sev-guest: configfs-tsm: Allow the privlevel_floor attribute to be updated

With the introduction of an SVSM, Linux will be running at a non-zero
VMPL. Any request for an attestation report at a higher privilege VMPL
than what Linux is currently running will result in an error. Allow for
the privlevel_floor attribute to be updated dynamically.

  [ bp: Trim commit message. ]

Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/5a736be9384aebd98a0b7c929660f8a97cbdc366.1717600736.git.thomas.lendacky@amd.com

diff --git a/drivers/virt/coco/sev-guest/sev-guest.c b/drivers/virt/coco/sev-guest/sev-guest.c
index 4597042f31e45d295d2a73824acd026e489946ee..3560b3a8bb4db915990b15f584ce79606a008021 100644 (file)
--- a/drivers/virt/coco/sev-guest/sev-guest.c
+++ b/drivers/virt/coco/sev-guest/sev-guest.c
@@ -892,7 +892,7 @@ static int sev_report_new(struct tsm_report *report, void *data)
        return 0;
 }
 
-static const struct tsm_ops sev_tsm_ops = {
+static struct tsm_ops sev_tsm_ops = {
        .name = KBUILD_MODNAME,
        .report_new = sev_report_new,
 };
@@ -979,6 +979,9 @@ static int __init sev_guest_probe(struct platform_device *pdev)
        snp_dev->input.resp_gpa = __pa(snp_dev->response);
        snp_dev->input.data_gpa = __pa(snp_dev->certs_data);
 
+       /* Set the privlevel_floor attribute based on the vmpck_id */
+       sev_tsm_ops.privlevel_floor = vmpck_id;
+
        ret = tsm_register(&sev_tsm_ops, snp_dev, &tsm_report_extra_type);
        if (ret)
                goto e_free_cert_data;

diff --git a/include/linux/tsm.h b/include/linux/tsm.h
index de8324a2223c52597e476b6fb67f745281ca193a..50c5769657d824a990153dc2fbd15b5781818d89 100644 (file)
--- a/include/linux/tsm.h
+++ b/include/linux/tsm.h
@@ -54,7 +54,7 @@ struct tsm_report {
  */
 struct tsm_ops {
        const char *name;
-       const unsigned int privlevel_floor;
+       unsigned int privlevel_floor;
        int (*report_new)(struct tsm_report *report, void *data);
 };