From nobody Sun Apr 28 09:34:45 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+97296+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+97296+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1670912693; cv=none; d=zohomail.com; s=zohoarc; b=P2bt4XCNLJ7Y1baaLtfZnqBXYob69HVzMyR8/gO68Ui/z2e5SGXql/MM4AMpoOCSgqK7sExvWcsUwgST7kuemvDFlSXDzGnmbIFtYaFTocDEai2+dQSmsmYE3KENuEAuC8PzlzTTTA9jK2C3kTP3spAH+veevFaYsckNSUpovgs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1670912693; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=87ve3AZSiEPm6+zqDyV0uif5cfqcHsHGd91nvWhhrmM=; b=UCqAEYsUJi6rLylKCd29uelR2/az9qgrCBT09p54wImpFUry9Sik21tdrEWxu4jQ4cfIN7FP1P17RCNjoHqhrlmouUM3vTZEe4j6pHE2yL35CDaegASHv9cV53Cq7mjxvD/gR/eeghVy7tyMVvXNfHvDzazj/z0LhU2IV1OL3bw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+97296+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1670912693915621.4286006314152; Mon, 12 Dec 2022 22:24:53 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id IbudYY1788612xZoDS7pdcPg; Mon, 12 Dec 2022 22:24:53 -0800 X-Received: from mga01.intel.com (mga01.intel.com [192.55.52.88]) by mx.groups.io with SMTP id smtpd.web11.67466.1670912693041909926 for ; Mon, 12 Dec 2022 22:24:53 -0800 X-IronPort-AV: E=McAfee;i="6500,9779,10559"; a="345116435" X-IronPort-AV: E=Sophos;i="5.96,240,1665471600"; d="scan'208";a="345116435" X-Received: from orsmga008.jf.intel.com ([10.7.209.65]) by fmsmga101.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 12 Dec 2022 22:24:30 -0800 X-IronPort-AV: E=McAfee;i="6500,9779,10559"; a="679199530" X-IronPort-AV: E=Sophos;i="5.96,240,1665471600"; d="scan'208";a="679199530" X-Received: from mxu9-mobl1.ccr.corp.intel.com ([10.249.170.38]) by orsmga008-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 12 Dec 2022 22:24:22 -0800 From: "Min Xu" To: devel@edk2.groups.io Cc: Min M Xu , Leif Lindholm , Ard Biesheuvel , Abner Chang , Daniel Schaefer , Gerd Hoffmann , Erdem Aktas , James Bottomley , Jiewen Yao , Tom Lendacky Subject: [edk2-devel] [PATCH V2 1/4] EmbeddedPkg/PrePiLib: Add FFS_CHECK_SECTION_HOOK when finding section Date: Tue, 13 Dec 2022 14:24:06 +0800 Message-Id: <20221213062409.932-2-min.m.xu@intel.com> In-Reply-To: <20221213062409.932-1-min.m.xu@intel.com> References: <20221213062409.932-1-min.m.xu@intel.com> MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,min.m.xu@intel.com X-Gm-Message-State: L3cCUHMU1quaYZwP73enQylix1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1670912693; bh=v+zBoUT5hVa8WCLyuVYuKEpkR6sWL5HGpts6TuYHh30=; h=Cc:Date:From:Reply-To:Subject:To; b=ow8h5pukXLicfJotA7+hEmyCTgEGofrw3/N+aJ/Ybz/woUl8tnblW0LUI3NOeZpvEVE jS5GBIRhJic8U9Op1VMBiBxUusaaoIblna3J2qnMzTu943Yo9YQkkJMzqpTNv9Y+ycbB3 c65hIWxNOpHOLPvMW3ZaXRPS9XRb1M2DDDY= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1670912695928100004 Content-Type: text/plain; charset="utf-8" From: Min M Xu BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D4152 EmbeddedPkg/PrePiLib provides the service of finding sections based on the input SectionType. But sometimes there maybe multiple sections with the same SectionType. FFS_CHECK_SECTION_HOOK is a hook which can be called to do additional check. Cc: Leif Lindholm Cc: Ard Biesheuvel Cc: Abner Chang Cc: Daniel Schaefer Cc: Gerd Hoffmann Cc: Erdem Aktas Cc: James Bottomley Cc: Jiewen Yao Cc: Tom Lendacky Signed-off-by: Min Xu EmbeddedPkg Acked-by: Ard Biesheuvel --- EmbeddedPkg/Include/Library/PrePiLib.h | 23 +++++++++++--- EmbeddedPkg/Library/PrePiLib/FwVol.c | 42 ++++++++++++++++++------- EmbeddedPkg/Library/PrePiLib/PrePiLib.c | 2 +- 3 files changed, 49 insertions(+), 18 deletions(-) diff --git a/EmbeddedPkg/Include/Library/PrePiLib.h b/EmbeddedPkg/Include/L= ibrary/PrePiLib.h index 3741b08c4478..f60b6678185a 100644 --- a/EmbeddedPkg/Include/Library/PrePiLib.h +++ b/EmbeddedPkg/Include/Library/PrePiLib.h @@ -52,11 +52,23 @@ FfsFindNextFile ( IN OUT EFI_PEI_FILE_HANDLE *FileHandle ); =20 +/** + * This is a hook which is used to check if the section is the target one. + * + */ +typedef +EFI_STATUS +(EFIAPI *FFS_CHECK_SECTION_HOOK)( + IN EFI_COMMON_SECTION_HEADER *Section + ); + /** This service enables discovery sections of a given type within a valid F= FS file. + Caller also can provide a SectionCheckHook to do additional checking. =20 - @param SearchType The value of the section type to find. - @param FfsFileHeader A pointer to the file header that contains= the set of sections to + @param SectionType The