Re: [RFC PATCH v1 10/11] virt: coco: arm-cca-host: Publish slot zero and establish streams after acceptance

[Jason Gunthorpe <jgg@nvidia.com>]

On Fri, Nov 06, 2026 at 08:53:39AM -0700, Dave Jiang wrote:
> (6) SPDM_DEVICE_ATTESTATION_INFO_T [ABI 3.3.2.4]: SPDM and TDISP
>     capabilities, TDISP version, the requested chains, and MEASUREMENT.
>     MEASUREMENT is the signed SPDM measurement log, Concatenate(VCA,
>     GET_MEASUREMENTS_REQUEST1, MEASUREMENTS_RESPONSE1, ...,
>     GET_MEASUREMENTS_REQUESTn, MEASUREMENTS_RESPONSEn) [SPDM 10.12.3].
>     The last MEASUREMENTS carries the signature. The TDX Module keeps
>     the info's digest. The kernel keeps the info as immutable startup
>     data.

I threw all this at AI and it could not answer a question..

If the guest obtains a SPDM_DEVICE_ATTESTATION_INFO_T where does it
get the VCA and other transcript information from to validate the
device signature? VCA transfer should be defined in the GHCI calls.

AI also complained about inconsistencies in the spec versions I
grabbed around if the recollection also updates the
GET_DEVICE_ATTESTATION_INFO_HASH. Your message says it does, and that
is what I would require, FWIW.

*Every* GET_MEASUREMENT in the guest kernel needs to trace back to
some crypto binding that TDX module was in fact the one that issued it
on the given device in the current session.

I also think it is a mistake for TDX to hold only one digest over a
large report that includes a measurement. That is going to be
difficult to use in the guest and requires transfering an unlocked
measurement to the guest which I really am really strongly against.

The other arches split the digests to cover SPDM defined objects
directly and you can transfer them out of the transcript from GHCI.

Jason