mbox series

[v4,0/7] Add TDX Guest Support (Attestation support)

Message ID 20210806000946.2951441-1-sathyanarayanan.kuppuswamy@linux.intel.com
Headers show
Series Add TDX Guest Support (Attestation support) | expand

Message

Kuppuswamy Sathyanarayanan Aug. 6, 2021, 12:09 a.m. UTC 
Hi All,

Intel's Trust Domain Extensions (TDX) protect guest VMs from malicious
hosts and some physical attacks. VM guest with TDX support is called
as TD Guest.

In TD Guest, the attestation process is used to verify the 
trustworthiness of TD guest to the 3rd party servers. Such attestation
process is required by 3rd party servers before sending sensitive
information to TD guests. One usage example is to get encryption keys
from the key server for mounting the encrypted rootfs or secondary drive.
    
Following patches adds the attestation support to TDX guest which
includes attestation user interface driver, user agent example, and
related hypercall support.

In this series, only following patches are in arch/x86 and are
intended for x86 maintainers review.

* x86/tdx: Add TDREPORT TDX Module call support
* x86/tdx: Add GetQuote TDX hypercall support
* x86/tdx: Add SetupEventNotifyInterrupt TDX hypercall support

Patch titled "platform/x86: intel_tdx_attest: Add TDX Guest attestation
interface driver" adds the attestation driver support. This is supposed
to be reviewed by platform-x86 maintainers.

Also, patch titled "tools/tdx: Add a sample attestation user app" adds
a testing app for attestation feature which needs review from
bpf@vger.kernel.org.

This series is the continuation of the following TDX patch series which
added basic TDX guest support.

[set 1, v5] - https://lore.kernel.org/patchwork/project/lkml/list/?series=510805
[set 2, v4] - https://lore.kernel.org/patchwork/project/lkml/list/?series=510814
[set 3, v4] - https://lore.kernel.org/patchwork/project/lkml/list/?series=510816
[set 4, v4] - https://lore.kernel.org/patchwork/project/lkml/list/?series=510836
[set 5, v3] - https://lkml.org/lkml/2021/8/5/1195

Also please note that this series alone is not necessarily fully
functional.

You can find TDX related documents in the following link.

https://software.intel.com/content/www/br/pt/develop/articles/intel-trust-domain-extensions.html

Changes since v3:
 * Since the code added by patch titled "x86/tdx: Add tdg_debug_enabled()
   interface" is only used by other patches in this series, moved it here.
 * Rebased on top of Tom Lendacky's protected guest
   changes (https://lore.kernel.org/patchwork/cover/1468760/
 * Rest of the history is included in individual patches.

Changes since v2:
 * Rebased on top of v5.14-rc1.
 * Rest of the history is included in individual patches.

Changes since v1:
 * Included platform-x86 and test tool maintainers in recipient list.
 * Fixed commit log and comments in attestation driver as per Han's comments.

Kuppuswamy Sathyanarayanan (7):
  x86/tdx: Add tdg_debug_enabled() interface
  x86/tdx: Add TDREPORT TDX Module call support
  x86/tdx: Add GetQuote TDX hypercall support
  x86/tdx: Add SetupEventNotifyInterrupt TDX hypercall support
  x86/tdx: Add TDX Guest event notify interrupt vector support
  platform/x86: intel_tdx_attest: Add TDX Guest attestation interface
    driver
  tools/tdx: Add a sample attestation user app

 arch/x86/include/asm/hardirq.h                |   1 +
 arch/x86/include/asm/idtentry.h               |   4 +
 arch/x86/include/asm/irq_vectors.h            |   7 +-
 arch/x86/include/asm/tdx.h                    |   8 +
 arch/x86/kernel/irq.c                         |   7 +
 arch/x86/kernel/tdx.c                         | 140 +++++++++++
 drivers/platform/x86/intel/Kconfig            |   1 +
 drivers/platform/x86/intel/Makefile           |   1 +
 drivers/platform/x86/intel/tdx/Kconfig        |  13 +
 drivers/platform/x86/intel/tdx/Makefile       |   3 +
 .../platform/x86/intel/tdx/intel_tdx_attest.c | 212 ++++++++++++++++
 include/uapi/misc/tdx.h                       |  37 +++
 tools/Makefile                                |  13 +-
 tools/tdx/Makefile                            |  19 ++
 tools/tdx/attest/.gitignore                   |   2 +
 tools/tdx/attest/Makefile                     |  24 ++
 tools/tdx/attest/tdx-attest-test.c            | 232 ++++++++++++++++++
 17 files changed, 717 insertions(+), 7 deletions(-)
 create mode 100644 drivers/platform/x86/intel/tdx/Kconfig
 create mode 100644 drivers/platform/x86/intel/tdx/Makefile
 create mode 100644 drivers/platform/x86/intel/tdx/intel_tdx_attest.c
 create mode 100644 include/uapi/misc/tdx.h
 create mode 100644 tools/tdx/Makefile
 create mode 100644 tools/tdx/attest/.gitignore
 create mode 100644 tools/tdx/attest/Makefile
 create mode 100644 tools/tdx/attest/tdx-attest-test.c

