Re: [PATCH v5 0/7] configfs-tsm: Attestation Report ABI

[Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>]

On 10/10/2023 10:27 PM, Dan Williams wrote:
> Changes since v4 [1]:
> - Fix a stack buffer vs scatterlist bug in sev-guest (Peter)
> - Test on AMD hardware, thanks Peter for the help!
> - Fix size of @len in __read_report() (Sathya)
> - Clarify the NULL @buf case in __read_report() (Sathya)
> - Fix kdoc for 'struct tsm_report' (Sathya)
> - Add kdoc for 'struct tsm_ops' (Sathya)
> - Initialize @certs_size to zero in sev_report_new() (Dan, smatch)
> - Add links to documentation for the attestation report formats
> - Drop conversion of sev-guest get_report(), just use get_ext_report()
>   exclusively
> - Add is_vmpck_empty() and exitinfo2 init in set_report_new() similar to
>   the ioctl() path
> 
> [1]: http://lore.kernel.org/r/169570181657.596431.6178773442587231200.stgit@dwillia2-xfh.jf.intel.com
> 
> ---
> 
> Merge notes: I am looking for Dave or Boris to pick this up, I believe
> all outstanding comments have been resolved and this has now been
> smoke-tested on AMD and Intel platforms.
> 
> ---
> 
> An attestation report is signed evidence of how a Trusted Virtual
> Machine (TVM) was launched and its current state. A verifying party uses
> the report to make judgements of the confidentiality and integrity of
> that execution environment. Upon successful attestation the verifying
> party may, for example, proceed to deploy secrets to the TVM to carry
> out a workload. Multiple confidential computing platforms share this
> similar flow.
>  
> The approach of adding adding new char devs and new ioctls, for what
> amounts to the same logical functionality with minor formatting
> differences across vendors [2], is untenable. Common concepts and the
> community benefit from common infrastructure. 
>  
> Use configfs for this facility for maintainability compared to ioctl(),
> and for its scalability compared to sysfs. Atomicity can be enforced at
> item creation time, and a conflict detection mechanism is included for
> scenarios where multiple threads may share a single configuration
> instance.
>  
> [2]: http://lore.kernel.org/r/cover.1684048511.git.sathyanarayanan.kuppuswamy@linux.intel.com
> 
> ---

Works fine in TDX environment.

Tested-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>


> 
> Dan Williams (6):
>       virt: sevguest: Fix passing a stack buffer as a scatterlist target
>       virt: coco: Add a coco/Makefile and coco/Kconfig
>       configfs-tsm: Introduce a shared ABI for attestation reports
>       virt: sevguest: Prep for kernel internal get_ext_report()
>       mm/slab: Add __free() support for kvfree
>       virt: sevguest: Add TSM_REPORTS support for SNP_GET_EXT_REPORT
> 
> Kuppuswamy Sathyanarayanan (1):
>       virt: tdx-guest: Add Quote generation support using TSM_REPORTS
> 
> 
>  Documentation/ABI/testing/configfs-tsm  |   76 ++++++
>  MAINTAINERS                             |    8 +
>  arch/x86/coco/tdx/tdx.c                 |   21 ++
>  arch/x86/include/asm/shared/tdx.h       |    1 
>  arch/x86/include/asm/tdx.h              |    2 
>  drivers/virt/Kconfig                    |    6 
>  drivers/virt/Makefile                   |    4 
>  drivers/virt/coco/Kconfig               |   14 +
>  drivers/virt/coco/Makefile              |    8 +
>  drivers/virt/coco/sev-guest/Kconfig     |    1 
>  drivers/virt/coco/sev-guest/sev-guest.c |  218 ++++++++++++++--
>  drivers/virt/coco/tdx-guest/Kconfig     |    1 
>  drivers/virt/coco/tdx-guest/tdx-guest.c |  229 +++++++++++++++++
>  drivers/virt/coco/tsm.c                 |  416 +++++++++++++++++++++++++++++++
>  include/linux/slab.h                    |    2 
>  include/linux/tsm.h                     |   68 +++++
>  16 files changed, 1039 insertions(+), 36 deletions(-)
>  create mode 100644 Documentation/ABI/testing/configfs-tsm
>  create mode 100644 drivers/virt/coco/Kconfig
>  create mode 100644 drivers/virt/coco/Makefile
>  create mode 100644 drivers/virt/coco/tsm.c
>  create mode 100644 include/linux/tsm.h
> 
> base-commit: 6465e260f48790807eef06b583b38ca9789b6072

-- 
Sathyanarayanan Kuppuswamy
Linux Kernel Developer