NOTE: This patch series introduces the Measurement Register (MR) ABI, and is
largely a continuation of Samuel Ortiz’s previous work on the RTMR ABI [1].

This patch series adds a unified interface to TSM core for confidential
computing (CC) guest drivers to provide access to measurement registers (MRs),
which are essential for relying parties (RPs) to verify the integrity of the
computing environment. The interface is structured around
`struct tsm_measurement`, which holds an array of
`struct tsm_measurement_register` and includes operations for reading and
updating MRs.

The MRs come in two varieties: static and runtime. Static MRs are determined at
the TEE VM (TVM) build time and capture the initial memory image or the
configuration/policy specified by the TVM's owner. In contrast, Runtime MRs
(RTMRs) start with known values, such as all zeros, at TVM build time and are
extended with measurements of loaded code, data, configuration, or executed
actions by the TVM guest during runtime.

Each `struct tsm_measurement_register` features a `mr_flags` member that
indicates the MR's properties. Static MRs are typically marked as read-only
with only the `TSM_MR_F_R` flag set, while RTMRs are marked as extensible with
the `TSM_MR_F_X` flag. Patch 2 adds a sample module to demonstrate how to
define and implement MRs.

MRs are made accessible to applications through a directory tree (rooted at
/sys/kernel/tsm). An MR could be presented as either a file containing its
value, or a directory containing elements like `digest` and `hash_algo`. By
default, an MR will be presented as a directory unless `TSM_MR_F_F` is set in
`mr_flags`.

[1]: https://patchwork.kernel.org/project/linux-integrity/cover/20240128212532.2754325-1-sameo@rivosinc.com/

Signed-off-by: Cedric Xing <cedric.xing@intel.com>
---
Changes in v2:
- Separated TSM MR code in a new file: `tsm-mr.c`.
- Removed RTMR event logging due to the lack of agreement on the log format.
- Default presentation of each MR as a directory, with the option to request an
  MR as a file using `TSM_MR_F_F`.
- Reduced verbosity: Renamed `struct tsm_measurement_provider` to `struct
  tsm_measurement`, and `tsm_(un)register_measurement_provider` to
  `tsm_(un)register_measurement`.
- Added `MODULE_DESCRIPTION` for measurement-sample.
- Fixed several compiler warnings on 32-bit builds.
- Link to v1: https://lore.kernel.org/r/20240907-tsm-rtmr-v1-0-12fc4d43d4e7@intel.com

---
Cedric Xing (2):
      tsm: Add TVM Measurement Register Support
      tsm: Add TVM Measurement Sample Code

 drivers/virt/coco/Kconfig               |   3 +-
 drivers/virt/coco/Makefile              |   2 +
 drivers/virt/coco/{tsm.c => tsm-core.c} |  26 ++-
 drivers/virt/coco/tsm-mr.c              | 374 ++++++++++++++++++++++++++++++++
 include/linux/tsm.h                     |  63 ++++++
 samples/Kconfig                         |   4 +
 samples/Makefile                        |   1 +
 samples/tsm/Makefile                    |   2 +
 samples/tsm/measurement-example.c       | 117 ++++++++++
 9 files changed, 581 insertions(+), 11 deletions(-)
---
base-commit: 81983758430957d9a5cb3333fe324fd70cf63e7e
change-id: 20240904-tsm-rtmr-7a45859d2a96

Best regards,
-- 
Cedric Xing <cedric.xing@intel.com>

On Thu, Oct 31, 2024 at 11:50:39AM -0500, Cedric Xing wrote:
> NOTE: This patch series introduces the Measurement Register (MR) ABI, and is
> largely a continuation of Samuel Ortiz’s previous work on the RTMR ABI [1].
> 
> This patch series adds a unified interface to TSM core for confidential
> computing (CC) guest drivers to provide access to measurement registers (MRs),
> which are essential for relying parties (RPs) to verify the integrity of the
> computing environment. The interface is structured around

I think we also need think about the user ABI here. While there's a use
case for user components (running in a CVM) to read and evaluate the static parts
of the report, exposing them in a vendor agnostic way can be difficult.

Is it justified for the kernel parse the report details and make them available
or would it be enough to let users to parse TSM Reports @outblob based on @provider
info for the parts they are interested?

On the runtime measurement registers, [1] took the approach where only a generic
transport (same thinking as with TSM Reports) was provided and the proposed user
ABI was only the digest with a pre-configured target register index without any
vendor specifics.

> `struct tsm_measurement`, which holds an array of
> `struct tsm_measurement_register` and includes operations for reading and
> updating MRs.
> 
> The MRs come in two varieties: static and runtime. Static MRs are determined at
> the TEE VM (TVM) build time and capture the initial memory image or the
> configuration/policy specified by the TVM's owner. In contrast, Runtime MRs
> (RTMRs) start with known values, such as all zeros, at TVM build time and are
> extended with measurements of loaded code, data, configuration, or executed
> actions by the TVM guest during runtime.
> 
> Each `struct tsm_measurement_register` features a `mr_flags` member that
> indicates the MR's properties. Static MRs are typically marked as read-only
> with only the `TSM_MR_F_R` flag set, while RTMRs are marked as extensible with
> the `TSM_MR_F_X` flag. Patch 2 adds a sample module to demonstrate how to
> define and implement MRs.
> 
> MRs are made accessible to applications through a directory tree (rooted at
> /sys/kernel/tsm). An MR could be presented as either a file containing its
> value, or a directory containing elements like `digest` and `hash_algo`. By
> default, an MR will be presented as a directory unless `TSM_MR_F_F` is set in
> `mr_flags`.
> 
> [1]: https://patchwork.kernel.org/project/linux-integrity/cover/20240128212532.2754325-1-sameo@rivosinc.com/
> 
> Signed-off-by: Cedric Xing <cedric.xing@intel.com>
> ---
> Changes in v2:
> - Separated TSM MR code in a new file: `tsm-mr.c`.
> - Removed RTMR event logging due to the lack of agreement on the log format.
> - Default presentation of each MR as a directory, with the option to request an
>   MR as a file using `TSM_MR_F_F`.
> - Reduced verbosity: Renamed `struct tsm_measurement_provider` to `struct
>   tsm_measurement`, and `tsm_(un)register_measurement_provider` to
>   `tsm_(un)register_measurement`.
> - Added `MODULE_DESCRIPTION` for measurement-sample.
> - Fixed several compiler warnings on 32-bit builds.
> - Link to v1: https://lore.kernel.org/r/20240907-tsm-rtmr-v1-0-12fc4d43d4e7@intel.com
> 
> ---
> Cedric Xing (2):
>       tsm: Add TVM Measurement Register Support
>       tsm: Add TVM Measurement Sample Code
> 
>  drivers/virt/coco/Kconfig               |   3 +-
>  drivers/virt/coco/Makefile              |   2 +
>  drivers/virt/coco/{tsm.c => tsm-core.c} |  26 ++-
>  drivers/virt/coco/tsm-mr.c              | 374 ++++++++++++++++++++++++++++++++
>  include/linux/tsm.h                     |  63 ++++++
>  samples/Kconfig                         |   4 +
>  samples/Makefile                        |   1 +
>  samples/tsm/Makefile                    |   2 +
>  samples/tsm/measurement-example.c       | 117 ++++++++++
>  9 files changed, 581 insertions(+), 11 deletions(-)
> ---
> base-commit: 81983758430957d9a5cb3333fe324fd70cf63e7e
> change-id: 20240904-tsm-rtmr-7a45859d2a96
> 
> Best regards,
> -- 
> Cedric Xing <cedric.xing@intel.com>
>

-- 
Regards, Mikko