AmdSev: Halt on failed blob allocation

A malicious host may be able to undermine the fw_cfg
interface such that loading a blob fails.

In this case rather than continuing to the next boot
option, the blob verifier should halt.

For non-confidential guests, the error should be non-fatal.

Signed-off-by: Tobin Feldman-Fitzthum <tobin@linux.ibm.com>

1 files changed, 4 insertions, 5 deletions

diff --git a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c
index 3c12085f6c..cf58c97cd2 100644
--- a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c
+++ b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c
@@ -1042,6 +1042,7 @@ QemuKernelLoaderFsDxeEntrypoint (
   KERNEL_BLOB  *CurrentBlob;

   KERNEL_BLOB  *KernelBlob;

   EFI_STATUS   Status;

+  EFI_STATUS   FetchStatus;

   EFI_HANDLE   FileSystemHandle;

   EFI_HANDLE   InitrdLoadFile2Handle;

 

@@ -1060,15 +1061,13 @@ QemuKernelLoaderFsDxeEntrypoint (
   //

   for (BlobType = 0; BlobType < KernelBlobTypeMax; ++BlobType) {

     CurrentBlob = &mKernelBlob[BlobType];

-    Status      = FetchBlob (CurrentBlob);

-    if (EFI_ERROR (Status)) {

-      goto FreeBlobs;

-    }

+    FetchStatus = FetchBlob (CurrentBlob);

 

     Status = VerifyBlob (

                CurrentBlob->Name,

                CurrentBlob->Data,

-               CurrentBlob->Size

+               CurrentBlob->Size,

+               FetchStatus

                );

     if (EFI_ERROR (Status)) {

       goto FreeBlobs;