From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from EUR05-AM6-obe.outbound.protection.outlook.com (EUR05-AM6-obe.outbound.protection.outlook.com [40.107.22.63]) by mx.groups.io with SMTP id smtpd.web11.6947.1635846204394654418 for ; Tue, 02 Nov 2021 02:43:25 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@armh.onmicrosoft.com header.s=selector2-armh-onmicrosoft-com header.b=8k7uraze; spf=pass (domain: arm.com, ip: 40.107.22.63, mailfrom: sami.mujawar@arm.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=FHw96Jxz7MtqgyvHGCY2lrFO2o0pmpA4WltBaNmTMvk=; b=8k7urazeJnHRVDZx+l6pnMKq/Xp0BWxO4UHCyJ/RBUIh1ZqqKA1CoGtj1/tjsFUsdHC4yDGJrAYY8L5gc8RLzYrfn8lt0cVrUWfqpyr1jYdKg76YFQeGV9LGhRJXmmH0VW9+zumqstVUgi8L4pqsx37SItOKOTreTEQlgUwsv5c= Received: from DU2P251CA0016.EURP251.PROD.OUTLOOK.COM (2603:10a6:10:230::18) by VI1PR08MB3181.eurprd08.prod.outlook.com (2603:10a6:803:3f::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4649.19; Tue, 2 Nov 2021 09:43:16 +0000 Received: from DB5EUR03FT060.eop-EUR03.prod.protection.outlook.com (2603:10a6:10:230:cafe::43) by DU2P251CA0016.outlook.office365.com (2603:10a6:10:230::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4669.10 via Frontend Transport; Tue, 2 Nov 2021 09:43:16 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;dmarc=pass action=none header.from=arm.com; Received-SPF: Pass (protection.outlook.com: domain of arm.com designates 63.35.35.123 as permitted sender) receiver=protection.outlook.com; client-ip=63.35.35.123; helo=64aa7808-outbound-1.mta.getcheckrecipient.com; Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by DB5EUR03FT060.mail.protection.outlook.com (10.152.21.231) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4649.14 via Frontend Transport; Tue, 2 Nov 2021 09:43:16 +0000 Received: ("Tessian outbound e7ce0d853b63:v108"); Tue, 02 Nov 2021 09:43:16 +0000 X-CheckRecipientChecked: true X-CR-MTA-CID: 9370baa7fadb4132 X-CR-MTA-TID: 64aa7808 Received: from 77df9c756556.1 by 64aa7808-outbound-1.mta.getcheckrecipient.com id 34BFCAC1-3A61-4801-ABCF-9E9A787446AD.1; Tue, 02 Nov 2021 09:43:09 +0000 Received: from EUR04-HE1-obe.outbound.protection.outlook.com by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id 77df9c756556.1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Tue, 02 Nov 2021 09:43:09 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=TrZP3smGMeloGxpCobas8CjQCqUxL5d1eKu4x/PCYPtZ6Rtsrjsxk6QZM6+pAVZaEqhoh8wfrAjX32JFBCXrudFSYPxNffhUAcp8dO9mi4VE3K3BDbEZeJI2PpP26pR4mWGdhx1sF2ahzoNZ/pWtbttiYHLJmb84Q6BlACXMDVM2BvfSwMYxivKbAANFh/1JowOlcY4HIBX5KyiWH8RghuzO96y6o5X2oTivPKZ3b8dUnUtxT9SWBtETmhhjxwZwyissyPNrUNhOYknDI7prrJsuPzoUwis8mVEvGxNgidQloMEG42bKLFocYcvjwTUs4B32Ey0BjCY4wVQH3/reCg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=FHw96Jxz7MtqgyvHGCY2lrFO2o0pmpA4WltBaNmTMvk=; b=Y+wlSTeEmomCdFmfP52xM9I6Beh/ufs1NO2r6jXm3GomoHJVmFjW729cDDYX+gLnSaCagPZoGVhC1xhZD38aEzNplljp/WLFUtPVUsi53UKG07r9vI7q/cUbl3m7RIDwvDsfOAh4S9IZGxPQ1ZJpiSjeAVpz1qqLhedElIfi83nM6BMCe79wIVzadHf+R5Rs1ly3d9vELUcAAJNsstfx9RWTtfFQ+NuGUWcXnZ28/YUYTMVC/cOjCdqbgO0VXASORsB3aQtcfFkn6F3bonYyvgNmX0XtEekEcuZS6PH/YaVUvYy6luvUdnyw0wQd5MFvx1XJQCqPiqW2+3TmGerJsQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=arm.com; dmarc=pass action=none header.from=arm.com; dkim=pass header.d=arm.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=FHw96Jxz7MtqgyvHGCY2lrFO2o0pmpA4WltBaNmTMvk=; b=8k7urazeJnHRVDZx+l6pnMKq/Xp0BWxO4UHCyJ/RBUIh1ZqqKA1CoGtj1/tjsFUsdHC4yDGJrAYY8L5gc8RLzYrfn8lt0cVrUWfqpyr1jYdKg76YFQeGV9LGhRJXmmH0VW9+zumqstVUgi8L4pqsx37SItOKOTreTEQlgUwsv5c= Authentication-Results-Original: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=arm.com; Received: from PAXPR08MB6813.eurprd08.prod.outlook.com (2603:10a6:102:15f::10) by PA4PR08MB6029.eurprd08.prod.outlook.com (2603:10a6:102:e7::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4649.17; Tue, 2 Nov 2021 09:43:06 +0000 Received: from PAXPR08MB6813.eurprd08.prod.outlook.com ([fe80::c49a:d0cf:237d:7968]) by PAXPR08MB6813.eurprd08.prod.outlook.com ([fe80::c49a:d0cf:237d:7968%5]) with mapi id 15.20.4649.019; Tue, 2 Nov 2021 09:43:06 +0000 Subject: Re: [PATCH V4 2/3] SecurityPkg: Support CcMeasurementProtocol in DxeTpm2MeasureBootLib To: Min Xu , devel@edk2.groups.io Cc: Michael D Kinney , Liming Gao , Zhiguang Liu , Jiewen Yao , Jian J Wang , Gerd Hoffmann , nd References: <17126378b5048506a508ef58a6610ada0b462bad.1635818903.git.min.m.xu@intel.com> From: "Sami Mujawar" Message-ID: <712c34bd-e3a8-1f00-7051-7a53629661af@arm.com> Date: Tue, 2 Nov 2021 09:43:09 +0000 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.0.1 In-Reply-To: <17126378b5048506a508ef58a6610ada0b462bad.1635818903.git.min.m.xu@intel.com> X-ClientProxiedBy: LO4P123CA0165.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:18a::8) To PAXPR08MB6813.eurprd08.prod.outlook.com (2603:10a6:102:15f::10) MIME-Version: 1.0 Received: from [10.1.196.43] (217.140.106.52) by LO4P123CA0165.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:18a::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4649.15 via Frontend Transport; Tue, 2 Nov 2021 09:43:05 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 296f11a8-de23-48ea-dfc7-08d99de53231 X-MS-TrafficTypeDiagnostic: PA4PR08MB6029:|VI1PR08MB3181: X-Microsoft-Antispam-PRVS: x-checkrecipientrouted: true NoDisclaimer: true X-MS-Oob-TLC-OOBClassifiers: OLM:147;OLM:147; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Untrusted: BCL:0; X-Microsoft-Antispam-Message-Info-Original: 2x+S26hZ08CFW1FNl/FHW2eunLJkJA+YmkUYs93xcFP9t6lRVNohPnyKjEl0L+uqPM0PJiUTxgsbHpA22ZASsqVpIpEcVAwQga+yISweBjOUbYNP1YDYh08Yt/G0h+dFBfw2ARVTxl0qpAP5Ulo7LwyzNvBNy/97XA/gPSPNxUmsB0x/OgcRKd1Pcc5Q2ca87sR2RGyAIMmZIVIeaNLqNQVHge1bQxTqU23XPHIA7ENSMnwybVGNGTztzSc6D/lhfXIk7oU1IgTfU75Rg+ShQAdgpvqXa101h+LQvxpGreSf36vHfHVH2aEe47h3Y6ZXk/QDFN1hgMTcSS8640RubGypqFqbkSXn7dpAZpMHly5vo+IN1+yGq9ox+kGpv7Ewz7hTVoBNs25uEFayrf8rVXIX7X1N6OI0cUpvioiWMVTM+F7kSmEhNUWF6rU/kPVi6jZm+nJqD2E9XYKsXl1r6lsKnVt7HTM9DMeX+YDfVsBBE1iBAeLDQzIQVPnhRG9DhtLL107/KBKI+OWGimsYkER14M1XRx7wl1kGi2ZUTpCn45HSGVqQrZs+HqxmkSOvLURFEtrJVn46SKY/0RV5ehYnUK+h+1shp15aGHGWWGvzx40lonvMC+b7sQoL//kaegefW7ggtV1aD/UYL8vsMAo3Qbh9/78J0DmXkqEzOktlh4YNNWQrxRzgdZ5wfhZm7wzUVLZY1Mg3jzG0O/e0DMETdCQsG3rDHQEHYhpb3YLV2lG2GrgouVKm2wvKsA5fG4Ay+lfxgYttakxhyjqDr53usZe/rfE/SpLFgcy1oQcAdY0n/Fs7jbW1rY/SUGJhXV0Bao+5vYhKBQfdtJGGeE2R013wBpkyVkW5zS+Vb/4= X-Forefront-Antispam-Report-Untrusted: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:PAXPR08MB6813.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(6029001)(4636009)(366004)(31686004)(6486002)(38350700002)(38100700002)(8676002)(36756003)(86362001)(83380400001)(166002)(30864003)(8936002)(31696002)(54906003)(4326008)(33964004)(66476007)(66556008)(44832011)(66946007)(16576012)(52116002)(316002)(15650500001)(2906002)(966005)(508600001)(2616005)(5660300002)(53546011)(956004)(19627235002)(26005)(186003)(45980500001)(43740500002)(579004);DIR:OUT;SFP:1101; X-MS-Exchange-Transport-CrossTenantHeadersStamped: PA4PR08MB6029 Original-Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=arm.com; Return-Path: Sami.Mujawar@arm.com X-EOPAttributedMessage: 0 X-MS-Exchange-Transport-CrossTenantHeadersStripped: DB5EUR03FT060.eop-EUR03.prod.protection.outlook.com X-MS-Office365-Filtering-Correlation-Id-Prvs: 68e61df6-fc83-4575-dede-08d99de52bcf X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: wTJgn3jVfm6M7M/HDh0FtASVEeMOQMPC6MHc8zrn11KIB7rXuKHrstmg2pFArLbYU/zoZ75ZWyCCJwfOZAfnWmrD3wk4d9ui89hE0G/n/ICs32RqBcwvZiBvo/9k6fSaQUNH32HhBDUPOL/Xt8NlGmi4wcgXeOSKeu8ihDx8o5X2lJtGrYDEOHrTDulwhDFAT4CXKZzBO+QWUYD+GgTVXEHSRn+KpO6LO2tQd882hVhVs/JVd9sFNoyLkc00/2YoAYv3OpuBKnzXoKOji37MJ8FgHQMm336NH02vBLIG8KgEAVlyvALMxwtacODvnWEryCi4o+ZUgou4ERORV8RfXTlBcH//zLVmTpk91l9o2k9Nxu1vhRIURGAZryBs71hHPSkU5vNG5is1nSclV13Q0XuZFV60qE9IzHFSdb0rVPykHALH/+Gfs/THvgl0wbAJviCiVQr4bwI6TB1dtuKF58qsfons222hRRk14RLt6/DfjuTTpWugxv82aKtIimGPYfHNtwWS4oRJ9plIU8SHJ0ovuMJVqeaqfuITNN7DybU4zqU/csPuNYNCkeOYb7+aO6Bfu0cuqLrPonCzo0oEG0ieMkjPZMvw/uC8XUkxx4j1pIz85Zlr7BHUurIeSAbtttRhoIFNWz4gUJ5EpA/+Z5ehfytpAy6vUU43B3H6V2+ybnzVheIY/t4CnJeQrZEsNbs2y97qf+R+BCjV3d0FrZcUQ2rbKftribxPOmmxgAs1wrntO5tCuf3R4HjNK5dnVvYV7Moc5lvVAMPjUdTe9MTpKO0bcQHthYIluEKI0iE8LQYHWjpuGuZbBBvW8mQz X-Forefront-Antispam-Report: CIP:63.35.35.123;CTRY:IE;LANG:en;SCL:1;SRV:;IPV:CAL;SFV:NSPM;H:64aa7808-outbound-1.mta.getcheckrecipient.com;PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com;CAT:NONE;SFS:(6029001)(4636009)(46966006)(36840700001)(54906003)(19627235002)(15650500001)(31686004)(2616005)(30864003)(36756003)(70586007)(966005)(336012)(36860700001)(47076005)(956004)(44832011)(53546011)(70206006)(82310400003)(16576012)(508600001)(8936002)(26005)(6486002)(8676002)(186003)(31696002)(83380400001)(5660300002)(33964004)(166002)(86362001)(4326008)(2906002)(81166007)(316002)(356005)(43740500002)(579004);DIR:OUT;SFP:1101; X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Nov 2021 09:43:16.4756 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 296f11a8-de23-48ea-dfc7-08d99de53231 X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d;Ip=[63.35.35.123];Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com] X-MS-Exchange-CrossTenant-AuthSource: DB5EUR03FT060.eop-EUR03.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR08MB3181 Content-Type: multipart/alternative; boundary="------------4D4AA5742F6F49213363F8AB" Content-Language: en-GB --------------4D4AA5742F6F49213363F8AB Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Hi Min, Thank you for this patch. Please find my feedback inline marked [SAMI]. Regards, Sami Mujawar On 02/11/2021 02:50 AM, Min Xu wrote: > BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3625 > > DxeTpm2MeasureBootLib supports TPM2 based measure boot. After > CcMeasurementProtocol is introduced, CC based measure boot needs to > be supported in DxeTpm2MeasureBootLib as well. > > There are 2 major changes in this commit. > > 1. MEASURE_BOOT_PROTOCOLS is defined to store the instances of TCG2 > protocol and TEE protocol. In the DxeTpm2MeasureBootHandler above 2 > measure boot protocol instances will be located. Then the located > protocol instances will be called to do the measure boot. > > 2. CcEvent is similar to Tcg2Event except the MrIndex and PcrIndex. > CreateCcEventFromTcg2Event is used to create the CcEvent based on the > Tcg2Event. > > Above 2 changes make the minimize changes to the existing code. > > Cc: Michael D Kinney > Cc: Liming Gao > Cc: Zhiguang Liu > Cc: Jiewen Yao > Cc: Jian J Wang > Cc: Sami Mujawar > Cc: Gerd Hoffmann > Signed-off-by: Min Xu > --- > .../DxeTpm2MeasureBootLib.c | 366 ++++++++++++++---- > .../DxeTpm2MeasureBootLib.inf | 3 +- > 2 files changed, 299 insertions(+), 70 deletions(-) > > diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c > index 92eac715800f..af889b6ed3ed 100644 > --- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c > +++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c > @@ -1,5 +1,6 @@ > /** @file > - The library instance provides security service of TPM2 measure boot. > + The library instance provides security service of TPM2 measure boot and > + Confidential Computing (CC) measure boot. > > Caution: This file requires additional review when modified. > This library will have external input - PE/COFF image and GPT partition. > @@ -41,6 +42,12 @@ SPDX-License-Identifier: BSD-2-Clause-Patent > #include > #include > #include > +#include > + > +typedef struct { > + EFI_TCG2_PROTOCOL *Tcg2Protocol; > + EFI_CC_MEASUREMENT_PROTOCOL *CcProtocol; > +} MEASURE_BOOT_PROTOCOLS; > > // > // Flag to check GPT partition. It only need be measured once. > @@ -55,6 +62,62 @@ UINTN mTcg2ImageSize; > EFI_HANDLE mTcg2CacheMeasuredHandle = NULL; > MEASURED_HOB_DATA *mTcg2MeasuredHobData = NULL; > > +/** > + Create CcEvent from Tcg2Event. > + > + CcEvent is similar to Tcg2Event except the MrIndex. > + > + @param CcProtocol Pointer to the located Cc Measurement protocol instance. > + @param Tcg2Event Pointer to the Tcg2Event. > + @param EventSize Size of the Event. > + @param EfiCcEvent The created CcEvent > + > + @retval EFI_SUCCESS Successfully create the CcEvent > + @retval EFI_INVALID_PARAMETER The input parameter is invalid > + @retval EFI_UNSUPPORTED The input PCRIndex cannot be mapped to Cc MR > + @retval EFI_OUT_OF_RESOURCES Out of resource > +**/ > +EFI_STATUS [SAMI] Is EFIAPI needed here? > +CreateCcEventFromTcg2Event ( > + IN EFI_CC_MEASUREMENT_PROTOCOL *CcProtocol, > + IN EFI_TCG2_EVENT *Tcg2Event, > + IN UINT32 EventSize, > + IN OUT EFI_CC_EVENT **EfiCcEvent > + ) > +{ > + UINT32 MrIndex; [SAMI] I think it may be good to use the typedef for the measurment register index here i.e.EFI_CC_MR_INDEX. > + EFI_STATUS Status; > + EFI_CC_EVENT *CcEvent; > + > + if (Tcg2Event == NULL || CcProtocol == NULL || EfiCcEvent == NULL) { > + return EFI_INVALID_PARAMETER; > + } > + > + *EfiCcEvent = NULL; > + > + Status = CcProtocol->MapPcrToMrIndex (CcProtocol, Tcg2Event->Header.PCRIndex, &MrIndex); > + if (EFI_ERROR (Status)) { > + DEBUG ((DEBUG_ERROR, "Cannot map PcrIndex(%d) to MrIndex\n", Tcg2Event->Header.PCRIndex)); > + return Status; > + } > + > + CcEvent = (EFI_CC_EVENT *)AllocateZeroPool (Tcg2Event->Size); > + if (CcEvent == NULL) { > + return EFI_OUT_OF_RESOURCES; > + } > + > + CcEvent->Size = Tcg2Event->Size; > + CcEvent->Header.HeaderSize = Tcg2Event->Header.HeaderSize; > + CcEvent->Header.HeaderVersion = Tcg2Event->Header.HeaderVersion; > + CcEvent->Header.MrIndex = MrIndex; > + CcEvent->Header.EventType = Tcg2Event->Header.EventType; > + CopyMem (CcEvent->Event, Tcg2Event->Event, EventSize); > + > + *EfiCcEvent = CcEvent; > + > + return EFI_SUCCESS; > +} > + > /** > Reads contents of a PE/COFF image in memory buffer. > > @@ -109,7 +172,7 @@ DxeTpm2MeasureBootLibImageRead ( > Caution: This function may receive untrusted input. > The GPT partition table is external input, so this function should parse partition data carefully. > > - @param Tcg2Protocol Pointer to the located TCG2 protocol instance. > + @param MeasureBootProtocols Pointer to the located MeasureBoot protocol instances (i.e. TCG2/Td protocol). > @param GptHandle Handle that GPT partition was installed. > > @retval EFI_SUCCESS Successfully measure GPT table. > @@ -121,8 +184,8 @@ DxeTpm2MeasureBootLibImageRead ( > EFI_STATUS > EFIAPI > Tcg2MeasureGptTable ( > - IN EFI_TCG2_PROTOCOL *Tcg2Protocol, > - IN EFI_HANDLE GptHandle > + IN MEASURE_BOOT_PROTOCOLS *MeasureBootProtocols, > + IN EFI_HANDLE GptHandle > ) > { > EFI_STATUS Status; > @@ -134,13 +197,29 @@ Tcg2MeasureGptTable ( > UINTN NumberOfPartition; > UINT32 Index; > EFI_TCG2_EVENT *Tcg2Event; > + EFI_CC_EVENT *CcEvent; > EFI_GPT_DATA *GptData; > UINT32 EventSize; > + EFI_TCG2_PROTOCOL *Tcg2Protocol; > + EFI_CC_MEASUREMENT_PROTOCOL *CcProtocol; > > if (mTcg2MeasureGptCount > 0) { > return EFI_SUCCESS; > } > > + PrimaryHeader = NULL; > + EntryPtr = NULL; > + CcEvent = NULL; > + Tcg2Event = NULL; > + > + Tcg2Protocol = MeasureBootProtocols->Tcg2Protocol; > + CcProtocol = MeasureBootProtocols->CcProtocol; > + > + if (Tcg2Protocol == NULL && CcProtocol == NULL) { > + ASSERT (FALSE); > + return EFI_UNSUPPORTED; > + } > + > Status = gBS->HandleProtocol (GptHandle, &gEfiBlockIoProtocolGuid, (VOID**)&BlockIo); > if (EFI_ERROR (Status)) { > return EFI_UNSUPPORTED; > @@ -149,6 +228,7 @@ Tcg2MeasureGptTable ( > if (EFI_ERROR (Status)) { > return EFI_UNSUPPORTED; > } > + > // > // Read the EFI Partition Table Header > // > @@ -156,6 +236,7 @@ Tcg2MeasureGptTable ( > if (PrimaryHeader == NULL) { > return EFI_OUT_OF_RESOURCES; > } > + > Status = DiskIo->ReadDisk ( > DiskIo, > BlockIo->Media->MediaId, > @@ -164,10 +245,20 @@ Tcg2MeasureGptTable ( > (UINT8 *)PrimaryHeader > ); > if (EFI_ERROR (Status)) { > - DEBUG ((EFI_D_ERROR, "Failed to Read Partition Table Header!\n")); > + DEBUG ((DEBUG_ERROR, "Failed to Read Partition Table Header!\n")); > FreePool (PrimaryHeader); > return EFI_DEVICE_ERROR; > } > + > + // > + // PrimaryHeader->SizeOfPartitionEntry should not be zero > + // > + if (PrimaryHeader->SizeOfPartitionEntry == 0) { > + DEBUG ((DEBUG_ERROR, "SizeOfPartitionEntry should not be zero!\n")); > + FreePool (PrimaryHeader); > + return EFI_BAD_BUFFER_SIZE; > + } > + > // > // Read the partition entry. > // > @@ -202,15 +293,14 @@ Tcg2MeasureGptTable ( > } > > // > - // Prepare Data for Measurement > + // Prepare Data for Measurement (CcProtocol and Tcg2Protocol) > // > EventSize = (UINT32)(sizeof (EFI_GPT_DATA) - sizeof (GptData->Partitions) > + NumberOfPartition * PrimaryHeader->SizeOfPartitionEntry); > Tcg2Event = (EFI_TCG2_EVENT *) AllocateZeroPool (EventSize + sizeof (EFI_TCG2_EVENT) - sizeof(Tcg2Event->Event)); > if (Tcg2Event == NULL) { > - FreePool (PrimaryHeader); > - FreePool (EntryPtr); > - return EFI_OUT_OF_RESOURCES; > + Status = EFI_OUT_OF_RESOURCES; > + goto Exit; > } > > Tcg2Event->Size = EventSize + sizeof (EFI_TCG2_EVENT) - sizeof(Tcg2Event->Event); > @@ -243,22 +333,57 @@ Tcg2MeasureGptTable ( > } > > // > - // Measure the GPT data > + // Measure the GPT data by Tcg2Protocol > // > - Status = Tcg2Protocol->HashLogExtendEvent ( > - Tcg2Protocol, > - 0, > - (EFI_PHYSICAL_ADDRESS) (UINTN) (VOID *) GptData, > - (UINT64) EventSize, > - Tcg2Event > - ); > - if (!EFI_ERROR (Status)) { > - mTcg2MeasureGptCount++; > - } > - > - FreePool (PrimaryHeader); > - FreePool (EntryPtr); > - FreePool (Tcg2Event); > + if (Tcg2Protocol != NULL) { > + Status = Tcg2Protocol->HashLogExtendEvent ( > + Tcg2Protocol, > + 0, > + (EFI_PHYSICAL_ADDRESS) (UINTN) (VOID *) GptData, > + (UINT64) EventSize, > + Tcg2Event > + ); > + if (!EFI_ERROR (Status)) { > + mTcg2MeasureGptCount++; > + } > + DEBUG ((DEBUG_INFO, "DxeTpm2MeasureBootHandler - Tcg2 MeasureGptTable - %r\n", Status)); > + > + } else if (CcProtocol != NULL) { [SAMI] Please see my comment in patch 3/3 about the behaviour if both the TCG2 and CC measurement protocols are installed. > + > + // > + // Measure the GPT data by TdProtocol > + // > + Status = CreateCcEventFromTcg2Event (CcProtocol, Tcg2Event, EventSize, &CcEvent); > + if (EFI_ERROR (Status)) { > + goto Exit; > + } > + > + Status = CcProtocol->HashLogExtendEvent ( > + CcProtocol, > + 0, > + (EFI_PHYSICAL_ADDRESS) (UINTN) (VOID *) GptData, > + (UINT64) EventSize, > + CcEvent > + ); > + if (!EFI_ERROR (Status)) { > + mTcg2MeasureGptCount++; > + } > + DEBUG ((DEBUG_INFO, "DxeTpm2MeasureBootHandler - Cc MeasureGptTable - %r\n", Status)); > + } > + > +Exit: > + if (PrimaryHeader != NULL) { > + FreePool (PrimaryHeader); > + } > + if (EntryPtr != NULL) { > + FreePool (EntryPtr); > + } > + if (Tcg2Event != NULL) { > + FreePool (Tcg2Event); > + } > + if (CcEvent != NULL) { > + FreePool (CcEvent); > + } > > return Status; > } > @@ -271,12 +396,12 @@ Tcg2MeasureGptTable ( > PE/COFF image is external input, so this function will validate its data structure > within this image buffer before use. > > - @param[in] Tcg2Protocol Pointer to the located TCG2 protocol instance. > - @param[in] ImageAddress Start address of image buffer. > - @param[in] ImageSize Image size > - @param[in] LinkTimeBase Address that the image is loaded into memory. > - @param[in] ImageType Image subsystem type. > - @param[in] FilePath File path is corresponding to the input image. > + @param[in] MeasureBootProtocols Pointer to the located MeasureBoot protocol instances. > + @param[in] ImageAddress Start address of image buffer. > + @param[in] ImageSize Image size > + @param[in] LinkTimeBase Address that the image is loaded into memory. > + @param[in] ImageType Image subsystem type. > + @param[in] FilePath File path is corresponding to the input image. > > @retval EFI_SUCCESS Successfully measure image. > @retval EFI_OUT_OF_RESOURCES No enough resource to measure image. > @@ -287,7 +412,7 @@ Tcg2MeasureGptTable ( > EFI_STATUS > EFIAPI > Tcg2MeasurePeImage ( > - IN EFI_TCG2_PROTOCOL *Tcg2Protocol, > + IN MEASURE_BOOT_PROTOCOLS *MeasureBootProtocols, > IN EFI_PHYSICAL_ADDRESS ImageAddress, > IN UINTN ImageSize, > IN UINTN LinkTimeBase, > @@ -300,9 +425,22 @@ Tcg2MeasurePeImage ( > EFI_IMAGE_LOAD_EVENT *ImageLoad; > UINT32 FilePathSize; > UINT32 EventSize; > + EFI_CC_EVENT *CcEvent; > + EFI_CC_MEASUREMENT_PROTOCOL *CcProtocol; > + EFI_TCG2_PROTOCOL *Tcg2Protocol; > > Status = EFI_UNSUPPORTED; > ImageLoad = NULL; > + CcEvent = NULL; > + > + Tcg2Protocol = MeasureBootProtocols->Tcg2Protocol; > + CcProtocol = MeasureBootProtocols->CcProtocol; > + > + if (Tcg2Protocol == NULL && CcProtocol == NULL) { > + ASSERT (FALSE); > + return EFI_UNSUPPORTED; > + } > + > FilePathSize = (UINT32) GetDevicePathSize (FilePath); > > // > @@ -334,7 +472,7 @@ Tcg2MeasurePeImage ( > break; > default: > DEBUG (( > - EFI_D_ERROR, > + DEBUG_ERROR, > "Tcg2MeasurePeImage: Unknown subsystem type %d", > ImageType > )); > @@ -352,28 +490,125 @@ Tcg2MeasurePeImage ( > // > // Log the PE data > // > - Status = Tcg2Protocol->HashLogExtendEvent ( > - Tcg2Protocol, > - PE_COFF_IMAGE, > - ImageAddress, > - ImageSize, > - Tcg2Event > - ); > - if (Status == EFI_VOLUME_FULL) { > - // > - // Volume full here means the image is hashed and its result is extended to PCR. > - // But the event log can't be saved since log area is full. > - // Just return EFI_SUCCESS in order not to block the image load. > - // > - Status = EFI_SUCCESS; > + if (Tcg2Protocol != NULL) { > + Status = Tcg2Protocol->HashLogExtendEvent ( > + Tcg2Protocol, > + PE_COFF_IMAGE, > + ImageAddress, > + ImageSize, > + Tcg2Event > + ); > + if (Status == EFI_VOLUME_FULL) { > + // > + // Volume full here means the image is hashed and its result is extended to PCR. > + // But the event log can't be saved since log area is full. > + // Just return EFI_SUCCESS in order not to block the image load. > + // > + Status = EFI_SUCCESS; > + } > + DEBUG ((DEBUG_INFO, "DxeTpm2MeasureBootHandler - Tcg2 MeasurePeImage - %r\n", Status)); > + > + } else if (CcProtocol != NULL) { > + > + Status = CreateCcEventFromTcg2Event (CcProtocol, Tcg2Event, EventSize, &CcEvent); > + if (EFI_ERROR (Status)) { > + goto Finish; > + } > + > + Status = CcProtocol->HashLogExtendEvent ( > + CcProtocol, > + PE_COFF_IMAGE, > + ImageAddress, > + ImageSize, > + CcEvent > + ); > + if (Status == EFI_VOLUME_FULL) { > + // > + // Volume full here means the image is hashed and its result is extended to PCR. > + // But the event log can't be saved since log area is full. > + // Just return EFI_SUCCESS in order not to block the image load. > + // > + Status = EFI_SUCCESS; > + } > + DEBUG ((DEBUG_INFO, "DxeTpm2MeasureBootHandler - Cc MeasurePeImage - %r\n", Status)); > } > > Finish: > - FreePool (Tcg2Event); > + if (Tcg2Event != NULL) { > + FreePool (Tcg2Event); > + } > + > + if (CcEvent != NULL) { > + FreePool (CcEvent); > + } > > return Status; > } > > +/** > + Get the measure boot protocols. > + > + There are 2 measure boot, TCG2 protocol based and Cc measurement protocol based. > + > + @param MeasureBootProtocols Pointer to the located measure boot protocol instances. > + > + @retval EFI_SUCCESS Sucessfully locate the measure boot protocol instances (at least one instance). > + @retval EFI_UNSUPPORTED Measure boot is not supported. > +**/ > +EFI_STATUS > +EFIAPI > +GetMeasureBootProtocols ( > + MEASURE_BOOT_PROTOCOLS *MeasureBootProtocols > + ) > +{ > + EFI_STATUS Status; > + EFI_TCG2_PROTOCOL *Tcg2Protocol; > + EFI_CC_MEASUREMENT_PROTOCOL *CcProtocol; > + EFI_TCG2_BOOT_SERVICE_CAPABILITY Tcg2ProtocolCapability; > + EFI_CC_BOOT_SERVICE_CAPABILITY CcProtocolCapability; > + > + CcProtocol = NULL; > + Status = gBS->LocateProtocol (&gEfiCcMeasurementProtocolGuid, NULL, (VOID **) &CcProtocol); > + if (EFI_ERROR (Status)) { > + // > + // Cc Measurement protocol is not installed. > + // > + DEBUG ((DEBUG_VERBOSE, "CcMeasurementProtocol is not installed. - %r\n", Status)); > + } else { > + ZeroMem (&CcProtocolCapability, sizeof (CcProtocolCapability)); > + CcProtocolCapability.Size = sizeof (CcProtocolCapability); > + Status = CcProtocol->GetCapability (CcProtocol, &CcProtocolCapability); > + if (EFI_ERROR (Status) || CcProtocolCapability.CcType.Type == EFI_CC_TYPE_NONE) { > + DEBUG ((DEBUG_ERROR, " CcProtocol->GetCapability returns : %x, %r\n", CcProtocolCapability.CcType.Type, Status)); > + CcProtocol = NULL; > + } > + } > + > + Tcg2Protocol = NULL; > + Status = gBS->LocateProtocol (&gEfiTcg2ProtocolGuid, NULL, (VOID **) &Tcg2Protocol); > + if (EFI_ERROR (Status)) { > + // > + // Tcg2 protocol is not installed. So, TPM2 is not present. > + // > + DEBUG ((DEBUG_VERBOSE, "Tcg2Protocol is not installed. - %r\n", Status)); > + } else { > + Tcg2ProtocolCapability.Size = (UINT8) sizeof (Tcg2ProtocolCapability); > + Status = Tcg2Protocol->GetCapability (Tcg2Protocol, &Tcg2ProtocolCapability); > + if (EFI_ERROR (Status) || (!Tcg2ProtocolCapability.TPMPresentFlag)) { > + // > + // TPM device doesn't work or activate. > + // > + DEBUG ((DEBUG_ERROR, "TPMPresentFlag=FALSE %r\n", Status)); > + Tcg2Protocol = NULL; > + } > + } > + > + MeasureBootProtocols->Tcg2Protocol = Tcg2Protocol; > + MeasureBootProtocols->CcProtocol = CcProtocol; > + > + return (Tcg2Protocol == NULL && CcProtocol == NULL) ? EFI_UNSUPPORTED: EFI_SUCCESS; > +} > + > /** > The security handler is used to abstract platform-specific policy > from the DXE core response to an attempt to use a file that returns a > @@ -422,9 +657,8 @@ DxeTpm2MeasureBootHandler ( > IN BOOLEAN BootPolicy > ) > { > - EFI_TCG2_PROTOCOL *Tcg2Protocol; > + MEASURE_BOOT_PROTOCOLS MeasureBootProtocols; > EFI_STATUS Status; > - EFI_TCG2_BOOT_SERVICE_CAPABILITY ProtocolCapability; > EFI_DEVICE_PATH_PROTOCOL *DevicePathNode; > EFI_DEVICE_PATH_PROTOCOL *OrigDevicePathNode; > EFI_HANDLE Handle; > @@ -435,28 +669,23 @@ DxeTpm2MeasureBootHandler ( > EFI_PHYSICAL_ADDRESS FvAddress; > UINT32 Index; > > - Status = gBS->LocateProtocol (&gEfiTcg2ProtocolGuid, NULL, (VOID **) &Tcg2Protocol); > + MeasureBootProtocols.Tcg2Protocol = NULL; > + MeasureBootProtocols.CcProtocol = NULL; > + > + Status = GetMeasureBootProtocols(&MeasureBootProtocols); > + > if (EFI_ERROR (Status)) { > // > - // Tcg2 protocol is not installed. So, TPM2 is not present. > + // None of Measured boot protocols (Tcg2, Cc) is installed. > // Don't do any measurement, and directly return EFI_SUCCESS. > // > - DEBUG ((EFI_D_VERBOSE, "DxeTpm2MeasureBootHandler - Tcg2 - %r\n", Status)); > + DEBUG ((DEBUG_INFO, "None of Tcg2Protocol/CcMeasurementProtocol is installed.\n")); > return EFI_SUCCESS; > } > > - ProtocolCapability.Size = (UINT8) sizeof (ProtocolCapability); > - Status = Tcg2Protocol->GetCapability ( > - Tcg2Protocol, > - &ProtocolCapability > - ); > - if (EFI_ERROR (Status) || (!ProtocolCapability.TPMPresentFlag)) { > - // > - // TPM device doesn't work or activate. > - // > - DEBUG ((EFI_D_ERROR, "DxeTpm2MeasureBootHandler (%r) - TPMPresentFlag - %x\n", Status, ProtocolCapability.TPMPresentFlag)); > - return EFI_SUCCESS; > - } > + DEBUG ((DEBUG_INFO, "Tcg2Protocol = %p, TdProtocol = %p\n", > + MeasureBootProtocols.Tcg2Protocol, > + MeasureBootProtocols.CcProtocol)); > > // > // Copy File Device Path > @@ -502,8 +731,8 @@ DxeTpm2MeasureBootHandler ( > // > // Measure GPT disk. > // > - Status = Tcg2MeasureGptTable (Tcg2Protocol, Handle); > - DEBUG ((EFI_D_INFO, "DxeTpm2MeasureBootHandler - Tcg2MeasureGptTable - %r\n", Status)); > + Status = Tcg2MeasureGptTable (&MeasureBootProtocols, Handle); > + > if (!EFI_ERROR (Status)) { > // > // GPT disk check done. > @@ -647,14 +876,13 @@ DxeTpm2MeasureBootHandler ( > // Measure PE image into TPM log. > // > Status = Tcg2MeasurePeImage ( > - Tcg2Protocol, > + &MeasureBootProtocols, > (EFI_PHYSICAL_ADDRESS) (UINTN) FileBuffer, > FileSize, > (UINTN) ImageContext.ImageAddress, > ImageContext.ImageType, > DevicePathNode > ); > - DEBUG ((EFI_D_INFO, "DxeTpm2MeasureBootHandler - Tcg2MeasurePeImage - %r\n", Status)); > } > > // > @@ -665,7 +893,7 @@ Finish: > FreePool (OrigDevicePathNode); > } > > - DEBUG ((EFI_D_INFO, "DxeTpm2MeasureBootHandler - %r\n", Status)); > + DEBUG ((DEBUG_INFO, "DxeTpm2MeasureBootHandler - %r\n", Status)); > > return Status; > } > diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.inf b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.inf > index 2506abbe7c8b..6dca79a20c93 100644 > --- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.inf > +++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.inf > @@ -1,5 +1,5 @@ > ## @file > -# Provides security service for TPM 2.0 measured boot > +# Provides security service for TPM 2.0 measured boot and Confidential Computing measure boot. > # > # Spec Compliance Info: > # "TCG PC Client Platform Firmware Profile Specification for TPM Family 2.0 Level 00 Revision 1.03 v51" > @@ -61,6 +61,7 @@ > > [Protocols] > gEfiTcg2ProtocolGuid ## SOMETIMES_CONSUMES > + gEfiCcMeasurementProtocolGuid ## SOMETIMES_CONSUMES > gEfiFirmwareVolumeBlockProtocolGuid ## SOMETIMES_CONSUMES > gEfiBlockIoProtocolGuid ## SOMETIMES_CONSUMES > gEfiDiskIoProtocolGuid ## SOMETIMES_CONSUMES --------------4D4AA5742F6F49213363F8AB Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: 7bit

