From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga09.intel.com (mga09.intel.com [134.134.136.24]) by mx.groups.io with SMTP id smtpd.web08.5676.1655519541534598350 for ; Fri, 17 Jun 2022 19:32:25 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="unable to parse pub key" header.i=@intel.com header.s=intel header.b=Xf0Tn5dN; spf=pass (domain: intel.com, ip: 134.134.136.24, mailfrom: min.m.xu@intel.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1655519544; x=1687055544; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=z9HFD1qvmu0i70xir0Kf+AkPxMLs/VIRwksruH6kByU=; b=Xf0Tn5dN4EzCj8kSwKLlREncVtqXxauFl1oAxynL411EKbQ+J6CCXrdB OJwTilYBblUGLR8cQKDkscXUB9FE/h4vQCgde7HplEjpy8b0qZADPqN+U evWTb0dW5HM0SVIU/r1602kumMGd366fkx+/BRWYvmpfsfL3vyhACw/i8 DMCvZpWfbZ39sbDdYXlT/kPXPDcl4X1Qnnehc81ZYon/soAbhQS64PKwC GSSJ4MWEpoB8BoCSwY0FUzynWXQO7GjUnmozuRNO83+Xpsh33A/1nCvw2 O9sV8le0gYFdmbqKdq9woq4gDNfNXSB0ZOEqGfNeB287bGtBYIIzhv7ET Q==; X-IronPort-AV: E=McAfee;i="6400,9594,10380"; a="280355753" X-IronPort-AV: E=Sophos;i="5.92,306,1650956400"; d="scan'208";a="280355753" Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by orsmga102.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jun 2022 19:32:24 -0700 X-IronPort-AV: E=Sophos;i="5.92,306,1650956400"; d="scan'208";a="642270316" Received: from mxu9-mobl1.ccr.corp.intel.com ([10.249.173.231]) by fmsmga008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Jun 2022 19:32:22 -0700 From: "Min Xu" To: devel@edk2.groups.io Cc: Min M Xu , Erdem Aktas , James Bottomley , Jiewen Yao , Gerd Hoffmann , Tom Lendacky Subject: [PATCH 2/3] OvmfPkg: Validate Cfv integrity in Tdx guest Date: Sat, 18 Jun 2022 10:32:02 +0800 Message-Id: <7d0710ff12be66b838fa2893f48d0837da7c2cec.1655518585.git.min.m.xu@intel.com> X-Mailer: git-send-email 2.29.2.windows.2 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Min M Xu Validate Configurtion FV (CFV) in Tdx guest. Cc: Erdem Aktas Cc: James Bottomley Cc: Jiewen Yao Cc: Gerd Hoffmann Cc: Tom Lendacky Signed-off-by: Min Xu --- OvmfPkg/Sec/SecMain.c | 8 ++++++++ OvmfPkg/Sec/SecMain.inf | 2 ++ 2 files changed, 10 insertions(+) diff --git a/OvmfPkg/Sec/SecMain.c b/OvmfPkg/Sec/SecMain.c index 1167d22a68cc..f6c00b8dab96 100644 --- a/OvmfPkg/Sec/SecMain.c +++ b/OvmfPkg/Sec/SecMain.c @@ -768,6 +768,14 @@ SecCoreStartupWithStack ( if (ProcessTdxHobList () != EFI_SUCCESS) { CpuDeadLoop (); } + + // + // Config FV (Cfv) contains the configuration information and its integrity + // should be validated. + // + if (!TdxValidateCfv ((UINT8 *)(UINTN)FixedPcdGet32 (PcdCfvBase), FixedPcdGet32 (PcdCfvRawDataSize))) { + CpuDeadLoop (); + } } #endif diff --git a/OvmfPkg/Sec/SecMain.inf b/OvmfPkg/Sec/SecMain.inf index 561a840f29c5..ae0094a15eda 100644 --- a/OvmfPkg/Sec/SecMain.inf +++ b/OvmfPkg/Sec/SecMain.inf @@ -84,6 +84,8 @@ gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbBackupBase gUefiOvmfPkgTokenSpaceGuid.PcdTdxAcceptPageSize gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase + gUefiOvmfPkgTokenSpaceGuid.PcdCfvBase + gUefiOvmfPkgTokenSpaceGuid.PcdCfvRawDataSize [FeaturePcd] gUefiOvmfPkgTokenSpaceGuid.PcdSmmSmramRequire -- 2.29.2.windows.2