Re: [PATCH RFC 00/20] attestation: Add a common subsystem and TDX support

[Nikolay Borisov <nik.borisov@suse.com>]

On 15.10.26 г. 17:50 ч., Jiri Pirko wrote:
> From: Jiri Pirko <jiri@nvidia.com>
> 
> Linux has several attestation interfaces tied to individual technologies.
> That makes evidence retrieval, measurement registers, device state and
> kernel consumers provider-specific.
> 
> This series introduces a common attestation subsystem. Its goal is to
> support platform, TEE and device providers through one model, including
> TPM2, TDX, SEV-SNP, Arm CCA, FIRME, Caliptra and PCI/TSM-backed devices.
> This first series implements the common subsystem and a TDX provider.
> Existing native TDX tsm_mr and tsm_report interfaces remain independent.

Wasn't config-tsm supposed to be this common attestation subsystem? Was 
this discussed when the initial config-tsm was proposed? Why is this 
coming now?

> 
> Attestation devices use CTLV, a schema-driven character-device TLV UAPI.
> Compared with sysfs or configfs, CTLV executes one validated request
> atomically instead of assembling a transaction through several files.
> Compared with netlink, an opened device fd directly identifies authority
> and lifetime, can be delegated normally, and owns its event queue. CTLV
> also provides:

Assuming we want to go through the route of CTLV, do we really want an 
attestation-specific  interface, or most of this functionality can 
simply be implemented as a specific genetlink protocol, utilising all 
the existing hardening that has gone into netlink's infrastructure to 
marshal messages from userspace to kernel space?

> 
>    - generated kernel metadata, UAPI constants and documentation;
>    - strict type, bounds, nesting and required-field validation;
>    - runtime operation and schema introspection;
>    - family inheritance and extension points;
>    - fragmented queries with generation checks;
>    - per-fd event subscription, overflow reporting and removal notification;
>    - large input and output blobs.
> 
> The attestation family exposes capabilities, evidence, measurement-register
> topology and operations, an append-only MR journal and journal
> notifications. This first ABI contains the paths exercised by TDX. Extended
> evidence classes, dynamic registers, record payloads, verdict recording and
> device-security transitions follow with providers that need them and are out
> of scope of this initial patchset. The broader direction is illustrated here:
> 
> https://github.com/jpirko/linux_mlxsw/commits/wip_attestation_all_1
> 
> That branch also contains additional providers (test and sim),
> attestation core extensions, libctlv and ctlvctl. With the tools
> and kernel specifications, an attestation device can be used as follows:
> 
>    # Discover CTLV devices and their family chains.
>    ctlvctl --spec-dir Documentation/ctlv/specs list
> 
>    # Inspect the root-family lineage and attestation capabilities.
>    ctlvctl --spec-dir Documentation/ctlv/specs query ctlv0 families-dump
>    ctlvctl --spec-dir Documentation/ctlv/specs query ctlv0 device-get
> 
>    # List the measurement registers of the attestation device.
>    ctlvctl --spec-dir Documentation/ctlv/specs query ctlv0 mr-dump
> 
>    # Read RTMR0 (MR 1).
>    ctlvctl --spec-dir Documentation/ctlv/specs \
>            query ctlv0 mr-read mr.id=1
> 
>    # Extend RTMR0 with 48 zero bytes (SHA-384).
>    digest=$(printf '%096d' 0)
>    ctlvctl --spec-dir Documentation/ctlv/specs \
>            exec ctlv0 mr-extend --json \
>            '{"id":1,"value":[{"hash-algo":5,"data":"hex:'"$digest"'"}]}'
> 
>    # Retrieve the RTMR0 journal.
>    ctlvctl --spec-dir Documentation/ctlv/specs \
>            query ctlv0 mr-log-get --json '{"selection":[{"id":1}]}'
> 
> The 20 patches are organized as follows:
> 
>    1-13    add CTLV, its generator and documentation
>    14-17   add the base attestation family and implementation
>    18-20   expose the native TDX service and add the TDX family
> 
> Note to reviewers: Please focus on the overall design, UAPI and internal
> attestation-provider API. The internal CTLV and attestation implementations
> remain rough around the edges.
> 

<snip>

>   83 files changed, 18084 insertions(+), 28 deletions(-)

That's an awful lot of code to just move certain binary blobs around 
(Judging by what config-tsm is doing ATM).

<snip>