On 4/09/24 06:07, Rick Edgecombe wrote:
> From: Isaku Yamahata <isaku.yamahata@xxxxxxxxx>
>
> Add a new VM-scoped KVM_MEMORY_ENCRYPT_OP IOCTL subcommand,
> KVM_TDX_FINALIZE_VM, to perform TD Measurement Finalization.
>
> Documentation for the API is added in another patch:
> "Documentation/virt/kvm: Document on Trust Domain Extensions(TDX)"
>
> For the purpose of attestation, a measurement must be made of the TDX VM
> initial state. This is referred to as TD Measurement Finalization, and
> uses SEAMCALL TDH.MR.FINALIZE, after which:
> 1. The VMM adding TD private pages with arbitrary content is no longer
> allowed
> 2. The TDX VM is runnable
>
> Co-developed-by: Adrian Hunter <adrian.hunter@xxxxxxxxx>
> Signed-off-by: Adrian Hunter <adrian.hunter@xxxxxxxxx>
> Signed-off-by: Isaku Yamahata <isaku.yamahata@xxxxxxxxx>
> Signed-off-by: Rick Edgecombe <rick.p.edgecombe@xxxxxxxxx>
> ---
> TDX MMU part 2 v1:
> - Added premapped check.
> - Update for the wrapper functions for SEAMCALLs. (Sean)
> - Add check if nr_premapped is zero. If not, return error.
> - Use KVM_BUG_ON() in tdx_td_finalizer() for consistency.
> - Change tdx_td_finalizemr() to take struct kvm_tdx_cmd *cmd and return error
> (Adrian)
> - Handle TDX_OPERAND_BUSY case (Adrian)
> - Updates from seamcall overhaul (Kai)
> - Rename error->hw_error
>
> v18:
> - Remove the change of tools/arch/x86/include/uapi/asm/kvm.h.
>
> v15:
> - removed unconditional tdx_track() by tdx_flush_tlb_current() that
> does tdx_track().
> ---
> arch/x86/include/uapi/asm/kvm.h | 1 +
> arch/x86/kvm/vmx/tdx.c | 28 ++++++++++++++++++++++++++++
> 2 files changed, 29 insertions(+)
>
> diff --git a/arch/x86/include/uapi/asm/kvm.h b/arch/x86/include/uapi/asm/kvm.h
> index 789d1d821b4f..0b4827e39458 100644
> --- a/arch/x86/include/uapi/asm/kvm.h
> +++ b/arch/x86/include/uapi/asm/kvm.h
> @@ -932,6 +932,7 @@ enum kvm_tdx_cmd_id {
> KVM_TDX_INIT_VM,
> KVM_TDX_INIT_VCPU,
> KVM_TDX_INIT_MEM_REGION,
> + KVM_TDX_FINALIZE_VM,
> KVM_TDX_GET_CPUID,
>
> KVM_TDX_CMD_NR_MAX,
> diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
> index 796d1a495a66..3083a66bb895 100644
> --- a/arch/x86/kvm/vmx/tdx.c
> +++ b/arch/x86/kvm/vmx/tdx.c
> @@ -1257,6 +1257,31 @@ void tdx_flush_tlb_current(struct kvm_vcpu *vcpu)
> ept_sync_global();
> }
>
> +static int tdx_td_finalizemr(struct kvm *kvm, struct kvm_tdx_cmd *cmd)
> +{
> + struct kvm_tdx *kvm_tdx = to_kvm_tdx(kvm);
> +
> + if (!is_hkid_assigned(kvm_tdx) || is_td_finalized(kvm_tdx))
> + return -EINVAL;
> + /*
> + * Pages are pending for KVM_TDX_INIT_MEM_REGION to issue
> + * TDH.MEM.PAGE.ADD().
> + */
> + if (atomic64_read(&kvm_tdx->nr_premapped))
> + return -EINVAL;
> +
> + cmd->hw_error = tdh_mr_finalize(kvm_tdx);
> + if ((cmd->hw_error & TDX_SEAMCALL_STATUS_MASK) == TDX_OPERAND_BUSY)
> + return -EAGAIN;
> + if (KVM_BUG_ON(cmd->hw_error, kvm)) {
> + pr_tdx_error(TDH_MR_FINALIZE, cmd->hw_error);
> + return -EIO;
> + }
> +
> + kvm_tdx->finalized = true;
> + return 0;
> +}
Isaku was going to lock the mmu. Seems like the change got lost.
To protect against racing with KVM_PRE_FAULT_MEMORY,
KVM_TDX_INIT_MEM_REGION, tdx_sept_set_private_spte() etc
e.g. Rename tdx_td_finalizemr to __tdx_td_finalizemr and add:
static int tdx_td_finalizemr(struct kvm *kvm, struct kvm_tdx_cmd *cmd)
{
int ret;
write_lock(&kvm->mmu_lock);
ret = __tdx_td_finalizemr(kvm, cmd);
write_unlock(&kvm->mmu_lock);
return ret;
}
> +
> int tdx_vm_ioctl(struct kvm *kvm, void __user *argp)
> {
> struct kvm_tdx_cmd tdx_cmd;
> @@ -1281,6 +1306,9 @@ int tdx_vm_ioctl(struct kvm *kvm, void __user *argp)
> case KVM_TDX_INIT_VM:
> r = tdx_td_init(kvm, &tdx_cmd);
> break;
> + case KVM_TDX_FINALIZE_VM:
> + r = tdx_td_finalizemr(kvm, &tdx_cmd);
> + break;
> default:
> r = -EINVAL;
> goto out;
