From nobody Fri Nov 22 21:07:03 2024 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 15DD5192B94; Fri, 15 Nov 2024 09:52:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.17 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1731664378; cv=none; b=hzIaYKgbOYCQqO3XK2h7TGkAtZM2UVZWNRQyvx6GPCw9DJVjYMYCkb4/p2PBAwkUTKzWg36xTWqAdx55FpocxqjXICFXs3eTx1PAKjm3wKaEOv/AlPCpstpOquv56uunSgIY4ei9NgPq33S3gGPTTNsNe0F3N7DWIXzQykz1KGE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1731664378; c=relaxed/simple; bh=PSJADArL2xWR+olfNc+CrrgxOkgymj6N08p3mFqLcaY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Z/RsNHSL2PADk+n5rX5ubKEU8DGPLknx5cvH14n3HX+mgmd1ODjezT5Escc+ZczNTXO2FP9B8qHRA1kkEITMqrculYMrwWE+PUN3PmmV4e7eyIkWiVkYqCwvK4l7YSbjr379tKE3cy2b/yoQo+yaVLs6UKv2fGCfyN40SgApf+k= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=Pn46ug84; arc=none smtp.client-ip=192.198.163.17 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="Pn46ug84" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1731664376; x=1763200376; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=PSJADArL2xWR+olfNc+CrrgxOkgymj6N08p3mFqLcaY=; b=Pn46ug84Ey3s1fa+1pQzf2oBq2kxUJbfie0MJT8RVi0P0XLfEsNGsQhe w5vCWHfJXJl3CZcrb08kbzlWQWi4i7sSoavQRc0XifQj6sMgWh8UH69sG av6nE1wpXgaxZhqYvNxFKL8YXUlYm/t+UAv8OuVw3C7KUFcLXKdKpa816 o5162/20ujapXvz2PClAaWQdA5Xy+BK3lwEvs3ggfwBlHwaV1CrsClo58 NfUT+sAg+AORB6ZKf2wpHHv4xsjIVVrMo2TdKIIXqLaC5K8nPu6OqCS4c nbuIcaxyYkOkZiL3vTAQUCjREYbGxiK986eqv1TA2aX414u55xDiAHx9k Q==; X-CSE-ConnectionGUID: dzCKf06eRtCVbXHq0xPEcg== X-CSE-MsgGUID: cvmv+i4vT/aMDi0IC3eueg== X-IronPort-AV: E=McAfee;i="6700,10204,11256"; a="31584836" X-IronPort-AV: E=Sophos;i="6.12,156,1728975600"; d="scan'208";a="31584836" Received: from orviesa004.jf.intel.com ([10.64.159.144]) by fmvoesa111.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 15 Nov 2024 01:52:56 -0800 X-CSE-ConnectionGUID: d75CrdAvQ96AUBNvfR2M6g== X-CSE-MsgGUID: NLG4yQxqTDuDslm7hWGa0Q== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.12,156,1728975600"; d="scan'208";a="93584315" Received: from kinlongk-mobl1.amr.corp.intel.com (HELO khuang2-desk.gar.corp.intel.com) ([10.124.221.135]) by orviesa004-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 15 Nov 2024 01:52:53 -0800 From: Kai Huang To: pbonzini@redhat.com, seanjc@google.com Cc: kvm@vger.kernel.org, rick.p.edgecombe@intel.com, isaku.yamahata@intel.com, reinette.chatre@intel.com, binbin.wu@linux.intel.com, xiaoyao.li@intel.com, yan.y.zhao@intel.com, adrian.hunter@intel.com, tony.lindgren@intel.com, kristen@linux.intel.com, linux-kernel@vger.kernel.org Subject: [PATCH v2 1/3] KVM: VMX: Refactor VMX module init/exit functions Date: Fri, 15 Nov 2024 22:52:39 +1300 Message-ID: <3f23f24098bdcf42e213798893ffff7cdc7103be.1731664295.git.kai.huang@intel.com> X-Mailer: git-send-email 2.46.2 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Add vt_init() and vt_exit() as the new module init/exit functions and refactor existing vmx_init()/vmx_exit() as helper to make room for TDX specific initialization and teardown. To support TDX, KVM will need to enable TDX during KVM module loading time. Enabling TDX requires enabling hardware virtualization first so that