From: Brijesh Singh <brijesh.singh@amd.com>
To: <x86@kernel.org>, <linux-kernel@vger.kernel.org>,
<kvm@vger.kernel.org>, <linux-efi@vger.kernel.org>,
<platform-driver-x86@vger.kernel.org>,
<linux-coco@lists.linux.dev>, <linux-mm@kvack.org>
Cc: Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>, Joerg Roedel <jroedel@suse.de>,
Tom Lendacky <thomas.lendacky@amd.com>,
"H. Peter Anvin" <hpa@zytor.com>,
Ard Biesheuvel <ardb@kernel.org>,
Paolo Bonzini <pbonzini@redhat.com>,
Sean Christopherson <seanjc@google.com>,
"Vitaly Kuznetsov" <vkuznets@redhat.com>,
Jim Mattson <jmattson@google.com>,
"Andy Lutomirski" <luto@kernel.org>,
Dave Hansen <dave.hansen@linux.intel.com>,
Sergio Lopez <slp@redhat.com>, Peter Gonda <pgonda@google.com>,
"Peter Zijlstra" <peterz@infradead.org>,
Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>,
David Rientjes <rientjes@google.com>,
Dov Murik <dovmurik@linux.ibm.com>,
Tobin Feldman-Fitzthum <tobin@ibm.com>,
Borislav Petkov <bp@alien8.de>,
Michael Roth <michael.roth@amd.com>,
Vlastimil Babka <vbabka@suse.cz>,
"Kirill A . Shutemov" <kirill.shutemov@linux.intel.com>,
Andi Kleen <ak@linux.intel.com>,
"Dr . David Alan Gilbert" <dgilbert@redhat.com>,
<brijesh.ksingh@gmail.com>, <tony.luck@intel.com>,
<marcorr@google.com>,
<sathyanarayanan.kuppuswamy@linux.intel.com>,
Brijesh Singh <brijesh.singh@amd.com>
Subject: [PATCH v11 41/45] x86/sev: Register SEV-SNP guest request platform device
Date: Thu, 24 Feb 2022 10:56:21 -0600 [thread overview]
Message-ID: <20220224165625.2175020-42-brijesh.singh@amd.com> (raw)
In-Reply-To: <20220224165625.2175020-1-brijesh.singh@amd.com>
Version 2 of the GHCB specification providesa Non Automatic Exit (NAE)
event type that can be used by the SEV-SNP guest to communicate with the
PSP without risk from a malicious hypervisor who wishes to read, alter,
drop or replay the messages sent.
SNP_LAUNCH_UPDATE can insert two special pages into the guest’s memory:
the secrets page and the CPUID page. The PSP firmware populates the
contents of the secrets page. The secrets page contains encryption keys
used by the guest to interact with the firmware. Because the secrets
page is encrypted with the guest’s memory encryption key, the hypervisor
cannot read the keys. See SEV-SNP firmware spec for further details on
the secrets page format.
Create a platform device that the SEV-SNP guest driver can bind to get
the platform resources such as encryption key and message id to use to
communicate with the PSP. The SEV-SNP guest driver provides a userspace
interface to get the attestation report, key derivation, extended
attestation report etc.
Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
---
arch/x86/include/asm/sev.h | 4 +++
arch/x86/kernel/sev.c | 56 ++++++++++++++++++++++++++++++++++++++
2 files changed, 60 insertions(+)
diff --git a/arch/x86/include/asm/sev.h b/arch/x86/include/asm/sev.h
index 9830ee1d6ef0..ca977493eb72 100644
--- a/arch/x86/include/asm/sev.h
+++ b/arch/x86/include/asm/sev.h
@@ -95,6 +95,10 @@ struct snp_req_data {
unsigned int data_npages;
};
+struct snp_guest_platform_data {
+ u64 secrets_gpa;
+};
+
#ifdef CONFIG_AMD_MEM_ENCRYPT
extern struct static_key_false sev_es_enable_key;
extern void __sev_es_ist_enter(struct pt_regs *regs);
diff --git a/arch/x86/kernel/sev.c b/arch/x86/kernel/sev.c
index cafced2237f3..7784067df7fa 100644
--- a/arch/x86/kernel/sev.c
+++ b/arch/x86/kernel/sev.c
@@ -19,6 +19,9 @@
#include <linux/kernel.h>
#include <linux/mm.h>
#include <linux/cpumask.h>
+#include <linux/efi.h>
+#include <linux/platform_device.h>
+#include <linux/io.h>
#include <asm/cpu_entry_area.h>
#include <asm/stacktrace.h>
@@ -2148,3 +2151,56 @@ int snp_issue_guest_request(u64 exit_code, struct snp_req_data *input, unsigned
return ret;
}
EXPORT_SYMBOL_GPL(snp_issue_guest_request);
+
+static struct platform_device guest_req_device = {
+ .name = "snp-guest",
+ .id = -1,
+};
+
+static u64 get_secrets_page(void)
+{
+ u64 pa_data = boot_params.cc_blob_address;
+ struct cc_blob_sev_info info;
+ void *map;
+
+ /*
+ * The CC blob contains the address of the secrets page, check if the
+ * blob is present.
+ */
+ if (!pa_data)
+ return 0;
+
+ map = early_memremap(pa_data, sizeof(info));
+ memcpy(&info, map, sizeof(info));
+ early_memunmap(map, sizeof(info));
+
+ /* smoke-test the secrets page passed */
+ if (!info.secrets_phys || info.secrets_len != PAGE_SIZE)
+ return 0;
+
+ return info.secrets_phys;
+}
+
+static int __init snp_init_platform_device(void)
+{
+ struct snp_guest_platform_data data;
+ u64 gpa;
+
+ if (!cc_platform_has(CC_ATTR_GUEST_SEV_SNP))
+ return -ENODEV;
+
+ gpa = get_secrets_page();
+ if (!gpa)
+ return -ENODEV;
+
+ data.secrets_gpa = gpa;
+ if (platform_device_add_data(&guest_req_device, &data, sizeof(data)))
+ return -ENODEV;
+
+ if (platform_device_register(&guest_req_device))
+ return -ENODEV;
+
+ pr_info("SNP guest platform device initialized.\n");
+ return 0;
+}
+device_initcall(snp_init_platform_device);
--
2.25.1
next prev parent reply other threads:[~2022-02-24 16:59 UTC|newest]
Thread overview: 73+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-02-24 16:55 [PATCH v11 00/45] Add AMD Secure Nested Paging (SEV-SNP) Guest Support Brijesh Singh
2022-02-24 16:55 ` [PATCH v11 01/45] KVM: SVM: Define sev_features and vmpl field in the VMSA Brijesh Singh
2022-02-24 16:55 ` [PATCH v11 02/45] KVM: SVM: Create a separate mapping for the SEV-ES save area Brijesh Singh
2022-02-24 16:55 ` [PATCH v11 03/45] KVM: SVM: Create a separate mapping for the GHCB " Brijesh Singh
2022-02-24 19:38 ` [PATCH v11 3.1/45] " Brijesh Singh
2022-02-24 16:55 ` [PATCH v11 04/45] KVM: SVM: Update the SEV-ES save area mapping Brijesh Singh
