On 7/6/21 3:54 AM, Dov Murik wrote: > In QemuKernelLoaderFsDxeEntrypoint we use FetchBlob to read the content > of the kernel/initrd/cmdline from the QEMU fw_cfg interface. Insert a > call to VerifyBlob after fetching to allow BlobVerifierLib > implementations to add a verification step for these blobs. > > This will allow confidential computing OVMF builds to add verification > mechanisms for these blobs that originate from an untrusted source > (QEMU). > > The null implementation of BlobVerifierLib does nothing in VerifyBlob, > and therefore no functional change is expected. > > Cc: Laszlo Ersek <ler...@redhat.com> > Cc: Ard Biesheuvel <ardb+tianoc...@kernel.org> > Cc: Jordan Justen <jordan.l.jus...@intel.com> > Cc: Ashish Kalra <ashish.ka...@amd.com> > Cc: Brijesh Singh <brijesh.si...@amd.com> > Cc: Erdem Aktas <erdemak...@google.com> > Cc: James Bottomley <j...@linux.ibm.com> > Cc: Jiewen Yao <jiewen....@intel.com> > Cc: Min Xu <min.m...@intel.com> > Cc: Tom Lendacky <thomas.lenda...@amd.com> > Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3457 > Co-developed-by: James Bottomley <j...@linux.ibm.com> > Signed-off-by: James Bottomley <j...@linux.ibm.com> > Signed-off-by: Dov Murik <dovmu...@linux.ibm.com>
The patch itself is okay. Just curious, do we also need to add a verification for the QEMU FW cfg file ? -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#77862): https://edk2.groups.io/g/devel/message/77862 Mute This Topic: https://groups.io/mt/84016359/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
