* [PATCH v2] KVM: TDX: Force split irqchip for TDX at irqchip creation time
@ 2025-08-27 1:17 Sagi Shahar
2025-08-27 1:41 ` Binbin Wu
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Sagi Shahar @ 2025-08-27 1:17 UTC (permalink / raw)
To: Sean Christopherson, Paolo Bonzini, Thomas Gleixner, Ingo Molnar,
Borislav Petkov, Dave Hansen, Binbin Wu, Ira Weiny,
H. Peter Anvin
Cc: linux-kernel, kvm, x86, Sagi Shahar
TDX module protects the EOI-bitmap which prevents the use of in-kernel
I/O APIC. See more details in the original patch [1]
The current implementation already enforces the use of split irqchip for
TDX but it does so at the vCPU creation time which is generally to late
to fallback to split irqchip.
This patch follows Sean's recomendation from [2] and move the check if
I/O APIC is supported for the VM at irqchip creation time.
[1] https://lore.kernel.org/lkml/20250222014757.897978-11-binbin.wu@linux.intel.com/
[2] https://lore.kernel.org/lkml/aK3vZ5HuKKeFuuM4@google.com/
Suggested-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Sagi Shahar <sagis@google.com>
---
arch/x86/include/asm/kvm_host.h | 1 +
arch/x86/kvm/vmx/tdx.c | 6 ++++++
arch/x86/kvm/x86.c | 9 +++++++++
3 files changed, 16 insertions(+)
diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
index f19a76d3ca0e..6a4019d3a184 100644
--- a/arch/x86/include/asm/kvm_host.h
+++ b/arch/x86/include/asm/kvm_host.h
@@ -1357,6 +1357,7 @@ struct kvm_arch {
u8 vm_type;
bool has_private_mem;
bool has_protected_state;
+ bool has_protected_eoi;
bool pre_fault_allowed;
struct hlist_head *mmu_page_hash;
struct list_head active_mmu_pages;
diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
index 66744f5768c8..9637d9da1af1 100644
--- a/arch/x86/kvm/vmx/tdx.c
+++ b/arch/x86/kvm/vmx/tdx.c
@@ -658,6 +658,12 @@ int tdx_vm_init(struct kvm *kvm)
*/
kvm->max_vcpus = min_t(int, kvm->max_vcpus, num_present_cpus());
+ /*
+ * TDX Module doesn't allow the hypervisor to modify the EOI-bitmap,
+ * i.e. all EOIs are accelerated and never trigger exits.
+ */
+ kvm->arch.has_protected_eoi = true;
+
kvm_tdx->state = TD_STATE_UNINITIALIZED;
return 0;
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index a1c49bc681c4..57b4d5ba2568 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -6966,6 +6966,15 @@ int kvm_arch_vm_ioctl(struct file *filp, unsigned int ioctl, unsigned long arg)
if (irqchip_in_kernel(kvm))
goto create_irqchip_unlock;
+ /*
+ * Disallow an in-kernel I/O APIC if the VM has protected EOIs,
+ * i.e. if KVM can't intercept EOIs and thus can't properly
+ * emulate level-triggered interrupts.
+ */
+ r = -ENOTTY;
+ if (kvm->arch.has_protected_eoi)
+ goto create_irqchip_unlock;
+
r = -EINVAL;
if (kvm->created_vcpus)
goto create_irqchip_unlock;
--
2.51.0.261.g7ce5a0a67e-goog
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH v2] KVM: TDX: Force split irqchip for TDX at irqchip creation time
2025-08-27 1:17 [PATCH v2] KVM: TDX: Force split irqchip for TDX at irqchip creation time Sagi Shahar
@ 2025-08-27 1:41 ` Binbin Wu
2025-08-27 6:22 ` Xiaoyao Li
2025-09-16 0:25 ` Sean Christopherson
2 siblings, 0 replies; 6+ messages in thread
From: Binbin Wu @ 2025-08-27 1:41 UTC (permalink / raw)
To: Sagi Shahar
Cc: Sean Christopherson, Paolo Bonzini, Thomas Gleixner, Ingo Molnar,
Borislav Petkov, Dave Hansen, Ira Weiny, H. Peter Anvin,
linux-kernel, kvm, x86
On 8/27/2025 9:17 AM, Sagi Shahar wrote:
> TDX module protects the EOI-bitmap which prevents the use of in-kernel
> I/O APIC. See more details in the original patch [1]
>
> The current implementation already enforces the use of split irqchip for
> TDX but it does so at the vCPU creation time which is generally to late
to late -> too late
> to fallback to split irqchip.
