tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

OvmfPkg/PeilessStartupLib: Delete TdxValidateCfv 

TdxValidateCfv is used to validate the integrity of FlashNvVarStore
(PcdOvmfFlashNvStorageVariableBase) and it is not Tdx specific.
So it will be moved to PlatformInitLib and be renamed to
PlatformValidateNvVarStore in the following patch. And it will be called
before EmuVaribleNvStore is initialized with the content in
FlashNvVarStore.

Cc: Erdem Aktas <erdemaktas@google.com>
Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Min Xu <min.m.xu@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
This commit is contained in:
Min M Xu 2022-06-29 10:30:02 +08:00 committed by mergify[bot]
parent fb008dbe01
commit 0e72e8762a
3 changed files with 0 additions and 178 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

153
OvmfPkg/Library/PeilessStartupLib/IntelTdx.c
View File

@ -7,8 +7,6 @@
#include <Library/BaseLib.h>
#include <Library/BaseMemoryLib.h>
#include <Library/DebugLib.h>
#include <Guid/VariableFormat.h>
#include <Guid/SystemNvDataGuid.h>
#include <IndustryStandard/Tpm20.h>
#include <IndustryStandard/UefiTcgPlatform.h>
#include <Library/HobLib.h>
@ -37,157 +35,6 @@ typedef struct {
#pragma pack()
/**
Check padding data all bit should be 1.
@param[in] Buffer - A pointer to buffer header
@param[in] BufferSize - Buffer size
@retval TRUE - The padding data is valid.
@retval TRUE - The padding data is invalid.
**/
BOOLEAN
CheckPaddingData (
IN UINT8 *Buffer,
IN UINT32 BufferSize
)
{
UINT32 index;
for (index = 0; index < BufferSize; index++) {
if (Buffer[index] != 0xFF) {
return FALSE;
}
}
return TRUE;
}
/**
Check the integrity of CFV data.
@param[in] TdxCfvBase - A pointer to CFV header
@param[in] TdxCfvSize - CFV data size
@retval TRUE - The CFV data is valid.
@retval FALSE - The CFV data is invalid.
**/
BOOLEAN
EFIAPI
TdxValidateCfv (
IN UINT8 *TdxCfvBase,
IN UINT32 TdxCfvSize
)
{
UINT16 Checksum;
UINTN VariableBase;
UINT32 VariableOffset;
UINT32 VariableOffsetBeforeAlign;
EFI_FIRMWARE_VOLUME_HEADER *CfvFvHeader;
VARIABLE_STORE_HEADER *CfvVariableStoreHeader;
AUTHENTICATED_VARIABLE_HEADER *VariableHeader;
static EFI_GUID FvHdrGUID = EFI_SYSTEM_NV_DATA_FV_GUID;
static EFI_GUID VarStoreHdrGUID = EFI_AUTHENTICATED_VARIABLE_GUID;
VariableOffset = 0;
if (TdxCfvBase == NULL) {
DEBUG ((DEBUG_ERROR, "TDX CFV: CFV pointer is NULL\n"));
return FALSE;
}
//
// Verify the header zerovetor, filesystemguid,
// revision, signature, attributes, fvlength, checksum
// HeaderLength cannot be an odd number
//
CfvFvHeader = (EFI_FIRMWARE_VOLUME_HEADER *)TdxCfvBase;
if ((!IsZeroBuffer (CfvFvHeader->ZeroVector, 16)) ||
(!CompareGuid (&FvHdrGUID, &CfvFvHeader->FileSystemGuid)) ||
(CfvFvHeader->Signature != EFI_FVH_SIGNATURE) ||
(CfvFvHeader->Attributes != 0x4feff) ||
(CfvFvHeader->Revision != EFI_FVH_REVISION) ||
(CfvFvHeader->FvLength != TdxCfvSize)
)
{
DEBUG ((DEBUG_ERROR, "TDX CFV: Basic FV headers were invalid\n"));
return FALSE;
}
//
// Verify the header checksum
//
Checksum = CalculateSum16 ((VOID *)CfvFvHeader, CfvFvHeader->HeaderLength);
if (Checksum != 0) {
