diff --git a/vmm/src/cpu.rs b/vmm/src/cpu.rs index dac22317c..975f52021 100644 --- a/vmm/src/cpu.rs +++ b/vmm/src/cpu.rs @@ -62,6 +62,16 @@ const MTRR_EDX_BIT: u8 = 12; // Hypervisor ecx bit. // KVM feature bits #[cfg(target_arch = "x86_64")] const KVM_FEATURE_ASYNC_PF_INT_BIT: u8 = 14; +#[cfg(feature = "tdx")] +const KVM_FEATURE_CLOCKSOURCE_BIT: u8 = 0; +#[cfg(feature = "tdx")] +const KVM_FEATURE_CLOCKSOURCE2_BIT: u8 = 3; +#[cfg(feature = "tdx")] +const KVM_FEATURE_CLOCKSOURCE_STABLE_BIT: u8 = 24; +#[cfg(feature = "tdx")] +const KVM_FEATURE_ASYNC_PF_BIT: u8 = 4; +#[cfg(feature = "tdx")] +const KVM_FEATURE_ASYNC_PF_VMEXIT_BIT: u8 = 10; #[cfg(feature = "acpi")] pub const CPU_MANAGER_ACPI_SIZE: usize = 0xc; @@ -533,6 +543,7 @@ impl CpuManager { hypervisor: Arc, seccomp_action: SeccompAction, vmmops: Arc>, + #[cfg(feature = "tdx")] tdx_enabled: bool, ) -> Result>> { let guest_memory = memory_manager.lock().unwrap().guest_memory(); let mut vcpu_states = Vec::with_capacity(usize::from(config.max_vcpus)); @@ -554,6 +565,8 @@ impl CpuManager { sgx_epc_sections, phys_bits, config.kvm_hyperv, + #[cfg(feature = "tdx")] + tdx_enabled, )? }; @@ -605,6 +618,7 @@ impl CpuManager { sgx_epc_sections: Option>, phys_bits: u8, kvm_hyperv: bool, + #[cfg(feature = "tdx")] tdx_enabled: bool, ) -> Result { let cpuid_patches = vec![ // Patch tsc deadline timer bit @@ -674,6 +688,16 @@ impl CpuManager { // TODO: Re-enable KVM_FEATURE_ASYNC_PF_INT (#2277) 0x4000_0001 => { entry.eax &= !(1 << KVM_FEATURE_ASYNC_PF_INT_BIT); + + // These features are not supported by TDX + #[cfg(feature = "tdx")] + if tdx_enabled { + entry.eax &= !(1 << KVM_FEATURE_CLOCKSOURCE_BIT + | 1 << KVM_FEATURE_CLOCKSOURCE2_BIT + | 1 << KVM_FEATURE_CLOCKSOURCE_STABLE_BIT + | 1 << KVM_FEATURE_ASYNC_PF_BIT + | 1 << KVM_FEATURE_ASYNC_PF_VMEXIT_BIT) + } } _ => {} } diff --git a/vmm/src/vm.rs b/vmm/src/vm.rs index 0bf9eb68d..7524ac187 100644 --- a/vmm/src/vm.rs +++ b/vmm/src/vm.rs @@ -558,6 +558,8 @@ impl Vm { hypervisor, seccomp_action.clone(), vm_ops, + #[cfg(feature = "tdx")] + config.lock().unwrap().tdx.is_some(), ) .map_err(Error::CpuManager)?;