| Message ID | 079540d563ab0f5d8991ad4d3b1546c05dc2fb01.1708933498.git.isaku.yamahata@intel.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [v19,001/130] x86/virt/tdx: Rename _offset to _member for TD_SYSINFO_MAP() macro | expand |
On 26/02/2024 9:25 pm, Yamahata, Isaku wrote: > From: Isaku Yamahata <isaku.yamahata@intel.com> > > KVM_MEMORY_ENCRYPT_OP was introduced for VM-scoped operations specific for > guest state-protected VM. It defined subcommands for technology-specific > operations under KVM_MEMORY_ENCRYPT_OP. Despite its name, the subcommands > are not limited to memory encryption, but various technology-specific > operations are defined. It's natural to repurpose KVM_MEMORY_ENCRYPT_OP > for TDX specific operations and define subcommands. > > TDX requires VM-scoped TDX-specific operations for device model, for > example, qemu. Getting system-wide parameters, TDX-specific VM > initialization. -EPARSE for the second sentence (or it is not a valid sentence at all). > > Add a place holder function for TDX specific VM-scoped ioctl as mem_enc_op. > TDX specific sub-commands will be added to retrieve/pass TDX specific > parameters. Make mem_enc_ioctl non-optional as it's always filled. > > Signed-off-by: Isaku Yamahata <isaku.yamahata@intel.com> > --- > v15: > - change struct kvm_tdx_cmd to drop unused member. > --- > arch/x86/include/asm/kvm-x86-ops.h | 2 +- > arch/x86/include/uapi/asm/kvm.h | 26 ++++++++++++++++++++++++++ > arch/x86/kvm/vmx/main.c | 10 ++++++++++ > arch/x86/kvm/vmx/tdx.c | 26 ++++++++++++++++++++++++++ > arch/x86/kvm/vmx/x86_ops.h | 4 ++++ > arch/x86/kvm/x86.c | 4 ---- > 6 files changed, 67 insertions(+), 5 deletions(-) > > diff --git a/arch/x86/include/asm/kvm-x86-ops.h b/arch/x86/include/asm/kvm-x86-ops.h > index 8be71a5c5c87..00b371d9a1ca 100644 > --- a/arch/x86/include/asm/kvm-x86-ops.h > +++ b/arch/x86/include/asm/kvm-x86-ops.h > @@ -123,7 +123,7 @@ KVM_X86_OP(enter_smm) > KVM_X86_OP(leave_smm) > KVM_X86_OP(enable_smi_window) > #endif > -KVM_X86_OP_OPTIONAL(mem_enc_ioctl) > +KVM_X86_OP(mem_enc_ioctl) > KVM_X86_OP_OPTIONAL(mem_enc_register_region) > KVM_X86_OP_OPTIONAL(mem_enc_unregister_region) > KVM_X86_OP_OPTIONAL(vm_copy_enc_context_from) > diff --git a/arch/x86/include/uapi/asm/kvm.h b/arch/x86/include/uapi/asm/kvm.h > index 45b2c2304491..9ea46d143bef 100644 > --- a/arch/x86/include/uapi/asm/kvm.h > +++ b/arch/x86/include/uapi/asm/kvm.h > @@ -567,6 +567,32 @@ struct kvm_pmu_event_filter { > #define KVM_X86_TDX_VM 2 > #define KVM_X86_SNP_VM 3 > > +/* Trust Domain eXtension sub-ioctl() commands. */ > +enum kvm_tdx_cmd_id { > + KVM_TDX_CAPABILITIES = 0, > + > + KVM_TDX_CMD_NR_MAX, > +}; > + > +struct kvm_tdx_cmd { > + /* enum kvm_tdx_cmd_id */ > + __u32 id; > + /* flags for sub-commend. If sub-command doesn't use this, set zero. */ > + __u32 flags; > + /* > + * data for each sub-command. An immediate or a pointer to the actual > + * data in process virtual address. If sub-command doesn't use it, > + * set zero. > + */ > + __u64 data; > + /* > + * Auxiliary error code. The sub-command may return TDX SEAMCALL > + * status code in addition to -Exxx. > + * Defined for consistency with struct kvm_sev_cmd. > + */ > + __u64 error; If the 'error' is for SEAMCALL error, should we rename it to 'hw_error' or 'fw_error' or something similar? I think 'error' is too generic. > +}; > + > #define KVM_TDX_CPUID_NO_SUBLEAF ((__u32)-1) > > struct kvm_tdx_cpuid_config { > diff --git a/arch/x86/kvm/vmx/main.c b/arch/x86/kvm/vmx/main.c > index a948a6959ac7..082e82ce6580 100644 > --- a/arch/x86/kvm/vmx/main.c > +++ b/arch/x86/kvm/vmx/main.c > @@ -47,6 +47,14 @@ static int vt_vm_init(struct kvm *kvm) > return vmx_vm_init(kvm); > } > > +static int vt_mem_enc_ioctl(struct kvm *kvm, void __user *argp) > +{ > + if (!is_td(kvm)) > + return -ENOTTY; > + > + return tdx_vm_ioctl(kvm, argp); > +} > + > #define VMX_REQUIRED_APICV_INHIBITS \ > (BIT(APICV_INHIBIT_REASON_DISABLE)| \ > BIT(APICV_INHIBIT_REASON_ABSENT) | \ > @@ -200,6 +208,8 @@ struct kvm_x86_ops vt_x86_ops __initdata = { > .vcpu_deliver_sipi_vector = kvm_vcpu_deliver_sipi_vector, > > .get_untagged_addr = vmx_get_untagged_addr, > + > + .mem_enc_ioctl = vt_mem_enc_ioctl, > }; > > struct kvm_x86_init_ops vt_init_ops __initdata = { > diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c > index 5edfb99abb89..07a3f0f75f87 100644 > --- a/arch/x86/kvm/vmx/tdx.c > +++ b/arch/x86/kvm/vmx/tdx.c > @@ -55,6 +55,32 @@ struct tdx_info { > /* Info about the TDX module. */ > static struct tdx_info *tdx_info; > > +int tdx_vm_ioctl(struct kvm *kvm, void __user *argp) > +{ > + struct kvm_tdx_cmd tdx_cmd; > + int r; > + > + if (copy_from_user(&tdx_cmd, argp, sizeof(struct kvm_tdx_cmd))) > + return -EFAULT; Add an empty line. > + if (tdx_cmd.error) > + return -EINVAL; Add a comment? /* * Userspace should never set @error, which is used to fill * hardware-defined error by the kernel. */ > + > + mutex_lock(&kvm->lock); > + > + switch (tdx_cmd.id) { > + default: > + r = -EINVAL; I am not sure whether you should return -ENOTTY to be consistent with the previous vt_mem_enc_ioctl() where a TDX-specific IOCTL is issued for non-TDX guest. Here I think the invalid @id means the sub-command isn't valid. > + goto out; > + } > + > + if (copy_to_user(argp, &tdx_cmd, sizeof(struct kvm_tdx_cmd))) > + r = -EFAULT; > + > +out: > + mutex_unlock(&kvm->lock); > + return r; > +} > +
On Fri, Mar 22, 2024 at 11:10:48AM +1300, "Huang, Kai" <kai.huang@intel.com> wrote: > > diff --git a/arch/x86/include/uapi/asm/kvm.h b/arch/x86/include/uapi/asm/kvm.h > > index 45b2c2304491..9ea46d143bef 100644 > > --- a/arch/x86/include/uapi/asm/kvm.h > > +++ b/arch/x86/include/uapi/asm/kvm.h > > @@ -567,6 +567,32 @@ struct kvm_pmu_event_filter { > > #define KVM_X86_TDX_VM 2 > > #define KVM_X86_SNP_VM 3 > > +/* Trust Domain eXtension sub-ioctl() commands. */ > > +enum kvm_tdx_cmd_id { > > + KVM_TDX_CAPABILITIES = 0, > > + > > + KVM_TDX_CMD_NR_MAX, > > +}; > > + > > +struct kvm_tdx_cmd { > > + /* enum kvm_tdx_cmd_id */ > > + __u32 id; > > + /* flags for sub-commend. If sub-command doesn't use this, set zero. */ > > + __u32 flags; > > + /* > > + * data for each sub-command. An immediate or a pointer to the actual > > + * data in process virtual address. If sub-command doesn't use it, > > + * set zero. > > + */ > > + __u64 data; > > + /* > > + * Auxiliary error code. The sub-command may return TDX SEAMCALL > > + * status code in addition to -Exxx. > > + * Defined for consistency with struct kvm_sev_cmd. > > + */ > > + __u64 error; > > If the 'error' is for SEAMCALL error, should we rename it to 'hw_error' or > 'fw_error' or something similar? I think 'error' is too generic. Ok, will rename it to hw_error. > > diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c > > index 5edfb99abb89..07a3f0f75f87 100644 > > --- a/arch/x86/kvm/vmx/tdx.c > > +++ b/arch/x86/kvm/vmx/tdx.c > > @@ -55,6 +55,32 @@ struct tdx_info { > > /* Info about the TDX module. */ > > static struct tdx_info *tdx_info; > > +int tdx_vm_ioctl(struct kvm *kvm, void __user *argp) > > +{ > > + struct kvm_tdx_cmd tdx_cmd; > > + int r; > > + > > + if (copy_from_user(&tdx_cmd, argp, sizeof(struct kvm_tdx_cmd))) > > + return -EFAULT; > > Add an empty line. > > > + if (tdx_cmd.error) > > + return -EINVAL; > > Add a comment? > > /* > * Userspace should never set @error, which is used to fill > * hardware-defined error by the kernel. > */ Sure. > > + > > + mutex_lock(&kvm->lock); > > + > > + switch (tdx_cmd.id) { > > + default: > > + r = -EINVAL; > > I am not sure whether you should return -ENOTTY to be consistent with the > previous vt_mem_enc_ioctl() where a TDX-specific IOCTL is issued for non-TDX > guest. > > Here I think the invalid @id means the sub-command isn't valid. vt_vcpu_mem_enc_ioctl() checks non-TDX case and returns -ENOTTY. We know that the guest is TD.
