From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id DA888C10DCE for ; Tue, 5 Dec 2023 00:30:22 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 59A036B009A; Mon, 4 Dec 2023 19:30:22 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 54AE16B009B; Mon, 4 Dec 2023 19:30:22 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 3751C6B009C; Mon, 4 Dec 2023 19:30:22 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id 2982E6B009A for ; Mon, 4 Dec 2023 19:30:22 -0500 (EST) Received: from smtpin19.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id 063451A046D for ; Tue, 5 Dec 2023 00:30:22 +0000 (UTC) X-FDA: 81530883084.19.CF6E0CF Received: from mgamail.intel.com (mgamail.intel.com [198.175.65.11]) by imf12.hostedemail.com (Postfix) with ESMTP id 8BC9040004 for ; Tue, 5 Dec 2023 00:30:17 +0000 (UTC) Authentication-Results: imf12.hostedemail.com; dkim=pass header.d=intel.com header.s=Intel header.b=mLclBRFu; dmarc=pass (policy=none) header.from=intel.com; spf=pass (imf12.hostedemail.com: domain of dan.j.williams@intel.com designates 198.175.65.11 as permitted sender) smtp.mailfrom=dan.j.williams@intel.com; arc=reject ("signature check failed: fail, {[1] = sig:microsoft.com:reject}") ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1701736218; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=+QGhxs2gOpvhXlYHiK8MAloXwnJymUIYW3lb3tlVLHk=; b=vKV9JyMDE6fQvVaba0pC60RSZ2ZVwnPXBmjVdZLcEGgm7sAaMkXDkxp+9c/A2H3uUbvyiw ws3kbfkkUVbKUpXbjt8AjoE4GFB37zP8Xiwdrq4H4LLMcHJkTzK2+KCig7R76DQKgpLz53 /DhvZFRZnJCa+vuhCgPgk/AP/KqNquc= ARC-Authentication-Results: i=2; imf12.hostedemail.com; dkim=pass header.d=intel.com header.s=Intel header.b=mLclBRFu; dmarc=pass (policy=none) header.from=intel.com; spf=pass (imf12.hostedemail.com: domain of dan.j.williams@intel.com designates 198.175.65.11 as permitted sender) smtp.mailfrom=dan.j.williams@intel.com; arc=reject ("signature check failed: fail, {[1] = sig:microsoft.com:reject}") ARC-Seal: i=2; s=arc-20220608; d=hostedemail.com; t=1701736218; a=rsa-sha256; cv=fail; b=pPuBJGvvSTDj4ERl7Iwd+BzCjW5n/nkKTMmiJHgAgHQYJ48sSzgM85hwylj8FWN0pCa3ns cFYXXgBK7KZ1FN2QHodU1kZYJwJUS5IMiQQyDiuwfqQrk7eron5LP8AzJpjW17gP1AdmIl hxsBZz6zsq69V44FlMMEWZ0WZFxlHco= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1701736217; x=1733272217; h=date:from:to:cc:subject:message-id:references: in-reply-to:mime-version; bh=cwldwLV9tnlaN1PBZG2sTEKF9j0+F0VNhngFQnxnJx8=; b=mLclBRFuBDK2d0f3QDkDFBBej7B531dJHSxXZK6OOX4luYEp6EXgVE1F GuXgRoZNu+5YIAym8lr1JKnTTmRgmnWHOKy3T2e0cV49RruopfkdFNH0X ndULK8DVujCNc8DziAlAhCCZZbIUTKpxbSvTgtGar/8zTYLoz8TwsqjWq rBqsmPL5c0DIKpdgfSdEN2Cz4HG1q05jsLK/cUvW6KWQoGHuJaXS0k4Ap UWaSxU1JhcWyO4DAVBFsWCKd7SkB911C1dqP++oGk8dFV5qJy4/wTdB1Y QXQew5K6xx69r8NbJ5cH2hHYeaZEr96PNqWEAHQUbBJBfrT5/X7PFn9SE Q==; X-IronPort-AV: E=McAfee;i="6600,9927,10914"; a="692113" X-IronPort-AV: E=Sophos;i="6.04,251,1695711600"; d="scan'208";a="692113" Received: from orviesa001.jf.intel.com ([10.64.159.141]) by orvoesa103.