From: Kuppuswamy Sathyanarayanan Date: Fri, 16 Jan 2026 23:03:15 +0000 (-0800) Subject: virt: tdx-guest: Return error for GetQuote failures X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0f409eaea53e49932cf92a761de66345c9a4b4be;p=thirdparty%2Fkernel%2Flinux.git virt: tdx-guest: Return error for GetQuote failures Currently, the GetQuote request handler returns explicit errors for hypercall-level failures and timeouts, but it ignores some VMM failures (e.g., GET_QUOTE_SERVICE_UNAVAILABLE), for which it returns success with a zero-length Quote. This makes error handling in userspace more complex. The VMM reports failures via the status field in the shared GPA header, which is inaccessible to userspace because only the Quote payload is exposed to userspace. Parse the status field in the kernel and return an error for Quote failures. This preserves existing ABI behavior as userspace already treats a zero-length Quote as a failure. Refer to GHCI specification [1], section "TDG.VP.VMCALL ", Table 3-10 and Table 3-11 for details on the GPA header and GetQuote status codes. Closes: https://lore.kernel.org/linux-coco/6bdf569c-684a-4459-af7c-4430691804eb@linux.intel.com/T/#u Closes: https://github.com/confidential-containers/guest-components/issues/823 Fixes: f4738f56d1dc ("virt: tdx-guest: Add Quote generation support using TSM_REPORTS") Reported-by: Xiaoyao Li Signed-off-by: Kuppuswamy Sathyanarayanan Signed-off-by: Dave Hansen Reviewed-by: Kirill A. Shutemov Reviewed-by: Xiaoyao Li Reviewed-by: Dan Williams Acked-by: Kai Huang Tested-by: Mikko Ylinen Link: https://cdrdv2.intel.com/v1/dl/getContent/858626 # [1] Link: https://patch.msgid.link/20260116230315.4023504-1-sathyanarayanan.kuppuswamy@linux.intel.com --- diff --git a/drivers/virt/coco/tdx-guest/tdx-guest.c b/drivers/virt/coco/tdx-guest/tdx-guest.c index 4252b147593ad..23ef3991c4d5a 100644 --- a/drivers/virt/coco/tdx-guest/tdx-guest.c +++ b/drivers/virt/coco/tdx-guest/tdx-guest.c @@ -306,6 +306,11 @@ static int tdx_report_new_locked(struct tsm_report *report, void *data) return ret; } + if (quote_buf->status != GET_QUOTE_SUCCESS) { + pr_debug("GetQuote request failed, status:%llx\n", quote_buf->status); + return -EIO; + } + buf = kvmemdup(quote_buf->data, quote_buf->out_len, GFP_KERNEL); if (!buf) return -ENOMEM;