>
> This patch follows Sean's recomendation from [2] and move the check if
recomendation -> recommendation
Also "move the check ..." needs to be updated, since the check during vCPU
creation is still there.
> I/O APIC is supported for the VM at irqchip creation time.
Some nits above.
Otherwise,
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
>
> [1] https://lore.kernel.org/lkml/20250222014757.897978-11-binbin.wu@linux.intel.com/
> [2] https://lore.kernel.org/lkml/aK3vZ5HuKKeFuuM4@google.com/
>
> Suggested-by: Sean Christopherson <seanjc@google.com>
> Signed-off-by: Sagi Shahar <sagis@google.com>
> ---
> arch/x86/include/asm/kvm_host.h | 1 +
> arch/x86/kvm/vmx/tdx.c | 6 ++++++
> arch/x86/kvm/x86.c | 9 +++++++++
> 3 files changed, 16 insertions(+)
>
> diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
> index f19a76d3ca0e..6a4019d3a184 100644
> --- a/arch/x86/include/asm/kvm_host.h
> +++ b/arch/x86/include/asm/kvm_host.h
> @@ -1357,6 +1357,7 @@ struct kvm_arch {
> u8 vm_type;
> bool has_private_mem;
> bool has_protected_state;
> + bool has_protected_eoi;
> bool pre_fault_allowed;
> struct hlist_head *mmu_page_hash;
> struct list_head active_mmu_pages;
> diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
> index 66744f5768c8..9637d9da1af1 100644
> --- a/arch/x86/kvm/vmx/tdx.c
> +++ b/arch/x86/kvm/vmx/tdx.c
> @@ -658,6 +658,12 @@ int tdx_vm_init(struct kvm *kvm)
> */
> kvm->max_vcpus = min_t(int, kvm->max_vcpus, num_present_cpus());
>
> + /*
> + * TDX Module doesn't allow the hypervisor to modify the EOI-bitmap,
> + * i.e. all EOIs are accelerated and never trigger exits.
> + */
> + kvm->arch.has_protected_eoi = true;
> +
> kvm_tdx->state = TD_STATE_UNINITIALIZED;
>
> return 0;
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index a1c49bc681c4..57b4d5ba2568 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -6966,6 +6966,15 @@ int kvm_arch_vm_ioctl(struct file *filp, unsigned int ioctl, unsigned long arg)
> if (irqchip_in_kernel(kvm))
> goto create_irqchip_unlock;
>
> + /*
> + * Disallow an in-kernel I/O APIC if the VM has protected EOIs,
> + * i.e. if KVM can't intercept EOIs and thus can't properly
> + * emulate level-triggered interrupts.
> + */
> + r = -ENOTTY;
> + if (kvm->arch.has_protected_eoi)
> + goto create_irqchip_unlock;
> +
> r = -EINVAL;
> if (kvm->created_vcpus)
> goto create_irqchip_unlock;
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] KVM: TDX: Force split irqchip for TDX at irqchip creation time
2025-08-27 1:17 [PATCH v2] KVM: TDX: Force split irqchip for TDX at irqchip creation time Sagi Shahar
2025-08-27 1:41 ` Binbin Wu
@ 2025-08-27 6:22 ` Xiaoyao Li
2025-09-16 0:25 ` Sean Christopherson
2 siblings, 0 replies; 6+ messages in thread
From: Xiaoyao Li @ 2025-08-27 6:22 UTC (permalink / raw)
To: Sagi Shahar, Sean Christopherson, Paolo Bonzini, Thomas Gleixner,
Ingo Molnar, Borislav Petkov, Dave Hansen, Binbin Wu, Ira Weiny,
H. Peter Anvin
Cc: linux-kernel, kvm, x86
On 8/27/2025 9:17 AM, Sagi Shahar wrote:
> TDX module protects the EOI-bitmap which prevents the use of in-kernel
> I/O APIC. See more details in the original patch [1]
>
> The current implementation already enforces the use of split irqchip for
> TDX but it does so at the vCPU creation time which is generally to late
> to fallback to split irqchip.