value of the section type to find. + @param SectionCheckHook A hook which can check if the section is t= he target one. + @param FileHeader A pointer to the file header that contains= the set of sections to be searched. @param SectionData A pointer to the discovered section, if su= ccessful. =20 @@ -67,9 +79,10 @@ FfsFindNextFile ( EFI_STATUS EFIAPI FfsFindSectionData ( - IN EFI_SECTION_TYPE SectionType, - IN EFI_PEI_FILE_HANDLE FileHandle, - OUT VOID **SectionData + IN EFI_SECTION_TYPE SectionType, + IN FFS_CHECK_SECTION_HOOK SectionCheckHook, + IN EFI_PEI_FILE_HANDLE FileHandle, + OUT VOID **SectionData ); =20 /** diff --git a/EmbeddedPkg/Library/PrePiLib/FwVol.c b/EmbeddedPkg/Library/Pre= PiLib/FwVol.c index 0a6d6925b7ea..778d8b13c33b 100644 --- a/EmbeddedPkg/Library/PrePiLib/FwVol.c +++ b/EmbeddedPkg/Library/PrePiLib/FwVol.c @@ -264,16 +264,18 @@ FindFileEx ( Go through the file to search SectionType section, when meeting an encapsuled section. =20 - @param SectionType - Filter to find only section of this type. - @param Section - From where to search. - @param SectionSize - The file size to search. - @param OutputBuffer - Pointer to the section to search. + @param SectionType - Filter to find only section of this type. + @param SectionCheckHook - A hook which can check if the section is the= target one. + @param Section - From where to search. + @param SectionSize - The file size to search. + @param OutputBuffer - Pointer to the section to search. =20 @retval EFI_SUCCESS **/ EFI_STATUS FfsProcessSection ( IN EFI_SECTION_TYPE SectionType, + IN FFS_CHECK_SECTION_HOOK SectionCheckHook, IN EFI_COMMON_SECTION_HEADER *Section, IN UINTN SectionSize, OUT VOID **OutputBuffer @@ -292,7 +294,9 @@ FfsProcessSection ( UINT32 AuthenticationStatus; CHAR8 *CompressedData; UINT32 CompressedDataLength; + BOOLEAN Found; =20 + Found =3D FALSE; *OutputBuffer =3D NULL; ParsedLength =3D 0; Status =3D EFI_NOT_FOUND; @@ -302,13 +306,23 @@ FfsProcessSection ( } =20 if (Section->Type =3D=3D SectionType) { - if (IS_SECTION2 (Section)) { - *OutputBuffer =3D (VOID *)((UINT8 *)Section + sizeof (EFI_COMMON_S= ECTION_HEADER2)); + if (SectionCheckHook !=3D NULL) { + Found =3D SectionCheckHook (Section) =3D=3D EFI_SUCCESS; } else { - *OutputBuffer =3D (VOID *)((UINT8 *)Section + sizeof (EFI_COMMON_S= ECTION_HEADER)); + Found =3D TRUE; } =20 - return EFI_SUCCESS; + if (Found) { + if (IS_SECTION2 (Section)) { + *OutputBuffer =3D (VOID *)((UINT8 *)Section + sizeof (EFI_COMMON= _SECTION_HEADER2)); + } else { + *OutputBuffer =3D (VOID *)((UINT8 *)Section + sizeof (EFI_COMMON= _SECTION_HEADER)); + } + + return EFI_SUCCESS; + } else { + goto CheckNextSection; + } } else if ((Section->Type =3D=3D EFI_SECTION_COMPRESSION) || (Section-= >Type =3D=3D EFI_SECTION_GUID_DEFINED)) { if (Section->Type =3D=3D EFI_SECTION_COMPRESSION) { if (IS_SECTION2 (Section)) { @@ -415,6 +429,7 @@ FfsProcessSection ( } else { return FfsProcessSection ( SectionType, + SectionCheckHook, DstBuffer, DstBufferSize, OutputBuffer @@ -422,6 +437,7 @@ FfsProcessSection ( } } =20 +CheckNextSection: if (IS_SECTION2 (Section)) { SectionLength =3D SECTION2_SIZE (Section); } else { @@ -456,9 +472,10 @@ FfsProcessSection ( EFI_STATUS EFIAPI FfsFindSectionData ( - IN EFI_SECTION_TYPE SectionType, - IN EFI_PEI_FILE_HANDLE FileHandle, - OUT VOID **SectionData + IN EFI_SECTION_TYPE SectionType, + IN FFS_CHECK_SECTION_HOOK SectionCheckHook, + IN EFI_PEI_FILE_HANDLE FileHandle, + OUT VOID **SectionData ) { EFI_FFS_FILE_HEADER *FfsFileHeader; @@ -478,6 +495,7 @@ FfsFindSectionData ( =20 return FfsProcessSection ( SectionType, + SectionCheckHook, Section, FileSize, SectionData @@ -799,7 +817,7 @@ FfsProcessFvFile ( // // Find FvImage in FvFile // - Status =3D FfsFindSectionData (EFI_SECTION_FIRMWARE_VOLUME_IMAGE, FvFile= Handle, (VOID **)&FvImageHandle); + Status =3D FfsFindSectionData (EFI_SECTION_FIRMWARE_VOLUME_IMAGE, NULL, = FvFileHandle, (VOID **)&FvImageHandle); if (EFI_ERROR (Status)) { return Status; } diff --git a/EmbeddedPkg/Library/PrePiLib/PrePiLib.c b/EmbeddedPkg/Library/= PrePiLib/PrePiLib.c index a0c5d02debd0..3b6fc4f0eba8 100644 --- a/EmbeddedPkg/Library/PrePiLib/PrePiLib.c +++ b/EmbeddedPkg/Library/PrePiLib/PrePiLib.c @@ -131,7 +131,7 @@ LoadDxeCoreFromFfsFile ( VOID *Hob; EFI_FV_FILE_INFO FvFileInfo; =20 - Status =3D FfsFindSectionData (EFI_SECTION_PE32, FileHandle, &PeCoffImag= e); + Status =3D FfsFindSectionData (EFI_SECTION_PE32, NULL, FileHandle, &PeCo= ffImage); if (EFI_ERROR (Status)) { return Status; } --=20 2.29.2.