tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
audk/OvmfPkg/VirtHstiDxe
History
Gerd Hoffmann 66c24219ad OvmfPkg/VirtHstiDxe: do not load driver in confidential guests 
The VirtHstiDxe does not work in confidential guests.  There also isn't
anything we can reasonably test, neither flash storage nor SMM mode will
be used in that case.  So just skip driver load when running in a
confidential guest.

Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Fixes: 506740982b ("OvmfPkg/VirtHstiDxe: add code flash check")
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Tested-by: Srikanth Aithal <sraithal@amd.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
 		2024-04-25 00:55:20 +00:00
..
Flash.c
…
QemuCommon.c OvmfPkg/VirtHstiDxe: add code flash check 2024-04-22 13:05:21 +00:00
QemuPC.c
…
QemuQ35.c
…
README.md OvmfPkg/VirtHstiDxe: add README.md 2024-04-22 13:05:21 +00:00
VirtHstiDxe.c OvmfPkg/VirtHstiDxe: do not load driver in confidential guests 2024-04-25 00:55:20 +00:00
VirtHstiDxe.h OvmfPkg/VirtHstiDxe: add code flash check 2024-04-22 13:05:21 +00:00
VirtHstiDxe.inf OvmfPkg/VirtHstiDxe: do not load driver in confidential guests 2024-04-25 00:55:20 +00:00

README.md

virtual machine platform hsti driver

This driver supports three tests.

VIRT_HSTI_BYTE0_SMM_SMRAM_LOCK

Verify the SMM memory is properly locked down.

Supported platforms:

  • Qemu Q35 (SMM_REQUIRE=TRUE builds).

VIRT_HSTI_BYTE0_SMM_SECURE_VARS_FLASH

Verify the variable store is not writable for normal (not SMM) code.

Supported platforms:

  • Qemu Q35 (SMM_REQUIRE=TRUE builds).

VIRT_HSTI_BYTE0_READONLY_CODE_FLASH

Verify the firmware code is not writable for the guest.

Supported platforms:

  • Qemu Q35
  • Qemu PC

qemu flash configuration

With qemu being configured properly flash behavior should be this:

configuration OVMF_CODE.fd OVMF_VARS.fd
SMM_REQUIRE=TRUE, SMM mode read-only writable
SMM_REQUIRE=TRUE, normal mode read-only (1) read-only (2)
SMM_REQUIRE=FALSE read-only (3) writable

VIRT_HSTI_BYTE0_READONLY_CODE_FLASH will verify (1) + (3). VIRT_HSTI_BYTE0_SMM_SECURE_VARS_FLASH will verify (2).

qemu command line for SMM_REQUIRE=TRUE builds

qemu-system-x86-64 -M q35,smm=on,pflash0=code,pflash1=vars \
  -blockdev node-name=code,driver=file,filename=OVMF_CODE.fd,read-only=on \
  -blockdev node-name=vars,driver=file,filename=OVMF_VARS.fd \
  -global driver=cfi.pflash01,property=secure,value=on \
  [ ... more options here ... ]