From: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
To: Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
Dave Hansen <dave.hansen@linux.intel.com>,
x86@kernel.org
Cc: "H . Peter Anvin" <hpa@zytor.com>,
Kuppuswamy Sathyanarayanan
<sathyanarayanan.kuppuswamy@linux.intel.com>,
"Kirill A . Shutemov" <kirill.shutemov@linux.intel.com>,
Tony Luck <tony.luck@intel.com>, Andi Kleen <ak@linux.intel.com>,
Kai Huang <kai.huang@intel.com>,
linux-kernel@vger.kernel.org
Subject: [PATCH v4 0/3] Add TDX Guest Attestation support
Date: Fri, 22 Apr 2022 16:34:15 -0700 [thread overview]
Message-ID: <20220422233418.1203092-1-sathyanarayanan.kuppuswamy@linux.intel.com> (raw)
Hi All,
Intel's Trust Domain Extensions (TDX) protect guest VMs from malicious
hosts and some physical attacks. VM guest with TDX support is called
as TD Guest.
In TD Guest, the attestation process is used to verify the
trustworthiness of TD guest to the 3rd party servers. Such attestation
process is required by 3rd party servers before sending sensitive
information to TD guests. One usage example is to get encryption keys
from the key server for mounting the encrypted rootfs or secondary drive.
Following patches add the attestation support to TDX guest which
includes attestation user interface driver and related hypercall support.
Any distribution enabling TDX is also expected to need attestation. So
enable it by default with TDX guest support. The compiled size is
quite small (500 bytes).
Dependencies:
--------------
This feature has dependency on TDX guest core patch set series.
https://lore.kernel.org/all/20220218161718.67148-1-kirill.shutemov@linux.intel.com/T/
Changes since v3:
* Moved the attestation driver from platform/x86 to arch/x86/coco/tdx/ and
renamed intel_tdx_attest.c to attest.c.
* Dropped CONFIG_INTEL_TDX_ATTESTATION and added support to compile
attestation changes with CONFIG_INTEL_TDX_GUEST option.
* Merged patch titled "x86/tdx: Add tdx_mcall_tdreport() API support" and
"platform/x86: intel_tdx_attest: Add TDX Guest attestation interface" into
a single patch.
* Moved GetQuote IOCTL support changes from patch titled "platform/x86:
intel_tdx_attest: Add TDX Guest attestation interface driver" to a
separate patch.
* Removed 8K size restriction when requesting quote, and added support
to let userspace decide the quote size.
* Added support to allow attestation agent configure quote generation
timeout value.
* Fixed commit log and comments as per review comments.
Changes since v2:
* As per Han's suggestion, modified the attestation driver to use
platform device driver model.
* Modified tdx_hcall_get_quote() and tdx_mcall_tdreport() APIs to
return TDCALL error code instead of generic error info (like -EIO).
* Removed attestation test app patch from this series to simplify
the patchset and review process. Test app patches will be submitted
once attestation support patches are merged.
* Since patches titled "x86/tdx: Add SetupEventNotifyInterrupt TDX
hypercall support" and "x86/tdx: Add TDX Guest event notify
interrupt vector support" are related, combining them into a
single patch.
Changes since v1:
* Moved test driver from "tools/tdx/attest/tdx-attest-test.c" to
"tools/arch/x86/tdx/attest/tdx-attest-test.c" as per Hans review
suggestion.
* Minor commit log and comment fixes in patches titled
"x86/tdx: Add tdx_mcall_tdreport() API support" and "x86/tdx:
Add tdx_hcall_get_quote() API support"
* Extended tdx_hcall_get_quote() API to accept GPA length as argument
to accomodate latest TDQUOTE TDVMCALL related specification update.
* Added support for tdx_setup_ev_notify_handler() and
tdx_remove_ev_notify_handler() in patch titled "x86/tdx: Add TDX
Guest event notify interrupt vector support"
Kuppuswamy Sathyanarayanan (3):
x86/tdx: Add TDX Guest attestation interface driver
x86/tdx: Add TDX Guest event notify interrupt support
x86/tdx: Add Quote generation support
arch/x86/coco/tdx/Makefile | 2 +-
arch/x86/coco/tdx/attest.c | 305 +++++++++++++++++++++++++++++
arch/x86/coco/tdx/tdx.c | 159 +++++++++++++++
arch/x86/include/asm/hardirq.h | 3 +
arch/x86/include/asm/idtentry.h | 4 +
arch/x86/include/asm/irq_vectors.h | 7 +-
arch/x86/include/asm/tdx.h | 8 +
arch/x86/include/uapi/asm/tdx.h | 59 ++++++
arch/x86/kernel/irq.c | 7 +
9 files changed, 552 insertions(+), 2 deletions(-)
create mode 100644 arch/x86/coco/tdx/attest.c
create mode 100644 arch/x86/include/uapi/asm/tdx.h
--
2.25.1
next reply other threads:[~2022-04-22 23:38 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-04-22 23:34 Kuppuswamy Sathyanarayanan [this message]
2022-04-22 23:34 ` [PATCH v4 1/3] x86/tdx: Add TDX Guest attestation interface driver Kuppuswamy Sathyanarayanan
2022-04-25 5:44 ` Kai Huang
2022-04-26 19:07 ` Sathyanarayanan Kuppuswamy
2022-04-27 5:15 ` Kai Huang
2022-04-27 21:45 ` Sathyanarayanan Kuppuswamy
2022-04-27 23:40 ` Kai Huang
2022-04-28 0:40 ` Sathyanarayanan Kuppuswamy
2022-04-27 4:05 ` Sathyanarayanan Kuppuswamy
2022-04-27 4:28 ` Kai Huang
2022-04-27 14:09 ` Sathyanarayanan Kuppuswamy
2022-04-27 5:45 ` Isaku Yamahata
2022-04-27 5:57 ` Kai Huang
2022-04-27 22:08 ` Sathyanarayanan Kuppuswamy
2022-04-28 17:45 ` Wander Lairson Costa
2022-04-28 17:56 ` Sathyanarayanan Kuppuswamy
2022-04-28 18:04 ` Dave Hansen
2022-04-28 18:18 ` Sathyanarayanan Kuppuswamy
2022-04-22 23:34 ` [PATCH v4 2/3] x86/tdx: Add TDX Guest event notify interrupt support Kuppuswamy Sathyanarayanan
2022-04-28 17:50 ` Wander Lairson Costa
2022-04-28 17:57 ` Sathyanarayanan Kuppuswamy
2022-04-22 23:34 ` [PATCH v4 3/3] x86/tdx: Add Quote generation support Kuppuswamy Sathyanarayanan
2022-04-26 9:47 ` Kai Huang
2022-05-01 0:52 ` Sathyanarayanan Kuppuswamy
2022-04-27 6:14 ` Isaku Yamahata
2022-05-01 1:02 ` Sathyanarayanan Kuppuswamy
2022-04-28 17:58 ` Wander Lairson Costa
2022-04-28 18:11 ` Sathyanarayanan Kuppuswamy
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220422233418.1203092-1-sathyanarayanan.kuppuswamy@linux.intel.com \
--to=sathyanarayanan.kuppuswamy@linux.intel.com \
--cc=ak@linux.intel.com \
--cc=bp@alien8.de \
--cc=dave.hansen@linux.intel.com \
--cc=hpa@zytor.com \
--cc=kai.huang@intel.com \
--cc=kirill.shutemov@linux.intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=tglx@linutronix.de \
--cc=tony.luck@intel.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).