linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Guorui Yu <GuoRui.Yu@linux.alibaba.com>
To: dave.hansen@intel.com
Cc: ak@linux.intel.com, bp@alien8.de, dave.hansen@linux.intel.com,
	hpa@zytor.com, isaku.yamahata@gmail.com, jun.nakajima@intel.com,
	kai.huang@intel.com, khalid.elmously@canonical.com,
	kirill.shutemov@linux.intel.com, linux-kernel@vger.kernel.org,
	marcelo.cerri@canonical.com, mingo@redhat.com,
	philip.cox@canonical.com,
	sathyanarayanan.kuppuswamy@linux.intel.com, tglx@linutronix.de,
	tim.gardner@canonical.com, tony.luck@intel.com,
	wander@redhat.com, x86@kernel.org
Subject: Re: [PATCH v8 5/5] x86/tdx: Add Quote generation support
Date: Tue, 9 Aug 2022 14:20:16 +0800	[thread overview]
Message-ID: <a69faebb-11e8-b386-d591-dbd08330b008@linux.alibaba.com> (raw)
In-Reply-To: <7c09d15b-40bc-c6a0-3282-a94e9d9c36be@intel.com>

To my opinion, virtio-vsock is a wonderful way to achieve the 
comunication between the host and the guest under traditional scenario.

But from secuirty perspective, virtio-vsock itself may involve too much 
of components, which may lead to considerable attack surfaces. In order 
for virtio to work properly, the guest must maintain several vrings 
placed in shared memory, which in turn depends on swiotlb in current 
codebase. As this flow is NOT designed for confidential scenario, there 
are some on-going/existing works on virtio hardening [1] [2] [3].

 > Do we *REALLY* need specific driver functionality for this?  For
 > instance, is there no existing virtio device that can send blobs back
 > and forth?

And we may indeed have use cases where virtio is not used at all, such 
as when we consider Intel-TDX/AMD-SNP protected VMs as a SGX enclave 
replacement. In such use cases, end users may expect a smaller 
dependency on the GetQuote interface. It doesn't seem natural that the 
GetQuote interface cannot be used because virtio-vsock is disabled (via 
kernel compile options or the upcoming device-filter), since GetQuote 
doesn't inherently depend on it.

Thanks,
Guorui

[1] 
https://lore.kernel.org/lkml/20210603004133.4079390-1-ak@linux.intel.com/
[2] https://lore.kernel.org/lkml/20211012065227.9953-1-jasowang@redhat.com/
[3] 
https://lore.kernel.org/linux-iommu/d2ae0b1d-332b-42a1-87bf-7da2b749cac2@sect.tu-berlin.de/

  parent reply	other threads:[~2022-08-09  6:20 UTC|newest]

