Host kernel never sets any Intel MKTME KeyID bits (including TDX KeyID
bits) in any mapping. KVM should not set any of them to MMU's SPTE which
maps to guest memory either. KVM MMU has shadow_zero_check which
contains those bits must be 0 for SPTE. This series adds MKTME bits to
shadow_zero_check. The first patch is not directly needed but looks
better to have IMHO. Patch 02/03 actually do the job.
Sanity tested by creating normal VMs on TDX capable machine (with TDX
turned on). However this is not tested on AMD machine since I don't have
access to any, though the risk should be very small I suppose.
Kai Huang (3):
KVM: x86/mmu: Rename reset_rsvds_bits_mask()
KVM: x86/mmu: Add shadow_me_value and repurpose shadow_me_mask
KVM: VMX: Include MKTME KeyID bits to shadow_zero_check
arch/x86/kvm/mmu.h | 20 ++++++++++++++++++++
arch/x86/kvm/mmu/mmu.c | 22 +++++++++++++++-------
arch/x86/kvm/mmu/spte.c | 40 ++++++++++++++++------------------------
arch/x86/kvm/mmu/spte.h | 1 +
arch/x86/kvm/svm/svm.c | 3 +++
arch/x86/kvm/vmx/vmx.c | 31 +++++++++++++++++++++++++++++++
6 files changed, 86 insertions(+), 31 deletions(-)
--
2.35.1
Rename reset_rsvds_bits_mask() to reset_guest_rsvds_bits_mask() to make
it clearer that it resets the reserved bits check for guest's page table
entries.
Signed-off-by: Kai Huang <[email protected]>
---
arch/x86/kvm/mmu/mmu.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
index 69a30d6d1e2b..2931785f1e73 100644
--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -4369,8 +4369,8 @@ static bool guest_can_use_gbpages(struct kvm_vcpu *vcpu)
guest_cpuid_has(vcpu, X86_FEATURE_GBPAGES);
}
-static void reset_rsvds_bits_mask(struct kvm_vcpu *vcpu,
- struct kvm_mmu *context)
+static void reset_guest_rsvds_bits_mask(struct kvm_vcpu *vcpu,
+ struct kvm_mmu *context)
{
__reset_rsvds_bits_mask(&context->guest_rsvd_check,
vcpu->arch.reserved_gpa_bits,
@@ -4669,7 +4669,7 @@ static void reset_guest_paging_metadata(struct kvm_vcpu *vcpu,
if (!is_cr0_pg(mmu))
return;
- reset_rsvds_bits_mask(vcpu, mmu);
+ reset_guest_rsvds_bits_mask(vcpu, mmu);
update_permission_bitmask(mmu, false);
update_pkru_bitmask(mmu);
}
--
2.35.1