> > > > + > > > + mutex_lock(&kvm->lock); > > > + > > > + switch (tdx_cmd.id) { > > > + default: > > > + r = -EINVAL; > > > > I am not sure whether you should return -ENOTTY to be consistent with the > > previous vt_mem_enc_ioctl() where a TDX-specific IOCTL is issued for non-TDX > > guest. > > > > Here I think the invalid @id means the sub-command isn't valid. > > vt_vcpu_mem_enc_ioctl() checks non-TDX case and returns -ENOTTY. We know that > the guest is TD. But the command is not supported, right? I roughly recall I saw somewhere that in such case we should return -ENOTTY, but I cannot find the link now. But I found this old link uses -ENOTTY: https://lwn.net/Articles/58719/ So, just fyi.
On Sat, 2024-03-23 at 04:27 +0000, Huang, Kai wrote: > > vt_vcpu_mem_enc_ioctl() checks non-TDX case and returns -ENOTTY. We know that > > the guest is TD. > > But the command is not supported, right? > > I roughly recall I saw somewhere that in such case we should return -ENOTTY, but > I cannot find the link now. > > But I found this old link uses -ENOTTY: > > https://lwn.net/Articles/58719/ > > So, just fyi. The AMD version of this returns -EINVAL when the subcommand is not implemented. I don't think the TDX side should need to necessarily match that. Is the case of concern when in a future where there are more subcommands that are only supported when some other mode is enabled? The man page says: ENOTTY The specified request does not apply to the kind of object that the file descriptor fd references. If a future command does not apply for the TDX mode, then an upgraded kernel could start returning ENOTTY instead of EINVAL. Hmm. We could always have the option of making KVM_MEMORY_ENCRYPT_OP_FOO for some future mode foo if there were compatibility issues, so I don't think we would be stuck either way. After thinking about it, I'd make a weak vote to leave it. No strong opinion though.
diff --git a/arch/x86/include/asm/kvm-x86-ops.h b/arch/x86/include/asm/kvm-x86-ops.h index 8be71a5c5c87..00b371d9a1ca 100644 --- a/arch/x86/include/asm/kvm-x86-ops.h +++ b/arch/x86/include/asm/kvm-x86-ops.h @@ -123,7 +123,7 @@ KVM_X86_OP(enter_smm) KVM_X86_OP(leave_smm) KVM_X86_OP(enable_smi_window) #endif -KVM_X86_OP_OPTIONAL(mem_enc_ioctl) +KVM_X86_OP(mem_enc_ioctl) KVM_X86_OP_OPTIONAL(mem_enc_register_region) KVM_X86_OP_OPTIONAL(mem_enc_unregister_region) KVM_X86_OP_OPTIONAL(vm_copy_enc_context_from) diff --git a/arch/x86/include/uapi/asm/kvm.h b/arch/x86/include/uapi/asm/kvm.h index 45b2c2304491..9ea46d143bef 100644 --- a/arch/x86/include/uapi/asm/kvm.h +++ b/arch/x86/include/uapi/asm/kvm.h @@ -567,6 +567,32 @@ struct kvm_pmu_event_filter { #define KVM_X86_TDX_VM 2 #define KVM_X86_SNP_VM 3 +/* Trust Domain eXtension sub-ioctl() commands. */ +enum kvm_tdx_cmd_id { + KVM_TDX_CAPABILITIES = 0, + + KVM_TDX_CMD_NR_MAX, +}; + +struct kvm_tdx_cmd { + /* enum kvm_tdx_cmd_id */ + __u32 id; + /* flags for sub-commend. If sub-command doesn't use this, set zero. */ + __u32 flags; + /* + * data for each sub-command. An immediate or a pointer to the actual + * data in process virtual