Skip to content

How to insert SNP_KERNEL_HASH into OVMF #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
blossomin opened this issue Jan 24, 2024 · 1 comment
Open

How to insert SNP_KERNEL_HASH into OVMF #6

blossomin opened this issue Jan 24, 2024 · 1 comment

Comments

@blossomin
Copy link

hello, I'm considering using this OVMF with the SNP VM. According to talks, I learned that the hash of kernel/initrd/cmdline should be inserted into the OVMF, and the OVMF needs to verify this hash when it loads the kernel and initrd into the memory. I searched online, but didn't find a tutorial telling me how to do this. Is there any docs showing the steps for this purpose?
@tlendacky
Copy link
Collaborator

You would use the AmdSevX64.dsc package located in the OvmfPkg/AmdSev/ directory. It requires adding kernel-hashes=on to the Qemu sev-snp-guest object command line option.

mdroth pushed a commit that referenced this issue Mar 29, 2024
@Flickdm @mergify
NetworkPkg: UefiPxeBcDxe: SECURITY PATCH CVE-2023-45234 Patch
1b53515 
REF:https://bugzilla.tianocore.org/show_bug.cgi?id=4539

Bug Details:
PixieFail Bug #6
CVE-2023-45234
CVSS 8.3 : CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
CWE-119 Improper Restriction of Operations within the Bounds of
 a Memory Buffer

Buffer overflow when processing DNS Servers option in a DHCPv6
Advertise message

Change Overview:

Introduces a function to cache the Dns Server and perform sanitizing
on the incoming DnsServerLen to ensure that the length is valid

> + EFI_STATUS
> + PxeBcCacheDnsServerAddresses (
> +  IN PXEBC_PRIVATE_DATA        *Private,
> +  IN PXEBC_DHCP6_PACKET_CACHE  *Cache6
> +  )

Additional code cleanup

Cc: Saloni Kasbekar <saloni.kasbekar@intel.com>
Cc: Zachary Clark-williams <zachary.clark-williams@intel.com>

Signed-off-by: Doug Flick [MSFT] <doug.edk2@gmail.com>
Reviewed-by: Saloni Kasbekar <saloni.kasbekar@intel.com>
mdroth pushed a commit that referenced this issue Mar 19, 2025
@jiaxinwu @mergify
UefiCpuPkg/PiSmmCpuDxeSmm: Clarification for BSP & APs Sync Flow
2351165 
This patch does not impact functionality. It aims to clarify the
synchronization flow between the BSP and APs to enhance code
readability and understanding:

Steps #6 and #11 are the basic synchronization requirements for all
cases.

Steps #1 is additional requirements if the MmCpuSyncModeTradition
mode is selected.

Steps #1, #2, #3, #4, #5, #7, #8, #9, and #10 are additional
requirements if the system needs to configure the MTRR.

Steps #9 and #10 are additional requirements if the system needs to
support the mSmmDebugAgentSupport.

Signed-off-by: Jiaxin Wu <jiaxin.wu@intel.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@tlendacky @blossomin