From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from NAM04-BN8-obe.outbound.protection.outlook.com (NAM04-BN8-obe.outbound.protection.outlook.com [40.107.100.56]) by mx.groups.io with SMTP id smtpd.web08.499.1626715687956117914 for ; Mon, 19 Jul 2021 10:28:08 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@amd.com header.s=selector1 header.b=LgfUoEkB; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: amd.com, ip: 40.107.100.56, mailfrom: thomas.lendacky@amd.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=oNg0H4rorhEKumIR0A1dOCBGJiJ7BL26DrxiGPg9Ed5gtqEo4U/Xr5S1WR3MUfeDWEfvqeZaZ2kK/rSvhQWiJWfG9ykR5mCgm3A8FXKHn1EA27aymgYm33Q4GjuW6aObrbcGBPB8R/9v0FOONbtvzWH/utjkqS+99bbNh471aFHKnQxaQl4jao9T7Zm3NQAAxSlfoCjmbI4p/yOmK1q7PuhIDZI4c7csGlIFhY3FaRL9+L1519fh02hGHJdXqd8mkOuAqUONIGdF5vhXe5pYqYMGwucp6NMupuUZiy/8Q1LyJ38SwIr19JcfI+0CqtQcppA2h3BlWoobWG8fhwc2lw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=LD8/P4QNTSo8KNzxOuSDxyYlcCfQsxC0tQ5/zM5cqyE=; b=UJBA45UEQh+bM3I8YBXyZjyd/rUXLculD8ldjg9QST/j9bCswDk+/eoYWnKiAKazQmjuVAW3VjsEAvD/ghAvhar/Ip5UUgpu9v47mAtDV3EAMkL4yysktr2WdkMvDmeQXoDlumjzdY9njfnxR/JEAQYZFRom0QmBWXsRslXVdGCnxb+QzC1BHOQVYMvoiTKBJVo5riVbc4/BDCkae17LR19IPzlwqgjRSE8Udi45EfxW+WpRKYPdk8vnbn73qr3Gh8srmpKZT7pxB6cMvAN0fKHaZPojZvDCY0xOlaFaxmousjwyuVuPK06MyV7WCbIp1mdQnALbBGwfJNUvryoBsA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=LD8/P4QNTSo8KNzxOuSDxyYlcCfQsxC0tQ5/zM5cqyE=; b=LgfUoEkBIluCQaQZ2r+KRbJ3XfQ/ACbXuAudpwfOs69i3yyKThKGqRA3uIBjhYU8nIaLO0DnhzX2iTpASblqJpxq1blU4Z0yZAsCcI+jiPWeL6/5Z9S8KeFpewi9glM7vsfMFZmVQ5NmVIwMN4F6GvBAvedZD5/OdaYo3j+3PA8= Authentication-Results: intel.com; dkim=none (message not signed) header.d=none;intel.com; dmarc=none action=none header.from=amd.com; Received: from DM4PR12MB5229.namprd12.prod.outlook.com (2603:10b6:5:398::12) by DM4PR12MB5151.namprd12.prod.outlook.com (2603:10b6:5:392::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4331.23; Mon, 19 Jul 2021 17:28:06 +0000 Received: from DM4PR12MB5229.namprd12.prod.outlook.com ([fe80::73:2581:970b:3208]) by DM4PR12MB5229.namprd12.prod.outlook.com ([fe80::73:2581:970b:3208%3]) with mapi id 15.20.4331.032; Mon, 19 Jul 2021 17:28:06 +0000 Subject: Re: [PATCH v2 10/11] OvmfPkg: add SevHashesBlobVerifierLib To: Dov Murik , devel@edk2.groups.io Cc: Tobin Feldman-Fitzthum , Tobin Feldman-Fitzthum , Jim Cadden , James Bottomley , Hubertus Franke , Laszlo Ersek , Ard Biesheuvel , Jordan Justen , Ashish Kalra , Brijesh Singh , Erdem Aktas , Jiewen Yao , Min Xu References: <20210706085501.1260662-1-dovmurik@linux.ibm.com> <20210706085501.1260662-11-dovmurik@linux.ibm.com> From: "Lendacky, Thomas" Message-ID: <1b9d824c-56e4-588c-4a48-e2962caa7d44@amd.com> Date: Mon, 19 Jul 2021 12:28:03 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.11.0 In-Reply-To: <20210706085501.1260662-11-dovmurik@linux.ibm.com> X-ClientProxiedBy: SN2PR01CA0019.prod.exchangelabs.com (2603:10b6:804:2::29) To DM4PR12MB5229.namprd12.prod.outlook.com (2603:10b6:5:398::12) Return-Path: thomas.lendacky@amd.com MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from [10.236.30.241] (165.204.77.1) by SN2PR01CA0019.prod.exchangelabs.com (2603:10b6:804:2::29) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4331.21 via Frontend Transport; Mon, 19 Jul 2021 17:28:05 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: b157730d-fd1d-4a1f-0c2f-08d94ada91b4 X-MS-TrafficTypeDiagnostic: DM4PR12MB5151: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:4714; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: Y8X4khAVDZEbtRWXu7WqJfS+FPvvKTJ/uxfETiQWA07gNCXB+G7KfSxwmoPkKgMvKG2Zez4+nrX9gyInjZ7U5IC9IhUsNRSMiWGt+hMm763XsDYRyZnJ/L9ZkhwBJSDsJGpY+dLNHG2/BaegizMhk//o8TYHDi53xOvRjlMZWjQ+6afPj/rnivEkUdbVNNNmI7D2Ej+yJoNOa675hGaYD47Y7WtVKYFOvd70bU6LQDwpCJlzYhmpSUNchx09QcnQvCHL2cq6zByHxGlyw2KelrlCb/zgmP7ME5XJLHPSeEwpkJWKz6V8r33OAFa0xfV+0YhXBLrNEiwUWh4aYpuoXIfC+GSolcH2Tvt1JdDnTX7+WWj/TllZk/GtiOt8mBI5CN7IT8YjStVffhWLQUgHOZprQqnlHMMIh19BlyA0GXlKs31JCdG+qsBGCJ6Lghk4q/tm7I62zuDYZirNnmzfllrcARRJwcp6anO5GUBaVcAu4Hsuw17pl5F9UbHuzVZejJRVW8MbrISCCg5ZJ1ondxtEfgX6vrwAuAi6SbMwb3BZ13owSYeAIlraFHvE8fdSZciVkh2jGUSF+MksGWV/rENU1pijnqCI8mCfSAHNZIqS2XyEPHBNEifrWgvVy80L2038JgL8b9u8OAVYPtfyKWVbTU1Ka1zN3pGgghogsUwOdj2RTOm+0yd/V6NK4yVT2km4I+o6Mdr2tx2oimOaTSwHzoRUXw1Ku4olycnkyrtfDoMkWEqqaWSvl6zTkU6okz15bl5I00phHlj1D6rLydnWKVAs5QdxGxVe7hX6DyjsGU95oCguBEuKPmV4P8uY X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DM4PR12MB5229.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(39860400002)(396003)(376002)(136003)(346002)(366004)(53546011)(83380400001)(4326008)(8936002)(5660300002)(54906003)(2906002)(38100700002)(186003)(66946007)(478600001)(6486002)(31686004)(8676002)(316002)(2616005)(31696002)(7416002)(966005)(16576012)(66556008)(66476007)(36756003)(86362001)(26005)(956004)(213903007)(43740500002);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?d0xMa0RCR09IbU94SkpWZDNRbVM3ZEx1bEhNM0JBU01FNkMxdGJrSXZ4aGNZ?= =?utf-8?B?M2hsZzN4TWpWNzc2MnUvRVdQdDRKMUNJRm5zZTNMaTI2VkRMdVM0WThSYzc0?= =?utf-8?B?YlgwY2dGZ0J1ZG1LV3BZWVBzdU96Z2J0czJmWU8xcDJ4SUFDYzBVUldNZDRH?= =?utf-8?B?Uk9mR0FGN0xOQWRSQ3ljRWozMGErTi9yUGYzYkdGaGMwdWh6OUlpNDJvbnQ5?= =?utf-8?B?VWpKWUI3dzlpTmh5U1ZudysxSXhYQ09EZ3JnenpJbW5BTnVkNS80QWVGS2c5?