all online CPUs (and the new CPU going online) are in post-VMXON state. Currently, the vmx_init() flow is: 1) hv_init_evmcs(), 2) kvm_x86_vendor_init(), 3) Other VMX specific initialization, 4) kvm_init() The kvm_x86_vendor_init() invokes kvm_x86_init_ops::hardware_setup() to do VMX specific hardware setup and calls kvm_update_ops() to initialize kvm_x86_ops to VMX's version. TDX will have its own version for most of kvm_x86_ops callbacks. It would be nice if kvm_x86_init_ops::hardware_setup() could also be used for TDX, but in practice it cannot. The reason is, as mentioned above, TDX initialization requires hardware virtualization having been enabled, which must happen after kvm_update_ops(), but hardware_setup() is done before that. Also, TDX is based on VMX, and it makes sense to only initialize TDX after VMX has been initialized. If VMX fails to initialize, TDX is likely broken anyway. So the new flow of KVM module init function will be: 1) Current VMX initialization code in vmx_init() before kvm_init(), 2) TDX initialization, 3) kvm_init() Split vmx_init() into two parts based on above 1) and 3) so that TDX initialization can fit in between. Make part 1) as the new helper vmx_init(). Introduce vt_init() as the new module init function which calls vmx_init() and kvm_init(). TDX initialization will be added later. Do the same thing for vmx_exit()/vt_exit(). Signed-off-by: Kai Huang --- arch/x86/kvm/vmx/main.c | 32 ++++++++++++++++++++++++++++++++ arch/x86/kvm/vmx/vmx.c | 23 ++--------------------- arch/x86/kvm/vmx/vmx.h | 3 +++ 3 files changed, 37 insertions(+), 21 deletions(-) diff --git a/arch/x86/kvm/vmx/main.c b/arch/x86/kvm/vmx/main.c index 92d35cc6cd15..6772e560ac7b 100644 --- a/arch/x86/kvm/vmx/main.c +++ b/arch/x86/kvm/vmx/main.c @@ -167,3 +167,35 @@ struct kvm_x86_init_ops vt_init_ops __initdata =3D { .runtime_ops =3D &vt_x86_ops, .pmu_ops =3D &intel_pmu_ops, }; + +static void vt_exit(void) +{ + kvm_exit(); + vmx_exit(); +} +module_exit(vt_exit); + +static int __init vt_init(void) +{ + int r; + + r =3D vmx_init(); + if (r) + return r; + + /* + * Common KVM initialization _must_ come last, after this, /dev/kvm is + * exposed to userspace! + */ + r =3D kvm_init(sizeof(struct vcpu_vmx), __alignof__(struct vcpu_vmx), + THIS_MODULE); + if (r) + goto err_kvm_init; + + return 0; + +err_kvm_init: + vmx_exit(); + return r; +} +module_init(vt_init); diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index 0f008f5ef6f0..90d8d86ba355 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -8602,23 +8602,16 @@ static void vmx_cleanup_l1d_flush(void) l1tf_vmx_mitigation =3D VMENTER_L1D_FLUSH_AUTO; } =20 -static void __vmx_exit(void) +void vmx_exit(void) { allow_smaller_maxphyaddr =3D false; =20 vmx_cleanup_l1d_flush(); -} =20 -static void vmx_exit(void) -{ - kvm_exit(); - __vmx_exit(); kvm_x86_vendor_exit(); - } -module_exit(vmx_exit); =20 -static int __init vmx_init(void) +int __init vmx_init(void) { int r, cpu; =20 @@ -8662,21 +8655,9 @@ static int __init vmx_init(void) if (!enable_ept) allow_smaller_maxphyaddr =3D true; =20 - /* - * Common KVM initialization _must_ come last, after this, /dev/kvm is - * exposed to userspace! - */ - r =3D kvm_init(sizeof(struct vcpu_vmx), __alignof__(struct vcpu_vmx), - THIS_MODULE); - if (r) - goto err_kvm_init; - return 0; =20 -err_kvm_init: - __vmx_exit(); err_l1d_flush: kvm_x86_vendor_exit(); return r; } -module_init(vmx_init); diff --git a/arch/x86/kvm/vmx/vmx.h b/arch/x86/kvm/vmx/vmx.h index 43f573f6ca46..1813caac1cea 100644 --- a/arch/x86/kvm/vmx/vmx.h +++ b/arch/x86/kvm/vmx/vmx.h @@ -756,4 +756,7 @@ static inline void vmx_segment_cache_clear(struct vcpu_= vmx *vmx) vmx->segment_cache.bitmask =3D 0; } =20 +int vmx_init(void); +void vmx_exit(void); + #endif /* __KVM_X86_VMX_H */ --=20 2.46.2 From nobody Fri Nov 22 21:07:03 2024 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0141C199921; Fri, 15 Nov 2024 09:52:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.17 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1731664380; cv=none; b=oneVclyd7UD2g6wLECAEdpZPPcgc+e8CXc8+aiW10S8NKvPjwY2odM/kLBztnptz3PZuvV8HUZeWe+bAioo6nGSy4b0lUqYkDpYn8Hb79G476r1hmKtStUn/wGjbhFFI5woOoGTRGQ6A7T+CdlYP1aMVDCKeEKsWJEz7UZr1XH8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1731664380; c=relaxed/simple; bh=JuKSfw+R0jUAZ+TWdRzjTinnZdSmStvT5RhNMySiuNA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=MacfgzKrYJ6Ngrxln4RgUFcDA8iDFTGrsjY5+6VQiRYQ1YezsK0mv/dWlYjJFQCRVdmqxGamgw6SYIpbCpTtNODK6NT3KTdQ3x3EQBXjJtWBD8a0/2YIYSGpYMfhqNsr7HmGgZCt4FAjeoPFR34/lY2UQLyUsOEnFM57nKC+R+0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=Qesv9QrJ; arc=none smtp.client-ip=192.198.163.17 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="Qesv9QrJ" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1731664379; x=1763200379; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=JuKSfw+R0jUAZ+TWdRzjTinnZdSmStvT5RhNMySiuNA=; b=Qesv9QrJErhzPOMEFn9fB8x4YV78jfCJkMHQuNZd8ENAkQ4lLGwy715Q yln6h6UDXrTN8EG+DZ8HT28rATORY+kUKRENGO4bssCi7Y4fjwyMNnenU WAfzaUdv7N+qHIfFI6gDTeAVJv2UmwrJMHMv6HjMZeQdz33ezG6sfJiUA D/XuaZsWRGtCah38mkL7LXwmAQWE9stAaaWj109vdxYodfdt7ktE4F0PD 32012zeVF90N//SNA1qBrYGGy9KO7DgQnst/c/TNs+JvQJKSEA/czz3Rs vv0reAFcJ/PvSdtTF8vOmpTrkSR18SI6xEzmDxAfe+fKYYHzH0OiR2Kr/ A==; X-CSE-ConnectionGUID: aLH8lz7LQCyaxJ4Pzedvcg== X-CSE-MsgGUID: EUru0IRWTWuYenyGocLtiw== X-IronPort-AV: E=McAfee;i="6700,10204,11256"; a="31584842" X-IronPort-AV: E=Sophos;i="6.12,156,1728975600"; d="scan'208";a="31584842" Received: from orviesa004.jf.intel.com ([10.64.159.144]) by fmvoesa111.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 15 Nov 2024 01:52:59 -0800 X-CSE-ConnectionGUID: agMgbAkRTIqhvXfdgoRy2g== X-CSE-MsgGUID: DX9iS7iOTEKTzkhkvZ8PHQ== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.12,156,1728975600"; d="scan'208";a="93584337" Received: from kinlongk-mobl1.amr.corp.intel.com (HELO khuang2-desk.gar.corp.intel.com) ([10.124.221.135]) by orviesa004-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 15 Nov 2024 01:52:56 -0800 From: Kai Huang To: pbonzini@redhat.com, seanjc@google.com Cc: kvm@vger.kernel.org, rick.p.edgecombe@intel.com, isaku.yamahata@intel.com, reinette.chatre@intel.com, binbin.wu@linux.intel.com, xiaoyao.li@intel.com, yan.y.zhao@intel.com, adrian.hunter@intel.com, tony.lindgren@intel.com, kristen@linux.intel.com, linux-kernel@vger.kernel.org