diff mbox series

[v6,16/21] x86/virt/tdx: Reserve TDX module global KeyID

Message ID 7558961d3dff6311c7872f57ac5bd6727f21e140.1666824663.git.kai.huang@intel.com
State New
Headers
Series TDX host kernel support |

Commit Message

Kai Huang Oct. 26, 2022, 11:16 p.m. UTC 
  TDX module initialization requires to use one TDX private KeyID as the
global KeyID to protect the TDX module metadata.  The global KeyID is
configured to the TDX module along with TDMRs.

Just reserve the first TDX private KeyID as the global KeyID.  Keep the
global KeyID as a static variable as KVM will need to use it too.

Reviewed-by: Isaku Yamahata <isaku.yamahata@intel.com>
Signed-off-by: Kai Huang <kai.huang@intel.com>
---
 arch/x86/virt/vmx/tdx/tdx.c | 9 +++++++++
 1 file changed, 9 insertions(+)

Comments

Andi Kleen Oct. 27, 2022, 12:40 p.m. UTC | #1 
On 10/26/2022 4:16 PM, Kai Huang wrote:
> TDX module initialization requires to use one TDX private KeyID as the
> global KeyID to protect the TDX module metadata.  The global KeyID is
> configured to the TDX module along with TDMRs.
>
> Just reserve the first TDX private KeyID as the global KeyID.  Keep the
> global KeyID as a static variable as KVM will need to use it too.
>
> Reviewed-by: Isaku Yamahata <isaku.yamahata@intel.com>
> Signed-off-by: Kai Huang <kai.huang@intel.com>
> ---
>   arch/x86/virt/vmx/tdx/tdx.c | 9 +++++++++
>   1 file changed, 9 insertions(+)
>
> diff --git a/arch/x86/virt/vmx/tdx/tdx.c b/arch/x86/virt/vmx/tdx/tdx.c
> index 5d74ada072ca..0820ba781f97 100644
> --- a/arch/x86/virt/vmx/tdx/tdx.c
> +++ b/arch/x86/virt/vmx/tdx/tdx.c
> @@ -62,6 +62,9 @@ static struct tdsysinfo_struct tdx_sysinfo;
>   static struct cmr_info tdx_cmr_array[MAX_CMRS] __aligned(CMR_INFO_ARRAY_ALIGNMENT);
>   static int tdx_cmr_num;
>   
> +/* TDX module global KeyID.  Used in TDH.SYS.CONFIG ABI. */
> +static u32 tdx_global_keyid;


Comment how this is serialized (or doesn't need it)
Kai Huang Oct. 28, 2022, 1:24 a.m. UTC | #2 
On Thu, 2022-10-27 at 05:40 -0700, Andi Kleen wrote:
> On 10/26/2022 4:16 PM, Kai Huang wrote:
> > TDX module initialization requires to use one TDX private KeyID as the
> > global KeyID to protect the TDX module metadata.  The global KeyID is
> > configured to the TDX module along with TDMRs.
> > 
> > Just reserve the first TDX private KeyID as the global KeyID.  Keep the
> > global KeyID as a static variable as KVM will need to use it too.
> > 
> > Reviewed-by: Isaku Yamahata <isaku.yamahata@intel.com>
> > Signed-off-by: Kai Huang <kai.huang@intel.com>
> > ---
> >   arch/x86/virt/vmx/tdx/tdx.c | 9 +++++++++
> >   1 file changed, 9 insertions(+)
> > 
> > diff --git a/arch/x86/virt/vmx/tdx/tdx.c b/arch/x86/virt/vmx/tdx/tdx.c
> > index 5d74ada072ca..0820ba781f97 100644
> > --- a/arch/x86/virt/vmx/tdx/tdx.c
> > +++ b/arch/x86/virt/vmx/tdx/tdx.c
> > @@ -62,6 +62,9 @@ static struct tdsysinfo_struct tdx_sysinfo;
> >   static struct cmr_info tdx_cmr_array[MAX_CMRS] __aligned(CMR_INFO_ARRAY_ALIGNMENT);
> >   static int tdx_cmr_num;
> >   
> > +/* TDX module global KeyID.  Used in TDH.SYS.CONFIG ABI. */
> > +static u32 tdx_global_keyid;
> 
> 
> Comment how this is serialized (or doesn't need it)
> 
> 

TDH.SYS.CONFIG, which takes 'tdx_global_keyid' as input, only needs to be called
once on any cpu, so no serialization is needed.

TDH.SYS.KEY.CONFIG, which doesn't take 'tdx_global_keyid' as input but
internally programs it, does require some serialization as this SEAMCALL must be
called on one cpu for each package, and it cannot run concurrently on different
cpus.  How about adding the comment in the patch which does TDH.SYS.KEY.CONFIG?

How about below (taken from patch 18 "x86/virt/tdx: Configure global KeyID on
all packages", but added "in serialized way as it cannot run concurrently on
different cpus" at the end of the first sentence in the comment)?

static int config_global_keyid(void)
{
	struct seamcall_ctx sc = { .fn = TDH_SYS_KEY_CONFIG };

	/*
	 * Configure the key of the global KeyID on all packages by
	 * calling TDH.SYS.KEY.CONFIG on all packages in serialized
	 * way as it cannot run concurrently on different cpus.
	 *
	 * ......
	 */
	return seamcall_on_each_package_serialized(&sc);
}
diff mbox series

Patch

diff --git a/arch/x86/virt/vmx/tdx/tdx.c b/arch/x86/virt/vmx/tdx/tdx.c
index 5d74ada072ca..0820ba781f97 100644
--- a/arch/x86/virt/vmx/tdx/tdx.c
+++ b/arch/x86/virt/vmx/tdx/tdx.c
@@ -62,6 +62,9 @@  static struct tdsysinfo_struct tdx_sysinfo;
 static struct cmr_info tdx_cmr_array[MAX_CMRS] __aligned(CMR_INFO_ARRAY_ALIGNMENT);
 static int tdx_cmr_num;
 
+/* TDX module global KeyID.  Used in TDH.SYS.CONFIG ABI. */
+static u32 tdx_global_keyid;
+
 /*
  * Detect TDX private KeyIDs to see whether TDX has been enabled by the
  * BIOS.  Both initializing the TDX module and running TDX guest require
@@ -1113,6 +1116,12 @@  static int init_tdx_module(void)
 	if (ret)
 		goto out_free_tdmrs;
 
+	/*
+	 * Reserve the first TDX KeyID as global KeyID to protect
+	 * TDX module metadata.
+	 */
+	tdx_global_keyid = tdx_keyid_start;
+
 	/*
 	 * Return -EINVAL until all steps of TDX module initialization
 	 * process are done.