= =?utf-8?B?OTJaQ2lueGVFRUNaQ2FOcmo3eWo1L2JMdTByZnJJd1BYZHRXa1N2K1FrZVZ1?= =?utf-8?B?SE8rYjRYTDRabEl0RFBDY1hXdDQ1K3RMNjlWcWxpSHluN2JndWlnSlNQdk5m?= =?utf-8?B?TjArTGxPYVdkZXZKcDRMVVQxSXdoTkMrN3Z5NDdGMERENWZyQStqaWdFeGR3?= =?utf-8?B?cENYVHhIb0pQWlFkN0k2V1o3UHRMS2hadTVrNnp2WXZsUWRNQVNFYzZuc2Fj?= =?utf-8?B?YzYrNWR6d1dCcWpGczNId0ZtVFR1WW94V0dGUmdIL3JBY2MwWkk5RnAyTnUz?= =?utf-8?B?N25CMnFtMWltQkNNQ25ha1dVNHdnNC9ETGJwS0NFUWhqUW1SZDZXRnpwZDhx?= =?utf-8?B?NFdMZ1lSL2Fsd1BKaEJNN1JML1dhNnpudkFZS20vb2dIeG1TVFE2Z09aZzdz?= =?utf-8?B?bDBQakdjOWpieVFqVzB5dDdCaWRRQkYvWit3SXpHSzlaUjkrU1JuSkhTdEhP?= =?utf-8?B?NmllUGVlQUNyenByYldDMDdDamxnWUpmWkNPejRoczFGNlJubnRVdWFDSFE0?= =?utf-8?B?eDZhaEEvYUFxbkE2ejhBUjEwdWE3ajNINEFuRmt3bGtZeTN2bTJ0WGU5Wndm?= =?utf-8?B?Rm11NXQwZTF5bFpPSElzQzR3UE1hWEZ1QWxsdUw3NW9qOTNCekZadjhPdC9Q?= =?utf-8?B?c1pWTW9pZDhFSGhBZHlMWHh3d0lWekR3S1NFQmNOQittWC9MTWVJcjZ5WmRE?= =?utf-8?B?bXdPd0V1TXNWcWl3cCtaM2hYdG9EOXV3dFA4M053T1pvM0RDcXEreG82YkFS?= =?utf-8?B?alAwVU82OFBTcXRqU240Q3lhN2hCTjFHNXViRndtRTVkQ3JQamlIajlOUHdY?= =?utf-8?B?VTJTWXlYTWlwNmw5cVE4ajh0U2czUnRVOFhncDVUTnlENDVTb1EreWx3d0Ny?= =?utf-8?B?K21Tazh0dFVUYmo0bmd0WjAyL2kzMXFhSUE2V3ViQVFRTW56TWV5TmxwRWNP?= =?utf-8?B?bTlkQzdJRVZWdzBjUExSbklDQkpSWE1OVHo1azZNSWRkMTRDM1MrN04rNGZa?= =?utf-8?B?cmhFdURiWUFXVGNmMHNMVUNOVzl1bzN5eldaTDc2Rm5hMlBTM1FxR09CQm9s?= =?utf-8?B?d0Z3VklLL00xQ0xxYUhIc2MvMXhpazR1bjMxUzV2QnRzd1NtRnl3dkV1Skxy?= =?utf-8?B?YzQrdTI5V3ZXSStwb3hXbmpBSXZtNVNwWnorTlBoNzFxTnJnRzlnVVpzZk1s?= =?utf-8?B?dlcxRWNiRW9yU25NcXhrWEJzemhMNDBhd3RXWG5QaExMKzgzSFhHK2JBNExM?= =?utf-8?B?b01jdFdHVHZZVExkN0hmckx1NlI0ZW15QVkxbzRNRWxxMVY0Y1d3dldoeWwz?= =?utf-8?B?b25vUXdTbUVoY2F3UEFoUDJ3TjVBL2lSQU4zVFpZRldlamVRQkJSdXBCSmV1?= =?utf-8?B?YmNFZXFuRlJTT0MrRDE0SU9oWFdXZkdqdWhvRFBCenRnQWJmWG5ROGtVUUxZ?= =?utf-8?Q?F7yL4iXrGHYwIq9QPCPOhzonvVaqH+PjNgN85aQ?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: b157730d-fd1d-4a1f-0c2f-08d94ada91b4 X-MS-Exchange-CrossTenant-AuthSource: DM4PR12MB5229.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Jul 2021 17:28:05.8652 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: dnsCpUBcB4jOKKUloDbbMmOTibB3mbxVVzCGj7vJ/7ftC4uQlcykw7l9E3LVBVT6Y1QoqBm6Q+LC7ah9vWcsng== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM4PR12MB5151 Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit On 7/6/21 3:55 AM, Dov Murik wrote: > Add an implementation for BlobVerifierLib that locates the SEV hashes > table and verifies that the calculated hashes of the kernel, initrd, and > cmdline blobs indeed match the expected hashes stated in the hashes > table. > > If there's a missing hash or a hash mismatch then EFI_ACCESS_DENIED