lkml.org 
[lkml]   [2021]   [Jul]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Subject[PATCH v2 0/6] Add TDX Guest Support (Attestation support)
    Date
    Hi All,

    Intel's Trust Domain Extensions (TDX) protect guest VMs from malicious
    hosts and some physical attacks. VM guest with TDX support is called
    as TD Guest.

    In TD Guest, the attestation process is used to verify the
    trustworthiness of TD guest to the 3rd party servers. Such attestation
    process is required by 3rd party servers before sending sensitive
    information to TD guests. One usage example is to get encryption keys
    from the key server for mounting the encrypted rootfs or secondary drive.

    Following patches adds the attestation support to TDX guest which
    includes attestation user interface driver, user agent example, and
    related hypercall support.

    In this series, only following patches are in arch/x86 and are
    intended for x86 maintainers review.

    * x86/tdx: Add TDREPORT TDX Module call support
    * x86/tdx: Add GetQuote TDX hypercall support
    * x86/tdx: Add SetupEventNotifyInterrupt TDX hypercall support

    Patch titled "platform/x86: intel_tdx_attest: Add TDX Guest attestation
    interface driver" adds the attestation driver support. This is supposed
    to be reviewed by platform-x86 maintainers.

    Also, patch titled "tools/tdx: Add a sample attestation user app" adds
    a testing app for attestation feature which needs review from
    bpf@vger.kernel.org.

    This series is the continuation of the following TDX patch series which
    added basic TDX guest support.

    [set 1] - https://lore.kernel.org/patchwork/project/lkml/list/?series=505232
    [set 2] - https://lore.kernel.org/patchwork/project/lkml/list/?series=506230
    [set 3] - https://lore.kernel.org/patchwork/project/lkml/list/?series=506231
    [set 4] - https://lore.kernel.org/patchwork/project/lkml/list/?series=506232
    [set 5] - https://lore.kernel.org/patchwork/project/lkml/list/?series=506233

    Also please note that this series alone is not necessarily fully
    functional.

    You can find TDX related documents in the following link.

    https://software.intel.com/content/www/br/pt/develop/articles/intel-trust-domain-extensions.html

    Changes since v1:
    * Included platform-x86 and test tool maintainers in recipient list.
    * Fixed commit log and comments in attestation driver as per Han's comments.


    Kuppuswamy Sathyanarayanan (6):
    x86/tdx: Add TDREPORT TDX Module call support
    x86/tdx: Add GetQuote TDX hypercall support
    x86/tdx: Add SetupEventNotifyInterrupt TDX hypercall support
    x86/tdx: Add TDX Guest event notify interrupt vector support
    platform/x86: intel_tdx_attest: Add TDX Guest attestation interface
    driver
    tools/tdx: Add a sample attestation user app

    arch/x86/include/asm/hardirq.h | 1 +
    arch/x86/include/asm/idtentry.h | 4 +
    arch/x86/include/asm/irq_vectors.h | 7 +-
    arch/x86/include/asm/tdx.h | 6 +
    arch/x86/kernel/irq.c | 7 +
    arch/x86/kernel/tdx.c | 129 +++++++++++++
    drivers/platform/x86/Kconfig | 9 +
    drivers/platform/x86/Makefile | 1 +
    drivers/platform/x86/intel_tdx_attest.c | 171 +++++++++++++++++
    include/uapi/misc/tdx.h | 37 ++++
    tools/Makefile | 13 +-
    tools/tdx/Makefile | 19 ++
    tools/tdx/attest/.gitignore | 2 +
    tools/tdx/attest/Makefile | 24 +++
    tools/tdx/attest/tdx-attest-test.c | 232 ++++++++++++++++++++++++
    15 files changed, 655 insertions(+), 7 deletions(-)
    create mode 100644 drivers/platform/x86/intel_tdx_attest.c
    create mode 100644 include/uapi/misc/tdx.h
    create mode 100644 tools/tdx/Makefile
    create mode 100644 tools/tdx/attest/.gitignore
    create mode 100644 tools/tdx/attest/Makefile
    create mode 100644 tools/tdx/attest/tdx-attest-test.c

    --
    2.25.1

    \
     
     \ /
      Last update: 2021-07-07 22:46    [W:3.429 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site