From nobody Sat May 4 00:27:45 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+90753+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+90753+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1656212773750440.283059691978; Sat, 25 Jun 2022 20:06:13 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id ViyoYY1788612xVcU7Vc1Dvk; Sat, 25 Jun 2022 20:06:13 -0700 X-Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by mx.groups.io with SMTP id smtpd.web09.26612.1656212770864849318 for ; Sat, 25 Jun 2022 20:06:12 -0700 X-IronPort-AV: E=McAfee;i="6400,9594,10389"; a="367554795" X-IronPort-AV: E=Sophos;i="5.92,223,1650956400"; d="scan'208";a="367554795" X-Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 25 Jun 2022 20:06:12 -0700 X-IronPort-AV: E=Sophos;i="5.92,223,1650956400"; d="scan'208";a="645862083" X-Received: from mxu9-mobl1.ccr.corp.intel.com ([10.255.30.236]) by fmsmga008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 25 Jun 2022 20:06:10 -0700 From: "Min Xu" To: devel@edk2.groups.io Cc: Min M Xu , Erdem Aktas , James Bottomley , Jiewen Yao , Gerd Hoffmann , Tom Lendacky Subject: [edk2-devel] [PATCH V2 1/8] OvmfPkg: Move TdxValidateCfv from PeilessStartupLib to PlatformInitLib Date: Sun, 26 Jun 2022 11:05:50 +0800 Message-Id: In-Reply-To: References: MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,min.m.xu@intel.com X-Gm-Message-State: ynfuhHBYH1HtYy4HTDoPCjXzx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1656212773; bh=F8CKhXAg5vDArhisLKWQfilwH7DkE/7L4x13JyidnNs=; h=Cc:Date:From:Reply-To:Subject:To; b=tZL9cS57Crcxrd3a9fTlRuYNoJq6kuJLw65y7seDkbuYbgJyQwdsTdYIxAsmcG2yVI0 MpqtUQTOCr5Ih5vpMo1NVuLzJWNFnL1BpkvwhJmkD55EYN+jOAjTpwlooRyitLKw9TJwn tf4hDZVwhCQhHuUy2m4MtGJ1+c3odp+B4Hs= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1656212775425100005 Content-Type: text/plain; charset="utf-8" From: Min M Xu TdxValidateCfv validates the integrity of Configuration FV (CFV). It was implemented in PeilessStartupLib which is included in IntelTdxX64. In OvmfPkgX64 we should validate CFV as well. So it is moved from PeilessStartupLib to PlatformInitLib so that it can be called in both OvmfPkgX64 and IntelTdxX64. Cc: Erdem Aktas Cc: James Bottomley Cc: Jiewen Yao Cc: Gerd Hoffmann Cc: Tom Lendacky Signed-off-by: Min Xu --- OvmfPkg/Include/Library/PlatformInitLib.h | 17 ++ OvmfPkg/Library/PeilessStartupLib/IntelTdx.c | 153 ------------------ .../PeilessStartupInternal.h | 17 -- OvmfPkg/Library/PlatformInitLib/IntelTdx.c | 153 ++++++++++++++++++ 4 files changed, 170 insertions(+), 170 deletions(-) diff --git a/OvmfPkg/Include/Library/PlatformInitLib.h b/OvmfPkg/Include/Li= brary/PlatformInitLib.h index 2987a367cc9c..a3acfb1fb196 100644 --- a/OvmfPkg/Include/Library/PlatformInitLib.h +++ b/OvmfPkg/Include/Library/PlatformInitLib.h @@ -234,4 +234,21 @@ PlatformTdxPublishRamRegions ( VOID ); =20 +/** + Check the integrity of CFV data. + + @param[in] TdxCfvBase - A pointer to CFV header + @param[in] TdxCfvSize - CFV data size + + @retval TRUE - The CFV data is valid. + @retval FALSE - The CFV data is invalid. + +**/ +BOOLEAN +EFIAPI +TdxValidateCfv ( + IN UINT8 *TdxCfvBase, + IN UINT32 TdxCfvSize + ); + #endif // PLATFORM_INIT_LIB_H_ diff --git a/OvmfPkg/Library/PeilessStartupLib/IntelTdx.c b/OvmfPkg/Library= /PeilessStartupLib/IntelTdx.c index 484fd21057c8..216c413caad5 100644 --- a/OvmfPkg/Library/PeilessStartupLib/IntelTdx.c +++ b/OvmfPkg/Library/PeilessStartupLib/IntelTdx.c @@ -7,8 +7,6 @@ #include #include #include -#include -#include #include #include #include @@ -37,157 +35,6 @@ typedef struct { =20 #pragma pack() =20 -/** - Check padding data all bit should be 1. - - @param[in] Buffer - A pointer to buffer header - @param[in] BufferSize - Buffer size - - @retval TRUE - The padding data is valid. - @retval TRUE - The padding data is invalid. - -**/ -BOOLEAN -CheckPaddingData ( - IN UINT8 *Buffer, - IN UINT32 BufferSize - ) -{ - UINT32 index; - - for (index =3D 0; index < BufferSize; index++) { - if (Buffer[index] !=3D 0xFF) { - return FALSE; - } - } - - return TRUE; -} - -/** - Check the integrity of CFV data. - - @param[in] TdxCfvBase - A pointer to CFV header - @param[in] TdxCfvSize - CFV data size - - @retval TRUE - The CFV data is valid. - @retval FALSE - The CFV data is invalid. - -**/ -BOOLEAN -EFIAPI -TdxValidateCfv ( - IN UINT8 *TdxCfvBase, - IN UINT32 TdxCfvSize - ) -{ - UINT16 Checksum; - UINTN VariableBase; - UINT32 VariableOffset; - UINT32 VariableOffsetBeforeAlign; - EFI_FIRMWARE_VOLUME_HEADER *CfvFvHeader; - VARIABLE_STORE_HEADER *CfvVariableStoreHeader; - AUTHENTICATED_VARIABLE_HEADER *VariableHeader; - - static EFI_GUID FvHdrGUID =3D EFI_SYSTEM_NV_DATA_FV_GUID; - static EFI_GUID VarStoreHdrGUID =3D EFI_AUTHENTICATED_VARIABLE_GUID; - - VariableOffset =3D 0; - - if (TdxCfvBase =3D=3D NULL) { - DEBUG ((DEBUG_ERROR, "TDX CFV: CFV pointer is NULL\n")); - return FALSE; - } - - // - // Verify the header zerovetor, filesystemguid, - // revision, signature, attributes, fvlength, checksum - // HeaderLength cannot be an odd number - // - CfvFvHeader =3D (EFI_FIRMWARE_VOLUME_HEADER *)TdxCfvBase; - - if ((!IsZeroBuffer (CfvFvHeader->ZeroVector, 16)) || - (!CompareGuid (&FvHdrGUID, &CfvFvHeader->FileSystemGuid)) || - (CfvFvHeader->Signature !=3D EFI_FVH_SIGNATURE) || - (CfvFvHeader->Attributes !=3D 0x4feff) || - (CfvFvHeader->Revision !=3D EFI_FVH_REVISION) || - (CfvFvHeader->FvLength !=3D TdxCfvSize) - ) - { - DEBUG ((DEBUG_ERROR, "TDX CFV: Basic FV headers were invalid\n")); - return FALSE; - } - - // - // Verify the header checksum - // - Checksum =3D CalculateSum16 ((VOID *)CfvFvHeader, CfvFvHeader->HeaderLen= gth); - - if (Checksum !=3D 0) { - DEBUG ((DEBUG_ERROR, "TDX CFV: FV checksum was invalid\n")); - return FALSE; - } - - // - // Verify the header signature, size, format, state - // - CfvVariableStoreHeader =3D (VARIABLE_STORE_HEADER *)(TdxCfvBase + CfvFvH= eader->HeaderLength); - if ((!CompareGuid (&VarStoreHdrGUID, &CfvVariableStoreHeader->Signature)= ) || - (CfvVariableStoreHeader->Format !