| Message ID | 20250324104653.138663-4-sgarzare@redhat.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | Enlightened vTPM support for SVSM on SEV-SNP | expand |
On Mon, Mar 24, 2025 at 11:46:48AM +0100, Stefano Garzarella wrote: > From: Stefano Garzarella <sgarzare@redhat.com> > > Add driver for the vTPM defined by the AMD SVSM spec [1]. > > The specification defines a protocol that a SEV-SNP guest OS can use to > discover and talk to a vTPM emulated by the Secure VM Service Module (SVSM) > in the guest context, but at a more privileged level (VMPL0). > > The new tpm-svsm platform driver uses two functions exposed by x86/sev > to verify that the device is actually emulated by the platform and to > send commands and receive responses. > > The device cannot be hot-plugged/unplugged as it is emulated by the > platform, so we can use module_platform_driver_probe(). The probe > function will only check whether in the current runtime configuration, > SVSM is present and provides a vTPM. > > This device does not support interrupts and sends responses to commands > synchronously. In order to have .recv() called just after .send() in > tpm_try_transmit(), the .status() callback returns 0, and both > .req_complete_mask and .req_complete_val are set to 0. > > [1] "Secure VM Service Module for SEV-SNP Guests" > Publication # 58019 Revision: 1.00 > > Signed-off-by: Stefano Garzarella <sgarzare@redhat.com> > --- > v4: > - moved "asm" includes after the "linux" includes [Tom] > - allocated buffer separately [Tom/Jarkko/Jason] > v3: > - removed send_recv() ops and followed the ftpm driver implementing .status, > .req_complete_mask, .req_complete_val, etc. [Jarkko] > - removed link to the spec because those URLs are unstable [Borislav] > --- > drivers/char/tpm/tpm_svsm.c | 155 ++++++++++++++++++++++++++++++++++++ > drivers/char/tpm/Kconfig | 10 +++ > drivers/char/tpm/Makefile | 1 + > 3 files changed, 166 insertions(+) > create mode 100644 drivers/char/tpm/tpm_svsm.c > > diff --git a/drivers/char/tpm/tpm_svsm.c b/drivers/char/tpm/tpm_svsm.c > new file mode 100644 > index 000000000000..1281ff265927 > --- /dev/null > +++ b/drivers/char/tpm/tpm_svsm.c > @@ -0,0 +1,155 @@ > +// SPDX-License-Identifier: GPL-2.0-only > +/* > + * Copyright (C) 2025 Red Hat, Inc. All Rights Reserved. > + * > + * Driver for the vTPM defined by the AMD SVSM spec [1]. > + * > + * The specification defines a protocol that a SEV-SNP guest OS can use to > + * discover and talk to a vTPM emulated by the Secure VM Service Module (SVSM) > + * in the guest context, but at a more privileged level (usually VMPL0). > + * > + * [1] "Secure VM Service Module for SEV-SNP Guests" > + * Publication # 58019 Revision: 1.00 > + */ > + > +#include <linux/module.h> > +#include <linux/kernel.h> > +#include <linux/platform_device.h> > +#include <linux/tpm_svsm.h> > + > +#include <asm/sev.h> > + > +#include "tpm.h" > + > +struct tpm_svsm_priv { > + void *buffer; > + u8 locality; > +}; > + > +static int tpm_svsm_send(struct tpm_chip *chip, u8 *buf, size_t len) > +{ > + struct tpm_svsm_priv *priv = dev_get_drvdata(&chip->dev); > + int ret; > + > + ret = svsm_vtpm_cmd_request_fill(priv->buffer, priv->locality, buf, len); > + if (ret) > + return ret; > + > + /* > + * The SVSM call uses the same buffer for the command and for the > + * response, so after this call, the buffer will contain the response > + * that can be used by .recv() op. > + */ > + return snp_svsm_vtpm_send_command(priv->buffer); > +} > + > +static int tpm_svsm_recv(struct tpm_chip *chip, u8 *buf, size_t len) > +{ > + struct tpm_svsm_priv *priv = dev_get_drvdata(&chip->dev); > + > + /* > + * The internal buffer contains the response after we send the command > + * to SVSM. > + */ > + return svsm_vtpm_cmd_response_parse(priv->buffer, buf, len); > +} > + > +static void tpm_svsm_cancel(struct tpm_chip *chip) > +{ > + /* not supported */ > +} > + > +static u8 tpm_svsm_status(struct tpm_chip *chip) > +{ > + return 0; > +} > + > +static bool tpm_svsm_req_canceled(struct tpm_chip *chip, u8 status) > +{ > + return false; > +} > + > +static struct tpm_class_ops tpm_chip_ops = { > + .flags = TPM_OPS_AUTO_STARTUP, > + .recv = tpm_svsm_recv, > + .send = tpm_svsm_send, > + .cancel = tpm_svsm_cancel, > + .status = tpm_svsm_status, > + .req_complete_mask = 0, > + .req_complete_val = 0, > + .req_canceled = tpm_svsm_req_canceled, If this was bundled with the patch set, this would short a lot: https://lore.kernel.org/linux-integrity/20250326161838.123606-1-jarkko@kernel.org/T/#u So maybe for v5? Including this patch does not take send_recv() out of consideration, it is just smart thing to do in all cases. It would be probably easiest to roll out my patch together with rest of the patch set. BR, Jarkko
On Wed, Mar 26, 2025 at 09:30:53PM +0200, Jarkko Sakkinen wrote: >On Mon, Mar 24, 2025 at 11:46:48AM +0100, Stefano Garzarella wrote: >> From: Stefano Garzarella <sgarzare@redhat.com> >> >> Add driver for the vTPM defined by the AMD SVSM spec [1]. >> >> The specification defines a protocol that a SEV-SNP guest OS can use to >> discover and talk to a vTPM emulated by the Secure VM Service Module (SVSM) >> in the guest context, but at a more privileged level (VMPL0). >> >> The new tpm-svsm platform driver uses two functions exposed by x86/sev >> to verify that the device is actually emulated by the platform and to >> send commands and receive responses. >> >> The device cannot be hot-plugged/unplugged as it is emulated by the >> platform, so we can use module_platform_driver_probe(). The probe >> function will only check whether in the current runtime configuration, >> SVSM is present and provides a vTPM. >> >> This device does not support interrupts and sends responses to commands >> synchronously. In order to have .recv() called just after .send() in >> tpm_try_transmit(), the .status() callback returns 0, and both >> .req_complete_mask and .req_complete_val are set to 0. >> >> [1] "Secure VM Service Module for SEV-SNP Guests" >> Publication # 58019 Revision: 1.00 >> >> Signed-off-by: Stefano Garzarella <sgarzare@redhat.com> >> --- >> v4: >> - moved "asm" includes after the "linux" includes [Tom] >> - allocated buffer separately [Tom/Jarkko/Jason] >> v3: >> - removed send_recv() ops and followed the ftpm driver implementing .status, >> .req_complete_mask, .req_complete_val, etc. [Jarkko] >> - removed link to the spec because those URLs are unstable [Borislav] >> --- >> drivers/char/tpm/tpm_svsm.c | 155 ++++++++++++++++++++++++++++++++++++ >> drivers/char/tpm/Kconfig | 10 +++ >> drivers/char/tpm/Makefile | 1 + >> 3 files changed, 166 insertions(+) >> create mode 100644 drivers/char/tpm/tpm_svsm.c >> >> diff --git a/drivers/char/tpm/tpm_svsm.c b/drivers/char/tpm/tpm_svsm.c >> new file mode 100644 >> index 000000000000..1281ff265927 >> --- /dev/null >> +++ b/drivers/char/tpm/tpm_svsm.c >> @@ -0,0 +1,155 @@ >> +// SPDX-License-Identifier: GPL-2.0-only >> +/* >> + * Copyright (C) 2025 Red Hat, Inc. All Rights Reserved. >> + * >> + * Driver for the vTPM defined by the AMD SVSM spec [1]. >> + * >> + * The