Branch: refs/heads/master
Home: https://github.com/tianocore/edk2
Commit: f05eb2dfe5d39b76df5ad33d8abb48425823b398
https://github.com/tianocore/edk2/commit/f05eb2dfe5d39b76df5ad33d8abb48425823b398
Author: James Bottomley <j...@linux.ibm.com>
Date: 2021-07-29 (Thu, 29 Jul 2021)
Changed paths:
M OvmfPkg/AmdSev/SecretDxe/SecretDxe.c
Log Message:
-----------
OvmfPkg/AmdSev/SecretDxe: fix header comment to generic naming
Commit 96201ae7bf97 ("OvmfPkg/AmdSev/SecretDxe: make secret location
naming generic", 2020-12-15) replaced references to SEV with the generic
term Confidential Computing, but missed the file header comment. Fix
the naming in that header.
Cc: Ard Biesheuvel <ardb+tianoc...@kernel.org>
Cc: Jordan Justen <jordan.l.jus...@intel.com>
Cc: Ashish Kalra <ashish.ka...@amd.com>
Cc: Brijesh Singh <brijesh.si...@amd.com>
Cc: Erdem Aktas <erdemak...@google.com>
Cc: James Bottomley <j...@linux.ibm.com>
Cc: Jiewen Yao <jiewen....@intel.com>
Cc: Min Xu <min.m...@intel.com>
Cc: Tom Lendacky <thomas.lenda...@amd.com>
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3457
Signed-off-by: James Bottomley <j...@linux.ibm.com>
Reviewed-by: Brijesh Singh <brijesh.si...@amd.com>
Reviewed-by: Jiewen Yao <jiewen....@intel.com>
Commit: 35e267cb3480b3eb5785fd4435a60c00449757d3
https://github.com/tianocore/edk2/commit/35e267cb3480b3eb5785fd4435a60c00449757d3
Author: Dov Murik <dovmu...@linux.ibm.com>
Date: 2021-07-29 (Thu, 29 Jul 2021)
Changed paths:
M OvmfPkg/AmdSev/AmdSevX64.dsc
Log Message:
-----------
OvmfPkg/AmdSev: use GenericQemuLoadImageLib in AmdSev builds
Newer kernels support efistub and therefore don't need all the legacy
stuff in X86QemuLoadImageLib, which are harder to secure. Specifically
the verification of kernel/initrd/cmdline blobs will be added only to
the GenericQemuLoadImageLib implementation, so use that for SEV builds.
Cc: Ard Biesheuvel <ardb+tianoc...@kernel.org>
Cc: Jordan Justen <jordan.l.jus...@intel.com>
Cc: Ashish Kalra <ashish.ka...@amd.com>
Cc: Brijesh Singh <brijesh.si...@amd.com>
Cc: Erdem Aktas <erdemak...@google.com>
Cc: James Bottomley <j...@linux.ibm.com>
Cc: Jiewen Yao <jiewen....@intel.com>
Cc: Min Xu <min.m...@intel.com>
Cc: Tom Lendacky <thomas.lenda...@amd.com>
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3457
Signed-off-by: Dov Murik <dovmu...@linux.ibm.com>
Reviewed-by: Brijesh Singh <brijesh.si...@amd.com>
Reviewed-by: Jiewen Yao <jiewen....@intel.com>
Commit: a26a08dc1fc8f2539d6eb20d808646ff46715908
https://github.com/tianocore/edk2/commit/a26a08dc1fc8f2539d6eb20d808646ff46715908
Author: James Bottomley <j...@linux.ibm.com>
Date: 2021-07-29 (Thu, 29 Jul 2021)
Changed paths:
M OvmfPkg/AmdSev/AmdSevX64.dsc
M OvmfPkg/Library/PlatformBootManagerLibGrub/BdsPlatform.c
M OvmfPkg/Library/PlatformBootManagerLibGrub/BdsPlatform.h
M OvmfPkg/Library/PlatformBootManagerLibGrub/PlatformBootManagerLibGrub.inf
A OvmfPkg/Library/PlatformBootManagerLibGrub/QemuKernel.c
Log Message:
-----------
OvmfPkg: PlatformBootManagerLibGrub: Allow executing kernel via fw_cfg
Support QEMU's -kernel option.
