sys/linux: add Intel TDX descriptions

Initial support for Intel TDX as per
https://docs.kernel.org/virt/kvm/x86/intel-tdx.html

2 files changed, 103 insertions, 0 deletions

diff --git a/sys/linux/dev_kvm_amd64.txt b/sys/linux/dev_kvm_amd64.txt
index 0f5cf7734..c68528e34 100644
--- a/sys/linux/dev_kvm_amd64.txt
+++ b/sys/linux/dev_kvm_amd64.txt
@@ -7,6 +7,7 @@ meta arches["386", "amd64"]
 
 include <linux/kvm.h>
 include <linux/kvm_host.h>
+include <asm/kvm.h>
 include <asm/mce.h>
 
 # kvm_syz_vm is a VM handler used by syzos-related pseudo-syscalls. It is actually an opaque pointer under the hood.
@@ -312,6 +313,25 @@ ioctl$KVM_SEV_SNP_LAUNCH_START(fd fd_kvmvm, cmd const[KVM_MEMORY_ENCRYPT_OP], ar
 ioctl$KVM_SEV_SNP_LAUNCH_UPDATE(fd fd_kvmvm, cmd const[KVM_MEMORY_ENCRYPT_OP], arg ptr[inout, kvm_memory_encrypt_op[KVM_SEV_SNP_LAUNCH_UPDATE, ptr[in, kvm_sev_snp_launch_update]]])
 ioctl$KVM_SEV_SNP_LAUNCH_FINISH(fd fd_kvmvm, cmd const[KVM_MEMORY_ENCRYPT_OP], arg ptr[inout, kvm_memory_encrypt_op[KVM_SEV_SNP_LAUNCH_FINISH, ptr[in, kvm_sev_snp_launch_finish]]])
 
+# TDX-related (based on Documentation/virt/kvm/x86/intel-tdx.rst).
+kvm_tdx_init_mem_region_flags = KVM_TDX_MEASURE_MEMORY_REGION
+
+kvm_tdx_empty_flags = 0
+
+type kvm_tdx_cmd[ID, FLAGS, DATA] {
+	id		const[ID, int32]
+	flags		flags[FLAGS, int32]
+	data		DATA
+	hw_error	int64	(out)
+}
+
+ioctl$KVM_TDX_CAPABILITIES(fd fd_kvmvm, cmd const[KVM_MEMORY_ENCRYPT_OP], arg ptr[inout, kvm_tdx_cmd[KVM_TDX_CAPABILITIES, kvm_tdx_empty_flags, ptr[out, kvm_tdx_capabilities]]])
+ioctl$KVM_TDX_INIT_VM(fd fd_kvmvm, cmd const[KVM_MEMORY_ENCRYPT_OP], arg ptr[inout, kvm_tdx_cmd[KVM_TDX_INIT_VM, kvm_tdx_empty_flags, ptr[in, kvm_tdx_init_vm]]])
+ioctl$KVM_TDX_INIT_VCPU(fd fd_kvmcpu, cmd const[KVM_MEMORY_ENCRYPT_OP], arg ptr[inout, kvm_tdx_cmd[KVM_TDX_INIT_VCPU, kvm_tdx_empty_flags, int64]])
+ioctl$KVM_TDX_INIT_MEM_REGION(fd fd_kvmvm, cmd const[KVM_MEMORY_ENCRYPT_OP], arg ptr[inout, kvm_tdx_cmd[KVM_TDX_INIT_MEM_REGION, kvm_tdx_init_mem_region_flags, ptr[in, kvm_tdx_init_mem_region]]])
+ioctl$KVM_TDX_FINALIZE_VM(fd fd_kvmvm, cmd const[KVM_MEMORY_ENCRYPT_OP], arg ptr[inout, kvm_tdx_cmd[KVM_TDX_FINALIZE_VM, kvm_tdx_empty_flags, const[0, intptr]]])
+ioctl$KVM_TDX_GET_CPUID(fd fd_kvmcpu, cmd const[KVM_MEMORY_ENCRYPT_OP], arg ptr[inout, kvm_tdx_cmd[KVM_TDX_GET_CPUID, kvm_tdx_empty_flags, ptr[inout, kvm_cpuid2]]])
+
 # Apparently KVM_MEMORY_ENCRYPT_REG_REGION and KVM_MEMORY_ENCRYPT_UNREG_REGION are VM ioctls, despite
 # https://docs.kernel.org/virt/kvm/api.html#kvm-memory-encrypt-reg-region says they are system.
 ioctl$KVM_MEMORY_ENCRYPT_REG_REGION(fd fd_kvmvm, cmd const[KVM_MEMORY_ENCRYPT_REG_REGION], arg ptr[in, kvm_enc_region])
@@ -471,6 +491,56 @@ kvm_sev_snp_launch_finish {
 	pad1		array[const[0, int64], 4]
 }
 
