Date:   Fri, 7 Jan 2022 20:49:26 +0300
From:   "Kirill A. Shutemov" <kirill@shutemov.name>
To:     Borislav Petkov <bp@alien8.de>
Cc:     "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>,
        tglx@linutronix.de, mingo@redhat.com, dave.hansen@intel.com,
        luto@kernel.org, peterz@infradead.org,
        sathyanarayanan.kuppuswamy@linux.intel.com, aarcange@redhat.com,
        ak@linux.intel.com, dan.j.williams@intel.com, david@redhat.com,
        hpa@zytor.com, jgross@suse.com, jmattson@google.com,
        joro@8bytes.org, jpoimboe@redhat.com, knsathya@kernel.org,
        pbonzini@redhat.com, sdeep@vmware.com, seanjc@google.com,
        tony.luck@intel.com, vkuznets@redhat.com, wanpengli@tencent.com,
        x86@kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH 08/26] x86/tdx: Handle in-kernel MMIO
Message-ID: <20220107174926.rh35qcyhu6u2tkzw@box.shutemov.name>
References: <20211214150304.62613-1-kirill.shutemov@linux.intel.com>
 <20211214150304.62613-9-kirill.shutemov@linux.intel.com>
 <YdV1BpMiAUGrwASv@zn.tnic>
 <20220105154311.bocij4mwbga4t2hb@box.shutemov.name>
 <YdhEQTnm+XMxoDPW@zn.tnic>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <YdhEQTnm+XMxoDPW@zn.tnic>
Precedence: bulk

On Fri, Jan 07, 2022 at 02:46:41PM +0100, Borislav Petkov wrote:
> On Wed, Jan 05, 2022 at 06:43:11PM +0300, Kirill A. Shutemov wrote:
> > Not encrypted, saved/restored by TDX module. But yes, cannot be exposed
> > (without guest intend).
> > 
> > I talk here about *why* the traditional way to handle MMIO -- on VMM side
> > -- doesn't work for TDX. It's not safe with untrusted VMM.
> 
> Lemme see if I understand this correctly: TDX module saves/restores
> guest registers so a malicious hypervisor cannot access them? And that's
> why you can't do the traditional way MMIO is done?

To emulate an instruction the emulator needs two things:

  - R/W access to the register file to read/modify instruction arguments
    and see RIP of the faulted instruction.

  - Read access to memory where instruction is placed to see what to
    emualte. In this case it is guest kernel text.

Both of them are not available to VMM in TDX environment:

  - Register file is never exposed to VMM. When a TD exits to the module,
    it saves registers into the state-save area allocated for that TD.
    The module then scrubs these registers before returning execution
    control to the VMM, to help prevent leakage of TD state.

  - Memory is encrypted TD-private key. The CPU disallows software other
    than the TDX module and TDs from making memory accesses using the
    private key.
> 
> > readX()/writeX() helpers limit the range of instructions which can trigger
> > MMIO. It makes MMIO instruction emulation feasible. Raw access to MMIO
> > region allows compiler to generate whatever instruction it wants.
> > Supporting all possible instructions is a task of a different scope.
> 
> Yap, please add that to the commit message.

Okay.

-- 
 Kirill A. Shutemov