linux-kernel - Re: [PATCH 1/2] KVM: TDX: Handle TDG.VP.VMCALL<GetQuote>

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <45674f2bb8c7bb09f0f3a29d7c4fb9bdc14b22d7.camel@intel.com>
Date: Wed, 2 Apr 2025 22:00:15 +0000
From: "Huang, Kai" <kai.huang@...el.com>
To: "kvm@...r.kernel.org" <kvm@...r.kernel.org>, "pbonzini@...hat.com"
	<pbonzini@...hat.com>, "seanjc@...gle.com" <seanjc@...gle.com>,
	"binbin.wu@...ux.intel.com" <binbin.wu@...ux.intel.com>
CC: "mikko.ylinen@...ux.intel.com" <mikko.ylinen@...ux.intel.com>, "Edgecombe,
 Rick P" <rick.p.edgecombe@...el.com>, "Gao, Chao" <chao.gao@...el.com>, "Li,
 Xiaoyao" <xiaoyao.li@...el.com>, "Chatre, Reinette"
	<reinette.chatre@...el.com>, "Hunter, Adrian" <adrian.hunter@...el.com>,
	"Lindgren, Tony" <tony.lindgren@...el.com>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>, "Zhao, Yan Y" <yan.y.zhao@...el.com>,
	"Yamahata, Isaku" <isaku.yamahata@...el.com>
Subject: Re: [PATCH 1/2] KVM: TDX: Handle TDG.VP.VMCALL<GetQuote>


> > 
> > > +via the same buffer. The 'ret' field represents the return value.
> > > 
> > return value of the GetQuote TDVMCALL?
> Yes, thereturn code of the GetQuote TDVMCALL.
> > 
> > > The userspace
> > > +should update the return value before resuming the vCPU according to TDX GHCI
> > > +spec.
> > > 
> > I don't quite follow.  Why userspace should "update" the return value?
> Because only userspace knows whether the request has been queued successfully.
> 
> According to GHCI, TDG.VP.VMCALL<GetQuote> API allows one TD to issue multiple
> requests. This is implementation specific as to how many concurrent requests
> are allowed.  The TD should be able to handle TDG.VP.VMCALL_RETRY if it chooses
> to issue multiple requests simultaneously.
> So the userspace may set the return code as TDG.VP.VMCALL_RETRY.

OK.  How about just say:

The 'ret' field represents the return value of the GetQuote request.  KVM only
bridges the request to userspace VMM after sanity checks, and the userspace VMM
is responsible for setting up the return value since only userspace knows
whether the request has been queued successfully or not.