=3D VARIABLE_STORE_FORMATTED) || - (CfvVariableStoreHeader->State !=3D VARIABLE_STORE_HEALTHY) || - (CfvVariableStoreHeader->Size > (CfvFvHeader->FvLength - CfvFvHeader= ->HeaderLength)) || - (CfvVariableStoreHeader->Size < sizeof (VARIABLE_STORE_HEADER)) - ) - { - DEBUG ((DEBUG_ERROR, "TDX CFV: Variable Store header was invalid\n")); - return FALSE; - } - - // - // Verify the header startId, state - // Verify data to the end - // - VariableBase =3D (UINTN)TdxCfvBase + CfvFvHeader->HeaderLength + sizeof = (VARIABLE_STORE_HEADER); - while (VariableOffset < (CfvVariableStoreHeader->Size - sizeof (VARIABL= E_STORE_HEADER))) { - VariableHeader =3D (AUTHENTICATED_VARIABLE_HEADER *)(VariableBase + Va= riableOffset); - if (VariableHeader->StartId !=3D VARIABLE_DATA) { - if (!CheckPaddingData ((UINT8 *)VariableHeader, CfvVariableStoreHead= er->Size - sizeof (VARIABLE_STORE_HEADER) - VariableOffset)) { - DEBUG ((DEBUG_ERROR, "TDX CFV: Variable header was invalid\n")); - return FALSE; - } - - VariableOffset =3D CfvVariableStoreHeader->Size - sizeof (VARIABLE_S= TORE_HEADER); - } else { - if (!((VariableHeader->State =3D=3D VAR_IN_DELETED_TRANSITION) || - (VariableHeader->State =3D=3D VAR_DELETED) || - (VariableHeader->State =3D=3D VAR_HEADER_VALID_ONLY) || - (VariableHeader->State =3D=3D VAR_ADDED))) - { - DEBUG ((DEBUG_ERROR, "TDX CFV: Variable header was invalid\n")); - return FALSE; - } - - VariableOffset +=3D sizeof (AUTHENTICATED_VARIABLE_HEADER) + Variabl= eHeader->NameSize + VariableHeader->DataSize; - // Verify VariableOffset should be less than or equal CfvVariableSto= reHeader->Size - sizeof(VARIABLE_STORE_HEADER) - if (VariableOffset > (CfvVariableStoreHeader->Size - sizeof (VARIABL= E_STORE_HEADER))) { - DEBUG ((DEBUG_ERROR, "TDX CFV: Variable header was invalid\n")); - return FALSE; - } - - VariableOffsetBeforeAlign =3D VariableOffset; - // 4 byte align - VariableOffset =3D (VariableOffset + 3) & (UINTN)(~3); - - if (!CheckPaddingData ((UINT8 *)(VariableBase + VariableOffsetBefore= Align), VariableOffset - VariableOffsetBeforeAlign)) { - DEBUG ((DEBUG_ERROR, "TDX CFV: Variable header was invalid\n")); - return FALSE; - } - } - } - - return TRUE; -} - /** Measure the Hoblist passed from the VMM. =20 diff --git a/OvmfPkg/Library/PeilessStartupLib/PeilessStartupInternal.h b/O= vmfPkg/Library/PeilessStartupLib/PeilessStartupInternal.h index 74b5f46552c2..09cac3e26c67 100644 --- a/OvmfPkg/Library/PeilessStartupLib/PeilessStartupInternal.h +++ b/OvmfPkg/Library/PeilessStartupLib/PeilessStartupInternal.h @@ -52,23 +52,6 @@ EFIAPI ConstructSecHobList ( ); =20 -/** - Check the integrity of CFV data. - - @param[in] TdxCfvBase - A pointer to CFV header - @param[in] TdxCfvSize - CFV data size - - @retval TRUE - The CFV data is valid. - @retval FALSE - The CFV data is invalid. - -**/ -BOOLEAN -EFIAPI -TdxValidateCfv ( - IN UINT8 *TdxCfvBase, - IN UINT32 TdxCfvSize - ); - /** Measure the Hoblist passed from the VMM. =20 diff --git a/OvmfPkg/Library/PlatformInitLib/IntelTdx.c b/OvmfPkg/Library/P= latformInitLib/IntelTdx.c index c6d7c8bb6e0e..626a670c9c64 100644 --- a/OvmfPkg/Library/PlatformInitLib/IntelTdx.c +++ b/OvmfPkg/Library/PlatformInitLib/IntelTdx.c @@ -20,6 +20,8 @@ #include #include #include +#include +#include #include #include =20 @@ -561,3 +563,154 @@ PlatformTdxPublishRamRegions ( ); } } + +/** + Check padding data all bit should be 1. + + @param[in] Buffer - A pointer to buffer header + @param[in] BufferSize - Buffer size + + @retval TRUE - The padding data is valid. + @retval TRUE - The padding data is invalid. + +**/ +BOOLEAN +CheckPaddingData ( + IN UINT8 *Buffer, + IN UINT32 BufferSize + ) +{ + UINT32 index; + + for (index =3D 0; index < BufferSize; index++) { + if (Buffer[index] !=3D 0xFF) { + return FALSE; + } + } + + return TRUE; +} + +/** + Check the integrity of CFV data. + + @param[in] TdxCfvBase - A pointer to CFV header + @param[in] TdxCfvSize - CFV data size + + @retval TRUE - The CFV data is valid. + @retval FALSE - The CFV data is invalid. + +**/ +BOOLEAN +EFIAPI +TdxValidateCfv ( + IN UINT8 *TdxCfvBase, + IN UINT32 TdxCfvSize + ) +{ + UINT16 Checksum; + UINTN VariableBase; + UINT32 VariableOffset; + UINT32 VariableOffsetBeforeAlign; + EFI_FIRMWARE_VOLUME_HEADER *CfvFvHeader; + VARIABLE_STORE_HEADER *CfvVariableStoreHeader; + AUTHENTICATED_VARIABLE_HEADER *VariableHeader; + + static EFI_GUID FvHdrGUID =3D EFI_SYSTEM_NV_DATA_FV_GUID; + static EFI_GUID VarStoreHdrGUID =3D EFI_AUTHENTICATED_VARIABLE_GUID; + + VariableOffset =3D 0; + + if (TdxCfvBase =3D=3D NULL) { + DEBUG ((DEBUG_ERROR, "TDX CFV: CFV pointer is NULL\n")); + return FALSE; + } + + // + // Verify the header zerovetor, filesystemguid, + // revision, signature, attributes, fvlength, checksum + // HeaderLength cannot be an odd number + // + CfvFvHeader =3D (EFI_FIRMWARE_VOLUME_HEADER *)TdxCfvBase; + + if ((!IsZeroBuffer (CfvFvHeader->ZeroVector, 16)) || + (!CompareGuid (&FvHdrGUID, &CfvFvHeader->FileSystemGuid)) || + (CfvFvHeader->Signature !=3D EFI_FVH_SIGNATURE) || + (CfvFvHeader->Attributes !=3D 0x4feff) || + (CfvFvHeader->Revision !=3D EFI_FVH_REVISION) || + (CfvFvHeader->FvLength !=3D TdxCfvSize) + ) + { + DEBUG ((DEBUG_ERROR, "TDX CFV: Basic FV headers were invalid\n")); + return FALSE; + } + + // + // Verify the header checksum + // + Checksum =3D CalculateSum16 ((VOID *)CfvFvHeader, CfvFvHeader->HeaderLen= gth); + + if (Checksum !=3D 0) { + DEBUG ((DEBUG_ERROR, "TDX CFV: FV checksum was invalid\n")); + return FALSE; + } + + // + // Verify the header signature, size, format, state + // + CfvVariableStoreHeader =3D (VARIABLE_STORE_HEADER *)(TdxCfvBase + CfvFvH= eader->HeaderLength); + if ((!CompareGuid (&VarStoreHdrGUID, &CfvVariableStoreHeader->Signature)= ) || + (CfvVariableStoreHeader->Format !