On 7/6/21 3:55 AM, Dov Murik wrote:
> In the AmdSevX86 build, use SevHashesBlobVerifierLib to enforce
> verification of hashes of the kernel/initrd/cmdline blobs fetched from
> firmware config.
>
> This allows for secure (measured) boot of SEV guests with QEMU's
> -kernel/-initrd/-append switches (with the corresponding QEMU support
> for injecting the hashes table into initial measured guest memory).
>
> Cc: Laszlo Ersek <ler...@redhat.com>
> Cc: Ard Biesheuvel <ardb+tianoc...@kernel.org>
> Cc: Jordan Justen <jordan.l.jus...@intel.com>
> Cc: Ashish Kalra <ashish.ka...@amd.com>
> Cc: Brijesh Singh <brijesh.si...@amd.com>
> Cc: Erdem Aktas <erdemak...@google.com>
> Cc: James Bottomley <j...@linux.ibm.com>
> Cc: Jiewen Yao <jiewen....@intel.com>
> Cc: Min Xu <min.m...@intel.com>
> Cc: Tom Lendacky <thomas.lenda...@amd.com>
> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3457
> Signed-off-by: Dov Murik <dovmu...@linux.ibm.com>
Reviewed-by: Tom Lendacky <thomas.lenda...@amd.com>
> ---
> OvmfPkg/AmdSev/AmdSevX64.dsc | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
> index 8b260df114e3..d1ed0abbd0fb 100644
> --- a/OvmfPkg/AmdSev/AmdSevX64.dsc
> +++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
> @@ -173,7 +173,7 @@ [LibraryClasses]
> LockBoxLib|OvmfPkg/Library/LockBoxLib/LockBoxBaseLib.inf
>
> CustomizedDisplayLib|MdeModulePkg/Library/CustomizedDisplayLib/CustomizedDisplayLib.inf
>
> FrameBufferBltLib|MdeModulePkg/Library/FrameBufferBltLib/FrameBufferBltLib.inf
> - BlobVerifierLib|OvmfPkg/Library/BlobVerifierLib/NullBlobVerifierLib.inf
> +
> BlobVerifierLib|OvmfPkg/Library/BlobVerifierLib/SevHashesBlobVerifierLib.inf
>
> !if $(SOURCE_DEBUG_ENABLE) == TRUE
>
> PeCoffExtraActionLib|SourceLevelDebugPkg/Library/PeCoffExtraActionLibDebug/PeCoffExtraActionLibDebug.inf
> @@ -696,7 +696,7 @@ [Components]
> }
> OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.inf {
> <LibraryClasses>
> - NULL|OvmfPkg/Library/BlobVerifierLib/NullBlobVerifierLib.inf
> + NULL|OvmfPkg/Library/BlobVerifierLib/SevHashesBlobVerifierLib.inf
> }
> OvmfPkg/VirtioPciDeviceDxe/VirtioPciDeviceDxe.inf
> OvmfPkg/Virtio10Dxe/Virtio10.inf
>
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#77913): https://edk2.groups.io/g/devel/message/77913
Mute This Topic: https://groups.io/mt/84016365/21656
Group Owner: devel+ow...@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-
