Re: [PATCH RFC 00/20] attestation: Add a common subsystem and TDX support

[Aneesh Kumar K.V <aneesh.kumar@kernel.org>]

Jason Gunthorpe <jgg@ziepe.ca> writes:

> On Fri, Oct 23, 2026 at 01:34:53PM +0530, Aneesh Kumar K.V wrote:
>
>> CCA currently takes the device identity index during pdev_create. I am
>> investigating how to retrieve the certificate chains for all slots. For
>> now, I have implemented the sequence below.
>
> Yeah, I think the consensus at LPC was this may be a gap in CCA.
>

I checked with Alexey, and if I understand him correctly, TIO also needs
to establish eight separate connections to retrieve the certificate
chains.

>
> For now I can imainge CCA just doesn't let you query the certificates,
> and we'd need an ECN to correct it someday once all the kernel parts
> are settled.
>
> I broadly hope we can use the software SPDM implementation to really
> flesh out the uapi and make sure that everyone is happy with it. Then
> we get what subset we get from the first generation of products.
>
> Something like if userspace can't get the slot information early it
> just hardwires slot 0 and goes forward.
>


For now, I am trying Jiri's suggestion: use Rust SPDM to fetch the
certificate chain and return it via evidence-get. evidence-accept then
does pdev-create with the specified slot number and compares the
evidence data returned by the RMM with the value cached by Rust SPDM. If
they match, it uses the cached value for set_pub_key. This seems to be
working. (FVP only supports slot 0, hence only one blob-instance)

# echo tsm0 > /sys/bus/pci/devices/$DEVICE/tsm/connect
[ 2325.581999] PCI/TSM 0000:02:00.0: connect via tsm0, SPDM discovery enabled=1
[ 2325.582080] PCI/TSM 0000:02:00.0: starting preliminary Rust SPDM discovery over DOE
[ 2325.594379] PCI/TSM 0000:02:00.0: Rust SPDM version=0x12 supported slots=0xff populated slots=0x1
[ 2325.594459] PCI/TSM 0000:02:00.0: fetching certificate chain for slot 0 via Rust SPDM
[ 2325.623625] PCI/TSM 0000:02:00.0: cached certificate chain for slot 0, 1668 bytes
[ 2325.623699] PCI/TSM 0000:02:00.0: preliminary Rust SPDM discovery complete
# cd ../tools/ctlv/
# sh -x cert.sh
+ ./ctlvctl/ctlvctl --spec-dir=./specs/ exec ctlv0 device-get
# device-get, 1 fragment, generation 0
  device.generation 0
  device.caps
    cap.evidence
      cap.min-challenge-length 0
      cap.max-challenge-length 0
      cap.max-total-output-length 369098752
      cap.evidence-flags evidence-accept,object-selection
      cap.object
        cap.blob-class cert-chain
        cap.blob-instance 0
        cap.format spdm-cert-chain
        cap.representation raw
        cap.representation tcb-digest
        cap.hash-algo 4
        cap.hash-algo 5
        cap.hash-algo 6
        cap.max-length 16777216
  device.info
    pci.name 0000:02:00.0
+ ./ctlvctl/ctlvctl --spec-dir=./specs/ exec ctlv0 state-get
# state-get, 1 fragment, generation 0
  pci.generation 0
  pci.connected 1
  pci.locked 0
  pci.accepted 0
  pci.tsm-id 0
  pci.dsm 0000:02:00.0
+ ./ctlvctl/ctlvctl --spec-dir=./specs/ exec ctlv0 evidence-get --json '{ "evidence.challenge": "hex:", "evidence.object": [{ "evidence.blob-class": "cert-chain", "evidence.format": "spdm-cert-chain", "evidence.blob-instance": 0, "evidence.representation": "raw", "evidence.data": { "file": "/tmp/cert0.bin", "data-buf-size": 16777216 } }] }'
# evidence-get, 1 fragment, generation 0
  device.generation 0
  evidence.generation 1
  evidence.object-length 1668
+ ./ctlvctl/ctlvctl --spec-dir=./specs/ exec ctlv0 evidence-accept --json '{ "device.generation": 0, "evidence.generation": 1, "evidence.accept-object": { "evidence.blob-class": "cert-chain", "evidence.format": "spdm-cert-chain", "evidence.blob-instance": 0 } }'
# acknowledged
+ ./ctlvctl/ctlvctl --spec-dir=./specs/ exec ctlv0 state-get
# state-get, 1 fragment, generation 0
  pci.generation 0
  pci.connected 1
  pci.locked 0
  pci.accepted 1
  pci.tsm-id 0
  pci.dsm 0000:02:00.0
#

-aneesh