From nobody Mon Feb 9 12:10:25 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+75571+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+75571+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=linux.ibm.com ARC-Seal: i=1; a=rsa-sha256; t=1621945609; cv=none; d=zohomail.com; s=zohoarc; b=gJo/fj6ckTIW7nVcxnfl2G+6RN8Ao6RX5vcpQwXY+mHWZwW4Z8pjNbP9G06L22UMq0tRRVKoI4BMwpIiBzqERXc7vJIzG+jYHFKwbfZlJNsMrzl24VPd6+6xWyFxalmOkOinYm6OaUqmj9fd+LvcrPA07wDmIAmz0mMxcoMwgp0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1621945609; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=q2++Ze3NMJ7pH4Ib47Yv/K5Vgdk6MlXFZY89NaHjyw8=; b=KYPoPCEflCWkL9FXBKQtEtB7vS7rrvyokAyhaDHS+pOUS4a+RDaNGS3bYz3AcmbkWMTl6vNf3YQu1Xdy3XMl3LBhR2L8omwkq7RxV9pGUyz/GPzJQhJMuhk3lgus10fqAefB76D6xDj2SwhGay26fEK+af2rEX2U5eebx3BJVE4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+75571+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) header.from= Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1621945609337281.6177938529047; Tue, 25 May 2021 05:26:49 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id Juu0YY1788612xwsAF6CwLcL; Tue, 25 May 2021 05:26:48 -0700 X-Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) by mx.groups.io with SMTP id smtpd.web09.5727.1621920689457513997 for ; Mon, 24 May 2021 22:31:29 -0700 X-Received: from pps.filterd (m0098394.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.43/8.16.0.43) with SMTP id 14P53leU051071; Tue, 25 May 2021 01:31:27 -0400 X-Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com with ESMTP id 38rtjy8y9g-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 25 May 2021 01:31:26 -0400 X-Received: from m0098394.ppops.net (m0098394.ppops.net [127.0.0.1]) by pps.reinject (8.16.0.43/8.16.0.43) with SMTP id 14P54MBV055173; Tue, 25 May 2021 01:31:26 -0400 X-Received: from ppma02wdc.us.ibm.com (aa.5b.37a9.ip4.static.sl-reverse.com [169.55.91.170]) by mx0a-001b2d01.pphosted.com with ESMTP id 38rtjy8y8p-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 25 May 2021 01:31:26 -0400 X-Received: from pps.filterd (ppma02wdc.us.ibm.com [127.0.0.1]) by ppma02wdc.us.ibm.com (8.16.0.43/8.16.0.43) with SMTP id 14P5ReRX027652; Tue, 25 May 2021 05:31:24 GMT X-Received: from b01cxnp22035.gho.pok.ibm.com (b01cxnp22035.gho.pok.ibm.com [9.57.198.25]) by ppma02wdc.us.ibm.com with ESMTP id 38psk9cdpy-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 25 May 2021 05:31:24 +0000 X-Received: from b01ledav001.gho.pok.ibm.com (b01ledav001.gho.pok.ibm.com [9.57.199.106]) by b01cxnp22035.gho.pok.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 14P5VOfl32637418 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 25 May 2021 05:31:24 GMT X-Received: from b01ledav001.gho.pok.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1226F2805A; Tue, 25 May 2021 05:31:24 +0000 (GMT) X-Received: from b01ledav001.gho.pok.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C25D328065; Tue, 25 May 2021 05:31:23 +0000 (GMT) X-Received: from localhost.localdomain (unknown [9.2.130.16]) by b01ledav001.gho.pok.ibm.com (Postfix) with ESMTP; Tue, 25 May 2021 05:31:23 +0000 (GMT) From: Dov Murik To: devel@edk2.groups.io Cc: Dov Murik , Tobin Feldman-Fitzthum , Tobin Feldman-Fitzthum , Jim Cadden , James Bottomley , Hubertus Franke , Laszlo Ersek , Ard Biesheuvel , Jordan Justen , Ashish Kalra , Brijesh Singh , Erdem Aktas , Jiewen Yao , Min Xu , Tom Lendacky Subject: [edk2-devel] [PATCH v1 4/8] OvmfPkg/QemuKernelLoaderFsDxe: Add ability to verify loaded items Date: Tue, 25 May 2021 05:31:12 +0000 Message-Id: <20210525053116.1533673-5-dovmurik@linux.ibm.com> In-Reply-To: <20210525053116.1533673-1-dovmurik@linux.ibm.com> References: <20210525053116.1533673-1-dovmurik@linux.ibm.com> MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: y20SaL_xzb7oM7AgNX25xVmNdAQJxA0L X-Proofpoint-ORIG-GUID: MoZ_3YB3uSNudDdIywdqbXCKMUsH4fvC Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,dovmurik@linux.ibm.com X-Gm-Message-State: RWxS2bw5e8fCfbFNfnrAHO0Mx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1621945608; bh=Y1qLAVCydrnS5G8JtmIB1JqAnE77cL1i8SOtcJ8s1I4=; h=Cc:Date:From:Reply-To:Subject:To; b=njDQyyRYDoCv7pXgJjReTG/cjp1dil73zJKl7VAkOZnNbntYgbuHANbKWnJYd/eD0Bp rcPWhQN5kmP3MCfpJxoq0yPASz+F63nxeoxJNQDi7GBvTNXHqHNU1Q99UpigAc08H0Ioy kCHXghLpDv6183ooDn19Xac2Qobl3fuPMXk= X-ZohoMail-DKIM: pass (identity @groups.io) Content-Type: text/plain; charset="utf-8" From: James Bottomley Allow registering a verifier which is then called for each blob passed via QEMU's fw_cfg. Cc: Laszlo Ersek Cc: Ard Biesheuvel Cc: Jordan Justen Cc: Ashish Kalra Cc: Brijesh Singh Cc: Erdem Aktas Cc: James Bottomley Cc: Jiewen Yao Cc: Min Xu Cc: Tom Lendacky Signed-off-by: James Bottomley --- OvmfPkg/Include/Library/QemuFwCfgLib.h | 35 +++++++++++++++= +++++ OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c | 31 +++++++++++++++= ++ 2 files changed, 66 insertions(+) diff --git a/OvmfPkg/Include/Library/QemuFwCfgLib.h b/OvmfPkg/Include/Libra= ry/QemuFwCfgLib.h index 68002bb654e6..1095efad5878 100644 --- a/OvmfPkg/Include/Library/QemuFwCfgLib.h +++ b/OvmfPkg/Include/Library/QemuFwCfgLib.h @@ -173,5 +173,40 @@ QemuFwCfgFindFile ( OUT UINTN *Size ); =20 +/** + The verifier is used to abstract a hash verification operation when + A firmware config item is accessed via a filesystem and has some type + of integrity information passed in. + + @param[in] Name The name of the config file to verify. + @param[in] Buffer A pointer to the loaded config information. + @param[in] Size The size of the buffer. + + @retval EFI_SUCCESS The buffer verified OK. + + @retval EFI_ACCESS_DENIED The buffer failed the integrity check. + +**/ +typedef +RETURN_STATUS +(EFIAPI *FW_CFG_VERIFIER) ( + IN CONST CHAR16 *Name, + IN VOID *Buffer, + IN UINTN Size + ); + +/** + Register a verifier for the Firmware Configuration Filesystem to use + + @param[in] Verifier The verifier to register + + @retval EFI_SUCCESS The verifier was successfully registered +**/ +RETURN_STATUS +EFIAPI +RegisterFwCfgVerifier ( + IN FW_CFG_VERIFIER Verifier + ); + #endif =20 diff --git a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c b/OvmfPk= g/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c index b09ff6a3590d..9823d23d1005 100644 --- a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c +++ b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c @@ -982,6 +982,27 @@ FetchBlob ( return EFI_SUCCESS; } =20 +STATIC FW_CFG_VERIFIER mVerifier =3D NULL; + +/** + Register a verifier for the Firmware Configuration Filesystem to use + + @param[in] Verifier The verifier to register + + @retval EFI_SUCCESS The verifier was successfully registered +**/ +EFI_STATUS +EFIAPI +RegisterFwCfgVerifier ( + IN FW_CFG_VERIFIER Verifier + ) +{ + if (mVerifier !=3D NULL) { + return EFI_OUT_OF_RESOURCES; + } + mVerifier =3D Verifier; + return EFI_SUCCESS; +} =20 // // The entry point of the feature. @@ -1033,6 +1054,16 @@ QemuKernelLoaderFsDxeEntrypoint ( if (EFI_ERROR (Status)) { goto FreeBlobs; } + if (mVerifier !=3D NULL) { + Status =3D mVerifier ( + CurrentBlob->Name, + CurrentBlob->Data, + CurrentBlob->Size + ); + if (EFI_ERROR (Status)) { + goto FreeBlobs; + } + } mTotalBlobBytes +=3D CurrentBlob->Size; } KernelBlob =3D &mKernelBlob[KernelBlobTypeKernel]; --=20 2.25.1 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#75571): https://edk2.groups.io/g/devel/message/75571 Mute This Topic: https://groups.io/mt/83074455/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-