specification defines a protocol that a SEV-SNP guest OS can use to >> + * discover and talk to a vTPM emulated by the Secure VM Service Module (SVSM) >> + * in the guest context, but at a more privileged level (usually VMPL0). >> + * >> + * [1] "Secure VM Service Module for SEV-SNP Guests" >> + * Publication # 58019 Revision: 1.00 >> + */ >> + >> +#include <linux/module.h> >> +#include <linux/kernel.h> >> +#include <linux/platform_device.h> >> +#include <linux/tpm_svsm.h> >> + >> +#include <asm/sev.h> >> + >> +#include "tpm.h" >> + >> +struct tpm_svsm_priv { >> + void *buffer; >> + u8 locality; >> +}; >> + >> +static int tpm_svsm_send(struct tpm_chip *chip, u8 *buf, size_t len) >> +{ >> + struct tpm_svsm_priv *priv = dev_get_drvdata(&chip->dev); >> + int ret; >> + >> + ret = svsm_vtpm_cmd_request_fill(priv->buffer, priv->locality, buf, len); >> + if (ret) >> + return ret; >> + >> + /* >> + * The SVSM call uses the same buffer for the command and for the >> + * response, so after this call, the buffer will contain the response >> + * that can be used by .recv() op. >> + */ >> + return snp_svsm_vtpm_send_command(priv->buffer); >> +} >> + >> +static int tpm_svsm_recv(struct tpm_chip *chip, u8 *buf, size_t len) >> +{ >> + struct tpm_svsm_priv *priv = dev_get_drvdata(&chip->dev); >> + >> + /* >> + * The internal buffer contains the response after we send the command >> + * to SVSM. >> + */ >> + return svsm_vtpm_cmd_response_parse(priv->buffer, buf, len); >> +} >> + >> +static void tpm_svsm_cancel(struct tpm_chip *chip) >> +{ >> + /* not supported */ >> +} >> + >> +static u8 tpm_svsm_status(struct tpm_chip *chip) >> +{ >> + return 0; >> +} >> + >> +static bool tpm_svsm_req_canceled(struct tpm_chip *chip, u8 status) >> +{ >> + return false; >> +} >> + >> +static struct tpm_class_ops tpm_chip_ops = { >> + .flags = TPM_OPS_AUTO_STARTUP, >> + .recv = tpm_svsm_recv, >> + .send = tpm_svsm_send, >> + .cancel = tpm_svsm_cancel, >> + .status = tpm_svsm_status, >> + .req_complete_mask = 0, >> + .req_complete_val = 0, >> + .req_canceled = tpm_svsm_req_canceled, > >If this was bundled with the patch set, this would short a lot: > >https://lore.kernel.org/linux-integrity/20250326161838.123606-1-jarkko@kernel.org/T/#u > >So maybe for v5? Including this patch does not take send_recv() >out of consideration, it is just smart thing to do in all cases. > >It would be probably easiest to roll out my patch together with >rest of the patch set. Yeah, I agree. I'll include it in this series and adapt this patch on top of it. Thanks, Stefano
On Thu, Mar 27, 2025 at 11:03:07AM +0100, Stefano Garzarella wrote: > On Wed, Mar 26, 2025 at 09:30:53PM +0200, Jarkko Sakkinen wrote: > > On Mon, Mar 24, 2025 at 11:46:48AM +0100, Stefano Garzarella wrote: > > > From: Stefano Garzarella <sgarzare@redhat.com> > > > > > > Add driver for the vTPM defined by the AMD SVSM spec [1]. > > > > > > The specification defines a protocol that a SEV-SNP guest OS can use to > > > discover and talk to a vTPM emulated by the Secure VM Service Module (SVSM) > > > in the guest context, but at a more privileged level (VMPL0). > > > > > > The new tpm-svsm platform driver uses two functions exposed by x86/sev > > > to verify that the device is actually emulated by the platform and to > > > send commands and receive responses. > > > > > > The device cannot be hot-plugged/unplugged as it is emulated by the > > > platform, so we can use module_platform_driver_probe(). The probe > > > function will only check whether in the current runtime configuration, > > > SVSM