drivers/virt/coco/Kconfig | 1 + drivers/virt/coco/tsm.c | 362 ++++++++++++++++++++++++++++++++++++++ include/linux/tsm.h | 28 ++- 3 files changed, 390 insertions(+), 1 deletion(-)
Some confidential computing architectures (Intel TDX, ARM CCA, RISC-V CoVE) provide their guests with a set of measurements registers that can be extended at runtime, i.e. after the initial, host-initiated measurements of the TVM are finalized. Those runtime measurement registers (RTMR) are isolated from the host accessible ones but TSMs include them in their signed attestation reports. All architectures supporting RTMRs expose a similar interface to their TVMs: An extension command/call that takes a measurement value and an RTMR index to extend it with, and a readback command for reading an RTMR value back (taking an RTMR index as an argument as well). This patch series builds an architecture agnostic, configfs-based ABI for userspace to extend and read RTMR values back. It extends the current TSM ops structure and each confidential computing architecture can implement this extension to provide RTMR support. --- Samuel Ortiz (4): tsm: Runtime measurement register support tsm: Add RTMRs to the configfs-tsm hierarchy tsm: Allow for mapping RTMRs to TCG TPM PCRs tsm: Allow for extending and reading configured RTMRs drivers/virt/coco/Kconfig | 1 + drivers/virt/coco/tsm.c | 362 ++++++++++++++++++++++++++++++++++++++ include/linux/tsm.h | 28 ++- 3 files changed, 390 insertions(+), 1 deletion(-) -- 2.42.0
Samuel Ortiz wrote: > Some confidential computing architectures (Intel TDX, ARM CCA, RISC-V > CoVE) provide their guests with a set of measurements registers that can > be extended at runtime, i.e. after the initial, host-initiated > measurements of the TVM are finalized. Those runtime measurement > registers (RTMR) are isolated from the host accessible ones but TSMs > include them in their signed attestation reports. > > All architectures supporting RTMRs expose a similar interface to their > TVMs: An extension command/call that takes a measurement value and an > RTMR index to extend it with, and a readback command for reading an RTMR > value back (taking an RTMR index as an argument as well). This patch series > builds an architecture agnostic, configfs-based ABI for userspace to extend > and read RTMR values back. It extends the current TSM ops structure and > each confidential computing architecture can implement this extension to > provide RTMR support. Hi, Samuel The ABI does not include eventlog, but eventlog is usually used with RTMR. What do you think about how to implement eventlog?
On Thu, Jan 18, 2024 at 11:35:15AM +0800, biao.lu@intel.com wrote: > Samuel Ortiz wrote: > > Some confidential computing architectures (Intel TDX, ARM CCA, RISC-V > > CoVE) provide their guests with a set of measurements registers that can > > be extended at runtime, i.e. after the initial, host-initiated > > measurements of the TVM are finalized. Those runtime measurement > > registers (RTMR) are isolated from the host accessible ones but TSMs > > include them in their signed attestation reports. > > > > All architectures supporting RTMRs expose a similar interface to their > > TVMs: An extension command/call that takes a measurement value and an > > RTMR index to extend it with, and a readback command for reading an RTMR > > value back (taking an RTMR index as an argument as well). This patch series > > builds an architecture agnostic, configfs-based ABI for userspace to extend > > and read RTMR values back. It extends the current TSM ops structure and > > each confidential computing architecture can implement this extension to > > provide RTMR support. > > Hi, Samuel > The ABI does not include eventlog, but eventlog is usually used with RTMR. > What do you think about how to implement eventlog? Since the event log is typically maintained in the firmware and not in the TSM itself, I don't think we should expose e.g. an event log extension ABI through the config-tsm one. We could decide to check for an EFI CC protocol availability and extend the event log when any RTMR gets extended, and that would be an internal, not userspace visible operation. I'm not sure that this would scale well with e.g. IMA (a lot more events than pre-OS boot afaik). Cheers, Samuel.
