x86: Add TDX support#375
Open
00xc wants to merge 7 commits into
Open
Conversation
00xc
requested review from
ShadowCurse,
acatangiu,
andreeaflorescu,
lauralt,
roypat and
sameo
as code owners
00xc
force-pushed
the
tdx-v2
branch
2 times, most recently
from
bf9d022 to
321a019
Compare
Contributor
Author
|
The unit test failure on arm64 is unrelated. I opened #376 to fix it. |
Contributor
Author
The kernel uapi headers recently started making extensive use of the
__DECLARE_FLEX_ARRAY() macro for flexible array members. This is defined
as:
#define __DECLARE_FLEX_ARRAY(TYPE, NAME) \
struct { \
struct { } __empty_ ## NAME; \
TYPE NAME[]; \
}
#endif
When generating bindings for this code, bindgen will end up generating a
lof of __empty_xxx structures, making things less readable and usable.
For example, before the use of __DECLARE_FLEX_ARRAY(), we would get the
following on the Rust side:
pub struct kvm_msrs {
pub nmsrs: __u32,
pub pad: __u32,
pub entries: __IncompleteArrayField<kvm_msr_entry>,
}
But with __DECLARE_FLEX_ARRAY() on this struct, we get:
pub struct kvm_msrs {
pub nmsrs: __u32,
pub pad: __u32,
pub __bindgen_anon_1: kvm_msrs__bindgen_ty_1,
}
#[repr(C)]
#[derive(Debug, Default)]
pub struct kvm_msrs__bindgen_ty_1 {
pub __empty_entries: kvm_msrs__bindgen_ty_1__bindgen_ty_1,
pub entries: __IncompleteArrayField<kvm_msr_entry>,
}
The culprit macro is however defined as follows for C++:
#define __DECLARE_FLEX_ARRAY(T, member) \
T member[0]
Which is exactly what kvm-bindings wants. Document that -D__cplusplus
should be used to make new bindings updates less intrusive.
Signed-off-by: Carlos López <clopez@suse.de>
Update the KVM bindings to the most recent kernel version to bring in new constants and structures, mostly related to x86 CoCo (SEV/TDX). Signed-off-by: Carlos López <clopez@suse.de>
kvm_tdx_capabilities and kvm_tdx_init_vm contain a kvm_cpuid2 field at the end, which itself is a flexible array member. Manually implement FamStruct for these types, which will simplify using the TDX ioctls that consume these structs (KVM_TDX_CAPABILITIES / KVM_TDX_INIT_VM). Signed-off-by: Carlos López <clopez@suse.de>
Add a missing capability to the Cap enum, which allows querying the VM types that KVM supports. Signed-off-by: Carlos López <clopez@suse.de>
Support KVM_EXIT_TDX, KVM's vmexit for TDX guest requests. Add the required Rust structures to adapt the parameters for the exit. As of this commit, this vmexit cannot be used, as the required ioctls to create a TDX VM are not yet implemented. Signed-off-by: Carlos López <clopez@suse.de>
Add the TDX equivalents of VmFd::encrypt_op_sev(). Note that, for TDX, KVM_MEMORY_ENCRYPT_OP also operates on the vCPU fd, so add a similar method for VcpuFd. This is the final piece to allow users to create TDX VMs, so update the changelog. Signed-off-by: Carlos López <clopez@suse.de>
Signed-off-by: Carlos López <clopez@suse.de>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary of the PR
Add all the required interfaces to be able to create TDX VMs. This includes:
KVM_CAP_VM_TYPESto detect if KVM supports TDX.KVM_EXIT_TDXand accessing the right fields inkvm_run.KVM_MEMORY_ENCRYPT_OPvariants (i.e. the TDX side ofVmFd::encrypt_op_sev().This closes #374.
Requirements
Before submitting your PR, please make sure you addressed the following
requirements:
git commit -s), and the commit message has max 60 characters for thesummary and max 75 characters for each description line.
test.
Release" section of CHANGELOG.md (if no such section exists, please create one).
unsafecode is properly documented.