Skip to content

Commit ae5ec8a

Browse files
torvaldstorvalds
committed
Merge tag 'tsm-for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm
Pull trusted security manager (TSM) updates from Dan Williams: - Add a general sysfs scheme for publishing "Measurement" values provided by the architecture's TEE Security Manager. Use it to publish TDX "Runtime Measurement Registers" ("RTMRs") that either maintain a hash of stored values (similar to a TPM PCR) or provide statically provisioned data. These measurements are validated by a relying party. - Reorganize the drivers/virt/coco/ directory for "host" and "guest" shared infrastructure. - Fix a configfs-tsm-report unregister bug - With CONFIG_TSM_MEASUREMENTS joining CONFIG_TSM_REPORTS and in anticipation of more shared "TSM" infrastructure arriving, rename the maintainer entry to "TRUSTED SECURITY MODULE (TSM) INFRASTRUCTURE". * tag 'tsm-for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm: tsm-mr: Fix init breakage after bin_attrs constification by scoping non-const pointers to init phase sample/tsm-mr: Fix missing static for sample_report virt: tdx-guest: Transition to scoped_cond_guard for mutex operations virt: tdx-guest: Refactor and streamline TDREPORT generation virt: tdx-guest: Expose TDX MRs as sysfs attributes x86/tdx: tdx_mcall_get_report0: Return -EBUSY on TDCALL_OPERAND_BUSY error x86/tdx: Add tdx_mcall_extend_rtmr() interface tsm-mr: Add tsm-mr sample code tsm-mr: Add TVM Measurement Register support configfs-tsm-report: Fix NULL dereference of tsm_ops coco/guest: Move shared guest CC infrastructure to drivers/virt/coco/guest/ configfs-tsm: Namespace TSM report symbols
2 parents bbd9c36 + 9d948b8 commit ae5ec8a

File tree

26 files changed

+974
-137
lines changed

26 files changed

+974
-137
lines changed

‎Documentation/ABI/testing/configfs-tsm‎ renamed to ‎Documentation/ABI/testing/configfs-tsm-report‎

File renamed without changes.

‎Documentation/ABI/testing/sysfs-devices-virtual-misc-tdx_guest‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
What: /sys/devices/virtual/misc/tdx_guest/measurements/MRNAME[:HASH]
2+
Date: April, 2025
3+
KernelVersion: v6.16
4+
Contact: linux-coco@lists.linux.dev
5+
Description:
6+
Value of a TDX measurement register (MR). MRNAME and HASH above
7+
are placeholders. The optional suffix :HASH is used for MRs
8+
that have associated hash algorithms. See below for a complete
9+
list of TDX MRs exposed via sysfs. Refer to Intel TDX Module
10+
ABI Specification for the definition of TDREPORT and the full
11+
list of TDX measurements.
12+
13+
Intel TDX Module ABI Specification can be found at:
14+
https://www.intel.com/content/www/us/en/developer/tools/trust-domain-extensions/documentation.html#architecture
15+
16+
See also:
17+
https://docs.kernel.org/driver-api/coco/measurement-registers.html
18+
19+
What: /sys/devices/virtual/misc/tdx_guest/measurements/mrconfigid
20+
Date: April, 2025
21+
KernelVersion: v6.16
22+
Contact: linux-coco@lists.linux.dev
23+
Description:
24+
(RO) MRCONFIGID - 48-byte immutable storage typically used for
25+
software-defined ID for non-owner-defined configuration of the
26+
guest TD – e.g., run-time or OS configuration.
27+
28+
What: /sys/devices/virtual/misc/tdx_guest/measurements/mrowner
29+
Date: April, 2025
30+
KernelVersion: v6.16
31+
Contact: linux-coco@lists.linux.dev
32+
Description:
33+
(RO) MROWNER - 48-byte immutable storage typically used for
34+
software-defined ID for the guest TD’s owner.
35+
36+
What: /sys/devices/virtual/misc/tdx_guest/measurements/mrownerconfig
37+
Date: April, 2025
38+
KernelVersion: v6.16
39+
Contact: linux-coco@lists.linux.dev
40+
Description:
41+
(RO) MROWNERCONFIG - 48-byte immutable storage typically used
42+
for software-defined ID for owner-defined configuration of the
43+
guest TD – e.g., specific to the workload rather than the
44+
run-time or OS.
45+
46+
What: /sys/devices/virtual/misc/tdx_guest/measurements/mrtd:sha384
47+
Date: April, 2025
48+
KernelVersion: v6.16
49+
Contact: linux-coco@lists.linux.dev
50+
Description:
51+
(RO) MRTD - Measurement of the initial contents of the TD.
52+
53+
What: /sys/devices/virtual/misc/tdx_guest/measurements/rtmr[0123]:sha384
54+
Date: April, 2025
55+
KernelVersion: v6.16
56+
Contact: linux-coco@lists.linux.dev
57+
Description:
58+
(RW) RTMR[0123] - 4 Run-Time extendable Measurement Registers.
59+
Read from any of these returns the current value of the
60+
corresponding RTMR. Write extends the written buffer to the
61+
RTMR. All writes must start at offset 0 and be 48 bytes in
62+
size. Partial writes will result in EINVAL returned by the
63+
write() syscall.

