* [PATCH v1 1/6] x86/tdx: Add TDREPORT TDX Module call support
2021-06-26 15:11 [PATCH v1 0/6] Add TDX Guest Support (Attestation support) Kuppuswamy Sathyanarayanan
@ 2021-06-26 15:11 ` Kuppuswamy Sathyanarayanan
2021-06-26 15:11 ` [PATCH v1 2/6] x86/tdx: Add GetQuote TDX hypercall support Kuppuswamy Sathyanarayanan
` (4 subsequent siblings)
5 siblings, 0 replies; 8+ messages in thread
From: Kuppuswamy Sathyanarayanan @ 2021-06-26 15:11 UTC (permalink / raw)
To: Thomas Gleixner, Ingo Molnar, Borislav Petkov, Peter Zijlstra,
Andy Lutomirski
Cc: Peter H Anvin, Dave Hansen, Tony Luck, Dan Williams, Andi Kleen,
Kirill Shutemov, Sean Christopherson, Kuppuswamy Sathyanarayanan,
x86, linux-kernel
The TDX Guest-Host Communication Interface (GHCI) includes a module
call (TDREPORT TDCALL) that a guest can make to acquire a copy of the
attestation data that it needs to verify its trustworthiness.
Add a wrapper function tdx_mcall_tdreport() that makes the module
call to get this data.
See GHCI section 2.4.5 "TDCALL [TDG.MR.REPORT] leaf" for additional
details.
[Xiaoyao: Proposed error code fix]
Reviewed-by: Tony Luck <tony.luck@intel.com>
Reviewed-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
---
arch/x86/include/asm/tdx.h | 2 ++
arch/x86/kernel/tdx.c | 33 +++++++++++++++++++++++++++++++++
2 files changed, 35 insertions(+)
diff --git a/arch/x86/include/asm/tdx.h b/arch/x86/include/asm/tdx.h
index 48927fac9e12..4f1b5c14a09b 100644
--- a/arch/x86/include/asm/tdx.h
+++ b/arch/x86/include/asm/tdx.h
@@ -96,6 +96,8 @@ extern int tdx_hcall_gpa_intent(phys_addr_t gpa, int numpages,
bool tdg_filter_enabled(void);
+int tdx_mcall_tdreport(u64 data, u64 reportdata);
+
/*
* To support I/O port access in decompressor or early kernel init
* code, since #VE exception handler cannot be used, use paravirt
diff --git a/arch/x86/kernel/tdx.c b/arch/x86/kernel/tdx.c
index f76af7661046..0f797803f4c8 100644
--- a/arch/x86/kernel/tdx.c
+++ b/arch/x86/kernel/tdx.c
@@ -23,6 +23,7 @@
/* TDX Module call Leaf IDs */
#define TDINFO 1
#define TDGETVEINFO 3
+#define TDREPORT 4
#define TDACCEPTPAGE 6
/* TDX hypercall Leaf IDs */
@@ -30,6 +31,11 @@
/* TDX Module call error codes */
#define TDX_PAGE_ALREADY_ACCEPTED 0x8000000000000001
+#define TDCALL_RETURN_CODE_MASK 0xFFFFFFFF00000000
+#define TDCALL_OPERAND_BUSY 0x8000020000000000
+#define TDCALL_INVALID_OPERAND 0x8000000000000000
+#define TDCALL_RETURN_CODE(a) ((a) & TDCALL_RETURN_CODE_MASK)
+
#define VE_IS_IO_OUT(exit_qual) (((exit_qual) & 8) ? 0 : 1)
#define VE_GET_IO_SIZE(exit_qual) (((exit_qual) & 7) + 1)
@@ -139,6 +145,33 @@ static bool tdg_perfmon_enabled(void)
return td_info.attributes & BIT(63);
}
+/*
+ * tdx_mcall_tdreport() - Generate TDREPORT_STRUCT using TDCALL.
+ *
+ * @data : Physical address of 1024B aligned data to store
+ * TDREPORT_STRUCT.
+ * @reportdata : Physical address of 64B aligned report data
+ *
+ * return 0 on success or failure error number.
+ */
+int tdx_mcall_tdreport(u64 data, u64 reportdata)
+{
+ u64 ret;
+
+ if (!data || !reportdata || !prot_guest_has(PR_GUEST_TDX))
+ return -EINVAL;
+
+ ret = __trace_tdx_module_call(TDREPORT, data, reportdata, 0, 0, NULL);
+
+ if (TDCALL_RETURN_CODE(ret) == TDCALL_INVALID_OPERAND)
+ return -EINVAL;
+ else if (TDCALL_RETURN_CODE(ret) == TDCALL_OPERAND_BUSY)
+ return -EBUSY;
+
+ return 0;
+}
+EXPORT_SYMBOL_GPL(tdx_mcall_tdreport);
+
static void tdg_get_info(void)
{
u64 ret;
--
2.25.1
^ permalink raw reply [flat|nested] 8+ messages in thread* [PATCH v1 2/6] x86/tdx: Add GetQuote TDX hypercall support
2021-06-26 15:11 [PATCH v1 0/6] Add TDX Guest Support (Attestation support) Kuppuswamy Sathyanarayanan
2021-06-26 15:11 ` [PATCH v1 1/6] x86/tdx: Add TDREPORT TDX Module call support Kuppuswamy Sathyanarayanan
@ 2021-06-26 15:11 ` Kuppuswamy Sathyanarayanan
2021-06-26 15:11 ` [PATCH v1 3/6] x86/tdx: Add SetupEventNotifyInterrupt " Kuppuswamy Sathyanarayanan
` (3 subsequent siblings)
5 siblings, 0 replies; 8+ messages in thread
From: Kuppuswamy Sathyanarayanan @ 2021-06-26 15:11 UTC (permalink / raw)
To: Thomas Gleixner, Ingo Molnar, Borislav Petkov, Peter Zijlstra,
Andy Lutomirski
Cc: Peter H Anvin, Dave Hansen, Tony Luck, Dan Williams, Andi Kleen,
Kirill Shutemov, Sean Christopherson, Kuppuswamy Sathyanarayanan,
x86, linux-kernel
The second stage in the attestation process is for the guest to
request the VMM generate and sign a quote based on the TDREPORT
acquired earlier.
Add tdx_hcall_get_quote() helper function to implement the GetQuote
hypercall.
More details about the GetQuote TDVMCALL are in the Guest-Host
Communication Interface (GHCI) Specification, sec 3.3, titled
"TDG.VP.VMCALL<GetQuote>".
This will be used by the TD attestation driver in follow-on patches.
Reviewed-by: Tony Luck <tony.luck@intel.com>
Reviewed-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
---
arch/x86/include/asm/tdx.h | 2 ++
arch/x86/kernel/tdx.c | 30 ++++++++++++++++++++++++++++++
2 files changed, 32 insertions(+)
diff --git a/arch/x86/include/asm/tdx.h b/arch/x86/include/asm/tdx.h
index 4f1b5c14a09b..1599aa4850e5 100644
--- a/arch/x86/include/asm/tdx.h
+++ b/arch/x86/include/asm/tdx.h
@@ -98,6 +98,8 @@ bool tdg_filter_enabled(void);
int tdx_mcall_tdreport(u64 data, u64 reportdata);
+int tdx_hcall_get_quote(u64 data);
+
/*
* To support I/O port access in decompressor or early kernel init
* code, since #VE exception handler cannot be used, use paravirt
diff --git a/arch/x86/kernel/tdx.c b/arch/x86/kernel/tdx.c
index 0f797803f4c8..eb3a90051604 100644
--- a/arch/x86/kernel/tdx.c
+++ b/arch/x86/kernel/tdx.c
@@ -28,6 +28,7 @@
/* TDX hypercall Leaf IDs */
#define TDVMCALL_MAP_GPA 0x10001
+#define TDVMCALL_GET_QUOTE 0x10002
/* TDX Module call error codes */
#define TDX_PAGE_ALREADY_ACCEPTED 0x8000000000000001
@@ -36,6 +37,9 @@
#define TDCALL_INVALID_OPERAND 0x8000000000000000
#define TDCALL_RETURN_CODE(a) ((a) & TDCALL_RETURN_CODE_MASK)
+/* TDX hypercall error codes */
+#define TDVMCALL_INVALID_OPERAND 0x8000000000000000
+#define TDVMCALL_TDREPORT_FAILED 0x8000000000000001
#define VE_IS_IO_OUT(exit_qual) (((exit_qual) & 8) ? 0 : 1)
#define VE_GET_IO_SIZE(exit_qual) (((exit_qual) & 7) + 1)
@@ -172,6 +176,32 @@ int tdx_mcall_tdreport(u64 data, u64 reportdata)
}
EXPORT_SYMBOL_GPL(tdx_mcall_tdreport);
+/*
+ * tdx_hcall_get_quote() - Generate TDQUOTE using TDREPORT_STRUCT.
