diff --git a/alioth/src/firmware/firmware.rs b/alioth/src/firmware/firmware.rs index 10c06a67..6757a727 100644 --- a/alioth/src/firmware/firmware.rs +++ b/alioth/src/firmware/firmware.rs @@ -26,6 +26,7 @@ use snafu::Snafu; use crate::errors::{DebugTrace, trace_error}; +use self::ovmf::x86_64::sev::SEV_SIGNATURE; use self::ovmf::x86_64::tdx::{TDVF_SIGNATURE, TDVF_VERSION}; #[trace_error] @@ -36,6 +37,8 @@ pub enum Error { MissingMetadata { name: &'static str }, #[snafu(display("Firmware missing TDVF signature {TDVF_SIGNATURE:08x}, got {got:08x}"))] MissingTdvfSignature { got: u32 }, + #[snafu(display("Firmware missing AMD-SEV signature {SEV_SIGNATURE:08x}, got {got:08x}"))] + MissingAmdSevSignature { got: u32 }, #[snafu(display("Firmware missing TDVF version {TDVF_VERSION}, got {got}"))] MissingTdvfVersion { got: u32 }, #[snafu(display("Invalid firmware data layout"))] diff --git a/alioth/src/firmware/ovmf/ovmf_x86_64/sev.rs b/alioth/src/firmware/ovmf/ovmf_x86_64/sev.rs index a039bb86..fa5ed602 100644 --- a/alioth/src/firmware/ovmf/ovmf_x86_64/sev.rs +++ b/alioth/src/firmware/ovmf/ovmf_x86_64/sev.rs @@ -25,6 +25,7 @@ pub const GUID_SEV_ES_RESET_BLOCK: [u8; GUID_SIZE] = [ pub const GUID_SEV_METADATA: [u8; GUID_SIZE] = [ 0x66, 0x65, 0x88, 0xdc, 0x4a, 0x98, 0x98, 0x47, 0xA7, 0x5e, 0x55, 0x85, 0xa7, 0xbf, 0x67, 0xcc, ]; +pub const SEV_SIGNATURE: u32 = u32::from_le_bytes(*b"ASEV"); #[derive(Debug, KnownLayout, Immutable, FromBytes, IntoBytes)] #[repr(C)] @@ -102,6 +103,12 @@ pub fn parse_desc(data: &[u8]) -> Result<&[SevMetadataDesc]> { let Ok((metadata, remain)) = SevMetaData::ref_from_prefix(&data[offset..]) else { return error::InvalidLayout.fail(); }; + if metadata.signature != SEV_SIGNATURE { + return error::MissingAmdSevSignature { + got: metadata.signature, + } + .fail(); + }; let Ok((entries, _)) = <[SevMetadataDesc]>::ref_from_prefix_with_elems(remain, metadata.num_desc as usize) else {