vvmx: Reinject L2 TDX exit reasons to L1 instead of crashing L1

[RFC PATCH 0/2] vvmx: Reinject L2 TDX exit reasons to L1 instead of crashing L1

Teddy Astie posted 2 patches 1 week, 1 day ago

Download series mbox

Patches applied successfully (tree, apply log)
git fetch https://gitlab.com/xen-project/patchew/xen tags/patchew/1784122772.8631fc262581453bbf619ec5b2062170.19f66010afa000edb5@vates.tech

xen/arch/x86/hvm/vmx/vvmx.c            | 2 ++
xen/arch/x86/include/asm/hvm/vmx/vmx.h | 2 ++
xen/arch/x86/include/asm/perfc_defn.h  | 2 +-
3 files changed, 5 insertions(+), 1 deletion(-)

Expand all Fold all

[RFC PATCH 0/2] vvmx: Reinject L2 TDX exit reasons to L1 instead of crashing L1

Posted by Teddy Astie 1 week, 1 day ago

On hardware that support TDX, guests performing SEAMCALL or TDCALL causes a
VMEXIT(SEAMCALL) or VMEXIT(TDCALL) regardless of VMCS configuration (there
is no flag to opt-out these VMEXIT).

This instruction can only be called in a guest with CPL = 0 [1], thus it cannot be
leveraged from guest userland to crash the entire guest. However, it can still be
used by a L2 guest kernel space to crash the L1 as such exit reason is unhandled
which defaults to crashing the entire domain.

RFC: I don't have access to hardware that supports TDX to test it; and I'm not
sure this is enough given that some other instructions may exhibit similar
issues; but these 2 ones in particular don't seem to have a opt-out.

[1] https://lore.kernel.org/all/20251016182148.69085-2-seanjc@google.com/

Teddy Astie (2):
  vmx: Introduce TDX instruction exit reasons
  vvmx: Reinject TDX instruction exit reasons to L1 when emitted by L2

 xen/arch/x86/hvm/vmx/vvmx.c            | 2 ++
 xen/arch/x86/include/asm/hvm/vmx/vmx.h | 2 ++
 xen/arch/x86/include/asm/perfc_defn.h  | 2 +-
 3 files changed, 5 insertions(+), 1 deletion(-)

-- 
2.54.0



-- 
 | Vates 

XCP-ng & Xen Orchestra - Vates solutions

web: https://vates.tech