Re: [RFC PATCH v1 10/11] virt: coco: arm-cca-host: Publish slot zero and establish streams after acceptance

[Aneesh Kumar K.V <aneesh.kumar@kernel.org>]

Jason Gunthorpe <jgg@nvidia.com> writes:

> On Fri, Oct 30, 2026 at 09:58:03AM +0000, Reshetova, Elena wrote:
>> > > It can't defer the session. The TDX Module runs the whole SPDM
>> > > session setup inside TDH.SPDM.CONNECT, and the host relays its DOE
>> > > messages without interpreting them, so there is no defined point to
>> > > stop after the certificates. The chains come back in the device info
>> > > only once TDH.SPDM.CONNECT completes (TDX Connect ABI Reference Spec
>> > > 2.1 v0.66, 4.2.20.1).
>> > 
>> > Yeah, its fine. TDX will have to do what Aneesh proposed for ARM, and
>> > use use the Rust SPDM Driver to operate DOE prior to calling
>> > TDH.SPDM.CONNECT. This will allow discovering what is in the slots and
>> > passing that information to userspace.
>> 
>> I am somewhat confused by this. 
>> 
>> 1. You are saying that prior to establishing a
>> secure SPDM session, you will use unsecure DOE mechanism to discover
>> available cert chains. Here you have to take into account that anything you
>> get at this step is not trusted. A malicious device could send you any cert
>> chains from another legitimate device.
>
> I poked at this with AI for a while.. While nothing about SPDM slots seems
> particularly clean it can be made to work. It looks like 1.4 improves
> things meaningfully.
>
>> 2. Next, you will choose a cert slot to be used for SPDM authentication and
>> secure session establishment (slot 0 initially in this patch) and allow
>> everything to happen.
>
> Yep
>
>> Now, who guarantees that a cert chain that you saw
>> at step 1 for the selected slot is the same that is going to be used
>> in actual SPDM connection? Who is verifying/ensuring this?
>> Kernel? Userspace? 
>
> Not sure, it would make sense if the kernel can do some of this with
> rustspdm, but there are alot of details here that I can't guess what
> is best.
>
> AI tells me there are a couple of reasonable ways to implement slot
> selection and avoid downgrade attacks:
>
> 1) With 1.4 match GET_DIGESTS and MULTI_KEY_CONN_RSP=true
>    1) Do via RustSPDM:
>         GET_DIGESTS / DIGESTS
>         GET_CERTIFICATE / CERTIFICATE
>    2) Userspace selects slots
>    3) TSM module does startup and also issues 'GET_DIGESTS' as part of
>       the signed transcript
>    4) Confirm that the digests from #1 match the digests from #2 in
>       the TSM transcript.
>

I am currently doing something similar to the above.

https://git.gitlab.arm.com/linux-arm/linux-cca/-/commit/0657d167aee1ba43dd2765d99b5e3244b83c6ea6


-aneesh