BlobVerifierSevHashes.c 6.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236
  1. /** @file
  2. Blob verifier library that uses SEV hashes table. The hashes table holds the
  3. allowed hashes of the kernel, initrd, and cmdline blobs.
  4. Copyright (C) 2021, IBM Corporation
  5. SPDX-License-Identifier: BSD-2-Clause-Patent
  6. **/
  7. #include <Library/BaseCryptLib.h>
  8. #include <Library/BaseLib.h>
  9. #include <Library/BaseMemoryLib.h>
  10. #include <Library/DebugLib.h>
  11. #include <Library/BlobVerifierLib.h>
  12. /**
  13. The SEV Hashes table must be in encrypted memory and has the table
  14. and its entries described by
  15. <GUID>|UINT16 <len>|<data>
  16. With the whole table GUID being 9438d606-4f22-4cc9-b479-a793d411fd21
  17. The current possible table entries are for the kernel, the initrd
  18. and the cmdline:
  19. 4de79437-abd2-427f-b835-d5b172d2045b kernel
  20. 44baf731-3a2f-4bd7-9af1-41e29169781d initrd
  21. 97d02dd8-bd20-4c94-aa78-e7714d36ab2a cmdline
  22. The size of the entry is used to identify the hash, but the
  23. expectation is that it will be 32 bytes of SHA-256.
  24. **/
  25. #define SEV_HASH_TABLE_GUID \
  26. (GUID) { 0x9438d606, 0x4f22, 0x4cc9, { 0xb4, 0x79, 0xa7, 0x93, 0xd4, 0x11, 0xfd, 0x21 } }
  27. #define SEV_KERNEL_HASH_GUID \
  28. (GUID) { 0x4de79437, 0xabd2, 0x427f, { 0xb8, 0x35, 0xd5, 0xb1, 0x72, 0xd2, 0x04, 0x5b } }
  29. #define SEV_INITRD_HASH_GUID \
  30. (GUID) { 0x44baf731, 0x3a2f, 0x4bd7, { 0x9a, 0xf1, 0x41, 0xe2, 0x91, 0x69, 0x78, 0x1d } }
  31. #define SEV_CMDLINE_HASH_GUID \
  32. (GUID) { 0x97d02dd8, 0xbd20, 0x4c94, { 0xaa, 0x78, 0xe7, 0x71, 0x4d, 0x36, 0xab, 0x2a } }
  33. STATIC CONST EFI_GUID mSevKernelHashGuid = SEV_KERNEL_HASH_GUID;
  34. STATIC CONST EFI_GUID mSevInitrdHashGuid = SEV_INITRD_HASH_GUID;
  35. STATIC CONST EFI_GUID mSevCmdlineHashGuid = SEV_CMDLINE_HASH_GUID;
  36. #pragma pack (1)
  37. typedef struct {
  38. GUID Guid;
  39. UINT16 Len;
  40. UINT8 Data[];
  41. } HASH_TABLE;
  42. #pragma pack ()
  43. STATIC HASH_TABLE *mHashesTable;
  44. STATIC UINT16 mHashesTableSize;
  45. STATIC
  46. CONST GUID *
  47. FindBlobEntryGuid (
  48. IN CONST CHAR16 *BlobName
  49. )
  50. {
  51. if (StrCmp (BlobName, L"kernel") == 0) {
  52. return &mSevKernelHashGuid;
  53. } else if (StrCmp (BlobName, L"initrd") == 0) {
  54. return &mSevInitrdHashGuid;
  55. } else if (StrCmp (BlobName, L"cmdline") == 0) {
  56. return &mSevCmdlineHashGuid;
  57. } else {
  58. return NULL;
  59. }
  60. }
  61. /**
  62. Verify blob from an external source.
  63. @param[in] BlobName The name of the blob
  64. @param[in] Buf The data of the blob
  65. @param[in] BufSize The size of the blob in bytes
  66. @retval EFI_SUCCESS The blob was verified successfully.
  67. @retval EFI_ACCESS_DENIED The blob could not be verified, and therefore
  68. should be considered non-secure.
