+ Cfir, Vishal and Ranga for awareness. -----Original Message----- From: Tom Lendacky <thomas.lenda...@amd.com> Sent: Thursday, April 11, 2024 7:08 AM To: Ard Biesheuvel <a...@kernel.org>; devel@edk2.groups.io; kra...@redhat.com Cc: Yao, Jiewen <jiewen....@intel.com>; Dionna Amalie Glaze <dionnagl...@google.com>; Mikko Ylinen <mikko.yli...@linux.intel.com>; James Bottomley <j...@linux.ibm.com>; Michael Roth <michael.r...@amd.com>; qinkun Bao <qin...@google.com>; linux-c...@lists.linux.dev; Aktas, Erdem <erdemak...@google.com>; Peter Gonda <pgo...@google.com>; Johnson, Simon P <simon.p.john...@intel.com>; Xiang, Qinglan <qinglan.xi...@intel.com> Subject: Re: [edk2-devel] [RFC PATCH] OvmfPkg/SecurityPkg: Add build option for coexistance of vTPM and RTMR.
On 4/11/24 05:33, Ard Biesheuvel wrote: > On Thu, 11 Apr 2024 at 12:29, Gerd Hoffmann <kra...@redhat.com> wrote: >> >> On Thu, Apr 11, 2024 at 09:56:48AM +0000, Yao, Jiewen wrote: >>> Please allow me to clarify what you are proposing: >>> Do you mean in vTPM case, we extend both, but we only need TCG event log, >>> NOT CC event log? >> >> Elsewhere in this thread it was mentioned that writing both vTPM and >> RTMR events to the event log is problematic because the event log >> format has no field to specify whenever a given event was measured to >> vTPM or RTMR. >> >> If the firmware can make sure all events are measured to both vTPM >> and RTMR the need to trace them separately goes away. >> >> So, yes, in case a vTPM is present the firmware would: >> (a) expose EFI_TCG2_PROTOCOL, measure to both vTPM + RTMR >> (b) not expose EFI_CC_MEASUREMENT_PROTOCOL >> (c) log measurements to TCG event log >> > > A TDX attestation would require the PCR to RTMR mapping used by the > firmware in order to reconstruct the RTMR values from the TCG event > log, but that seems feasible to me. > > In any case, I think it should be the guest firmware's job to abstract > away the difference. Agreed, this approach seems to be the best way forward. Thanks, Tom -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#117636): https://edk2.groups.io/g/devel/message/117636 Mute This Topic: https://groups.io/mt/105070442/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