Subject: [PATCH v2 2/3] KVM: Export hardware virtualization enabling/disabling functions Date: Fri, 15 Nov 2024 22:52:40 +1300 Message-ID: X-Mailer: git-send-email 2.46.2 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" To support TDX, KVM will need to enable TDX during KVM module loading time. Enabling TDX requires enabling hardware virtualization first so that all online CPUs (and the new CPU going online) are in post-VMXON state. KVM by default enables hardware virtualization but that is done in kvm_init(), which must be the last step after all initialization is done thus is too late for enabling TDX. Export functions to enable/disable hardware virtualization so that TDX code can use them to handle hardware virtualization enabling before kvm_init(). Signed-off-by: Kai Huang --- include/linux/kvm_host.h | 8 ++++++++ virt/kvm/kvm_main.c | 18 ++++-------------- 2 files changed, 12 insertions(+), 14 deletions(-) diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h index 401439bb21e3..6bb564c976e8 100644 --- a/include/linux/kvm_host.h +++ b/include/linux/kvm_host.h @@ -2553,4 +2553,12 @@ long kvm_arch_vcpu_pre_fault_memory(struct kvm_vcpu = *vcpu, struct kvm_pre_fault_memory *range); #endif =20 +#ifdef CONFIG_KVM_GENERIC_HARDWARE_ENABLING +int kvm_enable_virtualization(void); +void kvm_disable_virtualization(void); +#else +static inline int kvm_enable_virtualization(void) { return 0; } +static inline void kvm_disable_virtualization(void) { } +#endif + #endif diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index 22c145a99efe..e625e43c15c9 100644 --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -143,8 +143,6 @@ static int kvm_no_compat_open(struct inode *inode, stru= ct file *file) #define KVM_COMPAT(c) .compat_ioctl =3D kvm_no_compat_ioctl, \ .open =3D kvm_no_compat_open #endif -static int kvm_enable_virtualization(void); -static void kvm_disable_virtualization(void); =20 static void kvm_io_bus_destroy(struct kvm_io_bus *bus); =20 @@ -5538,7 +5536,7 @@ static struct syscore_ops kvm_syscore_ops =3D { .shutdown =3D kvm_shutdown, }; =20 -static int kvm_enable_virtualization(void) +int kvm_enable_virtualization(void) { int r; =20 @@ -5583,8 +5581,9 @@ static int kvm_enable_virtualization(void) --kvm_usage_count; return r; } +EXPORT_SYMBOL_GPL(kvm_enable_virtualization); =20 -static void kvm_disable_virtualization(void) +void kvm_disable_virtualization(void) { guard(mutex)(&kvm_usage_lock); =20 @@ -5595,6 +5594,7 @@ static void kvm_disable_virtualization(void) cpuhp_remove_state(CPUHP_AP_KVM_ONLINE); kvm_arch_disable_virtualization(); } +EXPORT_SYMBOL_GPL(kvm_disable_virtualization); =20 static int kvm_init_virtualization(void) { @@ -5610,21 +5610,11 @@ static void kvm_uninit_virtualization(void) kvm_disable_virtualization(); } #else /* CONFIG_KVM_GENERIC_HARDWARE_ENABLING */ -static int kvm_enable_virtualization(void) -{ - return 0; -} - static int kvm_init_virtualization(void) { return 0; } =20 -static void kvm_disable_virtualization(void) -{ - -} - static void kvm_uninit_virtualization(void) { =20 --=20 2.46.2 From nobody Fri Nov 22 21:07:03 2024 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5BB6F1AAE23; Fri, 15 Nov 