linux-kernel - Re: [PATCH v8 5/5] x86/tdx: Add Quote generation support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <a69faebb-11e8-b386-d591-dbd08330b008@linux.alibaba.com>
Date:   Tue, 9 Aug 2022 14:20:16 +0800
From:   Guorui Yu <GuoRui.Yu@...ux.alibaba.com>
To:     dave.hansen@...el.com
Cc:     ak@...ux.intel.com, bp@...en8.de, dave.hansen@...ux.intel.com,
        hpa@...or.com, isaku.yamahata@...il.com, jun.nakajima@...el.com,
        kai.huang@...el.com, khalid.elmously@...onical.com,
        kirill.shutemov@...ux.intel.com, linux-kernel@...r.kernel.org,
        marcelo.cerri@...onical.com, mingo@...hat.com,
        philip.cox@...onical.com,
        sathyanarayanan.kuppuswamy@...ux.intel.com, tglx@...utronix.de,
        tim.gardner@...onical.com, tony.luck@...el.com, wander@...hat.com,
        x86@...nel.org
Subject: Re: [PATCH v8 5/5] x86/tdx: Add Quote generation support

To my opinion, virtio-vsock is a wonderful way to achieve the 
comunication between the host and the guest under traditional scenario.

But from secuirty perspective, virtio-vsock itself may involve too much 
of components, which may lead to considerable attack surfaces. In order 
for virtio to work properly, the guest must maintain several vrings 
placed in shared memory, which in turn depends on swiotlb in current 
codebase. As this flow is NOT designed for confidential scenario, there 
are some on-going/existing works on virtio hardening [1] [2] [3].

 > Do we *REALLY* need specific driver functionality for this?  For
 > instance, is there no existing virtio device that can send blobs back
 > and forth?

And we may indeed have use cases where virtio is not used at all, such 
as when we consider Intel-TDX/AMD-SNP protected VMs as a SGX enclave 
replacement. In such use cases, end users may expect a smaller 
dependency on the GetQuote interface. It doesn't seem natural that the 
GetQuote interface cannot be used because virtio-vsock is disabled (via 
kernel compile options or the upcoming device-filter), since GetQuote 
doesn't inherently depend on it.

Thanks,
Guorui

[1] 
https://lore.kernel.org/lkml/20210603004133.4079390-1-ak@linux.intel.com/
[2] https://lore.kernel.org/lkml/20211012065227.9953-1-jasowang@redhat.com/
[3] 
https://lore.kernel.org/linux-iommu/d2ae0b1d-332b-42a1-87bf-7da2b749cac2@sect.tu-berlin.de/