Re: [PATCH RFC 00/20] attestation: Add a common subsystem and TDX support

[Aneesh Kumar K.V <aneesh.kumar@kernel.org>]

Jiri Pirko <jiri@resnulli.us> writes:

> Thu, Oct 22, 2026 at 12:30:47PM +0200, aneesh.kumar@kernel.org wrote:
>>Jiri Pirko <jiri@resnulli.us> writes:
>>
>>> From: Jiri Pirko <jiri@nvidia.com>
>>>

 [ ... 67 lines skipped ... ] 

>>>
>>
>>I am using this to understand what the IDE setup flow would look like,
>>but it is unclear whether the connect flow belongs in an attestation
>>framework. I understand the desire to pass the certificate slot number
>>as part of connect, and sysfs is probably not a suitable interface for
>>that. However, is CTLV the interface we want to use for connect?
>
> I was thinking about this and "connect" really does not belong in the
> attestation CTLV (same applies to "lock"). I was thinking about some
> parallel PCITSM CTLV instance, but that does not really click as well.
>
> Currently I'm thinking we can maintain existing "connect" in sysfs and
> extend it with "lock" sysfs knob for Realm side. Both would create
> ctlv-attestation-spdm instance. The same spdm instance may be created
> for other non-PCI-backed device.
>
> The proposed host flow is:
>
>     sysfs connect: select tsmN and prepare the connection
>         -> negotiate SPDM and discover certificates
>         -> register ctlv-attestation-spdm instance in DISCOVERED state
>
>     SPDM_GET
>         -> populated certificate slots and digests
>
>     EVIDENCE_GET(CERT_CHAIN, blob-instance=slot) /*optional*/
>         -> retrieve candidate certificate chain for appraisal
>
>     SPDM_AUTHENTICATE(device-generation, spdm-slot=selected_slot)
>         -> authenticate the selected chain
>         -> complete backend-required session and IDE setup
>
>     sysfs disconnect
>         -> remove the attestation instance
>         -> destroy the native connection
>
> The slot is therefore selected after discovery, rather than supplied to
> connect. The attestation instance represents the prepared connection; it
> does not exist beforehand as a controller for a disconnected PCI function.
>

CCA currently takes the device identity index during pdev_create. I am
investigating how to retrieve the certificate chains for all slots. For
now, I have implemented the sequence below.

echo tsm0 > /sys/bus/pci/devices/$DEVICE/tsm/connect

./ctlvctl/ctlvctl --spec-dir=./specs/ exec ctlv0 device-get                                                               
# device-get, 1 fragment, generation 0                                                                                      
  device.generation 0            
  device.caps                                                                                                               
    cap.evidence                                                                                                            
      cap.min-challenge-length 0                                                                                            
      cap.max-challenge-length 0                                                                                            
      cap.max-total-output-length 369098752                                                                                 
      cap.evidence-flags evidence-accept
      cap.object                                                                                                            
        cap.blob-class cert-chain                                                                                           
        cap.blob-instance 0                                                                                                 
        cap.format spdm-cert-chain
        cap.representation raw                                                                                              
        cap.representation tcb-digest                                                                                       
        cap.hash-algo 4                                                                                                     
        cap.hash-algo 5          
        cap.hash-algo 6                                                                                                     
        cap.max-length 16777216                                                                                             
  device.info                                                                                                               
    pci.name 0000:02:00.0                       

I think we can use evidence-refresh to select the blob-instance for the
desired slot once the CCA specification supports that.

 ./ctlvctl/ctlvctl --spec-dir=./specs/ exec ctlv0 state-get                                                                
# state-get, 1 fragment, generation 0
  pci.generation 0                                                                                                          
  pci.connected 1                                                                                                           
  pci.locked 0                                                                                                              
  pci.accepted 0                 
  pci.tsm-id 0                                                                                                              
  pci.dsm 0000:02:00.0                                                                                                      

device is marked connected, but IDE is not setup as indicated by pci.accepted = 0


./ctlvctl/ctlvctl --spec-dir=./specs/ exec ctlv0 evidence-get --json '{
"evidence.challenge": "hex:", "evidence.object": [{
"evidence.blob-class": "cert-chain", "evidence.format":
"spdm-cert-chain", "evidence.blob-instance": 0,
"evidence.representation": "raw", "evidence.data": { "file":
"/tmp/cert0.bin", "data-buf-size": 16777216 } }] }'
# evidence-get, 1 fragment, generation 0                                                                                    
  device.generation 0                                                                                                       
  evidence.generation 1                                                                                                     
  evidence.object-length 1632           


I added the file: attribute to verify the evidence blob's contents. ie,
we can do:

# file cert0.bin  
cert0.bin: Certificate, Version=3

./ctlvctl/ctlvctl --spec-dir=./specs/ exec ctlv0 evidence-accept device.generation=0 evidence.generation=1
# acknowledged
./ctlvctl/ctlvctl --spec-dir=./specs/ exec ctlv0 state-get
# state-get, 1 fragment, generation 0
  pci.generation 0
  pci.connected 1
  pci.locked 0
  pci.accepted 1
  pci.tsm-id 0
  pci.dsm 0000:02:00.0


I am wondering why we need 'devsec-run' ops. Isn't that already the result of
'evidence-accept'?

-aneesh