lkml.org 
[lkml]   [2023]   [Feb]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH RFC v8 27/56] crypto: ccp: Add the SNP_{SET,GET}_EXT_CONFIG command
From
On 2/22/23 06:32, Zhi Wang wrote:
> On Mon, 20 Feb 2023 12:38:18 -0600
> Michael Roth <michael.roth@amd.com> wrote:
>
>> From: Brijesh Singh <brijesh.singh@amd.com>
>>
>> The SEV-SNP firmware provides the SNP_CONFIG command used to set the
>> system-wide configuration value for SNP guests. The information includes
>> the TCB version string to be reported in guest attestation reports.
>>
>> Version 2 of the GHCB specification adds an NAE (SNP extended guest
>> request) that a guest can use to query the reports that include additional
>> certificates.
>>
>> In both cases, userspace provided additional data is included in the
>> attestation reports. The userspace will use the SNP_SET_EXT_CONFIG
>> command to give the certificate blob and the reported TCB version string
>> at once. Note that the specification defines certificate blob with a
>> specific GUID format; the userspace is responsible for building the
>> proper certificate blob. The ioctl treats it an opaque blob.
>>
>> While it is not defined in the spec, but let's add SNP_GET_EXT_CONFIG
>> command that can be used to obtain the data programmed through the
>> SNP_SET_EXT_CONFIG.
>>
>> Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
>> Signed-off-by: Ashish Kalra <ashish.kalra@amd.com>
>> Signed-off-by: Michael Roth <michael.roth@amd.com>
>> ---
>> Documentation/virt/coco/sev-guest.rst | 27 ++++++
>> drivers/crypto/ccp/sev-dev.c | 123 ++++++++++++++++++++++++++
>> drivers/crypto/ccp/sev-dev.h | 4 +
>> include/uapi/linux/psp-sev.h | 17 ++++
>> 4 files changed, 171 insertions(+)
>>

>> diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c
>> index 65e13a562f3b..b56b00ca2cd4 100644
>> --- a/drivers/crypto/ccp/sev-dev.c
>> +++ b/drivers/crypto/ccp/sev-dev.c
>> @@ -1481,6 +1481,10 @@ static int __sev_snp_shutdown_locked(int *error)
>> data.length = sizeof(data);
>> data.iommu_snp_shutdown = 1;
>>
>> + /* Free the memory used for caching the certificate data */
>> + kfree(sev->snp_certs_data);
>> + sev->snp_certs_data = NULL;
>> +
>> wbinvd_on_all_cpus();
>>
>> retry:
>> @@ -1793,6 +1797,118 @@ static int sev_ioctl_snp_platform_status(struct sev_issue_cmd *argp)
>> return ret;
>> }
>>
>> +static int sev_ioctl_snp_get_config(struct sev_issue_cmd *argp)
>> +{
>> + struct sev_device *sev = psp_master->sev_data;
>> + struct sev_user_data_ext_snp_config input;
>> + int ret;
>> +
>> + if (!sev->snp_initialized || !argp->data)
>> + return -EINVAL;
>> +
>> + memset(&input, 0, sizeof(input));
>> +
>> + if (copy_from_user(&input, (void __user *)argp->data, sizeof(input)))
>> + return -EFAULT;
>> +
>> + /* Copy the TCB version programmed through the SET_CONFIG to userspace */
>> + if (input.config_address) {
>> + if (copy_to_user((void * __user)input.config_address,
>> + &sev->snp_config, sizeof(struct sev_user_data_snp_config)))
>> + return -EFAULT;
>> + }
>> +
>> + /* Copy the extended certs programmed through the SNP_SET_CONFIG */
>> + if (input.certs_address && sev->snp_certs_data) {
>> + if (input.certs_len < sev->snp_certs_len) {
>> + /* Return the certs length to userspace */
>> + input.certs_len = sev->snp_certs_len;
>> +
>> + ret = -ENOSR;

We should be consistent with the other SEV ioctls that return required
lengths and return -EIO here instead -ENOSR.

Thanks,
Tom

>> + goto e_done;
>> + }
>> +
>
> What about if input.certs_len > sev->snp_certs_len? Is it possbile for the
> userspace to know the length of data in the buffer? (I guess it might be able
> to know the certs len through the blob data, but a comment here would be nice)
>
>> + if (copy_to_user((void * __user)input.certs_address,
>> + sev->snp_certs_data, sev->snp_certs_len))
>> + return -EFAULT;
>> + }
>> +
>> + ret = 0;
>> +
>> +e_done:
>> + if (copy_to_user((void __user *)argp->data, &input, sizeof(input)))
>> + ret = -EFAULT;
>> +
>> + return ret;
>> +}

\
 
 \ /
  Last update: 2023-03-27 00:32    [W:0.203 / U:0.212 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site