Samuel Ortiz wrote: > On Thu, Jan 18, 2024 at 11:35:15AM +0800, biao.lu@intel.com wrote: > > Samuel Ortiz wrote: > > > Some confidential computing architectures (Intel TDX, ARM CCA, RISC-V > > > CoVE) provide their guests with a set of measurements registers that can > > > be extended at runtime, i.e. after the initial, host-initiated > > > measurements of the TVM are finalized. Those runtime measurement > > > registers (RTMR) are isolated from the host accessible ones but TSMs > > > include them in their signed attestation reports. > > > > > > All architectures supporting RTMRs expose a similar interface to their > > > TVMs: An extension command/call that takes a measurement value and an > > > RTMR index to extend it with, and a readback command for reading an RTMR > > > value back (taking an RTMR index as an argument as well). This patch series > > > builds an architecture agnostic, configfs-based ABI for userspace to extend > > > and read RTMR values back. It extends the current TSM ops structure and > > > each confidential computing architecture can implement this extension to > > > provide RTMR support. > > > > Hi, Samuel > > The ABI does not include eventlog, but eventlog is usually used with RTMR. > > What do you think about how to implement eventlog? > > Since the event log is typically maintained in the firmware and not in > the TSM itself, I don't think we should expose e.g. an event log > extension ABI through the config-tsm one. > We could decide to check for an EFI CC protocol availability and extend > the event log when any RTMR gets extended, and that would be an > internal, not userspace visible operation. I'm not sure that this > would scale well with e.g. IMA (a lot more events than pre-OS boot > afaik). Another observation after chatting with my colleague Cedric is that the TPM layer that builds on RTMR can maintain an event log that forks from the RTMR log. I.e. instead of the TPM event log containig pre-OS events starting from 0, it would start from a golden point in the RTMR measurements.
On 1/21/2024 11:15 AM, Dan Williams wrote: > Samuel Ortiz wrote: >> On Thu, Jan 18, 2024 at 11:35:15AM +0800, biao.lu@intel.com wrote: >>> Samuel Ortiz wrote: >>>> Some confidential computing architectures (Intel TDX, ARM CCA, RISC-V >>>> CoVE) provide their guests with a set of measurements registers that can >>>> be extended at runtime, i.e. after the initial, host-initiated >>>> measurements of the TVM are finalized. Those runtime measurement >>>> registers (RTMR) are isolated from the host accessible ones but TSMs >>>> include them in their signed attestation reports. >>>> >>>> All architectures supporting RTMRs expose a similar interface to their >>>> TVMs: An extension command/call that takes a measurement value and an >>>> RTMR index to extend it with, and a readback command for reading an RTMR >>>> value back (taking an RTMR index as an argument as well). This patch series >>>> builds an architecture agnostic, configfs-based ABI for userspace to extend >>>> and read RTMR values back. It extends the current TSM ops structure and >>>> each confidential computing architecture can implement this extension to >>>> provide RTMR support. >>> >>> Hi, Samuel >>> The ABI does not include eventlog, but eventlog is usually used with RTMR. >>> What do you think about how to implement eventlog? >> >> Since the event log is typically maintained in the firmware and not in >> the TSM itself, I don't think we should expose e.g. an event log >> extension ABI through the config-tsm one. >> We could decide to check for an EFI CC protocol availability and extend >> the event log when any RTMR gets extended, and that would be an >> internal, not userspace visible operation. I'm not sure that this >> would scale well with e.g. IMA (a lot more events than pre-OS boot >> afaik). > > Another observation after chatting with my colleague Cedric is that the > TPM layer that builds on RTMR can maintain an event log that forks from > the RTMR log. I.e. instead of the TPM event log containig pre-OS events > starting from 0, it would start from a golden point in the RTMR > measurements. > That's right. What's needed in verification is the full history of how a measurement register's value was transitioned from A->B, which could be segmented as A->X then X->B and stored in separate event logs. Those event logs don't have to be maintained by the same entity or in the same format.
On Wed, Jan 17, 2024 at 7:36 PM <biao.lu@intel.com> wrote: > > Samuel Ortiz wrote: > > Some confidential computing architectures (Intel TDX, ARM CCA, RISC-V > > CoVE) provide their guests with a set of measurements registers that can > > be extended at runtime, i.e. after the initial, host-initiated > > measurements of the TVM are finalized. Those runtime measurement > > registers (RTMR) are isolated from the host accessible ones but TSMs > > include them in their signed attestation reports. > > > > All architectures supporting RTMRs expose a similar interface to their > > TVMs: An extension command/call that takes a measurement value and an > > RTMR index to extend it with, and a readback command for reading an RTMR > > value back (taking an RTMR index as an argument as well). This patch series > > builds an architecture agnostic, configfs-based ABI for userspace to extend > > and read RTMR values back. It extends the current TSM ops structure and > > each confidential computing architecture can implement this extension to > > provide RTMR support. > > Hi, Samuel > The ABI does not include eventlog, but eventlog is usually used with RTMR. > What do you think about how to implement eventlog? > > I had the same question and deleted my reply. The event log in TPM is made available in sysfs only up to the point that control transitions to user space. After that, all extensions to PCRs have to be logged by user space with whatever chosen workload event log