Empty outblob when using TSM to get TDX Quote

[Xynnn007]

Describe the bug

Thanks from @LiuSecone

When using the evidence_getter inside a TDX guest that has /sys/kernel/config/tsm/report, the evidence of TDX would be

{
    "cc_eventlog": "AQAAA....",
    "quote": "",
    "aa_eventlog": null
}

This is not expected. If the reading of outblob, attester shoud raise an error and try back to ioctl way to get evidence. But the actual execution result treats the empty reading of /sys/kernel/config/tsm/report/xxx/outblob a success.

If we manually execute the following inside guest

mkdir /sys/kernel/config/tsm/report/123
echo hahaha > /sys/kernel/config/tsm/report/123/inblob
cat /sys/kernel/config/tsm/report/123/outblob
cat /sys/kernel/config/tsm/report/123/generation

The first cat will say

cat: /sys/kernel/config/tsm/report/123/outblob: Invalid argument

and the second cat will say

1

How to reproduce

See description

CoCo version information

v0.10.0

What TEE are you seeing the problem on

None

Failing command and relevant log output

No response

[Xynnn007]

cc @mythi

[mythi]

The first cat will say

cat: /sys/kernel/config/tsm/report/123/outblob: Invalid argument

Interesting. I'll take a look where the error from std::fs:read() gets lost.

[mythi]

This is not expected. If the reading of outblob, attester shoud raise an error and try back to ioctl way to get evidence. But the actual execution result treats the empty reading of /sys/kernel/config/tsm/report/xxx/outblob a success.

We have not treated this as an error because there is no read error:

root@tdx-guest:~# dd if=/dev/random of=/sys/kernel/config/tsm/report/123/inblob bs=1 count=64
root@tdx-guest:~# cat /sys/kernel/config/tsm/report/123/outblob
root@tdx-guest:~# echo $?

(echo hahaha is incorrect reportdata and triggers the error shown in the original report)

I'm fine adding an .is_empty() check to tdx-attester but the ioctl() fallback is not ok since that interface is deprecated.

[mythi]

But the actual execution result treats the empty reading of /sys/kernel/config/tsm/report/xxx/outblob a success.

you might also wonder the root cause of an empty quote: TDX QGS is either too old (DCAP 1.21 or later is needed) or Qemu cannot connect to it (e.g., vsock_loopback module missing)