Re: [RFC PATCH 3/4] KVM: TDX: Exit to userspace for GetTdVmCallInfo

["Edgecombe, Rick P" <rick.p.edgecombe@intel.com>]

On Thu, 2025-06-12 at 08:27 +0000, Huang, Kai wrote:
> With no intention to disrupt this discussion, but even w/o GetQuote TDX can
> also support attestation, because TD can just get the TDREPORT and send to
> remote Quoting Enclave to get it signed, via whatever communication channel
> available (vsock, TCP/IP etc). :-)
> 
> It's just not all TDX guests have those communication channels available in
> CSP's deployment, and GetQuote can fill up the hole as a last resort.
> 
> Of course now TD userspace may choose to only support GetQuote simply
> because kernel supports "unified ABI" to return remotely verifiable blob
> across vendors, but still ...

This was what I was getting at by "Some highly coupled guest/VMM has an
alternate attestation scheme". If you don't care about running on any VMM, you
could invent your own communication channel. But the same is true for the other
TDVMCALLs as well.

I guess the way to look at it is what is the MVP for a TD that expects to run on
general VMMs. The others could also invent their own enumeration API and return
failure for GetTdVmCallInfo.