Re: [PATCH v7 05/10] x86/tdx: Handle port I/O

From: Sean Christopherson <seanjc@google.com>
To: Kuppuswamy Sathyanarayanan  <sathyanarayanan.kuppuswamy@linux.intel.com>
Cc: Thomas Gleixner <tglx@linutronix.de>,
	Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
	x86@kernel.org, Paolo Bonzini <pbonzini@redhat.com>,
	David Hildenbrand <david@redhat.com>,
	Andrea Arcangeli <aarcange@redhat.com>,
	Josh Poimboeuf <jpoimboe@redhat.com>,
	"H . Peter Anvin" <hpa@zytor.com>,
	Dave Hansen <dave.hansen@intel.com>,
	Tony Luck <tony.luck@intel.com>,
	Dan Williams <dan.j.williams@intel.com>,
	Andi Kleen <ak@linux.intel.com>,
	Kirill Shutemov <kirill.shutemov@linux.intel.com>,
	Kuppuswamy Sathyanarayanan <knsathya@kernel.org>,
	linux-kernel@vger.kernel.org
Subject: Re: [PATCH v7 05/10] x86/tdx: Handle port I/O
Date: Fri, 5 Nov 2021 21:23:55 +0000	[thread overview]
Message-ID: <YYWg6wa398Vw6FJu@google.com> (raw)
In-Reply-To: <20211005204136.1812078-6-sathyanarayanan.kuppuswamy@linux.intel.com>

On Tue, Oct 05, 2021, Kuppuswamy Sathyanarayanan wrote:
> diff --git a/arch/x86/kernel/tdx.c b/arch/x86/kernel/tdx.c
> index 4cbffcb737d9..cd0fb5d14ad7 100644
> --- a/arch/x86/kernel/tdx.c
> +++ b/arch/x86/kernel/tdx.c
> @@ -175,6 +175,38 @@ static u64 tdx_handle_cpuid(struct pt_regs *regs)
>  	return ret;
>  }
>  
> +/*
> + * tdx_handle_early_io() cannot be re-used in #VE handler for handling
> + * I/O because the way of handling string I/O is different between
> + * normal and early I/O case. Also, once trace support is enabled,
> + * tdx_handle_io() will be extended to use trace calls which is also
> + * not valid for early I/O cases.
> + */
> +static void tdx_handle_io(struct pt_regs *regs, u32 exit_qual)
> +{
> +	struct tdx_hypercall_output outh;

Same comments as patch 04.

> +	int out, size, port, ret;
> +	bool string;
> +	u64 mask;
> +
> +	string = VE_IS_IO_STRING(exit_qual);
> +
> +	/* I/O strings ops are unrolled at build time. */
> +	BUG_ON(string);

And here as well.

> +
> +	out = VE_IS_IO_OUT(exit_qual);
> +	size = VE_GET_IO_SIZE(exit_qual);
> +	port = VE_GET_PORT_NUM(exit_qual);
> +	mask = GENMASK(8 * size, 0);

And here.

> +
> +	ret = _tdx_hypercall(EXIT_REASON_IO_INSTRUCTION, size, out, port,
> +			     regs->ax, &outh);

This one too.

> +	if (!out) {

This needs to check "ret".  In general, why is this continuing on if I/O fails?
If I/O fails, the kernel done messed up and some downstream driver is going to
be real unhappy.  At a minimum, it should WARN.

On a related topic, the GHCB says:

	TDG.VP.VMCALL_INVALID_OPERAND 0x80000000 00000000 Invalid-IO-Port access

The "Invalid-IO-Port access" in particular is poorly worded as it implies the VMM
is allowed to deny access to ports, but AFAIK that's not the intention.  A better
phrasing would be something like "Reserved value in input GPR".

The GHCI should probably also state that bits 63:16 of R14 (port) are reserved.

> +		regs->ax &= ~mask;
> +		regs->ax |= (ret ? UINT_MAX : outh.r11) & mask;
> +	}
> +}