Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
From:   Andy Lutomirski <luto@amacapital.net>
Mime-Version: 1.0 (1.0)
Subject: Re: [RFC v1 09/26] x86/tdx: Handle CPUID via #VE
Date:   Sun, 7 Feb 2021 14:45:26 -0800
Message-Id: <0A886D87-1979-419C-86DE-EA2FABDFF3EB@amacapital.net>
References: <f81afd12-91ed-27c9-58d6-e59e7e1178c0@intel.com>
Cc:     "Kirill A. Shutemov" <kirill@shutemov.name>,
        Andy Lutomirski <luto@kernel.org>,
        Kuppuswamy Sathyanarayanan 
        <sathyanarayanan.kuppuswamy@linux.intel.com>,
        Peter Zijlstra <peterz@infradead.org>,
        Andi Kleen <ak@linux.intel.com>,
        Kirill Shutemov <kirill.shutemov@linux.intel.com>,
        Kuppuswamy Sathyanarayanan <knsathya@kernel.org>,
        Dan Williams <dan.j.williams@intel.com>,
        Raj Ashok <ashok.raj@intel.com>,
        Sean Christopherson <seanjc@google.com>,
        LKML <linux-kernel@vger.kernel.org>
In-Reply-To: <f81afd12-91ed-27c9-58d6-e59e7e1178c0@intel.com>
To:     Dave Hansen <dave.hansen@intel.com>
Precedence: bulk


> On Feb 7, 2021, at 2:31 PM, Dave Hansen <dave.hansen@intel.com> wrote:
>=20
> =EF=BB=BFOn 2/7/21 12:29 PM, Kirill A. Shutemov wrote:
>>> Couldn't you just have one big helper that takes *all* the registers
>>> that get used in any TDVMCALL and sets all the rcx bits?  The users
>>> could just pass 0's for the things they don't use.
>>>=20
>>> Then you've got the ugly inline asm in one place.  It also makes it
>>> harder to screw up the 'rcx' mask and end up passing registers you
>>> didn't want into a malicious VMM.
>> For now we only pass down R10-R15, but the interface allows to pass down
>> much wider set of registers, including XMM. How far do we want to get it?=

>=20
> Just do what we immediately need: R10-R15
> .
>=20

How much of the register state is revealed to the VMM when we do a TDVMCALL?=
  Presumably we should fully sanitize all register state that shows up in cl=
eartext on the other end, and we should treat all regs that can be modified b=
y the VMM as clobbered.=