tyler.durden/audk
1
0
Fork 0
mirror of https://github.com/acidanthera/audk.git synced 2025-07-25 14:44:28 +02:00
Code Issues Packages Projects Releases Wiki Activity

OvmfPkg/X86QemuLoadImageLib: make legacy loader configurable.

Browse Source 
Add the 'opt/org.tianocore/EnableLegacyLoader' FwCfg option to
enable/disable the insecure legacy linux kernel loader.

For now this is enabled by default.  Probably the default will be
flipped to disabled at some point in the future.

Also print a warning to the screen in case the linux kernel secure
boot verification has failed.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
Gerd Hoffmann 2024-12-17 09:59:21 +01:00 committed by Ard Biesheuvel
parent 4b507b4966
commit 1549bf11cc
2 changed files with 42 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c
View File

@ -19,8 +19,10 @@
#include <Library/MemoryAllocationLib.h> #include <Library/MemoryAllocationLib.h>
#include <Library/PrintLib.h> #include <Library/PrintLib.h>
#include <Library/QemuFwCfgLib.h> #include <Library/QemuFwCfgLib.h>
#include <Library/QemuFwCfgSimpleParserLib.h>
#include <Library/QemuLoadImageLib.h> #include <Library/QemuLoadImageLib.h>
#include <Library/UefiBootServicesTableLib.h> #include <Library/UefiBootServicesTableLib.h>
#include <Library/UefiLib.h>
#include <Protocol/DevicePath.h> #include <Protocol/DevicePath.h>
#include <Protocol/LoadedImage.h> #include <Protocol/LoadedImage.h>
#include <Protocol/OvmfLoadedX86LinuxKernel.h> #include <Protocol/OvmfLoadedX86LinuxKernel.h>
@ -421,13 +423,45 @@ QemuLoadKernelImage (
// Fall through // Fall through
// //
case EFI_ACCESS_DENIED: case EFI_ACCESS_DENIED:
// //
// We are running with UEFI secure boot enabled, and the image failed to // We are running with UEFI secure boot enabled, and the image failed to
// authenticate. For compatibility reasons, we fall back to the legacy // authenticate. For compatibility reasons, we fall back to the legacy
// loader in this case. // loader in this case (unless disabled via fw_cfg).
// //
// Fall through {
// EFI_STATUS RetStatus;
BOOLEAN Enabled = TRUE;
AsciiPrint (
"OVMF: Secure boot image verification failed. Consider using the '-shim'\n"
"OVMF: command line switch for qemu (available in version 10.0 + newer).\n"
"\n"
);
RetStatus = QemuFwCfgParseBool (
"opt/org.tianocore/EnableLegacyLoader",
&Enabled
);
if (EFI_ERROR (RetStatus)) {
Enabled = TRUE;
}
if (!Enabled) {
AsciiPrint (
"OVMF: Fallback to insecure legacy linux kernel loader is disabled.\n"
"\n"
);
return EFI_ACCESS_DENIED;
} else {
AsciiPrint (
"OVMF: Using legacy linux kernel loader (insecure and deprecated).\n"
"\n"
);
//
// Fall through
//
}
}
case EFI_UNSUPPORTED: case EFI_UNSUPPORTED:
// //
// The image is not natively supported or cross-type supported. Let's try // The image is not natively supported or cross-type supported. Let's try

1
OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.inf
View File

@ -33,6 +33,7 @@
LoadLinuxLib LoadLinuxLib
PrintLib PrintLib
QemuFwCfgLib QemuFwCfgLib
QemuFwCfgSimpleParserLib
ReportStatusCodeLib ReportStatusCodeLib
UefiBootServicesTableLib UefiBootServicesTableLib