is > returned which will cause a failure to load a kernel image. > > Cc: Laszlo Ersek > Cc: Ard Biesheuvel > Cc: Jordan Justen > Cc: Ashish Kalra > Cc: Brijesh Singh > Cc: Erdem Aktas > Cc: James Bottomley > Cc: Jiewen Yao > Cc: Min Xu > Cc: Tom Lendacky > Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=3457 > Co-developed-by: James Bottomley > Signed-off-by: James Bottomley > Signed-off-by: Dov Murik > --- > OvmfPkg/Library/BlobVerifierLib/SevHashesBlobVerifierLib.inf | 36 ++++ > OvmfPkg/Library/BlobVerifierLib/SevHashesBlobVerifier.c | 199 ++++++++++++++++++++ > 2 files changed, 235 insertions(+) > > diff --git a/OvmfPkg/Library/BlobVerifierLib/SevHashesBlobVerifierLib.inf b/OvmfPkg/Library/BlobVerifierLib/SevHashesBlobVerifierLib.inf > new file mode 100644 > index 000000000000..b060d6a1b545 > --- /dev/null > +++ b/OvmfPkg/Library/BlobVerifierLib/SevHashesBlobVerifierLib.inf > @@ -0,0 +1,36 @@ > +## @file > +# > +# Blob verifier library that uses SEV hashes table. > +# > +# Copyright (C) 2021, IBM Corp > +# > +# SPDX-License-Identifier: BSD-2-Clause-Patent > +# > +## > + Same comments here as were made on the Null library instance. > +[Defines] > + INF_VERSION = 0x00010005 > + BASE_NAME = SevHashesBlobVerifierLib > + FILE_GUID = 59e713b5-eff3-46a7-8d8b-46f4c004ad7b > + MODULE_TYPE = BASE > + VERSION_STRING = 1.0 > + LIBRARY_CLASS = BlobVerifierLib > + CONSTRUCTOR = SevHashesBlobVerifierLibConstructor > + > +[Sources] > + SevHashesBlobVerifier.c > + > +[Packages] > + CryptoPkg/CryptoPkg.dec > + MdePkg/MdePkg.dec > + OvmfPkg/OvmfPkg.dec > + > +[LibraryClasses] > + BaseCryptLib > + BaseMemoryLib > + DebugLib > + PcdLib > + > +[FixedPcd] > + gUefiOvmfPkgTokenSpaceGuid.PcdQemuHashTableBase > + gUefiOvmfPkgTokenSpaceGuid.PcdQemuHashTableSize > diff --git a/OvmfPkg/Library/BlobVerifierLib/SevHashesBlobVerifier.c b/OvmfPkg/Library/BlobVerifierLib/SevHashesBlobVerifier.c > new file mode 100644 > index 000000000000..961ee29f5df3 > --- /dev/null > +++ b/OvmfPkg/Library/BlobVerifierLib/SevHashesBlobVerifier.c > @@ -0,0 +1,199 @@ > +/** @file > + > + Blob verifier library that uses SEV hashes table. > + > + Copyright (C) 2021, IBM Corporation > + > + SPDX-License-Identifier: BSD-2-Clause-Patent > +**/ > + > +#include > +#include > +#include > +#include > +#include > + > +/** > + The SEV Hashes table must be in encrypted memory and has the table > + and its entries described by > + > + |UINT16 | > + > + With the whole table GUID being 9438d606-4f22-4cc9-b479-a793d411fd21 > + > + The current possible table entries are for the kernel, the initrd > + and the cmdline: > + > + 