Comments

Hans de Goede Aug. 6, 2021, 12:10 p.m. UTC | #1 
Hi,

On 8/6/21 2:09 AM, Kuppuswamy Sathyanarayanan wrote:
> Hi All,
> 
> Intel's Trust Domain Extensions (TDX) protect guest VMs from malicious
> hosts and some physical attacks. VM guest with TDX support is called
> as TD Guest.
> 
> In TD Guest, the attestation process is used to verify the 
> trustworthiness of TD guest to the 3rd party servers. Such attestation
> process is required by 3rd party servers before sending sensitive
> information to TD guests. One usage example is to get encryption keys
> from the key server for mounting the encrypted rootfs or secondary drive.
>     
> Following patches adds the attestation support to TDX guest which
> includes attestation user interface driver, user agent example, and
> related hypercall support.
> 
> In this series, only following patches are in arch/x86 and are
> intended for x86 maintainers review.
> 
> * x86/tdx: Add TDREPORT TDX Module call support
> * x86/tdx: Add GetQuote TDX hypercall support
> * x86/tdx: Add SetupEventNotifyInterrupt TDX hypercall support
> 
> Patch titled "platform/x86: intel_tdx_attest: Add TDX Guest attestation
> interface driver" adds the attestation driver support. This is supposed
> to be reviewed by platform-x86 maintainers.

Since the patches depend on each other I believe that it would be best
if the entire series gets merged through the tip tree.

Here is my ack for patch 6/7 for that:

Acked-by: Hans de Goede <hdegoede@redhat.com>

Regards,

Hans


> 
> Also, patch titled "tools/tdx: Add a sample attestation user app" adds
> a testing app for attestation feature which needs review from
> bpf@vger.kernel.org.
> 
> This series is the continuation of the following TDX patch series which
> added basic TDX guest support.
> 
> [set 1, v5] - https://lore.kernel.org/patchwork/project/lkml/list/?seriesQ0805
> [set 2, v4] - https://lore.kernel.org/patchwork/project/lkml/list/?seriesQ0814
> [set 3, v4] - https://lore.kernel.org/patchwork/project/lkml/list/?seriesQ0816
> [set 4, v4] - https://lore.kernel.org/patchwork/project/lkml/list/?seriesQ0836
> [set 5, v3] - https://lkml.org/lkml/2021/8/5/1195
> 
> Also please note that this series alone is not necessarily fully
> functional.
> 
> You can find TDX related documents in the following link.
> 
> https://software.intel.com/content/www/br/pt/develop/articles/intel-trust-domain-extensions.html
> 
> Changes since v3:
>  * Since the code added by patch titled "x86/tdx: Add tdg_debug_enabled()
>    interface" is only used by other patches in this series, moved it here.
>  * Rebased on top of Tom Lendacky's protected guest
>    changes (https://lore.kernel.org/patchwork/cover/1468760/
>  * Rest of the history is included in individual patches.
> 
> Changes since v2:
>  * Rebased on top of v5.14-rc1.
>  * Rest of the history is included in individual patches.
> 
> Changes since v1:
>  * Included platform-x86 and test tool maintainers in recipient list.
>  * Fixed commit log and comments in attestation driver as per Han's comments.
> 
> Kuppuswamy Sathyanarayanan (7):
>   x86/tdx: Add tdg_debug_enabled() interface
>   x86/tdx: Add TDREPORT TDX Module call support
>   x86/tdx: Add GetQuote TDX hypercall support
>   x86/tdx: Add SetupEventNotifyInterrupt TDX hypercall support
>   x86/tdx: Add TDX Guest event notify interrupt vector support
>   platform/x86: intel_tdx_attest: Add TDX Guest attestation interface
>     driver
>   tools/tdx: Add a sample attestation user app
> 
>  arch/x86/include/asm/hardirq.h                |   1 +
>  arch/x86/include/asm/idtentry.h               |   4 +
>  arch/x86/include/asm/irq_vectors.h            |   7 +-
>  arch/x86/include/asm/tdx.h                    |   8 +
>  arch/x86/kernel/irq.c                         |   7 +
>  arch/x86/kernel/tdx.c                         | 140 +++++++++++
>  drivers/platform/x86/intel/Kconfig            |   1 +
>  drivers/platform/x86/intel/Makefile           |   1 +
>  drivers/platform/x86/intel/tdx/Kconfig        |  13 +
>  drivers/platform/x86/intel/tdx/Makefile       |   3 +
>  .../platform/x86/intel/tdx/intel_tdx_attest.c | 212 ++++++++++++++++
>  include/uapi/misc/tdx.h                       |  37 +++
>  tools/Makefile                                |  13 +-
>  tools/tdx/Makefile                            |  19 ++
>  tools/tdx/attest/.gitignore                   |   2 +
>  tools/tdx/attest/Makefile                     |  24 ++
>  tools/tdx/attest/tdx-attest-test.c            | 232 ++++++++++++++++++
>  17 files changed, 717 insertions(+), 7 deletions(-)
>  create mode 100644 drivers/platform/x86/intel/tdx/Kconfig
>  create mode 100644 drivers/platform/x86/intel/tdx/Makefile
>  create mode 100644 drivers/platform/x86/intel/tdx/intel_tdx_attest.c
>  create mode 100644 include/uapi/misc/tdx.h
>  create mode 100644 tools/tdx/Makefile
>  create mode 100644 tools/tdx/attest/.gitignore
>  create mode 100644 tools/tdx/attest/Makefile
>  create mode 100644 tools/tdx/attest/tdx-attest-test.c
>