Messages in this thread | | | Date | Thu, 26 May 2022 11:37:47 -0300 | From | Wander Lairson Costa <> | Subject | Re: [PATCH v7 1/5] x86/tdx: Add TDX Guest attestation interface driver |
| |
On Mon, May 23, 2022 at 09:05:13PM -0700, Kuppuswamy Sathyanarayanan wrote: > In TDX guest, attestation is used to verify the trustworthiness of a TD > to other entities before provisioning secrets to the TD. > > One usage example is, when a TD guest uses encrypted drive and if the > decryption keys required to access the drive are stored in a secure 3rd > party keyserver, the key server can use attestation to verify TD's > trustworthiness and release the decryption keys to the TD. > > The attestation process consists of two steps: TDREPORT generation and > Quote generation. > > TDREPORT (TDREPORT_STRUCT) is a fixed-size data structure generated by > the TDX module which contains TD-specific information (such as TD > measurements), platform security version, and the MAC to protect the > integrity of the TDREPORT. The TD kernel uses TDCALL[TDG.MR.REPORT] to > get the TDREPORT from the TDX module. A user-provided 64-Byte > REPORTDATA is used as input and included in the TDREPORT. Typically it > can be some nonce provided by attestation service so the TDREPORT can > be verified uniquely. More details about TDREPORT can be found in > Intel TDX Module specification, section titled "TDG.MR.REPORT Leaf". > > TDREPORT can only be verified on local platform as the MAC key is bound > to the platform. To support remote verification of the TDREPORT, TDX > leverages Intel SGX Quote Enclave (QE) to verify the TDREPORT locally > and convert it to a remote verifiable Quote. > > After getting the TDREPORT, the second step of the attestation process > is to send it to the QE to generate the Quote. TDX doesn't support SGX > inside the TD, so the QE can be deployed in the host, or in another > legacy VM with SGX support. How to send the TDREPORT to QE and receive > the Quote is implementation and deployment specific. > > Implement a basic attestation driver to allow TD userspace to get the > TDREPORT. The TD userspace attestation software can get the TDREPORT > and then choose whatever communication channel available (i.e. vsock) > to send the TDREPORT to QE and receive the Quote. > > Also note that explicit access permissions are not enforced in this > driver because the quote and measurements are not a secret. However > the access permissions of the device node can be used to set any > desired access policy. The udev default is usually root access > only. > > Operations like getting TDREPORT or Quote generation involves sending > a blob of data as input and getting another blob of data as output. It > was considered to use a sysfs interface for this, but it doesn't fit > well into the standard sysfs model for configuring values. It would be > possible to do read/write on files, but it would need multiple file > descriptors, which would be somewhat messy. IOCTLs seems to be the best > fitting and simplest model for this use case. Also, the REPORTDATA used > in TDREPORT generation can possibly come from attestation service to > uniquely verify the Quote (like per instance verification). In such > case, since REPORTDATA is a secret, using sysfs to share it is insecure > compared to sending it via IOCTL. > > Reviewed-by: Tony Luck <tony.luck@intel.com> > Reviewed-by: Andi Kleen <ak@linux.intel.com> > Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> > Signed-off-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com> > --- > arch/x86/coco/tdx/Makefile | 2 +- > arch/x86/coco/tdx/attest.c | 118 ++++++++++++++++++++++++++++++++ > arch/x86/include/uapi/asm/tdx.h | 42 ++++++++++++ > 3 files changed, 161 insertions(+), 1 deletion(-) > create mode 100644 arch/x86/coco/tdx/attest.c > create mode 100644 arch/x86/include/uapi/asm/tdx.h > > diff --git a/arch/x86/coco/tdx/Makefile b/arch/x86/coco/tdx/Makefile > index 46c55998557d..d2db3e6770e5 100644 > --- a/arch/x86/coco/tdx/Makefile > +++ b/arch/x86/coco/tdx/Makefile > @@ -1,3 +1,3 @@ > # SPDX-License-Identifier: GPL-2.0 > > -obj-y += tdx.o tdcall.o > +obj-y += tdx.o tdcall.o attest.o > diff --git a/arch/x86/coco/tdx/attest.c b/arch/x86/coco/tdx/attest.c > new file mode 100644 > index 000000000000..24db0bad4923 > --- /dev/null > +++ b/arch/x86/coco/tdx/attest.c > @@ -0,0 +1,118 @@ > +// SPDX-License-Identifier: GPL-2.0 > +/* > + * attest.c - TDX guest attestation interface driver. > + * > + * Implements user interface to trigger attestation process. > + * > + * Copyright (C) 2022 Intel Corporation > + * > + */ > + > +#define pr_fmt(fmt) "x86/tdx: attest: " fmt > + > +#include <linux/miscdevice.h> > +#include <linux/mm.h> > +#include <linux/io.h> > +#include <asm/tdx.h> > +#include <uapi/asm/tdx.h> > + > +#define DRIVER_NAME "tdx-attest" > + > +/* TDREPORT module call leaf ID */ > +#define TDX_GET_REPORT 4 > + > +static struct miscdevice miscdev; > + > +static long tdx_get_report(void __user *argp) > +{ > + void *reportdata = NULL, *tdreport = NULL; > + long ret; > + > + /* Allocate buffer space for REPORTDATA */ > + reportdata = kmalloc(TDX_REPORTDATA_LEN, GFP_KERNEL); > + if (!reportdata) > + return -ENOMEM; > + > + /* Allocate buffer space for TDREPORT */ > + tdreport = kmalloc(TDX_REPORT_LEN, GFP_KERNEL); > + if (!tdreport) { > + ret = -ENOMEM; > + goto out; > + } > + > + /* Copy REPORTDATA from the user buffer */ > + if (copy_from_user(reportdata, argp, TDX_REPORTDATA_LEN)) { > + ret = -EFAULT; > + goto out; > + } > + > + /* > + * Generate TDREPORT using "TDG.MR.REPORT" TDCALL. > + * > + * Get the TDREPORT using REPORTDATA as input. Refer to > + * section 22.3.3 TDG.MR.REPORT leaf in the TDX Module 1.0 > + * Specification for detailed information. > + */ > + ret = __tdx_module_call(TDX_GET_REPORT, virt_to_phys(tdreport), > + virt_to_phys(reportdata), 0, 0, NULL); > + if (ret) { > + pr_debug("TDREPORT TDCALL failed, status:%lx\n", ret); > + ret = -EIO; > + goto out; > + } > + > + /* Copy TDREPORT back to the user buffer */ > + if (copy_to_user(argp, tdreport, TDX_REPORT_LEN)) > + ret = -EFAULT; > + > +out: > + kfree(reportdata); > + kfree(tdreport); > + return ret; > +} > + > +static long tdx_attest_ioctl(struct file *file, unsigned int cmd, > + unsigned long arg) > +{ > + void __user *argp = (void __user *)arg; > + long ret = -EINVAL; > + > + switch (cmd) { > + case TDX_CMD_GET_REPORT: > + ret = tdx_get_report(argp); > + break; > + default: > + pr_debug("cmd %d not supported\n", cmd); > + break; > + } > + > + return ret; > +} > + > +static const struct file_operations tdx_attest_fops = { > + .owner = THIS_MODULE, > + .unlocked_ioctl = tdx_attest_ioctl, > + .llseek = no_llseek, > +}; > + > +static int __init tdx_attestation_init(void) > +{ > + int ret; > + > + /* Make sure we are in a valid TDX platform */ > + if (!cpu_feature_enabled(X86_FEATURE_TDX_GUEST)) > + return -EIO; > + > + miscdev.name = DRIVER_NAME; > + miscdev.minor = MISC_DYNAMIC_MINOR; > + miscdev.fops = &tdx_attest_fops; > + > + ret = misc_register(&miscdev); > + if (ret) { > + pr_err("misc device registration failed\n"); > + return ret; > + } > + > + return 0; > +} > +device_initcall(tdx_attestation_init) > diff --git a/arch/x86/include/uapi/asm/tdx.h b/arch/x86/include/uapi/asm/tdx.h > new file mode 100644 > index 000000000000..8b57dea67eab > --- /dev/null > +++ b/arch/x86/include/uapi/asm/tdx.h > @@ -0,0 +1,42 @@ > +/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ > +#ifndef _UAPI_ASM_X86_TDX_H > +#define _UAPI_ASM_X86_TDX_H > + > +#include <linux/types.h> > +#include <linux/ioctl.h> > + > +/* Length of the REPORTDATA used in TDG.MR.REPORT TDCALL */ > +#define TDX_REPORTDATA_LEN 64 > + > +/* Length of TDREPORT used in TDG.MR.REPORT TDCALL */ > +#define TDX_REPORT_LEN 1024 > + > +/** > + * struct tdx_report_req: Get TDREPORT using REPORTDATA as input. > + * > + * @reportdata : User-defined 64-Byte REPORTDATA to be included into > + * TDREPORT. Typically it can be some nonce provided by > + * attestation service, so the generated TDREPORT can be > + * uniquely verified. > + * @tdreport : TDREPORT output from TDCALL[TDG.MR.REPORT] of size > + * TDX_REPORT_LEN. > + * > + * Used in TDX_CMD_GET_REPORT IOCTL request. > + */ > +struct tdx_report_req { > + union { > + __u8 reportdata[TDX_REPORTDATA_LEN]; > + __u8 tdreport[TDX_REPORT_LEN]; > + }; > +}; > + > +/* > + * TDX_CMD_GET_REPORT - Get TDREPORT using TDCALL[TDG.MR.REPORT] > + * > + * Return 0 on success, -EIO on TDCALL execution failure, and > + * standard errno on other general error cases. > + * > + */ > +#define TDX_CMD_GET_REPORT _IOWR('T', 0x01, struct tdx_report_req) > + > +#endif /* _UAPI_ASM_X86_TDX_H */ > -- > 2.25.1 > >
Acked-by: Wander Lairson Costa <wander@redhat.com>
| |