linux.git/Documentation/virt/kvm, branch v6.16

Merge tag 'kvm-x86-fixes-6.16-rc7' of https://github.com/kvm-x86/linux into HEAD

2025-07-17T15:06:13+00:00

KVM TDX fixes for 6.16

 - Fix a formatting goof in the TDX documentation.

 - Reject KVM_SET_TSC_KHZ for guests with a protected TSC (currently only TDX).

 - Ensure struct kvm_tdx_capabilities fields that are not explicitly set by KVM
   are zeroed.

KVM: Documentation: document how KVM is tested

2025-07-15T17:32:18+00:00

Proper testing greatly simplifies both patch development and review,
but it can be unclear what kind of userspace or guest support
should accompany new features. Clarify maintainer expectations
in terms of testing expectations; additionally, list the cases in
which open-source userspace support is pretty much a necessity and
its absence can only be mitigated by selftests.

While these ideas have long been followed implicitly by KVM contributors
and maintainers, formalize them in writing to provide consistent (though
not universal) guidelines.

Suggested-by: Rick Edgecombe 
Signed-off-by: Paolo Bonzini

KVM: Documentation: minimal updates to review-checklist.rst

2025-07-15T17:32:18+00:00

While the file could stand a larger update, these are the bare minimum changes
needed to make it more widely applicable.

Signed-off-by: Paolo Bonzini

KVM: x86: Reject KVM_SET_TSC_KHZ vCPU ioctl for TSC protected guest

2025-07-15T14:05:13+00:00

Reject KVM_SET_TSC_KHZ vCPU ioctl if guest's TSC is protected and not
changeable by KVM, and update the documentation to reflect it.

For such TSC protected guests, e.g. TDX guests, typically the TSC is
configured once at VM level before any vCPU are created and remains
unchanged during VM's lifetime.  KVM provides the KVM_SET_TSC_KHZ VM
scope ioctl to allow the userspace VMM to configure the TSC of such VM.
After that the userspace VMM is not supposed to call the KVM_SET_TSC_KHZ
vCPU scope ioctl anymore when creating the vCPU.

The de facto userspace VMM Qemu does this for TDX guests.  The upcoming
SEV-SNP guests with Secure TSC should follow.

Note, TDX support hasn't been fully released as of the "buggy" commit,
i.e. there is no established ABI to break.

Fixes: adafea110600 ("KVM: x86: Add infrastructure for secure TSC")
Suggested-by: Sean Christopherson 
Signed-off-by: Kai Huang 
Reviewed-by: Xiaoyao Li 
Reviewed-by: Nikunj A Dadhania 
Link: https://lore.kernel.org/r/71bbdf87fdd423e3ba3a45b57642c119ee2dd98c.1752444335.git.kai.huang@intel.com
Signed-off-by: Sean Christopherson

Documentation: KVM: Fix unexpected unindent warning

2025-07-10T16:47:23+00:00

Add proper indentations to bullet list item to resolve the warning:
"Bullet list ends without a blank line; unexpected unindent."

Closes:https://lore.kernel.org/kvm/20250623162110.6e2f4241@canb.auug.org.au

Fixes: 4580dbef5ce0 ("KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt")
Reported-by: Stephen Rothwell 
Signed-off-by: Binbin Wu 
Link: https://lore.kernel.org/r/20250701012536.1281367-1-binbin.wu@linux.intel.com
Signed-off-by: Sean Christopherson

Documentation: KVM: Fix unexpected unindent warnings

2025-06-25T13:29:45+00:00

Add proper indentations to bullet list items to resolve the warning:
"Bullet list ends without a blank line; unexpected unindent."

