Re: TDG quote analysis

[Sean Christopherson <seanjc@google.com>]

On Thu, Sep 24, 2026, Rick P Edgecombe wrote:
> On Wed, 2026-09-23 at 17:18 -0700, Sean Christopherson wrote:
> > From an upstream perspective, I think we don't care?  Or rather, we *shouldn't*
> > have to care beyond letting the admin flip a TDX Module switch.  I'm a-ok letting
> > end users opt-in to ultra-paranoid mode, with a pile of disclaimers around the
> > shortcomings and tradeoffs involved.  I.e. I don't really care how the quote is
> > generated, I just don't want to carry any kernel/KVM code to make it less painful
> > (and it should absolutely be opt-in).
> 
> I think the direction is to basically punt on Linux S3M design for the initial
> upstream implementation. But based on today, I think we would have several
> options. This is good thing to do for now I think, because the TDX arch side of
> S3M based attestation is still fuzzy.

Ya, and what I'm saying is that one of the goals of the TDX Module should be to
provide a common interface for signing quotes, regardless of what is doing the
actual signing.  I.e. beyond flipping a switch at boot time, we shouldn't need
to modify the host or guest kernels.  Host userspace and maybe guest userspace
will need to be aware of which signing implementation is being used, because it
will significantly impact VM scheduling and behavior, but the kernel really
shouldn't have to care.