address. If sub-command doesn't use it, + * set zero. + */ + __u64 data; + /* + * Auxiliary error code. The sub-command may return TDX SEAMCALL + * status code in addition to -Exxx. + * Defined for consistency with struct kvm_sev_cmd. + */ + __u64 error; +}; + #define KVM_TDX_CPUID_NO_SUBLEAF ((__u32)-1) struct kvm_tdx_cpuid_config { diff --git a/arch/x86/kvm/vmx/main.c b/arch/x86/kvm/vmx/main.c index a948a6959ac7..082e82ce6580 100644 --- a/arch/x86/kvm/vmx/main.c +++ b/arch/x86/kvm/vmx/main.c @@ -47,6 +47,14 @@ static int vt_vm_init(struct kvm *kvm) return vmx_vm_init(kvm); } +static int vt_mem_enc_ioctl(struct kvm *kvm, void __user *argp) +{ + if (!is_td(kvm)) + return -ENOTTY; + + return tdx_vm_ioctl(kvm, argp); +} + #define VMX_REQUIRED_APICV_INHIBITS \ (BIT(APICV_INHIBIT_REASON_DISABLE)| \ BIT(APICV_INHIBIT_REASON_ABSENT) | \ @@ -200,6 +208,8 @@ struct kvm_x86_ops vt_x86_ops __initdata = { .vcpu_deliver_sipi_vector = kvm_vcpu_deliver_sipi_vector, .get_untagged_addr = vmx_get_untagged_addr, + + .mem_enc_ioctl = vt_mem_enc_ioctl, }; struct kvm_x86_init_ops vt_init_ops __initdata = { diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c index 5edfb99abb89..07a3f0f75f87 100644 --- a/arch/x86/kvm/vmx/tdx.c +++ b/arch/x86/kvm/vmx/tdx.c @@ -55,6 +55,32 @@ struct tdx_info { /* Info about the TDX module. */ static struct tdx_info *tdx_info; +int tdx_vm_ioctl(struct kvm *kvm, void __user *argp) +{ + struct kvm_tdx_cmd tdx_cmd; + int r; + + if (copy_from_user(&tdx_cmd, argp, sizeof(struct kvm_tdx_cmd))) + return -EFAULT; + if (tdx_cmd.error) + return -EINVAL; + + mutex_lock(&kvm->lock); + + switch (tdx_cmd.id) { + default: + r = -EINVAL; + goto out; + } + + if (copy_to_user(argp, &tdx_cmd, sizeof(struct kvm_tdx_cmd))) + r = -EFAULT; + +out: + mutex_unlock(&kvm->lock); + return r; +} + #define TDX_MD_MAP(_fid, _ptr) \ { .fid = MD_FIELD_ID_##_fid, \ .ptr = (_ptr), } diff --git a/arch/x86/kvm/vmx/x86_ops.h b/arch/x86/kvm/vmx/x86_ops.h index e8cb4ae81cf1..f6c57ad44f80 100644 --- a/arch/x86/kvm/vmx/x86_ops.h +++ b/arch/x86/kvm/vmx/x86_ops.h @@ -138,10 +138,14 @@ void vmx_setup_mce(struct kvm_vcpu *vcpu); int __init tdx_hardware_setup(struct kvm_x86_ops *x86_ops); void tdx_hardware_unsetup(void); bool tdx_is_vm_type_supported(unsigned long type); + +int tdx_vm_ioctl(struct kvm *kvm, void __user *argp); #else static inline int tdx_hardware_setup(struct kvm_x86_ops *x86_ops) { return -EOPNOTSUPP; } static inline void tdx_hardware_unsetup(void) {} static inline bool tdx_is_vm_type_supported(unsigned long type) { return false; } + +static inline int tdx_vm_ioctl(struct kvm *kvm, void __user *argp) { return -EOPNOTSUPP; } #endif #endif /* __KVM_X86_VMX_X86_OPS_H */ diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 442b356e4939..c459a5e9e520 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -7247,10 +7247,6 @@ int kvm_arch_vm_ioctl(struct file *filp, unsigned int ioctl, unsigned long arg) goto out; } case KVM_MEMORY_ENCRYPT_OP: { - r = -ENOTTY; - if (!kvm_x86_ops.mem_enc_ioctl) - goto out; - r = static_call(kvm_x86_mem_enc_ioctl)(kvm, argp); break; }