On 19/07/2021 18:57, Tom Lendacky wrote:
> On 7/6/21 3:54 AM, Dov Murik wrote:
>> In QemuKernelLoaderFsDxeEntrypoint we use FetchBlob to read the content
>> of the kernel/initrd/cmdline from the QEMU fw_cfg interface. Insert a
>> call to VerifyBlob after fetching to allow BlobVerifierLib
>> implementations to add a verification step for these blobs.
>>
>> This will allow confidential computing OVMF builds to add verification
>> mechanisms for these blobs that originate from an untrusted source
>> (QEMU).
>>
>> The null implementation of BlobVerifierLib does nothing in VerifyBlob,
>> and therefore no functional change is expected.
>>
>> Cc: Laszlo Ersek <ler...@redhat.com>
>> Cc: Ard Biesheuvel <ardb+tianoc...@kernel.org>
>> Cc: Jordan Justen <jordan.l.jus...@intel.com>
>> Cc: Ashish Kalra <ashish.ka...@amd.com>
>> Cc: Brijesh Singh <brijesh.si...@amd.com>
>> Cc: Erdem Aktas <erdemak...@google.com>
>> Cc: James Bottomley <j...@linux.ibm.com>
>> Cc: Jiewen Yao <jiewen....@intel.com>
>> Cc: Min Xu <min.m...@intel.com>
>> Cc: Tom Lendacky <thomas.lenda...@amd.com>
>> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3457
>> Co-developed-by: James Bottomley <j...@linux.ibm.com>
>> Signed-off-by: James Bottomley <j...@linux.ibm.com>
>> Signed-off-by: Dov Murik <dovmu...@linux.ibm.com>
>> ---
>> OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c | 9 +++++++++
>> 1 file changed, 9 insertions(+)
>>
>> diff --git a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c
>> b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c
>> index c7ddd86f5c75..b43330d23b80 100644
>> --- a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c
>> +++ b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c
>> @@ -17,6 +17,7 @@
>> #include <Guid/QemuKernelLoaderFsMedia.h>
>> #include <Library/BaseLib.h>
>> #include <Library/BaseMemoryLib.h>
>> +#include <Library/BlobVerifierLib.h>
>> #include <Library/DebugLib.h>
>> #include <Library/DevicePathLib.h>
>> #include <Library/MemoryAllocationLib.h>
>> @@ -1039,6 +1040,14 @@ QemuKernelLoaderFsDxeEntrypoint (
>> if (EFI_ERROR (Status)) {
>> goto FreeBlobs;
>> }
>> + Status = VerifyBlob (
>> + CurrentBlob->Name,
>> + CurrentBlob->Data,
>> + CurrentBlob->Size
>> + );
>
> Just a nit, but the ");" should be under the "C" in CurrentBlob.
It's a sad winking face... I'll fix.
Thanks,
-Dov
>
> Thanks,
> Tom
>
>> + if (EFI_ERROR (Status)) {
>> + goto FreeBlobs;
>> + }
>> mTotalBlobBytes += CurrentBlob->Size;
>> }
>> KernelBlob = &mKernelBlob[KernelBlobTypeKernel];
>>
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#77918): https://edk2.groups.io/g/devel/message/77918
Mute This Topic: https://groups.io/mt/84016359/21656
Group Owner: devel+ow...@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-
