[RFC PATCH 0/2] vvmx: Reinject L2 TDX exit reasons to L1 instead of crashing L1

[Teddy Astie <teddy.astie@xxxxxxxxxx>]

On hardware that support TDX, guests performing SEAMCALL or TDCALL causes a
VMEXIT(SEAMCALL) or VMEXIT(TDCALL) regardless of VMCS configuration (there
is no flag to opt-out these VMEXIT).

This instruction can only be called in a guest with CPL = 0 [1], thus it cannot 
be
leveraged from guest userland to crash the entire guest. However, it can still 
be
used by a L2 guest kernel space to crash the L1 as such exit reason is unhandled
which defaults to crashing the entire domain.

RFC: I don't have access to hardware that supports TDX to test it; and I'm not
sure this is enough given that some other instructions may exhibit similar
issues; but these 2 ones in particular don't seem to have a opt-out.

[1] https://lore.kernel.org/all/20251016182148.69085-2-seanjc@xxxxxxxxxx/

Teddy Astie (2):
  vmx: Introduce TDX instruction exit reasons
  vvmx: Reinject TDX instruction exit reasons to L1 when emitted by L2

 xen/arch/x86/hvm/vmx/vvmx.c            | 2 ++
 xen/arch/x86/include/asm/hvm/vmx/vmx.h | 2 ++
 xen/arch/x86/include/asm/perfc_defn.h  | 2 +-
 3 files changed, 5 insertions(+), 1 deletion(-)

-- 
2.54.0



--
 | Vates

XCP-ng & Xen Orchestra - Vates solutions

web: https://vates.tech