[PATCH 0/2] KVM: TDX: Enable VM-DoS Prevention Features for TDX

[Xiaoyao Li <xiaoyao.li@intel.com>]

There are 3 existing DoS prevention features that can be used by
KVM/Linux to prevent DoS attacks from guests.

1. Bus Lock VM Exit

This feature is controlled by KVM. KVM exposes KVM_CAP_X86_BUS_LOCK_EXIT
as the interface for userspace to query support for and enable the
feature. When enabled, a VM exit occurs after the execution of an
instruction that asserts a bus lock. This VM exit is trap-like, meaning
it does not prevent the bus lock from occurring but can detect that one
has occurred. Similarly, there is another bus lock detection feature for
OS usage, where a #DB is raised when a bus lock occurs at CPL > 0. KVM
does not use this feature to detect bus locks from guests, but
virtualizes it for the guest so that the guest can use it to detect bus
locks from its own userspace.

2. Notify VM Exit

This feature is also controlled by KVM. KVM exposes
KVM_CAP_X86_NOTIFY_VMEXIT as the interface for userspace. When enabled,
a VM exit occurs if certain operations prevent the processor from
reaching an instruction boundary within the configured time window.

3. Split Lock Detection

This feature is controlled by the host kernel rather than KVM. When
enabled, a #AC is raised before a split lock can be acquired. Since the
MSR controlling this feature is per-core in scope, KVM does not
virtualize it for guests. As a result, when a guest split lock triggers
a #AC, the exception is unexpected from the guest's perspective. KVM
addresses this by intercepting the #AC and allowing the host to handle it.

For features 1 and 2, support was missed (inadvertently omitted) for TDX
during the initial TDX base support upstreaming. However, KVM still
reports KVM_CAP_X86_BUS_LOCK_EXIT and KVM_CAP_X86_NOTIFY_VMEXIT as
supported even for TDX guests. This means userspace does not receive an
error when attempting to enable these features for TDs, even though they
are not actually being enabled.

For feature 3, KVM cannot intercept #AC from TDs. There was a prior
effort[1] to enlighten the Linux TD guest kernel to handle such #AC.
however, it was not accepted. We are looking at TDX architecture
enhancement to allow intercepting #AC from TDs.

This series therefore focuses on fixing the CAPs reporting issue and
enabling features 1 and 2 for TDX. Specifically, this series adds the
codes to call SEAMCALLs to set the controlling bits for the features in
TD VMCS and implement the corresponding exit handlers.

[1] https://lore.kernel.org/all/20260107134955.3293885-1-xiaoyao.li@intel.com/ 

Xiaoyao Li (2):
  KVM: TDX: Enable Notify VM exit
  KVM: TDX: Enable Bus Lock VM exit

 arch/x86/kvm/vmx/tdx.c | 33 ++++++++++++++++++++++++++++++++-
 arch/x86/kvm/vmx/vmx.c | 25 ++++++++++++++++---------
 arch/x86/kvm/vmx/vmx.h |  2 ++
 3 files changed, 50 insertions(+), 10 deletions(-)


base-commit: 1590cf0329716306e948a8fc29f1d3ee87d3989f
-- 
2.43.0