+ *
+ * @data : Physical address of 4KB GPA memory which contains
+ * TDREPORT_STRUCT.
+ *
+ * return 0 on success or failure error number.
+ */
+int tdx_hcall_get_quote(u64 data)
+{
+ u64 ret;
+
+ if (!data || !prot_guest_has(PR_GUEST_TDX))
+ return -EINVAL;
+
+ ret = _trace_tdx_hypercall(TDVMCALL_GET_QUOTE, data, 0, 0, 0, NULL);
+
+ if (ret == TDVMCALL_INVALID_OPERAND)
+ return -EINVAL;
+ else if (ret == TDVMCALL_TDREPORT_FAILED)
+ return -EBUSY;
+
+ return 0;
+}
+EXPORT_SYMBOL_GPL(tdx_hcall_get_quote);
+
static void tdg_get_info(void)
{
u64 ret;
--
2.25.1
^ permalink raw reply [flat|nested] 8+ messages in thread* [PATCH v1 3/6] x86/tdx: Add SetupEventNotifyInterrupt TDX hypercall support
2021-06-26 15:11 [PATCH v1 0/6] Add TDX Guest Support (Attestation support) Kuppuswamy Sathyanarayanan
2021-06-26 15:11 ` [PATCH v1 1/6] x86/tdx: Add TDREPORT TDX Module call support Kuppuswamy Sathyanarayanan
2021-06-26 15:11 ` [PATCH v1 2/6] x86/tdx: Add GetQuote TDX hypercall support Kuppuswamy Sathyanarayanan
@ 2021-06-26 15:11 ` Kuppuswamy Sathyanarayanan
2021-06-26 15:11 ` [PATCH v1 4/6] x86/tdx: Add TDX Guest event notify interrupt vector support Kuppuswamy Sathyanarayanan
` (2 subsequent siblings)
5 siblings, 0 replies; 8+ messages in thread
From: Kuppuswamy Sathyanarayanan @ 2021-06-26 15:11 UTC (permalink / raw)
To: Thomas Gleixner, Ingo Molnar, Borislav Petkov, Peter Zijlstra,
Andy Lutomirski
Cc: Peter H Anvin, Dave Hansen, Tony Luck, Dan Williams, Andi Kleen,
Kirill Shutemov, Sean Christopherson, Kuppuswamy Sathyanarayanan,
x86, linux-kernel
SetupEventNotifyInterrupt TDX hypercall is used by guest TD to specify
which interrupt vector to use as an event-notify vector to the VMM.
Such registered vector is also used by Host VMM to notify about
completion of GetQuote requests to the Guest TD.
Add tdx_hcall_set_notify_intr() helper function to implement the
SetupEventNotifyInterrupt hypercall.
This will be used by the TD quote driver.
Details about the SetupEventNotifyInterrupt TDVMCALL can be found in
TDX Guest-Host Communication Interface (GHCI) Specification, sec 3.5
"TDG.VP.VMCALL<SetupEventNotifyInterrupt>".
Reviewed-by: Tony Luck <tony.luck@intel.com>
Reviewed-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
---
arch/x86/kernel/tdx.c | 25 +++++++++++++++++++++++++
1 file changed, 25 insertions(+)
diff --git a/arch/x86/kernel/tdx.c b/arch/x86/kernel/tdx.c
index eb3a90051604..fcb0ed70ea19 100644
--- a/arch/x86/kernel/tdx.c
+++ b/arch/x86/kernel/tdx.c
@@ -29,6 +29,7 @@
/* TDX hypercall Leaf IDs */
#define TDVMCALL_MAP_GPA 0x10001
#define TDVMCALL_GET_QUOTE 0x10002
+#define TDVMCALL_SETUP_NOTIFY_INTR 0x10004
/* TDX Module call error codes */
#define TDX_PAGE_ALREADY_ACCEPTED 0x8000000000000001
@@ -202,6 +203,30 @@ int tdx_hcall_get_quote(u64 data)
}
EXPORT_SYMBOL_GPL(tdx_hcall_get_quote);
+/*
+ * tdx_hcall_set_notify_intr() - Setup Event Notify Interrupt Vector.
+ *
+ * @vector : Vector address to be used for notification.
+ *
+ * return 0 on success or failure error number.
+ */
+int tdx_hcall_set_notify_intr(u8 vector)
+{
+ u64 ret;
+
+ /* Minimum vector value allowed is 32 */
+ if (vector < 32)
+ return -EINVAL;
+
+ ret = _trace_tdx_hypercall(TDVMCALL_SETUP_NOTIFY_INTR, vector, 0, 0, 0,
+ NULL);
+
+ if (ret == TDCALL_INVALID_OPERAND)
+ return -EINVAL;
+
+ return 0;
+}
+
static void tdg_get_info(void)
{
u64 ret;
--
2.25.1
^ permalink raw reply [flat|nested] 8+ messages in thread* [PATCH v1 4/6] x86/tdx: Add TDX Guest event notify interrupt vector support
2021-06-26 15:11 [PATCH v1 0/6] Add TDX Guest Support (Attestation support) Kuppuswamy Sathyanarayanan
` (2 preceding siblings ...)
2021-06-26 15:11 ` [PATCH v1 3/6] x86/tdx: Add SetupEventNotifyInterrupt " Kuppuswamy Sathyanarayanan
@ 2021-06-26 15:11 ` Kuppuswamy Sathyanarayanan
2021-06-26 15:11 ` [PATCH v1 5/6] platform/x86: intel_tdx_attest: Add TDX Guest attestation interface driver Kuppuswamy Sathyanarayanan
2021-06-26 15:11 ` [PATCH v1 6/6] tools/tdx: Add a sample attestation user app Kuppuswamy Sathyanarayanan
5 siblings, 0 replies; 8+ messages in thread
From: Kuppuswamy Sathyanarayanan @ 2021-06-26 15:11 UTC (permalink / raw)
To: Thomas Gleixner, Ingo Molnar, Borislav Petkov, Peter Zijlstra,
Andy Lutomirski
Cc: Peter H Anvin, Dave Hansen, Tony Luck, Dan Williams, Andi Kleen,
Kirill Shutemov, Sean Christopherson, Kuppuswamy Sathyanarayanan,
x86, linux-kernel
Allocate 0xec IRQ vector address for TDX guest to receive the event
completion notification from VMM. Since this vector address will be
sent to VMM via hypercall, allocate a fixed address and move
LOCAL_TIMER_VECTOR vector address by 1 byte. Also add related IDT
handler to process the notification event.
It will be mainly used by attestation driver to receive Quote event
completion notification from host.
Add support to track the notification event status via /proc/interrupts.
