Re: [RFC PATCH v1 10/11] virt: coco: arm-cca-host: Publish slot zero and establish streams after acceptance

[Aneesh Kumar K.V <aneesh.kumar@kernel.org>]

Jason Gunthorpe <jgg@nvidia.com> writes:

> On Fri, Nov 13, 2026 at 02:24:59PM +0530, Aneesh Kumar K.V wrote:
>> Jason Gunthorpe <jgg@nvidia.com> writes:
>> 
>> > On Thu, Nov 12, 2026 at 03:07:43PM +0530, Aneesh Kumar K.V wrote:

 [ ... 153 lines skipped ... ] 

> IMHO, leave everything alone as is today. We can make it work well
> enough as is.
>
> Make a ECN for a 1.3 opt in broadly like the above that fits better
> into how I sketched the kernel uAPI. Do this once we all agree to the
> new uAPI. The kernel will always try to use this new mode if RMM
> supports it and userspace gets a better 1.3 experiance.
>

This would be the below sequence right?


Host                              RMM                              Device
|                                 |                                  |
| RMI_PDEV_CREATE(No slot)        |                                  |
| NEW: enable multikey flow       |                                  |
|-------------------------------->|                                  |
|                                 |                                  |
| RMI_PDEV_COMMUNICATE loop       |                                  |
|-------------------------------->|                                  |
|                                 | GET_VERSION / VERSION            |
|                                 |<-------------------------------->|
|                                 | GET_CAPABILITIES / CAPABILITIES  |
|                                 |<-------------------------------->|
|                                 | NEGOTIATE_ALGORITHMS / ALGORITHMS|
|                                 |<-------------------------------->|
| Cache VCA exported by RMM       |                                  |
|<--------------------------------|                                  |
|                                 |                                  |
|              Require MULTI_KEY_CONN_RSP = true                     |
|                                 |                                  |
|                                 | GET_DIGESTS / DIGESTS            |
|                                 |<-------------------------------->|
| NEW: cache complete discovery   | Retain DIGESTS in signing        |
| messages exported by RMM        | transcript                       |
|<--------------------------------|                                  |
|                                 |                                  |
| NEW: request certificate slot 0 |                                  |
|-------------------------------->|                                  |
| RMI_PDEV_COMMUNICATE loop       | GET_CERTIFICATE(slot 0) /        |
|-------------------------------->| CERTIFICATE response chunks      |
|                                 |<-------------------------------->|
| Cache chain exported by RMM     | Check against slot 0's digest    |
|<--------------------------------|                                  |
|                                 |                                  |
| NEW: request certificate slot 1 |                                  |
|-------------------------------->|                                  |
| RMI_PDEV_COMMUNICATE loop       | GET_CERTIFICATE(slot 1) /        |
|-------------------------------->| CERTIFICATE response chunks      |
|                                 |<-------------------------------->|
| Cache chain exported by RMM     | Check against slot 1's digest    |
|<--------------------------------|                                  |
|                                 |                                  |
|             Discovery complete; waiting for public key             |
|             Chains and DIGESTS are good                            |
|                                 |                                  |
| Extract slot S's leaf key       |                                  |
| RMI_PDEV_SET_PUBKEY(key S)      |                                  |
|-------------------------------->|                                  |
|                                 |                                  |
| RMI_PDEV_COMMUNICATE loop       | KEY_EXCHANGE(slot S)             |
|-------------------------------->|--------------------------------->|
|                                 | KEY_EXCHANGE_RSP                 |
|                                 |<---------------------------------|
|                                 | Verify signature using key S     |
|                                 | over:                            |
|                                 |   VCA                            |
|                                 |   DIGESTS                        |
|                                 |   slot S's chain hash            |
|                                 |   key-exchange messages          |
|                                 |                                  |
| NEW: cache complete             |                                  |
| KEY_EXCHANGE request and        |                                  |
| KEY_EXCHANGE_RSP, with signature|                                  |
|<--------------------------------|                                  |
|                                 |                                  |
|                                 | FINISH / FINISH_RSP              |
| Relay                           |<-------------------------------->|
|                                 |                                  |
|                         PDEV_READY                                 |
|                  Secure session established                        |
|                                 |                                  |
|                                 |                                  |

-aneesh