Re: [PATCH RFC 20/20] attestation: Add the TDX family implementation

[Edgecombe, Rick P]

On Fri, 2026-10-23 at 20:15 +0200, Jiri Pirko wrote:
> Fri, Oct 23, 2026 at 12:07:28AM +0200, rick.p.edgecombe@xxxxxxxxx wrote:
> > On Thu, 2026-10-15 at 16:50 +0200, Jiri Pirko wrote:
> > One idea... Not sure on it. We are currently working on support for DICE based
> > attestation for TDX. This is an industry standard and AFAIU other vendors will
> > (want to?) support it too. Perhaps if we could have a single way to ask for for
> > DICE based quote, it could make a cross vendor interface more useful? Callers
> > could just call and get some standard format they can understand. It might take
> > some work on the TDX side to ensure the DICE format quote.
> 
> Yes, that sounds useful and fits the proposed interface.
> 
> DEVICE_GET advertises the supported evidence formats, and callers select
> one through EVIDENCE_GET. Providers implementing the same standardized
> DICE evidence profile could advertise the same format identifier,
> regardless of whether the underlying platform is TDX or something else:
> 
> EVIDENCE_GET(challenge=nonce,
>              object[]={PRIMARY(<agreed-DICE-profile>)})
> 
> We would not need a separate DICE operation or provider family. TDX could
> advertise this alongside its existing evidence formats.
> 
> Makes sense?

Sounds reasonable. How about if you ask for an unspecific quote and sometimes
get DICE and sometimes get a legacy TDX quote format? And problems? Because that
is what might happen based on the current plans. Please see my response to Jason
for more elaboration.