2022-02-24 16:55 ` [PATCH v11 05/45] x86/boot: Introduce helpers for MSR reads/writes Brijesh Singh
2022-02-24 16:55 ` [PATCH v11 06/45] x86/boot: Use MSR read/write helpers instead of inline assembly Brijesh Singh
2022-02-24 16:55 ` [PATCH v11 07/45] x86/compressed/64: Detect/setup SEV/SME features earlier in boot Brijesh Singh
2022-02-24 16:55 ` [PATCH v11 08/45] x86/sev: " Brijesh Singh
2022-02-24 16:55 ` [PATCH v11 09/45] x86/mm: Extend cc_attr to include AMD SEV-SNP Brijesh Singh
2022-02-24 16:55 ` [PATCH v11 10/45] x86/sev: Define the Linux specific guest termination reasons Brijesh Singh
2022-02-24 16:55 ` [PATCH v11 11/45] x86/sev: Save the negotiated GHCB version Brijesh Singh
2022-02-24 16:55 ` [PATCH v11 12/45] x86/sev: Check SEV-SNP features support Brijesh Singh
2022-02-24 16:55 ` [PATCH v11 13/45] x86/sev: Add a helper for the PVALIDATE instruction Brijesh Singh
2022-02-24 16:55 ` [PATCH v11 14/45] x86/sev: Check the vmpl level Brijesh Singh
2022-02-24 16:55 ` [PATCH v11 15/45] x86/compressed: Add helper for validating pages in the decompression stage Brijesh Singh
2022-02-24 16:55 ` [PATCH v11 16/45] x86/compressed: Register GHCB memory when SEV-SNP is active Brijesh Singh
2022-02-24 16:55 ` [PATCH v11 17/45] x86/sev: " Brijesh Singh
2022-02-24 16:55 ` [PATCH v11 18/45] x86/sev: Add helper for validating pages in early enc attribute changes Brijesh Singh
2022-02-24 16:55 ` [PATCH v11 19/45] x86/kernel: Make the .bss..decrypted section shared in RMP table Brijesh Singh
2022-02-24 16:56 ` [PATCH v11 20/45] x86/kernel: Validate ROM memory before accessing when SEV-SNP is active Brijesh Singh
2022-02-24 16:56 ` [PATCH v11 21/45] x86/mm: Validate memory when changing the C-bit Brijesh Singh
2022-02-24 16:56 ` [PATCH v11 22/45] x86/sev: Use SEV-SNP AP creation to start secondary CPUs Brijesh Singh
2022-03-03 17:09 ` Dave Hansen
2022-03-03 18:01 ` Brijesh Singh
2022-02-24 16:56 ` [PATCH v11 23/45] x86/head/64: Re-enable stack protection Brijesh Singh
2022-02-24 16:56 ` [PATCH v11 24/45] x86/compressed/acpi: Move EFI detection to helper Brijesh Singh
2022-02-24 16:56 ` [PATCH v11 25/45] x86/compressed/acpi: Move EFI system table lookup " Brijesh Singh
2022-02-24 16:56 ` [PATCH v11 26/45] x86/compressed/acpi: Move EFI config " Brijesh Singh
2022-02-24 16:56 ` [PATCH v11 27/45] x86/compressed/acpi: Move EFI vendor " Brijesh Singh
2022-02-24 16:56 ` [PATCH v11 28/45] x86/compressed/acpi: Move EFI kexec handling into common code Brijesh Singh
2022-02-24 16:56 ` [PATCH v11 29/45] x86/boot: Add Confidential Computing type to setup_data Brijesh Singh
2022-03-01 9:48 ` Borislav Petkov
2022-03-02 14:25 ` Brijesh Singh
2022-03-02 15:13 ` Borislav Petkov
2022-03-03 9:21 ` Ard Biesheuvel
2022-02-24 16:56 ` [PATCH v11 30/45] KVM: x86: Move lookup of indexed CPUID leafs to helper Brijesh Singh
2022-02-24 16:56 ` [PATCH v11 31/45] x86/sev: Move MSR-based VMGEXITs for CPUID " Brijesh Singh
2022-02-24 16:56 ` [PATCH v11 32/45] x86/compressed/64: Add support for SEV-SNP CPUID table in #VC handlers Brijesh Singh
2022-02-24 16:56 ` [PATCH v11 33/45] x86/boot: Add a pointer to Confidential Computing blob in bootparams Brijesh Singh