Reviewed-by: Tony Luck <tony.luck@intel.com>
Reviewed-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
---
arch/x86/include/asm/hardirq.h | 1 +
arch/x86/include/asm/idtentry.h | 4 +++
arch/x86/include/asm/irq_vectors.h | 7 ++++-
arch/x86/include/asm/tdx.h | 2 ++
arch/x86/kernel/irq.c | 7 +++++
arch/x86/kernel/tdx.c | 41 ++++++++++++++++++++++++++++++
6 files changed, 61 insertions(+), 1 deletion(-)
diff --git a/arch/x86/include/asm/hardirq.h b/arch/x86/include/asm/hardirq.h
index 07d79fa9c5c6..40d0534e7d82 100644
--- a/arch/x86/include/asm/hardirq.h
+++ b/arch/x86/include/asm/hardirq.h
@@ -46,6 +46,7 @@ typedef struct {
#endif
#if IS_ENABLED(CONFIG_INTEL_TDX_GUEST)
unsigned int tdg_ve_count;
+ unsigned int irq_tdg_event_notify_count;
#endif
} ____cacheline_aligned irq_cpustat_t;
diff --git a/arch/x86/include/asm/idtentry.h b/arch/x86/include/asm/idtentry.h
index d3c779abbc78..fad1b0110c88 100644
--- a/arch/x86/include/asm/idtentry.h
+++ b/arch/x86/include/asm/idtentry.h
@@ -702,6 +702,10 @@ DECLARE_IDTENTRY_SYSVEC(HYPERVISOR_CALLBACK_VECTOR, sysvec_xen_hvm_callback);
DECLARE_IDTENTRY_SYSVEC(HYPERVISOR_CALLBACK_VECTOR, sysvec_kvm_asyncpf_interrupt);
#endif
+#ifdef CONFIG_INTEL_TDX_GUEST
+DECLARE_IDTENTRY_SYSVEC(TDX_GUEST_EVENT_NOTIFY_VECTOR, sysvec_tdg_event_notify);
+#endif
+
#undef X86_TRAP_OTHER
#endif
diff --git a/arch/x86/include/asm/irq_vectors.h b/arch/x86/include/asm/irq_vectors.h
index 889f8b1b5b7f..a1550f237ef6 100644
--- a/arch/x86/include/asm/irq_vectors.h
+++ b/arch/x86/include/asm/irq_vectors.h
@@ -104,7 +104,12 @@
#define HYPERV_STIMER0_VECTOR 0xed
#endif
-#define LOCAL_TIMER_VECTOR 0xec
+#if IS_ENABLED(CONFIG_INTEL_TDX_GUEST)
+/* Vector on which TDX Guest event notification is delivered */
+#define TDX_GUEST_EVENT_NOTIFY_VECTOR 0xec
+#endif
+
+#define LOCAL_TIMER_VECTOR 0xeb
#define NR_VECTORS 256
diff --git a/arch/x86/include/asm/tdx.h b/arch/x86/include/asm/tdx.h
index 1599aa4850e5..a7ebc6e448d7 100644
--- a/arch/x86/include/asm/tdx.h
+++ b/arch/x86/include/asm/tdx.h
@@ -100,6 +100,8 @@ int tdx_mcall_tdreport(u64 data, u64 reportdata);
int tdx_hcall_get_quote(u64 data);
+extern void (*tdg_event_notify_handler)(void);
+
/*
* To support I/O port access in decompressor or early kernel init
* code, since #VE exception handler cannot be used, use paravirt
diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
index 669869bd46ec..a4fe53c8c18f 100644
--- a/arch/x86/kernel/irq.c
+++ b/arch/x86/kernel/irq.c
@@ -182,11 +182,18 @@ int arch_show_interrupts(struct seq_file *p, int prec)
irq_stats(j)->kvm_posted_intr_wakeup_ipis);
seq_puts(p, " Posted-interrupt wakeup event\n");
#endif
+
#if IS_ENABLED(CONFIG_INTEL_TDX_GUEST)
seq_printf(p, "%*s: ", prec, "TGV");
for_each_online_cpu(j)
seq_printf(p, "%10u ", irq_stats(j)->tdg_ve_count);
seq_puts(p, " TDX Guest VE event\n");
+
+ seq_printf(p, "%*s: ", prec, "TGN");
+ for_each_online_cpu(j)
+ seq_printf(p, "%10u ",
+ irq_stats(j)->irq_tdg_event_notify_count);
+ seq_puts(p, " TDX Guest event notification\n");
#endif
return 0;
}
diff --git a/arch/x86/kernel/tdx.c b/arch/x86/kernel/tdx.c
index fcb0ed70ea19..f08fd6ae44b3 100644
--- a/arch/x86/kernel/tdx.c
+++ b/arch/x86/kernel/tdx.c
@@ -11,6 +11,11 @@
#include <asm/tdx.h>
#include <asm/cmdline.h>
#include <asm/i8259.h>
+#include <asm/apic.h>
+#include <asm/idtentry.h>
+#include <asm/irq_regs.h>
+#include <asm/desc.h>
+#include <asm/idtentry.h>
#include <asm/vmx.h>
#include <asm/insn.h>
#include <asm/insn-eval.h>
@@ -52,6 +57,14 @@ static struct {
unsigned long attributes;
} td_info __ro_after_init;
+/*
+ * Currently it will be used only by the attestation
+ * driver. So, race condition with read/write operation
+ * is not considered.
+ */
+void (*tdg_event_notify_handler)(void);
+EXPORT_SYMBOL_GPL(tdg_event_notify_handler);
+
/*
* Wrapper for standard use of __tdx_hypercall with BUG_ON() check
* for TDCALL error.
@@ -150,6 +163,28 @@ static bool tdg_perfmon_enabled(void)
return td_info.attributes & BIT(63);
}
+/* TDX guest event notification handler */
+DEFINE_IDTENTRY_SYSVEC(sysvec_tdg_event_notify)
+{
+ struct pt_regs *old_regs = set_irq_regs(regs);
+
+ inc_irq_stat(irq_tdg_event_notify_count);
+
+ if (tdg_event_notify_handler)
+ tdg_event_notify_handler();
+
+ /*
+ * The hypervisor requires that the APIC EOI should be acked.
+ * If the APIC EOI is not acked, the APIC ISR bit for the
+ * TDX_GUEST_EVENT_NOTIFY_VECTOR will not be cleared and then it
+ * will block the interrupt whose vector is lower than
+ * TDX_GUEST_EVENT_NOTIFY_VECTOR.
+ */
+ ack_APIC_irq();
+
+ set_irq_regs(old_regs);
+}
+
/*
* tdx_mcall_tdreport() - Generate TDREPORT_STRUCT using TDCALL.
*
@@ -712,5 +747,11 @@ void __init tdx_early_init(void)
lock_kernel_down("TDX guest init", lockdown_reason);
}
+ alloc_intr_gate(TDX_GUEST_EVENT_NOTIFY_VECTOR,
+ asm_sysvec_tdg_event_notify);
+
+ if (tdx_hcall_set_notify_intr(TDX_GUEST_EVENT_NOTIFY_VECTOR))
+ pr_warn("Setting event notification interrupt failed\n");
+
pr_info("Guest initialized\n");
}
--
2.25.1
^ permalink raw reply [flat|nested] 8+ messages in thread* [PATCH v1 5/6] platform/x86: intel_tdx_attest: Add TDX Guest attestation interface driver
2021-06-26 15:11 [PATCH v1 0/6] Add TDX Guest Support (Attestation support) Kuppuswamy Sathyanarayanan
` (3 preceding siblings ...)
2021-06-26 15:11 ` [PATCH v1 4/6] x86/tdx: Add TDX Guest event notify interrupt vector support Kuppuswamy Sathyanarayanan
@ 2021-06-26 15:11 ` Kuppuswamy Sathyanarayanan
2021-07-06 9:48 ` Hans de Goede
2021-06-26 15:11 ` [PATCH v1 6/6] tools/tdx: Add a sample attestation user app Kuppuswamy Sathyanarayanan
5 siblings, 1 reply; 8+ messages in thread
From: Kuppuswamy Sathyanarayanan @ 2021-06-26 15:11 UTC (permalink / raw)
To: Thomas Gleixner, Ingo Molnar, Borislav Petkov, Peter Zijlstra,
Andy Lutomirski
Cc: Peter H Anvin, Dave Hansen, Tony Luck, Dan Williams, Andi Kleen,
Kirill Shutemov, Sean Christopherson, Kuppuswamy Sathyanarayanan,
x86, linux-kernel, Hans de Goede, Mark Gross,
platform-driver-x86
TDX guest supports encrypted disk as root or secondary drives.
