From: James Bottomley <j...@linux.ibm.com>
This is a wrapper library around GenericQemuLoadImageLib which
activates a verifier on the command line to check its hash against the
one passed in via the SEV hash table.
The verifier is enabled if SEV memory encryption is active.
Cc: Laszlo Ersek <ler...@redhat.com>
Cc: Ard Biesheuvel <ardb+tianoc...@kernel.org>
Cc: Jordan Justen <jordan.l.jus...@intel.com>
Cc: Ashish Kalra <ashish.ka...@amd.com>
Cc: Brijesh Singh <brijesh.si...@amd.com>
Cc: Erdem Aktas <erdemak...@google.com>
Cc: James Bottomley <j...@linux.ibm.com>
Cc: Jiewen Yao <jiewen....@intel.com>
Cc: Min Xu <min.m...@intel.com>
Cc: Tom Lendacky <thomas.lenda...@amd.com>
Signed-off-by: James Bottomley <j...@linux.ibm.com>
---
OvmfPkg/AmdSev/AmdSevX64.dsc | 4 +-
OvmfPkg/AmdSev/Library/SevQemuLoadImageLib/SevQemuLoadImageLib.inf | 30
+++++++++++
OvmfPkg/AmdSev/Library/SevQemuLoadImageLib/SevQemuLoadImageLib.c | 52
++++++++++++++++++++
3 files changed, 84 insertions(+), 2 deletions(-)
diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
index bfb16798b3b7..9db3d993dda0 100644
--- a/OvmfPkg/AmdSev/AmdSevX64.dsc
+++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
@@ -284,7 +284,6 @@ [LibraryClasses.common.PEIM]
CpuExceptionHandlerLib|UefiCpuPkg/Library/CpuExceptionHandlerLib/PeiCpuExceptionHandlerLib.inf
MpInitLib|UefiCpuPkg/Library/MpInitLib/PeiMpInitLib.inf
QemuFwCfgS3Lib|OvmfPkg/Library/QemuFwCfgS3Lib/PeiQemuFwCfgS3LibFwCfg.inf
-
QemuLoadImageLib|OvmfPkg/Library/GenericQemuLoadImageLib/GenericQemuLoadImageLib.inf
PcdLib|MdePkg/Library/PeiPcdLib/PeiPcdLib.inf
QemuFwCfgLib|OvmfPkg/Library/QemuFwCfgLib/QemuFwCfgPeiLib.inf
@@ -372,7 +371,8 @@ [LibraryClasses.common.DXE_DRIVER]
PciLib|OvmfPkg/Library/DxePciLibI440FxQ35/DxePciLibI440FxQ35.inf
MpInitLib|UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf
QemuFwCfgS3Lib|OvmfPkg/Library/QemuFwCfgS3Lib/DxeQemuFwCfgS3LibFwCfg.inf
- QemuLoadImageLib|OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.inf
+
GenericQemuLoadImageLib|OvmfPkg/Library/GenericQemuLoadImageLib/GenericQemuLoadImageLib.inf
+
QemuLoadImageLib|OvmfPkg/AmdSev/Library/SevQemuLoadImageLib/SevQemuLoadImageLib.inf
!if $(TPM_ENABLE) == TRUE
Tpm12DeviceLib|SecurityPkg/Library/Tpm12DeviceLibTcg/Tpm12DeviceLibTcg.inf
Tpm2DeviceLib|SecurityPkg/Library/Tpm2DeviceLibTcg2/Tpm2DeviceLibTcg2.inf
diff --git a/OvmfPkg/AmdSev/Library/SevQemuLoadImageLib/SevQemuLoadImageLib.inf
b/OvmfPkg/AmdSev/Library/SevQemuLoadImageLib/SevQemuLoadImageLib.inf
new file mode 100644
index 000000000000..b87031f4d15a
--- /dev/null
+++ b/OvmfPkg/AmdSev/Library/SevQemuLoadImageLib/SevQemuLoadImageLib.inf
@@ -0,0 +1,30 @@
+## @file
+# Provides the Secure Verification services for AMD SEV firmware config
+#
+# Copyright (C) 2021 James Bottomley, IBM Corporation.
+#
+# SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+##
+
+[Defines]
+ INF_VERSION = 1.27
+ BASE_NAME = SevQemuLoadImageLib
+ FILE_GUID = 7ceec418-e1e3-42fb-91c5-56abc6d3744d
+ MODULE_TYPE = BASE
+ VERSION_STRING = 1.0
+ LIBRARY_CLASS = QemuLoadImageLib|DXE_DRIVER
+ CONSTRUCTOR = SevQemuLoadImageConstructor
+
+[Sources]
+ SevQemuLoadImageLib.c
+
+[Packages]
+ MdePkg/MdePkg.dec
+ OvmfPkg/OvmfPkg.dec
+
+[LibraryClasses]
+ DebugLib
+ GenericQemuLoadImageLib
+ MemEncryptSevLib
+ SevHashFinderLib
diff --git a/OvmfPkg/AmdSev/Library/SevQemuLoadImageLib/SevQemuLoadImageLib.c
b/OvmfPkg/AmdSev/Library/SevQemuLoadImageLib/SevQemuLoadImageLib.c
new file mode 100644
index 000000000000..a44d296cea78
--- /dev/null
+++ b/OvmfPkg/AmdSev/Library/SevQemuLoadImageLib/SevQemuLoadImageLib.c
@@ -0,0 +1,52 @@
+/** @file
+ AMD SEV Firmware Config file verifier
+
+ Copyright (C) 2021 James Bottomley, IBM Corporation.
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#include <Uefi.h>
+
+#include <Library/DebugLib.h>
+#include <Library/MemEncryptSevLib.h>
+#include <Library/QemuFwCfgLib.h>
+#include <Library/SevHashFinderLib.h>
+
+STATIC EFI_STATUS
+EFIAPI
+SevCmdLineVerifier (
+ IN CONST CHAR16 *Name,
+ IN VOID *Buffer,
+ IN UINTN Size
+ )
+{
+ DEBUG ((DEBUG_INFO, "%a: Validating Hash\n", __FUNCTION__));
+
+ return ValidateHashEntry (&SEV_CMDLINE_HASH_GUID, Buffer, Size);
+}
+
+/**
+ Register security measurement handler.
+
+ @param ImageHandle ImageHandle of the loaded driver.
+ @param SystemTable Pointer to the EFI System Table.
+
+ @retval EFI_SUCCESS The handlers were registered successfully.
+**/
+EFI_STATUS
+EFIAPI
+SevQemuLoadImageConstructor (
+ VOID
+ )
+{
+ if (MemEncryptSevIsEnabled ()) {
+ DEBUG ((DEBUG_INFO, "Enabling hash verification of fw_cfg cmdline\n"));
+ return RegisterFwCfgVerifier (SevCmdLineVerifier);
+ } else {
+ //
+ // Don't install verifier if SEV isn't enabled
+ //
+ DEBUG ((DEBUG_INFO, "NOT Enabling hash verification of fw_cfg cmdline\n"));
+ return EFI_SUCCESS;
+ }
+}
--
2.25.1
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#75575): https://edk2.groups.io/g/devel/message/75575
Mute This Topic: https://groups.io/mt/83074459/21656
Group Owner: devel+ow...@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-
