On Thu, Oct 12, 2023 at 11:15:42AM +0200, Lukas Wunner wrote: > On Tue, Oct 10, 2023 at 03:07:41PM +1100, Alexey Kardashevskiy wrote: > > But the way SPDM is done now is that if the user (as myself) wants to let > > the firmware run SPDM - the only choice is disabling CONFIG_CMA completely > > as CMA is not a (un)loadable module or built-in (with some "blacklist" > > parameters), and does not provide a sysfs knob to control its tentacles. > > Kinda harsh. > > On AMD SEV-TIO, does the PSP perform SPDM exchanges with a device > *before* it is passed through to a guest? If so, why does it do that? SPDM exchanges would be done with the DSM, i.e. through the PF, which is typically *not* passed through to guests. VFs are. The RISC-V CoVE-IO [1] spec follows similar flows as SEV-TIO (and to some extend TDX-Connect) and expects the host to explicitly request the TSM to establish an SPDM connection with the DSM (PF) before passing one VF through a TSM managed guest. VFs would be vfio bound, not the PF, so I think patch #12 does not solve our problem here. > Dan and I discussed this off-list and Dan is arguing for lazy attestation, > i.e. the TSM should only have the need to perform SPDM exchanges with > the device when it is passed through. > > So the host enumerates the DOE protocols and authenticates the device. > When the device is passed through, patch 12/12 ensures that the host > keeps its hands off of the device, thus affording the TSM exclusive > SPDM control. Just to re-iterate: The TSM does not talk SPDM with the passed through device(s), but with the corresponding PF. If the host kernel owns the SPDM connection when the TSM initiates the SPDM connection with the DSM (For IDE key setup), the connection establishment will fail. Both CoVE-IO and SEV-TIO (Alexey, please correct me if I'm wrong) expect the host to explicitly ask the TSM to establish that SPDM connection. That request should somehow come from KVM, which then would have to destroy the existing CMA/SPDM connection in order to give the TSM a chance to successfully establish the SPDM link. Cheers, Samuel. [1] https://github.com/riscv-non-isa/riscv-ap-tee-io/blob/main/specification/07-theory_operations.adoc >