Decryption keys required to access such drives are usually maintained
by 3rd party key servers. Attestation is required by 3rd party key
servers to get the key for an encrypted disk volume, or possibly other
encrypted services. Attestation is used to prove to the key server that
the TD guest is running in a valid TD and the kernel and virtual BIOS
and other environment are secure.
During the boot process various components before the kernel accumulate
hashes in the TDX module, which can then combined into a report. This
would typically include a hash of the bios, bios configuration, boot
loader, command line, kernel, initrd. After checking the hashes the
key server will securely release the keys.
The actual details of the attestation protocol depend on the particular
key server configuration, but some parts are common and need to
communicate with the TDX module.
This communication is implemented in the attestation driver.
The supported steps are:
1. TD guest generates the TDREPORT that contains version information
about the Intel TDX module, measurement of the TD, along with a
TD-specified nonce.
2. TD guest shares the TDREPORT with TD host via GetQuote hypercall
which is used by the host to generate a quote via quoting
enclave (QE).
3. Quote generation completion notification is sent to TD OS via
callback interrupt vector configured by TD using
SetupEventNotifyInterrupt hypercall.
4. After receiving the generated TDQUOTE, a remote verifier can be
used to verify the quote and confirm the trustworthiness of the
TD.
Attestation agent uses IOCTLs implemented by the attestation driver to
complete the various steps of the attestation process.
Also note that, explicit access permissions are not enforced in this
driver because the quote and measurements are not a secret. However
the access permissions of the device node can be used to set any
desired access policy. The udev default is usually root access
only.
TDX_CMD_GEN_QUOTE IOCTL can be used to create an computation on the
host, but TDX assumes that the host is able to deal with malicious
guest flooding it anyways.
Cc: Hans de Goede <hdegoede@redhat.com>
Cc: Mark Gross <mgross@linux.intel.com>
Cc: platform-driver-x86@vger.kernel.org
Reviewed-by: Tony Luck <tony.luck@intel.com>
Reviewed-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
---
drivers/platform/x86/Kconfig | 9 ++
drivers/platform/x86/Makefile | 1 +
drivers/platform/x86/intel_tdx_attest.c | 171 ++++++++++++++++++++++++
include/uapi/misc/tdx.h | 20 +++
4 files changed, 201 insertions(+)
create mode 100644 drivers/platform/x86/intel_tdx_attest.c
create mode 100644 include/uapi/misc/tdx.h
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 60592fb88e7a..7d01c473aef6 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -1301,6 +1301,15 @@ config INTEL_SCU_IPC_UTIL
low level access for debug work and updating the firmware. Say
N unless you will be doing this on an Intel MID platform.
+config INTEL_TDX_ATTESTATION
+ tristate "Intel TDX attestation driver"
+ depends on INTEL_TDX_GUEST
+ help
+ The TDX attestation driver provides IOCTL or MMAP interfaces to
+ the user to request TDREPORT from the TDX module or request quote
+ from VMM. It is mainly used to get secure disk decryption keys from
+ the key server.
+
config INTEL_TELEMETRY
tristate "Intel SoC Telemetry Driver"
depends on X86_64
diff --git a/drivers/platform/x86/Makefile b/drivers/platform/x86/Makefile
index dcc8cdb95b4d..83439990ae47 100644
--- a/drivers/platform/x86/Makefile
+++ b/drivers/platform/x86/Makefile
@@ -138,6 +138,7 @@ obj-$(CONFIG_INTEL_SCU_PCI) += intel_scu_pcidrv.o
obj-$(CONFIG_INTEL_SCU_PLATFORM) += intel_scu_pltdrv.o
obj-$(CONFIG_INTEL_SCU_WDT) += intel_scu_wdt.o
obj-$(CONFIG_INTEL_SCU_IPC_UTIL) += intel_scu_ipcutil.o
+obj-$(CONFIG_INTEL_TDX_ATTESTATION) += intel_tdx_attest.o
obj-$(CONFIG_INTEL_TELEMETRY) += intel_telemetry_core.o \
intel_telemetry_pltdrv.o \
intel_telemetry_debugfs.o
diff --git a/drivers/platform/x86/intel_tdx_attest.c b/drivers/platform/x86/intel_tdx_attest.c
new file mode 100644
index 000000000000..a0225d053851
--- /dev/null
+++ b/drivers/platform/x86/intel_tdx_attest.c
@@ -0,0 +1,171 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * intel_tdx_attest.c - TDX guest attestation interface driver.
+ *
+ * Implements user interface to trigger attestation process and
+ * read the TD Quote result.
+ *
+ * Copyright (C) 2020 Intel Corporation
+ *
+ * Author:
+ * Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+ */
+
+#define pr_fmt(fmt) "x86/tdx: attest: " fmt
+
+#include <linux/module.h>
+#include <linux/miscdevice.h>
+#include <linux/uaccess.h>
+#include <linux/fs.h>
+#include <linux/mm.h>
+#include <linux/slab.h>
+#include <linux/set_memory.h>
+#include <linux/io.h>
+#include <asm/apic.h>
+#include <asm/tdx.h>
+#include <asm/irq_vectors.h>
+#include <uapi/misc/tdx.h>
+
+#define VERSION "1.0"
+
+/* Used in Quote memory allocation */
+#define QUOTE_SIZE (2 * PAGE_SIZE)
+
+/* Mutex to synchronize attestation requests */
+static DEFINE_MUTEX(attestation_lock);
+/* Completion object to track attestation status */
+static DECLARE_COMPLETION(attestation_done);
+
+static void attestation_callback_handler(void)
+{
+ complete(&attestation_done);
+}
+
+static long tdg_attest_ioctl(struct file *file, unsigned int cmd,
+ unsigned long arg)
+{
+ u64 data = virt_to_phys(file->private_data);
+ void __user *argp = (void __user *)arg;
+ u8 *reportdata;
+ long ret = 0;
+
+ mutex_lock(&attestation_lock);
+
+ reportdata = kzalloc(TDX_TDREPORT_LEN, GFP_KERNEL);
+ if (!reportdata) {
+ mutex_unlock(&attestation_lock);
+ return -ENOMEM;
+ }
+
+ switch (cmd) {
+ case TDX_CMD_GET_TDREPORT:
+ if (copy_from_user(reportdata, argp, TDX_REPORT_DATA_LEN)) {
+ ret = -EFAULT;
+ break;
+ }
+
+ /* Generate TDREPORT_STRUCT */
+ if (tdx_mcall_tdreport(data, virt_to_phys(reportdata))) {
+ ret = -EIO;
+ break;
+ }
+
+ if (copy_to_user(argp, file->private_data, TDX_TDREPORT_LEN))
+ ret = -EFAULT;
+ break;
+ case TDX_CMD_GEN_QUOTE:
+ if (copy_from_user(reportdata, argp, TDX_REPORT_DATA_LEN)) {
+ ret = -EFAULT;
+ break;
+ }
+
+ /* Generate TDREPORT_STRUCT */
+ if (tdx_mcall_tdreport(data, virt_to_phys(reportdata))) {
+ ret = -EIO;
+ break;
+ }
+
+ ret = set_memory_decrypted((unsigned long)file->private_data,
+ 1UL << get_order(QUOTE_SIZE));
+ if (ret)
+ break;
+
+ /* Submit GetQuote Request */
+ if (tdx_hcall_get_quote(data)) {
+ ret = -EIO;
+ goto done;
+ }
+
+ /* Wait for attestation completion */
+ wait_for_completion_interruptible(&attestation_done);
+
+ if (copy_to_user(argp, file->private_data, QUOTE_SIZE))
+ ret = -EFAULT;
+done:
+ ret = set_memory_encrypted((unsigned long)file->private_data,
+ 1UL << get_order(QUOTE_SIZE));
+
+ break;
+ case TDX_CMD_GET_QUOTE_SIZE:
+ if (put_user(QUOTE_SIZE, (u64 __user *)argp))
+ ret = -EFAULT;
+
+ break;
+ default:
+ pr_err("cmd %d not supported\n", cmd);
+ break;
+ }
+
+ mutex_unlock(&attestation_lock);
+
+ kfree(reportdata);
+
+ return ret;
+}
+
+static int tdg_attest_open(struct inode *inode, struct file *file)
+{
+ /*
+ * Currently tdg_event_notify_handler is only used in attestation
+ * driver. But, WRITE_ONCE is used as benign data race notice.
