From: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
To: "Huang, Kai" <kai.huang@intel.com>,
"Williams, Dan J" <dan.j.williams@intel.com>,
"linux-coco@lists.linux.dev" <linux-coco@lists.linux.dev>,
"jpiotrowski@linux.microsoft.com"
<jpiotrowski@linux.microsoft.com>
Cc: "bp@alien8.de" <bp@alien8.de>,
"peterz@infradead.org" <peterz@infradead.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"thomas.lendacky@amd.com" <thomas.lendacky@amd.com>,
"dionnaglaze@google.com" <dionnaglaze@google.com>,
"tglx@linutronix.de" <tglx@linutronix.de>,
"brijesh.singh@amd.com" <brijesh.singh@amd.com>,
"Yamahata, Isaku" <isaku.yamahata@intel.com>
Subject: Re: [PATCH v3 5/5] virt: sevguest: Add TSM_REPORTS support for SNP_{GET, GET_EXT}_REPORT
Date: Sun, 3 Sep 2023 19:57:52 -0700 [thread overview]
Message-ID: <f859d123-6c85-4bc4-8ac9-8761f1f3f602@linux.intel.com> (raw)
In-Reply-To: <4ff19f7c31b13a63756f40de69fbf8a24fe3bb08.camel@intel.com>
On 9/3/2023 7:14 PM, Huang, Kai wrote:
> On Fri, 2023-09-01 at 09:38 -0700, Dan Williams wrote:
>>> The extended guest request is another topic, since userspace has to be aware of
>>> where the kernel choses to put the extended data, and fixup all the offsets in the
>>> table (section 4.1.8.1 in [2]). It would be better to return this data through a
>>> separate file.
>>
>> I notice that the TDX report also includes a certificate blob, so if
>> that is a common concept then yes, it makes sense to have a separate
>> file for that.
>
> + Sathy and Isaku.
>
> It is a common concept from the perspective of "concept", because we need
> certificates to verify the attestation blob anyway. But in implementation,
> unlike to SEV, TDX doesn't have a command to return certificates separately or
> independently [1] -- they are embed to the Quote itself, or theoretically can be
> fetched from Intel.
>
> More, for TDX (SGX based attestation) certificates blob itself isn't mandatory
> to be part of the Quote. Instead, TDX Quote can choose to include some more
> basic platform identification which can in turn be used to get those
> certificates from Intel's provisioning certificate service [2].
>
> [1] I am not sure whether we can add one or already have one in the latest TDX
> development. Maybe Sathy or Isaku can help to confirm.
>
> [2]: Table 9: QE Certification Data
> https://download.01.org/intel-sgx/dcap-1.0.1/docs/Intel_SGX_ECDSA_QuoteGenReference_DCAP_API_Linux_1.0.1.pdf
Yes. TDX does not have any special command to fetch the certificate blob
separately. Currently, it is fetched as part of Quote data. But, since the
certificate blob is fixed per boot (unlike Quote data), I think it makes
sense to add a separate command for it.
--
Sathyanarayanan Kuppuswamy
Linux Kernel Developer
next prev parent reply other threads:[~2023-09-04 2:57 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-08-30 19:33 [PATCH v3 0/5] configfs-tsm: Attestation Report ABI Dan Williams
2023-08-30 19:33 ` [PATCH v3 1/5] virt: coco: Add a coco/Makefile and coco/Kconfig Dan Williams
2023-08-30 20:48 ` Kuppuswamy Sathyanarayanan
2023-08-30 19:33 ` [PATCH v3 2/5] configfs-tsm: Introduce a shared ABI for attestation reports Dan Williams
2023-08-30 20:45 ` Greg Kroah-Hartman
2023-08-30 20:57 ` Dan Williams
2023-08-30 22:08 ` Kuppuswamy Sathyanarayanan
2023-08-31 1:24 ` Dan Williams
2023-08-31 21:42 ` Dionna Amalie Glaze
2023-08-31 22:13 ` Dan Williams
2023-09-01 18:06 ` Thomas Gleixner
2023-09-01 18:47 ` Dan Williams
2023-09-01 19:06 ` Thomas Gleixner
2023-08-30 19:33 ` [PATCH v3 3/5] virt: sevguest: Prep for kernel internal {get, get_ext}_report() Dan Williams
2023-08-30 19:33 ` [PATCH v3 4/5] mm/slab: Add __free() support for kvfree Dan Williams
2023-08-30 20:46 ` Greg Kroah-Hartman
2023-09-07 8:59 ` Gupta, Pankaj
2023-08-30 19:33 ` [PATCH v3 5/5] virt: sevguest: Add TSM_REPORTS support for SNP_{GET, GET_EXT}_REPORT Dan Williams
2023-09-01 15:25 ` Jeremi Piotrowski
2023-09-01 16:38 ` Dan Williams
2023-09-04 2:14 ` Huang, Kai
2023-09-04 2:57 ` Kuppuswamy Sathyanarayanan [this message]
2023-09-05 23:21 ` Huang, Kai
2023-09-01 16:04 ` [PATCH v3 0/5] configfs-tsm: Attestation Report ABI Jeremi Piotrowski
2023-09-01 16:51 ` Dan Williams
2023-09-07 8:04 ` Samuel Ortiz
2023-09-25 19:26 ` Dan Williams
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=f859d123-6c85-4bc4-8ac9-8761f1f3f602@linux.intel.com \
--to=sathyanarayanan.kuppuswamy@linux.intel.com \
--cc=bp@alien8.de \
--cc=brijesh.singh@amd.com \
--cc=dan.j.williams@intel.com \
--cc=dionnaglaze@google.com \
--cc=isaku.yamahata@intel.com \
--cc=jpiotrowski@linux.microsoft.com \
--cc=kai.huang@intel.com \
--cc=linux-coco@lists.linux.dev \
--cc=linux-kernel@vger.kernel.org \
--cc=peterz@infradead.org \
--cc=tglx@linutronix.de \
--cc=thomas.lendacky@amd.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.