Received-SPF: pass (google.com: domain of linux-kernel+bounces-51465-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.199.223 as permitted sender) client-ip=147.75.199.223;
Message-ID: <82a84e769875c70279348179c1b2b63a16770c8e.camel@HansenPartnership.com>
Subject: Re: [PATCH v1] efi/libstub: Add Confidential Computing (CC)
 measurement support
From: James Bottomley <James.Bottomley@HansenPartnership.com>
To: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>,
  Ard Biesheuvel <ardb@kernel.org>
Cc: linux-kernel@vger.kernel.org, linux-efi@vger.kernel.org
Date: Sun, 04 Feb 2024 07:46:44 +0100
In-Reply-To: <20240203075736.3982371-1-sathyanarayanan.kuppuswamy@linux.intel.com>
References: 
	<20240203075736.3982371-1-sathyanarayanan.kuppuswamy@linux.intel.com>
Content-Type: text/plain; charset="UTF-8"
User-Agent: Evolution 3.42.4 
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit

On Sat, 2024-02-03 at 07:57 +0000, Kuppuswamy Sathyanarayanan wrote:
> If the virtual firmware implements TPM support, TCG2 protocol will be
> used for kernel measurements and event logging support. But in CC
> environment, not all platforms support or enable the TPM feature.
> UEFI specification [1] exposes protocol and interfaces used for
> kernel measurements in CC platforms without TPM support.
> 
> Currently, the efi-stub only supports the kernel related measurements
> for the platform that supports TCG2 protocol. So, extend it add
> CC measurement protocol (EFI_CC_MEASUREMENT_PROTOCOL) and event
> logging support. Event logging format in the CC environment is the
> same as TCG2.

Why do we have to do this anymore?  Given that you're already pushing
patches that map RTMRs to TPM PCRs:

https://lore.kernel.org/lkml/20240128212532.2754325-4-sameo@rivosinc.com/

Can't you just add a stub TCG2 driver to EFI that exposes only the
ability to log and measure using this mapping?  That way all our
existing code will "just work" without the need to understand anything
about confidential computing or add new code to do the measurement?

James