lkml.org 
[lkml]   [2024]   [Mar]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH v19 093/130] KVM: TDX: Implements vcpu request_immediate_exit
    On Mon, Feb 26, 2024 at 12:26:35AM -0800, isaku.yamahata@intel.com wrote:
    >From: Isaku Yamahata <isaku.yamahata@intel.com>
    >
    >Now we are able to inject interrupts into TDX vcpu, it's ready to block TDX
    >vcpu. Wire up kvm x86 methods for blocking/unblocking vcpu for TDX. To
    >unblock on pending events, request immediate exit methods is also needed.

    TDX doesn't support this immediate exit. It is considered as a potential
    attack to TDs. TDX module deploys 0/1-step mitigations to prevent this.
    Even KVM issues a self-IPI before TD-entry, TD-exit will happen after
    the guest runs a random number of instructions.

    KVM shouldn't request immediate exits in the first place. Just emit a
    warning if KVM tries to do this.

    >
    >Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com>
    >Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
    >---
    > arch/x86/kvm/vmx/main.c | 12 +++++++++++-
    > 1 file changed, 11 insertions(+), 1 deletion(-)
    >
    >diff --git a/arch/x86/kvm/vmx/main.c b/arch/x86/kvm/vmx/main.c
    >index f2c9d6358f9e..ee6c04959d4c 100644
    >--- a/arch/x86/kvm/vmx/main.c
    >+++ b/arch/x86/kvm/vmx/main.c
    >@@ -372,6 +372,16 @@ static void vt_enable_irq_window(struct kvm_vcpu *vcpu)
    > vmx_enable_irq_window(vcpu);
    > }
    >
    >+static void vt_request_immediate_exit(struct kvm_vcpu *vcpu)
    >+{
    >+ if (is_td_vcpu(vcpu)) {
    >+ __kvm_request_immediate_exit(vcpu);
    >+ return;
    >+ }
    >+
    >+ vmx_request_immediate_exit(vcpu);
    >+}
    >+
    > static u8 vt_get_mt_mask(struct kvm_vcpu *vcpu, gfn_t gfn, bool is_mmio)
    > {
    > if (is_td_vcpu(vcpu))
    >@@ -549,7 +559,7 @@ struct kvm_x86_ops vt_x86_ops __initdata = {
    > .check_intercept = vmx_check_intercept,
    > .handle_exit_irqoff = vmx_handle_exit_irqoff,
    >
    >- .request_immediate_exit = vmx_request_immediate_exit,
    >+ .request_immediate_exit = vt_request_immediate_exit,
    >
    > .sched_in = vt_sched_in,
    >
    >--
    >2.25.1
    >
    >

    \
     
     \ /
      Last update: 2024-05-27 16:14    [W:8.772 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site