Create a QemuKernel.c for PlatformBootManagerLibGrub
which is an exact copy of the file
PlatformBootManagerLib/QemuKernel.c .
Cc: Ard Biesheuvel <ardb+tianoc...@kernel.org>
Cc: Jordan Justen <jordan.l.jus...@intel.com>
Cc: Ashish Kalra <ashish.ka...@amd.com>
Cc: Brijesh Singh <brijesh.si...@amd.com>
Cc: Erdem Aktas <erdemak...@google.com>
Cc: James Bottomley <j...@linux.ibm.com>
Cc: Jiewen Yao <jiewen....@intel.com>
Cc: Min Xu <min.m...@intel.com>
Cc: Tom Lendacky <thomas.lenda...@amd.com>
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3457
Signed-off-by: James Bottomley <j...@linux.ibm.com>
Reviewed-by: Brijesh Singh <brijesh.si...@amd.com>
Reviewed-by: Jiewen Yao <jiewen....@intel.com>
Commit: 0cb48007f7cbb7a3fc6771bf7f1017d8658a18d2
https://github.com/tianocore/edk2/commit/0cb48007f7cbb7a3fc6771bf7f1017d8658a18d2
Author: Dov Murik <dovmu...@linux.ibm.com>
Date: 2021-07-29 (Thu, 29 Jul 2021)
Changed paths:
A OvmfPkg/Include/Library/BlobVerifierLib.h
A OvmfPkg/Library/BlobVerifierLibNull/BlobVerifierLibNull.inf
A OvmfPkg/Library/BlobVerifierLibNull/BlobVerifierNull.c
M OvmfPkg/OvmfPkg.dec
Log Message:
-----------
OvmfPkg: add library class BlobVerifierLib with null implementation
BlobVerifierLib will be used to verify blobs fetching them from QEMU's
firmware config (fw_cfg) in platforms that enable such verification.
The null implementation BlobVerifierLibNull treats all blobs as valid.
Cc: Ard Biesheuvel <ardb+tianoc...@kernel.org>
Cc: Jordan Justen <jordan.l.jus...@intel.com>
Cc: Ashish Kalra <ashish.ka...@amd.com>
Cc: Brijesh Singh <brijesh.si...@amd.com>
Cc: Erdem Aktas <erdemak...@google.com>
Cc: James Bottomley <j...@linux.ibm.com>
Cc: Jiewen Yao <jiewen....@intel.com>
Cc: Min Xu <min.m...@intel.com>
Cc: Tom Lendacky <thomas.lenda...@amd.com>
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3457
Signed-off-by: Dov Murik <dovmu...@linux.ibm.com>
Reviewed-by: Tom Lendacky <thomas.lenda...@amd.com>
Reviewed-by: Jiewen Yao <jiewen....@intel.com>
Commit: c73e31f54d2787465511830091f966ebf0db057a
https://github.com/tianocore/edk2/commit/c73e31f54d2787465511830091f966ebf0db057a
Author: Dov Murik <dovmu...@linux.ibm.com>
Date: 2021-07-29 (Thu, 29 Jul 2021)
Changed paths:
M OvmfPkg/AmdSev/AmdSevX64.dsc
M OvmfPkg/OvmfPkgIa32.dsc
M OvmfPkg/OvmfPkgIa32X64.dsc
M OvmfPkg/OvmfPkgX64.dsc
Log Message:
-----------
OvmfPkg: add BlobVerifierLibNull to DSC
This prepares the ground for calling VerifyBlob() in
QemuKernelLoaderFsDxe.