2024 09:53:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.17 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1731664384; cv=none; b=g0iEKYMT/inTZ2MXauF1grSTKsprMKXNvGoovDnmIBIRRXhmc3h2uXohSLw+o5I+xI7S+GfU5QZ0FsB3vgJukS9lIEj5cYPSC7PgMQpOrnlqDsVeVhU0jtbb2ZL008dOSySo/VO7cwF/Ikdgb7iJtxYLkLC1KYeg6Z841blsrEs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1731664384; c=relaxed/simple; bh=YmQqDOSkcImzxsT5qCUaJ8u0PLOHlwKIEADX1Y1QQfQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=p7sb+ibj0cWIMtgMIOeNYdube+38gxub0CyFn/Ze2r8KxQG5ayfqTCoZ2CwmqRhWCKNjnU1OyiUlfPjDuHGqVK840Imk2zWQN3uw4gWxOjI3DcLJD6WZcuIc8JuK+ur+VvgUABg7N/1TgHCLDAQViDYyDOCA2dNAY+L7Vzqha5o= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=HJejmrH/; arc=none smtp.client-ip=192.198.163.17 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="HJejmrH/" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1731664382; x=1763200382; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=YmQqDOSkcImzxsT5qCUaJ8u0PLOHlwKIEADX1Y1QQfQ=; b=HJejmrH/VnoV0UzFCvx0yQNKyOOcF6/+ksQ/pampkeUkTKWQ8mUku7ep UK2tiwt9rEeyXQ24GSIJVsAFSw0Yt6JuaZBLsdJZA77sWnHQEA9Fht4bJ /ry+nXODu85LKtp90ClxVUIrTg5zaYv9STgcoV70J8VWU1D0R5R4PIWVu im8NmieYFfjosu5/Xc/pEYDSPEIfQhe/+K0zrIHcaZ8FUpHv9+yqIxEx1 q5kCp1HLS5H0TqUVLrYwNU8R/+hS09N7yaWS3NP8eeSBCN0jDP0JyG5QE QTy1kdxGYiZLYPu5O2texp3AGO138HhLtNCg+FhY+FsCxZAl+mID91h6e g==; X-CSE-ConnectionGUID: LKn98QP+QSG/4t/7x20ihQ== X-CSE-MsgGUID: 7Z5kf7QMSmy0iXc+l9Gw2w== X-IronPort-AV: E=McAfee;i="6700,10204,11256"; a="31584847" X-IronPort-AV: E=Sophos;i="6.12,156,1728975600"; d="scan'208";a="31584847" Received: from orviesa004.jf.intel.com ([10.64.159.144]) by fmvoesa111.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 15 Nov 2024 01:53:02 -0800 X-CSE-ConnectionGUID: ZOJ4TKQ3RN+36xkktsY4bw== X-CSE-MsgGUID: YIhJv9zgQ0GGQAOfWH4iiw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.12,156,1728975600"; d="scan'208";a="93584352" Received: from kinlongk-mobl1.amr.corp.intel.com (HELO khuang2-desk.gar.corp.intel.com) ([10.124.221.135]) by orviesa004-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 15 Nov 2024 01:52:59 -0800 From: Kai Huang To: pbonzini@redhat.com, seanjc@google.com Cc: kvm@vger.kernel.org, rick.p.edgecombe@intel.com, isaku.yamahata@intel.com, reinette.chatre@intel.com, binbin.wu@linux.intel.com, xiaoyao.li@intel.com, yan.y.zhao@intel.com, adrian.hunter@intel.com, tony.lindgren@intel.com, kristen@linux.intel.com, linux-kernel@vger.kernel.org Subject: [PATCH v2 3/3] KVM: VMX: Initialize TDX during KVM module load Date: Fri, 15 Nov 2024 22:52:41 +1300 Message-ID: <162f9dee05c729203b9ad6688db1ca2960b4b502.1731664295.git.kai.huang@intel.com> X-Mailer: git-send-email 2.46.2 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Before KVM can use TDX to create and run TDX guests, TDX needs to be initialized from two perspectives: 1) TDX module must be initialized properly to a working state; 2) A per-cpu TDX initialization, a.k.a the TDH.SYS.LP.INIT SEAMCALL must be done on any logical cpu before it can run any other TDX SEAMCALLs. The TDX host core-kernel provides two functions to do the above two respectively: tdx_enable() and tdx_cpu_enable(). There are two