Commit 3c5c3245 authored by Kai Huang's avatar Kai Huang Committed by Paolo Bonzini
Browse files

KVM: VMX: Include MKTME KeyID bits in shadow_zero_check 



Intel MKTME KeyID bits (including Intel TDX private KeyID bits) should
never be set to SPTE.  Set shadow_me_value to 0 and shadow_me_mask to
include all MKTME KeyID bits to include them to shadow_zero_check.

Signed-off-by: default avatarKai Huang <kai.huang@intel.com>
Message-Id: <27bc10e97a3c0b58a4105ff9107448c190328239.1650363789.git.kai.huang@intel.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent e54f1ff2

arch/x86/kvm/mmu.h

+19 −0
Original line number Diff line number Diff line
@@ -89,6 +89,25 @@ static inline gfn_t kvm_mmu_max_gfn(void) 
	return (1ULL << (max_gpa_bits - PAGE_SHIFT)) - 1;

}



static inline u8 kvm_get_shadow_phys_bits(void)

{

	/*

	 * boot_cpu_data.x86_phys_bits is reduced when MKTME or SME are detected

	 * in CPU detection code, but the processor treats those reduced bits as

	 * 'keyID' thus they are not reserved bits. Therefore KVM needs to look at

	 * the physical address bits reported by CPUID.

	 */

	if (likely(boot_cpu_data.extended_cpuid_level >= 0x80000008))

		return cpuid_eax(0x80000008) & 0xff;



	/*

	 * Quite weird to have VMX or SVM but not MAXPHYADDR; probably a VM with

	 * custom CPUID.  Proceed with whatever the kernel found since these features

	 * aren't virtualizable (SME/SEV also require CPUIDs higher than 0x80000008).

	 */

	return boot_cpu_data.x86_phys_bits;

}



void kvm_mmu_set_mmio_spte_mask(u64 mmio_value, u64 mmio_mask, u64 access_mask);

void kvm_mmu_set_me_spte_mask(u64 me_value, u64 me_mask);

void kvm_mmu_set_ept_masks(bool has_ad_bits, bool has_exec_only);

arch/x86/kvm/mmu/spte.c

+0 −19
Original line number Diff line number Diff line
@@ -311,25 +311,6 @@ u64 kvm_mmu_changed_pte_notifier_make_spte(u64 old_spte, kvm_pfn_t new_pfn) 
	return new_spte;

}



static u8 kvm_get_shadow_phys_bits(void)

{

	/*

	 * boot_cpu_data.x86_phys_bits is reduced when MKTME or SME are detected

	 * in CPU detection code, but the processor treats those reduced bits as

	 * 'keyID' thus they are not reserved bits. Therefore KVM needs to look at

	 * the physical address bits reported by CPUID.

	 */

	if (likely(boot_cpu_data.extended_cpuid_level >= 0x80000008))

		return cpuid_eax(0x80000008) & 0xff;



	/*

	 * Quite weird to have VMX or SVM but not MAXPHYADDR; probably a VM with

	 * custom CPUID.  Proceed with whatever the kernel found since these features

	 * aren't virtualizable (SME/SEV also require CPUIDs higher than 0x80000008).

	 */

	return boot_cpu_data.x86_phys_bits;

}



u64 mark_spte_for_access_track(u64 spte)

{

	if (spte_ad_enabled(spte))

arch/x86/kvm/vmx/vmx.c

+31 −0
Original line number Diff line number Diff line
@@ -7883,6 +7883,31 @@ static __init void vmx_setup_user_return_msrs(void) 
		kvm_add_user_return_msr(vmx_uret_msrs_list[i]);

}



static void __init vmx_setup_me_spte_mask(void)

{

	u64 me_mask = 0;



	/*

	 * kvm_get_shadow_phys_bits() returns shadow_phys_bits.  Use

	 * the former to avoid exposing shadow_phys_bits.

	 *

	 * On pre-MKTME system, boot_cpu_data.x86_phys_bits equals to

	 * shadow_phys_bits.  On MKTME and/or TDX capable systems,

	 * boot_cpu_data.x86_phys_bits holds the actual physical address

	 * w/o the KeyID bits, and shadow_phys_bits equals to MAXPHYADDR

	 * reported by CPUID.  Those bits between are KeyID bits.

	 */

	if (boot_cpu_data.x86_phys_bits != kvm_get_shadow_phys_bits())

		me_mask = rsvd_bits(boot_cpu_data.x86_phys_bits,

			kvm_get_shadow_phys_bits() - 1);

	/*

	 * Unlike SME, host kernel doesn't support setting up any

	 * MKTME KeyID on Intel platforms.  No memory encryption

	 * bits should be included into the SPTE.

	 */

	kvm_mmu_set_me_spte_mask(0, me_mask);

}



static struct kvm_x86_init_ops vmx_init_ops __initdata;



static __init int hardware_setup(void)
@@ -7985,6 +8010,12 @@ static __init int hardware_setup(void) 
		kvm_mmu_set_ept_masks(enable_ept_ad_bits,

				      cpu_has_vmx_ept_execute_only());



	/*

	 * Setup shadow_me_value/shadow_me_mask to include MKTME KeyID

	 * bits to shadow_zero_check.

	 */

	vmx_setup_me_spte_mask();



	kvm_configure_mmu(enable_ept, 0, vmx_get_max_tdp_level(),

			  ept_caps_to_lpage_level(vmx_capability.ept));