Commit 765a0542 authored by Kai Huang's avatar Kai Huang Committed by Dave Hansen
Browse files

x86/virt/tdx: Detect TDX during kernel boot 



Intel Trust Domain Extensions (TDX) protects guest VMs from malicious
host and certain physical attacks.  A CPU-attested software module
called 'the TDX module' runs inside a new isolated memory range as a
trusted hypervisor to manage and run protected VMs.

Pre-TDX Intel hardware has support for a memory encryption architecture
called MKTME.  The memory encryption hardware underpinning MKTME is also
used for Intel TDX.  TDX ends up "stealing" some of the physical address
space from the MKTME architecture for crypto-protection to VMs.  The
BIOS is responsible for partitioning the "KeyID" space between legacy
MKTME and TDX.  The KeyIDs reserved for TDX are called 'TDX private
KeyIDs' or 'TDX KeyIDs' for short.

During machine boot, TDX microcode verifies that the BIOS programmed TDX
private KeyIDs consistently and correctly programmed across all CPU
packages.  The MSRs are locked in this state after verification.  This
is why MSR_IA32_MKTME_KEYID_PARTITIONING gets used for TDX enumeration:
it indicates not just that the hardware supports TDX, but that all the
boot-time security checks passed.

The TDX module is expected to be loaded by the BIOS when it enables TDX,
but the kernel needs to properly initialize it before it can be used to
create and run any TDX guests.  The TDX module will be initialized by
the KVM subsystem when KVM wants to use TDX.

Detect platform TDX support by detecting TDX private KeyIDs.

The TDX module itself requires one TDX KeyID as the 'TDX global KeyID'
to protect its metadata.  Each TDX guest also needs a TDX KeyID for its
own protection.  Just use the first TDX KeyID as the global KeyID and
leave the rest for TDX guests.  If no TDX KeyID is left for TDX guests,
disable TDX as initializing the TDX module alone is useless.

[ dhansen: add X86_FEATURE, replace helper function ]

Signed-off-by: default avatarKai Huang <kai.huang@intel.com>
Signed-off-by: default avatarDave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: default avatarKirill A. Shutemov <kirill.shutemov@linux.intel.com>
Reviewed-by: default avatarIsaku Yamahata <isaku.yamahata@intel.com>
Reviewed-by: default avatarDavid Hildenbrand <david@redhat.com>
Reviewed-by: default avatarDave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: default avatarKuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Link: https://lore.kernel.org/all/20231208170740.53979-1-dave.hansen%40intel.com
parent 33cc938e

arch/x86/include/asm/cpufeatures.h

+1 −0
Original line number Diff line number Diff line
@@ -198,6 +198,7 @@ 
#define X86_FEATURE_CAT_L3		( 7*32+ 4) /* Cache Allocation Technology L3 */

#define X86_FEATURE_CAT_L2		( 7*32+ 5) /* Cache Allocation Technology L2 */

#define X86_FEATURE_CDP_L3		( 7*32+ 6) /* Code and Data Prioritization L3 */

#define X86_FEATURE_TDX_HOST_PLATFORM	( 7*32+ 7) /* Platform supports being a TDX host */

#define X86_FEATURE_HW_PSTATE		( 7*32+ 8) /* AMD HW-PState */

#define X86_FEATURE_PROC_FEEDBACK	( 7*32+ 9) /* AMD ProcFeedbackInterface */

#define X86_FEATURE_XCOMPACTED		( 7*32+10) /* "" Use compacted XSTATE (XSAVES or XSAVEC) */

arch/x86/include/asm/msr-index.h

+3 −0
Original line number Diff line number Diff line
@@ -536,6 +536,9 @@ 
#define MSR_RELOAD_PMC0			0x000014c1

#define MSR_RELOAD_FIXED_CTR0		0x00001309



/* KeyID partitioning between MKTME and TDX */

#define MSR_IA32_MKTME_KEYID_PARTITIONING	0x00000087



/*

 * AMD64 MSRs. Not complete. See the architecture manual for a more

 * complete list.

arch/x86/include/asm/tdx.h

+3 −0
Original line number Diff line number Diff line
@@ -83,6 +83,9 @@ static inline long tdx_kvm_hypercall(unsigned int nr, unsigned long p1, 
u64 __seamcall(u64 fn, struct tdx_module_args *args);

u64 __seamcall_ret(u64 fn, struct tdx_module_args *args);

u64 __seamcall_saved_ret(u64 fn, struct tdx_module_args *args);

void tdx_init(void);

#else

static inline void tdx_init(void) { }

#endif	/* CONFIG_INTEL_TDX_HOST */



#endif /* !__ASSEMBLY__ */

arch/x86/kernel/cpu/common.c

+2 −0
Original line number Diff line number Diff line
@@ -66,6 +66,7 @@ 
#include <asm/set_memory.h>

#include <asm/traps.h>

#include <asm/sev.h>

#include <asm/tdx.h>



#include "cpu.h"
@@ -1987,6 +1988,7 @@ static __init void identify_boot_cpu(void) 
	setup_cr_pinning();



	tsx_init();

	tdx_init();

	lkgs_init();

}

arch/x86/virt/vmx/tdx/Makefile

+1 −1
Original line number Diff line number Diff line 
# SPDX-License-Identifier: GPL-2.0-only

obj-y += seamcall.o
 
obj-y += seamcall.o tdx.o