options in terms of when to initialize TDX: initialize TDX at KVM module loading time, or when creating the first TDX guest. Choose to initialize TDX during KVM module loading time: Initializing TDX module is both memory and CPU time consuming: 1) the kernel needs to allocate a non-trivial size(~1/256) of system memory as metadata used by TDX module to track each TDX-usable memory page's status; 2) the TDX module needs to initialize this metadata, one entry for each TDX-usable memory page. Also, the kernel uses alloc_contig_pages() to allocate those metadata chunks, because they are large and need to be physically contiguous. alloc_contig_pages() can fail. If initializing TDX when creating the first TDX guest, then there's chance that KVM won't be able to run any TDX guests albeit KVM _declares_ to be able to support TDX. This isn't good for the user. On the other hand, initializing TDX at KVM module loading time can make sure KVM is providing a consistent view of whether KVM can support TDX to the user. Always only try to initialize TDX after VMX has been initialized. TDX is based on VMX, and if VMX fails to initialize then TDX is likely to be broken anyway. Also, in practice, supporting TDX will require part of VMX and common x86 infrastructure in working order, so TDX cannot be enabled alone w/o VMX support. There are two cases that can result in failure to initialize TDX: 1) TDX cannot be supported (e.g., because of TDX is not supported or enabled by hardware, or module is not loaded, or missing some dependency in KVM's configuration); 2) Any unexpected error during TDX bring-up. For the first case only mark TDX is disabled but still allow KVM module to be loaded. For the second case just fail to load the KVM module so that the user can be aware. Because TDX costs additional memory, don't enable TDX by default. Add a new module parameter 'enable_tdx' to allow the user to opt-in. Note, the name tdx_init() has already been taken by the early boot code. Use tdx_bringup() for initializing TDX (and tdx_cleanup() since KVM doesn't actually teardown TDX). They don't match vt_init()/vt_exit(), vmx_init()/vmx_exit() etc but it's not end of the world. Also, once initialized, the TDX module cannot be disabled and enabled again w/o the TDX module runtime update, which isn't supported by the kernel. After TDX is enabled, nothing needs to be done when KVM disables hardware virtualization, e.g., when offlining CPU, or during suspend/resume. TDX host core-kernel code internally tracks TDX status and can handle "multiple enabling" scenario. Similar to KVM_AMD_SEV, add a new KVM_INTEL_TDX Kconfig to guide KVM TDX code. Make it depend on INTEL_TDX_HOST but not replace INTEL_TDX_HOST because in the longer term there's a use case that requires making SEAMCALLs w/o KVM as mentioned by Dan [1]. Link: https://lore.kernel.org/6723fc2070a96_60c3294dc@dwillia2-mobl3.amr.co= rp.intel.com.notmuch/ [1] Signed-off-by: Kai Huang --- arch/x86/kvm/Kconfig | 10 +++ arch/x86/kvm/Makefile | 1 + arch/x86/kvm/vmx/main.c | 9 +++ arch/x86/kvm/vmx/tdx.c | 153 ++++++++++++++++++++++++++++++++++++++++ arch/x86/kvm/vmx/tdx.h | 13 ++++ 5 files changed, 186 insertions(+) create mode 