Re: [PATCH v6 45/60] i386/tdx: Don't get/put guest state for TDX VMs

Xiaoyao Li
2024-11-05T11:25:23Z

On 11/5/2024 5:55 PM, Paolo Bonzini wrote:
> On 11/5/24 07:23, Xiaoyao Li wrote:
>> From: Sean Christopherson <sean.j.christopherson@intel.com>
>>
>> Don't get/put state of TDX VMs since accessing/mutating guest state of
>> production TDs is not supported.
>>
>> Note, it will be allowed for a debug TD. Corresponding support will be
>> introduced when debug TD support is implemented in the future.
>>
>> Signed-off-by: Sean Christopherson <sean.j.christopherson@intel.com>
>> Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
>> Acked-by: Gerd Hoffmann <kraxel@redhat.com>
>
> This should be unnecessary now that QEMU has
> kvm_mark_guest_state_protected().

Reverting this patch, we get:

tdx: tdx: error: failed to set MSR 0x174 to 0x0
tdx: ../../../go/src/tdx/tdx-qemu/target/i386/kvm/kvm.c:3859:
kvm_buf_set_msrs: Assertion `ret == cpu->kvm_msr_buf->nmsrs' failed.
error: failed to set MSR 0x174 to 0x0
tdx: ../../../go/src/tdx/tdx-qemu/target/i386/kvm/kvm.c:3859:
kvm_buf_set_msrs: Assertion `ret == cpu->kvm_msr_buf->nmsrs' failed.

> Paolo
>
>> ---
>>   target/i386/kvm/kvm.c | 11 +++++++++++
>>   1 file changed, 11 insertions(+)
>>
>> diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
>> index c39e879a77e9..e47aa32233e6 100644
>> --- a/target/i386/kvm/kvm.c
>> +++ b/target/i386/kvm/kvm.c
>> @@ -5254,6 +5254,11 @@ int kvm_arch_put_registers(CPUState *cpu, int
>> level, Error **errp)
>>       assert(cpu_is_stopped(cpu) || qemu_cpu_is_self(cpu));
>> +    /* TODO: Allow accessing guest state for debug TDs. */
>> +    if (is_tdx_vm()) {
>> +        return 0;
>> +    }
>> +
>>       /*
>>        * Put MSR_IA32_FEATURE_CONTROL first, this ensures the VM gets
>> out of VMX
>>        * root operation upon vCPU reset. kvm_put_msr_feature_control()
>> should also
>> @@ -5368,6 +5373,12 @@ int kvm_arch_get_registers(CPUState *cs, Error
>> **errp)
>>           error_setg_errno(errp, -ret, "Failed to get MP state");
>>           goto out;
>>       }
>> +
>> +    /* TODO: Allow accessing guest state for debug TDs. */
>> +    if (is_tdx_vm()) {
>> +        return 0;
>> +    }
>> +
>>       ret = kvm_getput_regs(cpu, 0);
>>       if (ret < 0) {
>>           error_setg_errno(errp, -ret, "Failed to get general purpose
>> registers");
>