+ */
+ WRITE_ONCE(tdg_event_notify_handler, attestation_callback_handler);
+
+ file->private_data = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
+ get_order(QUOTE_SIZE));
+
+ return !file->private_data ? -ENOMEM : 0;
+}
+
+static int tdg_attest_release(struct inode *inode, struct file *file)
+{
+ /*
+ * Currently tdg_event_notify_handler is only used in attestation
+ * driver. But, WRITE_ONCE is used as benign data race notice.
+ */
+ WRITE_ONCE(tdg_event_notify_handler, NULL);
+ free_pages((unsigned long)file->private_data, get_order(QUOTE_SIZE));
+ file->private_data = NULL;
+
+ return 0;
+}
+
+static const struct file_operations tdg_attest_fops = {
+ .owner = THIS_MODULE,
+ .open = tdg_attest_open,
+ .release = tdg_attest_release,
+ .unlocked_ioctl = tdg_attest_ioctl,
+ .llseek = no_llseek,
+};
+
+static struct miscdevice tdg_attest_device = {
+ .minor = MISC_DYNAMIC_MINOR,
+ .name = "tdx-attest",
+ .fops = &tdg_attest_fops,
+};
+module_misc_device(tdg_attest_device);
+
+MODULE_AUTHOR("Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>");
+MODULE_DESCRIPTION("TDX attestation driver ver " VERSION);
+MODULE_VERSION(VERSION);
+MODULE_LICENSE("GPL");
diff --git a/include/uapi/misc/tdx.h b/include/uapi/misc/tdx.h
new file mode 100644
index 000000000000..9afbef9079c1
--- /dev/null
+++ b/include/uapi/misc/tdx.h
@@ -0,0 +1,20 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef _UAPI_MISC_TDX_H
+#define _UAPI_MISC_TDX_H
+
+#include <linux/types.h>
+#include <linux/ioctl.h>
+
+/* Input report data length for TDX_CMD_GET_TDREPORT IOCTL request */
+#define TDX_REPORT_DATA_LEN 64
+/* Output report data length after TDX_CMD_GET_TDREPORT IOCTL execution */
+#define TDX_TDREPORT_LEN 1024
+
+/* IOCTL to request TDREPORT data from TDX Module */
+#define TDX_CMD_GET_TDREPORT _IOWR('T', 0x01, __u64)
+/* IOCTL to request Quote from VMM using report data */
+#define TDX_CMD_GEN_QUOTE _IOR('T', 0x02, __u64)
+/* Get current size of quote */
+#define TDX_CMD_GET_QUOTE_SIZE _IOR('T', 0x03, __u64)
+
+#endif /* _UAPI_MISC_TDX_H */
--
2.25.1
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH v1 5/6] platform/x86: intel_tdx_attest: Add TDX Guest attestation interface driver
2021-06-26 15:11 ` [PATCH v1 5/6] platform/x86: intel_tdx_attest: Add TDX Guest attestation interface driver Kuppuswamy Sathyanarayanan
@ 2021-07-06 9:48 ` Hans de Goede
0 siblings, 0 replies; 8+ messages in thread
From: Hans de Goede @ 2021-07-06 9:48 UTC (permalink / raw)
To: Kuppuswamy Sathyanarayanan, Thomas Gleixner, Ingo Molnar,
Borislav Petkov, Peter Zijlstra, Andy Lutomirski
Cc: Peter H Anvin, Dave Hansen, Tony Luck, Dan Williams, Andi Kleen,
Kirill Shutemov, Sean Christopherson, Kuppuswamy Sathyanarayanan,
x86, linux-kernel, Mark Gross, platform-driver-x86
Hi,
On 6/26/21 5:11 PM, Kuppuswamy Sathyanarayanan wrote:
> TDX guest supports encrypted disk as root or secondary drives.
> Decryption keys required to access such drives are usually maintained
> by 3rd party key servers. Attestation is required by 3rd party key
> servers to get the key for an encrypted disk volume, or possibly other
> encrypted services. Attestation is used to prove to the key server that
> the TD guest is running in a valid TD and the kernel and virtual BIOS
> and other environment are secure.
>
> During the boot process various components before the kernel accumulate
> hashes in the TDX module, which can then combined into a report. This
> would typically include a hash of the bios, bios configuration, boot
> loader, command line, kernel, initrd. After checking the hashes the
> key server will securely release the keys.
>
> The actual details of the attestation protocol depend on the particular
> key server configuration, but some parts are common and need to
> communicate with the TDX module.
>
> This communication is implemented in the attestation driver.
>
> The supported steps are:
>
> 1. TD guest generates the TDREPORT that contains version information
> about the Intel TDX module, measurement of the TD, along with a
> TD-specified nonce.
> 2. TD guest shares the TDREPORT with TD host via GetQuote hypercall
> which is used by the host to generate a quote via quoting
> enclave (QE).
> 3. Quote generation completion notification is sent to TD OS via
> callback interrupt vector configured by TD using
> SetupEventNotifyInterrupt hypercall.
> 4. After receiving the generated TDQUOTE, a remote verifier can be
> used to verify the quote and confirm the trustworthiness of the
> TD.
>
> Attestation agent uses IOCTLs implemented by the attestation driver to
> complete the various steps of the attestation process.
>
> Also note that, explicit access permissions are not enforced in this
> driver because the quote and measurements are not a secret. However
> the access permissions of the device node can be used to set any
> desired access policy. The udev default is usually root access
> only.
>
> TDX_CMD_GEN_QUOTE IOCTL can be used to create an computation on the
> host, but TDX assumes that the host is able to deal with malicious
> guest flooding it anyways.
>
> Cc: Hans de Goede <hdegoede@redhat.com>
> Cc: Mark Gross <mgross@linux.intel.com>
> Cc: platform-driver-x86@vger.kernel.org
> Reviewed-by: Tony Luck <tony.luck@intel.com>
> Reviewed-by: Andi Kleen <ak@linux.intel.com>
> Signed-off-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
You have only send this single patch of the 6 patch series to me /
to platform-driver-x86@vger.kernel.org, you did not send any of the
other patches, including the cover-letter to me nor to the
platform-driver-x86 list.
This means I don't have any context for this patch.
Worse this also means I won't receive any replies to the other emails
in this thread, thus missing out on any relevant discussion about
this series unless I manually search the archives for this which
I do not have time for.
So I'm simply going to drop this patch, for the next version please
make sure that you send the entire series, including the cover-letter
to me and to the platform-driver-x86 list.
Since this is part of a series, I assume that the code relies on
functions exported in earlier patches in the series, so that this
cannot be merged as a standalone patch ?
I also noticed that this patch introduces new userspace API in the
form of a new misc-device with IOCTLs, this is lacking 2 very
important things:
1. ioctls are generally seen as usually not the best interface to use
for new userspace API due to there multiplexing behavior where there is
no strong type checking on the passed arguments. Why did you e.g. not
choose to use a sysfs attribute interface instead ? Please explain
why this was done in the commit message for the next version.
2. Please add some documentation for the new userspace API.
Regards,
Hans
> ---
> drivers/platform/x86/Kconfig | 9 ++
> drivers/platform/x86/Makefile | 1 +
> drivers/platform/x86/intel_tdx_attest.c | 171 ++++++++++++++++++++++++
> include/uapi/misc/tdx.h | 20 +++
> 4 files changed, 201 insertions(+)
> create mode 100644 drivers/platform/x86/intel_tdx_attest.c
> create mode 100644 include/uapi/misc/tdx.h
>
> diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
> index 60592fb88e7a..7d01c473aef6 100644
> --- a/drivers/platform/x86/Kconfig
> +++ b/drivers/platform/x86/Kconfig
> @@ -1301,6 +1301,15 @@ config INTEL_SCU_IPC_UTIL
> low level access for debug work and updating the firmware. Say
> N unless you will be doing this on an Intel MID platform.
