On 8/26/22 22:06, Kuppuswamy Sathyanarayanan wrote: > Attestation is used to verify the TDX guest trustworthiness to other > entities before provisioning secrets to the guest. For example, a key > server may request for attestation before releasing the encryption keys > to mount the encrypted rootfs or secondary drive. > > During the TDX guest launch, the initial contents (including the > firmware image) and configuration of the guest are recorded by the > Intel TDX module in build time measurement register (MRTD). After TDX > guest is created, run-time measurement registers (RTMRs) can be used by > the guest software to extend the measurements. TDX supports 4 RTMR > registers, and TDG.MR.RTMR.EXTEND TDCALL is used to update the RTMR > registers securely. RTMRs are mainly used to record measurements > related to sections like the kernel image, command line parameters, > initrd, ACPI tables, firmware data, configuration firmware volume (CFV) > of TDVF, etc. For complete details, please refer to TDX Virtual > Firmware design specification, sec titled "TD Measurement". > > At TDX guest runtime, the Intel TDX module reuses the Intel SGX > attestation infrastructure to provide support for attesting to these > measurements as described below. > > The attestation process consists of two steps: TDREPORT generation and > Quote generation. > > TDREPORT (TDREPORT_STRUCT) is a fixed-size data structure generated by > the TDX module which contains guest-specific information (such as build > and boot measurements), platform security version, and the MAC to > protect the integrity of the TDREPORT. The guest kernel uses > TDCALL[TDG.MR.REPORT] to get the TDREPORT from the TDX module. A > user-provided 64-Byte REPORTDATA is used as input and included in the > TDREPORT. Typically it can be some nonce provided by attestation > service so the TDREPORT can be verified uniquely. More details about > the TDREPORT can be found in Intel TDX Module specification, section > titled "TDG.MR.REPORT Leaf". > > TDREPORT by design can only be verified on the local platform as the > MAC key is bound to the platform. To support remote verification of > the TDREPORT, TDX leverages Intel SGX Quote Enclave (QE) to verify > the TDREPORT locally and convert it to a remote verifiable Quote. > > After getting the TDREPORT, the second step of the attestation process > is to send it to the QE to generate the Quote. TDX doesn't support SGX > inside the guest, so the QE can be deployed in the host, or in another > legacy VM with SGX support. QE checks the integrity of TDREPORT and if > it is valid, a certified quote signing key is used to sign the Quote. > How to send the TDREPORT to QE and receive the Quote is implementation > and deployment specific. > > Implement a basic guest misc driver to allow userspace to get the > TDREPORT. After getting TDREPORT, the userspace attestation software > can choose whatever communication channel available (i.e. vsock or > hypercall) to send the TDREPORT to QE and receive the Quote. > > Also note that explicit access permissions are not enforced in this > driver because the quote and measurements are not a secret. However > the access permissions of the device node can be used to set any > desired access policy. The udev default is usually root access > only. > > Operations like getting TDREPORT or Quote generation involves sending > a blob of data as input and getting another blob of data as output. It > was considered to use a sysfs interface for this, but it doesn't fit > well into the standard sysfs model for configuring values. It would be > possible to do read/write on files, but it would need multiple file > descriptors, which would be somewhat messy. IOCTLs seems to be the best > fitting and simplest model for this use case. This is similar to AMD > SEV platform, which also uses IOCTL interface to support attestation. > > Any distribution enabling TDX is also expected to need attestation. So > enable it by default with TDX guest support. > On what tree this patch series is based on? And as this series is multi-patch, it's customary to have cover letter (or [PATCH 0/?]). Thanks. -- An old man doll... just what I always wanted! - Clara
