From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id AE8C4C433EF for ; Tue, 21 Jun 2022 22:30:45 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 0DDF08E005E; Tue, 21 Jun 2022 18:30:45 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 08E508E0059; Tue, 21 Jun 2022 18:30:45 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id EA0F18E005E; Tue, 21 Jun 2022 18:30:44 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id DA0598E0059 for ; Tue, 21 Jun 2022 18:30:44 -0400 (EDT) Received: from smtpin27.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay13.hostedemail.com (Postfix) with ESMTP id A5A796053E for ; Tue, 21 Jun 2022 22:30:44 +0000 (UTC) X-FDA: 79603688808.27.9F4460D Received: from mail-lf1-f41.google.com (mail-lf1-f41.google.com [209.85.167.41]) by imf02.hostedemail.com (Postfix) with ESMTP id 4D1B9800B1 for ; Tue, 21 Jun 2022 22:30:44 +0000 (UTC) Received: by mail-lf1-f41.google.com with SMTP id c4so24688932lfj.12 for ; Tue, 21 Jun 2022 15:30:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=be4KTBeZxtpbZf3YZP05Js8VaqFOMrf83r+bDTDFiOM=; b=TbHQbtE0PGZvjMfU0/fdCKW8kn0RfxMLcQkuL7vMebVX3ouG4SBKD8sC2tkjx1p4tL JxLcXHa+y4RxHDPxAebJuKeKGscJoUKjrE8VXTvglAp1x/G4b03ih1fW6yNXCTiMQAPw teAuWEmSVhc73eNHdbcV4Cw5YrPPKwRNTZrJn8Pi8wlXst7by6Z/L8eV9UBD3t3RBMx4 6tPWew7RqfGH09r381WEW8Hp903+By355KdF31SA7pdi4YDiewE/7uhPhZfmYqySyvZp 6jI1juXcpFpqrIIQaJi/mwPudugxTKnpFg9ho/joL50I2hmuYTg9jX/3uWx6noKgzt2W Yh6A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=be4KTBeZxtpbZf3YZP05Js8VaqFOMrf83r+bDTDFiOM=; b=5d7P/pwhSiHuNwu5GAEqxnbn2vkNB9Ul6GFUiDSw49tg3ClgAmh8gEH7kNNkl1rXcy WpPE8KdcyguKsf0cTOpMImvmdaHvcOQrgB44WTyTts7s/jxX6RaIVEw+rqAW8RA2eufD qaWRd55vaqjhgWWQY1S+3X3tH9LcRQ8E1o/6WDrYnOrqcxahzB7lL79zvvYWfJbFh7dJ QUjp31uE2ZRv1TyPueKBHJo3vby+bEn5DNcPXBn1uQU6mSey6J+LoyMp+1mX4NSGblEx 7ZjKaom9FETTAXPUeltpLO/BKjBpjNijxilWaLmtfezr84DSoo3I+P9imAI+vNIqR+1S 5zVA== X-Gm-Message-State: AJIora9cwgbovijVY5Off5WLMsyl2iQ85AoEG3e4/Km6UQ5C3IBR4leN 5ap1uTG6y0SxxSTfqSBSV9CQjBQGhVqcPcrjBWlnnw== X-Google-Smtp-Source: AGRyM1tNImbx2kxK7HvpjgFsrzYuq9fWYBmKlPeBU+D7of5gQReoy2FIhun71/isgSXq7ZOimBGSU35RGWxiIk/cWOU= X-Received: by 2002:a05:6512:3085:b0:479:3986:1d23 with SMTP id z5-20020a056512308500b0047939861d23mr274153lfd.373.1655850642319; Tue, 21 Jun 2022 15:30:42 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Peter Gonda Date: Tue, 21 Jun 2022 16:30:30 -0600 Message-ID: Subject: Re: [PATCH Part2 v6 18/49] crypto: ccp: Provide APIs to query extended attestation report To: Ashish Kalra Cc: "the arch/x86 maintainers" , LKML , kvm list , linux-coco@lists.linux.dev, linux-mm@kvack.org, Linux Crypto Mailing List , Thomas Gleixner , Ingo Molnar , Joerg Roedel , "Lendacky, Thomas" , "H. Peter Anvin" , Ard Biesheuvel , Paolo Bonzini , Sean Christopherson , Vitaly Kuznetsov , Jim Mattson , Andy Lutomirski , Dave Hansen , Sergio Lopez , Peter Zijlstra , Srinivas Pandruvada , David Rientjes , Dov Murik , Tobin Feldman-Fitzthum , Borislav Petkov , Michael Roth , Vlastimil Babka , "Kirill A . Shutemov" , Andi Kleen , Tony Luck , Marc Orr , Sathyanarayanan Kuppuswamy , Alper Gun , "Dr. David Alan Gilbert" , jarkko@kernel.org Content-Type: text/plain; charset="UTF-8" ARC-Authentication-Results: i=1; imf02.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=TbHQbtE0; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf02.hostedemail.com: domain of pgonda@google.com designates 209.85.167.41 as permitted sender) smtp.mailfrom=pgonda@google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1655850644; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=be4KTBeZxtpbZf3YZP05Js8VaqFOMrf83r+bDTDFiOM=; b=qn9tx8qzCRjnUYlT2RxizsoMkNwCjVyMgDJ0bLC+uTH8thxu9x+GVsHbdfMMnvNAtn0OuA 44YXaxiBvWhxuWNGUK9XBmPmqdw+CWMcr9KuP+NT4b7AU9Ztn/fFRbgNV6c8awEi7GYkmd iV8TDDDkdZVnqCYVbDtMNcPrODbOZBk= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1655850644; a=rsa-sha256; cv=none; b=mmdVYVRxl7EvULkNAX3tL+9DbhEutWDKxBvHcvVmABmFgaMU5PXrWLugcarZ5CVw8TlzC6 oEMwgFyylyL9mbgLrZIeqUtslO9GgEGKLGEzdXOEBypLG+go5i/3rRsCeyFcMaxOVu6czp kwIn3rq2Su5di99zdT1a5JLoIStzZJs= X-Stat-Signature: 7ggsi3eezbjdcxm33f9k4b35hta8h3un X-Rspamd-Queue-Id: 4D1B9800B1 X-Rspam-User: Authentication-Results: imf02.