DEBUG ((DEBUG_ERROR, "TDX CFV: FV checksum was invalid\n"));
return FALSE;
}
//
// Verify the header signature, size, format, state
//
CfvVariableStoreHeader = (VARIABLE_STORE_HEADER *)(TdxCfvBase + CfvFvHeader->HeaderLength);
if ((!CompareGuid (&VarStoreHdrGUID, &CfvVariableStoreHeader->Signature)) ||
(CfvVariableStoreHeader->Format != VARIABLE_STORE_FORMATTED) ||
(CfvVariableStoreHeader->State != VARIABLE_STORE_HEALTHY) ||
(CfvVariableStoreHeader->Size > (CfvFvHeader->FvLength - CfvFvHeader->HeaderLength)) ||
(CfvVariableStoreHeader->Size < sizeof (VARIABLE_STORE_HEADER))
)
{
DEBUG ((DEBUG_ERROR, "TDX CFV: Variable Store header was invalid\n"));
return FALSE;
}
//
// Verify the header startId, state
// Verify data to the end
//
VariableBase = (UINTN)TdxCfvBase + CfvFvHeader->HeaderLength + sizeof (VARIABLE_STORE_HEADER);
while (VariableOffset < (CfvVariableStoreHeader->Size - sizeof (VARIABLE_STORE_HEADER))) {
VariableHeader = (AUTHENTICATED_VARIABLE_HEADER *)(VariableBase + VariableOffset);
if (VariableHeader->StartId != VARIABLE_DATA) {
if (!CheckPaddingData ((UINT8 *)VariableHeader, CfvVariableStoreHeader->Size - sizeof (VARIABLE_STORE_HEADER) - VariableOffset)) {
DEBUG ((DEBUG_ERROR, "TDX CFV: Variable header was invalid\n"));
return FALSE;
}
VariableOffset = CfvVariableStoreHeader->Size - sizeof (VARIABLE_STORE_HEADER);
} else {
if (!((VariableHeader->State == VAR_IN_DELETED_TRANSITION) ||
(VariableHeader->State == VAR_DELETED) ||
(VariableHeader->State == VAR_HEADER_VALID_ONLY) ||
(VariableHeader->State == VAR_ADDED)))
{
DEBUG ((DEBUG_ERROR, "TDX CFV: Variable header was invalid\n"));
return FALSE;
}
VariableOffset += sizeof (AUTHENTICATED_VARIABLE_HEADER) + VariableHeader->NameSize + VariableHeader->DataSize;
// Verify VariableOffset should be less than or equal CfvVariableStoreHeader->Size - sizeof(VARIABLE_STORE_HEADER)
if (VariableOffset > (CfvVariableStoreHeader->Size - sizeof (VARIABLE_STORE_HEADER))) {
DEBUG ((DEBUG_ERROR, "TDX CFV: Variable header was invalid\n"));
return FALSE;
}
VariableOffsetBeforeAlign = VariableOffset;
// 4 byte align
VariableOffset = (VariableOffset + 3) & (UINTN)(~3);
if (!CheckPaddingData ((UINT8 *)(VariableBase + VariableOffsetBeforeAlign), VariableOffset - VariableOffsetBeforeAlign)) {
DEBUG ((DEBUG_ERROR, "TDX CFV: Variable header was invalid\n"));
return FALSE;
}
}
}
return TRUE;
}
/**
Measure the Hoblist passed from the VMM.

8
OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c
View File

@ -179,14 +179,6 @@ PeilessStartup (
CpuDeadLoop ();
}
//
// Validate Tdx CFV
//
if (!TdxValidateCfv (CfvBase, FixedPcdGet32 (PcdCfvRawDataSize))) {
ASSERT (FALSE);
CpuDeadLoop ();
}
//
// Measure Tdx CFV
//

17
OvmfPkg/Library/PeilessStartupLib/PeilessStartupInternal.h
View File

@ -52,23 +52,6 @@ EFIAPI
ConstructSecHobList (
);
/**
Check the integrity of CFV data.
@param[in] TdxCfvBase - A pointer to CFV header
@param[in] TdxCfvSize - CFV data size
@retval TRUE - The CFV data is valid.
@retval FALSE - The CFV data is invalid.
**/
BOOLEAN
EFIAPI
TdxValidateCfv (
IN UINT8 *TdxCfvBase,
IN UINT32 TdxCfvSize
);
/**
Measure the Hoblist passed from the VMM.