Hi Min,

Thank you for this patch.

Please find my feedback inline marked [SAMI].

Regards,

Sami Mujawar


On 02/11/2021 02:50 AM, Min Xu wrote:
BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3625

DxeTpm2MeasureBootLib supports TPM2 based measure boot. After
CcMeasurementProtocol is introduced, CC based measure boot needs to
be supported in DxeTpm2MeasureBootLib as well.

There are 2 major changes in this commit.

1. MEASURE_BOOT_PROTOCOLS is defined to store the instances of TCG2
protocol and TEE protocol. In the DxeTpm2MeasureBootHandler above 2
measure boot protocol instances will be located. Then the located
protocol instances will be called to do the measure boot.

2. CcEvent is similar to Tcg2Event except the MrIndex and PcrIndex.
CreateCcEventFromTcg2Event is used to create the CcEvent based on the
Tcg2Event.

Above 2 changes make the minimize changes to the existing code.

Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <gaoliming@byosoft.com.cn>
Cc: Zhiguang Liu <zhiguang.liu@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Sami Mujawar <sami.mujawar@arm.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Min Xu <min.m.xu@intel.com>
---
 .../DxeTpm2MeasureBootLib.c                   | 366 ++++++++++++++----
 .../DxeTpm2MeasureBootLib.inf                 |   3 +-
 2 files changed, 299 insertions(+), 70 deletions(-)

diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
index 92eac715800f..af889b6ed3ed 100644
--- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
+++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.c
@@ -1,5 +1,6 @@
 /** @file
-  The library instance provides security service of TPM2 measure boot.
+  The library instance provides security service of TPM2 measure boot and
+  Confidential Computing (CC) measure boot.
 
