mirror of https://github.com/acidanthera/audk.git
OvmfPkg/QemuKernelLoaderFsDxe: call VerifyBlob after fetch from fw_cfg
In QemuKernelLoaderFsDxeEntrypoint we use FetchBlob to read the content of the kernel/initrd/cmdline from the QEMU fw_cfg interface. Insert a call to VerifyBlob after fetching to allow BlobVerifierLib implementations to add a verification step for these blobs. This will allow confidential computing OVMF builds to add verification mechanisms for these blobs that originate from an untrusted source (QEMU). The null implementation of BlobVerifierLib does nothing in VerifyBlob, and therefore no functional change is expected. Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Ashish Kalra <ashish.kalra@amd.com> Cc: Brijesh Singh <brijesh.singh@amd.com> Cc: Erdem Aktas <erdemaktas@google.com> Cc: James Bottomley <jejb@linux.ibm.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Min Xu <min.m.xu@intel.com> Cc: Tom Lendacky <thomas.lendacky@amd.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3457 Co-developed-by: James Bottomley <jejb@linux.ibm.com> Signed-off-by: James Bottomley <jejb@linux.ibm.com> Signed-off-by: Dov Murik <dovmurik@linux.ibm.com> Reviewed-by: Brijesh Singh <brijesh.singh@amd.com> Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
This commit is contained in:
parent
6bf5580a3d
commit
d10ad8444f
|
@ -17,6 +17,7 @@
|
|||
#include <Guid/QemuKernelLoaderFsMedia.h>
|
||||
#include <Library/BaseLib.h>
|
||||
#include <Library/BaseMemoryLib.h>
|
||||
#include <Library/BlobVerifierLib.h>
|
||||
#include <Library/DebugLib.h>
|
||||
#include <Library/DevicePathLib.h>
|
||||
#include <Library/MemoryAllocationLib.h>
|
||||
|
@ -1039,6 +1040,14 @@ QemuKernelLoaderFsDxeEntrypoint (
|
|||
if (EFI_ERROR (Status)) {
|
||||
goto FreeBlobs;
|
||||
}
|
||||
Status = VerifyBlob (
|
||||
CurrentBlob->Name,
|
||||
CurrentBlob->Data,
|
||||
CurrentBlob->Size
|
||||
);
|
||||
if (EFI_ERROR (Status)) {
|
||||
goto FreeBlobs;
|
||||
}
|
||||
mTotalBlobBytes += CurrentBlob->Size;
|
||||
}
|
||||
KernelBlob = &mKernelBlob[KernelBlobTypeKernel];
|
||||
|
|
Loading…
Reference in New Issue