From nobody Mon Feb 9 02:31:37 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 65097C433EF for ; Mon, 27 Jun 2022 22:02:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242444AbiF0WCK (ORCPT ); Mon, 27 Jun 2022 18:02:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60876 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241671AbiF0V4Q (ORCPT ); Mon, 27 Jun 2022 17:56:16 -0400 Received: from mga11.intel.com (mga11.intel.com [192.55.52.93]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 90D4E63A8; Mon, 27 Jun 2022 14:55:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1656366911; x=1687902911; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=BBjPL6ZCBut4fu7dnmaz4Ptdk+zjJG4aikQXtEycxZ0=; b=mOGEcFG1whKLShQvAWAuiLR0wSmHhcFdzt6Cikg7u6LzFDk+d4ulUshU wXJcRLSpYg1uYHg++IjdL28FweZwGGhMDUe90OYJNHjJe8n0L3wunapBA hyR4xxKOnen4yiwcNugdaYyFmRrufvLzZQZY6B8h6XhwZ23EhrAECbFmB /IUWnDit10QJoza5RQAx2M5J2WMQaxdaHA56opF2qgYjQ2uYHa4VRGnEC 1B3lHRr787W/JAwR+VE65zW79mFtl1YBFQ9+76Kr1bwv+zTYmDB9yZiF8 FOxLLGZwL1iFsdby9ea7t5KupqP92crHo/q6SsEtPsdEnIzbjIHRi5o8F g==; X-IronPort-AV: E=McAfee;i="6400,9594,10391"; a="279116156" X-IronPort-AV: E=Sophos;i="5.92,227,1650956400"; d="scan'208";a="279116156" Received: from fmsmga004.fm.intel.com ([10.253.24.48]) by fmsmga102.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 27 Jun 2022 14:55:03 -0700 X-IronPort-AV: E=Sophos;i="5.92,227,1650956400"; d="scan'208";a="657863777" Received: from ls.sc.intel.com (HELO localhost) ([143.183.96.54]) by fmsmga004-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 27 Jun 2022 14:55:03 -0700 From: isaku.yamahata@intel.com To: kvm@vger.kernel.org, linux-kernel@vger.kernel.org Cc: isaku.yamahata@intel.com, isaku.yamahata@gmail.com, Paolo Bonzini , Sean Christopherson Subject: [PATCH v7 100/102] KVM: TDX: Add methods to ignore accesses to CPU state Date: Mon, 27 Jun 2022 14:54:32 -0700 Message-Id: X-Mailer: git-send-email 2.25.1 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sean Christopherson TDX protects TDX guest state from VMM. Implements to access methods for TDX guest state to ignore them or return zero. Signed-off-by: Sean Christopherson Signed-off-by: Isaku Yamahata --- arch/x86/kvm/vmx/main.c | 463 +++++++++++++++++++++++++++++++++---- arch/x86/kvm/vmx/tdx.c | 55 ++++- arch/x86/kvm/vmx/x86_ops.h | 17 ++ 3 files changed, 490 insertions(+), 45 deletions(-) diff --git a/arch/x86/kvm/vmx/main.c b/arch/x86/kvm/vmx/main.c index 552f2576d3ae..b9ad41ace499 100644 --- a/arch/x86/kvm/vmx/main.c +++ b/arch/x86/kvm/vmx/main.c @@ -268,6 +268,46 @@ static void vt_enable_smi_window(struct kvm_vcpu *vcpu) vmx_enable_smi_window(vcpu); } =20 +static bool vt_can_emulate_instruction(struct kvm_vcpu *vcpu, int emul_typ= e, + void *insn, int insn_len) +{ + if (is_td_vcpu(vcpu)) + return false; + + return vmx_can_emulate_instruction(vcpu, emul_type, insn, insn_len); +} + +static int vt_check_intercept(struct kvm_vcpu *vcpu, + struct x86_instruction_info *info, + enum x86_intercept_stage stage, + struct x86_exception *exception) +{ + /* + * This call back is triggered by the x86 instruction emulator. TDX + * doesn't allow guest memory inspection. + */ + if (KVM_BUG_ON(is_td_vcpu(vcpu), vcpu->kvm)) + return X86EMUL_UNHANDLEABLE; + + return vmx_check_intercept(vcpu, info, stage, exception); +} + +static bool vt_apic_init_signal_blocked(struct kvm_vcpu *vcpu) +{ + if (is_td_vcpu(vcpu)) + return true; + + return vmx_apic_init_signal_blocked(vcpu); +} + +static void vt_set_virtual_apic_mode(struct kvm_vcpu *vcpu) +{ + if (is_td_vcpu(vcpu)) + return tdx_set_virtual_apic_mode(vcpu); + + return vmx_set_virtual_apic_mode(vcpu); +} + static void vt_apicv_post_state_restore(struct kvm_vcpu *vcpu) { struct pi_desc *pi =3D vcpu_to_pi_desc(vcpu); @@ -275,6 +315,31 @@ static void vt_apicv_post_state_restore(struct kvm_vcp= u *vcpu) memset(pi->pir, 0, sizeof(pi->pir)); } =20 +static void vt_hwapic_irr_update(struct kvm_vcpu *vcpu, int max_irr) +{ + if (is_td_vcpu(vcpu)) + return; + + return vmx_hwapic_irr_update(vcpu, max_irr); +} + +static void vt_hwapic_isr_update(struct kvm_vcpu *vcpu, int max_isr) +{ + if (is_td_vcpu(vcpu)) + return; + + return vmx_hwapic_isr_update(vcpu, max_isr); +} + +static bool vt_guest_apic_has_interrupt(struct kvm_vcpu *vcpu) +{ + /* TDX doesn't support L2 at the moment. */ + if (WARN_ON_ONCE(is_td_vcpu(vcpu))) + return false; + + return vmx_guest_apic_has_interrupt(vcpu); +} + static int vt_sync_pir_to_irr(struct kvm_vcpu *vcpu) { if (is_td_vcpu(vcpu)) @@ -314,6 +379,177 @@ static void vt_vcpu_deliver_init(struct kvm_vcpu *vcp= u) kvm_vcpu_deliver_init(vcpu); } =20 +static void vt_vcpu_after_set_cpuid(struct kvm_vcpu *vcpu) +{ + if (is_td_vcpu(vcpu)) + return; + + return vmx_vcpu_after_set_cpuid(vcpu); +} + +static void vt_update_exception_bitmap(struct kvm_vcpu *vcpu) +{ + if (is_td_vcpu(vcpu)) + return; + + vmx_update_exception_bitmap(vcpu); +} + +static u64 vt_get_segment_base(struct kvm_vcpu *vcpu, int seg) +{ + if (KVM_BUG_ON(is_td_vcpu(vcpu), vcpu->kvm)) + return tdx_get_segment_base(vcpu, seg); + + return vmx_get_segment_base(vcpu, seg); +} + +static void vt_get_segment(struct kvm_vcpu *vcpu, struct kvm_segment *var, + int seg) +{ + if (KVM_BUG_ON(is_td_vcpu(vcpu), vcpu->kvm)) + return tdx_get_segment(vcpu, var, seg); + + vmx_get_segment(vcpu, var, seg); +} + +static void vt_set_segment(struct kvm_vcpu *vcpu, struct kvm_segment *var, + int seg) +{ + if (KVM_BUG_ON(is_td_vcpu(vcpu), vcpu->kvm)) + return; + + vmx_set_segment(vcpu, var, seg); +} + +static int