[RFC,0/5] Towards a shared TSM sysfs-ABI for Confidential Computing

Message

Dan Williams Jan. 30, 2024, 9:23 a.m. UTC

As you may recall the configfs-tsm proposal [1] for conveying
attestation reports, accepted into v6.7, made the case that shared
cross-vendor concepts demand shared infrastructure. Whereas configfs-tsm
only shares guest-side transport / blob-marshaling infrastructure, the
PCIe device-security interactions with a TSM are more standardized (PCIe
TDISP) and as a result present a wider opportunity for cross-vendor
shared-semantics, not just transport infrastructure.

The proposals in this set are an attempt to intercept and reconcile
details of 4 different patchsets in various stages of making their way
upstream, TDX host patches [2], TIO preview implementation [3], SPDM/CMA
support [4], and TDX Connect preview implementation (not posted). The
guiding principle for this RFC, beyond "common concepts demand shared
infrastructure", is that PCI core concepts, defined by the PCI spec,
should live in and interoperate with the PCI core (e.g. CMA <-> TSM
interaction). The result is a /sys/bus/virtual/devices/tsm0 singleton
class device proposal with a pci/ attribute directory and a
/sys/bus/pci/devices/$pdev/tsm/ attribute directory added to each PCI
capable device that in turn coordinates with
/sys/bus/pci/devices/$pdev/authenticated.

This gives TDX, and other software-module based TSMs like RISCV COVE, a
common place to host their module attributes in
/sys/bus/virtual/devices/tsm0/host, while for SEV-SNP, and other
hardware based TSMs like ARM CCA, that /sys/bus/virtual/tsm0/host is a
symlink back to /sys/bus/pci/devices/$tsm_dev. Beyond the sysfs
device-model, for TIO, COVE-IO, and TDX Connect this gives an initial
set of library calls, locking model, and operations to support the low
level implementations.

This set has only been verified to compile, it is not functional. It is
only meant to convey the scaffolding for low level implementations to
build upon. Expect it to change as low level implementations try to
adopt it.

Otherwise, this is the first step in demonstrating that we have our act
together in terms of unifying on a common-core interface language and
low-level interface verbs. I.e. "we" the device-security kernel
developer community regarding our conversation at the BoF at Plumbers
[5] where the outcome was to unify on a set of verbs and adopt the
semantics of the low level implementation that exports the least amount
of complexity to Linux while still meeting user expectations (as simple
as possible, but no simpler).

Note that this depends on a new core-sysfs capability (patch4), with
trending positive reaction from Greg [6], to hide entire sysfs-group
attribute directories when not applicable. This further lets
implementations get away from dynamic device-attribute creation, or
worse dynamic kobject creation, that makes device ABI subsystems hard to
reason about [7].

[1]: http://lore.kernel.org/r/[e-mail]
[2]: http://lore.kernel.org/r/[e-mail]
[3]: https://github.com/aik/linux/tree/tio
[4]: http://lore.kernel.org/r/[e-mail]
[5]: https://lpc.events/event/17/contributions/1635/
[6]: http://lore.kernel.org/r/2024012855-limb-monument-cd86@gregkh
[7]: http://lore.kernel.org/r/20231019200110.GA1410324@bhelgaas

---

Dan Williams (5):
      PCI/CMA: Prepare to interoperate with TSM authentication
      coco/tsm: Establish a new coco/tsm subdirectory
      coco/tsm: Introduce a shared class device for TSMs
      sysfs: Introduce a mechanism to hide static attribute_groups
      PCI/TSM: Authenticate devices via platform TSM


 Documentation/ABI/testing/sysfs-bus-pci   |   53 ++++
 Documentation/ABI/testing/sysfs-class-tsm |   35 +++
 drivers/pci/Kconfig                       |   15 +
 drivers/pci/Makefile                      |    2 
 drivers/pci/cma.c                         |   12 +
 drivers/pci/pci-sysfs.c                   |    3 
 drivers/pci/pci.h                         |   14 +
 drivers/pci/probe.c                       |    1 
 drivers/pci/remove.c                      |    1 
 drivers/pci/tsm.c                         |  346 +++++++++++++++++++++++++++++
 drivers/virt/coco/Kconfig                 |    6 -
 drivers/virt/coco/Makefile                |    4 
 drivers/virt/coco/sev-guest/sev-guest.c   |    8 -
 drivers/virt/coco/tdx-guest/tdx-guest.c   |    8 -
 drivers/virt/coco/tsm/Kconfig             |   14 +
 drivers/virt/coco/tsm/Makefile            |   10 +
 drivers/virt/coco/tsm/class.c             |  112 +++++++++
 drivers/virt/coco/tsm/pci.c               |   83 +++++++
 drivers/virt/coco/tsm/reports.c           |   24 +-
 drivers/virt/coco/tsm/tsm.h               |   28 ++
 fs/sysfs/group.c                          |   45 +++-
 include/linux/pci.h                       |    3 
 include/linux/sysfs.h                     |   63 ++++-
 include/linux/tsm.h                       |  109 ++++++++-
 include/uapi/linux/pci_regs.h             |    3 
 25 files changed, 935 insertions(+), 67 deletions(-)
 create mode 100644 Documentation/ABI/testing/sysfs-class-tsm
 create mode 100644 drivers/pci/tsm.c
 create mode 100644 drivers/virt/coco/tsm/Kconfig
 create mode 100644 drivers/virt/coco/tsm/Makefile
 create mode 100644 drivers/virt/coco/tsm/class.c
 create mode 100644 drivers/virt/coco/tsm/pci.c
 rename drivers/virt/coco/{tsm.c => tsm/reports.c} (94%)
 create mode 100644 drivers/virt/coco/tsm/tsm.h

The unstable baseline of this series is a merge of
https://github.com/l1k/linux/commit/f3dc1e0eb451 and v6.8-rc2.