>
> +config INTEL_TDX_ATTESTATION
> + tristate "Intel TDX attestation driver"
> + depends on INTEL_TDX_GUEST
> + help
> + The TDX attestation driver provides IOCTL or MMAP interfaces to
> + the user to request TDREPORT from the TDX module or request quote
> + from VMM. It is mainly used to get secure disk decryption keys from
> + the key server.
> +
> config INTEL_TELEMETRY
> tristate "Intel SoC Telemetry Driver"
> depends on X86_64
> diff --git a/drivers/platform/x86/Makefile b/drivers/platform/x86/Makefile
> index dcc8cdb95b4d..83439990ae47 100644
> --- a/drivers/platform/x86/Makefile
> +++ b/drivers/platform/x86/Makefile
> @@ -138,6 +138,7 @@ obj-$(CONFIG_INTEL_SCU_PCI) += intel_scu_pcidrv.o
> obj-$(CONFIG_INTEL_SCU_PLATFORM) += intel_scu_pltdrv.o
> obj-$(CONFIG_INTEL_SCU_WDT) += intel_scu_wdt.o
> obj-$(CONFIG_INTEL_SCU_IPC_UTIL) += intel_scu_ipcutil.o
> +obj-$(CONFIG_INTEL_TDX_ATTESTATION) += intel_tdx_attest.o
> obj-$(CONFIG_INTEL_TELEMETRY) += intel_telemetry_core.o \
> intel_telemetry_pltdrv.o \
> intel_telemetry_debugfs.o
> diff --git a/drivers/platform/x86/intel_tdx_attest.c b/drivers/platform/x86/intel_tdx_attest.c
> new file mode 100644
> index 000000000000..a0225d053851
> --- /dev/null
> +++ b/drivers/platform/x86/intel_tdx_attest.c
> @@ -0,0 +1,171 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/*
> + * intel_tdx_attest.c - TDX guest attestation interface driver.
> + *
> + * Implements user interface to trigger attestation process and
> + * read the TD Quote result.
> + *
> + * Copyright (C) 2020 Intel Corporation
> + *
> + * Author:
> + * Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
> + */
> +
> +#define pr_fmt(fmt) "x86/tdx: attest: " fmt
> +
> +#include <linux/module.h>
> +#include <linux/miscdevice.h>
> +#include <linux/uaccess.h>
> +#include <linux/fs.h>
> +#include <linux/mm.h>
> +#include <linux/slab.h>
> +#include <linux/set_memory.h>
> +#include <linux/io.h>
> +#include <asm/apic.h>
> +#include <asm/tdx.h>
> +#include <asm/irq_vectors.h>
> +#include <uapi/misc/tdx.h>
> +
> +#define VERSION "1.0"
> +
> +/* Used in Quote memory allocation */
> +#define QUOTE_SIZE (2 * PAGE_SIZE)
> +
> +/* Mutex to synchronize attestation requests */
> +static DEFINE_MUTEX(attestation_lock);
> +/* Completion object to track attestation status */
> +static DECLARE_COMPLETION(attestation_done);
> +
> +static void attestation_callback_handler(void)
> +{
> + complete(&attestation_done);
> +}
> +
> +static long tdg_attest_ioctl(struct file *file, unsigned int cmd,
> + unsigned long arg)
> +{
> + u64 data = virt_to_phys(file->private_data);
> + void __user *argp = (void __user *)arg;
> + u8 *reportdata;
> + long ret = 0;
> +
> + mutex_lock(&attestation_lock);
> +
> + reportdata = kzalloc(TDX_TDREPORT_LEN, GFP_KERNEL);
> + if (!reportdata) {
> + mutex_unlock(&attestation_lock);
> + return -ENOMEM;
> + }
> +
> + switch (cmd) {
> + case TDX_CMD_GET_TDREPORT:
> + if (copy_from_user(reportdata, argp, TDX_REPORT_DATA_LEN)) {
> + ret = -EFAULT;
> + break;
> + }
> +
> + /* Generate TDREPORT_STRUCT */
> + if (tdx_mcall_tdreport(data, virt_to_phys(reportdata))) {
> + ret = -EIO;
> + break;
> + }
> +
> + if (copy_to_user(argp, file->private_data, TDX_TDREPORT_LEN))
> + ret = -EFAULT;
> + break;
> + case TDX_CMD_GEN_QUOTE:
> + if (copy_from_user(reportdata, argp, TDX_REPORT_DATA_LEN)) {
> + ret = -EFAULT;
> + break;
> + }
> +
> + /* Generate TDREPORT_STRUCT */
> + if (tdx_mcall_tdreport(data, virt_to_phys(reportdata))) {
> + ret = -EIO;
> + break;
> + }
> +
> + ret = set_memory_decrypted((unsigned long)file->private_data,
> + 1UL << get_order(QUOTE_SIZE));
> + if (ret)
> + break;
> +
> + /* Submit GetQuote Request */
> + if (tdx_hcall_get_quote(data)) {
> + ret = -EIO;
> + goto done;
> + }
> +
> + /* Wait for attestation completion */
> + wait_for_completion_interruptible(&attestation_done);
> +
> + if (copy_to_user(argp, file->private_data, QUOTE_SIZE))
> + ret = -EFAULT;
> +done:
> + ret = set_memory_encrypted((unsigned long)file->private_data,
> + 1UL << get_order(QUOTE_SIZE));
> +
> + break;
> + case TDX_CMD_GET_QUOTE_SIZE:
> + if (put_user(QUOTE_SIZE, (u64 __user *)argp))
> + ret = -EFAULT;
> +
> + break;
> + default:
> + pr_err("cmd %d not supported\n", cmd);
> + break;
> + }
> +
> + mutex_unlock(&attestation_lock);
> +
> + kfree(reportdata);
> +
> + return ret;
> +}
> +
> +static int tdg_attest_open(struct inode *inode, struct file *file)
> +{
> + /*
> + * Currently tdg_event_notify_handler is only used in attestation
> + * driver. But, WRITE_ONCE is used as benign data race notice.
> + */
> + WRITE_ONCE(tdg_event_notify_handler, attestation_callback_handler);
> +
> + file->private_data = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO,
> + get_order(QUOTE_SIZE));
> +
> + return !file->private_data ? -ENOMEM : 0;
> +}
> +
> +static int tdg_attest_release(struct inode *inode, struct file *file)
> +{
> + /*
> + * Currently tdg_event_notify_handler is only used in attestation
> + * driver. But, WRITE_ONCE is used as benign data race notice.