100644 arch/x86/kvm/vmx/tdx.c create mode 100644 arch/x86/kvm/vmx/tdx.h diff --git a/arch/x86/kvm/Kconfig b/arch/x86/kvm/Kconfig index d93af5390341..e6da1b4ff3d2 100644 --- a/arch/x86/kvm/Kconfig +++ b/arch/x86/kvm/Kconfig @@ -128,6 +128,16 @@ config X86_SGX_KVM =20 If unsure, say N. =20 +config KVM_INTEL_TDX + bool "Intel Trust Domain Extensions (TDX) support" + default y + depends on INTEL_TDX_HOST + help + Provides support for launching Intel Trust Domain Extensions (TDX) + confidential VMs on Intel processors. + + If unsure, say N. + config KVM_AMD tristate "KVM for AMD processors support" depends on KVM && (CPU_SUP_AMD || CPU_SUP_HYGON) diff --git a/arch/x86/kvm/Makefile b/arch/x86/kvm/Makefile index f9dddb8cb466..a5d362c7b504 100644 --- a/arch/x86/kvm/Makefile +++ b/arch/x86/kvm/Makefile @@ -20,6 +20,7 @@ kvm-intel-y +=3D vmx/vmx.o vmx/vmenter.o vmx/pmu_intel.o= vmx/vmcs12.o \ =20 kvm-intel-$(CONFIG_X86_SGX_KVM) +=3D vmx/sgx.o kvm-intel-$(CONFIG_KVM_HYPERV) +=3D vmx/hyperv.o vmx/hyperv_evmcs.o +kvm-intel-$(CONFIG_KVM_INTEL_TDX) +=3D vmx/tdx.o =20 kvm-amd-y +=3D svm/svm.o svm/vmenter.o svm/pmu.o svm/nested.o svm/avic.o =20 diff --git a/arch/x86/kvm/vmx/main.c b/arch/x86/kvm/vmx/main.c index 6772e560ac7b..bc690c63e511 100644 --- a/arch/x86/kvm/vmx/main.c +++ b/arch/x86/kvm/vmx/main.c @@ -6,6 +6,7 @@ #include "nested.h" #include "pmu.h" #include "posted_intr.h" +#include "tdx.h" =20 #define VMX_REQUIRED_APICV_INHIBITS \ (BIT(APICV_INHIBIT_REASON_DISABLED) | \ @@ -171,6 +172,7 @@ struct kvm_x86_init_ops vt_init_ops __initdata =3D { static void vt_exit(void) { kvm_exit(); + tdx_cleanup(); vmx_exit(); } module_exit(vt_exit); @@ -183,6 +185,11 @@ static int __init vt_init(void) if (r) return r; =20 + /* tdx_init() has been taken */ + r =3D tdx_bringup(); + if (r) + goto err_tdx_bringup; + /* * Common KVM initialization _must_ come last, after this, /dev/kvm is * exposed to userspace! @@ -195,6 +202,8 @@ static int __init vt_init(void) return 0; =20 err_kvm_init: + tdx_cleanup(); +err_tdx_bringup: vmx_exit(); return r; } diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c new file mode 100644 index 000000000000..d35112758641 --- /dev/null +++ b/arch/x86/kvm/vmx/tdx.c @@ -0,0 +1,153 @@ +// SPDX-License-Identifier: GPL-2.0 +#include +#include +#include +#include "capabilities.h" +#include "tdx.h" + +#undef pr_fmt +#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + +static bool enable_tdx __ro_after_init; +module_param_named(tdx, enable_tdx, bool, 0444); + +static enum cpuhp_state tdx_cpuhp_state; + +static int tdx_online_cpu(unsigned int cpu) +{ + unsigned long flags; + int r; + + /* Sanity check CPU is already in post-VMXON */ + WARN_ON_ONCE(!(cr4_read_shadow() & X86_CR4_VMXE)); + + local_irq_save(flags); + r =3D tdx_cpu_enable(); + local_irq_restore(flags); + + return r; +} + +static void __do_tdx_cleanup(void) +{ + /* + * Once TDX module is initialized, it cannot be disabled and + * re-initialized again w/o runtime update (which isn't + * supported by kernel). Only need to remove the cpuhp here. + * The TDX host core code tracks TDX status and can handle + * 'multiple enabling' scenario. + */ + WARN_ON_ONCE(!tdx_cpuhp_state); + cpuhp_remove_state_nocalls(tdx_cpuhp_state); + tdx_cpuhp_state =3D 0; +} + +static int __init __do_tdx_bringup(void) +{ + int r; + + /* + * TDX-specific cpuhp callback to call tdx_cpu_enable() on all + * online CPUs before calling tdx_enable(), and on any new + * going-online CPU to make sure it is ready for TDX guest. + */ + r =3D cpuhp_setup_state_cpuslocked(CPUHP_AP_ONLINE_DYN, + "kvm/cpu/tdx:online", + tdx_online_cpu, NULL); + if (r < 0) + return r; + + tdx_cpuhp_state =3D r; + + r =3D tdx_enable(); + if (r) + __do_tdx_cleanup(); + + return r; +} + +static bool __init kvm_can_support_tdx(void) +{ + return cpu_feature_enabled(X86_FEATURE_TDX_HOST_PLATFORM); +} + +static int __init __tdx_bringup(void) +{ + int r; + + /* + * Enabling TDX requires enabling hardware virtualization first, + * as making SEAMCALLs requires CPU being in post-VMXON state. + */ + r =3D kvm_enable_virtualization(); + if (r) + return r; + + cpus_read_lock(); + r =3D __do_tdx_bringup(); + cpus_read_unlock(); + + if (r) + goto tdx_bringup_err; + + /* + * Leave hardware virtualization enabled after TDX is enabled + * successfully. TDX CPU hotplug depends on this. + */ + return 0; +tdx_bringup_err: + kvm_disable_virtualization(); + return r; +} + +void tdx_cleanup(void) +{ + if (enable_tdx) { + __do_tdx_cleanup(); + kvm_disable_virtualization(); + } +} + +int __init tdx_bringup(void) +{ + int r; + + enable_tdx =3D enable_tdx && kvm_can_support_tdx(); + + if (!enable_tdx) + return 0; + + /* + * Ideally KVM should probe whether TDX module has been loaded + * first and then try to bring it up, because KVM should treat + * them differently. I.e., KVM should just disable TDX while + * still allow module to be loaded when TDX module is not + * loaded, but fail to load module when it actually fails to + * bring up TDX. + * + * But unfortunately TDX needs to use SEAMCALL to probe whether + * the module is loaded (there is no CPUID or MSR for that), + * and making SEAMCALL requires enabling virtualization first, + * just like the rest steps of bringing up TDX module. + * + * The first SEAMCALL to bring up TDX module returns -ENODEV + * when the module is not loaded. For simplicity just try to + * bring up TDX and use the return code as the way to probe, + * albeit this is not perfect, i.e., need to make sure + * __tdx_bringup() doesn't return -ENODEV in other cases. + */ + r =3D __tdx_bringup(); + if (r) { + enable_tdx =3D 0; + /* + * Disable TDX only but don't fail to load module when + * TDX module is not loaded. No need to print message + * saying "module is not loaded" because it was printed + * when the first SEAMCALL failed. + */ + if (r =3D=3D -ENODEV) + r =3D 0; + } + + return r; +} diff --git a/arch/x86/kvm/vmx/tdx.h b/arch/x86/kvm/vmx/tdx.h new file mode 100644 index 000000000000..8aee938a968f --- /dev/null +++ b/arch/x86/kvm/vmx/tdx.h @@ -0,0 +1,13 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +#ifndef __KVM_X86_VMX_TDX_H +#define __KVM_X86_VMX_TDX_H + +#ifdef CONFIG_INTEL_TDX_HOST +int tdx_bringup(void); +void tdx_cleanup(void); +#else +static inline int tdx_bringup(void) { return 0; } +static inline void tdx_cleanup(void) {} +#endif + +#endif --=20 2.46.2