  69. **/
  70. EFI_STATUS
  71. EFIAPI
  72. VerifyBlob (
  73. IN CONST CHAR16 *BlobName,
  74. IN CONST VOID *Buf,
  75. IN UINT32 BufSize
  76. )
  77. {
  78. CONST GUID *Guid;
  79. INT32 Remaining;
  80. HASH_TABLE *Entry;
  81. if ((mHashesTable == NULL) || (mHashesTableSize == 0)) {
  82. DEBUG ((
  83. DEBUG_ERROR,
  84. "%a: Verifier called but no hashes table discoverd in MEMFD\n",
  85. __FUNCTION__
  86. ));
  87. return EFI_ACCESS_DENIED;
  88. }
  89. Guid = FindBlobEntryGuid (BlobName);
  90. if (Guid == NULL) {
  91. DEBUG ((
  92. DEBUG_ERROR,
  93. "%a: Unknown blob name \"%s\"\n",
  94. __FUNCTION__,
  95. BlobName
  96. ));
  97. return EFI_ACCESS_DENIED;
  98. }
  99. //
  100. // Remaining is INT32 to catch underflow in case Entry->Len has a
  101. // very high UINT16 value
  102. //
  103. for (Entry = mHashesTable, Remaining = mHashesTableSize;
  104. Remaining >= sizeof *Entry && Remaining >= Entry->Len;
  105. Remaining -= Entry->Len,
  106. Entry = (HASH_TABLE *)((UINT8 *)Entry + Entry->Len))
  107. {
  108. UINTN EntrySize;
  109. EFI_STATUS Status;
  110. UINT8 Hash[SHA256_DIGEST_SIZE];
  111. if (!CompareGuid (&Entry->Guid, Guid)) {
  112. continue;
  113. }
  114. DEBUG ((DEBUG_INFO, "%a: Found GUID %g in table\n", __FUNCTION__, Guid));
  115. EntrySize = Entry->Len - sizeof Entry->Guid - sizeof Entry->Len;
  116. if (EntrySize != SHA256_DIGEST_SIZE) {
  117. DEBUG ((
  118. DEBUG_ERROR,
  119. "%a: Hash has the wrong size %d != %d\n",
  120. __FUNCTION__,
  121. EntrySize,
  122. SHA256_DIGEST_SIZE
  123. ));
  124. return EFI_ACCESS_DENIED;
  125. }
  126. //
  127. // Calculate the buffer's hash and verify that it is identical to the
  128. // expected hash table entry
  129. //
  130. Sha256HashAll (Buf, BufSize, Hash);
  131. if (CompareMem (Entry->Data, Hash, EntrySize) == 0) {
  132. Status = EFI_SUCCESS;
  133. DEBUG ((
  134. DEBUG_INFO,
  135. "%a: Hash comparison succeeded for \"%s\"\n",
  136. __FUNCTION__,
  137. BlobName
  138. ));
  139. } else {
  140. Status = EFI_ACCESS_DENIED;
  141. DEBUG ((
  142. DEBUG_ERROR,
  143. "%a: Hash comparison failed for \"%s\"\n",
  144. __FUNCTION__,
  145. BlobName
  146. ));
  147. }
  148. return Status;
  149. }
  150. DEBUG ((
  151. DEBUG_ERROR,
  152. "%a: Hash GUID %g not found in table\n",
  153. __FUNCTION__,
  154. Guid
  155. ));
  156. return EFI_ACCESS_DENIED;
  157. }
  158. /**
  159. Locate the SEV hashes table.
  160. This function always returns success, even if the table can't be found. The
  161. subsequent VerifyBlob calls will fail if no table was found.
  162. @retval RETURN_SUCCESS The hashes table is set up correctly, or there is no
  163. hashes table
  164. **/
  165. RETURN_STATUS
  166. EFIAPI
  167. BlobVerifierLibSevHashesConstructor (
  168. VOID
  169. )
  170. {
  171. HASH_TABLE *Ptr;
  172. UINT32 Size;
  173. mHashesTable = NULL;
  174. mHashesTableSize = 0;
  175. Ptr = (void *)(UINTN)FixedPcdGet64 (PcdQemuHashTableBase);
  176. Size = FixedPcdGet32 (PcdQemuHashTableSize);
  177. if ((Ptr == NULL) || (Size < sizeof *Ptr) ||
  178. !CompareGuid (&Ptr->Guid, &SEV_HASH_TABLE_GUID) ||
  179. (Ptr->Len < sizeof *Ptr) || (Ptr->Len > Size))
  180. {
  181. return RETURN_SUCCESS;
  182. }
  183. DEBUG ((
  184. DEBUG_INFO,
  185. "%a: Found injected hashes table in secure location\n",
  186. __FUNCTION__
  187. ));
  188. mHashesTable = (HASH_TABLE *)Ptr->Data;
  189. mHashesTableSize = Ptr->Len - sizeof Ptr->Guid - sizeof Ptr->Len;
  190. DEBUG ((
  191. DEBUG_VERBOSE,
  192. "%a: mHashesTable=0x%p, Size=%u\n",
  193. __FUNCTION__,
  194. mHashesTable,
  195. mHashesTableSize
  196. ));
  197. return RETURN_SUCCESS;
  198. }