From: Sathyanarayanan Kuppuswamy <sathyanarayanan.kuppuswamy@linux.intel.com>
To: Kai Huang <kai.huang@intel.com>,
Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
Dave Hansen <dave.hansen@linux.intel.com>,
x86@kernel.org
Cc: "H . Peter Anvin" <hpa@zytor.com>,
"Kirill A . Shutemov" <kirill.shutemov@linux.intel.com>,
Tony Luck <tony.luck@intel.com>, Andi Kleen <ak@linux.intel.com>,
Wander Lairson Costa <wander@redhat.com>,
Isaku Yamahata <isaku.yamahata@gmail.com>,
marcelo.cerri@canonical.com, tim.gardner@canonical.com,
khalid.elmously@canonical.com, philip.cox@canonical.com,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH v5 3/3] x86/tdx: Add Quote generation support
Date: Mon, 2 May 2022 09:02:27 -0700 [thread overview]
Message-ID: <aae6c58c-a89f-e24c-946b-c16b2415c77e@linux.intel.com> (raw)
In-Reply-To: <7daf429ffda2bf834c129899426e204fbbcbd0b0.camel@intel.com>
Hi Kai,
On 5/1/22 10:01 PM, Kai Huang wrote:
>
>> +
>> +static long tdx_get_quote(void __user *argp)
>> +{
>> + struct tdx_quote_req quote_req;
>> + long ret = 0;
>> + int order;
>> +
>> + /* Hold lock to serialize GetQuote requests */
>> + mutex_lock("e_lock);
>> +
>> + reinit_completion(&req_compl);
>> +
>> + /* Copy GetQuote request struct from user buffer */
>> + if (copy_from_user("e_req, argp, sizeof(struct tdx_quote_req))) {
>> + ret = -EFAULT;
>> + goto quote_failed;
>> + }
>> +
>> + /* Make sure the length & timeout is valid */
>> + if (!quote_req.len || !quote_req.timeout) {
>> + ret = -EINVAL;
>> + goto quote_failed;
>> + }
>> +
>> + /* Get order for Quote buffer page allocation */
>> + order = get_order(quote_req.len);
>> +
>> + /*
>> + * Allocate buffer to get TD Quote from the VMM.
>> + * Size needs to be 4KB aligned (which is already
>> + * met in page allocation).
>> + */
>> + tdquote = (void *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, order);
>> + if (!tdquote) {
>> + ret = -ENOMEM;
>> + goto quote_failed;
>> + }
>> +
>> + /*
>> + * Since this buffer will be shared with the VMM via GetQuote
>> + * hypercall, decrypt it.
>> + */
>> + ret = set_memory_decrypted((unsigned long)tdquote, 1UL << order);
>> + if (ret)
>> + goto quote_failed;
>> +
>> + /* Copy TDREPORT from user buffer to kernel Quote buffer */
>> + if (copy_from_user(tdquote, (void __user *)quote_req.buf, quote_req.len)) {
>> + ret = -EFAULT;
>> + goto quote_failed;
>> + }
>> +
>> + /* Submit GetQuote Request */
>> + ret = tdx_get_quote_hypercall(tdquote, (1ULL << order) * PAGE_SIZE);
>> + if (ret) {
>> + pr_err("GetQuote hypercall failed, status:%lx\n", ret);
>> + ret = -EIO;
>> + goto quote_failed;
>> + }
>> +
>> + /* Wait for attestation completion */
>> + ret = wait_for_completion_interruptible(&req_compl);
>> + if (ret <= 0) {
>> + ret = -EIO;
>> + goto quote_failed;
>> + }
>> +
>> + /* Copy output data back to user buffer */
>> + if (copy_to_user((void __user *)quote_req.buf, tdquote, quote_req.len))
>> + ret = -EFAULT;
>> +
>> +quote_failed:
>> + if (tdquote)
>> + free_pages((unsigned long)tdquote, order);
>
> The buffer is freed w/o being converted back to private. How can you prevent
> the buffer from being allocated by kernel and used as private pages again?
Yes. It needs set_memory_encrypted() call here. I will fix this in next
version.
>
> Also, the buffer may be still used by VMM when timeout (IN_FLIGHT), how can
> this even work?
We will never reach here for IN_FLIGHT case. We will block in
wait_for_completion_interruptible() till the status changes to success
or failure.
>
>> + tdquote = NULL;
>> + mutex_unlock("e_lock);
>> + return ret;
>> +}
>> +
>> +static void attestation_callback_handler(void)
>> +{
>> + struct tdx_quote_hdr *quote_hdr;
>> +
>> + quote_hdr = (struct tdx_quote_hdr *) tdquote;
>> +
>> + /* Check for spurious callback IRQ case */
>> + if (!tdquote || quote_hdr->status == GET_QUOTE_IN_FLIGHT)
>> + return;
>
> I don't get the logic. Please explain.
I am trying to handle spurious IRQ case here. If we receive a callback
IRQ from VMM before even we allocate tdquote or post the GetQuote
request, accessing quote_hdr->status will lead to NULL pointer
exception. So I have added check for valid quote buffer (tdquote !=
NULL)
Second condition (quote_hdr->status == GET_QUOTE_IN_FLIGHT)) makes
sure we don't mark the current quote request complete until the
Quote buffer status changes to GET_QUOTE_SUCCESS, GET_QUOTE_ERROR or
GET_QUOTE_SERVICE_UNAVAILABLE.