> + */
> + WRITE_ONCE(tdg_event_notify_handler, NULL);
> + free_pages((unsigned long)file->private_data, get_order(QUOTE_SIZE));
> + file->private_data = NULL;
> +
> + return 0;
> +}
> +
> +static const struct file_operations tdg_attest_fops = {
> + .owner = THIS_MODULE,
> + .open = tdg_attest_open,
> + .release = tdg_attest_release,
> + .unlocked_ioctl = tdg_attest_ioctl,
> + .llseek = no_llseek,
> +};
> +
> +static struct miscdevice tdg_attest_device = {
> + .minor = MISC_DYNAMIC_MINOR,
> + .name = "tdx-attest",
> + .fops = &tdg_attest_fops,
> +};
> +module_misc_device(tdg_attest_device);
> +
> +MODULE_AUTHOR("Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>");
> +MODULE_DESCRIPTION("TDX attestation driver ver " VERSION);
> +MODULE_VERSION(VERSION);
> +MODULE_LICENSE("GPL");
> diff --git a/include/uapi/misc/tdx.h b/include/uapi/misc/tdx.h
> new file mode 100644
> index 000000000000..9afbef9079c1
> --- /dev/null
> +++ b/include/uapi/misc/tdx.h
> @@ -0,0 +1,20 @@
> +/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
> +#ifndef _UAPI_MISC_TDX_H
> +#define _UAPI_MISC_TDX_H
> +
> +#include <linux/types.h>
> +#include <linux/ioctl.h>
> +
> +/* Input report data length for TDX_CMD_GET_TDREPORT IOCTL request */
> +#define TDX_REPORT_DATA_LEN 64
> +/* Output report data length after TDX_CMD_GET_TDREPORT IOCTL execution */
> +#define TDX_TDREPORT_LEN 1024
> +
> +/* IOCTL to request TDREPORT data from TDX Module */
> +#define TDX_CMD_GET_TDREPORT _IOWR('T', 0x01, __u64)
> +/* IOCTL to request Quote from VMM using report data */
> +#define TDX_CMD_GEN_QUOTE _IOR('T', 0x02, __u64)
> +/* Get current size of quote */
> +#define TDX_CMD_GET_QUOTE_SIZE _IOR('T', 0x03, __u64)
> +
> +#endif /* _UAPI_MISC_TDX_H */
>
^ permalink raw reply [flat|nested] 8+ messages in thread
* [PATCH v1 6/6] tools/tdx: Add a sample attestation user app
2021-06-26 15:11 [PATCH v1 0/6] Add TDX Guest Support (Attestation support) Kuppuswamy Sathyanarayanan
` (4 preceding siblings ...)
2021-06-26 15:11 ` [PATCH v1 5/6] platform/x86: intel_tdx_attest: Add TDX Guest attestation interface driver Kuppuswamy Sathyanarayanan
@ 2021-06-26 15:11 ` Kuppuswamy Sathyanarayanan
5 siblings, 0 replies; 8+ messages in thread
From: Kuppuswamy Sathyanarayanan @ 2021-06-26 15:11 UTC (permalink / raw)
To: Thomas Gleixner, Ingo Molnar, Borislav Petkov, Peter Zijlstra,
Andy Lutomirski
Cc: Peter H Anvin, Dave Hansen, Tony Luck, Dan Williams, Andi Kleen,
Kirill Shutemov, Sean Christopherson, Kuppuswamy Sathyanarayanan,
x86, linux-kernel, Alexei Starovoitov, bpf
This application uses the misc device /dev/tdx-attest to get TDREPORT
from the TDX Module or request quote from the VMM.
It tests following attestation features:
- Get report using TDX_CMD_GET_TDREPORT IOCTL.
- Using report data request quote from VMM using TDX_CMD_GEN_QUOTE IOCTL.
- Get the quote size using TDX_CMD_GET_QUOTE_SIZE IOCTL.
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: bpf@vger.kernel.org
Reviewed-by: Tony Luck <tony.luck@intel.com>
Reviewed-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
---
tools/Makefile | 13 +-
tools/tdx/Makefile | 19 +++
tools/tdx/attest/.gitignore | 2 +
tools/tdx/attest/Makefile | 24 +++
tools/tdx/attest/tdx-attest-test.c | 232 +++++++++++++++++++++++++++++
5 files changed, 284 insertions(+), 6 deletions(-)
create mode 100644 tools/tdx/Makefile
create mode 100644 tools/tdx/attest/.gitignore
create mode 100644 tools/tdx/attest/Makefile
create mode 100644 tools/tdx/attest/tdx-attest-test.c
diff --git a/tools/Makefile b/tools/Makefile
index 7e9d34ddd74c..5d68084511cb 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -30,6 +30,7 @@ help:
@echo ' selftests - various kernel selftests'
@echo ' bootconfig - boot config tool'
@echo ' spi - spi tools'
+ @echo ' tdx - TDX related test tools'
@echo ' tmon - thermal monitoring and tuning tool'
@echo ' tracing - misc tracing tools'
@echo ' turbostat - Intel CPU idle stats and freq reporting tool'
@@ -65,7 +66,7 @@ acpi: FORCE
cpupower: FORCE
$(call descend,power/$@)
-cgroup firewire hv guest bootconfig spi usb virtio vm bpf iio gpio objtool leds wmi pci firmware debugging tracing: FORCE
+cgroup firewire hv guest bootconfig spi usb virtio vm bpf iio gpio objtool leds wmi pci firmware debugging tracing tdx: FORCE
$(call descend,$@)
bpf/%: FORCE
@@ -104,7 +105,7 @@ all: acpi cgroup cpupower gpio hv firewire liblockdep \
perf selftests bootconfig spi turbostat usb \
virtio vm bpf x86_energy_perf_policy \
tmon freefall iio objtool kvm_stat wmi \
- pci debugging tracing
+ pci debugging tracing tdx
acpi_install:
$(call descend,power/$(@:_install=),install)
@@ -112,7 +113,7 @@ acpi_install:
cpupower_install:
$(call descend,power/$(@:_install=),install)
-cgroup_install firewire_install gpio_install hv_install iio_install perf_install bootconfig_install spi_install usb_install virtio_install vm_install bpf_install objtool_install wmi_install pci_install debugging_install tracing_install:
+cgroup_install firewire_install gpio_install hv_install iio_install perf_install bootconfig_install spi_install usb_install virtio_install vm_install bpf_install objtool_install wmi_install pci_install debugging_install tracing_install tdx_install:
$(call descend,$(@:_install=),install)
liblockdep_install:
@@ -139,7 +140,7 @@ install: acpi_install cgroup_install cpupower_install gpio_install \
virtio_install vm_install bpf_install x86_energy_perf_policy_install \
tmon_install freefall_install objtool_install kvm_stat_install \
wmi_install pci_install debugging_install intel-speed-select_install \
- tracing_install
+ tracing_install tdx_install
acpi_clean:
$(call descend,power/acpi,clean)
@@ -147,7 +148,7 @@ acpi_clean:
cpupower_clean:
$(call descend,power/cpupower,clean)
-cgroup_clean hv_clean firewire_clean bootconfig_clean spi_clean usb_clean virtio_clean vm_clean wmi_clean bpf_clean iio_clean gpio_clean objtool_clean leds_clean pci_clean firmware_clean debugging_clean tracing_clean:
+cgroup_clean hv_clean firewire_clean bootconfig_clean spi_clean usb_clean virtio_clean vm_clean wmi_clean bpf_clean iio_clean gpio_clean objtool_clean leds_clean pci_clean firmware_clean debugging_clean tracing_clean tdx_clean:
$(call descend,$(@:_clean=),clean)
liblockdep_clean:
@@ -186,6 +187,6 @@ clean: acpi_clean cgroup_clean cpupower_clean hv_clean firewire_clean \
vm_clean bpf_clean iio_clean x86_energy_perf_policy_clean tmon_clean \
freefall_clean build_clean libbpf_clean libsubcmd_clean liblockdep_clean \
gpio_clean objtool_clean leds_clean wmi_clean pci_clean firmware_clean debugging_clean \
- intel-speed-select_clean tracing_clean
+ intel-speed-select_clean tracing_clean tdx_clean
.PHONY: FORCE
diff --git a/tools/tdx/Makefile b/tools/tdx/Makefile
new file mode 100644
index 000000000000..e2564557d463
--- /dev/null
+++ b/tools/tdx/Makefile
@@ -0,0 +1,19 @@
+# SPDX-License-Identifier: GPL-2.0
+include ../scripts/Makefile.include
+
+all: attest
+
+clean: attest_clean
+
+install: attest_install
+
+attest:
+ $(call descend,attest)
+
+attest_install:
+ $(call descend,attest,install)
+
+attest_clean:
+ $(call descend,attest,clean)
+
+.PHONY: all install clean attest latency_install latency_clean
diff --git a/tools/tdx/attest/.gitignore b/tools/tdx/attest/.gitignore
new file mode 100644
index 000000000000..5f819a8a6c49
--- /dev/null
+++ b/tools/tdx/attest/.gitignore
@@ -0,0 +1,2 @@
+# SPDX-License-Identifier: GPL-2.0
+tdx-attest-test
diff --git a/tools/tdx/attest/Makefile b/tools/tdx/attest/Makefile
new file mode 100644
index 000000000000..bf47ba718386
--- /dev/null
+++ b/tools/tdx/attest/Makefile
@@ -0,0 +1,24 @@
+# SPDX-License-Identifier: GPL-2.0
+# Makefile for vm tools
+#
+VAR_CFLAGS := $(shell pkg-config --cflags libtracefs 2>/dev/null)
+VAR_LDLIBS := $(shell pkg-config --libs libtracefs 2>/dev/null)
+
+TARGETS = tdx-attest-test
+CFLAGS = -static -Wall -Wextra -g -O2 $(VAR_CFLAGS)
+LDFLAGS = -lpthread $(VAR_LDLIBS)
+
+all: $(TARGETS)
+
+%: %.c
+ $(CC) $(CFLAGS) -o $@ $< $(LDFLAGS)
+
+clean:
+ $(RM) tdx-attest-test
+
+prefix ?= /usr/local
+sbindir ?= ${prefix}/sbin
+
+install: all
+ install -d $(DESTDIR)$(sbindir)
+ install -m 755 -p $(TARGETS) $(DESTDIR)$(sbindir)
diff --git a/tools/tdx/attest/tdx-attest-test.c b/tools/tdx/attest/tdx-attest-test.c
new file mode 100644
index 000000000000..7634ec6a084c
--- /dev/null
+++ b/tools/tdx/attest/tdx-attest-test.c
@@ -0,0 +1,232 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * tdx-attest-test.c - utility to test TDX attestation feature.
