Received-SPF: pass (google.com: domain of linux-kernel+bounces-193104-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Message-ID: <e7c24be1-dbea-0efd-2661-b626fd655478@amd.com>
Date: Tue, 28 May 2024 16:08:35 -0500
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.15.1
Content-Language: en-US
To: Borislav Petkov <bp@alien8.de>
Cc: linux-kernel@vger.kernel.org, x86@kernel.org, linux-coco@lists.linux.dev,
 svsm-devel@coconut-svsm.dev, Thomas Gleixner <tglx@linutronix.de>,
 Ingo Molnar <mingo@redhat.com>, Dave Hansen <dave.hansen@linux.intel.com>,
 "H. Peter Anvin" <hpa@zytor.com>, Andy Lutomirski <luto@kernel.org>,
 Peter Zijlstra <peterz@infradead.org>,
 Dan Williams <dan.j.williams@intel.com>, Michael Roth
 <michael.roth@amd.com>, Ashish Kalra <ashish.kalra@amd.com>
References: <cover.1713974291.git.thomas.lendacky@amd.com>
 <435f78e07c76e25d2d857138724098bc2a729b0a.1713974291.git.thomas.lendacky@amd.com>
 <20240527135101.GBZlSPxQ6iBSlMDefY@fat_crate.local>
From: Tom Lendacky <thomas.lendacky@amd.com>
Subject: Re: [PATCH v4 09/15] x86/sev: Provide guest VMPL level to userspace
In-Reply-To: <20240527135101.GBZlSPxQ6iBSlMDefY@fat_crate.local>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0:
	=?utf-8?B?OVVYallySWFFc3JvUWpuNzlXVHA4aUFsZHd5UWc5NjgrNHRsVURQN21IWHZ6?=
 =?utf-8?B?N3ZvUmJkdE93YkZzN3BBQkZpSmVNVHM5NXFJWU03aXlPOGdtdzF4RzRKWUM2?=
 =?utf-8?B?ZEdHamdvNDh6bGR6MW50a2hkTkRxdFVwb1djSmdmOFlwMm96b2ZKV0lkMU50?=
 =?utf-8?B?QVNiSjR0VTdyY3h4V2RZZkRwRVQyUVY5dW9sZWZIMWVSeEtjL21la0xqTVl4?=
 =?utf-8?B?WXE5R1BQTloweDZtc2NORUR3QTkvRDNyZTdrL0l3ZXdGbmc0UEt3U3QrdnZH?=
 =?utf-8?B?clNHckJhV21DbDdzZFZuemF5ajMwVlp3Ui8zQXZzK1FmaDBDZlJRaHpQYjhE?=
 =?utf-8?B?M0V4Zzg3bXVETm5CWnBGTUhYMVFLdVc5TDNBNGMwNDFrWXRHc3VGdHE4cUY5?=
 =?utf-8?B?YVkrTWEzRXY4ZlA1ZWViZit5dTh6RVlaMzM3UzJkK0c0bWtQRzJlZW1XdWZE?=
 =?utf-8?B?V3JuWlkwZmUyWnBicXM1ZWJYZmkyRVFyZE8yZlRKazRodTg3cWtwQUVWK202?=
 =?utf-8?B?bTlpelpqQkFoakhFL1g1cWZGaE9MOGZTdkQ3YTRPNkpXZlZDMDlqViswanZV?=
 =?utf-8?B?V2JFQ0lkdjZUa1JUcy82OWJuOXE1SjZURzJHa3BXYXNYS3FwbEF3WUlnU0Yx?=
 =?utf-8?B?MmR1MEl6ZmhSRERUa2dnaUxiSSs1M0ZXVGU4UERDUENRZWhrcGJoSTQra0pr?=
 =?utf-8?B?N2hralN3Q010WW1Sbkk0QkFNZm83aXFMbnk0N25HWlNsd2RPZzBQZW5aamRG?=
 =?utf-8?B?eXdjQjhuRDhmWUhtV0F1L2p4dHNIZXBOQzRieXZwSW9KWEl3enRaT3Y3clFh?=
 =?utf-8?B?RHMwZHplSmdMQi9XaEhsejltWkxWRjg2N3pCWlA2WDJYb1dCeXJFYUt0SFJx?=
 =?utf-8?B?R0VjTmVieDNiMm1ValBrYlo2MjhoN3hkVVJiSSs3VlVpUElBbzdyZWhKRHJq?=
 =?utf-8?B?OUJJK3FUdEhDZGtFMlVxMDdhV3pYRjFwamN6NDU4b3pyMXNFUXFHUDhsRkFw?=
 =?utf-8?B?WHBsQnpKcDFiekhqRVVzSEFYbGVnRllwZlB4eVNpZENrcDZoZk5UQnNlTDQ0?=
 =?utf-8?B?RG80NVBmVUd2SU4xS2dnYlA2eU42a3ZVT05qQTZqMitub0F5d2Z0UXVCV2Mz?=
 =?utf-8?B?V1hVajZKRmpXUkNSNC9OckE3eVIra1FGWC9ycjN4UHBuZ0ZUN2d3NHV5ZVB1?=
 =?utf-8?B?ZWxpMnMwVEdLbitLWlhmVzhTQzQ1QzcxTS9sb0FvYjBZd0tsUTN1UVl3Q3l0?=
 =?utf-8?B?NmV2WVRpZDJQUmMwZ2pyWm5XenM0cVNUVmdtMmtsSHh3NzNOUnE1UjV1aHBW?=
 =?utf-8?B?dkFWUGd3T0ExOUdVdTlyYnBQVk1TNVV0dThwMkx4c09GaWZaMFVHM3VtMy8z?=
 =?utf-8?B?TUx3UWlpeFVPdkkvc2s0UVdJTU9QcEtSaVU5MGo4dUo3VjJBbTRTUFBTY3po?=
 =?utf-8?B?cG5kV0ZCV3ZYOE1mVk5MMGUzK0tlNURXYVZ6S2VGUzhERit3WVBnTTFYenAw?=
 =?utf-8?B?dkFjdmFlei8vdUhLY0o4ZDRJRjhaK0VKM2kzREFHbHp1bTdSQURWOGFvZ0JE?=
 =?utf-8?B?YWN0WUJYSWcvbzM1Umhrbzh4M1A3aU4xUU43eHlCWkNNdThLTFdKakR3a3Q0?=
 =?utf-8?B?S2xQOURVa1Z3eDdJekZYaEg4QTIwa1NyZ3R0Q0JoQ1hiTlN3UUs4Uk5NVitv?=
 =?utf-8?B?dng4R1lFTEVrVTY2WXhLOHRzaGtZMjRXdmtSY3ZOZ0ptcXJNMTNYQW9Udjds?=
 =?utf-8?B?ZmV3Y05GcUp5NVJ3QmJOM2N5bjlzeUwxUE4yQjVQVzdEQUpydkwzZlJ3czNy?=
 =?utf-8?B?YlZRUnBtajJMZjdacnlVd3N6R0x3OE15NEZhU08xWnM1d2kzLzhzSnVZZ2ta?=
 =?utf-8?B?amE5SENEUG01STYyU0RqQUh4dllKR1NJM0o0dVFFT2ZMWWRIWjBrbE1LNW9m?=
 =?utf-8?B?dk9MRklYQUo3cWMxcytjZm9mR3UyNVd2WUJJUitKWDE2UCtVSHRSR0pWbzhR?=
 =?utf-8?B?WVUvTW5SU3QxS3dzeVBTWE1zTWlOSFBQTXd3akRjcGdmQW1IVlRlSXJpMGJZ?=
 =?utf-8?B?WmZOdld5VXZzaWNWMG1kbU1EUWxra1pzdlFyY1pSQnQrMFNoUWZySWpibVJ4?=
 =?utf-8?Q?AOfLBMvbrOxJVgl9Gmclw4Ux7?=
X-OriginatorOrg: amd.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 1800786c-2229-4338-d0d1-08dc7f5a5831
X-MS-Exchange-CrossTenant-AuthSource: BL1PR12MB5732.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 28 May 2024 21:08:38.4342
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: DUqAM+sqPId/DLCi72gE5QfVlQyqbvcDfA0q+XxnwPUzp5o6QzTMDk9PrB4nL58bu7qyRvLru3KpOaWmt0Rtpw==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW4PR12MB6849

