| Date | Mon, 7 Mar 2022 17:29:27 +0800 | Subject | Re: [PATCHv5 23/30] x86/boot: Avoid #VE during boot for TDX platforms | From | Xiaoyao Li <> |
| |
On 3/2/2022 10:27 PM, Kirill A. Shutemov wrote: > From: Sean Christopherson <seanjc@google.com> > > There are a few MSRs and control register bits that the kernel > normally needs to modify during boot. But, TDX disallows > modification of these registers to help provide consistent security > guarantees. Fortunately, TDX ensures that these are all in the correct > state before the kernel loads, which means the kernel does not need to > modify them. > > The conditions to avoid are: > > * Any writes to the EFER MSR > * Clearing CR3.MCE
typo. CR4.MCE
BTW, I remember there was a patch to clear X86_FEATURE_MCE for TDX guest. Why does that get dropped?
Even though CPUID reports MCE is supported, all the access to MCE related MSRs causes #VE. If they are accessed via mce_rdmsrl(), the #VE will be fixed up and goes to ex_handler_msr_mce(). Finally lead to panic().
|