Virtual Secure Boot: Secure Boot support in qemu, kvm and ovmf.

Presented at 33C3 (2016), Dec. 30, 2016, 4 p.m. (60 minutes).

Over the last two years secure boot support for virtual machines was added to qemu, kvm (linux kernel) and ovmf (edk2/tianocore). This talk covers the implementation details and the issues we had to deal with along the way.

Well, to be exact ovmf (open virtual machine firmware, part of tianocore) has support for the secure boot interfaces for a long time already. But it used to not provide any actual security, the guest os could easily tamper with the secure boot variable storage by simply writing to the (virtual) firmware flash.

This is no longer the case now.

Making secure boot actually secure was a bigger effort than we initially expected and it required changes in three software projects: kvm got smm emulation support. qemu got smm emulation support, and the q35 chipset emulation needed some fixes and improvements too. ovmf makes use of the smm lockbox now as tamper-resitant storage for secure boot variables (and some other bits).


Presenters:

  • Gerd Hoffmann
    Gerd is working on virtualization for about ten years. He maintains graphics and usb emulation in the qemu project. He is also involved in firmware development for qemu (seabios, coreboot, edk2) and in linux guest drivers support.

Links:

Similar Presentations: