AP-TEE event log
jyao1 opened this issue · 10 comments
Since AP-TEE includes dynamic_measurements, should AP-TEE also need measurement event log?
Other attestation related spec defined the event log clearly, such as
- TCG Platform Firmware Profile Spec defined TCG event log
- UEFI Spec Confidential Computing Extension defined (Confidential Computing) CC event log.
Do we want to use similar concept to add RISC-V extension for CC event log?
This is a direction check. If we do want to, we can work out next level detail.
For example, we may need add an extension to UEFI spec
#define EFI_CC_TYPE_RISCV_COVE 3
This is a good idea to maintain compatibility @jyao1 - would this add requirements into the CoVE ABI or would it be limited to the UEFI (TVM guest firmware)?
My recommendation is:
- Submit RISCV COVE proposal to UEFI specification. If you agree, I can help on this.
- Just mention CoVE ABI, that: if a UEFI firmware is used to initialize the RISCV COVE guest environment, then refer to UEFI specification confidential computing chapter for CC runtime measurement extension and event log creation.
My recommendation is:
1. Submit RISCV COVE proposal to UEFI specification. If you agree, I can help on this.
I think we should proceed with that, yes. @rsahita do you agree?
2. Just mention CoVE ABI, that: if a UEFI firmware is used to initialize the RISCV COVE guest environment, then refer to UEFI specification [confidential computing chapter](https://uefi.org/specs/UEFI/2.10/38_Confidential_Computing.html) for CC runtime measurement extension and event log creation.
Right, so there would not be any CoVE ABI impact, but only a spec addition describing that if a TVM boots a UEFI firmware, then it may provide the UEFI CC protocol (unless the firmware implements a full virtual TPM iiuc).
sorry for the delay - yes lets submit the required request to the UEFI spec
Thanks @rsahita, I created
CodeFirst - Add RISC-V CC-EventLog 002.docx.
Please review it and feedback.
Once we agree the content in AP-TEE TG, we can submit to UEFI together.
Thank you @rsahita, I have submitted to https://bugzilla.tianocore.org/show_bug.cgi?id=4738, and UEFI mantis 2449.
Update CodeFirst.-.Add.RISC-V.CC-EventLog.003.docx with informative text - adding URL for AP-TEE.
thanks - closing this issue.