is present and provides a vTPM. > > > > > > This device does not support interrupts and sends responses to commands > > > synchronously. In order to have .recv() called just after .send() in > > > tpm_try_transmit(), the .status() callback returns 0, and both > > > .req_complete_mask and .req_complete_val are set to 0. > > > > > > [1] "Secure VM Service Module for SEV-SNP Guests" > > > Publication # 58019 Revision: 1.00 > > > > > > Signed-off-by: Stefano Garzarella <sgarzare@redhat.com> > > > --- > > > v4: > > > - moved "asm" includes after the "linux" includes [Tom] > > > - allocated buffer separately [Tom/Jarkko/Jason] > > > v3: > > > - removed send_recv() ops and followed the ftpm driver implementing .status, > > > .req_complete_mask, .req_complete_val, etc. [Jarkko] > > > - removed link to the spec because those URLs are unstable [Borislav] > > > --- > > > drivers/char/tpm/tpm_svsm.c | 155 ++++++++++++++++++++++++++++++++++++ > > > drivers/char/tpm/Kconfig | 10 +++ > > > drivers/char/tpm/Makefile | 1 + > > > 3 files changed, 166 insertions(+) > > > create mode 100644 drivers/char/tpm/tpm_svsm.c > > > > > > diff --git a/drivers/char/tpm/tpm_svsm.c b/drivers/char/tpm/tpm_svsm.c > > > new file mode 100644 > > > index 000000000000..1281ff265927 > > > --- /dev/null > > > +++ b/drivers/char/tpm/tpm_svsm.c > > > @@ -0,0 +1,155 @@ > > > +// SPDX-License-Identifier: GPL-2.0-only > > > +/* > > > + * Copyright (C) 2025 Red Hat, Inc. All Rights Reserved. > > > + * > > > + * Driver for the vTPM defined by the AMD SVSM spec [1]. > > > + * > > > + * The specification defines a protocol that a SEV-SNP guest OS can use to > > > + * discover and talk to a vTPM emulated by the Secure VM Service Module (SVSM) > > > + * in the guest context, but at a more privileged level (usually VMPL0). > > > + * > > > + * [1] "Secure VM Service Module for SEV-SNP Guests" > > > + * Publication # 58019 Revision: 1.00 > > > + */ > > > + > > > +#include <linux/module.h> > > > +#include <linux/kernel.h> > > > +#include <linux/platform_device.h> > > > +#include <linux/tpm_svsm.h> > > > + > > > +#include <asm/sev.h> > > > + > > > +#include "tpm.h" > > > + > > > +struct tpm_svsm_priv { > > > + void *buffer; > > > + u8 locality; > > > +}; > > > + > > > +static int tpm_svsm_send(struct tpm_chip *chip, u8 *buf, size_t len) > > > +{ > > > + struct tpm_svsm_priv *priv = dev_get_drvdata(&chip->dev); > > > + int ret; > > > + > > > + ret = svsm_vtpm_cmd_request_fill(priv->buffer, priv->locality, buf, len); > > > + if (ret) > > > + return ret; > > > + > > > + /* > > > + * The SVSM call uses the same buffer for the command and for the > > > + * response, so after this call, the buffer will contain the response > > > + * that can be used by .recv() op. > > > + */ > > > + return snp_svsm_vtpm_send_command(priv->buffer); > > > +} > > > + > > > +static int tpm_svsm_recv(struct tpm_chip *chip, u8 *buf, size_t len) > > > +{ > > > + struct tpm_svsm_priv *priv = dev_get_drvdata(&chip->dev); > > > + > > > + /* > > > + * The internal buffer contains the response after we send the command > > > + * to SVSM. > > > + */ > > > + return svsm_vtpm_cmd_response_parse(priv->buffer, buf, len); > > > +} > > > + > > > +static void tpm_svsm_cancel(struct tpm_chip *chip) > > > +{ > > > + /* not supported */ > > > +} > > > + > > > +static u8 tpm_svsm_status(struct tpm_chip *chip) > > > +{ > > > + return 0; > > > +} > > > + > > > +static bool tpm_svsm_req_canceled(struct tpm_chip *chip, u8 status) > > > +{ > > > + return false; > > > +} > > > + > > > +static