Re: [edk2-devel] [PATCH 0/4] Measure kernel blob

["Ard Biesheuvel" <ardb@kernel.org>]

Same questions here. I don't think we should use the legacy Linux EFI
handover protocol for CC implementations, and the ordinary
LoadImage/StartImage based boot sequence already incorporates TPM
measurement, of which TDX and SEV/SNP are just a specialization.

So I don't understand why we need any of this in the first place.


On Mon, 23 May 2022 at 11:36, Yao, Jiewen <jiewen.yao@intel.com> wrote:
>
> Fix Typo for 3:
> ->BlobMeasurementLib->TpmMeasurementLib->TpmMeasurementLibTdx
> Should be: ->BlobMeasurementLib->TpmMeasurementLib->CcProtocol->Tdx
>
> > -----Original Message-----
> > From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Yao, Jiewen
> > Sent: Monday, May 23, 2022 5:30 PM
> > To: Xu, Min M <min.m.xu@intel.com>; devel@edk2.groups.io
> > Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>; Justen, Jordan L
> > <jordan.l.justen@intel.com>; Ashish Kalra <ashish.kalra@amd.com>; Brijesh
> > Singh <brijesh.singh@amd.com>; Aktas, Erdem <erdemaktas@google.com>;
> > James Bottomley <jejb@linux.ibm.com>; Tom Lendacky
> > <thomas.lendacky@amd.com>; Sami Mujawar <sami.mujawar@arm.com>;
> > Gerd Hoffmann <kraxel@redhat.com>
> > Subject: Re: [edk2-devel] [PATCH 0/4] Measure kernel blob
> >
> > Hi
> > I am not clear about the design. Some questions:
> >
> > 1. This should be generic feature for trusted boot. Not TDX specific. Right?
> >
> > 2. Why we need BlobMeasurementLib?
> > We already have TpmMeasurementLib. Why we cannot use it?
> >
> > 3. Why we need BlobMeasurementLibTdx?
> > Even if we really need BlobMeasurementLib, the flow should be: -
> > >BlobMeasurementLib->TpmMeasurementLib->TpmMeasurementLibTdx
> >
> > 4. Why we need BlobMeasurementLibNull?
> > We already have TpmMeasurementLibNull. What is benefit to add one more
> > NULL MeasurementLib?
> >
> > Thank you
> > Yao Jiewen
> >
> > > -----Original Message-----
> > > From: Xu, Min M <min.m.xu@intel.com>
> > > Sent: Monday, May 23, 2022 1:56 PM
> > > To: devel@edk2.groups.io
> > > Cc: Xu, Min M <min.m.xu@intel.com>; Ard Biesheuvel
> > > <ardb+tianocore@kernel.org>; Justen, Jordan L <jordan.l.justen@intel.com>;
> > > Ashish Kalra <ashish.kalra@amd.com>; Brijesh Singh
> > <brijesh.singh@amd.com>;
> > > Aktas, Erdem <erdemaktas@google.com>; James Bottomley
> > > <jejb@linux.ibm.com>; Yao, Jiewen <jiewen.yao@intel.com>; Tom Lendacky
> > > <thomas.lendacky@amd.com>; Sami Mujawar <sami.mujawar@arm.com>;
> > > Gerd Hoffmann <kraxel@redhat.com>
> > > Subject: [PATCH 0/4] Measure kernel blob
> > >
> > > Kernel blobs include the kernel image, initrd, command line. These are
> > > external inputs from host VMM. In some platforms,such as Tdx environment,
> > > Host VMM is treated as un-trusted. So these external inputs should be
> > > measured.
> > >
> > > This patch-set imports a new library class (BlobMeasurementLib). It is
> > > designed to do the blob measurement, including the kernel blob
> > > measurement. In the future, it will do other blob measurement, such as
> > > measuring ACPI table which is also passed from host VMM.
> > >
> > > The code is at: https://github.com/mxu9/edk2/tree/MeasureKernelBlob.v1
> > >
> > > Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
> > > Cc: Jordan Justen <jordan.l.justen@intel.com>
> > > Cc: Ashish Kalra <ashish.kalra@amd.com>
> > > Cc: Brijesh Singh <brijesh.singh@amd.com>
> > > Cc: Erdem Aktas <erdemaktas@google.com>
> > > Cc: James Bottomley <jejb@linux.ibm.com>
> > > Cc: Jiewen Yao <jiewen.yao@intel.com>
> > > Cc: Tom Lendacky <thomas.lendacky@amd.com>
> > > Cc: Sami Mujawar <sami.mujawar@arm.com>
> > > Cc: Gerd Hoffmann <kraxel@redhat.com>
> > > Signed-off-by: Min Xu <min.m.xu@intel.com>
> > >
> > > Min Xu (4):
> > >   OvmfPkg: Add library class BlobMeasurementLib with null implementation
> > >   OvmfPkg: Add BlobMeasurementLibNull to dsc
> > >   OvmfPkg: Implement BlobMeasurementLibTdx
> > >   OvmfPkg: Call MeasureKernelBlob after fetch from fw_cfg
> > >
> > >  ArmVirtPkg/ArmVirtQemu.dsc                    |  1 +
> > >  ArmVirtPkg/ArmVirtQemuKernel.dsc              |  1 +
> > >  OvmfPkg/AmdSev/AmdSevX64.dsc                  |  2 +
> > >  OvmfPkg/CloudHv/CloudHvX64.dsc                |  1 +
> > >  OvmfPkg/Include/Library/BlobMeasurementLib.h  | 38 ++++++++
> > >  .../BlobMeasurementLibTdx/BlobMeasurement.c   | 87
> > +++++++++++++++++++
> > >  .../BlobMeasurementLibTdx.inf                 | 30 +++++++
> > >  OvmfPkg/IntelTdx/IntelTdxX64.dsc              |  1 +
> > >  .../BlobMeasurementLibNull.c                  | 34 ++++++++
> > >  .../BlobMeasurementLibNull.inf                | 24 +++++
> > >  OvmfPkg/Microvm/MicrovmX64.dsc                |  1 +
> > >  OvmfPkg/OvmfPkg.dec                           |  3 +
> > >  OvmfPkg/OvmfPkgIa32.dsc                       |  1 +
> > >  OvmfPkg/OvmfPkgIa32X64.dsc                    |  1 +
> > >  OvmfPkg/OvmfPkgX64.dsc                        |  1 +
> > >  OvmfPkg/OvmfXen.dsc                           |  1 +
> > >  .../QemuKernelLoaderFsDxe.c                   | 13 +++
> > >  17 files changed, 240 insertions(+)
> > >  create mode 100644 OvmfPkg/Include/Library/BlobMeasurementLib.h
> > >  create mode 100644
> > > OvmfPkg/IntelTdx/BlobMeasurementLibTdx/BlobMeasurement.c
> > >  create mode 100644
> > > OvmfPkg/IntelTdx/BlobMeasurementLibTdx/BlobMeasurementLibTdx.inf
> > >  create mode 100644
> > > OvmfPkg/Library/BlobMeasurementLibNull/BlobMeasurementLibNull.c
> > >  create mode 100644
> > > OvmfPkg/Library/BlobMeasurementLibNull/BlobMeasurementLibNull.inf
> > >
> > > --
> > > 2.29.2.windows.2
> >
> >
> >
> > 
> >
>