KVM: VMX: Include MKTME KeyID bits in shadow_zero_check

Intel MKTME KeyID bits (including Intel TDX private KeyID bits) should
never be set to SPTE.  Set shadow_me_value to 0 and shadow_me_mask to
include all MKTME KeyID bits to include them to shadow_zero_check.

Signed-off-by: Kai Huang <kai.huang@intel.com>
Message-Id: <27bc10e97a3c0b58a4105ff9107448c190328239.1650363789.git.kai.huang@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

diff --git a/arch/x86/kvm/mmu.h b/arch/x86/kvm/mmu.h
index 1db11cd..f819286 100644 (file)
--- a/arch/x86/kvm/mmu.h
+++ b/arch/x86/kvm/mmu.h
@@ -89,6 +89,25 @@ static inline gfn_t kvm_mmu_max_gfn(void)
        return (1ULL << (max_gpa_bits - PAGE_SHIFT)) - 1;
 }
 
+static inline u8 kvm_get_shadow_phys_bits(void)
+{
+       /*
+        * boot_cpu_data.x86_phys_bits is reduced when MKTME or SME are detected
+        * in CPU detection code, but the processor treats those reduced bits as
+        * 'keyID' thus they are not reserved bits. Therefore KVM needs to look at
+        * the physical address bits reported by CPUID.
+        */
+       if (likely(boot_cpu_data.extended_cpuid_level >= 0x80000008))
+               return cpuid_eax(0x80000008) & 0xff;
+
+       /*
+        * Quite weird to have VMX or SVM but not MAXPHYADDR; probably a VM with
+        * custom CPUID.  Proceed with whatever the kernel found since these features
+        * aren't virtualizable (SME/SEV also require CPUIDs higher than 0x80000008).
+        */
+       return boot_cpu_data.x86_phys_bits;
+}
+
 void kvm_mmu_set_mmio_spte_mask(u64 mmio_value, u64 mmio_mask, u64 access_mask);
 void kvm_mmu_set_me_spte_mask(u64 me_value, u64 me_mask);
 void kvm_mmu_set_ept_masks(bool has_ad_bits, bool has_exec_only);

diff --git a/arch/x86/kvm/mmu/spte.c b/arch/x86/kvm/mmu/spte.c
index 12b9b3f..b5960bb 100644 (file)
--- a/arch/x86/kvm/mmu/spte.c
+++ b/arch/x86/kvm/mmu/spte.c
@@ -311,25 +311,6 @@ u64 kvm_mmu_changed_pte_notifier_make_spte(u64 old_spte, kvm_pfn_t new_pfn)
        return new_spte;
 }
 
-static u8 kvm_get_shadow_phys_bits(void)
-{
-       /*
-        * boot_cpu_data.x86_phys_bits is reduced when MKTME or SME are detected
-        * in CPU detection code, but the processor treats those reduced bits as
-        * 'keyID' thus they are not reserved bits. Therefore KVM needs to look at
-        * the physical address bits reported by CPUID.
-        */
-       if (likely(boot_cpu_data.extended_cpuid_level >= 0x80000008))
-               return cpuid_eax(0x80000008) & 0xff;
-
-       /*
-        * Quite weird to have VMX or SVM but not MAXPHYADDR; probably a VM with
-        * custom CPUID.  Proceed with whatever the kernel found since these features
-        * aren't virtualizable (SME/SEV also require CPUIDs higher than 0x80000008).
-        */
-       return boot_cpu_data.x86_phys_bits;
-}
-
 u64 mark_spte_for_access_track(u64 spte)
 {
        if (spte_ad_enabled(spte))

diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c
index cf85819..5fb37e7 100644 (file)
--- a/arch/x86/kvm/vmx/vmx.c
+++ b/arch/x86/kvm/vmx/vmx.c
@@ -7883,6 +7883,31 @@ static __init void vmx_setup_user_return_msrs(void)
                kvm_add_user_return_msr(vmx_uret_msrs_list[i]);
 }
 
+static void __init vmx_setup_me_spte_mask(void)
+{
+       u64 me_mask = 0;
+
+       /*
+        * kvm_get_shadow_phys_bits() returns shadow_phys_bits.  Use
+        * the former to avoid exposing shadow_phys_bits.
+        *
+        * On pre-MKTME system, boot_cpu_data.x86_phys_bits equals to
+        * shadow_phys_bits.  On MKTME and/or TDX capable systems,
+        * boot_cpu_data.x86_phys_bits holds the actual physical address
+        * w/o the KeyID bits, and shadow_phys_bits equals to MAXPHYADDR
+        * reported by CPUID.  Those bits between are KeyID bits.
+        */
+       if (boot_cpu_data.x86_phys_bits != kvm_get_shadow_phys_bits())
+               me_mask = rsvd_bits(boot_cpu_data.x86_phys_bits,
+                       kvm_get_shadow_phys_bits() - 1);
+       /*
+        * Unlike SME, host kernel doesn't support setting up any
+        * MKTME KeyID on Intel platforms.  No memory encryption
+        * bits should be included into the SPTE.
+        */
+       kvm_mmu_set_me_spte_mask(0, me_mask);
+}
+
 static struct kvm_x86_init_ops vmx_init_ops __initdata;
 
 static __init int hardware_setup(void)
@@ -7985,6 +8010,12 @@ static __init int hardware_setup(void)
                kvm_mmu_set_ept_masks(enable_ept_ad_bits,
                                      cpu_has_vmx_ept_execute_only());
 
+       /*
+        * Setup shadow_me_value/shadow_me_mask to include MKTME KeyID
+        * bits to shadow_zero_check.
+        */
+       vmx_setup_me_spte_mask();
+
        kvm_configure_mmu(enable_ept, 0, vmx_get_max_tdp_level(),
                          ept_caps_to_lpage_level(vmx_capability.ept));