Re: [edk2-devel] measurement to command-line/initrd for loading kernel via -kernel option

["Min Xu" <min.m.xu@intel.com>]

On September 19, 2022 2:59 PM, Ard Biesheuvel wrote:
> On Mon, 19 Sept 2022 at 04:13, Xu, Min M <min.m.xu@intel.com> wrote:
> >
> > On September 18, 2022 8:52 PM, Ard Biesheuvel wrote:
> > > Hello Min Xu,
> > >
> > > On Sat, 17 Sept 2022 at 04:53, Xu, Min M <min.m.xu@intel.com> wrote:
> > > >
> > > > Hi, Ard
> > > >
> > > > I am checking the measurement behavior when loading the kernel via
> > > > the
> > > QEMU -kernel option. I find it is implemented by below 2 driver/lib:
> > > >
> > > > - OvmfPkg/QemuKernelLoaderFsDxe
> > > >
> > > >  This is a separate DXE driver that exposes the virtual
> > > > SimpleFileSystem
> > > implementation that carries the kernel and initrd passed via the
> > > QEMU command line.
> > > >
> > > > - OvmfPkg/Library/X86QemuLoadImageLib
> > > >
> > > >   This is the library that consumes above driver and call
> > > LoadImage/StartImage so that the kernel image gets authenticated
> > > and/or measured.
> > > >
> > > > See https://edk2.groups.io/g/devel/message/55381
> > > >
> > > >
> > > >
> > > > I have some questions about the implementation need your help.
> > > >
> > > > 2. Kernel image is authenticated and/or measured in LoadImage. I
> > > > am
> > > wondering if “command line” is measured as well? “Command line” can
> > > be treated as an external input and in my opinion it should be measured
> too.
> > > >
> > > > 3. The same question to initrd. Is it measured?
> > > >
> > >
> > > The initrd is measured by the EFI stub in Linux, and we are
> > > currently adding measurement of the load options to that as well:
> > > https://lore.kernel.org/all/20220916081441.1993492-2-
> > > ilias.apalodimas@linaro.org/
> > >
> > > The initrd is Linux specific in any case, so there, the Linux OS
> > > loader is a natural place to take care of this. The load options are
> > > being added because of the oversight in the TCG spec, which only
> > > covers load options if they are part of a Boot#### option, but
> > > between
> > > LoadImage() and StartImage, you can pass any load options you want
> > > via the loaded image protocol, so it needs to be measured as well.
> > >
> > Thanks Ard for the explanation.
> > I was told that in grub boot cmd-line/initrd will be measured as well. So my
> question is that will they be measured twice? One in grub.efi, the other in efi-
> stub?
> >
> 
> The EFI stub may be the only OS loader, so the EFI stub should measure the
> command line and the initrd.
> 
> Whether or not a previous loader stage exists that may or may not measure
> the same pieces is not for the EFI stub to reason about. And in any case,
> measuring the same thing twice is much less of an issue than not measuring it
> at all.
> 
> > My understanding is that the loader should take the responsibility to do the
> measurement.
> > For grub boot, grub.efi is the loader so it measures kernel-image/cmd-
> line/initrd.
> 
> If the EFI stub is invoked, the EFI stub is the OS loader. We should not be
> relying on the presence of absence of GRUB (or shim) in the boot chain.
> 
> > For direct boot, TryRunningQemuKernel() now measures kernel image (in
> CoreLoadImage). Shall it also measure cmd-line/initrd in the same time?
> >
> 
> No, I don't think it should. This is why we are adding this to the EFI stub
> instead.
> 
> If we measure the initrd and command line in the EFI stub, we don't have to
> measure it anywhere else, and we can use any generic EFI loader on a
> measured boot system.
> 
Ard, thanks for the explanation.
The reason why I am checking the measurement of cmd-line and initrd is that I am thinking how to measure cmd-line and initrd in TDVF with the EFI_CC_MEASUREMENT_PROTOCOL which is defined in MdePkg/Include/Protocol/CcMeasurement.h. Actually EFI_CC_MEASUREMENT_PROTOCOL is designed for the Confidential Computing guest to support measurement. 

I check the patch in https://lore.kernel.org/all/20220916081441.1993492-1-ilias.apalodimas@linaro.org/. It supports the EFI_TCG2_PROTOCOL. I think it can also support EFI_CC_MEASUREMENT_PROTOCOL like below:
  efi_tcg2_protocol_t *tcg2 = NULL;
  efi_cc_protocol_t *cc = NULL;
  efi_bs_call(locate_protocol, &tcg2_guild, NULL, (void**)&tcg2);
  efi_bs_call(locate_protocol, &cc_guild, NULL, (void**)&cc);
  if (tcg2) {
      do_tcg2_measurement ();
  } else if (cc) {
      cc-> MapPcrToMrIndex ();  // because there is a map between TPM-PCR index to CC-MeasureRegister Index.
      do_cc_measurement ();
  }

I am wondering when your 2 patches would be accepted and merged so that I can submit my patch based on yours.

Thanks
Min