Cc: Ard Biesheuvel <ardb+tianoc...@kernel.org>
Cc: Jordan Justen <jordan.l.jus...@intel.com>
Cc: Ashish Kalra <ashish.ka...@amd.com>
Cc: Brijesh Singh <brijesh.si...@amd.com>
Cc: Erdem Aktas <erdemak...@google.com>
Cc: James Bottomley <j...@linux.ibm.com>
Cc: Jiewen Yao <jiewen....@intel.com>
Cc: Min Xu <min.m...@intel.com>
Cc: Tom Lendacky <thomas.lenda...@amd.com>
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3457
Signed-off-by: Dov Murik <dovmu...@linux.ibm.com>
Reviewed-by: Tom Lendacky <thomas.lenda...@amd.com>
Reviewed-by: Jiewen Yao <jiewen....@intel.com>
Commit: 6bf5580a3d6cebf9ec509e94bef12ae01845d6c2
https://github.com/tianocore/edk2/commit/6bf5580a3d6cebf9ec509e94bef12ae01845d6c2
Author: Dov Murik <dovmu...@linux.ibm.com>
Date: 2021-07-29 (Thu, 29 Jul 2021)
Changed paths:
M ArmVirtPkg/ArmVirtQemu.dsc
M ArmVirtPkg/ArmVirtQemuKernel.dsc
Log Message:
-----------
ArmVirtPkg: add BlobVerifierLibNull to DSC
This prepares the ground for calling VerifyBlob() in
QemuKernelLoaderFsDxe.
Cc: Ard Biesheuvel <ardb+tianoc...@kernel.org>
Cc: Leif Lindholm <l...@nuviainc.com>
Cc: Sami Mujawar <sami.muja...@arm.com>
Cc: Jordan Justen <jordan.l.jus...@intel.com>
Cc: Ashish Kalra <ashish.ka...@amd.com>
Cc: Brijesh Singh <brijesh.si...@amd.com>
Cc: Erdem Aktas <erdemak...@google.com>
Cc: James Bottomley <j...@linux.ibm.com>
Cc: Jiewen Yao <jiewen....@intel.com>
Cc: Min Xu <min.m...@intel.com>
Cc: Tom Lendacky <thomas.lenda...@amd.com>
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3457
Signed-off-by: Dov Murik <dovmu...@linux.ibm.com>
Reviewed-by: Ard Biesheuvel <a...@kernel.org>
Acked-by: Jiewen Yao <jiewen....@intel.com>
Commit: d10ad8444f29658d56eb7650a3781bc6cebe2620
https://github.com/tianocore/edk2/commit/d10ad8444f29658d56eb7650a3781bc6cebe2620
Author: Dov Murik <dovmu...@linux.ibm.com>
Date: 2021-07-29 (Thu, 29 Jul 2021)
Changed paths:
M OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c
Log Message:
-----------
OvmfPkg/QemuKernelLoaderFsDxe: call VerifyBlob after fetch from fw_cfg
In QemuKernelLoaderFsDxeEntrypoint we use FetchBlob to read the content
of the kernel/initrd/cmdline from the QEMU fw_cfg interface. Insert a
call to VerifyBlob after fetching to allow BlobVerifierLib
implementations to add a verification step for these blobs.
This will allow confidential computing OVMF builds to add verification
mechanisms for these blobs that originate from an untrusted source
(QEMU).
The null implementation of BlobVerifierLib does nothing in VerifyBlob,
and therefore no functional change is expected.
