OVMF builds in stateless secure boot configuration
(SECURE_BOOT_ENABLE=TRUE + SMM_REQUIRE=FALSE) are expected to use the
emulated variable store (EmuVariableFvbRuntimeDxe) with the store being
re-initialized on each reset (see PlatformInitEmuVariableNvStore())
Using these builds with writable flash is not secure. Log a warning
message saying so in case we find such a configuration.
Signed-off-by: Gerd Hoffmann <kra...@redhat.com>
---
OvmfPkg/QemuFlashFvbServicesRuntimeDxe/FwBlockServiceDxe.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/OvmfPkg/QemuFlashFvbServicesRuntimeDxe/FwBlockServiceDxe.c
b/OvmfPkg/QemuFlashFvbServicesRuntimeDxe/FwBlockServiceDxe.c
index 61e1f2e196e5..ab7154685424 100644
--- a/OvmfPkg/QemuFlashFvbServicesRuntimeDxe/FwBlockServiceDxe.c
+++ b/OvmfPkg/QemuFlashFvbServicesRuntimeDxe/FwBlockServiceDxe.c
@@ -57,6 +57,11 @@ InstallProtocolInterfaces (
NULL
);
ASSERT_EFI_ERROR (Status);
+ #ifdef SECURE_BOOT_FEATURE_ENABLED
+ DEBUG ((DEBUG_WARN, "This build is configured for stateless secure
boot.\n"));
+ DEBUG ((DEBUG_WARN, "Using this build with writable flash is NOT
secure.\n"));
+ // should we ASSERT(0) here?
+ #endif
} else if (IsDevicePathEnd (FvbDevice->DevicePath)) {
//
// Device already exists, so reinstall the FVB protocol
--
2.38.1
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#97502): https://edk2.groups.io/g/devel/message/97502
Mute This Topic: https://groups.io/mt/95707152/21656
Group Owner: devel+ow...@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-