=3D VARIABLE_STORE_FORMATTED) || + (CfvVariableStoreHeader->State !=3D VARIABLE_STORE_HEALTHY) || + (CfvVariableStoreHeader->Size > (CfvFvHeader->FvLength - CfvFvHeader= ->HeaderLength)) || + (CfvVariableStoreHeader->Size < sizeof (VARIABLE_STORE_HEADER)) + ) + { + DEBUG ((DEBUG_ERROR, "TDX CFV: Variable Store header was invalid\n")); + return FALSE; + } + + // + // Verify the header startId, state + // Verify data to the end + // + VariableBase =3D (UINTN)TdxCfvBase + CfvFvHeader->HeaderLength + sizeof = (VARIABLE_STORE_HEADER); + while (VariableOffset < (CfvVariableStoreHeader->Size - sizeof (VARIABL= E_STORE_HEADER))) { + VariableHeader =3D (AUTHENTICATED_VARIABLE_HEADER *)(VariableBase + Va= riableOffset); + if (VariableHeader->StartId !=3D VARIABLE_DATA) { + if (!CheckPaddingData ((UINT8 *)VariableHeader, CfvVariableStoreHead= er->Size - sizeof (VARIABLE_STORE_HEADER) - VariableOffset)) { + DEBUG ((DEBUG_ERROR, "TDX CFV: Variable header was invalid\n")); + return FALSE; + } + + VariableOffset =3D CfvVariableStoreHeader->Size - sizeof (VARIABLE_S= TORE_HEADER); + } else { + if (!((VariableHeader->State =3D=3D VAR_IN_DELETED_TRANSITION) || + (VariableHeader->State =3D=3D VAR_DELETED) || + (VariableHeader->State =3D=3D VAR_HEADER_VALID_ONLY) || + (VariableHeader->State =3D=3D VAR_ADDED))) + { + DEBUG ((DEBUG_ERROR, "TDX CFV: Variable header was invalid\n")); + return FALSE; + } + + VariableOffset +=3D sizeof (AUTHENTICATED_VARIABLE_HEADER) + Variabl= eHeader->NameSize + VariableHeader->DataSize; + // Verify VariableOffset should be less than or equal CfvVariableSto= reHeader->Size - sizeof(VARIABLE_STORE_HEADER) + if (VariableOffset > (CfvVariableStoreHeader->Size - sizeof (VARIABL= E_STORE_HEADER))) { + DEBUG ((DEBUG_ERROR, "TDX CFV: Variable header was invalid\n")); + return FALSE; + } + + VariableOffsetBeforeAlign =3D VariableOffset; + // 4 byte align + VariableOffset =3D (VariableOffset + 3) & (UINTN)(~3); + + if (!CheckPaddingData ((UINT8 *)(VariableBase + VariableOffsetBefore= Align), VariableOffset - VariableOffsetBeforeAlign)) { + DEBUG ((DEBUG_ERROR, "TDX CFV: Variable header was invalid\n")); + return FALSE; + } + } + } + + return TRUE; +} --=20 2.29.2.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#90753): https://edk2.groups.io/g/devel/message/90753 Mute This Topic: https://groups.io/mt/91995188/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Sat May 4 00:27:45 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+90754+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+90754+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1656212775438129.71150201212015; Sat, 25 Jun 2022 20:06:15 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id 4McsYY1788612xGngkpy0vIA; Sat, 25 Jun 2022 20:06:15 -0700 X-Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by mx.groups.io with SMTP id smtpd.web09.26612.1656212770864849318 for ; Sat, 25 Jun 2022 20:06:14 -0700 X-IronPort-AV: E=McAfee;i="6400,9594,10389"; a="367554810" X-IronPort-AV: E=Sophos;i="5.92,223,1650956400"; d="scan'208";a="367554810" X-Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 25 Jun 2022 20:06:14 -0700 X-IronPort-AV: E=Sophos;i="5.92,223,1650956400"; d="scan'208";a="645862090" X-Received: from mxu9-mobl1.ccr.corp.intel.com ([10.255.30.236]) by fmsmga008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 25 Jun 2022 20:06:12 -0700 From: "Min Xu" To: devel@edk2.groups.io Cc: Min M Xu , Erdem Aktas , James Bottomley , Jiewen Yao , Gerd Hoffmann , Tom Lendacky Subject: [edk2-devel] [PATCH V2 2/8] OvmfPkg: Validate Cfv integrity in Tdx guest Date: Sun, 26 Jun 2022 11:05:51 +0800 Message-Id: <9fbd08682821f8fc7f56f55383251182207b0965.1656210686.git.min.m.xu@intel.com> In-Reply-To: References: MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,min.m.xu@intel.com X-Gm-Message-State: cPqtEXZ3hCrH43ix0MsbTbvHx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1656212775; bh=R+3WpPOtTRihbT6pK0+7dp2J0MHmbLvcpWDYEot8q+o=; h=Cc:Date:From:Reply-To:Subject:To; b=v83Mgg/fnId5OxmBHWwXlYLsbSWvjz9w0SI4kIf7oN2erKX7roM9ims6l22dBaksOar x4k36V8RjEJUkqjfjvzuBZYXQ0ct16fvfhYK0Bv4nc2ZTxc3vs2r/9PUGGgf/vNK5XeIo f9xVd2EviZ699Ryxjv0gPJgxBKYa9qQPmWU= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1656212777441100011 Content-Type: text/plain; charset="utf-8" From: Min M Xu Validate Configurtion FV (CFV) in Tdx guest. Cc: Erdem Aktas Cc: James Bottomley Cc: Jiewen Yao Cc: Gerd Hoffmann Cc: Tom Lendacky Signed-off-by: Min Xu --- OvmfPkg/Sec/SecMain.c | 8 ++++++++ OvmfPkg/Sec/SecMain.inf | 2 ++ 2 files changed, 10 insertions(+) diff --git a/OvmfPkg/Sec/SecMain.c b/OvmfPkg/Sec/SecMain.c index 1167d22a68cc..f6c00b8dab96 100644 --- a/OvmfPkg/Sec/SecMain.c +++ b/OvmfPkg/Sec/SecMain.c @@ -768,6 +768,14 @@ SecCoreStartupWithStack ( if (ProcessTdxHobList () !=3D EFI_SUCCESS) { CpuDeadLoop (); } + + // + // Config FV (Cfv) contains the configuration information and its inte= grity + // should be validated. + // + if (!TdxValidateCfv ((UINT8 *)(UINTN)FixedPcdGet32 (PcdCfvBase), Fixed= PcdGet32 (PcdCfvRawDataSize))) { + CpuDeadLoop (); + } } =20 #endif diff --git a/OvmfPkg/Sec/SecMain.inf b/OvmfPkg/Sec/SecMain.inf index 561a840f29c5..ae0094a15eda 100644 --- a/OvmfPkg/Sec/SecMain.inf +++ b/OvmfPkg/Sec/SecMain.inf @@ -84,6 +84,8 @@ gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSecGhcbBackupBase gUefiOvmfPkgTokenSpaceGuid.PcdTdxAcceptPageSize gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase + gUefiOvmfPkgTokenSpaceGuid.PcdCfvBase + gUefiOvmfPkgTokenSpaceGuid.PcdCfvRawDataSize =20 [FeaturePcd] gUefiOvmfPkgTokenSpaceGuid.PcdSmmSmramRequire --=20 2.29.2.