Re: [PATCH v2 1/3] KVM: TDX: Enable Notify VM exit

["Edgecombe, Rick P" <rick.p.edgecombe@intel.com>]

On Mon, 2026-08-10 at 19:21 +0800, Xiaoyao Li wrote:
> Enable Notify VM exit functionality for TDX guests.
> 
> Notify VM exit is an existing feature supported by KVM.  Userspace can
> enable Notify VM exit through KVM_CAP_X86_NOTIFY_VMEXIT when it's
> reported as supported.  However, KVM reports the support of this CAP just
> based on the hardware capability but doesn't differentiate between VMX
> and TDX.  This leads to the issue that userspace can enable this cap for
> TDX guests without getting an error, but the feature is not actually
> enabled because KVM doesn't call the TDX module API to program the
> relevant TD VMCS fields.
> 
> Enable Notify VM exit for TDX guests by:
> 
>   - Invoking TDX module API calls to set NOTIFY_VM_EXITING and Notify
>     Window in TD VMCS.  It's done in tdx_vcpu_init() where other TD VMCS
>     bits are set.  Since TDX vCPU cannot be reset, it only needs to be
>     configured once when initializing the TDX vCPU.
> 
>   - Adding corresponding exit handler for TDX Notify VM Exit.
> 
> Notify VM exit can happen when executing the IRET instruction.  If the
> IRET unblocks the NMI blocking state, bit 12 of the exit qualification
> is set.  In this case, the VMM needs to restore the "blocked by NMI" state
> when it decides to re-enter the guest.  For TDX, KVM cannot manage the
> GUEST_INTERRUPTIBILITY_INFO and it's TDX module's responsibility to
> handle it.  Extract the common part without NMI blocking handling into a
> helper in common.h so that it can be shared between VMX and TDX.
> 
> Note, KVM uses "pre-production" terminology for the feature formally called
> Notify VM-Exit.  All public versions of the SDM refer to the feature as
> Instruction Timeout.  This will be remedied in the near future, for now,
> use KVM's terminology for consistency.
> 
> Note, #2, there is no enumeration bit for Notify VM exit by TDX module
> because all TDX modules support it, and allow to set the corresponding
> TD VMCS fields as long as the hardware supports the feature.
> 
> Fixes: 161d34609f9b ("KVM: TDX: Make TDX VM type supported")
> Cc: stable@vger.kernel.org
> Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>


Reviewed-by: Rick Edgecombe <rick.p.edgecombe@intel.com>