1. Patchew
  2. EDK2
  3. View series

[edk2-devel] [PATCH V2 0/3] Introduce TdProtocol into EDK2

Min Xu posted 3 patches 2 years, 6 months ago
Failed in applying to current master (apply log)
MdePkg/Include/Protocol/TdProtocol.h          | 305 +++++++++++++++
MdePkg/MdePkg.dec                             |   3 +
.../DxeTpm2MeasureBootLib.c                   | 346 ++++++++++++++----
.../DxeTpm2MeasureBootLib.inf                 |   1 +
.../DxeTpmMeasurementLib.c                    |  87 ++++-
.../DxeTpmMeasurementLib.inf                  |   1 +
6 files changed, 672 insertions(+), 71 deletions(-)
create mode 100644 MdePkg/Include/Protocol/TdProtocol.h
[edk2-devel] [PATCH V2 0/3] Introduce TdProtocol into EDK2
Posted by Min Xu 2 years, 6 months ago 
BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3625

If TD-Guest firmware supports measurement and an event is created,
TD-Guest firmware is designed to report the event log with the same data
structure in TCG-Platform-Firmware-Profile specification with
EFI_TCG2_EVENT_LOG_FORMAT_TCG_2 format.

The TD-Guest firmware supports measurement, the TD Guest Firmware is
designed to produce EFI_TD_PROTOCOL with new GUID EFI_TD_PROTOCOL_GUID
to report event log and provides hash capability.

https://software.intel.com/content/dam/develop/external/us/en/documents/
intel-tdx-guest-hypervisor-communication-interface-1.0-344426-002.pdf
Section 4.3.2 includes the EFI_TD_PROTOCOL.

Patch #1:
Introduce the TD Protocol definition into MdePkg

Patch #2:
Update DxeTpm2MeasureBootLib to support TD based measure boot.

Patch #3:
Update DxeTpmMeasurementLib to support TD based measurement.

Code is at https://github.com/mxu9/edk2/tree/td_protocol.v2

v2 changes:
 - TD based measure boot is implemented in DxeTpm2MeasureBootLib.
   This minimize the code changes.
 - TD based measurement is added. It is implemented in
   DxeTpmMeasurementLib.
 - Fix the typo in comments.

Cc: Michael D Kinney <michael.d.kinney@intel.com>
Cc: Liming Gao <gaoliming@byosoft.com.cn>
Cc: Zhiguang Liu <zhiguang.liu@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Ken Lu <ken.lu@intel.com>
Signed-off-by: Min Xu <min.m.xu@intel.com>

Min Xu (3):
  MdePkg: Introduce TdProtocol for TD-Guest firmware
  SecurityPkg: Support TdProtocol in DxeTpm2MeasureBootLib
  SecurityPkg: Support TdProtocol in DxeTpmMeasurementLib

 MdePkg/Include/Protocol/TdProtocol.h          | 305 +++++++++++++++
 MdePkg/MdePkg.dec                             |   3 +
 .../DxeTpm2MeasureBootLib.c                   | 346 ++++++++++++++----
 .../DxeTpm2MeasureBootLib.inf                 |   1 +
 .../DxeTpmMeasurementLib.c                    |  87 ++++-
 .../DxeTpmMeasurementLib.inf                  |   1 +
 6 files changed, 672 insertions(+), 71 deletions(-)
 create mode 100644 MdePkg/Include/Protocol/TdProtocol.h

-- 
2.29.2.windows.2



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#81649): https://edk2.groups.io/g/devel/message/81649
Mute This Topic: https://groups.io/mt/86163957/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] [PATCH V2 0/3] Introduce TdProtocol into EDK2
Posted by Sami Mujawar 2 years, 6 months ago 
Hi Min,

Thank you for this patch.

I think it would greatly help if the EFI_TD_PROTOCOL is changed to something more architecture neutral. As I understand, this patch series is removing the dependency on TPM for measurement and is instead providing a lightweight interface for extending measurements for Confidential Compute Architecture (CCA) guests.

