vmgs: Write a diagnostic marker when provisioning the VMGS #2552
Conversation
stunes-ms
requested review from
mingweishih and
tjones60
and removed request for
Copilot
There was a problem hiding this comment.
Pull request overview
This RFC introduces a diagnostic provisioning marker to VMGS files that records metadata about how the file was initially provisioned. The marker captures information such as the provisioner entity (OpenHCL, HCL, etc.), vTPM version and configuration details, and the HCL commit hash.
Key changes:
- New
ProvisioningMarkerstruct andVmgsProvisionerenum invmgs_formatto define the diagnostic marker format - vTPM-related constants moved to
tpm_protocolfor reuse across components - Logic in OpenHCL to write the provisioning marker when a VMGS file is provisioned
Reviewed changes
Copilot reviewed 8 out of 9 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| vm/vmgs/vmgs_format/src/lib.rs | Defines the ProvisioningMarker struct, VmgsProvisioner enum, and adds new file ID for the marker |
| vm/vmgs/vmgs_format/Cargo.toml | Adds tpm_protocol dependency for TpmVersion type |
| vm/vmgs/vmgs/src/vmgs_impl.rs | Tracks whether VMGS was formatted due to failure, adds accessor method |
| vm/vmgs/vmgs/Cargo.toml | Reorders dependency (cosmetic change) |
| vm/devices/tpm/tpm_protocol/src/lib.rs | Defines TpmVersion enum and default TPM configuration constants |
| vm/devices/tpm/tpm_protocol/Cargo.toml | Adds dependencies needed for the new enum (open_enum, zerocopy) |
| openhcl/underhill_core/src/worker.rs | Writes provisioning marker to VMGS when file is provisioned |
| openhcl/underhill_core/Cargo.toml | Adds dependencies for tpm_protocol and vmgs_format |
stunes-ms
changed the title
| } | ||
|
|
||
| /// Expected NVRAM index attributes for a platform-created AKCert index. | ||
| pub fn platform_akcert_attributes() -> TpmaNvBits { |
| encrypted_metadata_keys: [VmgsEncryptionKey; 2], | ||
| reprovisioned: bool, | ||
| provisioned_this_boot: bool, | ||
| formatted_on_failure: bool, |
There was a problem hiding this comment.
I might be cleaner to replace provisioned_this_boot and formatted_on_failure with format_reason: Option<VmgsFormatReason> or similar where VmgsFormatReason can be Empty, Failure, or Request.
| GuestStateLifetime::ReprovisionOnFailure | ||
| ) && vmgs.was_formatted_on_failure())) as u8; | ||
|
|
||
| let marker = ProvisioningMarker { |
There was a problem hiding this comment.
Thinking about this more, it seems like the VMGS impl should write the initial marker, maybe with tpm stuff zeroed out or in separate file. Then the TPM stuff can be modified in place or add to a different fileid later
| /// Entities that can provision a new VMGS file. | ||
| #[derive(IntoBytes, Immutable, KnownLayout, FromBytes)] | ||
| pub enum VmgsProvisioner: u32 { | ||
| HCL = 1, |
There was a problem hiding this comment.
Should we explicitly say 0 is unknown or something?
3 participants
We want to leave a marker in a VMGS file that indicates that it was provisioned originally by HCL, with some diagnostic details (vTPM version, etc.) This is intended to be information-only.