linux-kernel - Re: [PATCH V2 05/12] KVM: TDX: Implement TDX vcpu enter/exit path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <06c73413-d751-45bf-bde9-cdb4f56f95b0@intel.com>
Date: Thu, 20 Feb 2025 21:16:02 +0800
From: Xiaoyao Li <xiaoyao.li@...el.com>
To: Adrian Hunter <adrian.hunter@...el.com>, pbonzini@...hat.com,
 seanjc@...gle.com
Cc: kvm@...r.kernel.org, rick.p.edgecombe@...el.com, kai.huang@...el.com,
 reinette.chatre@...el.com, tony.lindgren@...ux.intel.com,
 binbin.wu@...ux.intel.com, dmatlack@...gle.com, isaku.yamahata@...el.com,
 nik.borisov@...e.com, linux-kernel@...r.kernel.org, yan.y.zhao@...el.com,
 chao.gao@...el.com, weijiang.yang@...el.com
Subject: Re: [PATCH V2 05/12] KVM: TDX: Implement TDX vcpu enter/exit path

On 1/29/2025 5:58 PM, Adrian Hunter wrote:
> +#define TDX_REGS_UNSUPPORTED_SET	(BIT(VCPU_EXREG_RFLAGS) |	\
> +					 BIT(VCPU_EXREG_SEGMENTS))
> +
> +fastpath_t tdx_vcpu_run(struct kvm_vcpu *vcpu, bool force_immediate_exit)
> +{
> +	/*
> +	 * force_immediate_exit requires vCPU entering for events injection with
> +	 * an immediately exit followed. But The TDX module doesn't guarantee
> +	 * entry, it's already possible for KVM to_think_ it completely entry
> +	 * to the guest without actually having done so.
> +	 * Since KVM never needs to force an immediate exit for TDX, and can't
> +	 * do direct injection, just warn on force_immediate_exit.
> +	 */
> +	WARN_ON_ONCE(force_immediate_exit);
> +
> +	trace_kvm_entry(vcpu, force_immediate_exit);
> +
> +	tdx_vcpu_enter_exit(vcpu);
> +
> +	vcpu->arch.regs_avail &= ~TDX_REGS_UNSUPPORTED_SET;

I don't understand this. Why only clear RFLAGS and SEGMENTS?

When creating the vcpu, vcpu->arch.regs_avail = ~0 in 
kvm_arch_vcpu_create().

now it only clears RFLAGS and SEGMENTS for TDX vcpu, which leaves other 
bits set. But I don't see any code that syncs the guest value of into 
vcpu->arch.regs[reg].

> +	trace_kvm_exit(vcpu, KVM_ISA_VMX);
> +
> +	return EXIT_FASTPATH_NONE;
> +}