Considering this, it would be good to generalise EFI_TD_PROTOCOL as a Confidential Compute Architecture Measurement (CCAM) protocol.
In fact, your v2 series demonstrates this need with the introduction of MEASURE_BOOT_PROTOCOLS in "[PATCH V2 2/3] SecurityPkg: Support TdProtocol in DxeTpm2MeasureBootLib [https://edk2.groups.io/g/devel/message/81651]".

As it stands, I feel most of the code can be reused/common.  Some interfaces may need to use an architecture specific library, and some configuration options would need to be defined using PCDs.

Kindly let me know your thoughts.

Regards,

Sami Mujawar

On 08/10/2021, 06:24, "devel@edk2.groups.io on behalf of Min Xu via groups.io" <devel@edk2.groups.io on behalf of min.m.xu=intel.com@groups.io> wrote:

    BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3625

    If TD-Guest firmware supports measurement and an event is created,
    TD-Guest firmware is designed to report the event log with the same data
    structure in TCG-Platform-Firmware-Profile specification with
    EFI_TCG2_EVENT_LOG_FORMAT_TCG_2 format.

    The TD-Guest firmware supports measurement, the TD Guest Firmware is
    designed to produce EFI_TD_PROTOCOL with new GUID EFI_TD_PROTOCOL_GUID
    to report event log and provides hash capability.

    https://software.intel.com/content/dam/develop/external/us/en/documents/
    intel-tdx-guest-hypervisor-communication-interface-1.0-344426-002.pdf
    Section 4.3.2 includes the EFI_TD_PROTOCOL.

    Patch #1:
    Introduce the TD Protocol definition into MdePkg

    Patch #2:
    Update DxeTpm2MeasureBootLib to support TD based measure boot.

    Patch #3:
    Update DxeTpmMeasurementLib to support TD based measurement.

    Code is at https://github.com/mxu9/edk2/tree/td_protocol.v2

    v2 changes:
     - TD based measure boot is implemented in DxeTpm2MeasureBootLib.
       This minimize the code changes.
     - TD based measurement is added. It is implemented in
       DxeTpmMeasurementLib.
     - Fix the typo in comments.

    Cc: Michael D Kinney <michael.d.kinney@intel.com>
    Cc: Liming Gao <gaoliming@byosoft.com.cn>
    Cc: Zhiguang Liu <zhiguang.liu@intel.com>
    Cc: Jiewen Yao <jiewen.yao@intel.com>
    Cc: Jian J Wang <jian.j.wang@intel.com>
    Cc: Ken Lu <ken.lu@intel.com>
    Signed-off-by: Min Xu <min.m.xu@intel.com>

    Min Xu (3):
      MdePkg: Introduce TdProtocol for TD-Guest firmware
      SecurityPkg: Support TdProtocol in DxeTpm2MeasureBootLib
      SecurityPkg: Support TdProtocol in DxeTpmMeasurementLib

     MdePkg/Include/Protocol/TdProtocol.h          | 305 +++++++++++++++
     MdePkg/MdePkg.dec                             |   3 +
     .../DxeTpm2MeasureBootLib.c                   | 346 ++++++++++++++----
     .../DxeTpm2MeasureBootLib.inf                 |   1 +
     .../DxeTpmMeasurementLib.c                    |  87 ++++-
     .../DxeTpmMeasurementLib.inf                  |   1 +
     6 files changed, 672 insertions(+), 71 deletions(-)
     create mode 100644 MdePkg/Include/Protocol/TdProtocol.h

    -- 
    2.29.2.windows.2



    





