linux-kernel - [PATCH V2 03/12] KVM: TDX: Set arch.has_protected

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250129095902.16391-4-adrian.hunter@intel.com>
Date: Wed, 29 Jan 2025 11:58:52 +0200
From: Adrian Hunter <adrian.hunter@...el.com>
To: pbonzini@...hat.com,
	seanjc@...gle.com
Cc: kvm@...r.kernel.org,
	rick.p.edgecombe@...el.com,
	kai.huang@...el.com,
	adrian.hunter@...el.com,
	reinette.chatre@...el.com,
	xiaoyao.li@...el.com,
	tony.lindgren@...ux.intel.com,
	binbin.wu@...ux.intel.com,
	dmatlack@...gle.com,
	isaku.yamahata@...el.com,
	nik.borisov@...e.com,
	linux-kernel@...r.kernel.org,
	yan.y.zhao@...el.com,
	chao.gao@...el.com,
	weijiang.yang@...el.com
Subject: [PATCH V2 03/12] KVM: TDX: Set arch.has_protected_state to true

TDX VMs have protected state. Accordingly, set arch.has_protected_state to
true.

This will cause the following IOCTL functions to return an error:

	kvm_arch_vcpu_ioctl()	case KVM_GET_SREGS2
	kvm_arch_vcpu_ioctl()	case KVM_SET_SREGS2
	kvm_arch_vcpu_ioctl_get_regs()
	kvm_arch_vcpu_ioctl_set_regs()
	kvm_arch_vcpu_ioctl_get_sregs()
	kvm_arch_vcpu_ioctl_set_sregs()
	kvm_vcpu_ioctl_x86_get_debugregs()
	kvm_vcpu_ioctl_x86_set_debugregs
	kvm_vcpu_ioctl_x86_get_xcrs()
	kvm_vcpu_ioctl_x86_set_xcrs()

In addition, the following will error for confidential FPU state:

	kvm_vcpu_ioctl_x86_get_xsave ()
	kvm_vcpu_ioctl_x86_get_xsave2()
	kvm_vcpu_ioctl_x86_set_xsave()
	kvm_arch_vcpu_ioctl_get_fpu()
	kvm_arch_vcpu_ioctl_set_fpu()

And finally, in accordance with commit 66155de93bcf ("KVM: x86: Disallow
read-only memslots for SEV-ES and SEV-SNP (and TDX)"), read-only
memslots will be disallowed.

Signed-off-by: Adrian Hunter <adrian.hunter@...el.com>
---
TD vcpu enter/exit v2:
 - New patch
---
 arch/x86/kvm/vmx/tdx.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
index ea9498028212..a7ebdafdfd82 100644
--- a/arch/x86/kvm/vmx/tdx.c
+++ b/arch/x86/kvm/vmx/tdx.c
@@ -553,6 +553,7 @@ int tdx_vm_init(struct kvm *kvm)
 {
 	struct kvm_tdx *kvm_tdx = to_kvm_tdx(kvm);
 
+	kvm->arch.has_protected_state = true;
 	kvm->arch.has_private_mem = true;
 
 	/*
-- 
2.43.0