linux-kernel - Re: [PATCH 0/4] tsm: Unified Measurement Register ABI for TVMs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c7894df2-2b27-4f67-b428-3eca312503f9@intel.com>
Date: Thu, 13 Feb 2025 15:19:55 -0800
From: Dave Hansen <dave.hansen@...el.com>
To: "Xing, Cedric" <cedric.xing@...el.com>,
 Dan Williams <dan.j.williams@...el.com>,
 "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
 Dave Hansen <dave.hansen@...ux.intel.com>,
 Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>,
 Borislav Petkov <bp@...en8.de>, x86@...nel.org,
 "H. Peter Anvin" <hpa@...or.com>
Cc: linux-kernel@...r.kernel.org, linux-coco@...ts.linux.dev,
 Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@...ux.intel.com>
Subject: Re: [PATCH 0/4] tsm: Unified Measurement Register ABI for TVMs

On 2/13/25 13:50, Xing, Cedric wrote:
> On 2/13/2025 10:58 AM, Dave Hansen wrote:
...
>> Wait a sec, so there's already ABI for manipulating these? This just
>> adds a parallel sysfs interface to the existing ABI?
>>
> No, this is new. There's no existing ABI for accessing measurement
> registers from within a TVM (TEE VM). Currently, on TDX for example,
> reading TDX measurement registers (MRs) must be done by getting a TD
> quote. And there's no way to extend any RTMRs. Therefore, it would be
> much easier end users to debug/diagnose measurement related issues
> (which would almost always require reading MRs) with this patch.

Ok, that makes sense.

But if this is for debug, wouldn't these belong better in debugfs? Do we
really want to maintain this interface forever? There's no shame in debugfs.

>> Also, you're saying that users don't need to write any code, but then
>> provide... sample code. That's unexpected.
>>
> The sample code is to demo how to expose MRs from a CC guest driver, but
> not for end users to access those MRs.
> 
>> Oh, and you seem to have forgotten to attach the sysfs ABI documentation
>> patch to the series. You did write the required documentation, right? ;)
> Documentation/ABI/testing/sysfs-kernel-tsm (new file added by patch 1)
> contains a description on the attributes added by the patch.

Whoops! I went looking for it but I'm blind, evidently. Thanks for
pointing it out.