Host kernel never sets any Intel MKTME KeyID bits (including TDX KeyID bits) in any mapping. KVM should not set any of them to MMU's SPTE which maps to guest memory either. KVM MMU has shadow_zero_check which contains those bits must be 0 for SPTE. This series adds MKTME bits to shadow_zero_check. The first patch is not directly needed but looks better to have IMHO. Patch 02/03 actually do the job. Sanity tested by creating normal VMs on TDX capable machine (with TDX turned on). However this is not tested on AMD machine since I don't have access to any, though the risk should be very small I suppose. Kai Huang (3): KVM: x86/mmu: Rename reset_rsvds_bits_mask() KVM: x86/mmu: Add shadow_me_value and repurpose shadow_me_mask KVM: VMX: Include MKTME KeyID bits to shadow_zero_check arch/x86/kvm/mmu.h | 20 ++++++++++++++++++++ arch/x86/kvm/mmu/mmu.c | 22 +++++++++++++++------- arch/x86/kvm/mmu/spte.c | 40 ++++++++++++++++------------------------ arch/x86/kvm/mmu/spte.h | 1 + arch/x86/kvm/svm/svm.c | 3 +++ arch/x86/kvm/vmx/vmx.c | 31 +++++++++++++++++++++++++++++++ 6 files changed, 86 insertions(+), 31 deletions(-) -- 2.35.1