>
> This patch follows Sean's recomendation from [2] and move the check if
> I/O APIC is supported for the VM at irqchip creation time.
>
> [1] https://lore.kernel.org/lkml/20250222014757.897978-11-binbin.wu@linux.intel.com/
> [2] https://lore.kernel.org/lkml/aK3vZ5HuKKeFuuM4@google.com/
>
> Suggested-by: Sean Christopherson <seanjc@google.com>
> Signed-off-by: Sagi Shahar <sagis@google.com>
> ---
> arch/x86/include/asm/kvm_host.h | 1 +
> arch/x86/kvm/vmx/tdx.c | 6 ++++++
> arch/x86/kvm/x86.c | 9 +++++++++
> 3 files changed, 16 insertions(+)
>
> diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
> index f19a76d3ca0e..6a4019d3a184 100644
> --- a/arch/x86/include/asm/kvm_host.h
> +++ b/arch/x86/include/asm/kvm_host.h
> @@ -1357,6 +1357,7 @@ struct kvm_arch {
> u8 vm_type;
> bool has_private_mem;
> bool has_protected_state;
> + bool has_protected_eoi;
> bool pre_fault_allowed;
> struct hlist_head *mmu_page_hash;
> struct list_head active_mmu_pages;
> diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
> index 66744f5768c8..9637d9da1af1 100644
> --- a/arch/x86/kvm/vmx/tdx.c
> +++ b/arch/x86/kvm/vmx/tdx.c
> @@ -658,6 +658,12 @@ int tdx_vm_init(struct kvm *kvm)
> */
> kvm->max_vcpus = min_t(int, kvm->max_vcpus, num_present_cpus());
>
> + /*
> + * TDX Module doesn't allow the hypervisor to modify the EOI-bitmap,
> + * i.e. all EOIs are accelerated and never trigger exits.
> + */
> + kvm->arch.has_protected_eoi = true;
I prefer putting it along with the lines
kvm->arch.has_protected_state = true;
kvm->arch.has_private_mem = true;
Otherwise,
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
> kvm_tdx->state = TD_STATE_UNINITIALIZED;
>
> return 0;
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index a1c49bc681c4..57b4d5ba2568 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -6966,6 +6966,15 @@ int kvm_arch_vm_ioctl(struct file *filp, unsigned int ioctl, unsigned long arg)
> if (irqchip_in_kernel(kvm))
> goto create_irqchip_unlock;
>
> + /*
> + * Disallow an in-kernel I/O APIC if the VM has protected EOIs,
> + * i.e. if KVM can't intercept EOIs and thus can't properly
> + * emulate level-triggered interrupts.
> + */
> + r = -ENOTTY;
> + if (kvm->arch.has_protected_eoi)
> + goto create_irqchip_unlock;
> +
> r = -EINVAL;
> if (kvm->created_vcpus)
> goto create_irqchip_unlock;
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] KVM: TDX: Force split irqchip for TDX at irqchip creation time
2025-08-27 1:17 [PATCH v2] KVM: TDX: Force split irqchip for TDX at irqchip creation time Sagi Shahar
2025-08-27 1:41 ` Binbin Wu
2025-08-27 6:22 ` Xiaoyao Li
@ 2025-09-16 0:25 ` Sean Christopherson
2025-09-16 5:22 ` Xiaoyao Li
2 siblings, 1 reply; 6+ messages in thread
From: Sean Christopherson @ 2025-09-16 0:25 UTC (permalink / raw)
To: Sean Christopherson, Paolo Bonzini, Thomas Gleixner, Ingo Molnar,
Borislav Petkov, Dave Hansen, Binbin Wu, Ira Weiny,
H. Peter Anvin, Sagi Shahar
Cc: linux-kernel, kvm, x86
On Tue, 26 Aug 2025 18:17:26 -0700, Sagi Shahar wrote:
> TDX module protects the EOI-bitmap which prevents the use of in-kernel
> I/O APIC. See more details in the original patch [1]
>
> The current implementation already enforces the use of split irqchip for
> TDX but it does so at the vCPU creation time which is generally to late
> to fallback to split irqchip.
>
> [...]
Applied to kvm-x86 misc, thanks!
