Re: [PATCH] virt: tdx-guest: Deprecate legacy IOCTL-based interface for quote generation

[Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>]

On 1/31/24 1:12 PM, Dan Williams wrote:
> Daniel P. Berrangé wrote:
>> On Wed, Jan 31, 2024 at 12:44:46PM -0800, Kuppuswamy Sathyanarayanan wrote:
>>> On 1/31/24 11:50 AM, Dan Williams wrote:
>>>> Kuppuswamy Sathyanarayanan wrote:
>>>>> + Dan Middleton
>>>>>
>>>>> Hi Boris,
>>>>>
>>>>> On 1/24/24 1:38 AM, Nikolay Borisov wrote:
>>>>>> IOCTL based interface was the natural choice for interacting with the
>>>>>> quote generation machine at a time when there wasn't anything better.
>>>>>> Fortunately, now we have a vendor-agnostic, configfs-based one which
>>>>>> obviates the need to have the IOCTL-based interface.
>>>>>>
>>>>>> Gate the relevant code behind a Kconfig option, clearly marking it as
>>>>>> deprecated as well as introduce a runtime warning.
>>>>>>
>>>>>> Signed-off-by: Nikolay Borisov <nik.borisov@suse.com>
>>>>>> ---
>>>>> In the following thread, Dan Middleton raised a point about this interface
>>>>> being used for local attestation use cases.
>>>>>
>>>>> https://lore.kernel.org/all/ZbAaKAh-230Hj4BF@redhat.com/T/#m691dae9a7833a35552cafb597c838df9c2ed5f3a
>>>>>
>>>>> Currently, the configfs-based ABI does not support the local attestation use cases.
>>>> What are local attestation use cases, and what happens if Linux does not
>>>> provide a local attestation interface and standardizes on remotely
>>>> attestable as the standard?
>>>
>>> Local attestation is used by one TD on the same platform to prove to another TD
>>> in the same platform about its identity. It is mainly used in cases where a TD provides
>>> some special services required by other TDs. Since they are all in the same platform,
>>> there is no need for a 3rd party verifier or Quoting service. It can use the verifiable MAC
>>> to check the correctness of the TD.
>> As an example of where this might be needed, consider supporting a vTPM in
>> TDX. The TPM impl would likely be run in a separate service TD, and need to
>> be locally attested by the primary TD, to establish trust in the vTPM.
> Service TDs are in active deployment? How does that work? A tenant pays
> the fees to host 2 VMs? Is that more economical than just communicating

For scalability or security reasons, CSPs can choose to host the VMM services
in a separate VM guest. Since the service VM guest generally extends the TCB
of the tenant VM guest to which it provides service to, it is considered secure. A
single service VM can provide service to multiple tenant VMs. Since service VM
implements host services, I don't think tenant has to pay for two VMs.

In TDX, we already use service TDs for  TD Migration. Related TVMCALLs are defined
in TDX 1.5 GHCI specification, section "TDG.VP.VMCALL <Service>"
(https://cdrdv2.intel.com/v1/dl/getContent/726792)

> the remote verifier? Not trying to be argumentative just trying to get
> to the root of the question "why Linux must care about local
> attestation".

I think the main use case is when a tenant VM wants to use services provided
by a service VM in the same platform.

-- 
Sathyanarayanan Kuppuswamy
Linux Kernel Developer