Re: [RFC PATCH v1 10/11] virt: coco: arm-cca-host: Publish slot zero and establish streams after acceptance

[Dave Jiang <dave.jiang@intel.com>]

On 11/4/26 9:54 AM, Dave Jiang wrote:
> 
> 
> On 11/4/26 6:41 AM, Jason Gunthorpe wrote:
> <--snip-->
> 
>> Is there a PDF for TDX's SPDM flow someplace? I will try to draft a
>> more complete document
> 
> TDX connect architecture spec
> https://cdrdv2-public.intel.com/862706/Intel%20TDX%20Connect%20EAS%20354629%20004.pdf
> 2.7.5 Figure 2.6
> 
> TDX connect TEE-IO device guide
> https://cdrdv2-public.intel.com/861654/whitepaper-tee-io-device-guide-v0-7-0.pdf
> Appendix B.1.1 Table B-1

I generated a diagram that hopefully better reflects Option A with TDX better than the current public documentations:

Option (a) on TDX, with the current TDX Connect ABI: slot 0 only, no TDX
change. Numbers in the left margin point to the notes below.

  ---->   call                 <- - -   return
  <---->  SPDM request and response in clear text, relayed by the host
  <====>  the same, inside the SPDM session

 Userspace           Host kernel             TDX Module                 Device
 (systemd,            (PCI/TSM,                 (TSM)                    (DSM)
 verifier)            tdx-host)
     |                    |                       |                        |
=== sysfs connect ==========================================================
     |                    |                       |                        |
(1)  | connect            |                       |                        |
     |------------------->|                       |                        |
     |                    |                       |                        |
=== Step 1: START CONNECT ==================================================
     |                    |                       |                        |
     | START CONNECT      |                       |                        |
     |------------------->|                       |                        |
     |                    |                       |                        |
     | 0 (no-op)          |                       |                        |
     |<- - - - - - - - - -|                       |                        |
     |                    |                       |                        |
=== Step 2: query certificates, query VCA items ============================
     |                    |                       |                        |
     | query certificates |                       |                        |
     |------------------->|                       |                        |
     |                    |                       |                        |
     | -EOPNOTSUPP        |                       |                        |
     |<- - - - - - - - - -|                       |                        |
     |                    |                       |                        |
=== Step 3: FINISH CONNECT with slot S =====================================
     |                    |                       |                        |
     | FINISH CONNECT(S)  |                       |                        |
     |------------------->|                       |                        |
     |                    |                       |                        |
     | if S != 0:         |                       |                        |
(2)  | refused            |                       |                        |
     |<- - - - - - - - - -|                       |                        |
     |                    |                       |                        |
     | if S == 0:         |                       |                        |
(3)  |                    | TDH.SPDM.CONNECT      |                        |
     |                    |---------------------->|                        |
     |                    |                       |                        |
(4)  |                    |                       | GET_VERSION            |
     |                    |                       |<---------------------->|
     |                    |                       | GET_CAPABILITIES       |
     |                    |                       |<---------------------->|
     |                    |                       | NEGOTIATE_ALGORITHMS   |
     |                    |                       |<---------------------->|
     |                    |                       | GET_CERTIFICATE slot 0 |
     |                    |                       |<---------------------->|
(5)  |                    |                       | KEY_EXCHANGE slot 0    |
     |                    |                       |<---------------------->|
     |                    |                       | FINISH                 |
     |                    |                       |<======================>|
     |                    |                       | GET_MEASUREMENTS       |
     |                    |                       |<======================>|
     |                    |                       | GET_TDISP_VERSION      |
     |                    |                       |<======================>|
     |                    |                       | GET_TDISP_CAPABILITIES |
     |                    |                       |<======================>|
     |                    |                       |                        |
(6)  |                    | device info           |                        |
     |                    |<- - - - - - - - - - - |                        |
     |                    |                       |                        |
     | 0                  |                       |                        |
     |<- - - - - - - - - -|                       |                        |
     |                    |                       |                        |
=== Step 4: query certificates, query final transcript items ===============
     |                    |                       |                        |
     | query certificates |                       |                        |
     |------------------->|                       |                        |
     |                    |                       |                        |
     | slot 0's chain     |                       |                        |
     |<- - - - - - - - - -|                       |                        |
     |                    |                       |                        |
     | query transcript   |                       |                        |
     |------------------->|                       |                        |
     |                    |                       |                        |
(6)  | device info        |                       |                        |
     |<- - - - - - - - - -|                       |                        |
     |                    |                       |                        |
     .--- optional: fresh measurements for a caller's nonce ---------------.
     |                    |                       |                        |
     | nonce              |                       |                        |
     |------------------->|                       |                        |
     |                    |                       |                        |
(7)  |                    | TDH.SPDM.MNG(nonce)   |                        |
     |                    |---------------------->|                        |
     |                    |                       |                        |
     |                    |                       | GET_CERTIFICATE        |
     |                    |                       |<======================>|
     |                    |                       | GET_MEASUREMENTS       |
     |                    |                       |<======================>|
     |                    |                       |                        |
     |                    | new device info       |                        |
     |                    |<- - - - - - - - - - - |                        |
     |                    |                       |                        |
     | one-shot result    |                       |                        |
     |<- - - - - - - - - -|                       |                        |
     |                    |                       |                        |
     '---------------------------------------------------------------------'
     |                    |                       |                        |
=== Step 5: ACCEPT (host) ==================================================
     |                    |                       |                        |
     | ACCEPT             |                       |                        |
     |------------------->|                       |                        |
     |                    |                       |                        |
(8)  |                    | TDH.IDE.STREAM.*      |                        |
     |                    |---------------------->|                        |
     |                    |                       |                        |
     |                    |                       | IDE_KM key programming |
     |                    |                       |<======================>|