vt_get_cpl(struct kvm_vcpu *vcpu) +{ + if (KVM_BUG_ON(is_td_vcpu(vcpu), vcpu->kvm)) + return tdx_get_cpl(vcpu); + + return vmx_get_cpl(vcpu); +} + +static void vt_get_cs_db_l_bits(struct kvm_vcpu *vcpu, int *db, int *l) +{ + if (KVM_BUG_ON(is_td_vcpu(vcpu), vcpu->kvm)) + return; + + vmx_get_cs_db_l_bits(vcpu, db, l); +} + +static void vt_set_cr0(struct kvm_vcpu *vcpu, unsigned long cr0) +{ + if (is_td_vcpu(vcpu)) + return; + + vmx_set_cr0(vcpu, cr0); +} + +static void vt_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4) +{ + if (is_td_vcpu(vcpu)) + return; + + vmx_set_cr4(vcpu, cr4); +} + +static int vt_set_efer(struct kvm_vcpu *vcpu, u64 efer) +{ + if (is_td_vcpu(vcpu)) + return 0; + + return vmx_set_efer(vcpu, efer); +} + +static void vt_get_idt(struct kvm_vcpu *vcpu, struct desc_ptr *dt) +{ + if (KVM_BUG_ON(is_td_vcpu(vcpu), vcpu->kvm)) { + memset(dt, 0, sizeof(*dt)); + return; + } + + vmx_get_idt(vcpu, dt); +} + +static void vt_set_idt(struct kvm_vcpu *vcpu, struct desc_ptr *dt) +{ + if (KVM_BUG_ON(is_td_vcpu(vcpu), vcpu->kvm)) + return; + + vmx_set_idt(vcpu, dt); +} + +static void vt_get_gdt(struct kvm_vcpu *vcpu, struct desc_ptr *dt) +{ + if (KVM_BUG_ON(is_td_vcpu(vcpu), vcpu->kvm)) { + memset(dt, 0, sizeof(*dt)); + return; + } + + vmx_get_gdt(vcpu, dt); +} + +static void vt_set_gdt(struct kvm_vcpu *vcpu, struct desc_ptr *dt) +{ + if (KVM_BUG_ON(is_td_vcpu(vcpu), vcpu->kvm)) + return; + + vmx_set_gdt(vcpu, dt); +} + +static void vt_set_dr7(struct kvm_vcpu *vcpu, unsigned long val) +{ + if (is_td_vcpu(vcpu)) + return; + + vmx_set_dr7(vcpu, val); +} + +static void vt_sync_dirty_debug_regs(struct kvm_vcpu *vcpu) +{ + /* + * MOV-DR exiting is always cleared for TD guest, even in debug mode. + * Thus KVM_DEBUGREG_WONT_EXIT can never be set and it should never + * reach here for TD vcpu. + */ + if (KVM_BUG_ON(is_td_vcpu(vcpu), vcpu->kvm)) + return; + + vmx_sync_dirty_debug_regs(vcpu); +} + +static void vt_cache_reg(struct kvm_vcpu *vcpu, enum kvm_reg reg) +{ + if (is_td_vcpu(vcpu)) + return tdx_cache_reg(vcpu, reg); + + return vmx_cache_reg(vcpu, reg); +} + +static unsigned long vt_get_rflags(struct kvm_vcpu *vcpu) +{ + if (is_td_vcpu(vcpu)) + return tdx_get_rflags(vcpu); + + return vmx_get_rflags(vcpu); +} + +static void vt_set_rflags(struct kvm_vcpu *vcpu, unsigned long rflags) +{ + if (is_td_vcpu(vcpu)) + return; + + vmx_set_rflags(vcpu, rflags); +} + +static bool vt_get_if_flag(struct kvm_vcpu *vcpu) +{ + if (is_td_vcpu(vcpu)) + return false; + + return vmx_get_if_flag(vcpu); +} + static void vt_flush_tlb_all(struct kvm_vcpu *vcpu) { if (is_td_vcpu(vcpu)) @@ -430,6 +666,15 @@ static u32 vt_get_interrupt_shadow(struct kvm_vcpu *vc= pu) return vmx_get_interrupt_shadow(vcpu); } =20 +static void vt_patch_hypercall(struct