linux-kernel - Re: [PATCHv7 02/30] x86/tdx: Provide common base for SEAMCALL and TDCALL C wrappers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20220321155229.jrjht4vnxgrh2wq5@black.fi.intel.com>
Date:   Mon, 21 Mar 2022 18:52:29 +0300
From:   "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>
To:     Borislav Petkov <bp@...en8.de>
Cc:     tglx@...utronix.de, mingo@...hat.com, dave.hansen@...el.com,
        luto@...nel.org, peterz@...radead.org,
        sathyanarayanan.kuppuswamy@...ux.intel.com, aarcange@...hat.com,
        ak@...ux.intel.com, dan.j.williams@...el.com, david@...hat.com,
        hpa@...or.com, jgross@...e.com, jmattson@...gle.com,
        joro@...tes.org, jpoimboe@...hat.com, knsathya@...nel.org,
        pbonzini@...hat.com, sdeep@...are.com, seanjc@...gle.com,
        tony.luck@...el.com, vkuznets@...hat.com, wanpengli@...cent.com,
        thomas.lendacky@....com, brijesh.singh@....com, x86@...nel.org,
        linux-kernel@...r.kernel.org,
        Dave Hansen <dave.hansen@...ux.intel.com>
Subject: Re: [PATCHv7 02/30] x86/tdx: Provide common base for SEAMCALL and
 TDCALL C wrappers

On Sat, Mar 19, 2022 at 03:48:11PM +0100, Borislav Petkov wrote:
> On Fri, Mar 18, 2022 at 06:30:20PM +0300, Kirill A. Shutemov wrote:
> > Secure Arbitration Mode (SEAM) is an extension of VMX architecture.  It
> > defines a new VMX root operation (SEAM VMX root) and a new VMX non-root
> > operation (SEAM VMX non-root) which are both isolated from the legacy
> > VMX operation where the host kernel runs.
> > 
> > A CPU-attested software module (called 'TDX module') runs in SEAM VMX
> > root to manage and protect VMs running in SEAM VMX non-root.  SEAM VMX
> > root is also used to host another CPU-attested software module (called
> > 'P-SEAMLDR') to load and update the TDX module.
> > 
> > Host kernel transits to either P-SEAMLDR or TDX module via the new
> > SEAMCALL instruction, which is essentially a VMExit from VMX root mode
> > to SEAM VMX root mode.  SEAMCALLs are leaf functions defined by
> > P-SEAMLDR and TDX module around the new SEAMCALL instruction.
> > 
> > A guest kernel can also communicate with TDX module via TDCALL
> > instruction.
> > 
> > TDCALLs and SEAMCALLs use an ABI different from the x86-64 system-v ABI.
> > RAX is used to carry both the SEAMCALL leaf function number (input) and
> > the completion status (output).  Additional GPRs (RCX, RDX, R8-R11) may
> > be further used as both input and output operands in individual leaf.
> > 
> > TDCALL and SEAMCALL share the same ABI and require the largely same
> > code to pass down arguments and retrieve results.
> > 
> > Define an assembly macro that can be used to implement C wrapper for
> > both TDCALL and SEAMCALL.
> > 
> > Suggested-by: Thomas Gleixner <tglx@...utronix.de>
> > Signed-off-by: Kirill A. Shutemov <kirill.shutemov@...ux.intel.com>
> > Reviewed-by: Dave Hansen <dave.hansen@...ux.intel.com>
> > Reviewed-by: Thomas Gleixner <tglx@...utronix.de>
> > ---
> > TDCALL wrapper will be implemented using the macro later in the series.
> > SEAMCALL wrapper is out-of-scope for the series and will be implemented
> > as part of TDX host enabling.
> > ---
> >  arch/x86/include/asm/tdx.h      | 28 ++++++++++
> >  arch/x86/kernel/asm-offsets.c   |  9 ++++
> >  arch/x86/virt/vmx/tdx/tdxcall.S | 94 +++++++++++++++++++++++++++++++++
> >  3 files changed, 131 insertions(+)
> >  create mode 100644 arch/x86/virt/vmx/tdx/tdxcall.S
> 
> Instead of hurrying to send the set again two days after the v6 one -
> 
>   [ I frankly wonder why you're even in such a hurry - it seems people
>     believe that hammering out the patches constantly would somehow get them
>     upstreamed faster :-\ ]
> 
> - you should rather apply more diligence and take care of working in all
> the comments from last review:
> 
> https://lore.kernel.org/r/87lex9321l.ffs@tglx

My bad.

I clearly remember addressing these. But I lost it somehow, I donno.

Will send v7.1.

-- 
 Kirill A. Shutemov