From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-1.mimecast.com (us-smtp-1.mimecast.com [207.211.31.120]) by mx.groups.io with SMTP id smtpd.web10.1723.1583230413907204482 for ; Tue, 03 Mar 2020 02:13:34 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=X+oH/gZ5; spf=pass (domain: redhat.com, ip: 207.211.31.120, mailfrom: lersek@redhat.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1583230413; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=aFXvVgjy0R7N4SqcjcpJACpCacXb6AlQMOqABMgFhZI=; b=X+oH/gZ5cx2p7yxVJ41NuQ4eyiLmyKX2T1VMCCNsEzWoSgBknv9GaU+nzJV6x9BZ/c0dQE 8KeCko5sP6Cmf4EZ1Ue47fiZ+frPvFREFR+7UpQGud9hgFFjYdyEhUw8YSOCsBeUTfXM51 cZdUlVCEaKR932Vjj7OgvAO6Z6GC+X4= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-271-OLBb4P-ROUyRtHy9eSM6HQ-1; Tue, 03 Mar 2020 05:13:29 -0500 X-MC-Unique: OLBb4P-ROUyRtHy9eSM6HQ-1 Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 8621E189F76A; Tue, 3 Mar 2020 10:13:28 +0000 (UTC) Received: from lacos-laptop-7.usersys.redhat.com (ovpn-117-34.ams2.redhat.com [10.36.117.34]) by smtp.corp.redhat.com (Postfix) with ESMTP id BDED71001B09; Tue, 3 Mar 2020 10:13:27 +0000 (UTC) Subject: Re: [edk2-devel] [PATCH 13/13] OvmfPkg: use generic QEMU image loader for secure boot enabled builds To: devel@edk2.groups.io, ard.biesheuvel@linaro.org References: <20200302072936.29221-1-ard.biesheuvel@linaro.org> <20200302072936.29221-14-ard.biesheuvel@linaro.org> From: "Laszlo Ersek" Message-ID: <40133727-5a60-51d3-9ad5-b4d0319acb17@redhat.com> Date: Tue, 3 Mar 2020 11:13:26 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <20200302072936.29221-14-ard.biesheuvel@linaro.org> X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Language: en-US Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit On 03/02/20 08:29, Ard Biesheuvel wrote: > The QemuLoadImageLib implementation we currently use for all OVMF > builds copies the behavior of the QEMU loader code that precedes it, > which is to disregard UEFI secure boot policies entirely when it comes > to loading kernel images that have been specified on the QEMU command > line. This behavior deviates from ArmVirtQemu based builds, which do > take UEFI secure boot policies into account, and refuse to load images > from the command line that cannot be authenticated. > > The disparity was originally due to the fact that the QEMU command line > kernel loader did not use LoadImage and StartImage at all, but this > changed recently, and now, there are only a couple of reasons left to > stick with the legacy loader: > - it permits loading images that lack a valid PE/COFF header, > - it permits loading X64 kernels on IA32 firmware running on a X64 > capable system. > > Since every non-authentic PE/COFF image can trivially be converted into > an image that lacks a valid PE/COFF header, the former case can simply > not be supported in a UEFI secure boot context. The latter case is highly > theoretical, given that one could easily switch to native X64 firmware in > a VM scenario. > > That leaves us with little justification to use the legacy loader at all > when UEFI secure boot policies are in effect, so let's switch to the > generic loader for UEFI secure boot enabled builds. > > Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2566 > Signed-off-by: Ard Biesheuvel > --- > OvmfPkg/OvmfPkgIa32.dsc | 4 ++++ > OvmfPkg/OvmfPkgIa32X64.dsc | 4 ++++ > OvmfPkg/OvmfPkgX64.dsc | 4 ++++ > 3 files changed, 12 insertions(+) > > diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc > index 2cc924a6986a..eceddb71948f 100644 > --- a/OvmfPkg/OvmfPkgIa32.dsc > +++ b/OvmfPkg/OvmfPkgIa32.dsc > @@ -361,7 +361,11 @@ [LibraryClasses.common.DXE_DRIVER] > PciLib|OvmfPkg/Library/DxePciLibI440FxQ35/DxePciLibI440FxQ35.inf > MpInitLib|UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf > QemuFwCfgS3Lib|OvmfPkg/Library/QemuFwCfgS3Lib/DxeQemuFwCfgS3LibFwCfg.inf > +!if $(SECURE_BOOT_ENABLE) == TRUE > + QemuLoadImageLib|OvmfPkg/Library/GenericQemuLoadImageLib/GenericQemuLoadImageLib.inf > +!else > QemuLoadImageLib|OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.inf > +!endif > !if $(TPM2_ENABLE) == TRUE > Tpm2DeviceLib|SecurityPkg/Library/Tpm2DeviceLibTcg2/Tpm2DeviceLibTcg2.inf > !endif > diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc > index 21d1f156973b..8bdf2e692b00 100644 > --- a/OvmfPkg/OvmfPkgIa32X64.dsc > +++ b/OvmfPkg/OvmfPkgIa32X64.dsc > @@ -365,7 +365,11 @@ [LibraryClasses.common.DXE_DRIVER] > PciLib|OvmfPkg/Library/DxePciLibI440FxQ35/DxePciLibI440FxQ35.inf > MpInitLib|UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf > QemuFwCfgS3Lib|OvmfPkg/Library/QemuFwCfgS3Lib/DxeQemuFwCfgS3LibFwCfg.inf > +!if $(SECURE_BOOT_ENABLE) == TRUE > + QemuLoadImageLib|OvmfPkg/Library/GenericQemuLoadImageLib/GenericQemuLoadImageLib.inf > +!else > QemuLoadImageLib|OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.inf > +!endif > !if $(TPM2_ENABLE) == TRUE > Tpm2DeviceLib|SecurityPkg/Library/Tpm2DeviceLibTcg2/Tpm2DeviceLibTcg2.inf > !endif > diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc > index f3d0f18db7e2..bc0a3e438d2a 100644 > --- a/OvmfPkg/OvmfPkgX64.dsc > +++ b/OvmfPkg/OvmfPkgX64.dsc > @@ -365,7 +365,11 @@ [LibraryClasses.common.DXE_DRIVER] > PciLib|OvmfPkg/Library/DxePciLibI440FxQ35/DxePciLibI440FxQ35.inf > MpInitLib|UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf > QemuFwCfgS3Lib|OvmfPkg/Library/QemuFwCfgS3Lib/DxeQemuFwCfgS3LibFwCfg.inf > +!if $(SECURE_BOOT_ENABLE) == TRUE > + QemuLoadImageLib|OvmfPkg/Library/GenericQemuLoadImageLib/GenericQemuLoadImageLib.inf > +!else > QemuLoadImageLib|OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.inf > +!endif > !if $(TPM2_ENABLE) == TRUE > Tpm2DeviceLib|SecurityPkg/Library/Tpm2DeviceLibTcg2/Tpm2DeviceLibTcg2.inf > !endif > Reviewed-by: Laszlo Ersek Thank you! Laszlo