kvm_vcpu *vcpu, + unsigned char *hypercall) +{ + if (KVM_BUG_ON(is_td_vcpu(vcpu), vcpu->kvm)) + return; + + vmx_patch_hypercall(vcpu, hypercall); +} + static void vt_inject_irq(struct kvm_vcpu *vcpu, bool reinjected) { if (is_td_vcpu(vcpu)) @@ -438,6 +683,14 @@ static void vt_inject_irq(struct kvm_vcpu *vcpu, bool = reinjected) vmx_inject_irq(vcpu, reinjected); } =20 +static void vt_queue_exception(struct kvm_vcpu *vcpu) +{ + if (KVM_BUG_ON(is_td_vcpu(vcpu), vcpu->kvm)) + return; + + vmx_queue_exception(vcpu); +} + static void vt_cancel_injection(struct kvm_vcpu *vcpu) { if (is_td_vcpu(vcpu)) @@ -470,6 +723,130 @@ static void vt_request_immediate_exit(struct kvm_vcpu= *vcpu) vmx_request_immediate_exit(vcpu); } =20 +static void vt_update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int ir= r) +{ + if (KVM_BUG_ON(is_td_vcpu(vcpu), vcpu->kvm)) + return; + + vmx_update_cr8_intercept(vcpu, tpr, irr); +} + +static void vt_set_apic_access_page_addr(struct kvm_vcpu *vcpu) +{ + if (WARN_ON_ONCE(is_td_vcpu(vcpu))) + return; + + vmx_set_apic_access_page_addr(vcpu); +} + +static void vt_refresh_apicv_exec_ctrl(struct kvm_vcpu *vcpu) +{ + if (WARN_ON_ONCE(is_td_vcpu(vcpu))) + return; + + vmx_refresh_apicv_exec_ctrl(vcpu); +} + +static void vt_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitma= p) +{ + if (is_td_vcpu(vcpu)) + return; + + vmx_load_eoi_exitmap(vcpu, eoi_exit_bitmap); +} + +static int vt_set_tss_addr(struct kvm *kvm, unsigned int addr) +{ + if (is_td(kvm)) + return 0; + + return vmx_set_tss_addr(kvm, addr); +} + +static int vt_set_identity_map_addr(struct kvm *kvm, u64 ident_addr) +{ + if (is_td(kvm)) + return 0; + + return vmx_set_identity_map_addr(kvm, ident_addr); +} + +static u64 vt_get_mt_mask(struct kvm_vcpu *vcpu, gfn_t gfn, bool is_mmio) +{ + if (is_td_vcpu(vcpu)) { + if (is_mmio) + return MTRR_TYPE_UNCACHABLE << VMX_EPT_MT_EPTE_SHIFT; + return MTRR_TYPE_WRBACK << VMX_EPT_MT_EPTE_SHIFT; + } + + return vmx_get_mt_mask(vcpu, gfn, is_mmio); +} + +static u64 vt_get_l2_tsc_offset(struct kvm_vcpu *vcpu) +{ + /* TDX doesn't support L2 guest at the moment. */ + if (KVM_BUG_ON(is_td_vcpu(vcpu), vcpu->kvm)) + return 0; + + return vmx_get_l2_tsc_offset(vcpu); +} + +static u64 vt_get_l2_tsc_multiplier(struct kvm_vcpu *vcpu) +{ + /* TDX doesn't support L2 guest at the moment. */ + if (KVM_BUG_ON(is_td_vcpu(vcpu), vcpu->kvm)) + return 0; + + return vmx_get_l2_tsc_multiplier(vcpu); +} + +static void vt_write_tsc_offset(struct kvm_vcpu *vcpu, u64 offset) +{ + /* In TDX, tsc offset can't be changed. */ + if (is_td_vcpu(vcpu)) + return; + + vmx_write_tsc_offset(vcpu, offset); +} + +static void vt_write_tsc_multiplier(struct kvm_vcpu *vcpu, u64 multiplier) +{ + /* In TDX, tsc multiplier can't be changed. */ + if (is_td_vcpu(vcpu)) + return; + + vmx_write_tsc_multiplier(vcpu, multiplier); +} + +static void vt_update_cpu_dirty_logging(struct kvm_vcpu *vcpu) +{ + if (KVM_BUG_ON(is_td_vcpu(vcpu), vcpu->kvm)) + return; + + vmx_update_cpu_dirty_logging(vcpu); +} + +#ifdef CONFIG_X86_64 +static int vt_set_hv_timer(struct kvm_vcpu *vcpu, u64 guest_deadline_tsc, + bool *expired) +{ + /* VMX-preemption timer isn't available for TDX. */ + if (is_td_vcpu(vcpu)) + return -EINVAL; + + return vmx_set_hv_timer(vcpu, guest_deadline_tsc, expired); +} + +static void vt_cancel_hv_timer(struct kvm_vcpu *vcpu) +{ + /* VMX-preemption timer can't be set. Set vt_set_hv_timer(). */ + if (KVM_BUG_ON(is_td_vcpu(vcpu), vcpu->kvm)) + return; + + vmx_cancel_hv_timer(vcpu); +} +#endif + static void vt_get_exit_info(struct kvm_vcpu *vcpu, u32 *reason, u64 *info1, u64 *info2, u32 *intr_info, u32 *error_code) { @@ -522,29 +899,29 @@ struct kvm_x86_ops vt_x86_ops __initdata =3D { .vcpu_load =3D vt_vcpu_load, .vcpu_put =3D vt_vcpu_put, =20 - .update_exception_bitmap =3D vmx_update_exception_bitmap, + .update_exception_bitmap =3D vt_update_exception_bitmap, .get_msr_feature =3D vmx_get_msr_feature, .get_msr =3D vt_get_msr, .set_msr =3D vt_set_msr, - .get_segment_base =3D vmx_get_segment_base, - .get_segment =3D vmx_get_segment, - .set_segment =3D vmx_set_segment, - .get_cpl =3D vmx_get_cpl, - .get_cs_db_l_bits =3D vmx_get_cs_db_l_bits, - .set_cr0 =3D vmx_set_cr0, + .get_segment_base =3D vt_get_segment_base, + .get_segment =3D vt_get_segment, + .set_segment =3D vt_set_segment, + .get_cpl =3D vt_get_cpl, + .get_cs_db_l_bits =3D vt_get_cs_db_l_bits, + .set_cr0 =3D vt_set_cr0, .is_valid_cr4 =3D vmx_is_valid_cr4, - .set_cr4 =3D vmx_set_cr4, - .set_efer =3D vmx_set_efer, - .get_idt =3D vmx_get_idt, - .set_idt =3D vmx_set_idt, - .get_gdt =3D vmx_get_gdt, - .set_gdt =3D vmx_set_gdt, - .set_dr7 =3D vmx_set_dr7, - .sync_dirty_debug_regs =3D vmx_sync_dirty_debug_regs, - .cache_reg =3D vmx_cache_reg, - .get_rflags =3D vmx_get_rflags, - .set_rflags =3D vmx_set_rflags, - .get_if_flag =3D vmx_get_if_flag, + .set_cr4 =3D vt_set_cr4, + .set_efer =3D vt_set_efer, + .get_idt =3D vt_get_idt, + .set_idt =3D vt_set_idt, + .get_gdt =3D vt_get_gdt, + .set_gdt =3D vt_set_gdt, + .set_dr7 =3D vt_set_dr7, + .sync_dirty_debug_regs =3D vt_sync_dirty_debug_regs, + .cache_reg =3D vt_cache_reg, + .get_rflags =3D vt_get_rflags, + .set_rflags =3D vt_set_rflags, + .get_if_flag =3D vt_get_if_flag, =20 .flush_tlb_all =3D vt_flush_tlb_all, .flush_tlb_current =3D vt_flush_tlb_current, @@ -558,10 +935,10 @@ struct kvm_x86_ops vt_x86_ops __initdata =3D { .update_emulated_instruction =3D vmx_update_emulated_instruction, .set_interrupt_shadow =3D vt_set_interrupt_shadow, .get_interrupt_shadow =3D vt_get_interrupt_shadow, - .patch_hypercall =3D vmx_patch_hypercall, + .patch_hypercall =3D vt_patch_hypercall, .inject_irq =3D vt_inject_irq, .inject_nmi =3D vt_inject_nmi, - .queue_exception =3D vmx_queue_exception, + .queue_exception =3D vt_queue_exception, .cancel_injection =3D vt_cancel_injection, .interrupt_allowed =3D vt_interrupt_allowed, .nmi_allowed =3D vt_nmi_allowed, @@ -569,39 +946,39 @@ struct kvm_x86_ops vt_x86_ops __initdata =3D { .set_nmi_mask =3D vt_set_nmi_mask, .enable_nmi_window =3D vt_enable_nmi_window, .enable_irq_window =3D vt_enable_irq_window, - .update_cr8_intercept =3D vmx_update_cr8_intercept, - .set_virtual_apic_mode =3D vmx_set_virtual_apic_mode, - .set_apic_access_page_addr =3D vmx_set_apic_access_page_addr, - .refresh_apicv_exec_ctrl =3D vmx_refresh_apicv_exec_ctrl, - .load_eoi_exitmap =3D vmx_load_eoi_exitmap, + .update_cr8_intercept =3D vt_update_cr8_intercept, + .set_virtual_apic_mode =3D vt_set_virtual_apic_mode, + .set_apic_access_page_addr =3D vt_set_apic_access_page_addr, + .refresh_apicv_exec_ctrl =3D vt_refresh_apicv_exec_ctrl, + .load_eoi_exitmap =3D vt_load_eoi_exitmap, .apicv_post_state_restore =3D vt_apicv_post_state_restore, .check_apicv_inhibit_reasons =3D vmx_check_apicv_inhibit_reasons, - .hwapic_irr_update =3D vmx_hwapic_irr_update, - .hwapic_isr_update =3D vmx_hwapic_isr_update, - .guest_apic_has_interrupt =3D vmx_guest_apic_has_interrupt, + .hwapic_irr_update =3D vt_hwapic_irr_update, + .hwapic_isr_update =3D vt_hwapic_isr_update, + .guest_apic_has_interrupt =3D vt_guest_apic_has_interrupt, .sync_pir_to_irr =3D vt_sync_pir_to_irr, .deliver_interrupt =3D vt_deliver_interrupt, .dy_apicv_has_pending_interrupt =3D pi_has_pending_interrupt, .protected_apic_has_interrupt =3D vt_protected_apic_has_interrupt, =20 - .set_tss_addr =3D vmx_set_tss_addr, - .set_identity_map_addr =3D vmx_set_identity_map_addr, - .get_mt_mask =3D vmx_get_mt_mask, + .set_tss_addr =3D vt_set_tss_addr, + .set_identity_map_addr =3D vt_set_identity_map_addr, + .get_mt_mask =3D vt_get_mt_mask, =20 .get_exit_info =3D vt_get_exit_info, =20 - .vcpu_after_set_cpuid =3D vmx_vcpu_after_set_cpuid, + .vcpu_after_set_cpuid =3D vt_vcpu_after_set_cpuid, =20 .has_wbinvd_exit =3D cpu_has_vmx_wbinvd_exit, =20 - .get_l2_tsc_offset =3D vmx_get_l2_tsc_offset, - .get_l2_tsc_multiplier =3D vmx_get_l2_tsc_multiplier, - .write_tsc_offset =3D vmx_write_tsc_offset, - .write_tsc_multiplier =3D vmx_write_tsc_multiplier, + .get_l2_tsc_offset =3D vt_get_l2_tsc_offset, + .get_l2_tsc_multiplier =3D vt_get_l2_tsc_multiplier, + .write_tsc_offset =3D vt_write_tsc_offset, + .write_tsc_multiplier =3D vt_write_tsc_multiplier, =20 .load_mmu_pgd =3D vt_load_mmu_pgd, =20 - .check_intercept =3D vmx_check_intercept, + .check_intercept =3D vt_check_intercept, .handle_exit_irqoff =3D vt_handle_exit_irqoff, =20 .request_immediate_exit =3D vt_request_immediate_exit, @@ -609,7 +986,7 @@ struct kvm_x86_ops vt_x86_ops __initdata =3D { .sched_in =3D vt_sched_in, =20 .cpu_dirty_log_size =3D PML_ENTITY_NUM, - .update_cpu_dirty_logging =3D vmx_update_cpu_dirty_logging, + .update_cpu_dirty_logging =3D vt_update_cpu_dirty_logging, =20 .nested_ops =3D &vmx_nested_ops, =20 @@ -617,8 +994,8 @@ struct kvm_x86_ops vt_x86_ops __initdata =3D { .pi_start_assignment =3D vmx_pi_start_assignment, =20 #ifdef CONFIG_X86_64 - .set_hv_timer =3D vmx_set_hv_timer, - .cancel_hv_timer =3D vmx_cancel_hv_timer, + .set_hv_timer =3D vt_set_hv_timer, + .cancel_hv_timer =3D vt_cancel_hv_timer, #endif =20 .setup_mce =3D vmx_setup_mce, @@ -628,8 +1005,8 @@ struct kvm_x86_ops vt_x86_ops __initdata =3D { .leave_smm =3D vt_leave_smm, .enable_smi_window =3D vt_enable_smi_window, =20 - .can_emulate_instruction =3D vmx_can_emulate_instruction, - .apic_init_signal_blocked =3D vmx_apic_init_signal_blocked, + .can_emulate_instruction =3D vt_can_emulate_instruction, + .apic_init_signal_blocked =3D vt_apic_init_signal_blocked, .migrate_timers =3D vmx_migrate_timers, =20 .msr_filter_changed =3D vmx_msr_filter_changed, diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c index d81a0a832ce2..10207afddec8 100644 --- a/arch/x86/kvm/vmx/tdx.c +++ b/arch/x86/kvm/vmx/tdx.c @@ -3,6 +3,7 @@ #include =20 #include +#include #include =20 #include "capabilities.h" @@ -609,8 +610,15 @@ int tdx_vcpu_create(struct kvm_vcpu *vcpu) =20 vcpu->arch.tsc_offset =3D to_kvm_tdx(vcpu->kvm)->tsc_offset; vcpu->arch.l1_tsc_offset =3D vcpu->arch.tsc_offset; - vcpu->arch.guest_state_protected =3D - !(to_kvm_tdx(vcpu->kvm)->attributes & TDX_TD_ATTRIBUTE_DEBUG); + /* + * TODO: support off-TD debug. If TD DEBUG is enabled, guest state + * can be accessed. guest_state_protected =3D false. and kvm ioctl to + * access CPU states should be usable for user space VMM (e.g. qemu). + * + * vcpu->arch.guest_state_protected =3D + * !(to_kvm_tdx(vcpu->kvm)->attributes & TDX_TD_ATTRIBUTE_DEBUG); + */ + vcpu->arch.guest_state_protected =3D true; =20 tdx->pi_desc.nv =3D POSTED_INTR_VECTOR; tdx->pi_desc.sn =3D 1; @@ -1855,6 +1863,49 @@ void tdx_enable_smi_window(struct kvm_vcpu *vcpu) vcpu->arch.smi_pending =3D false; } =20 +void tdx_set_virtual_apic_mode(struct kvm_vcpu *vcpu) +{ + /* Only x2APIC mode is supported for TD. */ + WARN_ON_ONCE(kvm_get_apic_mode(vcpu) !