‎Documentation/driver-api/coco/index.rst‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
.. SPDX-License-Identifier: GPL-2.0
2+
3+
======================
4+
Confidential Computing
5+
======================
6+
7+
.. toctree::
8+
:maxdepth: 1
9+
10+
measurement-registers
11+
12+
.. only:: subproject and html

‎Documentation/driver-api/coco/measurement-registers.rst‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
.. SPDX-License-Identifier: GPL-2.0
2+
.. include:: <isonum.txt>
3+
4+
=====================
5+
Measurement Registers
6+
=====================
7+
8+
.. kernel-doc:: include/linux/tsm-mr.h
9+
:internal:
10+
11+
.. kernel-doc:: drivers/virt/coco/guest/tsm-mr.c
12+
:export:

‎Documentation/driver-api/index.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,7 @@ Subsystem-specific APIs
8181
acpi/index
8282
backlight/lp855x-driver.rst
8383
clk
84+
coco/index
8485
console
8586
crypto/index
8687
dmaengine/index

‎MAINTAINERS‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24981,13 +24981,15 @@ M: David Lechner <dlechner@baylibre.com>
2498124981
S: Maintained
2498224982
F: Documentation/devicetree/bindings/trigger-source/pwm-trigger.yaml
2498324983

24984-
TRUSTED SECURITY MODULE (TSM) ATTESTATION REPORTS
24984+
TRUSTED SECURITY MODULE (TSM) INFRASTRUCTURE
2498524985
M: Dan Williams <dan.j.williams@intel.com>
2498624986
L: linux-coco@lists.linux.dev
2498724987
S: Maintained
24988-
F: Documentation/ABI/testing/configfs-tsm
24989-
F: drivers/virt/coco/tsm.c
24990-
F: include/linux/tsm.h
24988+
F: Documentation/ABI/testing/configfs-tsm-report
24989+
F: Documentation/driver-api/coco/
24990+
F: drivers/virt/coco/guest/
24991+
F: include/linux/tsm*.h
24992+
F: samples/tsm-mr/
2499124993

2499224994
TRUSTED SERVICES TEE DRIVER
2499324995
M: Balint Dobszay <balint.dobszay@arm.com>
@@ -26673,6 +26675,7 @@ L: x86@kernel.org
2667326675
L: linux-coco@lists.linux.dev
2667426676
S: Supported
2667526677
T: git git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git x86/tdx
26678+
F: Documentation/ABI/testing/sysfs-devices-virtual-misc-tdx_guest
2667626679
F: arch/x86/boot/compressed/tdx*
2667726680
F: arch/x86/coco/tdx/
2667826681
F: arch/x86/include/asm/shared/tdx.h

‎arch/x86/coco/tdx/tdx.c‎

Lines changed: 45 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@
3636
/* TDX Module call error codes */
3737
#define TDCALL_RETURN_CODE(a) ((a) >> 32)
3838
#define TDCALL_INVALID_OPERAND 0xc0000100
39+
#define TDCALL_OPERAND_BUSY 0x80000200
3940

