Received-SPF: pass (google.com: domain of linux-kernel+bounces-110742-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
Message-ID: <9c35ecd7-e737-441a-99ff-27bda2a9b25d@intel.com>
Date: Fri, 22 Mar 2024 11:10:48 +1300
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH v19 035/130] KVM: TDX: Add place holder for TDX VM
 specific mem_enc_op ioctl
To: "Yamahata, Isaku" <isaku.yamahata@intel.com>, "kvm@vger.kernel.org"
	<kvm@vger.kernel.org>, "linux-kernel@vger.kernel.org"
	<linux-kernel@vger.kernel.org>
CC: "isaku.yamahata@gmail.com" <isaku.yamahata@gmail.com>, Paolo Bonzini
	<pbonzini@redhat.com>, "Aktas, Erdem" <erdemaktas@google.com>, "Sean
 Christopherson" <seanjc@google.com>, Sagi Shahar <sagis@google.com>, "Chen,
 Bo2" <chen.bo@intel.com>, "Yuan, Hang" <hang.yuan@intel.com>, "Zhang, Tina"
	<tina.zhang@intel.com>
References: <cover.1708933498.git.isaku.yamahata@intel.com>
 <079540d563ab0f5d8991ad4d3b1546c05dc2fb01.1708933498.git.isaku.yamahata@intel.com>
Content-Language: en-US
From: "Huang, Kai" <kai.huang@intel.com>
In-Reply-To: <079540d563ab0f5d8991ad4d3b1546c05dc2fb01.1708933498.git.isaku.yamahata@intel.com>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?czZ4dW9EbHJXaWFzQzgyanRDMWJpRXp3U3pUWjhnRUdXeWVrVjNWdnVNemZH?=
 =?utf-8?B?OUZXMUY3U1dOQ3hlTGZsdUVlekFka1UyTDF2RE5iMzBKL1dxY09vV1lFRVBB?=
 =?utf-8?B?UlFEeUVZQjBENkNJK1lFa3VTZnZZcUpVRjBZUnNVNGkxK1N6d3pxNndlaXA0?=
 =?utf-8?B?d0ZybEV4K1FSZjliQUFZTDlHRHlBM2YvMkZ0b3pXUUZET0k5OFBFbndPMzBH?=
 =?utf-8?B?dTRtc1hWRnhSQTluRDRmM1lVWTRlOEJ4OFFEUWwwbjlnY3gyT0JHTXpKdVow?=
 =?utf-8?B?VWxmR25xYmFQYWp2S1h1NjNqUHBtZlBRK1ZNQ3VOV0poeXVLNTJuZEpkaHhF?=
 =?utf-8?B?K0hYQ2VHSlZBSi9zOXdEc3NzekZjS2NRdVllOUNJL3M4NTI3UHg0WjJ6RURr?=
 =?utf-8?B?WHNGTFROckJ5eWRiOW9pMFdyL1RQYUZVbTdmWm43anZmZ1g0eWJSUmlOSmN3?=
 =?utf-8?B?QnlrRENISDlESnNkM0xodkdzRm5YdWJ4b05jYXlEbmFtNzMxdkRKeURYYm02?=
 =?utf-8?B?aVhrWVY0a0VaOHk1UUVTMVdSOWJXQk0wMzRwc2RuUGFveWd5ZDFPL0hsNTZQ?=
 =?utf-8?B?VjFWN1kwWkU0akRMK3JHZ1VFNjJReHZsc2I3aHpzUlV0aW4xNE45ZFA3aDZT?=
 =?utf-8?B?WDNQb1VEOGdYQ0RnL0NHMzhvUjFCSHovRzlnZmJGOG1UNUhWRlVrK3ZXSm5T?=
 =?utf-8?B?Q1NjaXEzUDllT2hhTlk2VktXMjdZc0VEcXBoOGFIL1E4MnBYWGt3U1cySC81?=
