Re: [PATCH V3 1/1] UefiCpuPkg: Extend measurement of microcode patches to TPM

["Longlong Yang" <longlong.yang@intel.com>]

Hi Ray,

The order is required by the hash function.
By measuring an object, we first need to get the hash or the digest of that object, and then extend the hash/digest or measurement to TPM device. If there are more than one microcode patches applied to CPU, we need to measure all of those patches. My design on measuring multiple microcode patches is that we first pack those patches into a single binary blob, and then measure the binary blob by calling TpmMeasureAndLogData function. In TpmMeasureAndLogData function, the hash of binary blob will be calculated. If the order got changed, then the hash will change too, and then the attestation will be impacted. Therefore we need make sure if microcode didn't get updated, then the hash/digest should the same every time we measure them. So we should sort the patches to make sure the binary blob is device specific same. 

BRs
Longlong

-----Original Message-----
From: Ni, Ray <ray.ni@intel.com> 
Sent: Tuesday, December 14, 2021 9:57 AM
To: Yang, Longlong <longlong.yang@intel.com>; devel@edk2.groups.io
Cc: Dong, Eric <eric.dong@intel.com>; Kumar, Rahul1 <rahul1.kumar@intel.com>; Yao, Jiewen <jiewen.yao@intel.com>; Xu, Min M <min.m.xu@intel.com>; Zhang, Qi1 <qi1.zhang@intel.com>
Subject: RE: [PATCH V3 1/1] UefiCpuPkg: Extend measurement of microcode patches to TPM

> +
> +  //
> +  // The order matters when packing all applied microcode patches to a single binary blob.
> +  // Therefore it is a must to do sorting before packing.
> +  // NOTE: We assumed that the order of address of every microcode 
> + patch in RAM is the same  // with the order of those in the 
> + Microcode Firmware Volume in FLASH. If any future updates  // made this assumption untenable, then needs a new solution to measure microcode patches.
> +  //

Can you explain the above comments?
If you only measure the microcode which will be applied to CPU, why do you care about the order?