On Tue, Jan 17, 2023 at 03:40:10PM +0800, Min Xu wrote: > From: Min M Xu <min.m...@intel.com> > > BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4243 > > From the perspective of security any external input should be measured > and extended to some registers (TPM PCRs or TDX RTMR registers). > > There are below 2 external input in a Td guest: > - TdHob > - Configuration FV (CFV) > > TdHob contains the resource information passed from VMM, such as > unaccepted memory region. CFV contains the configurations, such as > secure boot variables. > > TdHob and CFV should be measured and extended to RTMRs before they're > consumed. TdHob is consumed in the very early stage of boot process. > At that moment the memory service is not ready. Cfv is consumed in > PlatformPei to initialize the EmuVariableNvStore. To make the > implementation simple and clean, these 2 external input are measured > and extended to RTMRs in SEC phase. The measurement values are stored > in WorkArea. Then after the Hob service is available, these 2 measurement > values are retrieved and GuidHobs for these 2 tdx measurements are > generated.
So the measurement is done early and the hashes are stored to create the event log entries later, correct? Why both TdHob and CFV are handled this way? It should be needed for TdHob only, right? The work area has a fixed size, IMHO we should not store data there unless we absolutely have to, and for CFV I don't see the justification. take care, Gerd -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#98669): https://edk2.groups.io/g/devel/message/98669 Mute This Topic: https://groups.io/mt/96325908/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-