4de79437-abd2-427f-b835-d5b172d2045b kernel > + 44baf731-3a2f-4bd7-9af1-41e29169781d initrd > + 97d02dd8-bd20-4c94-aa78-e7714d36ab2a cmdline > + > + The size of the entry is used to identify the hash, but the > + expectation is that it will be 32 bytes of SHA-256. > +**/ > + > +#define SEV_HASH_TABLE_GUID \ > + (GUID) { 0x9438d606, 0x4f22, 0x4cc9, { 0xb4, 0x79, 0xa7, 0x93, 0xd4, 0x11, 0xfd, 0x21 } } > +#define SEV_KERNEL_HASH_GUID \ > + (GUID) { 0x4de79437, 0xabd2, 0x427f, { 0xb8, 0x35, 0xd5, 0xb1, 0x72, 0xd2, 0x04, 0x5b } } > +#define SEV_INITRD_HASH_GUID \ > + (GUID) { 0x44baf731, 0x3a2f, 0x4bd7, { 0x9a, 0xf1, 0x41, 0xe2, 0x91, 0x69, 0x78, 0x1d } } > +#define SEV_CMDLINE_HASH_GUID \ > + (GUID) { 0x97d02dd8, 0xbd20, 0x4c94, { 0xaa, 0x78, 0xe7, 0x71, 0x4d, 0x36, 0xab, 0x2a } } > + > +STATIC CONST EFI_GUID mSevKernelHashGuid = SEV_KERNEL_HASH_GUID; > +STATIC CONST EFI_GUID mSevInitrdHashGuid = SEV_INITRD_HASH_GUID; > +STATIC CONST EFI_GUID mSevCmdlineHashGuid = SEV_CMDLINE_HASH_GUID; > + > +#pragma pack (1) > +typedef struct { > + GUID Guid; > + UINT16 Len; > + UINT8 Data[]; > +} HASH_TABLE; > +#pragma pack () > + > +STATIC HASH_TABLE *mHashesTable; > +STATIC UINT16 mHashesTableSize; > + > +STATIC > +CONST GUID* > +FindBlobEntryGuid ( > + IN CONST CHAR16 *BlobName > + ) > +{ > + if (StrCmp (BlobName, L"kernel") == 0) { > + return &mSevKernelHashGuid; > + } else if (StrCmp (BlobName, L"initrd") == 0) { > + return &mSevInitrdHashGuid; > + } else if (StrCmp (BlobName, L"cmdline") == 0) { > + return &mSevCmdlineHashGuid; > + } else { > + return NULL; > + } > +} > + > +/** > + Verify blob from an external source. > + > + @param BlobName The name of the blob > + @param Buf The data of the blob > + @param BufSize The size of the blob in bytes > + > + @retval EFI_SUCCESS The blob was verified successfully. > + @retval EFI_ACCESS_DENIED The blob could not be verified, and therefore > + should be considered non-secure. > +**/ > +EFI_STATUS > +EFIAPI > +VerifyBlob ( > + IN CONST CHAR16 *BlobName, > + IN CONST VOID *Buf, > + UINT32 BufSize > + ) > +{ > + CONST GUID *Guid; > + INT32 Len; Any reason for this not to be a UINT16 like the struct or mHashesTableSize? > + HASH_TABLE *Entry; > + UINT8 Hash[SHA256_DIGEST_SIZE]; > + > + if (mHashesTable == NULL || mHashesTableSize == 0) { > + DEBUG ((DEBUG_ERROR, > + "%a: Verifier called but no hashes table discoverd in MEMFD\n", > + __FUNCTION__)); > + return EFI_ACCESS_DENIED; > + } > + > + Guid = FindBlobEntryGuid (BlobName); > + if (Guid == NULL) { > + DEBUG ((DEBUG_ERROR, "%a: Unknown blob name \"%s\"\n", __FUNCTION__, > + BlobName)); > + return