Re: [RFC PATCH 0/3] Allow access to confidential computing secret area

On 5/20/21 5:02 PM, Andi Kleen wrote:

On 5/20/2021 3:56 AM, Dr. David Alan Gilbert wrote:

quoted

* Brijes
The nice thing about Dov's device/file is that it's a simple text file
that userspace can then read the secret out of;  I'm not sure if there's
anything similar in SNP (or for that matter TDX, cc'ing in Andi)

In TDX there are two different mechanisms:

- One is a ACPI table (SVKL) that allows to pass small pieces of data
like keys from the BIOS. We have a little driver to read and clear the
SVKL data. This would only be used if the TD BIOS does the negotiation
for the secrets, which it doesn't do currently.

- In the other model the negotiation is done by a user program, just
using another driver to issue calls to the TDX module. The calls just
expose the TDREPORT, which encodes the attestation data, but does not
actually include any secret. Then the negotiation for the secrets is
done by the program, which can then pass it out to other programs
(like mount for encrypted file systems). In such a case the secret is
never touched by the kernel. At least initially we'll use the second
option.

The SEV-SNP attestation approach is very similar to what Andi described
for the TDX. However, in the case of legacy SEV and ES, the attestation
verification is performed before the guest is booted. In this case, the
hyervisor puts the secret provided by the guest owner (after the
attestation) at a fixed location. Dov's driver is simply reading that
fixed location and making it available through the simple text file.

In case of the SEV-SNP and TDX, the guest OS participates during the
attestation flow; the driver working on the behalf of userspace and does
not have access to the secret, so it cannot populate the file with the
secrets in it.

-Brijesh

-Andi

57ccc1