-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#81832): https://edk2.groups.io/g/devel/message/81832
Mute This Topic: https://groups.io/mt/86163957/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] [PATCH V2 0/3] Introduce TdProtocol into EDK2
Posted by Min Xu 2 years, 6 months ago 
On October 12, 2021 11:27 PM, Sami Mujawar wrote:
> Hi Min,
> 
> Thank you for this patch.
> 
> I think it would greatly help if the EFI_TD_PROTOCOL is changed to something
> more architecture neutral. As I understand, this patch series is removing the
> dependency on TPM for measurement and is instead providing a lightweight
> interface for extending measurements for Confidential Compute Architecture
> (CCA) guests.
> 
> Considering this, it would be good to generalise EFI_TD_PROTOCOL as a
> Confidential Compute Architecture Measurement (CCAM) protocol.
> In fact, your v2 series demonstrates this need with the introduction of
> MEASURE_BOOT_PROTOCOLS in "[PATCH V2 2/3] SecurityPkg: Support
> TdProtocol in DxeTpm2MeasureBootLib
> [https://edk2.groups.io/g/devel/message/81651]".
> 
> As it stands, I feel most of the code can be reused/common.  Some interfaces
> may need to use an architecture specific library, and some configuration
> options would need to be defined using PCDs.
> 
> Kindly let me know your thoughts.
> 
Thanks for your comments.  Let me first discuss your feedback with our architecture. We will reply to your proposal a bit later.

Thanks.
Min


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#81945): https://edk2.groups.io/g/devel/message/81945
Mute This Topic: https://groups.io/mt/86163957/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] [PATCH V2 0/3] Introduce TdProtocol into EDK2
Posted by Yao, Jiewen 2 years, 6 months ago 
Hi Sami
I am not sure if I can understand your comment - 
"Some interfaces may need to use an architecture specific library, and some configuration options would need to be defined using PCDs."

Would you please be more specific?

Thank you
Yao Jiewen


> -----Original Message-----
> From: Xu, Min M <min.m.xu@intel.com>
> Sent: Thursday, October 14, 2021 1:41 PM
> To: Sami Mujawar <Sami.Mujawar@arm.com>; devel@edk2.groups.io; Yao,
> Jiewen <jiewen.yao@intel.com>
> Cc: Kinney, Michael D <michael.d.kinney@intel.com>; Liming Gao
> <gaoliming@byosoft.com.cn>; Liu, Zhiguang <zhiguang.liu@intel.com>; Wang,
> Jian J <jian.j.wang@intel.com>; Lu, Ken <ken.lu@intel.com>; nd <nd@arm.com>
> Subject: RE: [edk2-devel] [PATCH V2 0/3] Introduce TdProtocol into EDK2
> 
> On October 12, 2021 11:27 PM, Sami Mujawar wrote:
> > Hi Min,
> >
> > Thank you for this patch.
> >
> > I think it would greatly help if the EFI_TD_PROTOCOL is changed to something
> > more architecture neutral. As I understand, this patch series is removing the
> > dependency on TPM for measurement and is instead providing a lightweight
> > interface for extending measurements for Confidential Compute Architecture
> > (CCA) guests.
> >
> > Considering this, it would be good to generalise EFI_TD_PROTOCOL as a
> > Confidential Compute Architecture Measurement (CCAM) protocol.
> > In fact, your v2 series demonstrates this need with the introduction of
> > MEASURE_BOOT_PROTOCOLS in "[PATCH V2 2/3] SecurityPkg: Support
> > TdProtocol in DxeTpm2MeasureBootLib
> > [https://edk2.groups.io/g/devel/message/81651]".
> >
> > As it stands, I feel most of the code can be reused/common.  Some interfaces
> > may need to use an architecture specific library, and some configuration
> > options would need to be defined using PCDs.
> >
> > Kindly let me know your thoughts.
> >
> Thanks for your comments.  Let me first discuss your feedback with our
> architecture. We will reply to your proposal a bit later.
> 
> Thanks.
> Min


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#82028): https://edk2.groups.io/g/devel/message/82028
Mute This Topic: https://groups.io/mt/86163957/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-

Patchew 2.1-devel-0870f84

© 2016 - 2024 Red Hat, Inc.