Messages in this thread | | | Subject | Re: [PATCH v3 4/4] platform/x86: intel_tdx_attest: Add TDX Guest attestation interface driver | From | Kai Huang <> | Date | Tue, 19 Apr 2022 19:47:33 +1200 |
| |
On Fri, 2022-04-15 at 15:01 -0700, Kuppuswamy Sathyanarayanan wrote: > --- /dev/null > +++ b/drivers/platform/x86/intel/tdx/Kconfig > @@ -0,0 +1,13 @@ > +# SPDX-License-Identifier: GPL-2.0 > +# > +# X86 TDX Platform Specific Drivers > +# > + > +config INTEL_TDX_ATTESTATION > + tristate "Intel TDX attestation driver" > + depends on INTEL_TDX_GUEST > + help > + The TDX attestation driver provides IOCTL interfaces to the user to > + request TDREPORT from the TDX module or request quote from the VMM > + or to get quote buffer size. It is mainly used to get secure disk > + decryption keys from the key server. > diff --git a/drivers/platform/x86/intel/tdx/Makefile b/drivers/platform/x86/intel/tdx/Makefile > new file mode 100644 > index 000000000000..94eea6108fbd > --- /dev/null > +++ b/drivers/platform/x86/intel/tdx/Makefile > @@ -0,0 +1,3 @@ > +# SPDX-License-Identifier: GPL-2.0 > + > +obj-$(CONFIG_INTEL_TDX_ATTESTATION) += intel_tdx_attest.o > diff --git a/drivers/platform/x86/intel/tdx/intel_tdx_attest.c b/drivers/platform/x86/intel/tdx/intel_tdx_attest.c > new file mode 100644 > index 000000000000..9124db800d4f > --- /dev/null > +++ b/drivers/platform/x86/intel/tdx/intel_tdx_attest.c
From security's perspective, attestation is an essential part of TDX. That being said, w/o attestation support in TD guest, I guess nobody will seriously use TD guest.
From this perspective, I am not sure what's the value of having a dedicated INTEL_TDX_ATTESTATION Kconfig. The attestation support code should be turned on unconditionally when CONFIG_INTEL_TDX_GUEST is on. The code can also be just under arch/x86/coco/tdx/ I guess?
But I'll leave this to maintainers.
| |