Re: [PATCH RFC v8 27/56] crypto: ccp: Add the SNP_{SET,GET}_EXT_CONFIG command

[Tom Lendacky]

On 2/22/23 06:32, Zhi Wang wrote:
> On Mon, 20 Feb 2023 12:38:18 -0600
> Michael Roth <michael.roth@xxxxxxx> wrote:
>
> > From: Brijesh Singh <brijesh.singh@xxxxxxx>
> >
> > The SEV-SNP firmware provides the SNP_CONFIG command used to set the
> > system-wide configuration value for SNP guests. The information includes
> > the TCB version string to be reported in guest attestation reports.
> >
> > Version 2 of the GHCB specification adds an NAE (SNP extended guest
> > request) that a guest can use to query the reports that include additional
> > certificates.
> >
> > In both cases, userspace provided additional data is included in the
> > attestation reports. The userspace will use the SNP_SET_EXT_CONFIG
> > command to give the certificate blob and the reported TCB version string
> > at once. Note that the specification defines certificate blob with a
> > specific GUID format; the userspace is responsible for building the
> > proper certificate blob. The ioctl treats it an opaque blob.
> >
> > While it is not defined in the spec, but let's add SNP_GET_EXT_CONFIG
> > command that can be used to obtain the data programmed through the
> > SNP_SET_EXT_CONFIG.
> >
> > Signed-off-by: Brijesh Singh <brijesh.singh@xxxxxxx>
> > Signed-off-by: Ashish Kalra <ashish.kalra@xxxxxxx>
> > Signed-off-by: Michael Roth <michael.roth@xxxxxxx>
> > ---
> >   Documentation/virt/coco/sev-guest.rst |  27 ++++++
> >   drivers/crypto/ccp/sev-dev.c          | 123 ++++++++++++++++++++++++++
> >   drivers/crypto/ccp/sev-dev.h          |   4 +
> >   include/uapi/linux/psp-sev.h          |  17 ++++
> >   4 files changed, 171 insertions(+)

> > diff --git a/drivers/crypto/ccp/sev-dev.c b/drivers/crypto/ccp/sev-dev.c
> > index 65e13a562f3b..b56b00ca2cd4 100644
> > --- a/drivers/crypto/ccp/sev-dev.c
> > +++ b/drivers/crypto/ccp/sev-dev.c
> > @@ -1481,6 +1481,10 @@ static int __sev_snp_shutdown_locked(int *error)
> >   	data.length = sizeof(data);
> >   	data.iommu_snp_shutdown = 1;
> >   
> > +	/* Free the memory used for caching the certificate data */
> > +	kfree(sev->snp_certs_data);
> > +	sev->snp_certs_data = NULL;
> > +
> >   	wbinvd_on_all_cpus();
> >   
> >   retry:
> > @@ -1793,6 +1797,118 @@ static int sev_ioctl_snp_platform_status(struct sev_issue_cmd *argp)
> >   	return ret;
> >   }
> >   
> > +static int sev_ioctl_snp_get_config(struct sev_issue_cmd *argp)
> > +{
> > +	struct sev_device *sev = psp_master->sev_data;
> > +	struct sev_user_data_ext_snp_config input;
> > +	int ret;
> > +
> > +	if (!sev->snp_initialized || !argp->data)
> > +		return -EINVAL;
> > +
> > +	memset(&input, 0, sizeof(input));
> > +
> > +	if (copy_from_user(&input, (void __user *)argp->data, sizeof(input)))
> > +		return -EFAULT;
> > +
> > +	/* Copy the TCB version programmed through the SET_CONFIG to userspace */
> > +	if (input.config_address) {
> > +		if (copy_to_user((void * __user)input.config_address,
> > +				 &sev->snp_config, sizeof(struct sev_user_data_snp_config)))
> > +			return -EFAULT;
> > +	}
> > +
> > +	/* Copy the extended certs programmed through the SNP_SET_CONFIG */
> > +	if (input.certs_address && sev->snp_certs_data) {
> > +		if (input.certs_len < sev->snp_certs_len) {
> > +			/* Return the certs length to userspace */
> > +			input.certs_len = sev->snp_certs_len;
> > +
> > +			ret = -ENOSR;

We should be consistent with the other SEV ioctls that return required 
lengths and return -EIO here instead -ENOSR.

Thanks,
Tom

> > +			goto e_done;
> > +		}
> > +
>
> What about if input.certs_len > sev->snp_certs_len? Is it possbile for the
> userspace to know the length of data in the buffer? (I guess it might be able
> to know the certs len through the blob data, but a comment here would be nice)
>
> > +		if (copy_to_user((void * __user)input.certs_address,
> > +				 sev->snp_certs_data, sev->snp_certs_len))
> > +			return -EFAULT;
> > +	}
> > +
> > +	ret = 0;
> > +
> > +e_done:
> > +	if (copy_to_user((void __user *)argp->data, &input, sizeof(input)))
> > +		ret = -EFAULT;
> > +
> > +	return ret;
> > +}