Thread overview: 77+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-06-09  2:52 [PATCH v8 0/5] Add TDX Guest Attestation support Kuppuswamy Sathyanarayanan
2022-06-09  2:52 ` [PATCH v8 1/5] x86/tdx: Add TDX Guest attestation interface driver Kuppuswamy Sathyanarayanan
2022-06-24 16:51   ` Dave Hansen
2022-06-27 14:50     ` Sathyanarayanan Kuppuswamy
2022-06-27 17:24       ` Dave Hansen
2022-06-30 23:50         ` Sathyanarayanan Kuppuswamy
2022-07-05 12:07           ` Kai Huang
2022-07-05 18:45             ` Sathyanarayanan Kuppuswamy
2022-07-05 18:52               ` Dave Hansen
2022-07-05 21:21                 ` Sathyanarayanan Kuppuswamy
2022-07-05 22:31                   ` Kai Huang
2022-07-06 22:27                     ` Sathyanarayanan Kuppuswamy
2022-07-06 22:59                       ` Kai Huang
2022-07-18 22:52                       ` Sathyanarayanan Kuppuswamy
2022-06-09  2:52 ` [PATCH v8 2/5] x86/tdx: Add TDX Guest event notify interrupt support Kuppuswamy Sathyanarayanan
2022-06-20 12:33   ` Kai Huang
2022-06-20 15:44     ` Sathyanarayanan Kuppuswamy
2022-06-23  9:46       ` Kai Huang
2022-06-23 10:24       ` Kai Huang
2022-06-24 22:23       ` Sathyanarayanan Kuppuswamy
2022-06-24 23:41       ` Nakajima, Jun
2022-06-25  3:35         ` Yao, Jiewen
2022-06-27 11:21           ` Kai Huang
2022-06-27 14:56             ` Sathyanarayanan Kuppuswamy
2022-07-14  0:46             ` Sathyanarayanan Kuppuswamy
2022-07-14 10:42               ` Kai Huang
2022-07-14 20:55                 ` Sathyanarayanan Kuppuswamy
2022-07-14 23:58                   ` Kai Huang
2022-06-09  2:52 ` [PATCH v8 3/5] x86/mm: Make tdx_enc_status_changed() vmalloc address compatible Kuppuswamy Sathyanarayanan
2022-06-09  2:52 ` [PATCH v8 4/5] x86/mm: Add noalias variants of set_memory_*crypted() functions Kuppuswamy Sathyanarayanan
2022-06-24 13:19   ` Dave Hansen
2022-06-27 15:12     ` Kirill A. Shutemov
2022-06-27 18:24       ` Dave Hansen
2022-06-28  1:15         ` Kai Huang
2022-07-05 15:29           ` Kirill A. Shutemov
2022-07-18 14:22             ` Sathyanarayanan Kuppuswamy
2022-07-19 16:13               ` Kirill A. Shutemov
2022-07-19 17:10                 ` Sathyanarayanan Kuppuswamy
2022-07-19 21:55                   ` Kirill A. Shutemov
2022-07-20 14:56                     ` Sathyanarayanan Kuppuswamy
2022-07-20 16:17                       ` Kirill A. Shutemov
2022-07-20 16:58                         ` Sathyanarayanan Kuppuswamy
2022-06-09  2:52 ` [PATCH v8 5/5] x86/tdx: Add Quote generation support Kuppuswamy Sathyanarayanan
2022-06-14 12:30   ` Wander Lairson Costa
2022-06-14 12:58     ` Sathyanarayanan Kuppuswamy
2022-07-21 16:08   ` Dave Hansen
2022-07-21 16:42     ` Sathyanarayanan Kuppuswamy
2022-07-21 16:49       ` Dave Hansen
2022-07-21 16:54         ` Sathyanarayanan Kuppuswamy
2022-07-21 17:02           ` Dave Hansen
2022-07-21 17:16             ` Sathyanarayanan Kuppuswamy
2022-07-21 17:19               ` Dave Hansen
2022-07-21 18:31                 ` Sathyanarayanan Kuppuswamy
2022-07-21 18:42                 ` Isaku Yamahata
2022-07-21 18:52                   ` Dave Hansen
2022-07-21 18:57                     ` Sathyanarayanan Kuppuswamy
2022-07-21 19:23                       ` Dave Hansen
2022-07-21 22:08                         ` Sathyanarayanan Kuppuswamy
2022-07-21 23:16                         ` Kai Huang
2022-07-21 23:32     ` Kai Huang
2022-07-22  0:27   ` Dave Hansen
2022-07-22 19:05     ` Isaku Yamahata
2022-07-22 19:13       ` Dave Hansen
2022-07-22 21:18         ` Sathyanarayanan Kuppuswamy
2022-07-22 21:24           ` Dave Hansen
2022-07-25 20:19           ` Nakajima, Jun
2022-07-25 20:23             ` Dave Hansen
2022-07-25 21:56               ` Nakajima, Jun
2022-07-25 22:06                 ` Sathyanarayanan Kuppuswamy
2022-08-09  6:20               ` Guorui Yu [this message]
2022-11-21  2:04                 ` Guorui Yu
2022-11-21  2:26                   ` Dave Hansen
2023-01-07  0:58                     ` Erdem Aktas
2022-07-25 11:05         ` Kai Huang
2022-06-24 18:24 ` [PATCH v8 0/5] Add TDX Guest Attestation support Dave Hansen
2022-06-27 14:51   ` Sathyanarayanan Kuppuswamy
2022-06-27 18:51     ` Dave Hansen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=a69faebb-11e8-b386-d591-dbd08330b008@linux.alibaba.com \
    --to=guorui.yu@linux.alibaba.com \
    --cc=ak@linux.intel.com \
    --cc=bp@alien8.de \
    --cc=dave.hansen@intel.com \
    --cc=dave.hansen@linux.intel.com \
    --cc=hpa@zytor.com \
    --cc=isaku.yamahata@gmail.com \
    --cc=jun.nakajima@intel.com \
    --cc=kai.huang@intel.com \
    --cc=khalid.elmously@canonical.com \
    --cc=kirill.shutemov@linux.intel.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=marcelo.cerri@canonical.com \
    --cc=mingo@redhat.com \
    --cc=philip.cox@canonical.com \
    --cc=sathyanarayanan.kuppuswamy@linux.intel.com \
    --cc=tglx@linutronix.de \
    --cc=tim.gardner@canonical.com \
    --cc=tony.luck@intel.com \
    --cc=wander@redhat.com \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).