struct tpm_class_ops tpm_chip_ops = { > > > + .flags = TPM_OPS_AUTO_STARTUP, > > > + .recv = tpm_svsm_recv, > > > + .send = tpm_svsm_send, > > > + .cancel = tpm_svsm_cancel, > > > + .status = tpm_svsm_status, > > > + .req_complete_mask = 0, > > > + .req_complete_val = 0, > > > + .req_canceled = tpm_svsm_req_canceled, > > > > If this was bundled with the patch set, this would short a lot: > > > > https://lore.kernel.org/linux-integrity/20250326161838.123606-1-jarkko@kernel.org/T/#u > > > > So maybe for v5? Including this patch does not take send_recv() > > out of consideration, it is just smart thing to do in all cases. > > > > It would be probably easiest to roll out my patch together with > > rest of the patch set. > > Yeah, I agree. I'll include it in this series and adapt this patch on top of > it. Yeah, and you could simplify to goal in the other patch set: it's about avoiding double-copy of a buffer. It's a totally legit argument that we can measure. So in the end this will help out landing that too because it takes away the extra cruft and streamlines the goal. > > Thanks, > Stefano > > BR, Jarkko
On Thu, Mar 27, 2025 at 01:53:59PM +0200, Jarkko Sakkinen wrote: > On Thu, Mar 27, 2025 at 11:03:07AM +0100, Stefano Garzarella wrote: > > On Wed, Mar 26, 2025 at 09:30:53PM +0200, Jarkko Sakkinen wrote: > > > On Mon, Mar 24, 2025 at 11:46:48AM +0100, Stefano Garzarella wrote: > > > > From: Stefano Garzarella <sgarzare@redhat.com> > > > > > > > > Add driver for the vTPM defined by the AMD SVSM spec [1]. > > > > > > > > The specification defines a protocol that a SEV-SNP guest OS can use to > > > > discover and talk to a vTPM emulated by the Secure VM Service Module (SVSM) > > > > in the guest context, but at a more privileged level (VMPL0). > > > > > > > > The new tpm-svsm platform driver uses two functions exposed by x86/sev > > > > to verify that the device is actually emulated by the platform and to > > > > send commands and receive responses. > > > > > > > > The device cannot be hot-plugged/unplugged as it is emulated by the > > > > platform, so we can use module_platform_driver_probe(). The probe > > > > function will only check whether in the current runtime configuration, > > > > SVSM is present and provides a vTPM. > > > > > > > > This device does not support interrupts and sends responses to commands > > > > synchronously. In order to have .recv() called just after .send() in > > > > tpm_try_transmit(), the .status() callback returns 0, and both > > > > .req_complete_mask and .req_complete_val are set to 0. > > > > > > > > [1] "Secure VM Service Module for SEV-SNP Guests" > > > > Publication # 58019 Revision: 1.00 > > > > > > > > Signed-off-by: Stefano Garzarella <sgarzare@redhat.com> > > > > --- > > > > v4: > > > > - moved "asm" includes after the "linux" includes [Tom] > > > > - allocated buffer separately [Tom/Jarkko/Jason] > > > > v3: > > > > - removed send_recv() ops and followed the ftpm driver implementing .status, > > > > .req_complete_mask, .req_complete_val, etc. [Jarkko] > > > > - removed link to the spec because those URLs are unstable [Borislav] > > > > --- > > > > drivers/char/tpm/tpm_svsm.c | 155 ++++++++++++++++++++++++++++++++++++ > > > > drivers/char/tpm/Kconfig | 10 +++ > > > > drivers/char/tpm/Makefile | 1 + > > > > 3 files changed, 166 insertions(+) > > > > create mode 100644 drivers/char/tpm/tpm_svsm.c > > > > > > > > diff --git a/drivers/char/tpm/tpm_svsm.c b/drivers/char/tpm/tpm_svsm.c > > > > new file mode 100644 > > > > index 000000000000..1281ff265927 > > > > --- /dev/null > > > > +++ b/drivers/char/tpm/tpm_svsm.c > > > > @@ -0,0 +1,155 @@ > > > > +// SPDX-License-Identifier: GPL-2.0-only > > > > +/* > > > > + * Copyright (C) 2025 Red Hat, Inc. All Rights Reserved. > > > > + * > > > > + * Driver for the vTPM defined by the AMD SVSM spec [1]. > > > > + * > > > > + * The specification defines a protocol that a SEV-SNP guest OS can use to > > > > + * discover and talk to a vTPM emulated by the Secure VM Service Module (SVSM) > > > > + * in the guest context, but at a more privileged level (usually VMPL0). > > > > + * > > > > + * [1] "Secure VM Service Module for SEV-SNP Guests" > > > > + * Publication # 58019 Revision: 1.00 > > > > + */ > > > > + > > > > +#include <linux/module.h> > > > > +#include <linux/kernel.h> > > > > +#include <linux/platform_device.h> > > > > +#include <linux/tpm_svsm.h> > > > > + > > > > +#include <asm/sev.h> > > > > + > > > > +#include "tpm.h" > > > > + > > > > +struct tpm_svsm_priv { > > > > + void *buffer; > > > > + u8 locality; > > > > +}; > > > > + > > > > +static int tpm_svsm_send(struct tpm_chip *chip, u8 *buf, size_t len) > > > > +{ > > > > + struct tpm_svsm_priv *priv = dev_get_drvdata(&chip->dev); > > > > + int ret; > > > > + > > > > + ret = svsm_vtpm_cmd_request_fill(priv->buffer, priv->locality, buf, len); > > > > + if (ret) > > > > + return ret; > > > > + > > > > + /* > > > > + * The SVSM call uses the same buffer for the command and for the > > > > + * response, so after this call, the buffer will contain the response > > > > + * that can be used by .recv() op. > > > > + */ > > > > + return snp_svsm_vtpm_send_command(priv->buffer); > > > > +} > > > > + > > > > +static int tpm_svsm_recv(struct tpm_chip *chip, u8 *buf, size_t len) > > > > +{ > > > > + struct tpm_svsm_priv *priv = dev_get_drvdata(&chip->dev); > > > > + > > > > + /* > > > > + * The internal buffer contains the response after we send the command > > > > + * to SVSM. > > > > + */ > > > > + return svsm_vtpm_cmd_response_parse(priv->buffer, buf, len); > > > > +} > > > > + > > > > +static void tpm_svsm_cancel(struct tpm_chip *chip) > > > > +{ > > > > + /* not supported */ > > > > +} > > > > + > > > > +static u8 tpm_svsm_status(struct tpm_chip *chip) > > > > +{ > > > > + return 0; > > > > +} > > > > + > > > > +static bool tpm_svsm_req_canceled(struct tpm_chip *chip, u8 status) > > > > +{ > > > > + return false; > > > > +} > > > > + > > > > +static struct tpm_class_ops tpm_chip_ops = { > > > > + .flags = TPM_OPS_AUTO_STARTUP, > > > > + .recv = tpm_svsm_recv, > > > > + .send = tpm_svsm_send, > > > > + .cancel = tpm_svsm_cancel, > > > > + .status = tpm_svsm_status, > > > > + .req_complete_mask = 0, > > > > + .req_complete_val = 0, > > > > + .req_canceled = tpm_svsm_req_canceled, > > > > > > If this was bundled with the patch set, this would short a lot: > > > > > > https://lore.kernel.org/linux-integrity/20250326161838.123606-1-jarkko@kernel.org/T/#u > > > > > > So maybe for v5? Including this patch does not take send_recv() > > > out of consideration, it is just smart thing to do in all cases. > > > > > > It would be probably easiest to roll out my patch together with > > > rest of the patch set. > > > > Yeah, I agree. I'll include it in this series and adapt this patch on top of > > it. > > Yeah, and you could simplify to goal in the other patch set: it's about > avoiding double-copy of a buffer. > > It's a totally legit argument that we can measure. So in the end this > will help out landing that too because it takes away the extra cruft > and streamlines the goal. ... IMHO there is this unwritten law for upstreaming kernel features that goes something like "further the goals are from white papers, closer they are to mainline" ;-) BR, Jarkkko