=3D LAPIC_MODE_X2APIC); +} + +int tdx_get_cpl(struct kvm_vcpu *vcpu) +{ + return 0; +} + +void tdx_cache_reg(struct kvm_vcpu *vcpu, enum kvm_reg reg) +{ + kvm_register_mark_available(vcpu, reg); + switch (reg) { + case VCPU_REGS_RSP: + case VCPU_REGS_RIP: + case VCPU_EXREG_PDPTR: + case VCPU_EXREG_CR0: + case VCPU_EXREG_CR3: + case VCPU_EXREG_CR4: + break; + default: + KVM_BUG_ON(1, vcpu->kvm); + break; + } +} + +unsigned long tdx_get_rflags(struct kvm_vcpu *vcpu) +{ + return 0; +} + +u64 tdx_get_segment_base(struct kvm_vcpu *vcpu, int seg) +{ + return 0; +} + +void tdx_get_segment(struct kvm_vcpu *vcpu, struct kvm_segment *var, int s= eg) +{ + memset(var, 0, sizeof(*var)); +} + int tdx_dev_ioctl(void __user *argp) { struct kvm_tdx_capabilities __user *user_caps; diff --git a/arch/x86/kvm/vmx/x86_ops.h b/arch/x86/kvm/vmx/x86_ops.h index 1c4672037a2e..2e204002efb1 100644 --- a/arch/x86/kvm/vmx/x86_ops.h +++ b/arch/x86/kvm/vmx/x86_ops.h @@ -163,6 +163,14 @@ int tdx_smi_allowed(struct kvm_vcpu *vcpu, bool for_in= jection); int tdx_enter_smm(struct kvm_vcpu *vcpu, char *smstate); int tdx_leave_smm(struct kvm_vcpu *vcpu, const char *smstate); void tdx_enable_smi_window(struct kvm_vcpu *vcpu); +void tdx_set_virtual_apic_mode(struct kvm_vcpu *vcpu); + +int tdx_get_cpl(struct kvm_vcpu *vcpu); +void tdx_cache_reg(struct kvm_vcpu *vcpu, enum kvm_reg reg); +unsigned long tdx_get_rflags(struct kvm_vcpu *vcpu); +bool tdx_is_emulated_msr(u32 index, bool write); +u64 tdx_get_segment_base(struct kvm_vcpu *vcpu, int seg); +void tdx_get_segment(struct kvm_vcpu *vcpu, struct kvm_segment *var, int s= eg); =20 int tdx_vm_ioctl(struct kvm *kvm, void __user *argp); int tdx_vcpu_ioctl(struct kvm_vcpu *vcpu, void __user *argp); @@ -203,10 +211,19 @@ static inline void tdx_get_exit_info( static inline bool tdx_is_emulated_msr(u32 index, bool write) { return fal= se; } static inline int tdx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)= { return 1; } static inline int tdx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr)= { return 1; } + static inline int tdx_smi_allowed(struct kvm_vcpu *vcpu, bool for_injectio= n) { return false; } static inline int tdx_enter_smm(struct kvm_vcpu *vcpu, char *smstate) { re= turn 0; } static inline int tdx_leave_smm(struct kvm_vcpu *vcpu, const char *smstate= ) { return 0; } static inline void tdx_enable_smi_window(struct kvm_vcpu *vcpu) {} +static inline void tdx_set_virtual_apic_mode(struct kvm_vcpu *vcpu) {} + +static inline int tdx_get_cpl(struct kvm_vcpu *vcpu) { return 0; } +static inline void tdx_cache_reg(struct kvm_vcpu *vcpu, enum kvm_reg reg) = {} +static inline unsigned long tdx_get_rflags(struct kvm_vcpu *vcpu) { return= 0; } +static inline u64 tdx_get_segment_base(struct kvm_vcpu *vcpu, int seg) { r= eturn 0;} +static inline void tdx_get_segment( + struct kvm_vcpu *vcpu, struct kvm_segment *var, int seg) {} =20 static inline int tdx_vm_ioctl(struct kvm *kvm, void __user *argp) { retur= n -EOPNOTSUPP; } static inline int tdx_vcpu_ioctl(struct kvm_vcpu *vcpu, void __user *argp)= { return -EOPNOTSUPP; } --=20 2.25.1