From: Dan Williams <dan.j.williams@intel.com>
To: Steven Price <steven.price@arm.com>, <kvm@vger.kernel.org>,
<kvmarm@lists.linux.dev>
Cc: Sami Mujawar <sami.mujawar@arm.com>,
Catalin Marinas <catalin.marinas@arm.com>,
Marc Zyngier <maz@kernel.org>, Will Deacon <will@kernel.org>,
James Morse <james.morse@arm.com>,
Oliver Upton <oliver.upton@linux.dev>,
Suzuki K Poulose <suzuki.poulose@arm.com>,
"Zenghui Yu" <yuzenghui@huawei.com>,
<linux-arm-kernel@lists.infradead.org>,
<linux-kernel@vger.kernel.org>, Joey Gouly <joey.gouly@arm.com>,
"Alexandru Elisei" <alexandru.elisei@arm.com>,
Christoffer Dall <christoffer.dall@arm.com>,
Fuad Tabba <tabba@google.com>, <linux-coco@lists.linux.dev>,
Ganapatrao Kulkarni <gankulkarni@os.amperecomputing.com>,
Gavin Shan <gshan@redhat.com>,
"Shanker Donthineni" <sdonthineni@nvidia.com>,
Alper Gun <alpergun@google.com>,
"Dan Williams" <dan.j.williams@intel.com>,
"Aneesh Kumar K . V" <aneesh.kumar@kernel.org>,
Steven Price <steven.price@arm.com>
Subject: Re: [PATCH v7 10/11] virt: arm-cca-guest: TSM_REPORT support for realms
Date: Wed, 4 Dec 2024 13:16:05 -0800 [thread overview]
Message-ID: <6750c695194cd_2508129427@dwillia2-xfh.jf.intel.com.notmuch> (raw)
In-Reply-To: <20241017131434.40935-11-steven.price@arm.com>
Steven Price wrote:
> From: Sami Mujawar <sami.mujawar@arm.com>
>
> Introduce an arm-cca-guest driver that registers with
> the configfs-tsm module to provide user interfaces for
> retrieving an attestation token.
>
> When a new report is requested the arm-cca-guest driver
> invokes the appropriate RSI interfaces to query an
> attestation token.
>
> The steps to retrieve an attestation token are as follows:
> 1. Mount the configfs filesystem if not already mounted
> mount -t configfs none /sys/kernel/config
> 2. Generate an attestation token
> report=/sys/kernel/config/tsm/report/report0
> mkdir $report
> dd if=/dev/urandom bs=64 count=1 > $report/inblob
> hexdump -C $report/outblob
> rmdir $report
>
> Signed-off-by: Sami Mujawar <sami.mujawar@arm.com>
> Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
> Signed-off-by: Steven Price <steven.price@arm.com>
> ---
> Changes since v6:
> * Avoid get_cpu() and instead make the init attestation call using
> smp_call_function_single(). Improve comments to explain the logic.
> * Minor code reorgnisation and comment cleanup following Gavin's review
> (thanks!)
> ---
> drivers/virt/coco/Kconfig | 2 +
> drivers/virt/coco/Makefile | 1 +
> drivers/virt/coco/arm-cca-guest/Kconfig | 11 +
> drivers/virt/coco/arm-cca-guest/Makefile | 2 +
> .../virt/coco/arm-cca-guest/arm-cca-guest.c | 224 ++++++++++++++++++
> 5 files changed, 240 insertions(+)
> create mode 100644 drivers/virt/coco/arm-cca-guest/Kconfig
> create mode 100644 drivers/virt/coco/arm-cca-guest/Makefile
> create mode 100644 drivers/virt/coco/arm-cca-guest/arm-cca-guest.c
[..]
> diff --git a/drivers/virt/coco/arm-cca-guest/Kconfig b/drivers/virt/coco/arm-cca-guest/Kconfig
> new file mode 100644
> index 000000000000..9dd27c3ee215
> --- /dev/null
> +++ b/drivers/virt/coco/arm-cca-guest/Kconfig
> @@ -0,0 +1,11 @@
> +config ARM_CCA_GUEST
> + tristate "Arm CCA Guest driver"
> + depends on ARM64
> + default m
I am working on some updates to the TSM_REPORTS interface, rebased them
to test the changes with this driver, and discovered that this driver is
enabled by default.
Just a reminder to please do not mark new drivers as "default m" [1]. In
this case it is difficult to imagine that every arm64 kernel on the
planet needs this functionality enabled by default. In general, someone
should be able to run olddefconfig with a new kernel and not be exposed
to brand new drivers that they have not considered previously.
[1]: http://lore.kernel.org/CA+55aFzxL6-Xp=-mnBwMisZsuKhRZ6zRDJoAmH8W5LDHU2oJuw@mail.gmail.com/
next prev parent reply other threads:[~2024-12-04 21:17 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20241017131434.40935-1-steven.price@arm.com>
2024-10-23 10:02 ` [PATCH v7 00/11] arm64: Support for running as a guest in Arm CCA Catalin Marinas
[not found] ` <20241017131434.40935-11-steven.price@arm.com>
2024-12-04 21:16 ` Dan Williams [this message]
2024-12-05 11:51 ` [PATCH v7 10/11] virt: arm-cca-guest: TSM_REPORT support for realms Catalin Marinas
[not found] ` <20241017131434.40935-10-steven.price@arm.com>
2025-02-19 14:30 ` [PATCH v7 09/11] arm64: Enable memory encrypt for Realms Steven Price
2025-02-26 19:03 ` Catalin Marinas
2025-02-27 0:23 ` Will Deacon
2025-02-27 10:45 ` Steven Price
2025-02-27 10:55 ` Catalin Marinas
2025-02-27 17:22 ` Will Deacon
2025-02-27 21:21 ` Catalin Marinas
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6750c695194cd_2508129427@dwillia2-xfh.jf.intel.com.notmuch \
--to=dan.j.williams@intel.com \
--cc=alexandru.elisei@arm.com \
--cc=alpergun@google.com \
--cc=aneesh.kumar@kernel.org \
--cc=catalin.marinas@arm.com \
--cc=christoffer.dall@arm.com \
--cc=gankulkarni@os.amperecomputing.com \
--cc=gshan@redhat.com \
--cc=james.morse@arm.com \
--cc=joey.gouly@arm.com \
--cc=kvm@vger.kernel.org \
--cc=kvmarm@lists.linux.dev \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-coco@lists.linux.dev \
--cc=linux-kernel@vger.kernel.org \
--cc=maz@kernel.org \
--cc=oliver.upton@linux.dev \
--cc=sami.mujawar@arm.com \
--cc=sdonthineni@nvidia.com \
--cc=steven.price@arm.com \
--cc=suzuki.poulose@arm.com \
--cc=tabba@google.com \
--cc=will@kernel.org \
--cc=yuzenghui@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox