[RFC PATCH v1 02/11] attestation: Filter evidence objects per instance

["Aneesh Kumar K.V (Arm)" <aneesh.kumar@kernel.org>]

Allow an attestation instance to expose only the evidence objects its
device supports. Add an optional evidence_object_supported() callback
and use it both when building DEVICE_GET capabilities and when checking
EVIDENCE_GET requests.

The following PCI/TSM patch uses one attestation implementation for
devices that support different evidence objects. Its list includes
certificate slots 0-7, SPDM VCA, measurements, and a TDISP interface
report. Each device must expose only the objects it supports, for
example:

  Instance                  Supported evidence objects
  ------------------------  ------------------------------------------
  Host link using slot zero Certificate slot 0
  CCA guest device          Certificate slot 0, VCA, measurements,
                            TDISP interface report
  Host PF0 after discovery  Certificate slots reported populated by SPDM

PCI/TSM checks the TSM driver's evidence_types bitmap or, after SPDM
discovery on a host PF0, the populated-slot bitmap. The preceding patch
controls whether EVIDENCE_GET is enabled; this patch controls which
objects that operation can retrieve.

Cc: Jiri Pirko <jiri@resnulli.us>
Cc: Jonathan Cameron <jic23@kernel.org>
Cc: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Aneesh Kumar K.V (Arm) <aneesh.kumar@kernel.org>
---
 drivers/attestation/core/core.c |  8 ++++++--
 drivers/attestation/core/ctlv.c | 13 +++++++++++--
 include/linux/attestation.h     |  4 ++++
 3 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/drivers/attestation/core/core.c b/drivers/attestation/core/core.c
index 41fe1084c989..37d5d3233cf0 100644
--- a/drivers/attestation/core/core.c
+++ b/drivers/attestation/core/core.c
@@ -54,8 +54,12 @@ static int attestation_evidence_caps_validate(const struct attestation_provider
 	const struct attestation_evidence_caps *caps = provider->evidence_caps;
 	size_t object_index;
 
-	if (!caps)
-		return provider->evidence_get ? -EINVAL : 0;
+	if (!caps) {
+		if (provider->evidence_get || provider->evidence_object_supported)
+			return -EINVAL;
+		return 0;
+	}
+
 	if (!provider->evidence_get || !caps->objects || !caps->objects_count ||
 	    caps->objects_count > 16 || caps->min_challenge_length > caps->max_challenge_length ||
 	    caps->max_challenge_length > 4096 || !caps->max_total_output_length)
diff --git a/drivers/attestation/core/ctlv.c b/drivers/attestation/core/ctlv.c
index 8f4fa48ffdc5..baf9c39f2658 100644
--- a/drivers/attestation/core/ctlv.c
+++ b/drivers/attestation/core/ctlv.c
@@ -33,15 +33,20 @@ attestation_representation_in(const struct attestation_evidence_supported_object
 }
 
 static const struct attestation_evidence_supported_object *
-attestation_evidence_object_find(const struct attestation_evidence_caps *caps,
+attestation_evidence_object_find(struct attestation *att,
 				 enum attestation_evidence_blob_class blob_class, bool has_instance,
 				 unsigned int instance, const char *format)
 {
+	const struct attestation_evidence_caps *caps = att->provider->evidence_caps;
 	size_t index;
 
 	for (index = 0; index < caps->objects_count; index++) {
 		const struct attestation_evidence_supported_object *object = &caps->objects[index];
 
+		if (att->provider->evidence_object_supported &&
+		    !att->provider->evidence_object_supported(att, object))
+			continue;
+
 		if (object->blob_class == blob_class && object->has_blob_instance == has_instance &&
 		    (!has_instance || object->blob_instance == instance) &&
 		    !strcmp(object->format, format))
@@ -85,6 +90,10 @@ static int attestation_device_caps_put(struct attestation *att, struct ctlv_curs
 			const struct attestation_evidence_supported_object *cap =
 				&caps->objects[index];
 
+			if (provider->evidence_object_supported &&
+			    !provider->evidence_object_supported(att, cap))
+				continue;
+
 			if (!ctlv_attestation_cap_object_start(&group, &object)) {
 				ok = false;
 				break;
@@ -184,7 +193,7 @@ attestation_evidence_decode_objects(struct attestation *att, struct ctlv_op_ctx
 		if (has_instance)
 			instance = ctlv_attestation_evidence_get_object_evidence_blob_instance_get(
 				&object);
-		supported = attestation_evidence_object_find(caps, blob_class, has_instance,
+		supported = attestation_evidence_object_find(att, blob_class, has_instance,
 							     instance, format);
 		if (!supported || !attestation_representation_in(supported, representation)) {
 			kfree(objects);
diff --git a/include/linux/attestation.h b/include/linux/attestation.h
index dede1b53f67a..364ab5029277 100644
--- a/include/linux/attestation.h
+++ b/include/linux/attestation.h
@@ -233,6 +233,8 @@ struct attestation_evidence_result {
 
 /**
  * struct attestation_provider - Immutable provider operations and properties.
+ * @evidence_object_supported: optionally restrict advertised and requested
+ *	evidence objects per instance; called under the instance lock
  * @evidence_get: produce requested evidence
  * @evidence_accept: record acceptance of the current evidence
  * @evidence_accept_clear: clear a recorded acceptance
@@ -247,6 +249,8 @@ struct attestation_evidence_result {
  * @mrs_count: number of fixed MRs
  */
 struct attestation_provider {
+	bool (*evidence_object_supported)(struct attestation *att,
+		const struct attestation_evidence_supported_object *object);
 	int (*evidence_get)(struct attestation *att,
 			    const struct attestation_evidence_request *request,
 			    struct attestation_evidence_result *result);
-- 
2.43.0