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 04 Dec 2023 16:30:16 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.04,251,1695711600"; d="scan'208";a="18761962" Received: from fmsmsx603.amr.corp.intel.com ([10.18.126.83]) by orviesa001.jf.intel.com with ESMTP/TLS/AES256-GCM-SHA384; 04 Dec 2023 16:30:15 -0800 Received: from fmsmsx603.amr.corp.intel.com (10.18.126.83) by fmsmsx603.amr.corp.intel.com (10.18.126.83) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.35; Mon, 4 Dec 2023 16:30:14 -0800 Received: from FMSEDG603.ED.cps.intel.com (10.1.192.133) by fmsmsx603.amr.corp.intel.com (10.18.126.83) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.35 via Frontend Transport; Mon, 4 Dec 2023 16:30:14 -0800 Received: from NAM12-BN8-obe.outbound.protection.outlook.com (104.47.55.168) by edgegateway.intel.com (192.55.55.68) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2507.34; Mon, 4 Dec 2023 16:30:13 -0800 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=HuU75kJy+uL1jaSzmksr/5ox+cAzq01PXcgEJ4uETTYcYRAWvclF4Rp8NgcJHAbiamYvfiDUFPnCAXtHhMvox4QIEVbLns7DwyB6mApTUXbFKqOw1pyRp8L4N5xswmeTvH9LM/BTdgkJF5ndqyYIMcOdNmjEdipzdXApC90cTFF9ZE5oa87zSpvbZTm67K4eAuIxvDnxx9kvAnABMkPpUzAZXqjCto/pbnXi6VtigJSMOOtRJfliu6Kmi+0DpHCxVRVV1tVmSx7gb17Wd9Y+DsphsG5eK602HJXlMjLq7s37020yFbyq+j3rhnC4kSiUTCjXAoq0Bt4Lbc3+sQKhRw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=+QGhxs2gOpvhXlYHiK8MAloXwnJymUIYW3lb3tlVLHk=; b=mA7FlLq7X8EG+w+JFOcQCsevOxiZpasXS2j3issZWlg2KLrFx+tDP0o722rLM8HRG+aS2tKPqD2GuK4dDgkU3ka+u7nIK8eeLf6KPRpCdp+rM1izGY6TwDzbTXjBw+l6cTn4LtZkzGnJIYYYFB3UTRHACStBZwR8HsE58lUsbz2CsVlSIdKTclCz+olQWIkfcXIkY2ayHJWDUM7YcRKRPjoKp+9dM1j4Dnc8TWezSCjX36pK/pBs0JNK6eHKAm5ucYEk89ogh2AUmmegcYPyStwO80ic01r/xJsA9E0N91xxmNO4UPTPleD1KRz9XaYPU1N1dZtXnynBXcRty42rtA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=intel.com; dmarc=pass action=none header.from=intel.com; dkim=pass header.d=intel.com; arc=none Received: from PH8PR11MB8107.namprd11.prod.outlook.com (2603:10b6:510:256::6) by SJ2PR11MB7502.namprd11.prod.outlook.com (2603:10b6:a03:4d3::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7046.33; Tue, 5 Dec 2023 00:30:08 +0000 Received: from PH8PR11MB8107.namprd11.prod.outlook.com ([fe80::6362:763e:f84b:4169]) by PH8PR11MB8107.namprd11.prod.outlook.com ([fe80::6362:763e:f84b:4169%5]) with mapi id 15.20.7046.033; Tue, 5 Dec 2023 00:30:08 +0000 Date: Mon, 4 Dec 2023 16:30:02 -0800 From: Dan Williams To: Dionna Amalie Glaze , Sean Christopherson CC: Michael Roth , Alexey Kardashevskiy , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , Brijesh Singh , Dan Williams , Subject: Re: [PATCH v10 48/50] KVM: SEV: Provide support for SNP_GUEST_REQUEST NAE event Message-ID: <656e6f0aa1c5_4568a29451@dwillia2-xfh.jf.intel.com.notmuch> References: <20231016132819.1002933-1-michael.roth@amd.com> <20231016132819.1002933-49-michael.roth@amd.com> <20231110220756.7hhiy36jc6jiu7nm@amd.com> Content-Type: text/plain; charset="us-ascii" Content-Disposition: inline In-Reply-To: X-ClientProxiedBy: MW4P221CA0020.NAMP221.PROD.OUTLOOK.COM (2603:10b6:303:8b::25) To PH8PR11MB8107.namprd11.prod.outlook.com (2603:10b6:510:256::6) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: PH8PR11MB8107:EE_|SJ2PR11MB7502:EE_ X-MS-Office365-Filtering-Correlation-Id: dd64637d-5662-493a-9b85-08dbf529552d X-LD-Processed: 46c98d88-e344-4ed4-8496-4ed7712e255d,ExtAddr X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: XXjzxHmPhGQrqiAsKjxNMyadBBat9/qH89E/9RFFl9YSJG4Ej2VofhDvIm1Byrimw7VkK5fRJoTuuT2v20a7ltCZOs+UgWQgCwqn2elo2Xm+JGdF2qy0uOMUVSKT0hdp9v7g5Z5j0bBbeIglAKKydSQW4xPWTSzU2dRYE3cfepEyvHqTDdp4+/64Tt+7lNzp4yRS4Z5cviWKWqjA5JsWtzfcsZ/5uDP2dba/wfFr/h8e/3VHcx0ADjVmBzQHpgW3N9lcRE5M7dgVGce0Ga0VQI7xiTXB4vYOzxxayRUqRtjJYw1PVdvFrsn4sM8rPwzpYi+e5K8SqwIf4B0XtruYkvuiaKxDw1EbF1tVYQMOop9WlIqI6kw6YZkCGcWbFad75O99VwGxDurg73BSSIj22/hXHIlQmcD77LbqEEKAjfVrYr1WSck0SNMnFSZ7f24R3C2l7k0yk2/En923GcsPsQ0kJJpQODBdSF+FMcZzOULslA9XZwpzBhw00RlN70VLaUtso+R3P7hC5/9FCu2ypkzN0u9co6KsS8P1hSF9Qik= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:PH8PR11MB8107.namprd11.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230031)(136003)(396003)(39860400002)(346002)(376002)(366004)(230922051799003)(451199024)(64100799003)(186009)(1800799012)(7406005)(5660300002)(86362001)(4326008)(8676002)(8936002)(2906002)(7416002)(41300700001)(6512007)(9686003)(6506007)(82960400001)(6666004)(83380400001)(6486002)(966005)(478600001)(26005)(38100700002)(110136005)(316002)(54906003)(66476007)(66556008)(66946007);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?uRG7dOVFQRCLnoT4Fh/KQZnKz9yhNAOsurx3nDqSgvMwYk27aU0zwjZrRH+F?= =?us-ascii?Q?qiKOPpqM9g+YVWtquMdLOE500jivC3AoUtrGKVUNIk+sq2pzNWzweeEaTqKm?= =?us-ascii?Q?hEaudyafq9nBDUOEnIVvD728Ejnoq7Wuj1jlFJ56yt7RG3pmGMas6IcXpSIa?= =?us-ascii?Q?uM8KIIWN7LIk+bL1LmsWkSxLqQnSvgPaXByWyGX2UfqF2YhhnGZuG37zeVDY?= =?us-ascii?Q?HPt0d6j0DgkHHxF6prY4yqINj4J3SmsbwdNNczTcYsF0on50PR2Enmdl/ijG?= =?us-ascii?Q?Y0a5akBe9uNGgnISYUpMIHwZCaHPUPkofk0FPoKLAUO0+VgCytWt/mRGzNh0?= =?us-ascii?Q?/TWWP04RcgivWd+h/USNdYixn6+1Vj7kR4GYn3mAav47NLz7/ZjRpzVRGzYm?= =?us-ascii?Q?kGTQMJJCj64pYhkX1V5eHRoerwc8lc2biSM6hSTcWNmRo44wgTENJM5At4A0?= =?us-ascii?Q?mIl4uHgEhzyKIiccWOiqkDrmeIf9tDFvMnhyARIk8Qm06dRN58Ne0ymYT4Pa?= =?us-ascii?Q?gqOVYG/RWvT9+UauGkARNtkC2TnGCJ3BT9mab1Uu4lhMULZ5L9JzCcMcdro8?= =?us-ascii?Q?aFHisW4u691BeDGxZsmvRwyql0f7TBE3yLG+UP0w4TMsTGq0hsi/2V7mGSee?= =?us-ascii?Q?vwlYEuSQmcYgSHMzQgPsih05I8JhYOWHqUxSmlrSaBkq4Di0voF4IdDkYuFK?= =?us-ascii?Q?nB2Oc53MecDWOQG5aoF/xJy9J7G9wdvhuvGGinJ6iVXE0JvZha0+P/MoA8kS?= =?us-ascii?Q?kuGhmoFuKlH4hyiqc2fWnC+2IejqxTCDkbjRFSdcCE8Tn3P9Z0L1nNJZBHJ3?= =?us-ascii?Q?uOqi9+FSetjyKHJEZ1lQD7v6/eOU7PsAOhop7yxmq+2da49g7SRWukA7RdhU?= =?us-ascii?Q?Iu9qsDYFm6LinVEZX/8u0AX8EjEulz/50rlMbjFdMmnBcse0HFVxjccRxLu9?