From ca9651460832e15be4a5d0bdaff4c489fe4013bf Mon Sep 17 00:00:00 2001 From: "Liang, Zhou" Date: Wed, 9 Sep 2026 19:13:41 +0530 Subject: [PATCH] tdx: simplify configure_vcpu() CPUID handling for TD vCPUs Remove redundant/incorrect per-vCPU CPUID patches that duplicated or conflicted with what the TDX module already virtualizes: - Drop the manual X2APIC bit (leaf 1 ECX[21]) force-set: the TDX module already reports this as a Fixed1 bit, so patching it in cloud-hypervisor was redundant. - Drop the leaf 0x8000_0008 virtual/physical address width override (LA57-based) and the leaf 0x4000_0200 fake KVM signature injection, neither of which is needed for correct TD guest CPUID. - Replace the ad-hoc '#[cfg(not(feature = "tdx"))]' gating around MSR and LINT setup with explicit 'if !tdx_enabled' checks plus comments explaining why: the vCPU's MSR and local APIC state are owned by the TDX module and are not accessible via KVM_SET_MSRS / KVM_GET_LAPIC/KVM_SET_LAPIC for guest-state-protected TD vCPUs. Signed-off-by: Liang, Zhou --- arch/src/x86_64/mod.rs | 46 ++++++++++++++---------------------------- 1 file changed, 15 insertions(+), 31 deletions(-) diff --git a/arch/src/x86_64/mod.rs b/arch/src/x86_64/mod.rs index ecc1dfd8e..2d68b0e31 100644 --- a/arch/src/x86_64/mod.rs +++ b/arch/src/x86_64/mod.rs @@ -851,7 +851,6 @@ pub fn configure_vcpu( // Per vCPU CPUID changes; common are handled via generate_common_cpuid() let mut cpuid = cpuid; - let la57_enabled = CpuidPatch::is_feature_enabled(&cpuid, 7, 0, CpuidReg::ECX, 16); CpuidPatch::set_cpuid_reg(&mut cpuid, 0xb, None, CpuidReg::EDX, x2apic_id); CpuidPatch::set_cpuid_reg(&mut cpuid, 0x1f, None, CpuidReg::EDX, x2apic_id); if matches!(cpu_vendor, CpuVendor::AMD) { @@ -864,11 +863,6 @@ pub fn configure_vcpu( if entry.function == 1 { entry.ebx &= 0xffffff; entry.ebx |= x2apic_id << 24; - #[cfg(feature = "tdx")] - if tdx_enabled == true { - // TDX vCPUs are launched with xAPIC mode, so we need to set the x2APIC bit in CPUID to make sure the guest OS can enable x2APIC mode and use the correct APIC ID. - entry.ecx |= 0x200000; - } apic_id_patched = true; if matches!(cpu_vendor, CpuVendor::Intel) { if !nested { @@ -883,34 +877,9 @@ pub fn configure_vcpu( entry.ecx &= !(1 << SVM_ECX_BIT); } } - if entry.function == 0x8000_0008 { - /* 64 bit processor */ - let virt_addr_width = if la57_enabled { 57 } else { 48 }; - let mut guest_phys_bits = (entry.eax >> 16) & 0xff; - let phys_bits = entry.eax & 0xff; - if guest_phys_bits > phys_bits { - guest_phys_bits = phys_bits; - } - entry.eax = phys_bits - | (virt_addr_width << 8) - | (guest_phys_bits << 16); - } } assert!(apic_id_patched); - #[cfg(feature = "tdx")] - if tdx_enabled == true { - CpuidPatch::set_cpuid_reg(&mut cpuid, 0x8000_0000, Some(0), CpuidReg::EAX, 0x80000008); - CpuidPatch::set_cpuid_reg(&mut cpuid, 0x8000_0000, None, CpuidReg::EBX, 0); - CpuidPatch::set_cpuid_reg(&mut cpuid, 0x8000_0000, None, CpuidReg::ECX, 0); - CpuidPatch::set_cpuid_reg(&mut cpuid, 0x8000_0000, None, CpuidReg::EDX, 0); - // Set KVMKVMKVM\0\0\0 within CPUID - CpuidPatch::set_cpuid_reg(&mut cpuid, 0x4000_0200, Some(0), CpuidReg::EAX, 0x4000_0200); - CpuidPatch::set_cpuid_reg(&mut cpuid, 0x4000_0200, None, CpuidReg::EBX, 0x4b4d564b); // KVMK - CpuidPatch::set_cpuid_reg(&mut cpuid, 0x4000_0200, None, CpuidReg::ECX, 0x564b4d56); // VMKV - CpuidPatch::set_cpuid_reg(&mut cpuid, 0x4000_0200, None, CpuidReg::EDX, 0x0000004d); // M\0\0\0 - } - update_cpuid_topology( &mut cpuid, topology.0, topology.1, topology.2, topology.3, cpu_vendor, id, ); @@ -946,6 +915,14 @@ pub fn configure_vcpu( vcpu.enable_hyperv_synic().unwrap(); } + #[cfg(feature = "tdx")] + // For TDX, the vCPU's MSR state is owned by the TDX module and cannot be + // programmed through KVM_SET_MSRS (the vCPU is guest-state protected), so + // skip the boot MSR setup for TDs. + if !tdx_enabled { + regs::setup_msrs(vcpu).map_err(Error::MsrsConfiguration)?; + } + #[cfg(not(feature = "tdx"))] regs::setup_msrs(vcpu).map_err(Error::MsrsConfiguration)?; if let Some((kernel_entry_point, guest_memory)) = boot_setup { regs::setup_regs(vcpu, kernel_entry_point).map_err(Error::RegsConfiguration)?; @@ -960,6 +937,13 @@ pub fn configure_vcpu( regs::setup_sregs(&guest_memory.memory(), vcpu, enable_x2_apic_mode) .map_err(Error::SregsConfiguration)?; } + #[cfg(feature = "tdx")] + // For TDX, the vCPU's local APIC state is owned by the TDX module and is not + // accessible via KVM_GET_LAPIC/KVM_SET_LAPIC (the vCPU is guest-state + // protected), so skip the LINT setup that those ioctls back. + if !tdx_enabled { + interrupts::set_lint(vcpu).map_err(|e| Error::LocalIntConfiguration(e.into()))?; + } #[cfg(not(feature = "tdx"))] interrupts::set_lint(vcpu).map_err(|e| Error::LocalIntConfiguration(e.into()))?; Ok(())