• Dan Williams's avatar
    virt: sevguest: Add TSM_REPORTS support for SNP_GET_EXT_REPORT · f4790678
    Dan Williams authored
    The sevguest driver was a first mover in the confidential computing
    space. As a first mover that afforded some leeway to build the driver
    without concern for common infrastructure.
    
    Now that sevguest is no longer a singleton [1] the common operation of
    building and transmitting attestation report blobs can / should be made
    common. In this model the so called "TSM-provider" implementations can
    share a common envelope ABI even if the contents of that envelope remain
    vendor-specific. When / if the industry agrees on an attestation record
    format, that definition can also fit in the same ABI. In the meantime
    the kernel's maintenance burden is reduced and collaboration on the
    commons is increased.
    
    Convert sevguest to use CONFIG_TSM_REPORTS to retrieve the data that
    the SNP_GET_EXT_REPORT ioctl produces. An example flow follows for
    retrieving the report blob via the TSM interface utility,
    assuming no nonce and VMPL==2:
    
        report=/sys/kernel/config/tsm/report/report0
        mkdir $report
        echo 2 > $report/privlevel
        dd if=/dev/urandom bs=64 count=1 > $report/inblob
        hexdump -C $report/outblob # SNP report
        hexdump -C $report/auxblob # cert_table
        rmdir $report
    
    Given that the platform implementation is free to return empty
    certificate data if none is available it lets configfs-tsm be simplified
    as it only needs to worry about wrapping SNP_GET_EXT_REPORT, and leave
    SNP_GET_REPORT alone.
    
    The old ioctls can be lazily deprecated, the main motivation of this
    effort is to stop the proliferation of new ioctls, and to increase
    cross-vendor collaboration.
    
    Link: http://lore.kernel.org/r/64961c3baf8ce_142af829436@dwillia2-xfh.jf.intel.com.notmuch [1]
    Cc: Borislav Petkov <bp@alien8.de>
    Cc: Tom Lendacky <thomas.lendacky@amd.com>
    Cc: Dionna Glaze <dionnaglaze@google.com>
    Cc: Jeremi Piotrowski <jpiotrowski@linux.microsoft.com>
    Tested-by: default avatarKuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
    Tested-by: default avatarAlexey Kardashevskiy <aik@amd.com>
    Reviewed-by: default avatarTom Lendacky <thomas.lendacky@amd.com>
    Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
    f4790678
sev-guest.c 27.5 KB