Cc: Ard Biesheuvel <ardb+tianoc...@kernel.org>
Cc: Jordan Justen <jordan.l.jus...@intel.com>
Cc: Ashish Kalra <ashish.ka...@amd.com>
Cc: Brijesh Singh <brijesh.si...@amd.com>
Cc: Erdem Aktas <erdemak...@google.com>
Cc: James Bottomley <j...@linux.ibm.com>
Cc: Jiewen Yao <jiewen....@intel.com>
Cc: Min Xu <min.m...@intel.com>
Cc: Tom Lendacky <thomas.lenda...@amd.com>
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3457
Co-developed-by: James Bottomley <j...@linux.ibm.com>
Signed-off-by: James Bottomley <j...@linux.ibm.com>
Signed-off-by: Dov Murik <dovmu...@linux.ibm.com>
Reviewed-by: Brijesh Singh <brijesh.si...@amd.com>
Reviewed-by: Tom Lendacky <thomas.lenda...@amd.com>
Reviewed-by: Jiewen Yao <jiewen....@intel.com>
Commit: 5ace477f34f3339c1fb8d590430b5e15b69f099f
https://github.com/tianocore/edk2/commit/5ace477f34f3339c1fb8d590430b5e15b69f099f
Author: Dov Murik <dovmu...@linux.ibm.com>
Date: 2021-07-29 (Thu, 29 Jul 2021)
Changed paths:
M OvmfPkg/AmdSev/SecretPei/SecretPei.c
Log Message:
-----------
OvmfPkg/AmdSev/SecretPei: build hob for full page
Round up the size of the SEV launch secret area to a whole page, as
required by BuildMemoryAllocationHob. This will allow the secret
area defined in the MEMFD to take less than a whole 4KB page.
Cc: Ard Biesheuvel <ardb+tianoc...@kernel.org>
Cc: Jordan Justen <jordan.l.jus...@intel.com>
Cc: Ashish Kalra <ashish.ka...@amd.com>
Cc: Brijesh Singh <brijesh.si...@amd.com>
Cc: Erdem Aktas <erdemak...@google.com>
Cc: James Bottomley <j...@linux.ibm.com>
Cc: Jiewen Yao <jiewen....@intel.com>
Cc: Min Xu <min.m...@intel.com>
Cc: Tom Lendacky <thomas.lenda...@amd.com>
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3457
Signed-off-by: Dov Murik <dovmu...@linux.ibm.com>
Reviewed-by: Tom Lendacky <thomas.lenda...@amd.com>
Reviewed-by: Brijesh Singh <brijesh.si...@amd.com>
Reviewed-by: Jiewen Yao <jiewen....@intel.com>
Commit: 0deeab36d179e79de7b93bb930b4d6eb24185416
https://github.com/tianocore/edk2/commit/0deeab36d179e79de7b93bb930b4d6eb24185416
Author: James Bottomley <j...@linux.ibm.com>
Date: 2021-07-29 (Thu, 29 Jul 2021)
Changed paths:
M OvmfPkg/AmdSev/AmdSevX64.fdf
M OvmfPkg/OvmfPkg.dec
M OvmfPkg/ResetVector/Ia16/ResetVectorVtf0.asm
M OvmfPkg/ResetVector/ResetVector.inf
M OvmfPkg/ResetVector/ResetVector.nasmb
Log Message:
-----------
OvmfPkg/AmdSev: reserve MEMFD space for for firmware config hashes
Split the existing 4KB page reserved for SEV launch secrets into two
parts: first 3KB for SEV launch secrets and last 1KB for firmware
config hashes.
The area of the firmware config hashes will be attested (measured) by
the PSP and thus the untrusted VMM can't pass in different files from
what the guest owner allows.
Declare this in the Reset Vector table using GUID
7255371f-3a3b-4b04-927b-1da6efa8d454 and a uint32_t table of a base
and size value (similar to the structure used to declare the launch
secret block).
