linux-kernel - Re: [PATCH 11/13] x86/virt/tdx: Add SEAMCALL wrappers for TD measurement of initial contents

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <a3813ab21be79ceed508293d22dd65fdacf9c096.camel@intel.com>
Date: Fri, 3 Jan 2025 18:02:30 +0000
From: "Edgecombe, Rick P" <rick.p.edgecombe@...el.com>
To: "kvm@...r.kernel.org" <kvm@...r.kernel.org>, "pbonzini@...hat.com"
	<pbonzini@...hat.com>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>
CC: "Zhao, Yan Y" <yan.y.zhao@...el.com>, "sean.j.christopherson@...el.com"
	<sean.j.christopherson@...el.com>, "Huang, Kai" <kai.huang@...el.com>,
	"dave.hansen@...ux.intel.com" <dave.hansen@...ux.intel.com>, "Yamahata,
 Isaku" <isaku.yamahata@...el.com>
Subject: Re: [PATCH 11/13] x86/virt/tdx: Add SEAMCALL wrappers for TD
 measurement of initial contents

On Wed, 2025-01-01 at 02:49 -0500, Paolo Bonzini wrote:
> From: Isaku Yamahata <isaku.yamahata@...el.com>
> 
> The TDX module measures the TD during the build process and saves the
> measurement in TDCS.MRTD to facilitate TD attestation of the initial
> contents of the TD. Wrap the SEAMCALL TDH.MR.EXTEND with tdh_mr_extend()
> and TDH.MR.FINALIZE with tdh_mr_finalize() to enable the host kernel to
> assist the TDX module in performing the measurement.
> 
> The measurement in TDCS.MRTD is a SHA-384 digest of the build process.
> SEAMCALLs TDH.MNG.INIT and TDH.MEM.PAGE.ADD initialize and contribute to
> the MRTD digest calculation.
> 
> The caller of tdh_mr_extend() should break the TD private page into chunks
> of size TDX_EXTENDMR_CHUNKSIZE and invoke tdh_mr_extend() to add the page
> content into the digest calculation. Failures are possible with
> TDH.MR.EXTEND (e.g., due to SEPT walking). The caller of tdh_mr_extend()
> can check the function return value and retrieve extended error information
> from the function output parameters.
> 
> Calling tdh_mr_finalize() completes the measurement. The TDX module then
> turns the TD into the runnable state. Further TDH.MEM.PAGE.ADD and
> TDH.MR.EXTEND calls will fail.
> 
> TDH.MR.FINALIZE may fail due to errors such as the TD having no vCPUs or
> contentions. Check function return value when calling tdh_mr_finalize() to
> determine the exact reason for failure. Take proper locks on the caller's
> side to avoid contention failures, or handle the BUSY error in specific
> ways (e.g., retry). Return the SEAMCALL error code directly to the caller.
> Do not attempt to handle it in the core kernel.
> 
> [Kai: Switched from generic seamcall export]
> [Yan: Re-wrote the changelog]
> Co-developed-by: Sean Christopherson <sean.j.christopherson@...el.com>
> Signed-off-by: Sean Christopherson <sean.j.christopherson@...el.com>
> Signed-off-by: Isaku Yamahata <isaku.yamahata@...el.com>
> Signed-off-by: Kai Huang <kai.huang@...el.com>
> Signed-off-by: Rick Edgecombe <rick.p.edgecombe@...el.com>
> Signed-off-by: Yan Zhao <yan.y.zhao@...el.com>
> Message-ID: <20241112073709.22171-1-yan.y.zhao@...el.com>
> Signed-off-by: Paolo Bonzini <pbonzini@...hat.com>
> ---
>  arch/x86/include/asm/tdx.h  |  2 ++
>  arch/x86/virt/vmx/tdx/tdx.c | 27 +++++++++++++++++++++++++++
>  arch/x86/virt/vmx/tdx/tdx.h |  2 ++
>  3 files changed, 31 insertions(+)
> 
> diff --git a/arch/x86/include/asm/tdx.h b/arch/x86/include/asm/tdx.h
> index 74938f725481..6981a3d75eb2 100644
> --- a/arch/x86/include/asm/tdx.h
> +++ b/arch/x86/include/asm/tdx.h
> @@ -147,6 +147,8 @@ u64 tdh_mng_key_config(struct tdx_td *td);
>  u64 tdh_mng_create(struct tdx_td *td, u64 hkid);
>  u64 tdh_vp_create(struct tdx_td *td, struct tdx_vp *vp);
>  u64 tdh_mng_rd(struct tdx_td *td, u64 field, u64 *data);
> +u64 tdh_mr_extend(struct tdx_td *td, u64 gpa, u64 *rcx, u64 *rdx);
> +u64 tdh_mr_finalize(struct tdx_td *td);
>  u64 tdh_vp_flush(struct tdx_vp *vp);
>  u64 tdh_mng_vpflushdone(struct tdx_td *td);
>  u64 tdh_mng_key_freeid(struct tdx_td *td);
> diff --git a/arch/x86/virt/vmx/tdx/tdx.c b/arch/x86/virt/vmx/tdx/tdx.c
> index cde55e9b3280..84fe5bc79434 100644
> --- a/arch/x86/virt/vmx/tdx/tdx.c
> +++ b/arch/x86/virt/vmx/tdx/tdx.c
> @@ -1629,6 +1629,33 @@ u64 tdh_mng_rd(struct tdx_td *td, u64 field, u64 *data)
>  }
>  EXPORT_SYMBOL_GPL(tdh_mng_rd);
>  
> +u64 tdh_mr_extend(struct tdx_td *td, u64 gpa, u64 *rcx, u64 *rdx)

gpa should be type gpa_t to avoid bare u64 types.

> +{
> +	struct tdx_module_args args = {
> +		.rcx = gpa,
> +		.rdx = tdx_tdr_pa(td),
> +	};
> +	u64 ret;
> +
> +	ret = seamcall_ret(TDH_MR_EXTEND, &args);
> +
> +	*rcx = args.rcx;
> +	*rdx = args.rdx;

Could be extended_err1/2.

> +
> +	return ret;
> +}
> +EXPORT_SYMBOL_GPL(tdh_mr_extend);
> +
> +u64 tdh_mr_finalize(struct tdx_td *td)
> +{
> +	struct tdx_module_args args = {
> +		.rcx = tdx_tdr_pa(td),
> +	};
> +
> +	return seamcall(TDH_MR_FINALIZE, &args);
> +}
> +EXPORT_SYMBOL_GPL(tdh_mr_finalize);
> +
>  u64 tdh_vp_flush(struct tdx_vp *vp)
>  {
>  	struct tdx_module_args args = {
> diff --git a/arch/x86/virt/vmx/tdx/tdx.h b/arch/x86/virt/vmx/tdx/tdx.h
> index d49cdd9b0577..a1e34773bab7 100644
> --- a/arch/x86/virt/vmx/tdx/tdx.h
> +++ b/arch/x86/virt/vmx/tdx/tdx.h
> @@ -24,6 +24,8 @@
>  #define TDH_MNG_KEY_CONFIG		8
>  #define TDH_MNG_CREATE			9
>  #define TDH_MNG_RD			11
> +#define TDH_MR_EXTEND			16
> +#define TDH_MR_FINALIZE			17
>  #define TDH_VP_FLUSH			18
>  #define TDH_MNG_VPFLUSHDONE		19
>  #define TDH_VP_CREATE			10