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#97296): https://edk2.groups.io/g/devel/message/97296 Mute This Topic: https://groups.io/mt/95640159/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Sun Apr 28 09:34:45 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+97297+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+97297+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1670912694; cv=none; d=zohomail.com; s=zohoarc; b=UdRvMy/GhkQ6GnHf9WaVJ1nsGCNMCM8FrnGJvkkYT2UBb6DQCtAnYiPYtdLekQxQWhO0vTFJyiELMJ4gzKNFPNk9ppyL+TjnSXv9G3qKAulzZdLXyr3zRLKx6z2Ch/T+wf3OfPfCZpALvXHhXVgFx3zgEebBSHduThBF1wslE0Y= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1670912694; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=dhf5FeNy5RMW7Hqo0q1GemBT4rjuXCYz3feGmh5EVPY=; b=Yi8zyY62z1BzaLfRoReb+q2Mo5QqCk5rSUa/9JQMIHuY5SjqVfusNyJpOD5NBU1yv1zhfoemNKijMSC6V1+S/7q0WWXK7vKg5G2q/pAidoMNQX1Z0dbsD9T8flaK7gQTlAPA+FyJy/p8lKH+DFrj6h3SMbhvvdx1IaMJ2XQ5wF0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+97297+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1670912694361977.7793547882756; Mon, 12 Dec 2022 22:24:54 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id ROT9YY1788612xZhHMg380I1; Mon, 12 Dec 2022 22:24:54 -0800 X-Received: from mga01.intel.com (mga01.intel.com [192.55.52.88]) by mx.groups.io with SMTP id smtpd.web11.67466.1670912693041909926 for ; Mon, 12 Dec 2022 22:24:53 -0800 X-IronPort-AV: E=McAfee;i="6500,9779,10559"; a="345116443" X-IronPort-AV: E=Sophos;i="5.96,240,1665471600"; d="scan'208";a="345116443" X-Received: from orsmga008.jf.intel.com ([10.7.209.65]) by fmsmga101.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 12 Dec 2022 22:24:30 -0800 X-IronPort-AV: E=McAfee;i="6500,9779,10559"; a="679199538" X-IronPort-AV: E=Sophos;i="5.96,240,1665471600"; d="scan'208";a="679199538" X-Received: from mxu9-mobl1.ccr.corp.intel.com ([10.249.170.38]) by orsmga008-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 12 Dec 2022 22:24:28 -0800 From: "Min Xu" To: devel@edk2.groups.io Cc: Min M Xu , Gerd Hoffmann , Erdem Aktas , James Bottomley , Jiewen Yao , Tom Lendacky Subject: [edk2-devel] [PATCH V2 2/4] OvmfPkg: Add PCDs/GUID for NCCFV Date: Tue, 13 Dec 2022 14:24:07 +0800 Message-Id: <20221213062409.932-3-min.m.xu@intel.com> In-Reply-To: <20221213062409.932-1-min.m.xu@intel.com> References: <20221213062409.932-1-min.m.xu@intel.com> MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,min.m.xu@intel.com X-Gm-Message-State: u5cOtWrySCajDRWXI5lg9y2Ux1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1670912694; bh=9z9Z2COmkgHWtTYBrYwm/Oj+MJb5cBe83qQxyIANPFM=; h=Cc:Date:From:Reply-To:Subject:To; b=NrnVdXohXdfi7IVqgdhUF6l58FGFKWRM4QYaJFA+Dce7KfYiH6ByBDPxTvGqOJhG4pC aagatV2JRYYKrdF7TbH5M4xWV0RvNq8eaSBLHjmbbDIfs2LZEbI8EryZDXQ4pKOIY2HFS JkhrOBTr/6PkgF9xZbt1dG5ar5c9C8bCsBg= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1670912695919100002 Content-Type: text/plain; charset="utf-8" From: Min M Xu BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D4152 NCCFV refers to Non-Confidential-Computing-FV. It includes the DXE phase drivers which are only loaded/started in non-cc guest. Hence the PCDs / GUID for NCCFV are defined in OvmfPkg.dec. Cc: Gerd Hoffmann Cc: Erdem Aktas Cc: James Bottomley Cc: Jiewen Yao Cc: Tom Lendacky Signed-off-by: Min Xu --- OvmfPkg/OvmfPkg.dec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec index 5f5556c67c6c..64148e67026e 100644 --- a/OvmfPkg/OvmfPkg.dec +++ b/OvmfPkg/OvmfPkg.dec @@ -151,6 +151,7 @@ gConfidentialComputingSevSnpBlobGuid =3D {0x067b1f5f, 0xcf26, 0x44c5, {= 0x85, 0x54, 0x93, 0xd7, 0x77, 0x91, 0x2d, 0x42}} gUefiOvmfPkgPlatformInfoGuid =3D {0xdec9b486, 0x1f16, 0x47c7, {= 0x8f, 0x68, 0xdf, 0x1a, 0x41, 0x88, 0x8b, 0xa5}} gVMMBootOrderGuid =3D {0x668f4529, 0x63d0, 0x4bb5, {= 0xb6, 0x5d, 0x6f, 0xbb, 0x9d, 0x36, 0xa4, 0x4a}} + gEfiNonCcFvGuid =3D {0xae047c6d, 0xbce9, 0x426c, {= 0xae, 0x03, 0xa6, 0x8e, 0x3b, 0x8a, 0x04, 0x88}} =20 [Ppis] # PPI whose presence in the PPI database signals that the TPM base addre= ss @@ -187,6 +188,8 @@ gUefiOvmfPkgTokenSpaceGuid.PcdOvmfPeiMemFvSize|0x0|UINT32|1 gUefiOvmfPkgTokenSpaceGuid.PcdOvmfDxeMemFvBase|0x0|UINT32|0x15 gUefiOvmfPkgTokenSpaceGuid.PcdOvmfDxeMemFvSize|0x0|UINT32|0x16 + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfDxeNonCcFvBase|0x0|UINT32|0x6a + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfDxeNonCcFvSize|0x0|UINT32|0x6b =20 ## This flag is used to control the destination port for PlatformDebugLi= bIoPort gUefiOvmfPkgTokenSpaceGuid.PcdDebugIoPort|0x402|UINT16|4 --=20 2.29.2.