On Thu, Mar 27, 2025 at 01:57:31PM +0200, Jarkko Sakkinen wrote: >On Thu, Mar 27, 2025 at 01:53:59PM +0200, Jarkko Sakkinen wrote: >> On Thu, Mar 27, 2025 at 11:03:07AM +0100, Stefano Garzarella wrote: >> > On Wed, Mar 26, 2025 at 09:30:53PM +0200, Jarkko Sakkinen wrote: >> > > On Mon, Mar 24, 2025 at 11:46:48AM +0100, Stefano Garzarella wrote: [...] >> > > > + >> > > > +static struct tpm_class_ops tpm_chip_ops = { >> > > > + .flags = TPM_OPS_AUTO_STARTUP, >> > > > + .recv = tpm_svsm_recv, >> > > > + .send = tpm_svsm_send, >> > > > + .cancel = tpm_svsm_cancel, >> > > > + .status = tpm_svsm_status, >> > > > + .req_complete_mask = 0, >> > > > + .req_complete_val = 0, >> > > > + .req_canceled = tpm_svsm_req_canceled, >> > > >> > > If this was bundled with the patch set, this would short a lot: >> > > >> > > https://lore.kernel.org/linux-integrity/20250326161838.123606-1-jarkko@kernel.org/T/#u >> > > >> > > So maybe for v5? Including this patch does not take send_recv() >> > > out of consideration, it is just smart thing to do in all cases. >> > > >> > > It would be probably easiest to roll out my patch together with >> > > rest of the patch set. >> > >> > Yeah, I agree. I'll include it in this series and adapt this patch on top of >> > it. >> >> Yeah, and you could simplify to goal in the other patch set: it's about >> avoiding double-copy of a buffer. Yep, agree! >> >> It's a totally legit argument that we can measure. So in the end this >> will help out landing that too because it takes away the extra cruft >> and streamlines the goal. > >... IMHO there is this unwritten law for upstreaming kernel features >that goes something like "further the goals are from white papers, >closer they are to mainline" ;-) :-D I'll make a note of it! Thanks, Stefano
diff --git a/drivers/char/tpm/tpm_svsm.c b/drivers/char/tpm/tpm_svsm.c new file mode 100644 index 000000000000..1281ff265927 --- /dev/null +++ b/drivers/char/tpm/tpm_svsm.c @@ -0,0 +1,155 @@ +// SPDX-License-Identifier: GPL-2.0-only +/* + * Copyright (C) 2025 Red Hat, Inc. All Rights Reserved. + * + * Driver for the vTPM defined by the AMD SVSM spec [1]. + * + * The specification defines a protocol that a SEV-SNP guest OS can use to + * discover and talk to a vTPM emulated by the Secure VM Service Module (SVSM) + * in the guest context, but at a more privileged level (usually VMPL0). + * + * [1] "Secure VM Service Module for SEV-SNP Guests" + * Publication # 58019 Revision: 1.00 + */ + +#include <linux/module.h> +#include <linux/kernel.h> +#include <linux/platform_device.h> +#include <linux/tpm_svsm.h> + +#include <asm/sev.h> + +#include "tpm.h" + +struct tpm_svsm_priv { + void *buffer; + u8 locality; +}; + +static int tpm_svsm_send(struct tpm_chip *chip, u8 *buf, size_t len) +{ + struct tpm_svsm_priv *priv = dev_get_drvdata(&chip->dev); + int ret; + + ret = svsm_vtpm_cmd_request_fill(priv->buffer, priv->locality, buf, len); + if (ret) + return ret; + + /* + * The SVSM call uses the same buffer for the command and for the + * response, so after this call, the buffer will contain the response + * that can be used by .recv() op. + */ + return snp_svsm_vtpm_send_command(priv->buffer); +} + +static int tpm_svsm_recv(struct tpm_chip *chip, u8 *buf, size_t len) +{ + struct tpm_svsm_priv *priv = dev_get_drvdata(&chip->dev); + + /* + * The internal buffer contains