[1/1] KVM: TDX: Force split irqchip for TDX at irqchip creation time
https://github.com/kvm-x86/linux/commit/2569c8c5767b
--
https://github.com/kvm-x86/linux/tree/next
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] KVM: TDX: Force split irqchip for TDX at irqchip creation time
2025-09-16 0:25 ` Sean Christopherson
@ 2025-09-16 5:22 ` Xiaoyao Li
2025-09-16 19:59 ` Sean Christopherson
0 siblings, 1 reply; 6+ messages in thread
From: Xiaoyao Li @ 2025-09-16 5:22 UTC (permalink / raw)
To: Sean Christopherson, Paolo Bonzini, Thomas Gleixner, Ingo Molnar,
Borislav Petkov, Dave Hansen, Binbin Wu, Ira Weiny,
H. Peter Anvin, Sagi Shahar
Cc: linux-kernel, kvm, x86
On 9/16/2025 8:25 AM, Sean Christopherson wrote:
> On Tue, 26 Aug 2025 18:17:26 -0700, Sagi Shahar wrote:
>> TDX module protects the EOI-bitmap which prevents the use of in-kernel
>> I/O APIC. See more details in the original patch [1]
>>
>> The current implementation already enforces the use of split irqchip for
>> TDX but it does so at the vCPU creation time which is generally to late
>> to fallback to split irqchip.
>>
>> [...]
>
> Applied to kvm-x86 misc, thanks!
The latest one of this patch is v4:
https://lore.kernel.org/all/20250904062007.622530-1-sagis@google.com/
> [1/1] KVM: TDX: Force split irqchip for TDX at irqchip creation time
> https://github.com/kvm-x86/linux/commit/2569c8c5767b
What got queued, added a superfluous new line in tdx_vm_init()
> --
> https://github.com/kvm-x86/linux/tree/next
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] KVM: TDX: Force split irqchip for TDX at irqchip creation time
2025-09-16 5:22 ` Xiaoyao Li
@ 2025-09-16 19:59 ` Sean Christopherson
0 siblings, 0 replies; 6+ messages in thread
From: Sean Christopherson @ 2025-09-16 19:59 UTC (permalink / raw)
To: Xiaoyao Li
Cc: Paolo Bonzini, Thomas Gleixner, Ingo Molnar, Borislav Petkov,
Dave Hansen, Binbin Wu, Ira Weiny, H. Peter Anvin, Sagi Shahar,
linux-kernel, kvm, x86
On Tue, Sep 16, 2025, Xiaoyao Li wrote:
> On 9/16/2025 8:25 AM, Sean Christopherson wrote:
> > On Tue, 26 Aug 2025 18:17:26 -0700, Sagi Shahar wrote:
> > > TDX module protects the EOI-bitmap which prevents the use of in-kernel
> > > I/O APIC. See more details in the original patch [1]
> > >
> > > The current implementation already enforces the use of split irqchip for
> > > TDX but it does so at the vCPU creation time which is generally to late
> > > to fallback to split irqchip.
> > >
> > > [...]
> >
> > Applied to kvm-x86 misc, thanks!
>
> The latest one of this patch is v4:
>
> https://lore.kernel.org/all/20250904062007.622530-1-sagis@google.com/
Yeah, I had applied v2 quite some time ago, just took me a while to do final
testing and send the "thank you".
> > [1/1] KVM: TDX: Force split irqchip for TDX at irqchip creation time
> > https://github.com/kvm-x86/linux/commit/2569c8c5767b
>
> What got queued, added a superfluous new line in tdx_vm_init()
Drat. I force pushed to fix that goof, and added Kai's Acked-by in the process.
[1/1] KVM: TDX: Reject fully in-kernel irqchip if EOIs are protected, i.e. for TDX VMs
https://github.com/kvm-x86/linux/commit/b3a37bff8daf
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2025-09-16 19:59 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-08-27 1:17 [PATCH v2] KVM: TDX: Force split irqchip for TDX at irqchip creation time Sagi Shahar
2025-08-27 1:41 ` Binbin Wu
2025-08-27 6:22 ` Xiaoyao Li
2025-09-16 0:25 ` Sean Christopherson
2025-09-16 5:22 ` Xiaoyao Li
2025-09-16 19:59 ` Sean Christopherson
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox