From nobody Thu Dec 18 02:17:59 2025 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9754B218AAD for ; Thu, 20 Feb 2025 17:06:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740071201; cv=none; b=DUWOO4QSC9dYn7siOFeA4FaUtL5G8faek8kEd2Z5zXiR/LBFObCyxbVwPg7JZCKtu4qOh6YE5i8s4lY13Y5Z7oKZ4EZiXraST3Pf77cmissWhMnB590jIhVuADnd8N1VHa9izpw0rCQ1NreiWYSEsEePEbzlFXi+RAcx1yNtyTI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740071201; c=relaxed/simple; bh=HbWCV+mETAHWTKHHBWZkcZUlSZ1oSOoV/q0RgCTLReg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=t/O4zTVQC+Rq1gZE/VbSLYFDumaZnzeAlC1POdCtmyI4pGn5H+OYqRS6eGVDrooyfQ8oc4jEY0D8hA1y1fR4l3JC25iAEzeayy/OT5Zna1NmGzGxVjiJzR3BIlGHm7mOj11pVGjj24S+dZuMbL6okcXzSOpdVBVfif4aPy2JryU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=Ri9Bl5Ry; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="Ri9Bl5Ry" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1740071198; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=hq1OkvKb2vekpPdZQfh7i/EWk4fkjhdAozs6dxCFkao=; b=Ri9Bl5RynnNOKK+KFpDFlVy7bmFgHnA3pzHMCj/3Ro3xCqVddk0+uzcvAvhciNAXpgGzr5 Eo5WN9IVBY9mVSHyXJ30LCJQJcLYTP08CqscBPnX5RC3w5Qr5tvCKc2U6WQtW39ZwfMPDH GgaB2shh+Pnt90Y3Asepx0E7BlJ3fVM= Received: from mx-prod-mc-02.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-679-cjY7w19INPKFo5KBJuPaZQ-1; Thu, 20 Feb 2025 12:06:36 -0500 X-MC-Unique: cjY7w19INPKFo5KBJuPaZQ-1 X-Mimecast-MFC-AGG-ID: cjY7w19INPKFo5KBJuPaZQ_1740071195 Received: from mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.93]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-02.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 3340B18EAB38; Thu, 20 Feb 2025 17:06:35 +0000 (UTC) Received: from virtlab1023.lab.eng.rdu2.redhat.com (virtlab1023.lab.eng.rdu2.redhat.com [10.8.1.187]) by mx-prod-int-06.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id DB70B1800D9E; Thu, 20 Feb 2025 17:06:33 +0000 (UTC) From: Paolo Bonzini To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: seanjc@google.com, Yan Zhao , Rick Edgecombe , Isaku Yamahata , Xiaoyao Li , Tony Lindgren , Binbin Wu Subject: [PATCH 19/30] KVM: TDX: Get system-wide info about TDX module on initialization Date: Thu, 20 Feb 2025 12:05:53 -0500 Message-ID: <20250220170604.2279312-20-pbonzini@redhat.com> In-Reply-To: <20250220170604.2279312-1-pbonzini@redhat.com> References: <20250220170604.2279312-1-pbonzini@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.93 Content-Type: text/plain; charset="utf-8" From: Isaku Yamahata TDX KVM needs system-wide information about the TDX module. Generate the data based on tdx_sysinfo td_conf CPUID data. Signed-off-by: Isaku Yamahata Co-developed-by: Xiaoyao Li Signed-off-by: Xiaoyao Li Co-developed-by: Tony Lindgren Signed-off-by: Tony Lindgren Signed-off-by: Rick Edgecombe Reviewed-by: Binbin Wu --- - Clarify comment about EAX[23:16] in td_init_cpuid_entry2() (Xiaoyao) - Add comment for configurable CPUID bits (Xiaoyao) Signed-off-by: Paolo Bonzini --- arch/x86/include/uapi/asm/kvm.h | 11 +++ arch/x86/kvm/vmx/tdx.c | 137 ++++++++++++++++++++++++++++++++ arch/x86/kvm/vmx/tdx_arch.h | 2 + 3 files changed, 150 insertions(+) diff --git a/arch/x86/include/uapi/asm/kvm.h b/arch/x86/include/uapi/asm/kv= m.h index 2b0317b47e47..8a4633cdb247 100644 --- a/arch/x86/include/uapi/asm/kvm.h +++ b/arch/x86/include/uapi/asm/kvm.h @@ -929,6 +929,8 @@ struct kvm_hyperv_eventfd { =20 /* Trust Domain eXtension sub-ioctl() commands. */ enum kvm_tdx_cmd_id { + KVM_TDX_CAPABILITIES =3D 0, + KVM_TDX_CMD_NR_MAX, }; =20 @@ -950,4 +952,13 @@ struct kvm_tdx_cmd { __u64 hw_error; }; =20 +struct kvm_tdx_capabilities { + __u64 supported_attrs; + __u64 supported_xfam; + __u64 reserved[254]; + + /* Configurable CPUID bits for userspace */ + struct kvm_cpuid2 cpuid; +}; + #endif /* _ASM_X86_KVM_H */ diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c index 08880ac9c77b..630d19114429 100644 --- a/arch/x86/kvm/vmx/tdx.c +++ b/arch/x86/kvm/vmx/tdx.c @@ -33,6 +33,8 @@ static enum cpuhp_state tdx_cpuhp_state; =20 static const struct tdx_sys_info *tdx_sysinfo; =20 +#define KVM_SUPPORTED_TD_ATTRS (TDX_TD_ATTR_SEPT_VE_DISABLE) + static __always_inline struct kvm_tdx *to_kvm_tdx(struct kvm *kvm) { return container_of(kvm, struct kvm_tdx, kvm); @@ -43,6 +45,129 @@ static __always_inline struct vcpu_tdx *to_tdx(struct k= vm_vcpu *vcpu) return container_of(vcpu, struct vcpu_tdx, vcpu); } =20 +static u64 tdx_get_supported_attrs(const struct tdx_sys_info_td_conf *td_c= onf) +{ + u64 val =3D KVM_SUPPORTED_TD_ATTRS; + + if ((val & td_conf->attributes_fixed1) !=3D td_conf->attributes_fixed1) + return 0; + + val &=3D td_conf->attributes_fixed0; + + return val; +} + +static u64 tdx_get_supported_xfam(const struct tdx_sys_info_td_conf *td_co= nf) +{ + u64 val =3D kvm_caps.supported_xcr0 | kvm_caps.supported_xss; + + if ((val & td_conf->xfam_fixed1) !=3D td_conf->xfam_fixed1) + return 0; + + val &=3D td_conf->xfam_fixed0; + + return val; +} + +static u32 tdx_set_guest_phys_addr_bits(const u32 eax, int addr_bits) +{ + return (eax & ~GENMASK(23, 16)) | (addr_bits & 0xff) << 16; +} + +#define KVM_TDX_CPUID_NO_SUBLEAF ((__u32)-1) + +static void td_init_cpuid_entry2(struct kvm_cpuid_entry2 *entry, unsigned = char idx) +{ + const struct tdx_sys_info_td_conf *td_conf =3D &tdx_sysinfo->td_conf; + + entry->function =3D (u32)td_conf->cpuid_config_leaves[idx]; + entry->index =3D td_conf->cpuid_config_leaves[idx] >> 32; + entry->eax =3D (u32)td_conf->cpuid_config_values[idx][0]; + entry->ebx =3D td_conf->cpuid_config_values[idx][0] >> 32; + entry->ecx =3D (u32)td_conf->cpuid_config_values[idx][1]; + entry->edx =3D td_conf->cpuid_config_values[idx][1] >> 32; + + if (entry->index =3D=3D KVM_TDX_CPUID_NO_SUBLEAF) + entry->index =3D 0; + + /* + * The TDX module doesn't allow configuring the guest phys addr bits + * (EAX[23:16]). However, KVM uses it as an interface to the userspace + * to configure the GPAW. Report these bits as configurable. + */ + if (entry->function =3D=3D 0x80000008) + entry->eax =3D tdx_set_guest_phys_addr_bits(entry->eax, 0xff); +} + +static int init_kvm_tdx_caps(const struct tdx_sys_info_td_conf *td_conf, + struct kvm_tdx_capabilities *caps) +{ + int i; + + caps->supported_attrs =3D tdx_get_supported_attrs(td_conf); + if (!caps->supported_attrs) + return -EIO; + + caps->supported_xfam =3D tdx_get_supported_xfam(td_conf); + if (!caps->supported_xfam) + return -EIO; + + caps->cpuid.nent =3D td_conf->num_cpuid_config; + + for (i =3D 0; i < td_conf->num_cpuid_config; i++) + td_init_cpuid_entry2(&caps->cpuid.entries[i], i); + + return 0; +} + +static int tdx_get_capabilities(struct kvm_tdx_cmd *cmd) +{ + const struct tdx_sys_info_td_conf *td_conf =3D &tdx_sysinfo->td_conf; + struct kvm_tdx_capabilities __user *user_caps; + struct kvm_tdx_capabilities *caps =3D NULL; + int ret =3D 0; + + /* flags is reserved for future use */ + if (cmd->flags) + return -EINVAL; + + caps =3D kmalloc(sizeof(*caps) + + sizeof(struct kvm_cpuid_entry2) * td_conf->num_cpuid_config, + GFP_KERNEL); + if (!caps) + return -ENOMEM; + + user_caps =3D u64_to_user_ptr(cmd->data); + if (copy_from_user(caps, user_caps, sizeof(*caps))) { + ret =3D -EFAULT; + goto out; + } + + if (caps->cpuid.nent < td_conf->num_cpuid_config) { + ret =3D -E2BIG; + goto out; + } + + ret =3D init_kvm_tdx_caps(td_conf, caps); + if (ret) + goto out; + + if (copy_to_user(user_caps, caps, sizeof(*caps))) { + ret =3D -EFAULT; + goto out; + } + + if (copy_to_user(user_caps->cpuid.entries, caps->cpuid.entries, + caps->cpuid.nent * + sizeof(caps->cpuid.entries[0]))) + ret =3D -EFAULT; + +out: + /* kfree() accepts NULL. */ + kfree(caps); + return ret; +} + int tdx_vm_ioctl(struct kvm *kvm, void __user *argp) { struct kvm_tdx_cmd tdx_cmd; @@ -61,6 +186,9 @@ int tdx_vm_ioctl(struct kvm *kvm, void __user *argp) mutex_lock(&kvm->lock); =20 switch (tdx_cmd.id) { + case KVM_TDX_CAPABILITIES: + r =3D tdx_get_capabilities(&tdx_cmd); + break; default: r =3D -EINVAL; goto out; @@ -158,11 +286,20 @@ static int __init __tdx_bringup(void) goto get_sysinfo_err; } =20 + /* Check TDX module and KVM capabilities */ + if (!tdx_get_supported_attrs(&tdx_sysinfo->td_conf) || + !tdx_get_supported_xfam(&tdx_sysinfo->td_conf)) + goto get_sysinfo_err; + + if (!(tdx_sysinfo->features.tdx_features0 & MD_FIELD_ID_FEATURES0_TOPOLOG= Y_ENUM)) + goto get_sysinfo_err; + /* * Leave hardware virtualization enabled after TDX is enabled * successfully. TDX CPU hotplug depends on this. */ return 0; + get_sysinfo_err: __do_tdx_cleanup(); tdx_bringup_err: diff --git a/arch/x86/kvm/vmx/tdx_arch.h b/arch/x86/kvm/vmx/tdx_arch.h index fb7abe9fef8e..cb9a638fa398 100644 --- a/arch/x86/kvm/vmx/tdx_arch.h +++ b/arch/x86/kvm/vmx/tdx_arch.h @@ -120,4 +120,6 @@ struct td_params { #define TDX_MIN_TSC_FREQUENCY_KHZ (100 * 1000) #define TDX_MAX_TSC_FREQUENCY_KHZ (10 * 1000 * 1000) =20 +#define MD_FIELD_ID_FEATURES0_TOPOLOGY_ENUM BIT_ULL(20) + #endif /* __KVM_X86_TDX_ARCH_H */ --=20 2.43.5