From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from NAM02-DM3-obe.outbound.protection.outlook.com (NAM02-DM3-obe.outbound.protection.outlook.com [40.107.95.78]) by mx.groups.io with SMTP id smtpd.web10.16151.1626623257020990589 for ; Sun, 18 Jul 2021 08:47:37 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@amd.com header.s=selector1 header.b=2vw4Re2X; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: amd.com, ip: 40.107.95.78, mailfrom: brijesh.singh@amd.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=aqN0evLR7MF/S9/RRY68rv/x89loE1uZeADCGXAWmzsU+gtBAvjgDY6FREL5hnP9Vh0kqYNnBKqctGJsDCg+EOtyKGdF215eC3ByrxJ2w598L2VHnOmsIDAUtCCEi0C2dWKytL3lzkm5t3YIX1ZuhvtjOntNFXP1Sckc144gXVeVFfGzbb3eGOySS+Zc7KshMOfnlQR1+1ItjPOEoN44ePQUAyMtJYiGEsABIUUx8TBBaZ315LyoZF9x3mDvxM/ynktPGpw9wBWFPOjEKYMjadbXTGgynhmoRSgRBXhYaISgAIelcXUh5KSgfAsrATbIi+8bH6eIYXXM5tKzbV4tUA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=s3tJ5qWfeplq5HAVGHJ9PJ8eFAPEGnnBu0X26iuDVXU=; b=fYRJzgW3UweWEyfPus7vF0b9re+0JOfLpRM0hFZN/EB/vXS4i15uKKYDJ9MZmsCU13msYRMpXd3U0zVTu0/AFPuOwGIIY2UL8ST1tP8qLH/OB1sFhoSuqdJGGBOn9hw7DOvr65bXjPb4b6BkenwhrH/CS0dduIG/xrmGxA04u8fzQOw1IalrxnnnwS4C82TwjgKoeKyHqz8amu1NkDEzQ3UuqwUHFGF6s129KE6c/negFH+69s3reBbBPMcmsQTUd2ZTqDmTszBXf8bGSb/rTGE5RvQx7bla5g2BhG3ylX+ume9YmK0oEXa6muKr/YM8CUP7OXV7MYzqRbr0Xo3yjA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=s3tJ5qWfeplq5HAVGHJ9PJ8eFAPEGnnBu0X26iuDVXU=; b=2vw4Re2XL+ARd4FfHq7ibs/YQ8lrRkHlVvnlRi6mFrmetXsv5qFeCBujuO3BGmzmiy/ox4vTJcLf0oSFyL/rTfCz4aCFm4/DD0pnUpmNR7gP9t2lxegmU8JmaDN7pKts/V/4veDZjvr7EzdXv6HEW57S1LsoeNYGmqcyRWn9jtw= Authentication-Results: amd.com; dkim=none (message not signed) header.d=none;amd.com; dmarc=none action=none header.from=amd.com; Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SN6PR12MB2639.namprd12.prod.outlook.com (2603:10b6:805:75::25) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4331.26; Sun, 18 Jul 2021 15:47:31 +0000 Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::a8a9:2aac:4fd1:88fa]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::a8a9:2aac:4fd1:88fa%3]) with mapi id 15.20.4331.032; Sun, 18 Jul 2021 15:47:31 +0000 Cc: brijesh.singh@amd.com, Tobin Feldman-Fitzthum , Tobin Feldman-Fitzthum , Jim Cadden , James Bottomley , Hubertus Franke , Laszlo Ersek , Ard Biesheuvel , Jordan Justen , Ashish Kalra , Erdem Aktas , Jiewen Yao , Min Xu , Tom Lendacky Subject: Re: [PATCH v2 07/11] OvmfPkg/QemuKernelLoaderFsDxe: call VerifyBlob after fetch from fw_cfg To: Dov Murik , devel@edk2.groups.io References: <20210706085501.1260662-1-dovmurik@linux.ibm.com> <20210706085501.1260662-8-dovmurik@linux.ibm.com> From: "Brijesh Singh" Message-ID: <02974eb3-d919-f147-10f8-605ca7c152cb@amd.com> Date: Sun, 18 Jul 2021 10:47:25 -0500 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:78.0) Gecko/20100101 Thunderbird/78.12.0 In-Reply-To: <20210706085501.1260662-8-dovmurik@linux.ibm.com> X-ClientProxiedBy: SN7PR04CA0231.namprd04.prod.outlook.com (2603:10b6:806:127::26) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) Return-Path: brijesh.singh@amd.com MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from Brijeshs-MacBook-Pro.local (70.112.153.56) by SN7PR04CA0231.namprd04.prod.outlook.com (2603:10b6:806:127::26) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4331.21 via Frontend Transport; Sun, 18 Jul 2021 15:47:27 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: df7980f7-3487-4904-7982-08d94a035ab5 X-MS-TrafficTypeDiagnostic: SN6PR12MB2639: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:2000; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: dsXuCRm1Df0MKIiXrwEV6RPq4INh9/Sk7VaV/p0BDoud3oRaM3MMRCi6gEMcTc0OzKrlai1IQQO1XRlH5XxzTv2eHQ9chHusEbuX4ElR9zGJsRW7c+ENqFd4shlE86quZSugaGmuDYjO6UIbwYq0oias4jMLDXztis5pmrfJJ9X5rNkDgvWywi3sObwEC1Yk7AFVDcccHtt0iuwxWA2MO2p5bOBgB39IID8Y/1t0l3sTr2chlYOzsJMsh6hfYtECIVTG2V5z9grYE88isyA/JMUjryoJTCsS2IwQnqzmu7bJtWKP4dI6JO8M27uRnoedxYwPBI9UQfUPqcmwyFqTmeIUUyMniDhjtQM/WGaIrDyWaZvkl8rjjj3JnLdeeUFbwB3/iiQE4B9G2TcW+U6rkkLAtsNQsrfT72XkwVGwKlSlu5AQRbHTIwPlKpumwIhCbVWDJdaGW0CLJ5khL0RmlZhFIchbq7+KFQ/JxseNifxJQqBCI5OPob9utIaGP1zHUbVa7yeqetC9Cl/BTy5bZxp+QTubIL70qVr0R3PGprKuqRlH7sNiJuM3b38vxKt4kRo+qSmA076WnFm07iQ/6m4jldk2W+iWKcWRtFBfravaMr5LKf6yRKzzArbrI4ac9CtvbosHLQzZqRem7ysX+4kOzUQt3q4rNnBmz08HWdwhckjU+a6f6AZHHbcAhBzma5MToiEYZtqmZTJ/SanwD+d0Tx46TuCTpS/sEpz2VrZQ7o4AkyAZChoc/+urewzPNfmTpMZoIpSonxYiEfFBRj9st7a9YWCaBSQZYq8RqZGow3eUKaJjzCpPB/yShjokznfcVrc/3usT7dOYgzpB2A== X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SN6PR12MB2718.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(6029001)(4636009)(366004)(966005)(26005)(6506007)(53546011)(316002)(2906002)(36756003)(6512007)(31696002)(7416002)(8676002)(66946007)(66476007)(52116002)(86362001)(4326008)(66556008)(5660300002)(54906003)(15650500001)(44832011)(2616005)(6486002)(38350700002)(83380400001)(38100700002)(956004)(186003)(8936002)(31686004)(508600001)(45980500001)(43740500002);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?bXVTQWF5WHZzVWtxNXl6S2N3OHV2SEtCQTc3UHNlMnpTV3NiUmpsdk5ubk0x?= =?utf-8?B?QUd5V2dvNllOdkNPNG5FdmVieUdTcWhqSloxZnJNclU3VTkySldhaWZoKytX?= =?utf-8?B?KzdjSXJVTVRjQnhoZVVQVkZ5ZUh1RWROWncxWjkvbnZwdk9COXFLRG5MeldL?= =?utf-8?B?c21rUlJjYlFaZVhFY3lwaXNyUFBuc2QyZDNIVm5oc0MyWktsM1NCUUM3NmpN?= =?utf-8?B?MUtSdXhGaGZTTjhyVWlWcTlGd2dBRytIS0VZVVRNZ0FaY0NDUEpDWExMU04z?= =?utf-8?B?ZlZqekZHd1VDVDlYR0tjSTlYWEhhMlBMWElXSWVhbTVBOFRNQUNQU2Q5V0tj?= =?utf-8?B?Q2liSjRCRkNwZ2JNdVNaOUpoeFRqMmVsL1FGWVQ5cVhzbHhucHI2WjV2TWF0?= =?utf-8?B?QWU1eTY4QkpLNUs4MVdmQkdxOHhHdGdaT0REbDZTKzU3c0tleitEUksvb1N1?= =?utf-8?B?Ym1mYk8zU3loRGFBSEhaZUlmdnJQWFUxc0xUelJ3NytiWWdoWmJGdHZQTjcv?= =?utf-8?B?Q2I2aFh4ZXd2bGdtNFV0TWxUbmtmdmZHOGN5djRyVHBvNGt4aHBoTFU4ZTc0?= =?utf-8?B?alVMRmk0ZTV3b283UWFYbzd1Yks0dWgvVHBRZGVzUkgySElNbnk3azRrWUZh?