linux-kernel - Re: [PATCH v2 08/11] coco: guest: arm64: Add support for fetching and verifying device info

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <yq5ay0nvltqh.fsf@kernel.org>
Date: Mon, 24 Nov 2025 13:58:38 +0530
From: Aneesh Kumar K.V <aneesh.kumar@...nel.org>
To: Jonathan Cameron <jonathan.cameron@...wei.com>
Cc: linux-coco@...ts.linux.dev, kvmarm@...ts.linux.dev,
	linux-pci@...r.kernel.org, linux-kernel@...r.kernel.org,
	dan.j.williams@...el.com, aik@....com, lukas@...ner.de,
	Samuel Ortiz <sameo@...osinc.com>,
	Xu Yilun <yilun.xu@...ux.intel.com>,
	Jason Gunthorpe <jgg@...pe.ca>,
	Suzuki K Poulose <Suzuki.Poulose@....com>,
	Steven Price <steven.price@....com>,
	Bjorn Helgaas <helgaas@...nel.org>,
	Catalin Marinas <catalin.marinas@....com>,
	Marc Zyngier <maz@...nel.org>, Will Deacon <will@...nel.org>,
	Oliver Upton <oliver.upton@...ux.dev>
Subject: Re: [PATCH v2 08/11] coco: guest: arm64: Add support for fetching
 and verifying device info

Jonathan Cameron <jonathan.cameron@...wei.com> writes:

> On Mon, 17 Nov 2025 19:30:04 +0530
> "Aneesh Kumar K.V (Arm)" <aneesh.kumar@...nel.org> wrote:
>

...

>
>> +		return -EIO;
>> +	}
>> +
>> +	dsc->dev_info.cert_id       = dev_info->cert_id;
>> +	dsc->dev_info.hash_algo     = dev_info->hash_algo;
>> +	dsc->dev_info.lock_nonce    = dev_info->lock_nonce;
>> +	dsc->dev_info.meas_nonce    = dev_info->meas_nonce;
>> +	dsc->dev_info.report_nonce  = dev_info->report_nonce;
>> +	memcpy(dsc->dev_info.cert_digest, dev_info->cert_digest, SHA512_DIGEST_SIZE);
>> +	memcpy(dsc->dev_info.meas_digest, dev_info->meas_digest, SHA512_DIGEST_SIZE);
>> +	memcpy(dsc->dev_info.report_digest, dev_info->report_digest, SHA512_DIGEST_SIZE);
>
> So copy everything other than flags.  Any reason why not flags?
>

The flags field currently carries p2p_enabled and p2p_bound, but these
aren’t used yet. I’ll drop flags from dsc->dev_info for now and
reintroduce it once there’s an actual user.

>> +
>> +	kfree(dev_info);
>> +	/*
>> +	 * Verify that the digests of the provided reports match with the
>> +	 * digests from RMM
>> +	 */
>> +	ret = verify_digests(dsc);
>> +	if (ret) {
>> +		pci_err(pdev, "device digest validation failed (%d)\n", ret);
>> +		return ret;
>> +	}
>> +
>> +	ret = cca_apply_interface_report_mappings(pdev, true);
>> +	if (ret) {
>> +		pci_err(pdev, "failed to validate the interface report\n");
>> +		return -EIO;
>> +	}
>> +
>> +	return 0;
>> +}