| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20250429143114.1724280-2-jun.miao@intel.com>
Date: Tue, 29 Apr 2025 10:31:14 -0400
From: Jun Miao <jun.miao@...el.com>
To: kirill.shutemov@...ux.intel.com,
dave.hansen@...ux.intel.com,
tglx@...utronix.de,
mingo@...hat.com,
bp@...en8.de
Cc: x86@...nel.org, linux-coco@...ts.linux.dev,
linux-kernel@...r.kernel.org, jun.miao@...el.com,
fan.du.com@....codeaurora.org, zhiquan1.li@...el.com
Subject: [V2 PATCH] x86/tdx: add VIRT_CPUID2 virtualization if REDUCE_VE was not successful
From: Zhiquan Li <zhiquan1.li@...el.com>
The ENUM_TOPOLOGY and VIRT_CPUID2 virtualization control are the subset
of the REDUCE_VE control, TD enabling REDUCE_VE will also implicitly
enable ENUM_TOPOLOGY and VIRT_CPUID2. Both features were introduced
earlier than REDUCE_VE. Now if enabling REDUCE_VE is failed
will fall back to enabling ENUM_TOPOLOGY, the same reason is applicable
for VIRT_CPUID2.
The VIRT_CPUID2 feature allows TDX module provides fixed values
eax=0x00feff01, ebx=0, ecx=0 and edx=0, meaning "cache data is returned
by CPUID leaf 0x4" and "TLB data is returned by CPUID leaf 0x18" while
TD guest execution of CPUID leaf 0x2, instead the kernel CPUID #VE
handler returns all zeros. It is quite useful for backward
compatibility.
REDUCE_VE can only be enabled if x2APIC_ID has been properly configured
with unique values for each VCPU. Check if VMM has provided an activated
topology configuration first as it is the prerequisite of REDUCE_VE and
ENUM_TOPOLOGY, so move it to reduce_unnecessary_ve(). The function
enable_cpu_topology_enumeration() was very little and can be
integrated into reduce_unnecessary_ve().
Only try to enable VIRT_CPUID2 when REDUCE_VE was not successful and the
depended x2APIC_ID didn't set to each TD vCPU.
Fixes: cd9ce8217345 ("x86/tdx: Disable unnecessary virtualization exceptions")
Co-developed-by: Jun Miao <jun.miao@...el.com>
Signed-off-by: Jun Miao <jun.miao@...el.com>
Signed-off-by: Zhiquan Li <zhiquan1.li@...el.com>
---
arch/x86/coco/tdx/tdx.c | 52 +++++++++++++++++++++++++++--------------
1 file changed, 34 insertions(+), 18 deletions(-)
diff --git a/arch/x86/coco/tdx/tdx.c b/arch/x86/coco/tdx/tdx.c
index edab6d6049be..94062dbf57fd 100644
--- a/arch/x86/coco/tdx/tdx.c
+++ b/arch/x86/coco/tdx/tdx.c
@@ -247,43 +247,59 @@ static void disable_sept_ve(u64 td_attr)
}
/*
+ * Newer TDX modules provide a "REDUCE_VE" feature. When enabled, it
+ * drastically cuts cases when guests receive #VE on MSR and CPUID accesses,
+ * and TDX module also forces ENUM_TOPOLOGY and VIRT_CPUID to enabled.
+ *
+ * But REDUCE_VE can only be enabled if x2APIC_ID has been properly configured
+ * with unique values for each VCPU. So check if VMM has provided a valid
+ * topology configuration first.
+ *
* TDX 1.0 generates a #VE when accessing topology-related CPUID leafs (0xB and
* 0x1F) and the X2APIC_APICID MSR. The kernel returns all zeros on CPUID #VEs.
* In practice, this means that the kernel can only boot with a plain topology.
* Any complications will cause problems.
*
* The ENUM_TOPOLOGY feature allows the VMM to provide topology information.
- * Enabling the feature eliminates topology-related #VEs: the TDX module
+ * Enabling the feature eliminates topology-related #VEs: the TDX module
* virtualizes accesses to the CPUID leafs and the MSR.
*
- * Enable ENUM_TOPOLOGY if it is available.
+ * The VIRT_CPUID2 feature allows TDX module provides fixed values
+ * eax=0x00feff01, ebx=0, ecx=0 and edx=0, meaning "cache data is returned by
+ * CPUID leaf 0x4" and "TLB data is returned by CPUID leaf 0x18" while TD
+ * guest execution of CPUID leaf 0x2, instead the kernel CPUID #VE handler
+ * returns all zeros. It is quite useful for backward compatibility.
+ *
+ * Both ENUM_TOPOLOGY and VIRT_CPUID2 are earlier than REDUCE_VE, fall back to
+ * enable them if REDUCE_VE was not successful.
*/
-static void enable_cpu_topology_enumeration(void)
+static void reduce_unnecessary_ve(void)
{
+ u64 err = TDX_SUCCESS;
u64 configured;
/* Has the VMM provided a valid topology configuration? */
tdg_vm_rd(TDCS_TOPOLOGY_ENUM_CONFIGURED, &configured);
- if (!configured) {
- pr_err("VMM did not configure X2APIC_IDs properly\n");
- return;
- }
-
- tdg_vm_wr(TDCS_TD_CTLS, TD_CTLS_ENUM_TOPOLOGY, TD_CTLS_ENUM_TOPOLOGY);
-}
-static void reduce_unnecessary_ve(void)
-{
- u64 err = tdg_vm_wr(TDCS_TD_CTLS, TD_CTLS_REDUCE_VE, TD_CTLS_REDUCE_VE);
+ if (configured) {
+ err = tdg_vm_wr(TDCS_TD_CTLS, TD_CTLS_REDUCE_VE, TD_CTLS_REDUCE_VE);
- if (err == TDX_SUCCESS)
- return;
+ /*
+ * Enabling REDUCE_VE includes ENUM_TOPOLOGY. Only try to
+ * enable ENUM_TOPOLOGY if REDUCE_VE was not successful.
+ */
+ if (err != TDX_SUCCESS)
+ tdg_vm_wr(TDCS_TD_CTLS, TD_CTLS_ENUM_TOPOLOGY, TD_CTLS_ENUM_TOPOLOGY);
+ } else
+ pr_err("VMM did not configure X2APIC_IDs properly\n");
/*
- * Enabling REDUCE_VE includes ENUM_TOPOLOGY. Only try to
- * enable ENUM_TOPOLOGY if REDUCE_VE was not successful.
+ * Enabling REDUCE_VE includes VIRT_CPUID2. Only try to enable
+ * VIRT_CPUID2 if REDUCE_VE was not successful.
*/
- enable_cpu_topology_enumeration();
+ if (!configured || err != TDX_SUCCESS)
+ tdg_vm_wr(TDCS_TD_CTLS, TD_CTLS_VIRT_CPUID2, TD_CTLS_VIRT_CPUID2);
+
}
static void tdx_setup(u64 *cc_mask)
--
2.43.0
Powered by blists - more mailing lists