4041
#define TDREPORT_SUBTYPE_0 0
4142

@@ -109,12 +110,13 @@ static inline u64 tdg_vm_wr(u64 field, u64 value, u64 mask)
109110
* REPORTDATA to be included into TDREPORT.
110111
* @tdreport: Address of the output buffer to store TDREPORT.
111112
*
112-
* Refer to section titled "TDG.MR.REPORT leaf" in the TDX Module
113-
* v1.0 specification for more information on TDG.MR.REPORT TDCALL.
113+
* Refer to section titled "TDG.MR.REPORT leaf" in the TDX Module v1.0
114+
* specification for more information on TDG.MR.REPORT TDCALL.
115+
*
114116
* It is used in the TDX guest driver module to get the TDREPORT0.
115117
*
116-
* Return 0 on success, -EINVAL for invalid operands, or -EIO on
117-
* other TDCALL failures.
118+
* Return 0 on success, -ENXIO for invalid operands, -EBUSY for busy operation,
119+
* or -EIO on other TDCALL failures.
118120
*/
119121
int tdx_mcall_get_report0(u8 *reportdata, u8 *tdreport)
120122
{
@@ -128,14 +130,52 @@ int tdx_mcall_get_report0(u8 *reportdata, u8 *tdreport)
128130
ret = __tdcall(TDG_MR_REPORT, &args);
129131
if (ret) {
130132
if (TDCALL_RETURN_CODE(ret) == TDCALL_INVALID_OPERAND)
131-
return -EINVAL;
133+
return -ENXIO;
134+
else if (TDCALL_RETURN_CODE(ret) == TDCALL_OPERAND_BUSY)
135+
return -EBUSY;
132136
return -EIO;
133137
}
134138

135139
return 0;
136140
}
137141
EXPORT_SYMBOL_GPL(tdx_mcall_get_report0);
138142

143+
/**
144+
* tdx_mcall_extend_rtmr() - Wrapper to extend RTMR registers using
145+
* TDG.MR.RTMR.EXTEND TDCALL.
146+
* @index: Index of RTMR register to be extended.
147+
* @data: Address of the input buffer with RTMR register extend data.
148+
*
149+
* Refer to section titled "TDG.MR.RTMR.EXTEND leaf" in the TDX Module v1.0
150+
* specification for more information on TDG.MR.RTMR.EXTEND TDCALL.
151+
*
152+
* It is used in the TDX guest driver module to allow user to extend the RTMR
153+
* registers.
154+
*
155+
* Return 0 on success, -ENXIO for invalid operands, -EBUSY for busy operation,
156+
* or -EIO on other TDCALL failures.
157+
*/
158+
int tdx_mcall_extend_rtmr(u8 index, u8 *data)
159+
{
160+
struct tdx_module_args args = {
161+
.rcx = virt_to_phys(data),
162+
.rdx = index,
163+
};
164+
u64 ret;
165+
166+
ret = __tdcall(TDG_MR_RTMR_EXTEND, &args);
167+
if (ret) {
168+
if (TDCALL_RETURN_CODE(ret) == TDCALL_INVALID_OPERAND)
169+
return -ENXIO;
170+
if (TDCALL_RETURN_CODE(ret) == TDCALL_OPERAND_BUSY)
171+
return -EBUSY;
172+
return -EIO;
173+
}
174+
175+
return 0;
176+
}
177+
EXPORT_SYMBOL_GPL(tdx_mcall_extend_rtmr);
178+
139179
/**
140180
* tdx_hcall_get_quote() - Wrapper to request TD Quote using GetQuote
141181
* hypercall.

‎arch/x86/include/asm/shared/tdx.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
/* TDX module Call Leaf IDs */
1414
#define TDG_VP_VMCALL 0
1515
#define TDG_VP_INFO 1
16+
#define TDG_MR_RTMR_EXTEND 2
1617
#define TDG_VP_VEINFO_GET 3
1718
#define TDG_MR_REPORT 4
1819
#define TDG_MEM_PAGE_ACCEPT 6

‎arch/x86/include/asm/tdx.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,8 @@ bool tdx_early_handle_ve(struct pt_regs *regs);
6868

6969
int tdx_mcall_get_report0(u8 *reportdata, u8 *tdreport);
7070

71+
int tdx_mcall_extend_rtmr(u8 index, u8 *data);
72+
7173
u64 tdx_hcall_get_quote(u8 *buf, size_t size);
7274

7375
void __init tdx_dump_attributes(u64 td_attr);

‎drivers/virt/coco/Kconfig‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,6 @@
33
# Confidential computing related collateral
44
#
55

6-
config TSM_REPORTS
7-
select CONFIGFS_FS
8-
tristate
9-
106
source "drivers/virt/coco/efi_secret/Kconfig"
117

128
source "drivers/virt/coco/pkvm-guest/Kconfig"
@@ -16,3 +12,5 @@ source "drivers/virt/coco/sev-guest/Kconfig"
1612
source "drivers/virt/coco/tdx-guest/Kconfig"
1713

1814
source "drivers/virt/coco/arm-cca-guest/Kconfig"
15+
16+
source "drivers/virt/coco/guest/Kconfig"

0 commit comments

Comments
 (0)