linux-kernel - Re: [PATCH v9 1/6] x86/tdx: Add TDX Guest attestation interface driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 18 Aug 2022 09:25:57 -0700
From:   Dave Hansen <dave.hansen@...el.com>
To:     Borislav Petkov <bp@...en8.de>,
        Kuppuswamy Sathyanarayanan 
        <sathyanarayanan.kuppuswamy@...ux.intel.com>
Cc:     Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>,
        Dave Hansen <dave.hansen@...ux.intel.com>, x86@...nel.org,
        "H . Peter Anvin" <hpa@...or.com>,
        "Kirill A . Shutemov" <kirill.shutemov@...ux.intel.com>,
        Tony Luck <tony.luck@...el.com>,
        Andi Kleen <ak@...ux.intel.com>,
        Kai Huang <kai.huang@...el.com>,
        Wander Lairson Costa <wander@...hat.com>,
        Isaku Yamahata <isaku.yamahata@...il.com>,
        marcelo.cerri@...onical.com, tim.gardner@...onical.com,
        khalid.elmously@...onical.com, philip.cox@...onical.com,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v9 1/6] x86/tdx: Add TDX Guest attestation interface
 driver

On 8/18/22 07:18, Borislav Petkov wrote:
>> +	/*
>> +	 * Generate TDREPORT using "TDG.MR.REPORT" TDCALL.
>> +	 *
>> +	 * Get the TDREPORT using REPORTDATA as input. Refer to
>> +	 * section 22.3.3 TDG.MR.REPORT leaf in the TDX Module 1.0
>> +	 * Specification for detailed information.
>> +	 */
>> +	ret = __tdx_module_call(TDX_GET_REPORT, virt_to_phys(tdreport),
>> +				virt_to_phys(reportdata), req.subtype,
> That subtype you're not checking either.

I'll chime in here a bit since you're touching on something that bugged
me too.  This whole mechanism is because of two TDX shortcuts.  (calling
them shortcuts is generous, but I digress...)

     1. TDX guest attestation relies on SGX.  TDX does not have its own
	attestation mechanism.
     2. TDX guests can not run SGX enclaves.  Only TDX hosts can.

As a result, any TDX guest that wants to do the attestation dance has to
talk to the host, who them talks to the SGX enclave.  There's actually a
nice diagram of it in here (Figure 5.8):

> https://www.intel.com/content/dam/develop/external/us/en/documents/tdx-whitepaper-v4.pdf

This "talking" can be done via any old communication mechanism.  Shared
memory, virtio, morse code, whatever.  TDX_GET_REPORT just happens to be
yet another communication mechanism dedicated *only* to these
attestation reports.

So, this is not a *STRICTLY* required ABI.  Guests _can_ use other
mechanisms to talk to an SGX attestation (quoting) enclave.  Second,
this ABI *is* TDX-specific because no other hardware architectures have
made the same design "choices".

That's why this was jettisoned for v10.  It might reappear later, though.