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=TbHQbtE0; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf02.hostedemail.com: domain of pgonda@google.com designates 209.85.167.41 as permitted sender) smtp.mailfrom=pgonda@google.com X-Rspamd-Server: rspam10 X-HE-Tag: 1655850644-459997 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Mon, Jun 20, 2022 at 5:06 PM Ashish Kalra wrote: > > From: Brijesh Singh > > Version 2 of the GHCB specification defines VMGEXIT that is used to get > the extended attestation report. The extended attestation report includes > the certificate blobs provided through the SNP_SET_EXT_CONFIG. > > The snp_guest_ext_guest_request() will be used by the hypervisor to get > the extended attestation report. See the GHCB specification for more > details. > > Signed-off-by: Brijesh Singh > --- > drivers/crypto/ccp/sev-dev.c | 43 ++++++++++++++++++++++++++++++++++++ > include/linux/psp-sev.h | 24 ++++++++++++++++++++ > 2 files changed, 67 insertions(+) > > diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c > index 97b479d5aa86..f6306b820b86 100644 > --- a/drivers/crypto/ccp/sev-dev.c > +++ b/drivers/crypto/ccp/sev-dev.c > @@ -25,6 +25,7 @@ > #include > > #include > +#include > > #include "psp-dev.h" > #include "sev-dev.h" > @@ -1857,6 +1858,48 @@ int snp_guest_dbg_decrypt(struct sev_data_snp_dbg *data, int *error) > } > EXPORT_SYMBOL_GPL(snp_guest_dbg_decrypt); > > +int snp_guest_ext_guest_request(struct sev_data_snp_guest_request *data, > + unsigned long vaddr, unsigned long *npages, unsigned long *fw_err) > +{ > + unsigned long expected_npages; > + struct sev_device *sev; > + int rc; > + > + if (!psp_master || !psp_master->sev_data) > + return -ENODEV; > + > + sev = psp_master->sev_data; > + > + if (!sev->snp_inited) > + return -EINVAL; > + > + /* > + * Check if there is enough space to copy the certificate chain. Otherwise > + * return ERROR code defined in the GHCB specification. > + */ > + expected_npages = sev->snp_certs_len >> PAGE_SHIFT; > + if (*npages < expected_npages) { > + *npages = expected_npages; > + *fw_err = SNP_GUEST_REQ_INVALID_LEN; > + return -EINVAL; > + } > + > + rc = sev_do_cmd(SEV_CMD_SNP_GUEST_REQUEST, data, (int *)&fw_err); We can just pass |fw_error| here (with the cast) here right? Not need to do &fw_err. rc = sev_do_cmd(SEV_CMD_SNP_GUEST_REQUEST, data, (int *)fw_err); > + if (rc) > + return rc; > + > + /* Copy the certificate blob */ > + if (sev->snp_certs_data) { > + *npages = expected_npages; > + memcpy((void *)vaddr, sev->snp_certs_data, *npages << PAGE_SHIFT); Why don't we just make |vaddr| into a void* instead of an unsigned long? > + } else { > + *npages = 0; > + } > + > + return rc; > +} > +EXPORT_SYMBOL_GPL(snp_guest_ext_guest_request); > + > static void sev_exit(struct kref *ref) > { > misc_deregister(&misc_dev->misc); > diff --git a/include/linux/psp-sev.h b/include/linux/psp-sev.h > index a3bb792bb842..cd37ccd1fa1f 100644 > --- a/include/linux/psp-sev.h > +++ b/include/linux/psp-sev.h > @@ -945,6 +945,23 @@ void *psp_copy_user_blob(u64 uaddr, u32 len); > void *snp_alloc_firmware_page(gfp_t mask); > void snp_free_firmware_page(void *addr); > > +/** > + * snp_guest_ext_guest_request - perform the SNP extended guest request command > + * defined in the GHCB specification. > + * > + * @data: the input guest request structure > + * @vaddr: address where the certificate blob need to be copied. > + * @npages: number of pages for the certificate blob. > + * If the specified page count is less than the certificate blob size, then the > + * required page count is returned with error code defined in the GHCB spec. > + * If the specified page count is more than the certificate blob size, then > + * page count is updated to reflect the amount of valid data copied in the > + * vaddr. > + */ > +int snp_guest_ext_guest_request(struct sev_data_snp_guest_request *data, > + unsigned long vaddr, unsigned long *npages, > + unsigned long *error); > + > #else /* !CONFIG_CRYPTO_DEV_SP_PSP */ > > static inline int > @@ -992,6 +1009,13 @@ static inline void *snp_alloc_firmware_page(gfp_t mask) > > static inline void snp_free_firmware_page(void *addr) { } > > +static inline int snp_guest_ext_guest_request(struct sev_data_snp_guest_request *data, > + unsigned long vaddr, unsigned long *n, > + unsigned long *error) > +{ > + return -ENODEV; > +} > + > #endif /* CONFIG_CRYPTO_DEV_SP_PSP */ > > #endif /* __PSP_SEV_H__ */ > -- > 2.25.1 >