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#97297): https://edk2.groups.io/g/devel/message/97297 Mute This Topic: https://groups.io/mt/95640160/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Sun Apr 28 09:34:45 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+97298+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+97298+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1670912695; cv=none; d=zohomail.com; s=zohoarc; b=fLw1437f4BHS6vDPlowYkgDaqfHxHbATpWOWEWnfMy1HUOL4N8xg1lbEnwUgOZw5ehFRDX8mb8Z1svkVkUQp8D866rJNO43vQKNXq+0g6J28IaF3x9ihlAiXJlV5IrnE34pX+G1mvDGYFnLOFVkdvoKiQhijyNPwi4p0VxUFTPc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1670912695; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=6qp/pBSLzh99V8+vYXylwwc12fftgYl+avDrYWbVHo4=; b=b17eiz7vJaVXdX1OmgDc+0IIsgQrassW4h9GNYJr6WegaOtstTaNUuWNu2GkJAXpRlSVsmXYst4IN3zB/ZAftWH52lMrfod7O4u0fq1rf8uu7XHOpvfDoNMkcAfOwgjZKO0Cio+NybSPsEhAPw6dvoddbvGFH0GTaXMyCybLzio= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+97298+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1670912695039325.1965539497538; Mon, 12 Dec 2022 22:24:55 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id b57TYY1788612xbWubAqXftz; Mon, 12 Dec 2022 22:24:54 -0800 X-Received: from mga01.intel.com (mga01.intel.com [192.55.52.88]) by mx.groups.io with SMTP id smtpd.web11.67466.1670912693041909926 for ; Mon, 12 Dec 2022 22:24:53 -0800 X-IronPort-AV: E=McAfee;i="6500,9779,10559"; a="345116453" X-IronPort-AV: E=Sophos;i="5.96,240,1665471600"; d="scan'208";a="345116453" X-Received: from orsmga008.jf.intel.com ([10.7.209.65]) by fmsmga101.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 12 Dec 2022 22:24:33 -0800 X-IronPort-AV: E=McAfee;i="6500,9779,10559"; a="679199556" X-IronPort-AV: E=Sophos;i="5.96,240,1665471600"; d="scan'208";a="679199556" X-Received: from mxu9-mobl1.ccr.corp.intel.com ([10.249.170.38]) by orsmga008-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 12 Dec 2022 22:24:31 -0800 From: "Min Xu" To: devel@edk2.groups.io Cc: Min M Xu , Gerd Hoffmann , Erdem Aktas , James Bottomley , Jiewen Yao , Tom Lendacky Subject: [edk2-devel] [PATCH V2 3/4] OvmfPkg/IntelTdx: Enable separate-fv in IntelTdx/IntelTdxX64.fdf Date: Tue, 13 Dec 2022 14:24:08 +0800 Message-Id: <20221213062409.932-4-min.m.xu@intel.com> In-Reply-To: <20221213062409.932-1-min.m.xu@intel.com> References: <20221213062409.932-1-min.m.xu@intel.com> MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,min.m.xu@intel.com X-Gm-Message-State: ulVuxrbFjOQQnKN3Rs8cIkslx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1670912694; bh=wx233aC7wq28YyT6D6VG4BPYSdXu/7XLnSwBaMW3zqs=; h=Cc:Date:From:Reply-To:Subject:To; b=rO13XklCQnODqiLdgHeomOoGUYOKK+Mpor4uyiZU4k7V/l7pQOGrKBDoj/nU5iG9z5Z DbDXoNQWUKvlyFqjMM/rj7J6u7SPcXltMQi/iokfzAWxMQhT7W++9UZCbAHvPkEtSZrxn nX4P6RbSFvF+c2M6JOU0dv0Z8gWTFLxpu3k= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1670912695954100007 Content-Type: text/plain; charset="utf-8" From: Min M Xu BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D4152 In current DXE FV there are 100+ drivers. Some of the drivers are not used in Td guest. (Such as USB support drivers, network related drivers, etc). From the security perspective if a driver is not used, we'd should prevent it from being loaded / started. There are 2 benefits: 1. Reduce the attack surface 2. Improve the boot performance So we separate DXEFV into 2 FVs: DXEFV and NCCFV. All the drivers which are not needed by a Confidential Computing guest are moved from DXEFV to NCCFV. The following patch will find NCCFV for non-cc guest and build FVHob so that NCCFV drivers can be loaded / started in DXE phase. Cc: Gerd Hoffmann Cc: Erdem Aktas Cc: James Bottomley Cc: Jiewen Yao Cc: Tom Lendacky Signed-off-by: Min Xu --- OvmfPkg/IntelTdx/IntelTdxX64.dsc | 11 ++- OvmfPkg/IntelTdx/IntelTdxX64.fdf | 112 ++++++++++++++++++++----------- 2 files changed, 83 insertions(+), 40 deletions(-) diff --git a/OvmfPkg/IntelTdx/IntelTdxX64.dsc b/OvmfPkg/IntelTdx/IntelTdxX6= 4.dsc index 345892651520..50db9006644a 100644 --- a/OvmfPkg/IntelTdx/IntelTdxX64.dsc +++ b/OvmfPkg/IntelTdx/IntelTdxX64.dsc @@ -31,6 +31,11 @@ # DEFINE SECURE_BOOT_ENABLE =3D FALSE =20 + # + # Shell can be useful for debugging but should not be