2022-02-24 16:56 ` [PATCH v11 34/45] x86/compressed: Add SEV-SNP feature detection/setup Brijesh Singh
2022-02-24 16:56 ` [PATCH v11 35/45] x86/compressed: Use firmware-validated CPUID leaves for SEV-SNP guests Brijesh Singh
2022-02-24 16:56 ` [PATCH v11 36/45] x86/compressed: Export and rename add_identity_map() Brijesh Singh
2022-02-24 16:56 ` [PATCH v11 37/45] x86/compressed/64: Add identity mapping for Confidential Computing blob Brijesh Singh
2022-02-24 16:56 ` [PATCH v11 38/45] x86/sev: Add SEV-SNP feature detection/setup Brijesh Singh
2022-02-24 16:56 ` [PATCH v11 39/45] x86/sev: Use firmware-validated CPUID for SEV-SNP guests Brijesh Singh
2022-03-03 11:51 ` Borislav Petkov
2022-03-04 0:31 ` Michael Roth
2022-03-04 7:43 ` Borislav Petkov
2022-02-24 16:56 ` [PATCH v11 40/45] x86/sev: Provide support for SNP guest request NAEs Brijesh Singh
2022-02-24 16:56 ` Brijesh Singh [this message]
2022-02-24 16:56 ` [PATCH v11 42/45] virt: Add SEV-SNP guest driver Brijesh Singh
2022-03-02 10:03 ` Dov Murik
2022-03-02 14:33 ` Brijesh Singh
2022-03-03 17:33 ` Dave Hansen
2022-03-04 13:17 ` Brijesh Singh
2022-03-04 15:23 ` Dave Hansen
2022-03-04 15:43 ` Brijesh Singh
2022-02-24 16:56 ` [PATCH v11 43/45] virt: sevguest: Add support to derive key Brijesh Singh
2022-02-24 16:56 ` [PATCH v11 44/45] virt: sevguest: Add support to get extended report Brijesh Singh
2022-03-03 15:28 ` Borislav Petkov
2022-03-03 16:47 ` Brijesh Singh
2022-03-04 14:06 ` Borislav Petkov
2022-03-04 15:39 ` Brijesh Singh
2022-03-04 15:53 ` Borislav Petkov
2022-03-04 16:03 ` Brijesh Singh
2022-03-04 16:14 ` Borislav Petkov
2022-02-24 16:56 ` [PATCH v11 45/45] virt: sevguest: Add documentation for SEV-SNP CPUID Enforcement Brijesh Singh
2022-03-02 14:22 ` [PATCH v11 00/45] Add AMD Secure Nested Paging (SEV-SNP) Guest Support Borislav Petkov
2022-03-02 16:09 ` Paolo Bonzini
2022-03-02 16:14 ` Borislav Petkov
2022-04-03 22:36 ` Borislav Petkov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220224165625.2175020-42-brijesh.singh@amd.com \
--to=brijesh.singh@amd.com \
--cc=ak@linux.intel.com \
--cc=ardb@kernel.org \
--cc=bp@alien8.de \
--cc=brijesh.ksingh@gmail.com \
--cc=dave.hansen@linux.intel.com \
--cc=dgilbert@redhat.com \
--cc=dovmurik@linux.ibm.com \
--cc=hpa@zytor.com \
--cc=jmattson@google.com \
--cc=jroedel@suse.de \
--cc=kirill.shutemov@linux.intel.com \
--cc=kvm@vger.kernel.org \
--cc=linux-coco@lists.linux.dev \
--cc=linux-efi@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=luto@kernel.org \
--cc=marcorr@google.com \
--cc=michael.roth@amd.com \
--cc=mingo@redhat.com \
--cc=pbonzini@redhat.com \
--cc=peterz@infradead.org \
--cc=pgonda@google.com \
--cc=platform-driver-x86@vger.kernel.org \
--cc=rientjes@google.com \
--cc=sathyanarayanan.kuppuswamy@linux.intel.com \
--cc=seanjc@google.com \
--cc=slp@redhat.com \
--cc=srinivas.pandruvada@linux.intel.com \
--cc=tglx@linutronix.de \
--cc=thomas.lendacky@amd.com \
--cc=tobin@ibm.com \
--cc=tony.luck@intel.com \
--cc=vbabka@suse.cz \
--cc=vkuznets@redhat.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).