 =?utf-8?B?RjlqN2tFNHdla3AwcHdxQkpYNFZHMW1pTkZDaGRCQ2VMSkNwb3UxNThBNjBQ?=
 =?utf-8?B?d2VHSVFOaStSK2IwRHR6NkJzNGtZcVFqQ3VHRmo1Y3ZNRmVlVlA2TTYyWWt5?=
 =?utf-8?B?VGhHbHVmbjQ1N0NTNE1zNE5JQ2xxQm1Ud3BYTExpZzVXdjdCaUh2QzZmZmMr?=
 =?utf-8?B?b1JWNUxvYlhWWVd0Zmp6T0l3M1UrZ1I5em9pWnlacldudnc4SHpCVHl3WHJB?=
 =?utf-8?B?Z0Q5bjBLR2NzbGNYNHpEbkhFRDQzcG9heGIzNWxPcHJOdUcxTEM3UE1TSHRG?=
 =?utf-8?B?WjJVWE82aGZKckdyZHBqMjA1YzU2MkFYb2hRWm1pNy9ZOVUrcVdoOGtVZDli?=
 =?utf-8?B?MlVUdFprci9XQ1lWSDVLME9LTVV0eno4R3Q4c0Nkcnd0YXltTzl1Mlk4bERp?=
 =?utf-8?B?MnNIU09vQndhRlpIWlp1amlHVDBNYk15VUt1TE5LZVhwbExldWN0WU5hb3F5?=
 =?utf-8?B?WkdmRTFUL3pXNUNWbDJjckdDa3M2NlhoTkVKdFNRVW5VMFZURHpTbTFvU0hz?=
 =?utf-8?B?S3FMbHhrUTg4bklIWE9DZ2hiQnBwWVJjR0MxTzdXeGdRcVRidC8wK1pKT2JM?=
 =?utf-8?B?RTlCUzlOM0pwekRUc2pXL3V6aHZqbWpaMk1XNnMrNTczbW1xNlorMENSVXlF?=
 =?utf-8?B?VCs5N1RPRHhoOVZvNXhmRlY4RCsxNHAxbzU2elRYNVd0OSs5VXZDR3MwQ3RO?=
 =?utf-8?B?VlBHbVpscDNmK3EwaXBCK3NNQXlkZ2NUTHgxaW41SVZ6SXE0M0JJNjE1M3dO?=
 =?utf-8?B?Y2pSRnpYMUtocDd5OEJOVlRCeHZUQ1RQV0YraWNHYWdhZW1vZlN2UC92QVh3?=
 =?utf-8?B?ZkFrZWNmWFJ3cFBjNms4QUZsTnBqZXdNSFFqRURkZkNwdWVMTE9BUHVYdHpn?=
 =?utf-8?B?SDA0VXRCUGw3enlKSi8rQ0FHWHp4MjZzT3E2eVYyZjllQWgra0lKQUhtV2dN?=
 =?utf-8?B?Q21nVU9NVmtIS1h0dUFWdUkxbVZsY1ZQcVo1MHpwMm5QT3NWaG1wR25xUU1r?=
 =?utf-8?B?UDVmNzlubG5BdWZsVkRFaVduZjRKV2tXTHZ2YUI1ZDVnUjhBbzhvMjNtUHYz?=
 =?utf-8?B?bTZEQXhkd3ZweWU0Z0dSWW4xSkcyelhGczR6RGhWajlLMGdhNlB1WXlFS2ow?=
 =?utf-8?B?dnE0S0dkZlRiSzA5bFlvTFB4Sm5wMzRSY1AxUnVkbm1BRm1LTlFyRzQ2VndE?=
 =?utf-8?B?bzFxRHRLc0JWQkpBa2pKWWp6QWdwQ3B5ZXFsTWtSejJxNjdMY1hHM3ltZE52?=
 =?utf-8?B?c3k2NzhCU08vSGt4eVNFSnRWZHI0OXE1NzVRSXI2MUJDckRzM2k3eXVBZGRy?=
 =?utf-8?Q?BUlmXyezr0HZeUefiIJx5Of3k?=
X-MS-Exchange-CrossTenant-Network-Message-Id: 6190a21c-ef39-4ffe-936d-08dc49f3c984
X-MS-Exchange-CrossTenant-AuthSource: BL1PR11MB5978.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Mar 2024 22:10:58.7832
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: lQy4tix+Dj1Qpema3/CSMf0gTZ1OvegAwnJXcM74CNHlD+icFSdBXIaucdQF65TErnN7Ow5cUIqfQv2c6wbb0Q==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ2PR11MB8498
X-OriginatorOrg: intel.com


On 26/02/2024 9:25 pm, Yamahata, Isaku wrote:
> From: Isaku Yamahata <isaku.yamahata@intel.com>
> 
> KVM_MEMORY_ENCRYPT_OP was introduced for VM-scoped operations specific for
> guest state-protected VM.  It defined subcommands for technology-specific
> operations under KVM_MEMORY_ENCRYPT_OP.  Despite its name, the subcommands
> are not limited to memory encryption, but various technology-specific
> operations are defined.  It's natural to repurpose KVM_MEMORY_ENCRYPT_OP
> for TDX specific operations and define subcommands.
> 
> TDX requires VM-scoped TDX-specific operations for device model, for
> example, qemu.  Getting system-wide parameters, TDX-specific VM
> initialization.

-EPARSE for the second sentence (or it is not a valid sentence at all).

> 
> Add a place holder function for TDX specific VM-scoped ioctl as mem_enc_op.
> TDX specific sub-commands will be added to retrieve/pass TDX specific
> parameters.  Make mem_enc_ioctl non-optional as it's always filled.
> 
> Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com>
> ---
> v15:
> - change struct kvm_tdx_cmd to drop unused member.
> ---
>   arch/x86/include/asm/kvm-x86-ops.h |  2 +-
>   arch/x86/include/uapi/asm/kvm.h    | 26 ++++++++++++++++++++++++++
>   arch/x86/kvm/vmx/main.c            | 10 ++++++++++
>   arch/x86/kvm/vmx/tdx.c             | 26 ++++++++++++++++++++++++++
>   arch/x86/kvm/vmx/x86_ops.h         |  4 ++++
>   arch/x86/kvm/x86.c                 |  4 ----
>   6 files changed, 67 insertions(+), 5 deletions(-)
> 
> diff --git a/arch/x86/include/asm/kvm-x86-ops.h b/arch/x86/include/asm/kvm-x86-ops.h
> index 8be71a5c5c87..00b371d9a1ca 100644
> --- a/arch/x86/include/asm/kvm-x86-ops.h
> +++ b/arch/x86/include/asm/kvm-x86-ops.h
> @@ -123,7 +123,7 @@ KVM_X86_OP(enter_smm)
>   KVM_X86_OP(leave_smm)
>   KVM_X86_OP(enable_smi_window)
>   #endif
> -KVM_X86_OP_OPTIONAL(mem_enc_ioctl)
> +KVM_X86_OP(mem_enc_ioctl)
>   KVM_X86_OP_OPTIONAL(mem_enc_register_region)
>   KVM_X86_OP_OPTIONAL(mem_enc_unregister_region)
>   KVM_X86_OP_OPTIONAL(vm_copy_enc_context_from)
> diff --git a/arch/x86/include/uapi/asm/kvm.h b/arch/x86/include/uapi/asm/kvm.h
> index 45b2c2304491..9ea46d143bef 100644
> --- a/arch/x86/include/uapi/asm/kvm.h
> +++ b/arch/x86/include/uapi/asm/kvm.h
> @@ -567,6 +567,32 @@ struct kvm_pmu_event_filter {
>   #define KVM_X86_TDX_VM		2
>   #define KVM_X86_SNP_VM		3
>   
> +/* Trust Domain eXtension sub-ioctl() commands. */
> +enum kvm_tdx_cmd_id {
> +	KVM_TDX_CAPABILITIES = 0,
> +
> +	KVM_TDX_CMD_NR_MAX,
> +};
> +
> +struct kvm_tdx_cmd {
> +	/* enum kvm_tdx_cmd_id */
> +	__u32 id;
> +	/* flags for sub-commend. If sub-command doesn't use this, set zero. */
> +	__u32 flags;
> +	/*
> +	 * data for each sub-command. An immediate or a pointer to the actual
> +	 * data in process virtual address.  If sub-command doesn't use it,
> +	 * set zero.
> +	 */
> +	__u64 data;
> +	/*
> +	 * Auxiliary error code.  The sub-command may return TDX SEAMCALL
> +	 * status code in addition to -Exxx.
> +	 * Defined for consistency with struct kvm_sev_cmd.
> +	 */
> +	__u64 error;