representation. I imagine the same is true for RTMRs. What this patch series doesn't take into account is how RTMRs might not be represented in the hardware attestation, but rather would be in a supervisor service whose integrity is chained from hardware attestation. In the configfs-tsm model, tsm/report with its single provider requirement will not be able to interface with the SVSM attestation protocol /and/ the AMD hardware protocol. That may as well be okay, but that's a choice folks need to be aware of. There's still the issue of attesting a single service vs attesting all services in the SVSM. I imagine single service attestation will have to be abandoned. In SVSM, a vTPM is a service that an updated linux driver will be able to get a quote from, and the same AMD SEV-SNP attestation report TSM provider would still be present, but if we want a simpler RTMR service, then we're in a little pickle with this design. -- -Dionna Glaze, PhD (she/her)
Dionna Amalie Glaze wrote: > On Wed, Jan 17, 2024 at 7:36 PM <biao.lu@intel.com> wrote: > > > > Samuel Ortiz wrote: > > > Some confidential computing architectures (Intel TDX, ARM CCA, RISC-V > > > CoVE) provide their guests with a set of measurements registers that can > > > be extended at runtime, i.e. after the initial, host-initiated > > > measurements of the TVM are finalized. Those runtime measurement > > > registers (RTMR) are isolated from the host accessible ones but TSMs > > > include them in their signed attestation reports. > > > > > > All architectures supporting RTMRs expose a similar interface to their > > > TVMs: An extension command/call that takes a measurement value and an > > > RTMR index to extend it with, and a readback command for reading an RTMR > > > value back (taking an RTMR index as an argument as well). This patch series > > > builds an architecture agnostic, configfs-based ABI for userspace to extend > > > and read RTMR values back. It extends the current TSM ops structure and > > > each confidential computing architecture can implement this extension to > > > provide RTMR support. > > > > Hi, Samuel > > The ABI does not include eventlog, but eventlog is usually used with RTMR. > > What do you think about how to implement eventlog? > > > > > > I had the same question and deleted my reply. The event log in TPM is > made available in sysfs only up to the point that control transitions > to user space. After that, all extensions to PCRs have to be logged by > user space with whatever chosen workload event log representation. I > imagine the same is true for RTMRs. > > What this patch series doesn't take into account is how RTMRs might > not be represented in the hardware attestation, but rather would be in > a supervisor service whose integrity is chained from hardware > attestation. In the configfs-tsm model, tsm/report with its single > provider requirement will not be able to interface with the SVSM > attestation protocol /and/ the AMD hardware protocol. That may as well > be okay, but that's a choice folks need to be aware of. There's still > the issue of attesting a single service vs attesting all services in > the SVSM. I imagine single service attestation will have to be > abandoned. > > In SVSM, a vTPM is a service that an updated linux driver will be able > to get a quote from, and the same AMD SEV-SNP attestation report TSM > provider would still be present, but if we want a simpler RTMR > service, then we're in a little pickle with this design. There is a good chance I am misunderstanding the concern, but I would say yes, the vTPM that would be layered on top of RTMRs is independent of the SVSM vTPM effort. For an architecture without RTMRs, vTPM via SVSM is likely the only choice, and for architectures with RTMRs an SVSM indepdendent vTPM is possible. For the kernel it already has a vtpm_proxy driver that could be put to use here, and that would be independent of the eventual SVSM vTPM driver. I am using "SVSM" above with the model of a layer providing services to an unenlightened TVM in mind. In contrast, this RTMR model requires some TVM enlightenment to setup vtpm_proxy on top of this cross-architecture building block.
Samuel Ortiz wrote: > Some confidential computing architectures (Intel TDX, ARM CCA, RISC-V > CoVE) provide their guests with a set of measurements registers that can > be extended at runtime, i.e. after the initial, host-initiated > measurements of the TVM are finalized. Those runtime measurement > registers (RTMR) are isolated from the host accessible ones but TSMs > include them in their signed attestation reports. > > All architectures supporting RTMRs expose a similar interface to their > TVMs: An extension command/call that takes a measurement value and an > RTMR index to extend it with, and a readback command for reading an RTMR > value back (taking an RTMR index as an argument as well). This patch series > builds an architecture agnostic, configfs-based ABI for userspace to extend > and read RTMR values back. It extends the current TSM ops structure and > each confidential computing architecture can implement this extension to > provide RTMR support. Hi Samuel, this looks like the right direction to me. One of my goals at Plumbers was to explore the tension of the perception of RTMR being a one-off (Intel-only) solution, and that the ecosystem is otherwise best served by preserving TPM ABI momentum. This submission clears that first concern, several vendors have an RTMR concept. The second concern, after talking with others, is that a soft-TPM (e.g. vtpm_proxy) backed by RTMR can support the TPM ecosystem. Such a layer on top of this achieves TPM support for several architectures at once which seems the right thing to do from an upstream maintenance perspective. I will likely have some questions about the details, but that basic "should we do this" threshold in my view has been overcome.
© 2016 - 2025 Red Hat, Inc.