Re: [PATCH v2 0/3] TDX attestation support and GHCI fixup

[Binbin Wu]

On 6/20/2025 9:30 AM, Xiaoyao Li wrote:
> On 6/20/2025 2:01 AM, Paolo Bonzini wrote:
> > This is a refresh of Binbin's patches with a change to the userspace
> > API.  I am consolidating everything into a single KVM_EXIT_TDX and
> > adding to the contract that userspace is free to ignore it *except*
> > for having to reenter the guest with KVM_RUN.
> >
> > If in the future this does not work, it should be possible to introduce
> > an opt-in interface.  Hopefully that will not be necessary.
>
> For <GetTdVmCallInfo> exit, I think KVM still needs to report which TDVMCALL leaf will exit to userspace, to differentiate between different KVMs.

Yes, I planned a v2 to expose the bitmap of TDVMCALLs that KVM will exit to
userspace VMM for handling via KVM_TDX_CAPABILITIES.

> But it's not a must for current <GetQuote> since it exits to userspace from day 0. So that we can leave the report interface until KVM needs to support user exit of another TDVMCALL leaf.

Agree. This report interface can be added later when needed.

About the compatibility:
Since <GetQuote> is the only optional TDVMCALL for now and KVM always exit to
userspace for <GetQuote>, a userspace VMM can always set the bit for <GetQuote>
if it's supported in userspace.
Then
- First KVM release + new userspace VMM release with report interface.
  Userspace will see nothing reported by the interface, and it always sets
  <GetQuote> , which is expected.
- New KVM release with report interface + first userspace VMM release
  Userspace doesn't know the report interface and it only sets <GetQuote>, which
  is expected.

> > Paolo
> >
> > Binbin Wu (3):
> >    KVM: TDX: Add new TDVMCALL status code for unsupported subfuncs
> >    KVM: TDX: Handle TDG.VP.VMCALL<GetQuote>
> >    KVM: TDX: Exit to userspace for GetTdVmCallInfo
> >
> >   Documentation/virt/kvm/api.rst    | 62 ++++++++++++++++++++++++-
> >   arch/x86/include/asm/shared/tdx.h |  1 +
> >   arch/x86/kvm/vmx/tdx.c            | 77 ++++++++++++++++++++++++++++---
> >   include/uapi/linux/kvm.h          | 22 +++++++++
> >   4 files changed, 154 insertions(+), 8 deletions(-)