SVSM vTPM specification

[Tom Lendacky <thomas.lendacky@amd.com>]

I'd like to approach this from the standpoint of an enlightened guest with 
a TPM driver that is SVSM aware. I'm by no means a TPM expert, but I'll 
pose a bunch of questions to see if we can start moving forward.

What would an enlightened guest need from the SVSM for attestation of the 
SVSM/vTPM? What would a vTPM driver need to supply to an SVSM for TPM 
operations?

For attestation, the SVSM could provide a VMPCK0 attestation report. What, 
if any, data should the guest supply to the SVSM to be part of the SNP 
attestation report data? Should this attestation request be part of the 
SVSM base protocol?

For the TPM, is it enough to emulate the TPM device register space? Rather 
than using a PCI BAR or an ACPI memory resource address, could the vTPM 
driver replicate the TPM register space in ordinary memory for the SVSM to 
process? Should this memory come from the SVSM or from the guest?

Or is there a better, more efficient method that can be used to perform 
TPM operations? What would that look like?

Here's hoping this starts the discussion...

Thanks,
Tom