Re: [RFC PATCH] virt: tdx-guest: Remove quote generation via ioctl

[Dan Williams <dan.j.williams@intel.com>]

Daniel P. Berrangé wrote:
> On Tue, Jan 23, 2024 at 11:06:01AM -0800, Dan Williams wrote:
> > Nikolay Borisov wrote:
> > > 
> > > 
> > > On 23.01.24 г. 19:51 ч., Kuppuswamy Sathyanarayanan wrote:
> > > > 
> > > > On 1/23/24 8:07 AM, Nikolay Borisov wrote:
> > > >> When this driver got merged initially there was no widely agreed upon
> > > >> interface how the quote generation interface will work so having an
> > > >> ioctl made sense. However, there's now a vendor-neutral interface via
> > > >> configfs. Just remove the old ioctl interface and leave only the the
> > > >> configfs one.
> > > >>
> > > >> Signed-off-by: Nikolay Borisov <nik.borisov@suse.com>
> > > >> ---
> > > > 
> > > > This ABI allows the user to get the raw report which is further used
> > > > for Quote generation via vsock. AFAIK, some vendors (TDX users) and
> > > > DCAP user libraries are still using this ABI to support attestation over
> > > > vsock model.
> > > > 
> > > > Don't you think we should wait till there are no users before considering
> > > > removing it?
> > > 
> > > Given that hw with TDX was just released I'd be surprised if there are 
> > > any users? But then again, this is an RFC so let's get opinions :)
> > > 
> > 
> > The assumption is that this tdx_guest_ioctl() ABI has never appeared in
> > an enterprise distro kernel. If that assumption is valid, it
> > significantly reduces the long term support exposure.
> 
> This ioctl is present in current RHEL-9 kernels
> 
>   https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/blob/main/drivers/virt/coco/tdx-guest/tdx-guest.c?ref_type=heads#L69
> 
> and this is exposed to users when running RHEL-9 guest on Azure
> cloud with TDX support.

Ah, ok, thanks for looking that up. Also good to see the new interface
is also backported into that kernel.

> I've not directly checked, but I would assume it is also probably
> included in Ubuntu LTS kernels too, since they also target TDX in
> Azure.
> 
> No idea what the status of SLES is wrt TDX / Azure offhand.

Seems like this needs to follow the typical upstream deprecation of
notifying in Kconfig and maybe a runtime message, and then circle back
in a couple years to remove when distros stop enabling the legacy
interface.