Re: [edk2-devel] [PATCH 0/4] Measure kernel blob

["Yao, Jiewen" <jiewen.yao@intel.com>]

Fix Typo for 3:
->BlobMeasurementLib->TpmMeasurementLib->TpmMeasurementLibTdx
Should be: ->BlobMeasurementLib->TpmMeasurementLib->CcProtocol->Tdx

> -----Original Message-----
> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Yao, Jiewen
> Sent: Monday, May 23, 2022 5:30 PM
> To: Xu, Min M <min.m.xu@intel.com>; devel@edk2.groups.io
> Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>; Justen, Jordan L
> <jordan.l.justen@intel.com>; Ashish Kalra <ashish.kalra@amd.com>; Brijesh
> Singh <brijesh.singh@amd.com>; Aktas, Erdem <erdemaktas@google.com>;
> James Bottomley <jejb@linux.ibm.com>; Tom Lendacky
> <thomas.lendacky@amd.com>; Sami Mujawar <sami.mujawar@arm.com>;
> Gerd Hoffmann <kraxel@redhat.com>
> Subject: Re: [edk2-devel] [PATCH 0/4] Measure kernel blob
> 
> Hi
> I am not clear about the design. Some questions:
> 
> 1. This should be generic feature for trusted boot. Not TDX specific. Right?
> 
> 2. Why we need BlobMeasurementLib?
> We already have TpmMeasurementLib. Why we cannot use it?
> 
> 3. Why we need BlobMeasurementLibTdx?
> Even if we really need BlobMeasurementLib, the flow should be: -
> >BlobMeasurementLib->TpmMeasurementLib->TpmMeasurementLibTdx
> 
> 4. Why we need BlobMeasurementLibNull?
> We already have TpmMeasurementLibNull. What is benefit to add one more
> NULL MeasurementLib?
> 
> Thank you
> Yao Jiewen
> 
> > -----Original Message-----
> > From: Xu, Min M <min.m.xu@intel.com>
> > Sent: Monday, May 23, 2022 1:56 PM
> > To: devel@edk2.groups.io
> > Cc: Xu, Min M <min.m.xu@intel.com>; Ard Biesheuvel
> > <ardb+tianocore@kernel.org>; Justen, Jordan L <jordan.l.justen@intel.com>;
> > Ashish Kalra <ashish.kalra@amd.com>; Brijesh Singh
> <brijesh.singh@amd.com>;
> > Aktas, Erdem <erdemaktas@google.com>; James Bottomley
> > <jejb@linux.ibm.com>; Yao, Jiewen <jiewen.yao@intel.com>; Tom Lendacky
> > <thomas.lendacky@amd.com>; Sami Mujawar <sami.mujawar@arm.com>;
> > Gerd Hoffmann <kraxel@redhat.com>
> > Subject: [PATCH 0/4] Measure kernel blob
> >
> > Kernel blobs include the kernel image, initrd, command line. These are
> > external inputs from host VMM. In some platforms,such as Tdx environment,
> > Host VMM is treated as un-trusted. So these external inputs should be
> > measured.
> >
> > This patch-set imports a new library class (BlobMeasurementLib). It is
> > designed to do the blob measurement, including the kernel blob
> > measurement. In the future, it will do other blob measurement, such as
> > measuring ACPI table which is also passed from host VMM.
> >
> > The code is at: https://github.com/mxu9/edk2/tree/MeasureKernelBlob.v1
> >
> > Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
> > Cc: Jordan Justen <jordan.l.justen@intel.com>
> > Cc: Ashish Kalra <ashish.kalra@amd.com>
> > Cc: Brijesh Singh <brijesh.singh@amd.com>
> > Cc: Erdem Aktas <erdemaktas@google.com>
> > Cc: James Bottomley <jejb@linux.ibm.com>
> > Cc: Jiewen Yao <jiewen.yao@intel.com>
> > Cc: Tom Lendacky <thomas.lendacky@amd.com>
> > Cc: Sami Mujawar <sami.mujawar@arm.com>
> > Cc: Gerd Hoffmann <kraxel@redhat.com>
> > Signed-off-by: Min Xu <min.m.xu@intel.com>
> >
> > Min Xu (4):
> >   OvmfPkg: Add library class BlobMeasurementLib with null implementation
> >   OvmfPkg: Add BlobMeasurementLibNull to dsc
> >   OvmfPkg: Implement BlobMeasurementLibTdx
> >   OvmfPkg: Call MeasureKernelBlob after fetch from fw_cfg
> >
> >  ArmVirtPkg/ArmVirtQemu.dsc                    |  1 +
> >  ArmVirtPkg/ArmVirtQemuKernel.dsc              |  1 +
> >  OvmfPkg/AmdSev/AmdSevX64.dsc                  |  2 +
> >  OvmfPkg/CloudHv/CloudHvX64.dsc                |  1 +
> >  OvmfPkg/Include/Library/BlobMeasurementLib.h  | 38 ++++++++
> >  .../BlobMeasurementLibTdx/BlobMeasurement.c   | 87
> +++++++++++++++++++
> >  .../BlobMeasurementLibTdx.inf                 | 30 +++++++
> >  OvmfPkg/IntelTdx/IntelTdxX64.dsc              |  1 +
> >  .../BlobMeasurementLibNull.c                  | 34 ++++++++
> >  .../BlobMeasurementLibNull.inf                | 24 +++++
> >  OvmfPkg/Microvm/MicrovmX64.dsc                |  1 +
> >  OvmfPkg/OvmfPkg.dec                           |  3 +
> >  OvmfPkg/OvmfPkgIa32.dsc                       |  1 +
> >  OvmfPkg/OvmfPkgIa32X64.dsc                    |  1 +
> >  OvmfPkg/OvmfPkgX64.dsc                        |  1 +
> >  OvmfPkg/OvmfXen.dsc                           |  1 +
> >  .../QemuKernelLoaderFsDxe.c                   | 13 +++
> >  17 files changed, 240 insertions(+)
> >  create mode 100644 OvmfPkg/Include/Library/BlobMeasurementLib.h
> >  create mode 100644
> > OvmfPkg/IntelTdx/BlobMeasurementLibTdx/BlobMeasurement.c
> >  create mode 100644
> > OvmfPkg/IntelTdx/BlobMeasurementLibTdx/BlobMeasurementLibTdx.inf
> >  create mode 100644
> > OvmfPkg/Library/BlobMeasurementLibNull/BlobMeasurementLibNull.c
> >  create mode 100644
> > OvmfPkg/Library/BlobMeasurementLibNull/BlobMeasurementLibNull.inf
> >
> > --
> > 2.29.2.windows.2
> 
> 
> 
> 
>