Brijesh Singh 6041ac65ae OvmfPkg/PlatformPei: DENY_EXECUTE_ON_SECURITY_VIOLATION when SEV is active ... The following commit: 1fea9ddb4e OvmfPkg: execute option ROM images regardless of Secure Boot sets the OptionRomImageVerificationPolicy to ALWAYS_EXECUTE the expansion ROMs attached to the emulated PCI devices. A expansion ROM constitute another channel through which a cloud provider (i.e hypervisor) can inject a code in guest boot flow to compromise it. When SEV is enabled, the bios code has been verified by the guest owner via the SEV guest launch sequence before its executed. When secure boot, is enabled, lets make sure that we do not allow guest bios to execute a code which is not signed by the guest owner. Fixes: https://bugzilla.tianocore.org/show_bug.cgi?id=728 Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Tom Lendacky <thomas.lendacky@amd.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Brijesh Singh <brijesh.singh@amd.com> Reviewed-by: Laszlo Ersek <lersek@redhat.com>		2017-10-17 21:28:27 +02:00
..
AmdSev.c	OvmfPkg/PlatformPei: DENY_EXECUTE_ON_SECURITY_VIOLATION when SEV is active	2017-10-17 21:28:27 +02:00
Cmos.c	Update the copyright notice format	2010-04-28 12:43:04 +00:00
Cmos.h	Update the copyright notice format	2010-04-28 12:43:04 +00:00
FeatureControl.c	OvmfPkg/PlatformPei: program MSR_IA32_FEATURE_CONTROL from fw_cfg	2016-07-15 07:38:56 +02:00
Fv.c	OvmfPkg: decompress FVs on S3 resume if SMM_REQUIRE is set	2015-11-30 18:41:24 +00:00
MemDetect.c	OvmfPkg/PlatformPei: support >=1TB high RAM, and discontiguous high RAM	2017-08-05 03:45:09 +02:00
Platform.c	OvmfPkg/PlatformPei: log informative message at DEBUG_INFO level	2017-09-11 22:39:31 +02:00
Platform.h	OvmfPkg/PlatformPei: Set memory encryption PCD when SEV is enabled	2017-07-10 21:17:27 -07:00
PlatformPei.inf	OvmfPkg/PlatformPei: DENY_EXECUTE_ON_SECURITY_VIOLATION when SEV is active	2017-10-17 21:28:27 +02:00
Xen.c	OvmfPkg/PlatformPei: eliminate unchecked PcdSetXX() calls	2016-10-25 10:46:22 +02:00
Xen.h	OvmfPkg: define EFI_XEN_OVMF_INFO	2013-12-08 01:35:52 +00:00