the response after we send the command + * to SVSM. + */ + return svsm_vtpm_cmd_response_parse(priv->buffer, buf, len); +} + +static void tpm_svsm_cancel(struct tpm_chip *chip) +{ + /* not supported */ +} + +static u8 tpm_svsm_status(struct tpm_chip *chip) +{ + return 0; +} + +static bool tpm_svsm_req_canceled(struct tpm_chip *chip, u8 status) +{ + return false; +} + +static struct tpm_class_ops tpm_chip_ops = { + .flags = TPM_OPS_AUTO_STARTUP, + .recv = tpm_svsm_recv, + .send = tpm_svsm_send, + .cancel = tpm_svsm_cancel, + .status = tpm_svsm_status, + .req_complete_mask = 0, + .req_complete_val = 0, + .req_canceled = tpm_svsm_req_canceled, +}; + +static int __init tpm_svsm_probe(struct platform_device *pdev) +{ + struct device *dev = &pdev->dev; + struct tpm_svsm_priv *priv; + struct tpm_chip *chip; + int err; + + if (!snp_svsm_vtpm_probe()) + return -ENODEV; + + priv = devm_kmalloc(dev, sizeof(*priv), GFP_KERNEL); + if (!priv) + return -ENOMEM; + + /* + * The maximum buffer supported is one page (see SVSM_VTPM_MAX_BUFFER + * in tpm_svsm.h). + */ + priv->buffer = (void *)devm_get_free_pages(dev, GFP_KERNEL, 0); + if (!priv->buffer) + return -ENOMEM; + + /* + * FIXME: before implementing locality we need to agree what it means + * for the SNP SVSM vTPM + */ + priv->locality = 0; + + chip = tpmm_chip_alloc(dev, &tpm_chip_ops); + if (IS_ERR(chip)) + return PTR_ERR(chip); + + dev_set_drvdata(&chip->dev, priv); + + err = tpm2_probe(chip); + if (err) + return err; + + err = tpm_chip_register(chip); + if (err) + return err; + + dev_info(dev, "SNP SVSM vTPM %s device\n", + (chip->flags & TPM_CHIP_FLAG_TPM2) ? "2.0" : "1.2"); + + return 0; +} + +static void __exit tpm_svsm_remove(struct platform_device *pdev) +{ + struct tpm_chip *chip = platform_get_drvdata(pdev); + + tpm_chip_unregister(chip); +} + +/* + * tpm_svsm_remove() lives in .exit.text. For drivers registered via + * module_platform_driver_probe() this is ok because they cannot get unbound + * at runtime. So mark the driver struct with __refdata to prevent modpost + * triggering a section mismatch warning. + */ +static struct platform_driver tpm_svsm_driver __refdata = { + .remove = __exit_p(tpm_svsm_remove), + .driver = { + .name = "tpm-svsm", + }, +}; + +module_platform_driver_probe(tpm_svsm_driver, tpm_svsm_probe); + +MODULE_DESCRIPTION("SNP SVSM vTPM Driver"); +MODULE_LICENSE("GPL"); +MODULE_ALIAS("platform:tpm-svsm"); diff --git a/drivers/char/tpm/Kconfig b/drivers/char/tpm/Kconfig index 0fc9a510e059..fc3f1d10d31d 100644 --- a/drivers/char/tpm/Kconfig +++ b/drivers/char/tpm/Kconfig @@ -225,5 +225,15 @@ config TCG_FTPM_TEE help This driver proxies for firmware TPM running in TEE. +config TCG_SVSM + tristate "SNP SVSM vTPM interface" + depends on AMD_MEM_ENCRYPT + help + This is a driver for the AMD SVSM vTPM protocol that a SEV-SNP guest + OS can use to discover and talk to a vTPM emulated by the Secure VM + Service Module (SVSM) in the guest context, but at a more privileged + level (usually VMPL0). To compile this driver as a module, choose M + here; the module will be called tpm_svsm. + source "drivers/char/tpm/st33zp24/Kconfig" endif # TCG_TPM diff --git a/drivers/char/tpm/Makefile b/drivers/char/tpm/Makefile index 9bb142c75243..52d9d80a0f56 100644 --- a/drivers/char/tpm/Makefile +++ b/drivers/char/tpm/Makefile @@ -44,3 +44,4 @@ obj-$(CONFIG_TCG_XEN) += xen-tpmfront.o obj-$(CONFIG_TCG_CRB) += tpm_crb.o obj-$(CONFIG_TCG_VTPM_PROXY) += tpm_vtpm_proxy.o obj-$(CONFIG_TCG_FTPM_TEE) += tpm_ftpm_tee.o +obj-$(CONFIG_TCG_SVSM) += tpm_svsm.o