lkml.org 
[lkml]   [2022]   [Dec]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH RFC v7 32/64] crypto: ccp: Provide APIs to query extended attestation report
    Date
    From: Brijesh Singh <brijesh.singh@amd.com>

    Version 2 of the GHCB specification defines VMGEXIT that is used to get
    the extended attestation report. The extended attestation report includes
    the certificate blobs provided through the SNP_SET_EXT_CONFIG.

    The snp_guest_ext_guest_request() will be used by the hypervisor to get
    the extended attestation report. See the GHCB specification for more
    details.

    Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
    Signed-off-by: Ashish Kalra <ashish.kalra@amd.com>
    Signed-off-by: Michael Roth <michael.roth@amd.com>
    ---
    drivers/crypto/ccp/sev-dev.c | 48 ++++++++++++++++++++++++++++++++++++
    include/linux/psp-sev.h | 33 +++++++++++++++++++++++++
    2 files changed, 81 insertions(+)

    diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c
    index d59727ac2bdd..d4f13e5a8dde 100644
    --- a/drivers/crypto/ccp/sev-dev.c
    +++ b/drivers/crypto/ccp/sev-dev.c
    @@ -27,6 +27,7 @@

    #include <asm/smp.h>
    #include <asm/e820/types.h>
    +#include <asm/sev.h>

    #include "psp-dev.h"
    #include "sev-dev.h"
    @@ -2016,6 +2017,53 @@ int sev_guest_df_flush(int *error)
    }
    EXPORT_SYMBOL_GPL(sev_guest_df_flush);

    +int snp_guest_ext_guest_request(struct sev_data_snp_guest_request *data,
    + unsigned long vaddr, unsigned long *npages, unsigned long *fw_err)
    +{
    + unsigned long expected_npages;
    + struct sev_device *sev;
    + int rc;
    +
    + if (!psp_master || !psp_master->sev_data)
    + return -ENODEV;
    +
    + sev = psp_master->sev_data;
    +
    + if (!sev->snp_initialized)
    + return -EINVAL;
    +
    + mutex_lock(&sev->snp_certs_lock);
    + /*
    + * Check if there is enough space to copy the certificate chain. Otherwise
    + * return ERROR code defined in the GHCB specification.
    + */
    + expected_npages = sev->snp_certs_len >> PAGE_SHIFT;
    + if (*npages < expected_npages) {
    + *npages = expected_npages;
    + *fw_err = SNP_GUEST_REQ_INVALID_LEN;
    + mutex_unlock(&sev->snp_certs_lock);
    + return -EINVAL;
    + }
    +
    + rc = sev_do_cmd(SEV_CMD_SNP_GUEST_REQUEST, data, (int *)fw_err);
    + if (rc) {
    + mutex_unlock(&sev->snp_certs_lock);
    + return rc;
    + }
    +
    + /* Copy the certificate blob */
    + if (sev->snp_certs_data) {
    + *npages = expected_npages;
    + memcpy((void *)vaddr, sev->snp_certs_data, *npages << PAGE_SHIFT);
    + } else {
    + *npages = 0;
    + }
    +
    + mutex_unlock(&sev->snp_certs_lock);
    + return rc;
    +}
    +EXPORT_SYMBOL_GPL(snp_guest_ext_guest_request);
    +
    static void sev_exit(struct kref *ref)
    {
    misc_deregister(&misc_dev->misc);
    diff --git a/include/linux/psp-sev.h b/include/linux/psp-sev.h
    index d19744807471..81bafc049eca 100644
    --- a/include/linux/psp-sev.h
    +++ b/include/linux/psp-sev.h
    @@ -931,6 +931,32 @@ void snp_free_firmware_page(void *addr);
    */
    void snp_mark_pages_offline(unsigned long pfn, unsigned int npages);

    +/**
    + * snp_guest_ext_guest_request - perform the SNP extended guest request command
    + * defined in the GHCB specification.
    + *
    + * @data: the input guest request structure
    + * @vaddr: address where the certificate blob need to be copied.
    + * @npages: number of pages for the certificate blob.
    + * If the specified page count is less than the certificate blob size, then the
    + * required page count is returned with error code defined in the GHCB spec.
    + * If the specified page count is more than the certificate blob size, then
    + * page count is updated to reflect the amount of valid data copied in the
    + * vaddr.
    + *
    + * @sev_ret: sev command return code
    + *
    + * Returns:
    + * 0 if the sev successfully processed the command
    + * -%ENODEV if the sev device is not available
    + * -%ENOTSUPP if the sev does not support SEV
    + * -%ETIMEDOUT if the sev command timed out
    + * -%EIO if the sev returned a non-zero return code
    + */
    +int snp_guest_ext_guest_request(struct sev_data_snp_guest_request *data,
    + unsigned long vaddr, unsigned long *npages,
    + unsigned long *error);
    +
    #else /* !CONFIG_CRYPTO_DEV_SP_PSP */

    static inline int
    @@ -968,6 +994,13 @@ static inline void *snp_alloc_firmware_page(gfp_t mask)

    static inline void snp_free_firmware_page(void *addr) { }

    +static inline int snp_guest_ext_guest_request(struct sev_data_snp_guest_request *data,
    + unsigned long vaddr, unsigned long *n,
    + unsigned long *error)
    +{
    + return -ENODEV;
    +}
    +
    #endif /* CONFIG_CRYPTO_DEV_SP_PSP */

    #endif /* __PSP_SEV_H__ */
    --
    2.25.1
    \
     
     \ /
      Last update: 2022-12-14 21:02    [W:2.231 / U:25.760 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site