>
>> +
>> + complete(&req_compl);
>> +}
>> +
>
--
Sathyanarayanan Kuppuswamy
Linux Kernel Developer
next prev parent reply other threads:[~2022-05-02 16:03 UTC|newest]
Thread overview: 56+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-05-01 18:34 [PATCH v5 0/3] Add TDX Guest Attestation support Kuppuswamy Sathyanarayanan
2022-05-01 18:34 ` [PATCH v5 1/3] x86/tdx: Add TDX Guest attestation interface driver Kuppuswamy Sathyanarayanan
2022-05-02 2:31 ` Kai Huang
2022-05-02 15:52 ` Sathyanarayanan Kuppuswamy
2022-05-02 22:30 ` Kai Huang
2022-05-02 23:17 ` Sathyanarayanan Kuppuswamy
2022-05-02 23:37 ` Kai Huang
2022-05-03 14:38 ` Wander Costa
2022-05-03 15:09 ` Sathyanarayanan Kuppuswamy
2022-05-03 22:08 ` Kai Huang
2022-05-02 12:18 ` Wander Lairson Costa
2022-05-02 16:06 ` Sathyanarayanan Kuppuswamy
2022-05-01 18:34 ` [PATCH v5 2/3] x86/tdx: Add TDX Guest event notify interrupt support Kuppuswamy Sathyanarayanan
2022-05-02 12:44 ` Wander Lairson Costa
2022-05-01 18:35 ` [PATCH v5 3/3] x86/tdx: Add Quote generation support Kuppuswamy Sathyanarayanan
2022-05-02 2:40 ` Kai Huang
2022-05-03 1:27 ` Kirill A. Shutemov
2022-05-03 2:18 ` Kai Huang
2022-05-03 2:39 ` Sathyanarayanan Kuppuswamy
2022-05-03 22:13 ` Kai Huang
2022-05-03 2:45 ` Kirill A. Shutemov
2022-05-03 3:36 ` Kai Huang
2022-05-03 22:24 ` Dave Hansen
2022-05-03 22:28 ` Sathyanarayanan Kuppuswamy
2022-05-03 22:30 ` Sathyanarayanan Kuppuswamy
2022-05-04 22:49 ` Sathyanarayanan Kuppuswamy
2022-05-04 23:28 ` Kai Huang
2022-05-05 20:53 ` Sathyanarayanan Kuppuswamy
2022-05-05 22:15 ` Kai Huang
2022-05-05 22:38 ` Sathyanarayanan Kuppuswamy
2022-05-05 23:06 ` Dave Hansen
2022-05-06 0:11 ` Kai Huang
2022-05-06 1:55 ` Sathyanarayanan Kuppuswamy
2022-05-07 0:42 ` Kirill A. Shutemov
2022-05-09 3:37 ` Kai Huang
2022-05-09 12:09 ` Kirill A. Shutemov
2022-05-09 14:14 ` Dave Hansen
2022-05-09 15:35 ` Kirill A. Shutemov
2022-05-09 15:43 ` Sathyanarayanan Kuppuswamy
2022-05-09 23:54 ` Kai Huang
2022-05-10 0:17 ` Sathyanarayanan Kuppuswamy
2022-05-10 1:30 ` Kirill A. Shutemov
2022-05-10 1:40 ` Kai Huang
2022-05-10 10:42 ` Kai Huang
2022-05-16 17:39 ` Sathyanarayanan Kuppuswamy
2022-05-06 11:00 ` Kai Huang
2022-05-06 15:47 ` Dave Hansen
2022-05-07 1:00 ` Kirill A. Shutemov
2022-05-05 10:50 ` Kai Huang
2022-05-05 19:03 ` Sathyanarayanan Kuppuswamy
2022-05-05 22:25 ` Kai Huang
2022-05-02 5:01 ` Kai Huang
2022-05-02 16:02 ` Sathyanarayanan Kuppuswamy [this message]
2022-05-02 23:02 ` Kai Huang
2022-05-02 13:16 ` Wander Lairson Costa
2022-05-02 16:05 ` Sathyanarayanan Kuppuswamy
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aae6c58c-a89f-e24c-946b-c16b2415c77e@linux.intel.com \
--to=sathyanarayanan.kuppuswamy@linux.intel.com \
--cc=ak@linux.intel.com \
--cc=bp@alien8.de \
--cc=dave.hansen@linux.intel.com \
--cc=hpa@zytor.com \
--cc=isaku.yamahata@gmail.com \
--cc=kai.huang@intel.com \
--cc=khalid.elmously@canonical.com \
--cc=kirill.shutemov@linux.intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=marcelo.cerri@canonical.com \
--cc=mingo@redhat.com \
--cc=philip.cox@canonical.com \
--cc=tglx@linutronix.de \
--cc=tim.gardner@canonical.com \
--cc=tony.luck@intel.com \
--cc=wander@redhat.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).