Re: [PATCH] virt: tdx-guest: Deprecate legacy IOCTL-based interface for quote generation

[Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>]

+ Dan Middleton

Hi Boris,

On 1/24/24 1:38 AM, Nikolay Borisov wrote:
> IOCTL based interface was the natural choice for interacting with the
> quote generation machine at a time when there wasn't anything better.
> Fortunately, now we have a vendor-agnostic, configfs-based one which
> obviates the need to have the IOCTL-based interface.
>
> Gate the relevant code behind a Kconfig option, clearly marking it as
> deprecated as well as introduce a runtime warning.
>
> Signed-off-by: Nikolay Borisov <nik.borisov@suse.com>
> ---

In the following thread, Dan Middleton raised a point about this interface
being used for local attestation use cases.

https://lore.kernel.org/all/ZbAaKAh-230Hj4BF@redhat.com/T/#m691dae9a7833a35552cafb597c838df9c2ed5f3a

Currently, the configfs-based ABI does not support the local attestation use cases.

IMO, for now we can just add a config option to allow the user to selectively
enable it. We can add the runtime warning once we address the local attestation
use case via configfs ABI.

>  drivers/virt/coco/tdx-guest/Kconfig     |  9 +++++++++
>  drivers/virt/coco/tdx-guest/tdx-guest.c | 13 +++++++++++++
>  2 files changed, 22 insertions(+)
>
> diff --git a/drivers/virt/coco/tdx-guest/Kconfig b/drivers/virt/coco/tdx-guest/Kconfig
> index 22dd59e19431..0f1cfdfbbd28 100644
> --- a/drivers/virt/coco/tdx-guest/Kconfig
> +++ b/drivers/virt/coco/tdx-guest/Kconfig
> @@ -9,3 +9,12 @@ config TDX_GUEST_DRIVER
>  
>  	  To compile this driver as module, choose M here. The module will
>  	  be called tdx-guest.
> +
> +config TDX_GUEST_DRIVER_LEGACY_IOCTL
> +	def_bool y
> +	prompt "Enable legacy ioctl interface (DEPRECATED)"
> +	depends on TDX_GUEST_DRIVER
> +	help
> +	  Enable the legacy IOCTL-based interface to get the TDX report. It's
> +	  deprecated in favor of the configfs based one and will be removed
> +	  in a future release.
> diff --git a/drivers/virt/coco/tdx-guest/tdx-guest.c b/drivers/virt/coco/tdx-guest/tdx-guest.c
> index 1253bf76b570..b8cea9486daf 100644
> --- a/drivers/virt/coco/tdx-guest/tdx-guest.c
> +++ b/drivers/virt/coco/tdx-guest/tdx-guest.c
> @@ -66,6 +66,7 @@ static DEFINE_MUTEX(quote_lock);
>   */
>  static u32 getquote_timeout = 30;
>  
> +#ifdef CONFIG_TDX_GUEST_DRIVER_LEGACY_IOCTL
>  static long tdx_get_report0(struct tdx_report_req __user *req)
>  {
>  	u8 *reportdata, *tdreport;
> @@ -100,6 +101,7 @@ static long tdx_get_report0(struct tdx_report_req __user *req)
>  
>  	return ret;
>  }
> +#endif
>  
>  static void free_quote_buf(void *buf)
>  {
> @@ -249,6 +251,9 @@ static int tdx_report_new(struct tsm_report *report, void *data)
>  	return ret;
>  }
>  
> +
> +
> +#ifdef CONFIG_TDX_GUEST_DRIVER_LEGACY_IOCTL
>  static long tdx_guest_ioctl(struct file *file, unsigned int cmd,
>  			    unsigned long arg)
>  {
> @@ -271,6 +276,7 @@ static struct miscdevice tdx_misc_dev = {
>  	.minor = MISC_DYNAMIC_MINOR,
>  	.fops = &tdx_guest_fops,
>  };
> +#endif
>  
>  static const struct x86_cpu_id tdx_guest_ids[] = {
>  	X86_MATCH_FEATURE(X86_FEATURE_TDX_GUEST, NULL),
> @@ -290,9 +296,12 @@ static int __init tdx_guest_init(void)
>  	if (!x86_match_cpu(tdx_guest_ids))
>  		return -ENODEV;
>  
> +#ifdef CONFIG_TDX_GUEST_DRIVER_LEGACY_IOCTL
> +	pr_info("Legacy IOCTL-based interface is deprecated and will be removed in a future release\n");
>  	ret = misc_register(&tdx_misc_dev);
>  	if (ret)
>  		return ret;
> +#endif
>  
>  	quote_data = alloc_quote_buf();
>  	if (!quote_data) {
> @@ -310,7 +319,9 @@ static int __init tdx_guest_init(void)
>  free_quote:
>  	free_quote_buf(quote_data);
>  free_misc:
> +#ifdef CONFIG_TDX_GUEST_DRIVER_LEGACY_IOCTL
>  	misc_deregister(&tdx_misc_dev);
> +#endif
>  
>  	return ret;
>  }
> @@ -320,7 +331,9 @@ static void __exit tdx_guest_exit(void)
>  {
>  	tsm_unregister(&tdx_tsm_ops);
>  	free_quote_buf(quote_data);
> +#ifdef CONFIG_TDX_GUEST_DRIVER_LEGACY_IOCTL
>  	misc_deregister(&tdx_misc_dev);
> +#endif
>  }
>  module_exit(tdx_guest_exit);
>  

-- 
Sathyanarayanan Kuppuswamy
Linux Kernel Developer