tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

OvmfPkg/AcpiPlatformDxe: Measure ACPI table from QEMU in TDVF 

https://bugzilla.tianocore.org/show_bug.cgi?id=4245

QEMU provides the following three files for guest to install the ACPI
tables:
 - etc/acpi/rsdp
 - etc/acpi/tables
 - etc/table-loader

"etc/acpi/rsdp" and "etc/acpi/tables" are similar, they are only kept
separate because they have different allocation requirements in SeaBIOS.

Both of these fw_cfg files contain preformatted ACPI payload.
"etc/acpi/rsdp" contains only the RSDP table, while "etc/acpi/tables"
contains all other tables, concatenated. To be noted, the tables in these
two files have been filled in by qemu, but two kinds of fields are
incomplete: pointers to other tables and checksums (which depend on the
pointers).

"/etc/table-loader" is a linker/loader which provides the commands to
"patch" the tables in "etc/acpi/tables" and then install them. "Patch"
means to fill the pointers and compute the checksum.

From the security perspective these 3 files are the raw data downloaded
from qemu. They should be measured and extended before they're consumed.

Cc: Erdem Aktas <erdemaktas@google.com>
Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Michael Roth <michael.roth@amd.com>
Signed-off-by: Min Xu <min.m.xu@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
This commit is contained in:
Min M Xu 2023-02-02 17:03:14 +08:00 committed by mergify[bot]
parent 7623b4bf6a
commit 935343cf16
2 changed files with 33 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
OvmfPkg/AcpiPlatformDxe/AcpiPlatformDxe.inf
View File

@ -46,6 +46,7 @@
UefiBootServicesTableLib
UefiDriverEntryPoint
HobLib
TpmMeasurementLib
[Protocols]
gEfiAcpiTableProtocolGuid # PROTOCOL ALWAYS_CONSUMED

32
OvmfPkg/AcpiPlatformDxe/QemuFwCfgAcpi.c
View File

@ -10,6 +10,7 @@
#include <IndustryStandard/Acpi.h> // EFI_ACPI_DESCRIPTION_HEADER
#include <IndustryStandard/QemuLoader.h> // QEMU_LOADER_FNAME_SIZE
#include <IndustryStandard/UefiTcgPlatform.h>
#include <Library/BaseLib.h> // AsciiStrCmp()
#include <Library/BaseMemoryLib.h> // CopyMem()
#include <Library/DebugLib.h> // DEBUG()
@ -18,6 +19,7 @@
#include <Library/QemuFwCfgLib.h> // QemuFwCfgFindFile()
#include <Library/QemuFwCfgS3Lib.h> // QemuFwCfgS3Enabled()
#include <Library/UefiBootServicesTableLib.h> // gBS
#include <Library/TpmMeasurementLib.h>
#include "AcpiPlatform.h"
@ -415,6 +417,21 @@ ProcessCmdAllocate (
(UINT64)Blob->Size,
(UINT64)(UINTN)Blob->Base
));
//
// Measure the data which is downloaded from QEMU.
// It has to be done before it is consumed. Because the data will
// be updated in the following operations.
//
TpmMeasureAndLogData (
1,
EV_PLATFORM_CONFIG_FLAGS,
EV_POSTCODE_INFO_ACPI_DATA,
ACPI_DATA_LEN,
(VOID *)(UINTN)Blob->Base,
Blob->Size
);
return EFI_SUCCESS;
FreeBlob:
@ -1126,6 +1143,21 @@ InstallQemuFwCfgTables (
QemuFwCfgSelectItem (FwCfgItem);
QemuFwCfgReadBytes (FwCfgSize, LoaderStart);
RestorePciDecoding (OriginalPciAttributes, OriginalPciAttributesCount);
//
// Measure the "etc/table-loader" which is downloaded from QEMU.
// It has to be done before it is consumed. Because it would be
// updated in the following operations.
//
TpmMeasureAndLogData (
1,
EV_PLATFORM_CONFIG_FLAGS,
EV_POSTCODE_INFO_ACPI_DATA,
ACPI_DATA_LEN,
(VOID *)(UINTN)LoaderStart,
FwCfgSize
);
LoaderEnd = LoaderStart + FwCfgSize / sizeof *LoaderEntry;
AllocationsRestrictedTo32Bit = NULL;