enabled for produc= tion + # + DEFINE BUILD_SHELL =3D TRUE + # # Device drivers # @@ -204,7 +209,9 @@ VariablePolicyHelperLib|MdeModulePkg/Library/VariablePolicyHelperLib/Var= iablePolicyHelperLib.inf VariableFlashInfoLib|MdeModulePkg/Library/BaseVariableFlashInfoLib/BaseV= ariableFlashInfoLib.inf =20 +!if $(BUILD_SHELL) =3D=3D TRUE ShellLib|ShellPkg/Library/UefiShellLib/UefiShellLib.inf +!endif ShellCEntryLib|ShellPkg/Library/UefiShellCEntryLib/UefiShellCEntryLib.inf S3BootScriptLib|MdeModulePkg/Library/PiDxeS3BootScriptLib/DxeS3BootScrip= tLib.inf SmbusLib|MdePkg/Library/BaseSmbusLibNull/BaseSmbusLibNull.inf @@ -719,12 +726,13 @@ MdeModulePkg/Bus/Usb/UsbKbDxe/UsbKbDxe.inf MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf =20 -!if $(TOOL_CHAIN_TAG) !=3D "XCODE5" +!if $(TOOL_CHAIN_TAG) !=3D "XCODE5" && $(BUILD_SHELL) =3D=3D TRUE OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.in= f { gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE } !endif +!if $(BUILD_SHELL) =3D=3D TRUE ShellPkg/Application/Shell/Shell.inf { ShellCommandLib|ShellPkg/Library/UefiShellCommandLib/UefiShellComman= dLib.inf @@ -743,6 +751,7 @@ gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE gEfiMdePkgTokenSpaceGuid.PcdUefiLibMaxPrintBufferSize|8000 } +!endif =20 !if $(SECURE_BOOT_ENABLE) =3D=3D TRUE SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDx= e.inf diff --git a/OvmfPkg/IntelTdx/IntelTdxX64.fdf b/OvmfPkg/IntelTdx/IntelTdxX6= 4.fdf index e79ad3e10217..7e18d3f021d0 100644 --- a/OvmfPkg/IntelTdx/IntelTdxX64.fdf +++ b/OvmfPkg/IntelTdx/IntelTdxX64.fdf @@ -97,10 +97,14 @@ gUefiOvmfPkgTokenSpaceGuid.PcdOvmfCpuidBase|gUefiOvmfPk= gTokenSpaceGuid.PcdOvmfCp 0x010000|0x010000 gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecPeiTempRamBase|gUefiOvmfPkgTokenSpace= Guid.PcdOvmfSecPeiTempRamSize =20 -0x100000|0xC00000 +0x100000|0x700000 gUefiOvmfPkgTokenSpaceGuid.PcdOvmfDxeMemFvBase|gUefiOvmfPkgTokenSpaceGuid.= PcdOvmfDxeMemFvSize FV =3D DXEFV =20 +0x800000|0x500000 +gUefiOvmfPkgTokenSpaceGuid.PcdOvmfDxeNonCcFvBase|gUefiOvmfPkgTokenSpaceGui= d.PcdOvmfDxeNonCcFvSize +FV =3D NCCFV + ##########################################################################= ################ # Set the SEV-ES specific work area PCDs # @@ -183,7 +187,6 @@ INF MdeModulePkg/Universal/PCD/Dxe/Pcd.inf =20 INF MdeModulePkg/Core/RuntimeDxe/RuntimeDxe.inf INF MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf -INF MdeModulePkg/Universal/EbcDxe/EbcDxe.inf INF UefiCpuPkg/CpuIo2Dxe/CpuIo2Dxe.inf =20 INF UefiCpuPkg/CpuDxe/CpuDxe.inf @@ -201,17 +204,6 @@ INF PcAtChipsetPkg/PcatRealTimeClockRuntimeDxe/PcatRe= alTimeClockRuntimeDxe.inf INF OvmfPkg/VirtioPciDeviceDxe/VirtioPciDeviceDxe.inf INF OvmfPkg/Virtio10Dxe/Virtio10.inf INF OvmfPkg/VirtioBlkDxe/VirtioBlk.inf -INF OvmfPkg/VirtioScsiDxe/VirtioScsi.inf -INF OvmfPkg/VirtioRngDxe/VirtioRng.inf -!if $(PVSCSI_ENABLE) =3D=3D TRUE -INF OvmfPkg/PvScsiDxe/PvScsiDxe.inf -!endif -!if $(MPT_SCSI_ENABLE) =3D=3D TRUE -INF OvmfPkg/MptScsiDxe/MptScsiDxe.inf -!endif -!if $(LSI_SCSI_ENABLE) =3D=3D TRUE -INF OvmfPkg/LsiScsiDxe/LsiScsiDxe.inf -!endif =20 !if $(SECURE_BOOT_ENABLE) =3D=3D TRUE INF SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootCon= figDxe.inf @@ -222,19 +214,14 @@ INF MdeModulePkg/Universal/MonotonicCounterRuntimeDx= e/MonotonicCounterRuntimeDx INF MdeModulePkg/Universal/CapsuleRuntimeDxe/CapsuleRuntimeDxe.inf INF MdeModulePkg/Universal/Console/ConPlatformDxe/ConPlatformDxe.inf INF MdeModulePkg/Universal/Console/ConSplitterDxe/ConSplitterDxe.inf -INF MdeModulePkg/Universal/Console/GraphicsConsoleDxe/GraphicsConsoleDxe.= inf INF MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf -INF MdeModulePkg/Universal/DriverHealthManagerDxe/DriverHealthManagerDxe.= inf INF MdeModulePkg/Universal/BdsDxe/BdsDxe.inf INF MdeModulePkg/Application/UiApp/UiApp.inf INF OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.inf INF MdeModulePkg/Universal/DevicePathDxe/DevicePathDxe.inf INF MdeModulePkg/Universal/Disk/DiskIoDxe/DiskIoDxe.inf INF MdeModulePkg/Universal/Disk/PartitionDxe/PartitionDxe.inf -INF MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf INF MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf -INF MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf -INF MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf INF OvmfPkg/SataControllerDxe/SataControllerDxe.inf INF MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf INF MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf @@ -242,34 +229,94 @@ INF MdeModulePkg/Bus/Pci/NvmExpressDxe/NvmExpressDxe= .inf INF MdeModulePkg/Universal/HiiDatabaseDxe/HiiDatabaseDxe.inf INF MdeModulePkg/Universal/SetupBrowserDxe/SetupBrowserDxe.inf INF MdeModulePkg/Universal/DisplayEngineDxe/DisplayEngineDxe.inf -INF MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe= .inf =20 INF OvmfPkg/SioBusDxe/SioBusDxe.inf INF MdeModulePkg/Bus/Pci/PciSioSerialDxe/PciSioSerialDxe.inf -INF MdeModulePkg/Bus/Isa/Ps2KeyboardDxe/Ps2KeyboardDxe.inf =20 INF MdeModulePkg/Universal/SmbiosDxe/SmbiosDxe.inf INF OvmfPkg/SmbiosPlatformDxe/SmbiosPlatformDxe.inf =20 INF MdeModulePkg/Universal/Acpi/AcpiTableDxe/AcpiTableDxe.inf INF OvmfPkg/AcpiPlatformDxe/AcpiPlatformDxe.inf + +INF FatPkg/EnhancedFatDxe/Fat.inf +INF OvmfPkg/TdxDxe/TdxDxe.inf + +INF OvmfPkg/IoMmuDxe/IoMmuDxe.inf + +# +# Variable driver stack (non-SMM) +# +INF OvmfPkg/QemuFlashFvbServicesRuntimeDxe/FvbServicesRuntimeDxe.inf +INF OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.inf +INF MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf +INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf + +# +# EFI_CC_MEASUREMENT_PROTOCOL +# +INF OvmfPkg/IntelTdx/TdTcg2Dxe/TdTcg2Dxe.inf + +##########################################################################= ###### + +[FV.NCCFV] +FvForceRebase =3D FALSE +FvNameGuid =3D AE047C6D-BCE9-426C-AE03-A68E3B8A0488 +BlockSize =3D 0x10000 +FvAlignment =3D 16 +ERASE_POLARITY =3D 1 +MEMORY_MAPPED =3D TRUE +STICKY_WRITE =3D TRUE +LOCK_CAP =3D TRUE +LOCK_STATUS =3D TRUE +WRITE_DISABLED_CAP =3D TRUE +WRITE_ENABLED_CAP =3D TRUE +WRITE_STATUS =3D TRUE +WRITE_LOCK_CAP =3D TRUE +WRITE_LOCK_STATUS =3D TRUE +READ_DISABLED_CAP =3D TRUE +READ_ENABLED_CAP =3D TRUE +READ_STATUS =3D TRUE +READ_LOCK_CAP =3D TRUE +READ_LOCK_STATUS =3D TRUE + +# +# DXE Phase modules +# +INF MdeModulePkg/Universal/EbcDxe/EbcDxe.inf +INF OvmfPkg/VirtioScsiDxe/VirtioScsi.inf +INF OvmfPkg/VirtioRngDxe/VirtioRng.inf +!if $(PVSCSI_ENABLE) =3D=3D TRUE +INF OvmfPkg/PvScsiDxe/PvScsiDxe.inf +!endif +!if $(MPT_SCSI_ENABLE) =3D=3D TRUE +INF OvmfPkg/MptScsiDxe/MptScsiDxe.inf +!endif +!if $(LSI_SCSI_ENABLE) =3D=3D TRUE +INF OvmfPkg/LsiScsiDxe/LsiScsiDxe.inf +!endif +INF MdeModulePkg/Universal/Console/GraphicsConsoleDxe/GraphicsConsoleDxe.= inf +INF MdeModulePkg/Universal/DriverHealthManagerDxe/DriverHealthManagerDxe.= inf +INF MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf +INF MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf +INF MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf +INF MdeModulePkg/Universal/MemoryTest/NullMemoryTestDxe/NullMemoryTestDxe= .inf +INF MdeModulePkg/Bus/Isa/Ps2KeyboardDxe/Ps2KeyboardDxe.inf INF MdeModulePkg/Universal/Acpi/S3SaveStateDxe/S3SaveStateDxe.inf INF MdeModulePkg/Universal/Acpi/BootScriptExecutorDxe/BootScriptExecutorD= xe.inf INF MdeModulePkg/Universal/Acpi/BootGraphicsResourceTableDxe/BootGraphics= ResourceTableDxe.inf - -INF FatPkg/EnhancedFatDxe/Fat.inf INF MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf INF OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf =20 -!if $(TOOL_CHAIN_TAG) !=3D "XCODE5" +!if $(BUILD_SHELL) =3D=3D TRUE && $(TOOL_CHAIN_TAG) !=3D "XCODE5" INF OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand= .inf !endif +!if $(BUILD_SHELL) =3D=3D TRUE INF ShellPkg/Application/Shell/Shell.inf +!endif =20 INF MdeModulePkg/Logo/LogoDxe.inf =20 -INF OvmfPkg/TdxDxe/TdxDxe.inf - # # Usb Support # @@ -285,20 +332,6 @@ INF OvmfPkg/QemuVideoDxe/QemuVideoDxe.inf INF OvmfPkg/QemuRamfbDxe/QemuRamfbDxe.inf INF OvmfPkg/VirtioGpuDxe/VirtioGpu.inf INF OvmfPkg/PlatformDxe/Platform.inf -INF OvmfPkg/IoMmuDxe/IoMmuDxe.inf - -# -# Variable driver stack (non-SMM) -# -INF OvmfPkg/QemuFlashFvbServicesRuntimeDxe/FvbServicesRuntimeDxe.inf -INF OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.inf -INF MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf -INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf - -# -# EFI_CC_MEASUREMENT_PROTOCOL -# -INF OvmfPkg/IntelTdx/TdTcg2Dxe/TdTcg2Dxe.inf =20 ##########################################################################= ###### =20 @@ -329,6 +362,7 @@ FILE FV_IMAGE =3D 9E21FD93-9C72-4c15-8C4B-E77F1DB2D792 { # compression operation in order to achieve better overall compressio= n. # SECTION FV_IMAGE =3D DXEFV + SECTION FV_IMAGE =3D NCCFV } } =20 --=20 2.29.2.