If the 'error' is for SEAMCALL error, should we rename it to 'hw_error' 
or 'fw_error' or something similar? I think 'error' is too generic.

> +};
> +
>   #define KVM_TDX_CPUID_NO_SUBLEAF	((__u32)-1)
>   
>   struct kvm_tdx_cpuid_config {
> diff --git a/arch/x86/kvm/vmx/main.c b/arch/x86/kvm/vmx/main.c
> index a948a6959ac7..082e82ce6580 100644
> --- a/arch/x86/kvm/vmx/main.c
> +++ b/arch/x86/kvm/vmx/main.c
> @@ -47,6 +47,14 @@ static int vt_vm_init(struct kvm *kvm)
>   	return vmx_vm_init(kvm);
>   }
>   
> +static int vt_mem_enc_ioctl(struct kvm *kvm, void __user *argp)
> +{
> +	if (!is_td(kvm))
> +		return -ENOTTY;
> +
> +	return tdx_vm_ioctl(kvm, argp);
> +}
> +
>   #define VMX_REQUIRED_APICV_INHIBITS				\
>   	(BIT(APICV_INHIBIT_REASON_DISABLE)|			\
>   	 BIT(APICV_INHIBIT_REASON_ABSENT) |			\
> @@ -200,6 +208,8 @@ struct kvm_x86_ops vt_x86_ops __initdata = {
>   	.vcpu_deliver_sipi_vector = kvm_vcpu_deliver_sipi_vector,
>   
>   	.get_untagged_addr = vmx_get_untagged_addr,
> +
> +	.mem_enc_ioctl = vt_mem_enc_ioctl,
>   };
>   
>   struct kvm_x86_init_ops vt_init_ops __initdata = {
> diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
> index 5edfb99abb89..07a3f0f75f87 100644
> --- a/arch/x86/kvm/vmx/tdx.c
> +++ b/arch/x86/kvm/vmx/tdx.c
> @@ -55,6 +55,32 @@ struct tdx_info {
>   /* Info about the TDX module. */
>   static struct tdx_info *tdx_info;
>   
> +int tdx_vm_ioctl(struct kvm *kvm, void __user *argp)
> +{
> +	struct kvm_tdx_cmd tdx_cmd;
> +	int r;
> +
> +	if (copy_from_user(&tdx_cmd, argp, sizeof(struct kvm_tdx_cmd)))
> +		return -EFAULT;

Add an empty line.

> +	if (tdx_cmd.error)
> +		return -EINVAL;

Add a comment?

	/*
	 * Userspace should never set @error, which is used to fill
	 * hardware-defined error by the kernel.
	 */

> +
> +	mutex_lock(&kvm->lock);
> +
> +	switch (tdx_cmd.id) {
> +	default:
> +		r = -EINVAL;

I am not sure whether you should return -ENOTTY to be consistent with 
the previous vt_mem_enc_ioctl() where a TDX-specific IOCTL is issued for 
non-TDX guest.

Here I think the invalid @id means the sub-command isn't valid.

> +		goto out;
> +	}
> +
> +	if (copy_to_user(argp, &tdx_cmd, sizeof(struct kvm_tdx_cmd)))
> +		r = -EFAULT;
> +
> +out:
> +	mutex_unlock(&kvm->lock);
> +	return r;
> +}
> +