tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
audk/OvmfPkg/PlatformPei
History
Brijesh Singh 6041ac65ae OvmfPkg/PlatformPei: DENY_EXECUTE_ON_SECURITY_VIOLATION when SEV is active 
The following commit:

1fea9ddb4e OvmfPkg: execute option ROM images regardless of Secure Boot

sets the OptionRomImageVerificationPolicy to ALWAYS_EXECUTE the expansion
ROMs attached to the emulated PCI devices. A expansion ROM constitute
another channel through which a cloud provider (i.e hypervisor) can
inject a code in guest boot flow to compromise it.

When SEV is enabled, the bios code has been verified by the guest owner
via the SEV guest launch sequence before its executed. When secure boot,
is enabled, lets make sure that we do not allow guest bios to execute a
code which is not signed by the guest owner.

Fixes: https://bugzilla.tianocore.org/show_bug.cgi?id=728
Cc: Chao Zhang <chao.b.zhang@intel.com>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Laszlo Ersek <lersek@redhat.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
 		2017-10-17 21:28:27 +02:00
..
AmdSev.c OvmfPkg/PlatformPei: DENY_EXECUTE_ON_SECURITY_VIOLATION when SEV is active 2017-10-17 21:28:27 +02:00
Cmos.c
…
Cmos.h
…
FeatureControl.c OvmfPkg/PlatformPei: program MSR_IA32_FEATURE_CONTROL from fw_cfg 2016-07-15 07:38:56 +02:00
Fv.c OvmfPkg: decompress FVs on S3 resume if SMM_REQUIRE is set 2015-11-30 18:41:24 +00:00
MemDetect.c OvmfPkg/PlatformPei: support >=1TB high RAM, and discontiguous high RAM 2017-08-05 03:45:09 +02:00
Platform.c OvmfPkg/PlatformPei: log informative message at DEBUG_INFO level 2017-09-11 22:39:31 +02:00
Platform.h OvmfPkg/PlatformPei: Set memory encryption PCD when SEV is enabled 2017-07-10 21:17:27 -07:00
PlatformPei.inf OvmfPkg/PlatformPei: DENY_EXECUTE_ON_SECURITY_VIOLATION when SEV is active 2017-10-17 21:28:27 +02:00
Xen.c OvmfPkg/PlatformPei: eliminate unchecked PcdSetXX() calls 2016-10-25 10:46:22 +02:00
Xen.h OvmfPkg: define EFI_XEN_OVMF_INFO 2013-12-08 01:35:52 +00:00