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#97298): https://edk2.groups.io/g/devel/message/97298 Mute This Topic: https://groups.io/mt/95640161/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Sun Apr 28 09:34:45 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+97299+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+97299+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1670912696; cv=none; d=zohomail.com; s=zohoarc; b=jcUjqi1MHGsyPcJczkbPyumjImiYao6yxg4PX0oIjOYkydlSrYoRwVTH7pwjddPah39ejd9/iUZKXADBzL26f18pLZyY9IK2A0zSnOrgNakwXpqtPmjaRLpX2VGUYwljC6HLh66hwqGmypIqHqLJ0cV6Dpz6R16qU/BXrS2WfNM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1670912696; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=lLQKeLHnav/WeJDCtsl8pmF5WMVUoGP1o/GPOtD2GvM=; b=j8/k9YaD5Izl023+CxuHPk1IY1IzzMXbR1qgMm1p4AGL9AqYpmN22H273QtU0WgFqq/gr8NTJyfUNb0qzDUh4YZTsSc9JCh6GZc5ykONqkEOMkJNzi2ia4jaVKgR5YOqKzDqnOMv0LYJ9bZGBWF4PUpsWhPHb3g2cn2Ce9AJmbY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+97299+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1670912695885227.31995635161854; Mon, 12 Dec 2022 22:24:55 -0800 (PST) Return-Path: X-Received: by 127.0.0.2 with SMTP id hh2gYY1788612x60C8cKgRAD; Mon, 12 Dec 2022 22:24:55 -0800 X-Received: from mga01.intel.com (mga01.intel.com [192.55.52.88]) by mx.groups.io with SMTP id smtpd.web11.67466.1670912693041909926 for ; Mon, 12 Dec 2022 22:24:54 -0800 X-IronPort-AV: E=McAfee;i="6500,9779,10559"; a="345116465" X-IronPort-AV: E=Sophos;i="5.96,240,1665471600"; d="scan'208";a="345116465" X-Received: from orsmga008.jf.intel.com ([10.7.209.65]) by fmsmga101.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 12 Dec 2022 22:24:35 -0800 X-IronPort-AV: E=McAfee;i="6500,9779,10559"; a="679199566" X-IronPort-AV: E=Sophos;i="5.96,240,1665471600"; d="scan'208";a="679199566" X-Received: from mxu9-mobl1.ccr.corp.intel.com ([10.249.170.38]) by orsmga008-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 12 Dec 2022 22:24:33 -0800 From: "Min Xu" To: devel@edk2.groups.io Cc: Min M Xu , Gerd Hoffmann , Erdem Aktas , James Bottomley , Jiewen Yao , Tom Lendacky Subject: [edk2-devel] [PATCH V2 4/4] OvmfPkg/PeilessStartupLib: Find NCCFV in non-td guest Date: Tue, 13 Dec 2022 14:24:09 +0800 Message-Id: <20221213062409.932-5-min.m.xu@intel.com> In-Reply-To: <20221213062409.932-1-min.m.xu@intel.com> References: <20221213062409.932-1-min.m.xu@intel.com> MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,min.m.xu@intel.com X-Gm-Message-State: AHYEngj6FTPpQ8H5nIdAZuVWx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1670912695; bh=BOOzm+8WbZhFERsI4aHg/8B8L4rcUSoP1LO3do+XEFU=; h=Cc:Date:From:Reply-To:Subject:To; b=nFsF0TT/lyhVpUDBhhlvaF018dc/m4MsM7GhWSJuEu2gQZ0X7qwlXpIRQAvNvT3rp0T LQ21n9mfOLK3QsM8Hbyyrp3E6I4kBLfyaHK0BYgXX21OgbPNSOSyvhvmHiDxNECrStpw2 FoNbvbXjPFDj43UIoXWAym4TQga5PKViS1Y= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1670912698088100001 Content-Type: text/plain; charset="utf-8" From: Min M Xu BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D4152 As described in BZ#4152, NCCFV includes the DXE phase drivers for non-cc guest. PeilessStartupLib is updated to find NCCFV for non-cc guest. Cc: Gerd Hoffmann Cc: Erdem Aktas Cc: James Bottomley Cc: Jiewen Yao Cc: Tom Lendacky Signed-off-by: Min Xu --- OvmfPkg/Library/PeilessStartupLib/DxeLoad.c | 134 +++++++++++++++++- .../PeilessStartupInternal.h | 6 + .../PeilessStartupLib/PeilessStartupLib.inf | 1 + 3 files changed, 140 insertions(+), 1 deletion(-) diff --git a/OvmfPkg/Library/PeilessStartupLib/DxeLoad.c b/OvmfPkg/Library/= PeilessStartupLib/DxeLoad.c index 6e79c3084672..4b1fefd452dc 100644 --- a/OvmfPkg/Library/PeilessStartupLib/DxeLoad.c +++ b/OvmfPkg/Library/PeilessStartupLib/DxeLoad.c @@ -22,6 +22,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #include =20 #define STACK_SIZE 0x20000 +extern EFI_GUID gEfiNonCcFvGuid; =20 /** Transfers control to DxeCore. @@ -136,6 +137,133 @@ FindDxeCore ( return Status; } =20 +/** + * This is a FFS_CHECK_SECTION_HOOK which is defined by caller to check + * if the section is an EFI_SECTION_FIRMWARE_VOLUME_IMAGE and if it is + * a NonCc FV. + * + * @param Section The section in which we're checking for the NonCc = FV. + * @return EFI_STATUS The section is the NonCc FV. + */ +EFI_STATUS +EFIAPI +CheckSectionHookForDxeNonCc ( + IN EFI_COMMON_SECTION_HEADER *Section + ) +{ + VOID *Buffer; + EFI_STATUS Status; + EFI_FV_INFO FvImageInfo; + + if (Section->Type !