Re: [RFC v2-fix-v2 1/1] x86/tdx: Add __tdx_module_call() and __tdx_hypercall() helper functions

[Kuppuswamy, Sathyanarayanan]

On 5/27/21 8:25 AM, Luck, Tony wrote:
> > Guests communicate with VMMs with hypercalls. Historically, these
> > are implemented using instructions that are known to cause VMEXITs
> > like vmcall, vmlaunch, etc. However, with TDX, VMEXITs no longer
> > expose guest state to the host.  This prevents the old hypercall
> > mechanisms from working. So to communicate with VMM, TDX
> > specification defines a new instruction called "tdcall".
>
> You use all caps TDCALL everywhere else in this commit message.
> Looks odd to have quoted lower case here.

I will use TDCALL uniformly.

> > In a TDX based VM, since VMM is an untrusted entity, a intermediary
> > layer (TDX module) exists between host and guest to facilitate the
> > secure communication. TDX guests communicate with the TDX module and
> > with the VMM using a new instruction: TDCALL.
>
> Seems both repeat what was in the first paragraph, but also fail to
> explain how this TDCALL is different from that first TDCALL.

Both cases uses TDCALL instruction. Arguments we pass confirms the
type of TDCALL ( one used to communicate with TDX module vs one used
to communicate with VMM).

I can modify the description to convey the difference between both
cases.

> > Implement common helper functions to communicate with the TDX Module
> > and VMM (using TDCALL instruction).
> >     
> > __tdx_hypercall()    - request services from the VMM.
> > __tdx_module_call()  - communicate with the TDX Module.
>
> Looking at the code, the hypercall can return an error if TDCALL fails,
> but module_call forces a panic with UD2 on error. This difference isn't
> explained anywhere.

I think you meant hypercall will panic vs module call will not.

In hypercall case, since we use same TDCALL instruction, we will have two
return values. One is for TDCALL failure (at the TDX module level) and
other is return value from VMM. So in hypercall case, we return VMM value
to the user but panic for TDCALL failures. As per TDX spec, for hypercall
use case, if everything is in order, TDCALL will never fail. If we notice
TDCALL failure error then it means, we are working with the broken TDX module.
So we panic.

> -Tony

--
Sathyanarayanan Kuppuswamy
Linux Kernel Developer