0_EBX_CLWB | CPUID_7_0_EBX_SHA_NI, + .ecx =3D CPUID_7_0_ECX_BUS_LOCK_DETECT | CPUID_7_0_ECX_MOVDIRI | + CPUID_7_0_ECX_MOVDIR64B, + .edx =3D CPUID_7_0_EDX_MD_CLEAR | CPUID_7_0_EDX_SPEC_CTRL | + CPUID_7_0_EDX_STIBP | CPUID_7_0_EDX_FLUSH_L1D | + CPUID_7_0_EDX_ARCH_CAPABILITIES | CPUID_7_0_EDX_CORE_CAPABI= LITY | + CPUID_7_0_EDX_SPEC_CTRL_SSBD, + }, + .entries[3] =3D { + .function =3D 0x7, + .index =3D 2, + .flags =3D KVM_CPUID_FLAG_SIGNIFCANT_INDEX, + .edx =3D (1U << 0) | (1U << 1) | (1U << 2) | (1U << 4), + }, + .entries[4] =3D { + .function =3D 0xD, + .index =3D 0, + .flags =3D KVM_CPUID_FLAG_SIGNIFCANT_INDEX, + .eax =3D XSTATE_FP_MASK | XSTATE_SSE_MASK, + }, + .entries[5] =3D { + .function =3D 0xD, + .index =3D 1, + .flags =3D KVM_CPUID_FLAG_SIGNIFCANT_INDEX, + .eax =3D CPUID_XSAVE_XSAVEOPT | CPUID_XSAVE_XSAVEC| + CPUID_XSAVE_XGETBV1 | CPUID_XSAVE_XSAVES, + }, + .entries[6] =3D { + .function =3D 0x80000001, + .index =3D 0, + .ecx =3D CPUID_EXT3_LAHF_LM | CPUID_EXT3_ABM | CPUID_EXT3_3DNOWPRE= FETCH, + /* strictly speaking, SYSCALL is not fixed1 bit since it depends on + * the CPU to be in 64-bit mode. But here fixed1 is used to serve = the + * purpose of supported bits for TDX. In this sense, SYACALL is al= ways + * supported. + */ + .edx =3D CPUID_EXT2_SYSCALL | CPUID_EXT2_NX | CPUID_EXT2_PDPE1GB | + CPUID_EXT2_RDTSCP | CPUID_EXT2_LM, + }, + .entries[7] =3D { + .function =3D 0x80000007, + .index =3D 0, + .edx =3D CPUID_APM_INVTSC, + }, +}; + +static struct kvm_cpuid_entry2 *find_in_supported_entry(uint32_t function, + uint32_t index) +{ + struct kvm_cpuid_entry2 *e; + + e =3D cpuid_find_entry(tdx_supported_cpuid, function, index); + if (!e) { + if (tdx_supported_cpuid->nent >=3D KVM_MAX_CPUID_ENTRIES) { + error_report("tdx_supported_cpuid requries more space than %d = entries", + KVM_MAX_CPUID_ENTRIES); + exit(1); + } + e =3D &tdx_supported_cpuid->entries[tdx_supported_cpuid->nent++]; + e->function =3D function; + e->index =3D index; + } + + return e; +} + +static void tdx_add_supported_cpuid_by_fixed1_bits(void) +{ + struct kvm_cpuid_entry2 *e, *e1; + int i; + + for (i =3D 0; i < tdx_fixed1_bits.cpuid.nent; i++) { + e =3D &tdx_fixed1_bits.entries[i]; + + e1 =3D find_in_supported_entry(e->function, e->index); + e1->eax |=3D e->eax; + e1->ebx |=3D e->ebx; + e1->ecx |=3D e->ecx; + e1->edx |=3D e->edx; + } +} + static void tdx_setup_supported_cpuid(void) { if (tdx_supported_cpuid) { @@ -381,6 +506,8 @@ static void tdx_setup_supported_cpuid(void) memcpy(tdx_supported_cpuid->entries, tdx_caps->cpuid.entries, tdx_caps->cpuid.nent * sizeof(struct kvm_cpuid_entry2)); tdx_supported_cpuid->nent =3D tdx_caps->cpuid.nent; + + tdx_add_supported_cpuid_by_fixed1_bits(); } =20 static int tdx_kvm_init(ConfidentialGuestSupport *cgs, Error **errp) @@ -465,6 +592,11 @@ static uint32_t tdx_adjust_cpuid_features(X86Confident= ialGuest *cg, { struct kvm_cpuid_entry2 *e; =20 + e =3D cpuid_find_entry(&tdx_fixed1_bits.cpuid, feature, index); + if (e) { + value |=3D cpuid_entry_get_reg(e, reg); + } + if (is_feature_word_cpuid(feature, index, reg)) { e =3D cpuid_find_entry(tdx_supported_cpuid, feature, index); if (e) { diff --git a/target/i386/sev.c b/target/i386/sev.c index a6c0a697250b..217b19ad7bc6 100644 --- a/target/i386/sev.c +++ b/target/i386/sev.c @@ -214,11 +214,6 @@ static const char *const sev_fw_errlist[] =3D { /* doesn't expose this, so re-use the max from kvm.c */ #define KVM_MAX_CPUID_ENTRIES 100 =20 -typedef struct KvmCpuidInfo { - struct kvm_cpuid2 cpuid; - struct kvm_cpuid_entry2 entries[KVM_MAX_CPUID_ENTRIES]; -} KvmCpuidInfo; - #define SNP_CPUID_FUNCTION_MAXCOUNT 64 #define SNP_CPUID_FUNCTION_UNKNOWN 0xFFFFFFFF =20 --=20 2.34.1