+ *
+ * Copyright (C) 2020 - 2021 Intel Corporation. All rights reserved.
+ *
+ * Author: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
+ *
+ */
+
+#include <linux/types.h>
+#include <linux/ioctl.h>
+#include <sys/ioctl.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <stdio.h>
+#include <ctype.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <limits.h>
+#include <stdbool.h>
+#include <getopt.h>
+#include <stdint.h> /* uintmax_t */
+#include <sys/mman.h>
+#include <unistd.h> /* sysconf */
+#include <time.h>
+
+#include "../../../include/uapi/misc/tdx.h"
+
+#define devname "/dev/tdx-attest"
+
+#define HEX_DUMP_SIZE 16
+#define MAX_ROW_SIZE 70
+
+#define ATTESTATION_TEST_BIN_VERSION "0.1"
+
+struct tdx_attest_args {
+ bool is_dump_data;
+ bool is_get_tdreport;
+ bool is_get_quote_size;
+ bool is_gen_quote;
+ bool debug_mode;
+ char *out_file;
+};
+
+static void print_hex_dump(const char *title, const char *prefix_str,
+ const void *buf, int len)
+{
+ const __u8 *ptr = buf;
+ int i, rowsize = HEX_DUMP_SIZE;
+
+ if (!len || !buf)
+ return;
+
+ printf("\t\t%s", title);
+
+ for (i = 0; i < len; i++) {
+ if (!(i % rowsize))
+ printf("\n%s%.8x:", prefix_str, i);
+ printf(" %.2x", ptr[i])
+ }
+
+ printf("\n");
+}
+
+static void gen_report_data(__u8 *report_data, bool dump_data)
+{
+ int i;
+
+ srand(time(NULL));
+
+ for (i = 0; i < TDX_REPORT_DATA_LEN; i++)
+ report_data[i] = rand();
+
+ if (dump_data)
+ print_hex_dump("\n\t\tTDX report data\n", " ",
+ report_data, TDX_REPORT_DATA_LEN);
+}
+
+static int get_tdreport(int devfd, bool dump_data, __u8 *report_data)
+{
+ __u8 tdrdata[TDX_TDREPORT_LEN] = {0};
+ int ret;
+
+ if (!report_data)
+ report_data = tdrdata;
+
+ gen_report_data(report_data, dump_data);
+
+ ret = ioctl(devfd, TDX_CMD_GET_TDREPORT, report_data);
+ if (ret) {
+ printf("TDX_CMD_GET_TDREPORT ioctl() %d failed\n", ret);
+ return -EIO;
+ }
+
+ if (dump_data)
+ print_hex_dump("\n\t\tTDX tdreport data\n", " ", report_data,
+ TDX_TDREPORT_LEN);
+
+ return 0;
+}
+
+static __u64 get_quote_size(int devfd)
+{
+ int ret;
+ __u64 quote_size;
+
+ ret = ioctl(devfd, TDX_CMD_GET_QUOTE_SIZE, "e_size);
+ if (ret) {
+ printf("TDX_CMD_GET_QUOTE_SIZE ioctl() %d failed\n", ret);
+ return -EIO;
+ }
+
+ printf("Quote size: %lld\n", quote_size);
+
+ return quote_size;
+}
+
+static int gen_quote(int devfd, bool dump_data)
+{
+ __u8 *quote_data;
+ __u64 quote_size;
+ int ret;
+
+ quote_size = get_quote_size(devfd);
+
+ quote_data = malloc(sizeof(char) * quote_size);
+ if (!quote_data) {
+ printf("%s queue data alloc failed\n", devname);
+ return -ENOMEM;
+ }
+
+ ret = get_tdreport(devfd, dump_data, quote_data);
+ if (ret) {
+ printf("TDX_CMD_GET_TDREPORT ioctl() %d failed\n", ret);
+ goto done;
+ }
+
+ ret = ioctl(devfd, TDX_CMD_GEN_QUOTE, quote_data);
+ if (ret) {
+ printf("TDX_CMD_GEN_QUOTE ioctl() %d failed\n", ret);
+ goto done;
+ }
+
+ print_hex_dump("\n\t\tTDX Quote MMIO data\n", " ", quote_data,
+ quote_size);
+
+done:
+ free(quote_data);
+
+ return ret;
+}
+
+static void usage(void)
+{
+ puts("\nUsage:\n");
+ puts("tdx_attest [options] \n");
+
+ puts("Attestation device test utility.");
+
+ puts("\nOptions:\n");
+ puts(" -d, --dump Dump tdreport/tdquote data");
+ puts(" -r, --get-tdreport Get TDREPORT data");
+ puts(" -g, --gen-quote Generate TDQUOTE");
+ puts(" -s, --get-quote-size Get TDQUOTE size");
+}
+
+int main(int argc, char **argv)
+{
+ int ret, devfd;
+ struct tdx_attest_args args = {0};
+
+ static const struct option longopts[] = {
+ { "dump", no_argument, NULL, 'd' },
+ { "get-tdreport", required_argument, NULL, 'r' },
+ { "gen-quote", required_argument, NULL, 'g' },
+ { "gen-quote-size", required_argument, NULL, 's' },
+ { "version", no_argument, NULL, 'V' },
+ { NULL, 0, NULL, 0 }
+ };
+
+ while ((ret = getopt_long(argc, argv, "hdrgsV", longopts,
+ NULL)) != -1) {
+ switch (ret) {
+ case 'd':
+ args.is_dump_data = true;
+ break;
+ case 'r':
+ args.is_get_tdreport = true;
+ break;
+ case 'g':
+ args.is_gen_quote = true;
+ break;
+ case 's':
+ args.is_get_quote_size = true;
+ break;
+ case 'h':
+ usage();
+ return 0;
+ case 'V':
+ printf("Version: %s\n", ATTESTATION_TEST_BIN_VERSION);
+ return 0;
+ default:
+ printf("Invalid options\n");
+ usage();
+ return -EINVAL;
+ }
+ }
+
+ devfd = open(devname, O_RDWR | O_SYNC);
+ if (devfd < 0) {
+ printf("%s open() failed\n", devname);
+ return -ENODEV;
+ }
+
+ if (args.is_get_quote_size)
+ get_quote_size(devfd);
+
+ if (args.is_get_tdreport)
+ get_tdreport(devfd, args.is_dump_data, NULL);
+
+ if (args.is_gen_quote)
+ gen_quote(devfd, args.is_dump_data);
+
+ close(devfd);
+
+ return 0;
+}
--
2.25.1
^ permalink raw reply [flat|nested] 8+ messages in thread