tyler.durden/audk
1
0
Fork 0
mirror of https://github.com/acidanthera/audk.git synced 2025-04-08 17:05:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

OvmfPkg/PlatformPei: DENY_EXECUTE_ON_SECURITY_VIOLATION when SEV is active

Browse Source 
The following commit:

1fea9ddb4e3f OvmfPkg: execute option ROM images regardless of Secure Boot

sets the OptionRomImageVerificationPolicy to ALWAYS_EXECUTE the expansion
ROMs attached to the emulated PCI devices. A expansion ROM constitute
another channel through which a cloud provider (i.e hypervisor) can
inject a code in guest boot flow to compromise it.

When SEV is enabled, the bios code has been verified by the guest owner
via the SEV guest launch sequence before its executed. When secure boot,
is enabled, lets make sure that we do not allow guest bios to execute a
code which is not signed by the guest owner.

Fixes: https://bugzilla.tianocore.org/show_bug.cgi?id=728
Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
This commit is contained in:
Brijesh Singh 2017-10-05 15:16:42 -05:00 committed by Laszlo Ersek
parent 071f1d19dd
commit 6041ac65ae
5 changed files with 24 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
OvmfPkg/OvmfPkgIa32.dsc
View File

@ -483,10 +483,6 @@
gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackSize|0x4000 gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackSize|0x4000
!endif !endif
!if $(SECURE_BOOT_ENABLE) == TRUE
gEfiSecurityPkgTokenSpaceGuid.PcdOptionRomImageVerificationPolicy|0x00
!endif
# IRQs 5, 9, 10, 11 are level-triggered # IRQs 5, 9, 10, 11 are level-triggered
gPcAtChipsetPkgTokenSpaceGuid.Pcd8259LegacyModeEdgeLevel|0x0E20 gPcAtChipsetPkgTokenSpaceGuid.Pcd8259LegacyModeEdgeLevel|0x0E20
@ -544,6 +540,11 @@
gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmApSyncTimeout|100000 gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmApSyncTimeout|100000
!endif !endif
!if $(SECURE_BOOT_ENABLE) == TRUE
gEfiSecurityPkgTokenSpaceGuid.PcdOptionRomImageVerificationPolicy|0x00
!endif
################################################################################ ################################################################################
# #
# Components Section - list of all EDK II Modules needed by this Platform. # Components Section - list of all EDK II Modules needed by this Platform.

9
OvmfPkg/OvmfPkgIa32X64.dsc
View File

@ -489,10 +489,6 @@
gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackSize|0x4000 gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackSize|0x4000
!endif !endif
!if $(SECURE_BOOT_ENABLE) == TRUE
gEfiSecurityPkgTokenSpaceGuid.PcdOptionRomImageVerificationPolicy|0x00
!endif
# IRQs 5, 9, 10, 11 are level-triggered # IRQs 5, 9, 10, 11 are level-triggered
gPcAtChipsetPkgTokenSpaceGuid.Pcd8259LegacyModeEdgeLevel|0x0E20 gPcAtChipsetPkgTokenSpaceGuid.Pcd8259LegacyModeEdgeLevel|0x0E20
@ -552,6 +548,11 @@
gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmApSyncTimeout|100000 gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmApSyncTimeout|100000
!endif !endif
!if $(SECURE_BOOT_ENABLE) == TRUE
gEfiSecurityPkgTokenSpaceGuid.PcdOptionRomImageVerificationPolicy|0x00
!endif
################################################################################ ################################################################################
# #
# Components Section - list of all EDK II Modules needed by this Platform. # Components Section - list of all EDK II Modules needed by this Platform.

9
OvmfPkg/OvmfPkgX64.dsc
View File

@ -488,10 +488,6 @@
gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackSize|0x4000 gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackSize|0x4000
!endif !endif
!if $(SECURE_BOOT_ENABLE) == TRUE
gEfiSecurityPkgTokenSpaceGuid.PcdOptionRomImageVerificationPolicy|0x00
!endif
# IRQs 5, 9, 10, 11 are level-triggered # IRQs 5, 9, 10, 11 are level-triggered
gPcAtChipsetPkgTokenSpaceGuid.Pcd8259LegacyModeEdgeLevel|0x0E20 gPcAtChipsetPkgTokenSpaceGuid.Pcd8259LegacyModeEdgeLevel|0x0E20
@ -551,6 +547,11 @@
gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmApSyncTimeout|100000 gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmApSyncTimeout|100000
!endif !endif
!if $(SECURE_BOOT_ENABLE) == TRUE
gEfiSecurityPkgTokenSpaceGuid.PcdOptionRomImageVerificationPolicy|0x00
!endif
################################################################################ ################################################################################
# #
# Components Section - list of all EDK II Modules needed by this Platform. # Components Section - list of all EDK II Modules needed by this Platform.

7
OvmfPkg/PlatformPei/AmdSev.c
View File

@ -59,4 +59,11 @@ AmdSevInitialize (
ASSERT_RETURN_ERROR (PcdStatus); ASSERT_RETURN_ERROR (PcdStatus);
DEBUG ((DEBUG_INFO, "SEV is enabled (mask 0x%lx)\n", EncryptionMask)); DEBUG ((DEBUG_INFO, "SEV is enabled (mask 0x%lx)\n", EncryptionMask));
//
// Set Pcd to Deny the execution of option ROM when security
// violation.
//
PcdStatus = PcdSet32S (PcdOptionRomImageVerificationPolicy, 0x4);
ASSERT_RETURN_ERROR (PcdStatus);
} }

2
OvmfPkg/PlatformPei/PlatformPei.inf
View File

@ -41,6 +41,7 @@
IntelFrameworkModulePkg/IntelFrameworkModulePkg.dec IntelFrameworkModulePkg/IntelFrameworkModulePkg.dec
MdePkg/MdePkg.dec MdePkg/MdePkg.dec
MdeModulePkg/MdeModulePkg.dec MdeModulePkg/MdeModulePkg.dec
SecurityPkg/SecurityPkg.dec
UefiCpuPkg/UefiCpuPkg.dec UefiCpuPkg/UefiCpuPkg.dec
OvmfPkg/OvmfPkg.dec OvmfPkg/OvmfPkg.dec
@ -96,6 +97,7 @@
gEfiMdeModulePkgTokenSpaceGuid.PcdPropertiesTableEnable gEfiMdeModulePkgTokenSpaceGuid.PcdPropertiesTableEnable
gEfiMdeModulePkgTokenSpaceGuid.PcdAcpiS3Enable gEfiMdeModulePkgTokenSpaceGuid.PcdAcpiS3Enable
gEfiMdeModulePkgTokenSpaceGuid.PcdPteMemoryEncryptionAddressOrMask gEfiMdeModulePkgTokenSpaceGuid.PcdPteMemoryEncryptionAddressOrMask
gEfiSecurityPkgTokenSpaceGuid.PcdOptionRomImageVerificationPolicy
gUefiCpuPkgTokenSpaceGuid.PcdCpuLocalApicBaseAddress gUefiCpuPkgTokenSpaceGuid.PcdCpuLocalApicBaseAddress
gUefiCpuPkgTokenSpaceGuid.PcdCpuMaxLogicalProcessorNumber gUefiCpuPkgTokenSpaceGuid.PcdCpuMaxLogicalProcessorNumber
gUefiCpuPkgTokenSpaceGuid.PcdCpuApInitTimeOutInMicroSeconds gUefiCpuPkgTokenSpaceGuid.PcdCpuApInitTimeOutInMicroSeconds