Re: [RFC PATCH v1 10/11] virt: coco: arm-cca-host: Publish slot zero and establish streams after acceptance

[Jason Gunthorpe <jgg@nvidia.com>]

On Fri, Nov 13, 2026 at 10:42:06PM +0530, Aneesh Kumar K.V wrote:
> Jason Gunthorpe <jgg@nvidia.com> writes:
> 
> > On Fri, Nov 13, 2026 at 02:24:59PM +0530, Aneesh Kumar K.V wrote:
> >> Jason Gunthorpe <jgg@nvidia.com> writes:
> >> 
> >> > On Thu, Nov 12, 2026 at 03:07:43PM +0530, Aneesh Kumar K.V wrote:
> 
>  [ ... 96 lines skipped ... ] 
> 
> > We really want the certificates to be loaded at the start before doing
> > key_exchange. That is when they are most useful.
> >
> > So when we fix this for 1.3 the opt in should trigger a transcript'd
> > GET_DIGEST in plain text and certificate collection from all the slots
> > in plain text.
> >
> > 1.3 will sign GET_DIGESTS during KEY_EXCHANGE
> > 1.2 RMM could issue CHALLENGE if the device supports it right before
> >     KEY_EXCHANGE and transcript it
> > 1.2 RMM could issue GET_DIGESTS inside the session and fail if != to
> >     the plaintext
> >
> 
> 
> So the combined flow would be:
> 
> Host                             RMM                              Device
> |                                 |                                  |
> | RMI_PDEV_CREATE(new-flow opt-in)|                                  |
> |-------------------------------->|                                  |
> |                                 | GET_VERSION / VERSION            |
> |                                 | GET_CAPABILITIES / CAPABILITIES  |
> |                                 | NEGOTIATE_ALGORITHMS / ALGORITHMS|
> |                                 |<-------------------------------->|
> | Cache individual VCA messages   |                                  |
> |<--------------------------------|                                  |
> |                                 |                                  |
> |                                 | GET_DIGESTS / DIGESTS [plaintext]|
> |                                 |<-------------------------------->|
> | Cache discovery transcript      | Retain original slot mask        |
> |<--------------------------------| and per-slot chain digests       |
> |                                 |                                  |
> |                                 | For each populated slot:         |
> |                                 | GET_CERTIFICATE / CERTIFICATE    |
> |                                 |<-------------------------------->|
> | Cache complete chains by slot   |                                  |
> |<--------------------------------|                                  |
> |                                 |
> |

This should be identical to your prior email where the host requests
each certificate. But yes.

> |                      Pause: PDEV_NEEDS_KEY                         |
> |                                 |                                  |
> | Validate candidate certificate  |                                  |
> | paths against userspace policy. |                                  |
> | Select slot S and extract key S.|                                  |
> | Discovery remains provisional.  |                                  |
> |                                 |                                  |
> | RMI_PDEV_SET_PUBKEY             |                                  |
> | (slot S, key S, chain hash S)   |                                  |
> |-------------------------------->|                                  |
> |                                 |                                  |
> |                    IF SPDM 1.2 AND CHALLENGE supported             |
> |                                 |                                  |
> |                                 | CHALLENGE(slot S, fresh nonce)   |
> |                                 |--------------------------------->|
> |                                 | CHALLENGE_AUTH                   |
> |                                 |<---------------------------------|
> |                                 | Verify signature using key S.    |
> |                                 | Authenticates earlier DIGESTS.   |
> | Cache challenge transcript      |                                  |
> |<--------------------------------|                                  |
> |                                 |                                  |
> |                    END IF                                          |
> |                                 |                                  |
> |                                 | KEY_EXCHANGE(slot S)             |
> |                                 |--------------------------------->|
> |                                 | KEY_EXCHANGE_RSP                 |
> |                                 |<---------------------------------|
> |                                 | Verify signature using key S.    |
> |                                 |                                  |
> |                    IF SPDM 1.3 multikey negotiated                 |
> |                                 |                                  |
> |                                 | Signature covers earlier DIGESTS.|
> |                                 | Authenticate retained inventory. |
> |                                 |                                  |
> |                    END IF                                          |
> |                                 |                                  |
> | Cache key-exchange transcript   |                                  |
> |<--------------------------------|                                  |
> |                                 | FINISH / FINISH_RSP              |
> |                                 |<-------------------------------->|
> |                                 | Session established.             |
> |                                 |                                  |
> |                    IF SPDM 1.2 AND CHALLENGE unavailable           |
> |                                 |                                  |
> |                                 | GET_DIGESTS / DIGESTS [secure]   |
> | Relay ciphertext                |<-------------------------------->|
> |                                 | Compare authenticated slot mask  |
> |                                 | and every digest with original   |
> |                                 | plaintext discovery.             |
> |                                 |                                  |
> |                                 | Mismatch: fail setup.            |
> |                                 | Match: authenticate inventory.   |
> |                                 |                                  |
> |                    END IF
> |

Yeah, I think this is probably the best we can do. You always end up
with some kind of authenticated GET_DIGESTS recorded to the
transcript. Authentication is either directly in the transcript with a
CHALLENGE/KEY_EXCHANGE signature or indirectly via the symmetric
session.

I would incorporate this into the 1.3 ecn upgrade as the 'now this is
how 1.2 works if you turn this on'.

But I don't see an urgency to stop the world, we should implement as
spec'd. All three arches are similar and have the same issues with 1.3
multikey.

Hopefully these flow diagrams help the other vendors to understand
what the ideal flow would look like. The ARM TSM directed "caching" is
very smart, IMHO.

Jason