Closes:https://lore.kernel.org/kvm/20250623162110.6e2f4241@canb.auug.org.au/

Fixes: cf207eac06f6 ("KVM: TDX: Handle TDG.VP.VMCALL")
Fixes: 25e8b1dd4883 ("KVM: TDX: Exit to userspace for GetTdVmCallInfo")
Reported-by: Stephen Rothwell 
Signed-off-by: Binbin Wu 
Reviewed-by: Bagas Sanjaya 
Link: https://lore.kernel.org/r/20250625014829.82289-1-binbin.wu@linux.intel.com
Signed-off-by: Sean Christopherson

KVM: TDX: Report supported optional TDVMCALLs in TDX capabilities

2025-06-20T18:20:20+00:00

Allow userspace to advertise TDG.VP.VMCALL subfunctions that the
kernel also supports.  For each output register of GetTdVmCallInfo's
leaf 1, add two fields to KVM_TDX_CAPABILITIES: one for kernel-supported
TDVMCALLs (userspace can set those blindly) and one for user-supported
TDVMCALLs (userspace can set those if it knows how to handle them).

Signed-off-by: Paolo Bonzini

KVM: TDX: Exit to userspace for SetupEventNotifyInterrupt

2025-06-20T18:09:50+00:00

Signed-off-by: Paolo Bonzini

KVM: TDX: Exit to userspace for GetTdVmCallInfo

2025-06-20T17:55:47+00:00

Exit to userspace for TDG.VP.VMCALL via KVM_EXIT_TDX,
to allow userspace to provide information about the support of
TDVMCALLs when r12 is 1 for the TDVMCALLs beyond the GHCI base API.

GHCI spec defines the GHCI base TDVMCALLs: , ,
, , <#VE.RequestMMIO>,
, ,  and
. They must be supported by VMM to support TDX guests.

For GetTdVmCallInfo
- When leaf (r12) to enumerate TDVMCALL functionality is set to 0,
  successful execution indicates all GHCI base TDVMCALLs listed above are
  supported.

  Update the KVM TDX document with the set of the GHCI base APIs.

- When leaf (r12) to enumerate TDVMCALL functionality is set to 1, it
  indicates the TDX guest is querying the supported TDVMCALLs beyond
  the GHCI base TDVMCALLs.
  Exit to userspace to let userspace set the TDVMCALL sub-function bit(s)
  accordingly to the leaf outputs.  KVM could set the TDVMCALL bit(s)
  supported by itself when the TDVMCALLs don't need support from userspace
  after returning from userspace and before entering guest. Currently, no
  such TDVMCALLs implemented, KVM just sets the values returned from
  userspace.

Suggested-by: Paolo Bonzini 
Signed-off-by: Binbin Wu 
[Adjust userspace API. - Paolo]
Signed-off-by: Paolo Bonzini

KVM: TDX: Handle TDG.VP.VMCALL

2025-06-20T17:09:32+00:00

Handle TDVMCALL for GetQuote to generate a TD-Quote.

GetQuote is a doorbell-like interface used by TDX guests to request VMM
to generate a TD-Quote signed by a service hosting TD-Quoting Enclave
operating on the host.  A TDX guest passes a TD Report (TDREPORT_STRUCT) in
a shared-memory area as parameter.  Host VMM can access it and queue the
operation for a service hosting TD-Quoting enclave.  When completed, the
Quote is returned via the same shared-memory area.

KVM only checks the GPA from the TDX guest has the shared-bit set and drops
the shared-bit before exiting to userspace to avoid bleeding the shared-bit
into KVM's exit ABI.  KVM forwards the request to userspace VMM (e.g. QEMU)
and userspace VMM queues the operation asynchronously.  KVM sets the return
code according to the 'ret' field set by userspace to notify the TDX guest
whether the request has been queued successfully or not.  When the request
has been queued successfully, the TDX guest can poll the status field in
the shared-memory area to check whether the Quote generation is completed
or not.  When completed, the generated Quote is returned via the same
buffer.

Add KVM_EXIT_TDX as a new exit reason to userspace. Userspace is
required to handle the KVM exit reason as the initial support for TDX,
by reentering KVM to ensure that the TDVMCALL is complete.  While at it,
add a note that KVM_EXIT_HYPERCALL also requires reentry with KVM_RUN.

Signed-off-by: Binbin Wu 
Tested-by: Mikko Ylinen 
Acked-by: Kai Huang 
[Adjust userspace API. - Paolo]
Signed-off-by: Paolo Bonzini