Cc: Ard Biesheuvel <ardb+tianoc...@kernel.org>
Cc: Jordan Justen <jordan.l.jus...@intel.com>
Cc: Ashish Kalra <ashish.ka...@amd.com>
Cc: Brijesh Singh <brijesh.si...@amd.com>
Cc: Erdem Aktas <erdemak...@google.com>
Cc: James Bottomley <j...@linux.ibm.com>
Cc: Jiewen Yao <jiewen....@intel.com>
Cc: Min Xu <min.m...@intel.com>
Cc: Tom Lendacky <thomas.lenda...@amd.com>
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3457
Co-developed-by: Dov Murik <dovmu...@linux.ibm.com>
Signed-off-by: Dov Murik <dovmu...@linux.ibm.com>
Signed-off-by: James Bottomley <j...@linux.ibm.com>
Reviewed-by: Tom Lendacky <thomas.lenda...@amd.com>
Reviewed-by: Brijesh Singh <brijesh.si...@amd.com>
Reviewed-by: Jiewen Yao <jiewen....@intel.com>
Commit: 385b9d80a0100490b833f6483e5593fa1abc21b4
https://github.com/tianocore/edk2/commit/385b9d80a0100490b833f6483e5593fa1abc21b4
Author: Dov Murik <dovmu...@linux.ibm.com>
Date: 2021-07-29 (Thu, 29 Jul 2021)
Changed paths:
A OvmfPkg/AmdSev/BlobVerifierLibSevHashes/BlobVerifierLibSevHashes.inf
A OvmfPkg/AmdSev/BlobVerifierLibSevHashes/BlobVerifierSevHashes.c
M OvmfPkg/OvmfPkg.ci.yaml
Log Message:
-----------
OvmfPkg/AmdSev: add BlobVerifierLibSevHashes
Add an implementation for BlobVerifierLib that locates the SEV hashes
table and verifies that the calculated hashes of the kernel, initrd, and
cmdline blobs indeed match the expected hashes stated in the hashes
table.
If there's a missing hash or a hash mismatch then EFI_ACCESS_DENIED is
returned which will cause a failure to load a kernel image.
Cc: Ard Biesheuvel <ardb+tianoc...@kernel.org>
Cc: Jordan Justen <jordan.l.jus...@intel.com>
Cc: Ashish Kalra <ashish.ka...@amd.com>
Cc: Brijesh Singh <brijesh.si...@amd.com>
Cc: Erdem Aktas <erdemak...@google.com>
Cc: James Bottomley <j...@linux.ibm.com>
Cc: Jiewen Yao <jiewen....@intel.com>
Cc: Min Xu <min.m...@intel.com>
Cc: Tom Lendacky <thomas.lenda...@amd.com>
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3457
Co-developed-by: James Bottomley <j...@linux.ibm.com>
Signed-off-by: James Bottomley <j...@linux.ibm.com>
Signed-off-by: Dov Murik <dovmu...@linux.ibm.com>
Reviewed-by: Jiewen Yao <jiewen....@intel.com>
[ardb: add CryptoPkg to accepted dependencies list for CI]
Commit: 514b3aa08ece52140b769a8676595655691c7cb3
https://github.com/tianocore/edk2/commit/514b3aa08ece52140b769a8676595655691c7cb3
Author: Dov Murik <dovmu...@linux.ibm.com>
Date: 2021-07-29 (Thu, 29 Jul 2021)
Changed paths:
M OvmfPkg/AmdSev/AmdSevX64.dsc
Log Message:
-----------
OvmfPkg/AmdSev: Enforce hash verification of kernel blobs
In the AmdSevX64 build, use BlobVerifierLibSevHashes to enforce
verification of hashes of the kernel/initrd/cmdline blobs fetched from
firmware config.
This allows for secure (measured) boot of SEV guests with QEMU's
-kernel/-initrd/-append switches (with the corresponding QEMU support
for injecting the hashes table into initial measured guest memory).
Cc: Ard Biesheuvel <ardb+tianoc...@kernel.org>
Cc: Jordan Justen <jordan.l.jus...@intel.com>
Cc: Ashish Kalra <ashish.ka...@amd.com>
Cc: Brijesh Singh <brijesh.si...@amd.com>
Cc: Erdem Aktas <erdemak...@google.com>
Cc: James Bottomley <j...@linux.ibm.com>
Cc: Jiewen Yao <jiewen....@intel.com>
Cc: Min Xu <min.m...@intel.com>
Cc: Tom Lendacky <thomas.lenda...@amd.com>
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3457
Signed-off-by: Dov Murik <dovmu...@linux.ibm.com>
Reviewed-by: Tom Lendacky <thomas.lenda...@amd.com>
Reviewed-by: Jiewen Yao <jiewen....@intel.com>
Compare: https://github.com/tianocore/edk2/compare/dc485c556d5f...514b3aa08ece
_______________________________________________
edk2-commits mailing list
edk2-commits@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/edk2-commits
