Re: [PATCH v8 5/5] x86/tdx: Add Quote generation support

Guorui Yu
2022-08-09T06:20:31Z

To my opinion, virtio-vsock is a wonderful way to achieve the
comunication between the host and the guest under traditional scenario.

But from secuirty perspective, virtio-vsock itself may involve too much
of components, which may lead to considerable attack surfaces. In order
for virtio to work properly, the guest must maintain several vrings
placed in shared memory, which in turn depends on swiotlb in current
codebase. As this flow is NOT designed for confidential scenario, there
are some on-going/existing works on virtio hardening [1] [2] [3].

> Do we *REALLY* need specific driver functionality for this? For
> instance, is there no existing virtio device that can send blobs back
> and forth?

And we may indeed have use cases where virtio is not used at all, such
as when we consider Intel-TDX/AMD-SNP protected VMs as a SGX enclave
replacement. In such use cases, end users may expect a smaller
dependency on the GetQuote interface. It doesn't seem natural that the
GetQuote interface cannot be used because virtio-vsock is disabled (via
kernel compile options or the upcoming device-filter), since GetQuote
doesn't inherently depend on it.

Thanks,
Guorui

[1]
https://lore.kernel.org/lkml/20210603004133.4079390-1-ak@linux.intel.com/
[2] https://lore.kernel.org/lkml/20211012065227.9953-1-jasowang@redhat.com/
[3]