On 13/10/23 16:03, Samuel Ortiz wrote:
On Thu, Oct 12, 2023 at 04:32:21PM +0100, Jonathan Cameron wrote:
On Thu, 12 Oct 2023 15:13:31 +0200
Samuel Ortiz <sameo@xxxxxxxxxxxx> wrote:
On Thu, Oct 12, 2023 at 11:15:42AM +0200, Lukas Wunner wrote:
On Tue, Oct 10, 2023 at 03:07:41PM +1100, Alexey Kardashevskiy wrote:
But the way SPDM is done now is that if the user (as myself) wants to let
the firmware run SPDM - the only choice is disabling CONFIG_CMA completely
as CMA is not a (un)loadable module or built-in (with some "blacklist"
parameters), and does not provide a sysfs knob to control its tentacles.
Kinda harsh.
On AMD SEV-TIO, does the PSP perform SPDM exchanges with a device
*before* it is passed through to a guest? If so, why does it do that?
SPDM exchanges would be done with the DSM, i.e. through the PF, which is
typically *not* passed through to guests. VFs are.
The RISC-V CoVE-IO [1] spec follows similar flows as SEV-TIO (and to
some extend TDX-Connect) and expects the host to explicitly request the
TSM to establish an SPDM connection with the DSM (PF) before passing one
VF through a TSM managed guest. VFs would be vfio bound, not the PF, so
I think patch #12 does not solve our problem here.
Dan and I discussed this off-list and Dan is arguing for lazy attestation,
i.e. the TSM should only have the need to perform SPDM exchanges with
the device when it is passed through.
So the host enumerates the DOE protocols and authenticates the device.
When the device is passed through, patch 12/12 ensures that the host
keeps its hands off of the device, thus affording the TSM exclusive
SPDM control.
Just to re-iterate: The TSM does not talk SPDM with the passed
through device(s), but with the corresponding PF. If the host kernel
owns the SPDM connection when the TSM initiates the SPDM connection with
the DSM (For IDE key setup), the connection establishment will fail.
Both CoVE-IO and SEV-TIO (Alexey, please correct me if I'm wrong)
expect the host to explicitly ask the TSM to establish that SPDM
connection. That request should somehow come from KVM, which then would
have to destroy the existing CMA/SPDM connection in order to give the
TSM a chance to successfully establish the SPDM link.
Agreed - I don't see a problem with throwing away the initial connection.
In these cases you are passing that role on to another entity - the
job of this patch set is done.
Right. As long as there's a way for the kernel to explicitly drop that
ownership before calling into the TSM for asking it to create a new SPDM
connection, we should be fine. Alexey, would you agree with that
statement?
Yes, sounds right.
I'm not clear yet if we need an explicit lock out similar to the VFIO
one for PF pass through or if everything will happen in a 'safe' order
anyway. I suspect a lockout on the ability to re attest is necessary
if the PF driver is loaded.
Perhaps just dropping the
+#if IS_ENABLED(CONFIG_VFIO_PCI_CORE)
and letting other PF drivers or another bit of core kernel code
(I'm not sure where the proxy resides for the models being discussed)
claim ownership is enough?
If we agree that other parts of the kernel (I suspect KVM would do the
"Connect to device" call to the TSM) should be able to tear the
established SPDM connection, then yes, the claim/return_ownership() API
should not be only available to VFIO.
Correct. I just want to make sure that DOE mailboxes stay alive and
nothing in the host kernel relies on SPDM being still active after
ownership is transferred to the TSM==PSP.
Cheers,
Samuel.
--
Alexey
