Re: TDG quote analysis

[Sean Christopherson <seanjc@google.com>]

On Wed, Sep 23, 2026, Vishal Annapurve wrote:
> On Tue, Sep 22, 2026 at 9:09 PM Vishal Annapurve <vannapurve@google.com> wrote:
> >
> > On Mon, Sep 21, 2026 at 4:06 PM Dave Hansen <dave.hansen@intel.com> wrote:
> > >
> > > On 9/21/26 16:00, Peter Fang wrote:
> > > >> is how to hide the fact that someone in the future might think following AMD's
> > > >> lead and putting a precious resource into a tiny microprosser on a slow bus is a
> > > >> fantastic idea.
> > > > As shocking as it sounds, there are actually cloud providers out there
> > > > that are wanting this, or at the very least wanting to see how it goes
> > > > in real deployment. I think memory side channel attacks are a real
> > > > concern for some of them. But yeah this is not great from a performance
> > > > perspective.
> > >
> > > I'll believe it when I see it (on this mailing list).
> > >
> > > If folks want complexity and low performance in the kernel for
> > > side-channel defense, then I'm your guy. I've made half a career out of
> > > it. All that I ask is that they come and ask for it in the open. Here,
> > > please.
> >
> > Google is tracking use cases for deploying S3M-based attestation for
> > both TDX guest workloads and host workloads.
> >
> 
> To clarify this statement further and address the discussion from the
> PUCK meeting: Google is tracking use cases for deploying S3M based
> signing of attestation quotes (or S3M-based quoting as referred to in
> this thread) for TDX guest workloads.

Good timing, I was just chatting with Erdem about this.  The TL;DR of "why" is
that anything that's done on-CPU is more vulnerable to side channel attacks, so
hyper-paranoid use cases that *also* know the tradeoffs involved may want to
use much slower, but more secure (in theory) S3M signing.

From an upstream perspective, I think we don't care?  Or rather, we *shouldn't*
have to care beyond letting the admin flip a TDX Module switch.  I'm a-ok letting
end users opt-in to ultra-paranoid mode, with a pile of disclaimers around the
shortcomings and tradeoffs involved.  I.e. I don't really care how the quote is
generated, I just don't want to carry any kernel/KVM code to make it less painful
(and it should absolutely be opt-in).