   Caution: This file requires additional review when modified.
   This library will have external input - PE/COFF image and GPT partition.
@@ -41,6 +42,12 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #include <Library/PeCoffLib.h>
 #include <Library/SecurityManagementLib.h>
 #include <Library/HobLib.h>
+#include <Protocol/CcMeasurement.h>
+
+typedef struct {
+  EFI_TCG2_PROTOCOL             *Tcg2Protocol;
+  EFI_CC_MEASUREMENT_PROTOCOL   *CcProtocol;
+} MEASURE_BOOT_PROTOCOLS;
 
 //
 // Flag to check GPT partition. It only need be measured once.
@@ -55,6 +62,62 @@ UINTN                             mTcg2ImageSize;
 EFI_HANDLE                        mTcg2CacheMeasuredHandle  = NULL;
 MEASURED_HOB_DATA                 *mTcg2MeasuredHobData     = NULL;
 
+/**
+  Create CcEvent from Tcg2Event.
+
+  CcEvent is similar to Tcg2Event except the MrIndex.
+
+  @param  CcProtocol  Pointer to the located Cc Measurement protocol instance.
+  @param  Tcg2Event   Pointer to the Tcg2Event.
+  @param  EventSize   Size of the Event.
+  @param  EfiCcEvent  The created CcEvent
+
+  @retval EFI_SUCCESS           Successfully create the CcEvent
+  @retval EFI_INVALID_PARAMETER The input parameter is invalid
+  @retval EFI_UNSUPPORTED       The input PCRIndex cannot be mapped to Cc MR
+  @retval EFI_OUT_OF_RESOURCES  Out of resource
+**/
+EFI_STATUS
[SAMI] Is EFIAPI needed here? 
+CreateCcEventFromTcg2Event (
+  IN  EFI_CC_MEASUREMENT_PROTOCOL   *CcProtocol,
+  IN  EFI_TCG2_EVENT                *Tcg2Event,
+  IN  UINT32                        EventSize,
+  IN OUT EFI_CC_EVENT               **EfiCcEvent
+  )
+{
+  UINT32            MrIndex;
[SAMI] I think it may be good to use the typedef for the measurment register index here i.e. EFI_CC_MR_INDEX. 
+  EFI_STATUS        Status;
+  EFI_CC_EVENT      *CcEvent;
+
+  if (Tcg2Event == NULL || CcProtocol == NULL || EfiCcEvent == NULL) {
+    return EFI_INVALID_PARAMETER;
+  }
+
+  *EfiCcEvent = NULL;
+
+  Status = CcProtocol->MapPcrToMrIndex (CcProtocol, Tcg2Event->Header.PCRIndex, &MrIndex);
+  if (EFI_ERROR (Status)) {
+    DEBUG ((DEBUG_ERROR, "Cannot map PcrIndex(%d) to MrIndex\n", Tcg2Event->Header.PCRIndex));
+    return Status;
+  }
+
+  CcEvent = (EFI_CC_EVENT *)AllocateZeroPool (Tcg2Event->Size);
+  if (CcEvent == NULL) {
+    return EFI_OUT_OF_RESOURCES;
+  }
+
+  CcEvent->Size                 = Tcg2Event->Size;
+  CcEvent->Header.HeaderSize    = Tcg2Event->Header.HeaderSize;
+  CcEvent->Header.HeaderVersion = Tcg2Event->Header.HeaderVersion;
+  CcEvent->Header.MrIndex       = MrIndex;
+  CcEvent->Header.EventType     = Tcg2Event->Header.EventType;
+  CopyMem (CcEvent->Event, Tcg2Event->Event, EventSize);
+
+  *EfiCcEvent = CcEvent;
+
+  return EFI_SUCCESS;
+}
+
 /**
   Reads contents of a PE/COFF image in memory buffer.
 
@@ -109,7 +172,7 @@ DxeTpm2MeasureBootLibImageRead (
   Caution: This function may receive untrusted input.
   The GPT partition table is external input, so this function should parse partition data carefully.
 
-  @param Tcg2Protocol            Pointer to the located TCG2 protocol instance.
+  @param MeasureBootProtocols    Pointer to the located MeasureBoot protocol instances (i.e. TCG2/Td protocol).
   @param GptHandle               Handle that GPT partition was installed.
 
   @retval EFI_SUCCESS            Successfully measure GPT table.
@@ -121,8 +184,8 @@ DxeTpm2MeasureBootLibImageRead (
 EFI_STATUS
 EFIAPI
 Tcg2MeasureGptTable (
-  IN  EFI_TCG2_PROTOCOL  *Tcg2Protocol,
-  IN  EFI_HANDLE         GptHandle
+  IN  MEASURE_BOOT_PROTOCOLS  *MeasureBootProtocols,
+  IN  EFI_HANDLE              GptHandle
   )
 {
   EFI_STATUS                        Status;
@@ -134,13 +197,29 @@ Tcg2MeasureGptTable (
   UINTN                             NumberOfPartition;
   UINT32                            Index;
   EFI_TCG2_EVENT                    *Tcg2Event;
+  EFI_CC_EVENT                      *CcEvent;
   EFI_GPT_DATA                      *GptData;
   UINT32                            EventSize;
+  EFI_TCG2_PROTOCOL                 *Tcg2Protocol;
+  EFI_CC_MEASUREMENT_PROTOCOL       *CcProtocol;
 
   if (mTcg2MeasureGptCount > 0) {
     return EFI_SUCCESS;
   }
 
+  PrimaryHeader = NULL;
+  EntryPtr      = NULL;
+  CcEvent       = NULL;
+  Tcg2Event     = NULL;
+
+  Tcg2Protocol  = MeasureBootProtocols->Tcg2Protocol;
+  CcProtocol    = MeasureBootProtocols->CcProtocol;
+
+  if (Tcg2Protocol == NULL && CcProtocol == NULL) {
+    ASSERT (FALSE);
+    return EFI_UNSUPPORTED;
+  }
+
   Status = gBS->HandleProtocol (GptHandle, &gEfiBlockIoProtocolGuid, (VOID**)&BlockIo);
   if (EFI_ERROR (Status)) {
     return EFI_UNSUPPORTED;
@@ -149,6 +228,7 @@ Tcg2MeasureGptTable (
   if (EFI_ERROR (Status)) {
     return EFI_UNSUPPORTED;
   }
+
   //
   // Read the EFI Partition Table Header
   //
@@ -156,6 +236,7 @@ Tcg2MeasureGptTable (
   if (PrimaryHeader == NULL) {
     return EFI_OUT_OF_RESOURCES;
   }
+
   Status = DiskIo->ReadDisk (
                      DiskIo,
                      BlockIo->Media->MediaId,
@@ -164,10 +245,20 @@ Tcg2MeasureGptTable (
                      (UINT8 *)PrimaryHeader
                      );
   if (EFI_ERROR (Status)) {
-    DEBUG ((EFI_D_ERROR, "Failed to Read Partition Table Header!\n"));
+    DEBUG ((DEBUG_ERROR, "Failed to Read Partition Table Header!\n"));
     FreePool (PrimaryHeader);
     return EFI_DEVICE_ERROR;
   }
+
+  //
+  // PrimaryHeader->SizeOfPartitionEntry should not be zero
+  //
+  if (PrimaryHeader->SizeOfPartitionEntry == 0) {
+    DEBUG ((DEBUG_ERROR, "SizeOfPartitionEntry should not be zero!\n"));
+    FreePool (PrimaryHeader);
+    return EFI_BAD_BUFFER_SIZE;
+  }
+
   //
   // Read the partition entry.
   //
@@ -202,15 +293,14 @@ Tcg2MeasureGptTable (
   }
 
   //
-  // Prepare Data for Measurement
+  // Prepare Data for Measurement (CcProtocol and Tcg2Protocol)
   //
   EventSize = (UINT32)(sizeof (EFI_GPT_DATA) - sizeof (GptData->Partitions)
                         + NumberOfPartition * PrimaryHeader->SizeOfPartitionEntry);
   Tcg2Event = (EFI_TCG2_EVENT *) AllocateZeroPool (EventSize + sizeof (EFI_TCG2_EVENT) - sizeof(Tcg2Event->Event));
   if (Tcg2Event == NULL) {
-    FreePool (PrimaryHeader);
-    FreePool (EntryPtr);
-    return EFI_OUT_OF_RESOURCES;
+    Status = EFI_OUT_OF_RESOURCES;
+    goto Exit;
   }
 
   Tcg2Event->Size = EventSize + sizeof (EFI_TCG2_EVENT) - sizeof(Tcg2Event->Event);
@@ -243,22 +333,57 @@ Tcg2MeasureGptTable (
   }
 