=3D EFI_SECTION_FIRMWARE_VOLUME_IMAGE) { + return EFI_INVALID_PARAMETER; + } + + if (IS_SECTION2 (Section)) { + Buffer =3D (VOID *)((UINT8 *)Section + sizeof (EFI_COMMON_SECTION_HEAD= ER2)); + } else { + Buffer =3D (VOID *)((UINT8 *)Section + sizeof (EFI_COMMON_SECTION_HEAD= ER)); + } + + ZeroMem (&FvImageInfo, sizeof (FvImageInfo)); + Status =3D FfsGetVolumeInfo ((EFI_PEI_FV_HANDLE)(UINTN)Buffer, &FvImageI= nfo); + if (EFI_ERROR (Status)) { + DEBUG ((DEBUG_INFO, "Cannot get volume info! %r\n", Status)); + return Status; + } + + return CompareGuid (&FvImageInfo.FvName, &gEfiNonCcFvGuid) ? EFI_SUCCESS= : EFI_NOT_FOUND; +} + +/** + * Find the NonCc FV. + * + * @param FvInstance The FvInstance number. + * @return EFI_STATUS Successfuly find the NonCc FV. + */ +EFI_STATUS +EFIAPI +FindDxeNonCc ( + IN INTN FvInstance + ) +{ + EFI_STATUS Status; + EFI_PEI_FV_HANDLE VolumeHandle; + EFI_PEI_FILE_HANDLE FileHandle; + EFI_PEI_FV_HANDLE FvImageHandle; + EFI_FV_INFO FvImageInfo; + UINT32 FvAlignment; + VOID *FvBuffer; + + FileHandle =3D NULL; + + // + // Caller passed in a specific FV to try, so only try that one + // + Status =3D FfsFindNextVolume (FvInstance, &VolumeHandle); + ASSERT (Status =3D=3D EFI_SUCCESS); + + Status =3D FfsFindNextFile (EFI_FV_FILETYPE_FIRMWARE_VOLUME_IMAGE, Volum= eHandle, &FileHandle); + ASSERT (FileHandle !=3D NULL); + + // + // Find FvImage in FvFile + // + Status =3D FfsFindSectionData (EFI_SECTION_FIRMWARE_VOLUME_IMAGE, CheckS= ectionHookForDxeNonCc, FileHandle, (VOID **)&FvImageHandle); + if (EFI_ERROR (Status)) { + return Status; + } + + // + // Collect FvImage Info. + // + ZeroMem (&FvImageInfo, sizeof (FvImageInfo)); + Status =3D FfsGetVolumeInfo (FvImageHandle, &FvImageInfo); + ASSERT_EFI_ERROR (Status); + + // + // FvAlignment must be more than 8 bytes required by FvHeader structure. + // + FvAlignment =3D 1 << ((FvImageInfo.FvAttributes & EFI_FVB2_ALIGNMENT) >>= 16); + if (FvAlignment < 8) { + FvAlignment =3D 8; + } + + // + // Check FvImage + // + if ((UINTN)FvImageInfo.FvStart % FvAlignment !=3D 0) { + FvBuffer =3D AllocateAlignedPages (EFI_SIZE_TO_PAGES ((UINT32)FvImageI= nfo.FvSize), FvAlignment); + if (FvBuffer =3D=3D NULL) { + return EFI_OUT_OF_RESOURCES; + } + + CopyMem (FvBuffer, FvImageInfo.FvStart, (UINTN)FvImageInfo.FvSize); + // + // Update FvImageInfo after reload FvImage to new aligned memory + // + FfsGetVolumeInfo ((EFI_PEI_FV_HANDLE)FvBuffer, &FvImageInfo); + } + + // + // Inform HOB consumer phase, i.e. DXE core, the existence of this FV + // + BuildFvHob ((EFI_PHYSICAL_ADDRESS)(UINTN)FvImageInfo.FvStart, FvImageInf= o.FvSize); + + // + // Makes the encapsulated volume show up in DXE phase to skip processing= of + // encapsulated file again. + // + BuildFv2Hob ( + (EFI_PHYSICAL_ADDRESS)(UINTN)FvImageInfo.FvStart, + FvImageInfo.FvSize, + &FvImageInfo.FvName, + &(((EFI_FFS_FILE_HEADER *)FileHandle)->Name) + ); + + return Status; +} + /** This function finds DXE Core in the firmware volume and transfer the co= ntrol to DXE core. @@ -168,10 +296,14 @@ DxeLoadCore ( return Status; } =20 + if (!TdIsEnabled ()) { + FindDxeNonCc (FvInstance); + } + // // Load the DXE Core from a Firmware Volume. // - Status =3D FfsFindSectionData (EFI_SECTION_PE32, FileHandle, &PeCoffImag= e); + Status =3D FfsFindSectionData (EFI_SECTION_PE32, NULL, FileHandle, &PeCo= ffImage); if (EFI_ERROR (Status)) { return Status; } diff --git a/OvmfPkg/Library/PeilessStartupLib/PeilessStartupInternal.h b/O= vmfPkg/Library/PeilessStartupLib/PeilessStartupInternal.h index 09cac3e26c67..f56bc3578e5e 100644 --- a/OvmfPkg/Library/PeilessStartupLib/PeilessStartupInternal.h +++ b/OvmfPkg/Library/PeilessStartupLib/PeilessStartupInternal.h @@ -21,6 +21,12 @@ DxeLoadCore ( IN INTN FvInstance ); =20 +EFI_STATUS +EFIAPI +FindDxeNonCc ( + IN INTN FvInstance + ); + VOID EFIAPI TransferHobList ( diff --git a/OvmfPkg/Library/PeilessStartupLib/PeilessStartupLib.inf b/Ovmf= Pkg/Library/PeilessStartupLib/PeilessStartupLib.inf index def50b4b019e..5c6eb1597bea 100644 --- a/OvmfPkg/Library/PeilessStartupLib/PeilessStartupLib.inf +++ b/OvmfPkg/Library/PeilessStartupLib/PeilessStartupLib.inf @@ -67,6 +67,7 @@ gEfiMemoryTypeInformationGuid gPcdDataBaseHobGuid gCcEventEntryHobGuid + gEfiNonCcFvGuid =20 [Pcd] gUefiOvmfPkgTokenSpaceGuid.PcdCfvBase --=20 2.29.2.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#97299): https://edk2.groups.io/g/devel/message/97299 Mute This Topic: https://groups.io/mt/95640162/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-