Re: SVSM vTPM specification

[James Bottomley <jejb@linux.ibm.com>]

On Wed, 2022-10-19 at 15:14 -0700, Dionna Amalie Glaze wrote:
> > > Hmm, do we need also something like SNP_GET_EXT_REPORT which also
> > > returns the cert-chain stored in the host kernel? Or modify this
> > > call to also return the certs?
> > 
> > Yes, good catch. I believe we do. Adding two more parameters (maybe
> > change this to a struct now?) for Cert Data GPA and Cert Data size
> > is the way to go. We want the Cert Data that is associated with the
> > attestation report that was generated, in an "atomic" way. Once
> > live migration is available, the VM could theoretically be migrated
> > in between two functions calls and then the VCEK wouldn't match.
> > 
> > Thanks,
> > Tom
> > 
> 
> I thought that TPM2_EC_Emphemeral would get the EC public key and
> Tspi_Key_GetPubKey could be used to get the SRK public key.

I don't think I really follow this at all.  Tspi_ was the old Trousers
(TPM 1.2) TSS API and TPM2_EC_Ephemeral is used to generate a random EC
key for use in the two phase commit protocol for doing ECDH.

>  I might be mistaken, but I believe the TPM has commands for this
> already, so the vTPM protocol doesn't need an extra entrypoint. The
> TPM keys shouldn't change through live migration, so querying
> separately should work.

The keys/certificates being referred to above quote are the PSP chip
signing keys used to sign the attestation report.  They do change if
the VM+SVSM is migrated to a new host.  The vTPM will go with the VM so
its seeds will remain the same, but the attestation report binding the
SVSM to the vTPM will change signing keys.

James