Re: [PATCH v2 5/6] KVM: x86: Track available/dirty register masks as "unsigned long" values

Sean Christopherson
2026-04-14T15:49:05Z

On Mon, Apr 13, 2026, Kai Huang wrote:
> On Mon, 2026-04-13 at 07:54 -0700, Sean Christopherson wrote:
> > More importantly, because the TDX-Module *requires* RCX (the GPR that holds the
> > mask of registers to expose to the VMM) to be hidden on TDVMCALL, KVM *can't*
> > do any kind of meaningful "available" tracking.
> >
>
> Hmm I think RCX conveys the shared GPRs and VMM can read. Per "Table 5.323:
> TDH.VP.ENTER Output Operands Format #5 Definition: On TDCALL(TDG.VP.VMCALL)
> Following a TD Entry":
>
> RCX ...
> Bit(s) Name Description
>
> 31:0 PARAMS_MASK Value as passed into TDCALL(TDG.VP.VMCALL) by
> the guest TD: indicates which part of the guest
> TD GPR and XMM state is passed as-is to the
> VMM
> and back. For details, see the description of
> TDG.VP.VMCALL in 5.5.26.

The problem is that bit 1 in RCX is required to be '0'. I.e. the guest *can't*
expose RCX to the VMM. From the spec:

15:0 GPR Mask Controls the transfer of GPR values:
Bit 0: RAX (must be 0)
Bit 1: RCX (must be 0)

And the code:

api_error_type tdg_vp_vmcall(uint64_t controller_value)
{
api_error_type retval = TDX_OPERAND_INVALID;
tdx_module_local_t* tdx_local_data_ptr = get_local_data();

tdvmcall_control_t control = { .raw = controller_value };

// Bits 0, 1 and 4 and 63:32 of RCX must be 0
if (((control.gpr_select & (uint16_t)(BIT(0) | BIT(1) | BIT(4))) != 0) || <==== sadness
(control.reserved != 0))
{
retval = api_error_with_operand_id(TDX_OPERAND_INVALID, OPERAND_ID_RCX);
TDX_ERROR("Unsupported bits in GPR_SELECT field = 0x%x\n", control.gpr_select)
goto EXIT_FAILURE;
}

Oh, dagnabbit. The spec also says:

The value of RCX itself is always passed to the host VMM.

and then in code:

td_exit_qual.gpr_select = control.gpr_select;
td_exit_qual.xmm_select = control.xmm_select;

tdx_local_data_ptr->vmm_regs.rcx = td_exit_qual.raw;

// RAX is not copied, RCX filled above, start from RDX

I don't get why TDX requires bit 1 to be 0, but whatever.

So I was wrong, KVM can (and should!) validate the registers coming from the
guest. If we want to harden TDX, that's the obvious first step.