+kvm_tdx_capabilities {
+	supported_attrs			int64
+	supported_xfam			int64
+	kernel_tdvmcallinfo_1_r11	int64
+	user_tdvmcallinfo_1_r11		int64
+	kernel_tdvmcallinfo_1_r12	int64
+	user_tdvmcallinfo_1_r12		int64
+	reserved			array[const[0, int64], 250]
+	cpuid				kvm_cpuid2
+}
+
+# From arch/x86/include/asm/shared/tdx.h.
+tdx_attrs = 0, TDX_ATTR_DEBUG, TDX_ATTR_HGS_PLUS_PROF, TDX_ATTR_PERF_PROF, TDX_ATTR_PMT_PROF, TDX_ATTR_ICSSD, TDX_ATTR_LASS, TDX_ATTR_SEPT_VE_DISABLE, TDX_ATTR_MIGRTABLE, TDX_ATTR_PKS, TDX_ATTR_KL, TDX_ATTR_TPA, TDX_ATTR_PERFMON
+
+# From Intel Trust Domain Extensions Module Base Architecture Specification,
+# Table 11.9: Extended Features Enumeration and Execution Control.
+# These loosely resemble the XFEATURE_MASK_* flags in the kernel.
+define XFAM_FP	(1 << 0)
+define XFAM_SSE	(1 << 1)
+define XFAM_AVX	(1 << 2)
+# MPX is XFAM[4:3] and must be 0.
+define XFAM_AVX512	(7 << 5)
+define XFAM_PT	(1 << 8)
+define XFAM_PK	(1 << 9)
+define XFAM_ENQCMD	(1 << 10)
+define XFAM_CET	(3 << 11)
+define XFAM_HDC	(1 << 13)
+define XFAM_ULI	(1 << 14)
+define XFAM_LBR	(1 << 15)
+define XFAM_HWP	(1 << 16)
+define XFAM_AMX	(3 << 17)
+define XFAM_APX	(1 << 19)
+tdx_xfam = 0, XFAM_FP, XFAM_SSE, XFAM_AVX, XFAM_AVX512, XFAM_PT, XFAM_PK, XFAM_ENQCMD, XFAM_CET, XFAM_HDC, XFAM_ULI, XFAM_LBR, XFAM_HWP, XFAM_AMX, XFAM_APX
+
+kvm_tdx_init_vm {
+	attributes	flags[tdx_attrs, int64]
+	xfam		flags[tdx_xfam, int64]
+	mrconfigid	array[int64, 6]
+	mrowner		array[int64, 6]
+	mrownerconfig	array[int64, 6]
+	reserved	array[const[0, int64], 12]
+	cpuid		kvm_cpuid2
+}
+
+kvm_tdx_init_mem_region {
+	source_addr	vma64
+	gpa		flags[kvm_guest_addrs, int64]
+	nr_pages	int64
+}
+
 kvm_enc_region {
 	addr	flags[kvm_guest_addrs, int64]
 	size	flags[kvm_guest_addr_size, int64]
diff --git a/sys/linux/dev_kvm_amd64.txt.const b/sys/linux/dev_kvm_amd64.txt.const
index 50e9df80a..54fc1acf8 100644
--- a/sys/linux/dev_kvm_amd64.txt.const
+++ b/sys/linux/dev_kvm_amd64.txt.const
@@ -164,6 +164,13 @@ KVM_STATE_NESTED_SMM_VMXON = 2
 KVM_STATE_NESTED_SVM_VMCB_SIZE = 4096
 KVM_STATE_NESTED_VMX_VMCS_SIZE = 4096
 KVM_STATE_VMX_PREEMPTION_TIMER_DEADLINE = 1
+KVM_TDX_CAPABILITIES = 0
+KVM_TDX_FINALIZE_VM = 4
+KVM_TDX_GET_CPUID = 5
+KVM_TDX_INIT_MEM_REGION = 3
+KVM_TDX_INIT_VCPU = 2
+KVM_TDX_INIT_VM = 1
+KVM_TDX_MEASURE_MEMORY_REGION = 1
 KVM_TPR_ACCESS_REPORTING = 3223891602
 KVM_TRANSLATE = 3222843013
 KVM_X2APIC_API_DISABLE_BROADCAST_QUIRK = 2
@@ -209,5 +216,31 @@ MCI_STATUS_PCC = 144115188075855872
 MCI_STATUS_S = 72057594037927936
 MCI_STATUS_UC = 2305843009213693952
 MCI_STATUS_VAL = 9223372036854775808
+TDX_ATTR_DEBUG = 1
+TDX_ATTR_HGS_PLUS_PROF = 16
+TDX_ATTR_ICSSD = 65536
+TDX_ATTR_KL = 2147483648
+TDX_ATTR_LASS = 134217728
+TDX_ATTR_MIGRTABLE = 536870912
+TDX_ATTR_PERFMON = 9223372036854775808
+TDX_ATTR_PERF_PROF = 32
+TDX_ATTR_PKS = 1073741824
+TDX_ATTR_PMT_PROF = 64
+TDX_ATTR_SEPT_VE_DISABLE = 268435456
+TDX_ATTR_TPA = 4611686018427387904
+XFAM_AMX = 393216
+XFAM_APX = 524288
+XFAM_AVX = 4
+XFAM_AVX512 = 224
+XFAM_CET = 6144
+XFAM_ENQCMD = 1024
+XFAM_FP = 1
+XFAM_HDC = 8192
+XFAM_HWP = 65536
+XFAM_LBR = 32768
+XFAM_PK = 512
+XFAM_PT = 256
+XFAM_SSE = 2
+XFAM_ULI = 16384
 __NR_ioctl = 386:54, amd64:16
 __NR_openat = 386:295, amd64:257