Changeset 108794 in vbox for trunk/src/VBox/Devices/EFI/FirmwareNew/OvmfPkg/AmdSev/BlobVerifierLibSevHashes/BlobVerifierSevHashes.c

Timestamp:

Mar 31, 2025 11:31:09 AM (2 weeks ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

168237

Message:

Devices/EFI/FirmwareNew: Merge edk2-stable202502 from the vendor branch and make it build for the important platforms, bugref:4643

Location:

trunk/src/VBox/Devices/EFI/FirmwareNew

Files:

• . (modified) (1 prop)
• OvmfPkg/AmdSev/BlobVerifierLibSevHashes/BlobVerifierSevHashes.c (modified) (8 diffs)

trunk/src/VBox/Devices/EFI/FirmwareNew/OvmfPkg/AmdSev/BlobVerifierLibSevHashes/BlobVerifierSevHashes.c

@@ -78 +78 @@
   Verify blob from an external source.
 
+  If a non-secure configuration is detected this function will enter a
+  dead loop to prevent a boot.
+
   @param[in] BlobName           The name of the blob
   @param[in] Buf                The data of the blob
   @param[in] BufSize            The size of the blob in bytes
-
-  @retval EFI_SUCCESS           The blob was verified successfully.
-  @retval EFI_ACCESS_DENIED     The blob could not be verified, and therefore
-                                should be considered non-secure.
+  @param[in] FetchStatus        The status of the previous blob fetch
+
+  @retval EFI_SUCCESS           The blob was verified successfully or was not
+                                found in the hash table.
+  @retval EFI_ACCESS_DENIED     Kernel hashes not supported, but the boot
+                                can continue safely.
 **/
 EFI_STATUS
@@ -91 +96 @@
   IN  CONST CHAR16  *BlobName,
   IN  CONST VOID    *Buf,
-  IN  UINT32        BufSize
+  IN  UINT32        BufSize,
+  IN  EFI_STATUS    FetchStatus
   )
 {
@@ -98 +104 @@
   HASH_TABLE  *Entry;
 
+  // Enter a dead loop if the fetching of this blob
+  // failed. This prevents a malicious host from
+  // circumventing the following checks.
+  if (EFI_ERROR (FetchStatus)) {
+    DEBUG ((
+      DEBUG_ERROR,
+      "%a: Fetching blob failed.\n",
+      __func__
+      ));
+
+    CpuDeadLoop ();
+  }
+
   if ((mHashesTable == NULL) || (mHashesTableSize == 0)) {
     DEBUG ((
-      DEBUG_ERROR,
+      DEBUG_WARN,
       "%a: Verifier called but no hashes table discoverd in MEMFD\n",
       __func__
@@ -115 +134 @@
       BlobName
       ));
-    return EFI_ACCESS_DENIED;
+
+    CpuDeadLoop ();
   }
 
@@ -140 +160 @@
     if (EntrySize != SHA256_DIGEST_SIZE) {
       DEBUG ((
-        DEBUG_ERROR,
+        DEBUG_WARN,
         "%a: Hash has the wrong size %d != %d\n",
         __func__,
@@ -171 +191 @@
         BlobName
         ));
+
+      CpuDeadLoop ();
     }
 
@@ -176 +198 @@
   }
 
+  //
+  // If the GUID is not in the hash table, execution can still continue.
+  // This blob will not be measured, but at least one blob must be.
+  //
   DEBUG ((
     DEBUG_ERROR,
@@ -182 +208 @@
     Guid
     ));
-  return EFI_ACCESS_DENIED;
+  return EFI_SUCCESS;
 }