[edk2-devel] [PATCH v3 10/11] OvmfPkg: add BlobVerifierLibSevHashes

[Lendacky, Thomas via groups.io]

On 7/20/21 3:04 AM, Dov Murik wrote:
> Add an implementation for BlobVerifierLib that locates the SEV hashes
> table and verifies that the calculated hashes of the kernel, initrd, and
> cmdline blobs indeed match the expected hashes stated in the hashes
> table.
> 
> If there's a missing hash or a hash mismatch then EFI_ACCESS_DENIED is
> returned which will cause a failure to load a kernel image.
> 
> Cc: Ard Biesheuvel <ardb+tianocore at kernel.org>
> Cc: Jordan Justen <jordan.l.justen at intel.com>
> Cc: Ashish Kalra <ashish.kalra at amd.com>
> Cc: Brijesh Singh <brijesh.singh at amd.com>
> Cc: Erdem Aktas <erdemaktas at google.com>
> Cc: James Bottomley <jejb at linux.ibm.com>
> Cc: Jiewen Yao <jiewen.yao at intel.com>
> Cc: Min Xu <min.m.xu at intel.com>
> Cc: Tom Lendacky <thomas.lendacky at amd.com>
> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3457
> Co-developed-by: James Bottomley <jejb at linux.ibm.com>
> Signed-off-by: James Bottomley <jejb at linux.ibm.com>
> Signed-off-by: Dov Murik <dovmurik at linux.ibm.com>

A comment about the use of INT32 in the for loop to protect against a
large entry length value would be useful. I don't think it's worth another
version, but if you have to make any updates it would be nice to add.

Reviewed-by: Tom Lendacky <thomas.lendacky at amd.com>

> ---
>  OvmfPkg/Library/BlobVerifierLib/BlobVerifierLibSevHashes.inf |  37 ++++
>  OvmfPkg/Library/BlobVerifierLib/BlobVerifierSevHashes.c      | 200 ++++++++++++++++++++
>  2 files changed, 237 insertions(+)
> 


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#77979): https://edk2.groups.io/g/devel/message/77979
Mute This Topic: https://groups.io/mt/84328241/1813853
Group Owner: devel+owner at edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [edk2-devel-archive at redhat.com]
-=-=-=-=-=-=-=-=-=-=-=-