Re: [RFC PATCH v1 10/11] virt: coco: arm-cca-host: Publish slot zero and establish streams after acceptance

[Jason Gunthorpe <jgg@nvidia.com>]

On Tue, Nov 10, 2026 at 11:40:46AM +1000, Alistair wrote:
> On 10/11/26 04:53, Jason Gunthorpe wrote:
> > On Mon, Nov 09, 2026 at 10:37:14AM -0700, Dave Jiang wrote:
> > 
> > > One thing on TDX is that TDH.SPDM.CONNECT also runs a
> > > GET_MEASUREMENTS of its own during the connect, and the kernel
> > > doesn't choose its nonce. The kernel wouldn't hand that one to
> > > userspace. Measurements only come out through the two flows, with a
> > > user nonce.
> > 
> > Why? Seems like another wasted operation..
> > 
> > > That works for TDX. tdx-host's relay is one function today. It takes
> > > the module's request from a page shared with the module and calls
> > > pci_tsm_doe_transfer(), so att_spdm_doe_exchange() drops in there.
> > 
> > Yeah, it looks like it works for everyone.
> 
> Jason just pointed out this thread, I've tried to pickup what the discussion
> is currently up to, hopefully I've understood it all.
> 
> It sounds like the current thinking is the TSM will issue all of the SPDM
> requests and be in control of the session. The kernel will forward those
> requests to the device and Rust SPDM in the kernel will be used to decode
> the responses.

'capture' is the word I want to use here. We actually don't want to
decode them. The goal is to get the message transcript and share it to
user-space in a 100% consistent format derived from the spec.

If DOE had a more sane protocol this would be trivial, just unwrapping
the DOE transport and recovering the exact SPDM messages then storing
them away.

We don't actually want to decode them in the kernel. The padding issue
means we need to decode them enough as part of sizing them :(

> The TSM will be in charge of slot selection, bank selection and algorithm
> support.

kernel will do slot selection, but TSM will drive the slot numbers in
the commands. Yes on algorithms/etc.

> The current Rust SPM implementation has split out the message processing, so
> that should be somewhat easy to reuse. Basically (in Rust) you pass in the
> bytes of an SPDM response, specify what the reply is (CHALLENGE_RSP) and you
> get a nice destructed struct back (or an error if it's invalid). It's all
> called the Validator as it validates Untrusted data and returns an SPDM
> response.

This isn't quite the right thing, we want a module that undoes the
transport chunking, padding, and GET_CERTIFICATE chunking to store
pristine raw messages. We don't want to validate or decode them,
beyond what is necessary to undo the padding.

The goal is to pass pristine message bytes to userspace as the
transcript report.

Your series should have most of this, but I am guessing in not quite
the right arrangement.

> > But it brings forward "rust spdm" or something in a new form as a
> > pre-condition to do the TSMs. Which is annoying for sure.
> 
> The Rust SPDM code is hopefully really close! I'm planning on sending v6
> today or tomorrow. 

No TSM drivers will go ahead until all of this and the uAPI is fully
agreed..

Plus now there is this issue if we need to reorganize things to
support this capture flow.

> > The optional chunking features are a bit tricky, but I don't think a
> > 1.2 only implementation needs them. They seem necesary for future
> > post-quantum.
> 
> Maybe for PQC, but generally this doesn't seem to come up much with DOE. So
> for now it should be fine.

I gathered the PQC issue is the signatures can get really big and the
biggest DOE chunk may not be sufficient anymore depending on
implementation.

> > This also formalizes the version locking: the TSM FW cannot use a SPDM
> > version that the kernel does not understand. I think this was already
> > basically true, trying to do the 1.3 multi-slot flow is not going to
> > work out with out kernel support to move the additional data. Maybe
> > nobody noticed, but with this scheme it would be really formal.
> 
> The kernel patches support 1.0 - 1.4, so that should be fine.

Not support as in "I can be an initiator and do a limited subset"

Support as in "I can be an observer and accept *everything* in the
spec the actual initiator might use"

For now all we need is a fairly complete 1.2 since that is the minimum
rev for PCIe (by spec) and the only thing any TSM FW has implemented.

> > But, I am strongly tempted to make a draft placeholder in C with AI as
> > a way to get alignment and try it out. Something we can throw out if a
> > Rust version comes along.
> 
> I would argue that you would be better spending that effort on making
> changes to the Rust code and re-use that. That at least would make sure it
> can be adjusted to do what you want and would be more useful :)

Heh, well I don't know Rust so I'm useless. I also have no Rust
knowers to recruit to such a project right now.

The best I can do is make a draft with AI reusing parts of your series
that shows exactly what I'm thinking and we can talk about how to go
from there.

I fear it will not be very good rust though. I fear this will be a
huge delay :)

This direction would end up with two series, a core bit doing the
message capture and a secondary one doing the in-kernel
initiator. Maybe we don't need any new rust bindings just for
capture..

But sure it is just AI $$ we can have a try.

Jason