On 5/27/24 08:51, Borislav Petkov wrote:
> On Wed, Apr 24, 2024 at 10:58:05AM -0500, Tom Lendacky wrote:
>> Requesting an attestation report from userspace involves providing the
>> VMPL level for the report. Currently any value from 0-3 is valid because
>> Linux enforces running at VMPL0.
>>
>> When an SVSM is present, though, Linux will not be running at VMPL0 and
>> only VMPL values starting at the VMPL level Linux is running at to 3 are
>> valid. In order to allow userspace to determine the minimum VMPL value
>> that can be supplied to an attestation report, create a sysfs entry that
>> can be used to retrieve the current VMPL level of Linux.
> 
> So what is the use case here: you create the attestation report *on* the
> running guest and as part of that, the script which does that should do
> 
> cat /sys/.../sev/vmpl
> 
> ?
> 
> But then sev-guest does some VMPL including into some report:
> 
> struct snp_report_req {
>          /* user data that should be included in the report */
>          __u8 user_data[SNP_REPORT_USER_DATA_SIZE];
> 
>          /* The vmpl level to be included in the report */
>          __u32 vmpl;
> 
> Why do you need this and can't use sev-guest?

The vmpl value is input from user-space.

The SNP spec allows the VMPL that is put in the attestation report to be 
numerically equal to or higher than the current VMPL (which is 
determined based on the VMPCK key that is used). So this is to let 
userspace know that it shouldn't request a value numerically smaller 
than what is reported in sysfs in order to avoid failure of the request.

> 
>> +static int __init sev_sysfs_init(void)
>> +{
>> +	struct kobject *sev_kobj;
>> +	int ret;
>> +
>> +	if (!cc_platform_has(CC_ATTR_GUEST_SEV_SNP))
>> +		return -ENODEV;
>> +
>> +	sev_kobj = kobject_create_and_add("sev", kernel_kobj);
> 
> In the main hierarchy?!
> 
> This is a x86 CPU thing, so if anything, it should be under
> /sys/devices/system/cpu/

I can move it there. Or what about creating a coco folder under 
/sys/kernel/? This would then create /sys/kernel/coco/sev/?

Thanks,
Tom

>