EFI_ACCESS_DENIED; > + } > + > + Sha256HashAll (Buf, BufSize, Hash); Maybe search for and find the Guid (done in the for loop below) before calling Sha256HashAll? Thanks, Tom > + > + for (Entry = mHashesTable, Len = 0; > + Len < (INT32)mHashesTableSize; > + Len += Entry->Len, > + Entry = (HASH_TABLE *)((UINT8 *)Entry + Entry->Len)) { > + UINTN EntrySize; > + EFI_STATUS Status; > + > + if (!CompareGuid (&Entry->Guid, Guid)) { > + continue; > + } > + > + DEBUG ((DEBUG_INFO, "%a: Found GUID %g in table\n", __FUNCTION__, Guid)); > + > + // > + // Verify that the buffer's calculated hash is identical to the expected > + // hash table entry > + // > + EntrySize = Entry->Len - sizeof (Entry->Guid) - sizeof (Entry->Len); > + if (EntrySize != SHA256_DIGEST_SIZE) { > + DEBUG ((DEBUG_ERROR, "%a: Hash has the wrong size %d != %d\n", > + __FUNCTION__, EntrySize, SHA256_DIGEST_SIZE)); > + return EFI_ACCESS_DENIED; > + } > + > + if (CompareMem (Entry->Data, Hash, EntrySize) == 0) { > + Status = EFI_SUCCESS; > + DEBUG ((DEBUG_INFO, "%a: Hash comparison succeeded for \"%s\"\n", > + __FUNCTION__, BlobName)); > + } else { > + Status = EFI_ACCESS_DENIED; > + DEBUG ((DEBUG_ERROR, "%a: Hash comparison failed for \"%s\"\n", > + __FUNCTION__, BlobName)); > + } > + return Status; > + } > + > + DEBUG ((DEBUG_ERROR, "%a: Hash GUID %g not found in table\n", __FUNCTION__, > + Guid)); > + return EFI_ACCESS_DENIED; > +} > + > +/** > + Locate the SEV hashes table. > + > + This function always returns success, even if the table can't be found. The > + subsequent VerifyBlob calls will fail if no table was found. > + > + @retval RETURN_SUCCESS The verifier tables were set up correctly > +**/ > +RETURN_STATUS > +EFIAPI > +SevHashesBlobVerifierLibConstructor ( > + VOID > + ) > +{ > + HASH_TABLE *Ptr = (void *)(UINTN)FixedPcdGet64 (PcdQemuHashTableBase); > + UINT32 Size = FixedPcdGet32 (PcdQemuHashTableSize); > + > + mHashesTable = NULL; > + mHashesTableSize = 0; > + > + if (Ptr == NULL || Size == 0) { > + return RETURN_SUCCESS; > + } > + > + if (!CompareGuid (&Ptr->Guid, &SEV_HASH_TABLE_GUID)) { > + return RETURN_SUCCESS; > + } > + > + if (Ptr->Len < (sizeof Ptr->Guid + sizeof Ptr->Len)) { > + return RETURN_SUCCESS; > + } > + > + DEBUG ((DEBUG_INFO, "%a: Found injected hashes table in secure location\n", > + __FUNCTION__)); > + > + mHashesTable = (HASH_TABLE *)Ptr->Data; > + mHashesTableSize = Ptr->Len - sizeof Ptr->Guid - sizeof Ptr->Len; > + > + DEBUG ((DEBUG_VERBOSE, "%a: mHashesTable=0x%p, Size=%u\n", __FUNCTION__, > + mHashesTable, mHashesTableSize)); > + > + return RETURN_SUCCESS; > +} >