From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-20.6 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,NICE_REPLY_A, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_SANE_1 autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id CCE92C4338F for ; Fri, 6 Aug 2021 12:10:27 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id A9EBF61102 for ; Fri, 6 Aug 2021 12:10:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343604AbhHFMKh (ORCPT ); Fri, 6 Aug 2021 08:10:37 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]:30683 "EHLO us-smtp-delivery-124.mimecast.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343589AbhHFMKg (ORCPT ); Fri, 6 Aug 2021 08:10:36 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1628251821; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=iUX9tkPbPQoCHmRVVBakL5GihoDlnIvlBLjyIrxXxlQ=; b=LAow66GmT3jca8v5qZWQ/6Tv7iZKzy0EI7aaO1SR8Msy7YiX8dml201kibDgynQZ+pTc+3 DjJnz0pq3KeSrjf/P7ow79rklmBRSgl7yVofPBnOjFl9IRM6bvf0N+xHjapehj7vYZ/blZ STZZd4fwijkhpg9xeeMhp/4/1V2Nor8= Received: from mail-ej1-f70.google.com (mail-ej1-f70.google.com [209.85.218.70]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-294-tTnGUh97PMmEfwDVh-D11A-1; Fri, 06 Aug 2021 08:10:20 -0400 X-MC-Unique: tTnGUh97PMmEfwDVh-D11A-1 Received: by mail-ej1-f70.google.com with SMTP id q19-20020a170906b293b029058a1e75c819so3036137ejz.16 for ; Fri, 06 Aug 2021 05:10:19 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=iUX9tkPbPQoCHmRVVBakL5GihoDlnIvlBLjyIrxXxlQ=; b=HZnKD0oWDYQkKvng5JAOEKY89EWiE+u98oXJ6TcMNTYzwIsINifV8h1Upomf0+stS2 pDri1k9zSAGLg2smVvz5DEciXOy089stVxmaViLPI5DW4MzIi6SvUhWGhnmGc8sB6oNH 0BTe/cvoN/7+wKpUxR93y3SARJ7bRDaefJSf2ucEGy4CAZihUb3FALF0kJGiSl3qrUjt MVpYrMVgqj6zgvZkDoQkqFwcvCzhxT/gOppx4rh7lbr3+q4PZkx1M2pgWrWfelIhRluJ jHcc6q1iaPvF0K7bkjgilLYxsMCUw9CCX99rFFM2XZ6ltvWcdezaOEphwjTv8FlTe4OC nqLg== X-Gm-Message-State: AOAM531VEuXp9t3uoHeL99mC0UJ8RBd+qJge7hfohH54oDkUeOzyCAr2 ULTchY1R8ZAblXAQOi4PrLkkX5c333t38T3va/bZNvp+mf/3Ee4zNo4oglhPCyN/FI73ZsA/0fH t8SkQLqpLYegzgqOKBJYHI32z X-Received: by 2002:a17:906:190c:: with SMTP id a12mr9606619eje.141.1628251818749; Fri, 06 Aug 2021 05:10:18 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxIy7pPE5neyynmuNk+K1t2AeMYsAbqvWPh61GejqqHO3cLZMf+XAD32NUXkg67Vn1gH2F8cw== X-Received: by 2002:a17:906:190c:: with SMTP id a12mr9606597eje.141.1628251818587; Fri, 06 Aug 2021 05:10:18 -0700 (PDT) Received: from x1.localdomain (2001-1c00-0c1e-bf00-1054-9d19-e0f0-8214.cable.dynamic.v6.ziggo.nl. [2001:1c00:c1e:bf00:1054:9d19:e0f0:8214]) by smtp.gmail.com with ESMTPSA id ov4sm2818048ejb.122.2021.08.06.05.10.17 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 06 Aug 2021 05:10:18 -0700 (PDT) Subject: Re: [PATCH v4 0/7] Add TDX Guest Support (Attestation support) To: Kuppuswamy Sathyanarayanan , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Peter Zijlstra , Andy Lutomirski , Mark Gross , Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko Cc: Peter H Anvin , Dave Hansen , Tony Luck , Dan Williams , Andi Kleen , Kirill Shutemov , Sean Christopherson , Kuppuswamy Sathyanarayanan , x86@kernel.org, linux-kernel@vger.kernel.org, platform-driver-x86@vger.kernel.org, bpf@vger.kernel.org, netdev@vger.kernel.org References: <20210806000946.2951441-1-sathyanarayanan.kuppuswamy@linux.intel.com> From: Hans de Goede Message-ID: Date: Fri, 6 Aug 2021 14:10:17 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.11.0 MIME-Version: 1.0 In-Reply-To: <20210806000946.2951441-1-sathyanarayanan.kuppuswamy@linux.intel.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi, On 8/6/21 2:09 AM, Kuppuswamy Sathyanarayanan wrote: > Hi All, > > Intel's Trust Domain Extensions (TDX) protect guest VMs from malicious > hosts and some physical attacks. VM guest with TDX support is called > as TD Guest. > > In TD Guest, the attestation process is used to verify the > trustworthiness of TD guest to the 3rd party servers. Such attestation > process is required by 3rd party servers before sending sensitive > information to TD guests. One usage example is to get encryption keys > from the key server for mounting the encrypted rootfs or secondary drive. > > Following patches adds the attestation support to TDX guest which > includes attestation user interface driver, user agent example, and > related hypercall support. > > In this series, only following patches are in arch/x86 and are > intended for x86 maintainers review. > > * x86/tdx: Add TDREPORT TDX Module call support > * x86/tdx: Add GetQuote TDX hypercall support > * x86/tdx: Add SetupEventNotifyInterrupt TDX hypercall support > > Patch titled "platform/x86: intel_tdx_attest: Add TDX Guest attestation > interface driver" adds the attestation driver support. This is supposed > to be reviewed by platform-x86 maintainers. Since the patches depend on each other I believe that it would be best if the entire series gets merged through the tip tree. Here is my ack for patch 6/7 for that: Acked-by: Hans de Goede Regards, Hans > > Also, patch titled "tools/tdx: Add a sample attestation user app" adds > a testing app for attestation feature which needs review from > bpf@vger.kernel.org. > > This series is the continuation of the following TDX patch series which > added basic TDX guest support. > > [set 1, v5] - https://lore.kernel.org/patchwork/project/lkml/list/?seriesQ0805 > [set 2, v4] - https://lore.kernel.org/patchwork/project/lkml/list/?seriesQ0814 > [set 3, v4] - https://lore.kernel.org/patchwork/project/lkml/list/?seriesQ0816 > [set 4, v4] - https://lore.kernel.org/patchwork/project/lkml/list/?seriesQ0836 > [set 5, v3] - https://lkml.org/lkml/2021/8/5/1195 > > Also please note that this series alone is not necessarily fully > functional. > > You can find TDX related documents in the following link. > > https://software.intel.com/content/www/br/pt/develop/articles/intel-trust-domain-extensions.html > > Changes since v3: > * Since the code added by patch titled "x86/tdx: Add tdg_debug_enabled() > interface" is only used by other patches in this series, moved it here. > * Rebased on top of Tom Lendacky's protected guest > changes (https://lore.kernel.org/patchwork/cover/1468760/ > * Rest of the history is included in individual patches. > > Changes since v2: > * Rebased on top of v5.14-rc1. > * Rest of the history is included in individual patches. > > Changes since v1: > * Included platform-x86 and test tool maintainers in recipient list. > * Fixed commit log and comments in attestation driver as per Han's comments. > > Kuppuswamy Sathyanarayanan (7): > x86/tdx: Add tdg_debug_enabled() interface > x86/tdx: Add TDREPORT TDX Module call support > x86/tdx: Add GetQuote TDX hypercall support > x86/tdx: Add SetupEventNotifyInterrupt TDX hypercall support > x86/tdx: Add TDX Guest event notify interrupt vector support > platform/x86: intel_tdx_attest: Add TDX Guest attestation interface > driver > tools/tdx: Add a sample attestation user app > > arch/x86/include/asm/hardirq.h | 1 + > arch/x86/include/asm/idtentry.h | 4 + > arch/x86/include/asm/irq_vectors.h | 7 +- > arch/x86/include/asm/tdx.h | 8 + > arch/x86/kernel/irq.c | 7 + > arch/x86/kernel/tdx.c | 140 +++++++++++ > drivers/platform/x86/intel/Kconfig | 1 + > drivers/platform/x86/intel/Makefile | 1 + > drivers/platform/x86/intel/tdx/Kconfig | 13 + > drivers/platform/x86/intel/tdx/Makefile | 3 + > .../platform/x86/intel/tdx/intel_tdx_attest.c | 212 ++++++++++++++++ > include/uapi/misc/tdx.h | 37 +++ > tools/Makefile | 13 +- > tools/tdx/Makefile | 19 ++ > tools/tdx/attest/.gitignore | 2 + > tools/tdx/attest/Makefile | 24 ++ > tools/tdx/attest/tdx-attest-test.c | 232 ++++++++++++++++++ > 17 files changed, 717 insertions(+), 7 deletions(-) > create mode 100644 drivers/platform/x86/intel/tdx/Kconfig > create mode 100644 drivers/platform/x86/intel/tdx/Makefile > create mode 100644 drivers/platform/x86/intel/tdx/intel_tdx_attest.c > create mode 100644 include/uapi/misc/tdx.h > create mode 100644 tools/tdx/Makefile > create mode 100644 tools/tdx/attest/.gitignore > create mode 100644 tools/tdx/attest/Makefile > create mode 100644 tools/tdx/attest/tdx-attest-test.c >