Re: SVSM Attestation and vTPM specification additions - v0.60

[Nicolai Stange <nstange@suse.de>]

Hi Tom,

Tom Lendacky <thomas.lendacky@amd.com> writes:

> Please take a look and reply with any feedback you may have.

Perhaps I simply missed it, but the available SVSM_VTPM_CMD response
buffer size seems to remain kind of unspecified. That is, the proposal
from [1] was to just require a complete page for the buffer, but I can't
find that explicitly stated anywhere (except for the required alignment
of %rcx giving a hint).


For the table on p. 28 in sec. 8.1 "SVSM_VTPM_QUERY Call", the
"Supported vTPM features" are meant get returned in %rdx, not %rcx, I
think.


And finally a question re the addition on p.9 ("Scope of the document"),
which reads as
 "Items measured at VMLP1+
  o Firmware binary
 "

In light of the sentence immediately preceeding the above and explicitly
stating that the svsm would get measured as part of the initial image,
does this conversely imply that the firmware binary would typically not
get measured as part of the initial guest image? I.e. that it would get
loaded with PAGE_TYPE_UNMEASURED? If so the above could be read as if
the firmware was supposed to measure itself at VMPL1. I think that's not
what's being meant here, but the wording is a bit misleading IMO.

Thanks!

Nicolai

[1] https://lore.kernel.org/linux-coco/b488a79617beed8913df61186e8e263c40f2330b.camel@linux.ibm.com/

-- 
SUSE Software Solutions Germany GmbH, Frankenstraße 146, 90461 Nürnberg, Germany
GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman
(HRB 36809, AG Nürnberg)