Re: Coconut-SVSM - vTPM support for Intel TD Partitioning

[James Bottomley <James.Bottomley@HansenPartnership.com>]

On Mon, 2024-08-05 at 09:55 +0000, Reshetova, Elena wrote:
> > On Fri, 2024-08-02 at 18:54 -0700, Dionna Amalie Glaze wrote:
[...]
> > 
> > That brings me to a curious point: is the Intel TDX SVSM going to
> > follow the SVSM protocol interface?  because if it is, it will
> > naturally inherit the enlightened interface (the code will be
> > present in the kernel, so it only needs activating).  However, if
> > the Intel SVSM were going to ignore the SVSM protocol spec then it
> > would have to reinvent everything and the CRB interface might make
> > more sense.
> 
> I cannot speak on behalf of the Intel TDX *SVSM* implementation, but
> for the Linux guest kernel there is no intention at the moment to
> support smth like SVSM protocol interface. We have made an evaluation
> on this during the spring. There are no usecases currently that
> require such new protocol introduction on Intel TDX and it does bring
> additional code complexity, etc.
> If anyone believes otherwise, please let me know. 

If you reinvent the vTPM communication interface, I can see you are
able to get away without that SVSM communication component. I assume
you've done the same for other SVSM provided services like
deposit/remove memory and vcpu create/delete, but what about migration
when it comes along?  Since the high level operations will be pretty
much identical on AMD and Intel it would be very annoying to have to do
it in completely different ways (with presumably different tools).

Regards,

James