   //
-  // Measure the GPT data
+  // Measure the GPT data by Tcg2Protocol
   //
-  Status = Tcg2Protocol->HashLogExtendEvent (
-             Tcg2Protocol,
-             0,
-             (EFI_PHYSICAL_ADDRESS) (UINTN) (VOID *) GptData,
-             (UINT64) EventSize,
-             Tcg2Event
-             );
-  if (!EFI_ERROR (Status)) {
-    mTcg2MeasureGptCount++;
-  }
-
-  FreePool (PrimaryHeader);
-  FreePool (EntryPtr);
-  FreePool (Tcg2Event);
+  if (Tcg2Protocol != NULL) {
+    Status = Tcg2Protocol->HashLogExtendEvent (
+               Tcg2Protocol,
+               0,
+               (EFI_PHYSICAL_ADDRESS) (UINTN) (VOID *) GptData,
+               (UINT64) EventSize,
+               Tcg2Event
+               );
+    if (!EFI_ERROR (Status)) {
+      mTcg2MeasureGptCount++;
+    }
+    DEBUG ((DEBUG_INFO, "DxeTpm2MeasureBootHandler - Tcg2 MeasureGptTable - %r\n", Status));
+
+  } else if (CcProtocol != NULL) {
[SAMI] Please see my comment in patch 3/3 about the behaviour if both the TCG2 and CC measurement protocols are installed. 
+
+    //
+    // Measure the GPT data by TdProtocol
+    //
+    Status = CreateCcEventFromTcg2Event (CcProtocol, Tcg2Event, EventSize, &CcEvent);
+    if (EFI_ERROR (Status)) {
+      goto Exit;
+    }
+
+    Status = CcProtocol->HashLogExtendEvent (
+               CcProtocol,
+               0,
+               (EFI_PHYSICAL_ADDRESS) (UINTN) (VOID *) GptData,
+               (UINT64) EventSize,
+               CcEvent
+               );
+    if (!EFI_ERROR (Status)) {
+      mTcg2MeasureGptCount++;
+    }
+    DEBUG ((DEBUG_INFO, "DxeTpm2MeasureBootHandler - Cc MeasureGptTable - %r\n", Status));
+  }
+
+Exit:
+  if (PrimaryHeader != NULL) {
+    FreePool (PrimaryHeader);
+  }
+  if (EntryPtr != NULL) {
+    FreePool (EntryPtr);
+  }
+  if (Tcg2Event != NULL) {
+    FreePool (Tcg2Event);
+  }
+  if (CcEvent != NULL) {
+    FreePool (CcEvent);
+  }
 
   return Status;
 }
@@ -271,12 +396,12 @@ Tcg2MeasureGptTable (
   PE/COFF image is external input, so this function will validate its data structure
   within this image buffer before use.
 
-  @param[in] Tcg2Protocol   Pointer to the located TCG2 protocol instance.
-  @param[in] ImageAddress   Start address of image buffer.
-  @param[in] ImageSize      Image size
-  @param[in] LinkTimeBase   Address that the image is loaded into memory.
-  @param[in] ImageType      Image subsystem type.
-  @param[in] FilePath       File path is corresponding to the input image.
+  @param[in] MeasureBootProtocols   Pointer to the located MeasureBoot protocol instances.
+  @param[in] ImageAddress           Start address of image buffer.
+  @param[in] ImageSize              Image size
+  @param[in] LinkTimeBase           Address that the image is loaded into memory.
+  @param[in] ImageType              Image subsystem type.
+  @param[in] FilePath               File path is corresponding to the input image.
 
   @retval EFI_SUCCESS            Successfully measure image.
   @retval EFI_OUT_OF_RESOURCES   No enough resource to measure image.
@@ -287,7 +412,7 @@ Tcg2MeasureGptTable (
 EFI_STATUS
 EFIAPI
 Tcg2MeasurePeImage (
-  IN  EFI_TCG2_PROTOCOL         *Tcg2Protocol,
+  IN  MEASURE_BOOT_PROTOCOLS    *MeasureBootProtocols,
   IN  EFI_PHYSICAL_ADDRESS      ImageAddress,
   IN  UINTN                     ImageSize,
   IN  UINTN                     LinkTimeBase,
@@ -300,9 +425,22 @@ Tcg2MeasurePeImage (
   EFI_IMAGE_LOAD_EVENT              *ImageLoad;
   UINT32                            FilePathSize;
   UINT32                            EventSize;
+  EFI_CC_EVENT                      *CcEvent;
+  EFI_CC_MEASUREMENT_PROTOCOL       *CcProtocol;
+  EFI_TCG2_PROTOCOL                 *Tcg2Protocol;
 
   Status        = EFI_UNSUPPORTED;
   ImageLoad     = NULL;
+  CcEvent       = NULL;
+
+  Tcg2Protocol  = MeasureBootProtocols->Tcg2Protocol;
+  CcProtocol    = MeasureBootProtocols->CcProtocol;
+
+  if (Tcg2Protocol == NULL && CcProtocol == NULL) {
+    ASSERT (FALSE);
+    return EFI_UNSUPPORTED;
+  }
+
   FilePathSize  = (UINT32) GetDevicePathSize (FilePath);
 
   //
@@ -334,7 +472,7 @@ Tcg2MeasurePeImage (
       break;
     default:
       DEBUG ((
-        EFI_D_ERROR,
+        DEBUG_ERROR,
         "Tcg2MeasurePeImage: Unknown subsystem type %d",
         ImageType
         ));
@@ -352,28 +490,125 @@ Tcg2MeasurePeImage (
   //
   // Log the PE data
   //
-  Status = Tcg2Protocol->HashLogExtendEvent (
-             Tcg2Protocol,
-             PE_COFF_IMAGE,
-             ImageAddress,
-             ImageSize,
-             Tcg2Event
-             );
-  if (Status == EFI_VOLUME_FULL) {
-    //
-    // Volume full here means the image is hashed and its result is extended to PCR.
-    // But the event log can't be saved since log area is full.
-    // Just return EFI_SUCCESS in order not to block the image load.
-    //
-    Status = EFI_SUCCESS;
+  if (Tcg2Protocol != NULL) {
+    Status = Tcg2Protocol->HashLogExtendEvent (
+               Tcg2Protocol,
+               PE_COFF_IMAGE,
+               ImageAddress,
+               ImageSize,
+               Tcg2Event
+               );
+    if (Status == EFI_VOLUME_FULL) {
+      //
+      // Volume full here means the image is hashed and its result is extended to PCR.
+      // But the event log can't be saved since log area is full.
+      // Just return EFI_SUCCESS in order not to block the image load.
+      //
+      Status = EFI_SUCCESS;
+    }
+    DEBUG ((DEBUG_INFO, "DxeTpm2MeasureBootHandler - Tcg2 MeasurePeImage - %r\n", Status));
+
+  } else if (CcProtocol != NULL) {
+
+    Status = CreateCcEventFromTcg2Event (CcProtocol, Tcg2Event, EventSize, &CcEvent);
+    if (EFI_ERROR (Status)) {
+      goto Finish;
+    }
+
+    Status = CcProtocol->HashLogExtendEvent (
+               CcProtocol,
+               PE_COFF_IMAGE,
+               ImageAddress,
+               ImageSize,
+               CcEvent
+               );
+    if (Status == EFI_VOLUME_FULL) {
+      //
+      // Volume full here means the image is hashed and its result is extended to PCR.
+      // But the event log can't be saved since log area is full.
+      // Just return EFI_SUCCESS in order not to block the image load.
+      //
+      Status = EFI_SUCCESS;
+    }
+    DEBUG ((DEBUG_INFO, "DxeTpm2MeasureBootHandler - Cc MeasurePeImage - %r\n", Status));
   }
 