Notes:
(1) Creates the attestation endpoint only; no TSM call.
(2) TDH.SPDM.CONNECT has no KEY_EXCHANGE slot input.
    CERTIFICATE_SLOT_MASK, the only slot field in SPDM_CONFIG_INFO_T, is
    the "Device certificate request slot mask" [ABI 3.3.2.2]: it picks
    which chains to read, not the slot. So userspace can't enumerate
    slots by repeating step 3.
(3) TDH.SPDM.CREATE runs first. The kernel sets CERTIFICATE_SLOT_MASK to
    0x01, so the TSM reads only slot 0's chain. It could also read slots
    1-7 inside the session [GUIDE B.1.1, Table B-1], but no signature
    would cover them: KEY_EXCHANGE hashes only the chain of the slot it
    names [SPDM 10.18.1]. So (a) doesn't report them.
(4) The host relays each message over DOE [ABI 3.3.3, 4.2.20]. No
    GET_DIGESTS and no CHALLENGE [ARCH 2.7.5, Figure 2.6]. The guide's
    session setup example also reads slot 0's chain before KEY_EXCHANGE
    [GUIDE B.1.1, Table B-1].
(5) The TSM verifies the KEY_EXCHANGE_RSP signature [SPDM para 630]. The
    host trusts that check, so it keeps no KEY_EXCHANGE messages.
(6) SPDM_DEVICE_ATTESTATION_INFO_T [ABI 3.3.2.4]: SPDM and TDISP
    capabilities, TDISP version, the requested chains, and MEASUREMENT.
    MEASUREMENT is the signed SPDM measurement log, Concatenate(VCA,
    GET_MEASUREMENTS_REQUEST1, MEASUREMENTS_RESPONSE1, ...,
    GET_MEASUREMENTS_REQUESTn, MEASUREMENTS_RESPONSEn) [SPDM 10.12.3].
    The last MEASUREMENTS carries the signature. The TDX Module keeps
    the info's digest. The kernel keeps the info as immutable startup
    data.
(7) DEV_INFO_RECOLLECTION puts the caller's nonce in GET_MEASUREMENTS
    [ABI 3.3.2.3], and the TSM reads the chains again
    [GUIDE B.1.5, Table B-5]. The device signs the new measurement log,
    nonce included [SPDM 10.12.3]. That signature is what protects the
    new measurements. The verifier must check it with the leaf key of
    slot 0, the slot KEY_EXCHANGE used, and must find its nonce in the
    log to know the result is fresh. The kernel hands the result over
    once and doesn't store it.
(8) TDH.IDE.STREAM.CREATE, then TDH.IDE.STREAM.KM. IDE setup moves from
    connect to ACCEPT.

Sources:
  [ABI]    TDX Connect ABI Reference Specification 2.1 V0.66
           https://cdrdv2.intel.com/v1/dl/getContent/858625
  [ARCH]   Intel TDX Connect Architecture Specification, 354629-003
           https://cdrdv2.intel.com/v1/dl/getContent/773614
  [GUIDE]  Intel TDX Connect TEE-IO Device Guide, 354272-002
           https://cdrdv2.intel.com/v1/dl/getContent/772642
  [SPDM]   DMTF DSP0274 1.4.1