= =?us-ascii?Q?tw+eXB/P3KPMXRxRolS+u0C/jZY4E6U4JqCYEzRak5XLdCxF9GnE4zIyM5sx?= =?us-ascii?Q?RL7sq/CusSd8dD0eZEj++fuTUYTLkLmH5DjmfeT0Q0oQ4lXyU1LymVfW4jcd?= =?us-ascii?Q?YVchRvTItOZ+kLLovwNfoAkyyb98S5lnxoN0XcTTpJHK0NhP/XgapycZ1mix?= =?us-ascii?Q?a7B6wKjTi5YOKju9SmgvXkKoioYNUie6R/uR5tPDKrpdN32/jkj7fxWLgk8c?= =?us-ascii?Q?FgXP1qQgAZ1phD2XdquAYcSwKf4BRg1ALjSfdQnLvfgphnt1SVVyIim7z/xf?= =?us-ascii?Q?Mg7Oz0Xbb0Pr9IEh2mqq2/VLBQoqcBL7KGQTSMF0Zt/xNcXEgmNxXg3qoosw?= =?us-ascii?Q?ENn7uVcxdb1bRslW19ppX/9xM8bwWcnlKXTxRMdOuv3MLx/+w7h272HG6E42?= =?us-ascii?Q?7OqAx0VuFPDoScsXg8PmzLwrZowOCNIh0/qjsIQDuyhCtGmyXbIZ/8WG7cPo?= =?us-ascii?Q?sGI2jm0HfNTcHP1obpTG3HZzFIaSugMfGJpaFvSkOJFzByLIDxwhZFN37bfG?= =?us-ascii?Q?qlQN3QnCekO/E9g+GwWPP2YuJGM+/mHIZb0PwlcosNuFv94Cg7JzdmLBpOJy?= =?us-ascii?Q?RDgnm5clsQjJARWAisAAXM2SuQPGUagF0rx4NGCb5eMbR2H62TtZJZT3l9wc?= =?us-ascii?Q?wA=3D=3D?= X-MS-Exchange-CrossTenant-Network-Message-Id: dd64637d-5662-493a-9b85-08dbf529552d X-MS-Exchange-CrossTenant-AuthSource: PH8PR11MB8107.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 05 Dec 2023 00:30:08.0675 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: WxOBSmNm5OfSCiz272W9kkmQoKF++l7Mzd4plTCap/ZZGhcyYL1j5Qhq9/MR2fc2/nW3K3vxC4BKPrDjHRQt9EB/VA3N+jA8GnVDwRwIQI8= X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ2PR11MB7502 X-OriginatorOrg: intel.com X-Rspamd-Queue-Id: 8BC9040004 X-Rspam-User: X-Rspamd-Server: rspam04 X-Stat-Signature: pof19hpwb7txua69rgaja5y4gdr9dksd X-HE-Tag: 1701736217-510333 X-HE-Meta: U2FsdGVkX18wZ/BrAu+ZAY8wLLoPi3HziVwZE48+vFx/jOPeQ3SbPB1y4uk90bWFhA3K+2jJzFYspcFpDBMrTapQqCxfjkE89ohqDf69+m0m/F+UzaHKxOtYvU6Px3d2bWI3akq46ieQm4LNxb90On1sxndnIz56NHgBd0HDoOjUgvOX0oQ21eA0fXArZv0jmYzxYczooyxnQ5hAzxcnWs0vb/fEXMNYZ2QlMDzaeLG8hfwEQDT96zbky7Tskv9eJ021wwdb8STvP4NJzajTHIwrpkOhPdKuPkdcRFXKl47WTgXNLHN29kZT9RcoOoldYSAFaX2FLwb5t9Nyl+io4vvqb0pGTbQ1JMmzGkX3jG8xxNjSk8LSOJnWQ01g+CDabHXz0rJ3ZwchJhHECzUO49Wf16t7kE6XfxkAZ8ao1V67TEjy8TxVYpZT85yxyEicJu7sAu6pIJGLq6egzLv8lpCQWxxEL3lxUYVXlpEAr2u66/h5vhhMbEp7XhEoMD1+sev14Cip2g1m2b56umYm96sg+Pj8prc65lLPj/koMzSLiBMR4TrthgTUR8zt2SU3mXpLThuCWmCaUGzA6GO6TOpjaT924Rq7J4wF5zmkfQwshvWFl+aA3r3Nrrpjxb138rFkKJ551WecwoBeT/XC8fZxhwgmVNaw+lH4WaGksVjSisC+Z5z7mqGBQsh+n0cXPYQElh5QrbZ4SpodSOUxyRMmIBcJ6XeHDZWoD+iA0tKVf3JSJhdh/ecWGtYYHtUP+jlYD8KuZYzpYBW1YA/8d93a13+2G3pAj8mVw1Nkk/EV31QpC0ZXHALAG4FJ2EO9f/mfSu8QDFMYNDoZmd0PwS74nkrS8TLQ6BzlG5f+whCu2D2oZm1cF9IQfFal3nKbjniGJy7Pgc0RdY94g30T/nqyzlFFSskI831s8maAkECdOTotjSigB4RN5ei/jXXwS7Mv52EpvSZ7OJ8XZYI UUZcD2B0 3SkY8M96QY8i8PFFJaLHAdKmCn5KnqE/UdyeEWDzlmPMkn0qkqXVLpUdjGi83En2bewW8IC++LmVFaKcbTiHwFEf5+kE8fi5iaNPbJwsfhyLRH/E8SDe7wuz7Br35vit4cwGNlDgT0epUkAm6GHIGqCuI6tCCdehIXilpLwFZSjTw0Uw/UM+n8hOvL7a8Ra/QdoDclE4W2FDclasXmAu5APGih5WMLRa76yA9RG34TQ5TpBmyIjnSbjVmjVdGXHlgAltRyv05xLQ0bb+NL9sYJd3ihruxVfMQ94AVPfW6huTu+ytaekUu7t8AIxXon7HMiYkYImECnp6r2hesS7TZ2HKkWHbUr7NuWOmXfiQroBqGaS56y7CjG3UTtw== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000022, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: [ add Dan Middleton for his awareness ] Dionna Amalie Glaze wrote: > > > So we're sort of complicating the more common case to support a more niche > > > one (as far as userspace is concerned anyway; as far as kernel goes, your > > > approach is certainly simplest :)). > > > > > > Instead, maybe a compromise is warranted so the requirements on userspace > > > side are less complicated for a more basic deployment: > > > > > > 1) If /dev/sev is used to set a global certificate, then that will be > > > used unconditionally by KVM, protected by simple dumb mutex during > > > usage/update. > > > 2) If /dev/sev is not used to set the global certificate is the value > > > is NULL, we assume userspace wants full responsibility for managing > > > certificates and exit to userspace to request the certs in the manner > > > you suggested. > > > > > > Sean, Dionna, would this cover your concerns and address the certificate > > > update use-case? > > > > Honestly, no. I see zero reason for the kernel to be involved. IIUC, there's no > > privileged operations that require kernel intervention, which means that shoving > > a global cert into /dev/sev is using the CCP driver as middleman. Just use a > > userspace daemon. I have a very hard time believing that passing around large-ish > > blobs of data in userspace isn't already a solved problem. > > ping sathyanarayanan.kuppuswamy@linux.intel.com and +Dan Williams Apologies Dionna, I missed this earlier. > > I think for a uniform experience for all coco technologies, we need > someone from Intel to weigh in on supporting auxblob through a similar > vmexit. Whereas the quoting enclave gets its PCK cert installed by the > host, something like the firmware's SBOM [1] could be delivered in > auxblob. The proposal to embed the compressed SBOM binary in a coff > section of the UEFI doesn't get it communicated to user space, so this > is a good place to get that info about the expected TDMR in. The SBOM > proposal itself would need additional modeling in the coRIM profile to > have extra coco-specific measurements or we need to find some other > method of getting this info bundled with the attestation report. SBOM looks different than the SEV use case of @auxblob to convey a certificate chain. Are you asking for @auxblob to be SBOM on TDX and a certchain on SEV, or unifying the @auxblob format on SBOM? > My own plan for SEV-SNP was to have a bespoke signed measurement of > the UEFI in the GUID table, but that doesn't extend to TDX. If we're > looking more at an industry alignment on coRIM for SBOM formats (yes > please), then it'd be great to start getting that kind of info plumbed > to the user in a uniform way that doesn't have to rely on servers > providing the endorsements. > > [1] https://uefi.org/blog/firmware-sbom-proposal Honestly my first reaction for this ABI would be for a new file under /sys/firmware/efi/efivars or similar.