lkml.org 
[lkml]   [2023]   [Mar]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v13 109/113] KVM: TDX: Add methods to ignore virtual apic related operation
    Date
    From: Isaku Yamahata <isaku.yamahata@intel.com>

    TDX protects TDX guest APIC state from VMM. Implement access methods of
    TDX guest vAPIC state to ignore them or return zero.

    Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com>
    ---
    arch/x86/kvm/vmx/main.c | 61 ++++++++++++++++++++++++++++++++++----
    arch/x86/kvm/vmx/tdx.c | 6 ++++
    arch/x86/kvm/vmx/x86_ops.h | 3 ++
    3 files changed, 64 insertions(+), 6 deletions(-)

    diff --git a/arch/x86/kvm/vmx/main.c b/arch/x86/kvm/vmx/main.c
    index 21aebf38697a..c79f46ede97e 100644
    --- a/arch/x86/kvm/vmx/main.c
    +++ b/arch/x86/kvm/vmx/main.c
    @@ -364,6 +364,14 @@ static bool vt_apic_init_signal_blocked(struct kvm_vcpu *vcpu)
    return vmx_apic_init_signal_blocked(vcpu);
    }

    +static void vt_set_virtual_apic_mode(struct kvm_vcpu *vcpu)
    +{
    + if (is_td_vcpu(vcpu))
    + return tdx_set_virtual_apic_mode(vcpu);
    +
    + return vmx_set_virtual_apic_mode(vcpu);
    +}
    +
    static void vt_apicv_post_state_restore(struct kvm_vcpu *vcpu)
    {
    struct pi_desc *pi = vcpu_to_pi_desc(vcpu);
    @@ -372,6 +380,31 @@ static void vt_apicv_post_state_restore(struct kvm_vcpu *vcpu)
    memset(pi->pir, 0, sizeof(pi->pir));
    }

    +static void vt_hwapic_irr_update(struct kvm_vcpu *vcpu, int max_irr)
    +{
    + if (is_td_vcpu(vcpu))
    + return;
    +
    + return vmx_hwapic_irr_update(vcpu, max_irr);
    +}
    +
    +static void vt_hwapic_isr_update(int max_isr)
    +{
    + if (is_td_vcpu(kvm_get_running_vcpu()))
    + return;
    +
    + return vmx_hwapic_isr_update(max_isr);
    +}
    +
    +static bool vt_guest_apic_has_interrupt(struct kvm_vcpu *vcpu)
    +{
    + /* TDX doesn't support L2 at the moment. */
    + if (WARN_ON_ONCE(is_td_vcpu(vcpu)))
    + return false;
    +
    + return vmx_guest_apic_has_interrupt(vcpu);
    +}
    +
    static int vt_sync_pir_to_irr(struct kvm_vcpu *vcpu)
    {
    if (is_td_vcpu(vcpu))
    @@ -809,6 +842,22 @@ static void vt_update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr)
    vmx_update_cr8_intercept(vcpu, tpr, irr);
    }

    +static void vt_set_apic_access_page_addr(struct kvm_vcpu *vcpu)
    +{
    + if (is_td_vcpu(vcpu))
    + return;
    +
    + vmx_set_apic_access_page_addr(vcpu);
    +}
    +
    +static void vt_refresh_apicv_exec_ctrl(struct kvm_vcpu *vcpu)
    +{
    + if (WARN_ON_ONCE(is_td_vcpu(vcpu)))
    + return;
    +
    + vmx_refresh_apicv_exec_ctrl(vcpu);
    +}
    +
    static void vt_load_eoi_exitmap(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap)
    {
    if (is_td_vcpu(vcpu))
    @@ -1019,15 +1068,15 @@ struct kvm_x86_ops vt_x86_ops __initdata = {
    .enable_nmi_window = vt_enable_nmi_window,
    .enable_irq_window = vt_enable_irq_window,
    .update_cr8_intercept = vt_update_cr8_intercept,
    - .set_virtual_apic_mode = vmx_set_virtual_apic_mode,
    - .set_apic_access_page_addr = vmx_set_apic_access_page_addr,
    - .refresh_apicv_exec_ctrl = vmx_refresh_apicv_exec_ctrl,
    + .set_virtual_apic_mode = vt_set_virtual_apic_mode,
    + .set_apic_access_page_addr = vt_set_apic_access_page_addr,
    + .refresh_apicv_exec_ctrl = vt_refresh_apicv_exec_ctrl,
    .load_eoi_exitmap = vt_load_eoi_exitmap,
    .apicv_post_state_restore = vt_apicv_post_state_restore,
    .required_apicv_inhibits = VMX_REQUIRED_APICV_INHIBITS,
    - .hwapic_irr_update = vmx_hwapic_irr_update,
    - .hwapic_isr_update = vmx_hwapic_isr_update,
    - .guest_apic_has_interrupt = vmx_guest_apic_has_interrupt,
    + .hwapic_irr_update = vt_hwapic_irr_update,
    + .hwapic_isr_update = vt_hwapic_isr_update,
    + .guest_apic_has_interrupt = vt_guest_apic_has_interrupt,
    .sync_pir_to_irr = vt_sync_pir_to_irr,
    .deliver_interrupt = vt_deliver_interrupt,
    .dy_apicv_has_pending_interrupt = pi_has_pending_interrupt,
    diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
    index 23a184d5ab47..8e392bc3330b 100644
    --- a/arch/x86/kvm/vmx/tdx.c
    +++ b/arch/x86/kvm/vmx/tdx.c
    @@ -1866,6 +1866,12 @@ void tdx_enable_smi_window(struct kvm_vcpu *vcpu)
    }
    #endif

    +void tdx_set_virtual_apic_mode(struct kvm_vcpu *vcpu)
    +{
    + /* Only x2APIC mode is supported for TD. */
    + WARN_ON_ONCE(kvm_get_apic_mode(vcpu) != LAPIC_MODE_X2APIC);
    +}
    +
    int tdx_get_cpl(struct kvm_vcpu *vcpu)
    {
    return 0;
    diff --git a/arch/x86/kvm/vmx/x86_ops.h b/arch/x86/kvm/vmx/x86_ops.h
    index 9be0ac32d2b4..d049e0c72ed0 100644
    --- a/arch/x86/kvm/vmx/x86_ops.h
    +++ b/arch/x86/kvm/vmx/x86_ops.h
    @@ -174,6 +174,7 @@ void tdx_get_exit_info(struct kvm_vcpu *vcpu, u32 *reason,
    bool tdx_has_emulated_msr(u32 index, bool write);
    int tdx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr);
    int tdx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr);
    +void tdx_set_virtual_apic_mode(struct kvm_vcpu *vcpu);

    int tdx_get_cpl(struct kvm_vcpu *vcpu);
    void tdx_cache_reg(struct kvm_vcpu *vcpu, enum kvm_reg reg);
    @@ -226,6 +227,8 @@ static inline bool tdx_has_emulated_msr(u32 index, bool write) { return false; }
    static inline int tdx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr) { return 1; }
    static inline int tdx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr) { return 1; }

    +static inline void tdx_set_virtual_apic_mode(struct kvm_vcpu *vcpu) {}
    +
    static inline int tdx_get_cpl(struct kvm_vcpu *vcpu) { return 0; }
    static inline void tdx_cache_reg(struct kvm_vcpu *vcpu, enum kvm_reg reg) {}
    static inline unsigned long tdx_get_rflags(struct kvm_vcpu *vcpu) { return 0; }
    --
    2.25.1
    \
     
     \ /
      Last update: 2023-03-27 00:55    [W:3.990 / U:0.032 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site