 Finish:
-  FreePool (Tcg2Event);
+  if (Tcg2Event != NULL) {
+    FreePool (Tcg2Event);
+  }
+
+  if (CcEvent != NULL) {
+    FreePool (CcEvent);
+  }
 
   return Status;
 }
 
+/**
+  Get the measure boot protocols.
+
+  There are 2 measure boot, TCG2 protocol based and Cc measurement protocol based.
+
+  @param  MeasureBootProtocols  Pointer to the located measure boot protocol instances.
+
+  @retval EFI_SUCCESS           Sucessfully locate the measure boot protocol instances (at least one instance).
+  @retval EFI_UNSUPPORTED       Measure boot is not supported.
+**/
+EFI_STATUS
+EFIAPI
+GetMeasureBootProtocols (
+  MEASURE_BOOT_PROTOCOLS    *MeasureBootProtocols
+  )
+{
+  EFI_STATUS                          Status;
+  EFI_TCG2_PROTOCOL                   *Tcg2Protocol;
+  EFI_CC_MEASUREMENT_PROTOCOL         *CcProtocol;
+  EFI_TCG2_BOOT_SERVICE_CAPABILITY    Tcg2ProtocolCapability;
+  EFI_CC_BOOT_SERVICE_CAPABILITY      CcProtocolCapability;
+
+  CcProtocol = NULL;
+  Status = gBS->LocateProtocol (&gEfiCcMeasurementProtocolGuid, NULL, (VOID **) &CcProtocol);
+  if (EFI_ERROR (Status)) {
+    //
+    // Cc Measurement protocol is not installed.
+    //
+    DEBUG ((DEBUG_VERBOSE, "CcMeasurementProtocol is not installed. - %r\n", Status));
+  } else {
+    ZeroMem (&CcProtocolCapability, sizeof (CcProtocolCapability));
+    CcProtocolCapability.Size = sizeof (CcProtocolCapability);
+    Status = CcProtocol->GetCapability (CcProtocol, &CcProtocolCapability);
+    if (EFI_ERROR (Status) || CcProtocolCapability.CcType.Type == EFI_CC_TYPE_NONE) {
+      DEBUG ((DEBUG_ERROR, " CcProtocol->GetCapability returns : %x, %r\n", CcProtocolCapability.CcType.Type, Status));
+      CcProtocol = NULL;
+    }
+  }
+
+  Tcg2Protocol = NULL;
+  Status = gBS->LocateProtocol (&gEfiTcg2ProtocolGuid, NULL, (VOID **) &Tcg2Protocol);
+  if (EFI_ERROR (Status)) {
+    //
+    // Tcg2 protocol is not installed. So, TPM2 is not present.
+    //
+    DEBUG ((DEBUG_VERBOSE, "Tcg2Protocol is not installed. - %r\n", Status));
+  } else {
+    Tcg2ProtocolCapability.Size = (UINT8) sizeof (Tcg2ProtocolCapability);
+    Status = Tcg2Protocol->GetCapability (Tcg2Protocol, &Tcg2ProtocolCapability);
+    if (EFI_ERROR (Status) || (!Tcg2ProtocolCapability.TPMPresentFlag)) {
+      //
+      // TPM device doesn't work or activate.
+      //
+      DEBUG ((DEBUG_ERROR, "TPMPresentFlag=FALSE %r\n", Status));
+      Tcg2Protocol = NULL;
+    }
+  }
+
+  MeasureBootProtocols->Tcg2Protocol = Tcg2Protocol;
+  MeasureBootProtocols->CcProtocol   = CcProtocol;
+
+  return (Tcg2Protocol == NULL && CcProtocol == NULL) ? EFI_UNSUPPORTED: EFI_SUCCESS;
+}
+
 /**
   The security handler is used to abstract platform-specific policy
   from the DXE core response to an attempt to use a file that returns a
@@ -422,9 +657,8 @@ DxeTpm2MeasureBootHandler (
   IN  BOOLEAN                          BootPolicy
   )
 {
-  EFI_TCG2_PROTOCOL                   *Tcg2Protocol;
+  MEASURE_BOOT_PROTOCOLS              MeasureBootProtocols;
   EFI_STATUS                          Status;
-  EFI_TCG2_BOOT_SERVICE_CAPABILITY    ProtocolCapability;
   EFI_DEVICE_PATH_PROTOCOL            *DevicePathNode;
   EFI_DEVICE_PATH_PROTOCOL            *OrigDevicePathNode;
   EFI_HANDLE                          Handle;
@@ -435,28 +669,23 @@ DxeTpm2MeasureBootHandler (
   EFI_PHYSICAL_ADDRESS                FvAddress;
   UINT32                              Index;
 
-  Status = gBS->LocateProtocol (&gEfiTcg2ProtocolGuid, NULL, (VOID **) &Tcg2Protocol);
+  MeasureBootProtocols.Tcg2Protocol = NULL;
+  MeasureBootProtocols.CcProtocol   = NULL;
+
+  Status = GetMeasureBootProtocols(&MeasureBootProtocols);
+
   if (EFI_ERROR (Status)) {
     //
-    // Tcg2 protocol is not installed. So, TPM2 is not present.
+    // None of Measured boot protocols (Tcg2, Cc) is installed.
     // Don't do any measurement, and directly return EFI_SUCCESS.
     //
-    DEBUG ((EFI_D_VERBOSE, "DxeTpm2MeasureBootHandler - Tcg2 - %r\n", Status));
+    DEBUG ((DEBUG_INFO, "None of Tcg2Protocol/CcMeasurementProtocol is installed.\n"));
     return EFI_SUCCESS;
   }
 
-  ProtocolCapability.Size = (UINT8) sizeof (ProtocolCapability);
-  Status = Tcg2Protocol->GetCapability (
-                           Tcg2Protocol,
-                           &ProtocolCapability
-                           );
-  if (EFI_ERROR (Status) || (!ProtocolCapability.TPMPresentFlag)) {
-    //
-    // TPM device doesn't work or activate.
-    //
-    DEBUG ((EFI_D_ERROR, "DxeTpm2MeasureBootHandler (%r) - TPMPresentFlag - %x\n", Status, ProtocolCapability.TPMPresentFlag));
-    return EFI_SUCCESS;
-  }
+  DEBUG ((DEBUG_INFO, "Tcg2Protocol = %p, TdProtocol = %p\n",
+                      MeasureBootProtocols.Tcg2Protocol,
+                      MeasureBootProtocols.CcProtocol));
 
   //
   // Copy File Device Path
@@ -502,8 +731,8 @@ DxeTpm2MeasureBootHandler (
             //
             // Measure GPT disk.
             //
-            Status = Tcg2MeasureGptTable (Tcg2Protocol, Handle);
-            DEBUG ((EFI_D_INFO, "DxeTpm2MeasureBootHandler - Tcg2MeasureGptTable - %r\n", Status));
+            Status = Tcg2MeasureGptTable (&MeasureBootProtocols, Handle);
+
             if (!EFI_ERROR (Status)) {
               //
               // GPT disk check done.
@@ -647,14 +876,13 @@ DxeTpm2MeasureBootHandler (
     // Measure PE image into TPM log.
     //
     Status = Tcg2MeasurePeImage (
-               Tcg2Protocol,
+               &MeasureBootProtocols,
                (EFI_PHYSICAL_ADDRESS) (UINTN) FileBuffer,
                FileSize,
                (UINTN) ImageContext.ImageAddress,
                ImageContext.ImageType,
                DevicePathNode
                );
-    DEBUG ((EFI_D_INFO, "DxeTpm2MeasureBootHandler - Tcg2MeasurePeImage - %r\n", Status));
   }
 
   //
@@ -665,7 +893,7 @@ Finish:
     FreePool (OrigDevicePathNode);
   }
 
-  DEBUG ((EFI_D_INFO, "DxeTpm2MeasureBootHandler - %r\n", Status));
+  DEBUG ((DEBUG_INFO, "DxeTpm2MeasureBootHandler - %r\n", Status));
 
   return Status;
 }
diff --git a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.inf b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.inf
index 2506abbe7c8b..6dca79a20c93 100644
--- a/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.inf
+++ b/SecurityPkg/Library/DxeTpm2MeasureBootLib/DxeTpm2MeasureBootLib.inf
@@ -1,5 +1,5 @@
 ## @file
-#  Provides security service for TPM 2.0 measured boot
+#  Provides security service for TPM 2.0 measured boot and Confidential Computing measure boot.
 #
 #  Spec Compliance Info:
 #    "TCG PC Client Platform Firmware Profile Specification for TPM Family 2.0 Level 00 Revision 1.03 v51"
@@ -61,6 +61,7 @@
 
 [Protocols]
   gEfiTcg2ProtocolGuid                  ## SOMETIMES_CONSUMES
+  gEfiCcMeasurementProtocolGuid         ## SOMETIMES_CONSUMES
   gEfiFirmwareVolumeBlockProtocolGuid   ## SOMETIMES_CONSUMES
   gEfiBlockIoProtocolGuid               ## SOMETIMES_CONSUMES
   gEfiDiskIoProtocolGuid                ## SOMETIMES_CONSUMES

--------------4D4AA5742F6F49213363F8AB--