= =?utf-8?B?b3JwVEl6aE9uU2VrbkswWVh3bDE1UjRpeTdjTmZ0WENtYnhOUU1Yd0V2LzJ5?= =?utf-8?B?ZmpKV3hCK0d5ZEZ5RUE4T0FheGdaT0twT0c5MWxGUDFQaE16MmdiYVJpSVNY?= =?utf-8?B?TlIvNnVtZ0UwMTJoMzUxTXZhR1NzVFBqb1h3QXNPQm5YY3lmelBiUnpDV0ND?= =?utf-8?B?emFtNkVhbThlbS9kT2dLNUQ5NGdnNFNPUmlVV1k1SWZzMy9mYUFGbkRXQ284?= =?utf-8?B?cWFOUXdLU2I1eEYrZFF3Znl6Nkp5aHlSZjEydlN2djF0S2dXYTN5eml1NjFL?= =?utf-8?B?dkdyY2dDWk5RWisrY0lMUnA4WDNkT01pc2dLTHI0YWJTbjZxMUZ0anM2b2JL?= =?utf-8?B?emo1RlNCbkg4ZFVHck5tbmxGT0ZJRE5vYVJNcW4ybytKZzNxNTRsOW9NbndR?= =?utf-8?B?YU5KZlROQWlCQmd4bnJKekpJZ3lBV2NWRHl1bFc0M1VoUGtBVHI1RWY3K0dV?= =?utf-8?B?TWJYV05RdHRVYitFM1ppYjBxMlVvSXUwVUNzYTZSOHBqMXRwd0RmNjlSa3lW?= =?utf-8?B?Zk43UkY4cklHbkVXYVFIeDBYcWJUWnlmY0xvNnZHQzJnSmx1UU82TXdaUkV0?= =?utf-8?B?RHhmTWxob3BlaHlGRDBGUjl3YWZnY29jSHlSUktLTDlMcmh6dytGV25hS3h2?= =?utf-8?B?SHNkaVkxanA2aGhLUUhnR1VMMXBheEJOWlVoeExGazFTREpkNER2MUVkVS9U?= =?utf-8?B?VlJ0M3ZoRzB5R0pMbVlMck1vVEFCeW9oQjgrbUQvN1MrTzY2Q2tvK3FtNDZ0?= =?utf-8?B?UDZwMy80UUU0bWdSKzVGK0d5cER2VC9FR3hLNzM5MUlkYWYyUmZxTGZ3TXE5?= =?utf-8?B?bFNuRzExNXJaMnhPbXcrQVJrdVl4ck1ZR3B4bGVHc2pKMUVlTXdheGsrWlB6?= =?utf-8?B?elhmU21rUEtrVy8rRXE5WEdKdHNMZzdkYTdlZ0xwOFNsc2pqUHJXTTZXRGM3?= =?utf-8?B?WWcvNGhpS3Q4UXNTSk95RFQ1eUZpeUMrODJEbXZoeHN4MWtFZks4d05YVnpv?= =?utf-8?B?NEd3Smd1TG5NOU1hUjRTcDI4eWUzS1NXN0NNNElraXM1V1YvN2VLSnM3bTd5?= =?utf-8?Q?7/bty3GqCjc06IvToZdtVeWDDgZnNngftzjqJw5?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: df7980f7-3487-4904-7982-08d94a035ab5 X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 18 Jul 2021 15:47:31.7875 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 3xIbSPCoI022CE0ql7l3AL82n2WgLr0KMqDOcNiqo7BxMkjSNdySi79GkYYfJhp2unX0ORk/3/CM77EIlh9H6g== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR12MB2639 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Content-Language: en-US On 7/6/21 3:54 AM, Dov Murik wrote: > In QemuKernelLoaderFsDxeEntrypoint we use FetchBlob to read the content > of the kernel/initrd/cmdline from the QEMU fw_cfg interface. Insert a > call to VerifyBlob after fetching to allow BlobVerifierLib > implementations to add a verification step for these blobs. > > This will allow confidential computing OVMF builds to add verification > mechanisms for these blobs that originate from an untrusted source > (QEMU). > > The null implementation of BlobVerifierLib does nothing in VerifyBlob, > and therefore no functional change is expected. > > Cc: Laszlo Ersek > Cc: Ard Biesheuvel > Cc: Jordan Justen > Cc: Ashish Kalra > Cc: Brijesh Singh > Cc: Erdem Aktas > Cc: James Bottomley > Cc: Jiewen Yao > Cc: Min Xu > Cc: Tom Lendacky > Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3457 > Co-developed-by: James Bottomley > Signed-off-by: James Bottomley > Signed-off-by: Dov Murik The patch itself is okay. Just curious, do we also need to add a verification for the QEMU FW cfg file ?