Hi All,
Intel's Trust Domain Extensions (TDX) protect guest VMs from malicious
hosts and some physical attacks. VM guest with TDX support is called
as TD Guest.
In TD Guest, the attestation process is used to verify the
trustworthiness of TD guest to the 3rd party servers. Such attestation
process is required by 3rd party servers before sending sensitive
information to TD guests. One usage example is to get encryption keys
from the key server for mounting the encrypted rootfs or secondary drive.
Following patches add the attestation support to TDX guest which
includes attestation user interface driver, user agent example, and
related hypercall support.
In this series, only following patches are in arch/x86 and are
intended for x86 maintainers review.
* x86/tdx: Add TDREPORT TDX Module call support
* x86/tdx: Add GetQuote TDX hypercall support
* x86/tdx: Add SetupEventNotifyInterrupt TDX hypercall support
* x86/tdx: Add TDX Guest event notify interrupt vector support
Patch titled "platform/x86: intel_tdx_attest: Add TDX Guest attestation
interface driver" adds the attestation driver support. This is supposed
to be reviewed by platform-x86 maintainers.
Also, patch titled "tools/tdx: Add a sample attestation user app" adds
a testing app for attestation feature which needs review from
bpf@xxxxxxxxxxxxxxx.
Dependencies:
--------------
This feature has dependency on TDX guest core patch set series.
https://lore.kernel.org/all/20220218161718.67148-1-kirill.shutemov@xxxxxxxxxxxxxxx/T/
History:
----------
Previously this patch set was sent under title "Add TDX Guest
Support (Attestation support)". In the previous version, only the
attestation driver patch was reviewed and got acked. Rest of the
patches need to be reviewed freshly.
https://lore.kernel.org/bpf/20210806000946.2951441-1-sathyanarayanan.kuppuswamy@xxxxxxxxxxxxxxx/
Changes since previous submission:
* Updated commit log and error handling in TDREPORT, GetQuote and
SetupEventNotifyInterrupt support patches.
* Added locking support in attestation driver.
Kuppuswamy Sathyanarayanan (6):
x86/tdx: Add tdx_mcall_tdreport() API support
x86/tdx: Add tdx_hcall_get_quote() API support
x86/tdx: Add SetupEventNotifyInterrupt TDX hypercall support
platform/x86: intel_tdx_attest: Add TDX Guest attestation interface
driver
x86/tdx: Add TDX Guest event notify interrupt vector support
tools/tdx: Add a sample attestation user app
arch/x86/coco/tdx.c | 170 ++++++++++++
arch/x86/include/asm/hardirq.h | 4 +
arch/x86/include/asm/idtentry.h | 4 +
arch/x86/include/asm/irq_vectors.h | 7 +-
arch/x86/include/asm/tdx.h | 5 +
arch/x86/kernel/irq.c | 7 +
drivers/platform/x86/intel/Kconfig | 1 +
drivers/platform/x86/intel/Makefile | 1 +
drivers/platform/x86/intel/tdx/Kconfig | 13 +
drivers/platform/x86/intel/tdx/Makefile | 3 +
.../platform/x86/intel/tdx/intel_tdx_attest.c | 241 ++++++++++++++++++
include/uapi/misc/tdx.h | 37 +++
tools/Makefile | 13 +-
tools/tdx/Makefile | 19 ++
tools/tdx/attest/.gitignore | 2 +
tools/tdx/attest/Makefile | 24 ++
tools/tdx/attest/tdx-attest-test.c | 240 +++++++++++++++++
17 files changed, 784 insertions(+), 7 deletions(-)
create mode 100644 drivers/platform/x86/intel/tdx/Kconfig
create mode 100644 drivers/platform/x86/intel/tdx/Makefile
create mode 100644 drivers/platform/x86/intel/tdx/intel_tdx_attest.c
create mode 100644 include/uapi/misc/tdx.h
create mode 100644 tools/tdx/Makefile
create mode 100644 tools/tdx/attest/.gitignore
create mode 100644 tools/tdx/attest/Makefile
create mode 100644 tools/tdx/attest/tdx-attest-test.c
--
2.25.1