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#90754): https://edk2.groups.io/g/devel/message/90754 Mute This Topic: https://groups.io/mt/91995189/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Sat May 4 00:27:45 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+90755+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+90755+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1656212777191123.74394218541079; Sat, 25 Jun 2022 20:06:17 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id 0XfMYY1788612xkIrfjG5drf; Sat, 25 Jun 2022 20:06:16 -0700 X-Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by mx.groups.io with SMTP id smtpd.web09.26612.1656212770864849318 for ; Sat, 25 Jun 2022 20:06:16 -0700 X-IronPort-AV: E=McAfee;i="6400,9594,10389"; a="367554827" X-IronPort-AV: E=Sophos;i="5.92,223,1650956400"; d="scan'208";a="367554827" X-Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 25 Jun 2022 20:06:16 -0700 X-IronPort-AV: E=Sophos;i="5.92,223,1650956400"; d="scan'208";a="645862100" X-Received: from mxu9-mobl1.ccr.corp.intel.com ([10.255.30.236]) by fmsmga008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 25 Jun 2022 20:06:14 -0700 From: "Min Xu" To: devel@edk2.groups.io Cc: Min M Xu , Leif Lindholm , Ard Biesheuvel , Abner Chang , Daniel Schaefer , Gerd Hoffmann Subject: [edk2-devel] [PATCH V2 3/8] EmbeddedPkg: Add AllocateRuntimePages in PrePiMemoryAllocationLib Date: Sun, 26 Jun 2022 11:05:52 +0800 Message-Id: In-Reply-To: References: MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,min.m.xu@intel.com X-Gm-Message-State: AWAxNPB4T0dgCfs3KctQm6swx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1656212776; bh=gc07khwYrzIY4ii1F6m4xBSbcMLWE9J+oXq2BYnxWwI=; h=Cc:Date:From:Reply-To:Subject:To; b=hj14vDjQG9GbUkdfj5ezD9PpS6fbksrV5q+yCR9arfjz5sKZdwtD0o6OFtOGXGW4++e Xw+Dhjt6NtIEaMnSsxR2bUYenxtjsmx1is93B346bbNN1mC7yaBXpxx+Pc6PitLOHmdVC 9NS0CC7FDAJSrX8KARLHVWi7dip5YpPxMTE= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1656212777454100012 Content-Type: text/plain; charset="utf-8" From: Min M Xu AllocateRuntimePages is used to allocate one or more 4KB pages of type EfiRuntimeServicesData. Cc: Leif Lindholm Cc: Ard Biesheuvel Cc: Abner Chang Cc: Daniel Schaefer Cc: Gerd Hoffmann Signed-off-by: Min Xu Reviewed-by: Ard Biesheuvel --- EmbeddedPkg/Include/Library/PrePiLib.h | 19 ++++++ .../MemoryAllocationLib.c | 64 ++++++++++++++----- 2 files changed, 67 insertions(+), 16 deletions(-) diff --git a/EmbeddedPkg/Include/Library/PrePiLib.h b/EmbeddedPkg/Include/L= ibrary/PrePiLib.h index 7b2cea296f1c..3741b08c4478 100644 --- a/EmbeddedPkg/Include/Library/PrePiLib.h +++ b/EmbeddedPkg/Include/Library/PrePiLib.h @@ -665,6 +665,25 @@ AllocatePages ( IN UINTN Pages ); =20 +/** + Allocates one or more 4KB pages of type EfiRuntimeServicesData. + + Allocates the number of 4KB pages of type EfiRuntimeServicesData and ret= urns a pointer to the + allocated buffer. The buffer returned is aligned on a 4KB boundary. If= Pages is 0, then NULL + is returned. If there is not enough memory remaining to satisfy the req= uest, then NULL is + returned. + + @param Pages The number of 4 KB pages to allocate. + + @return A pointer to the allocated buffer or NULL if allocation fails. + +**/ +VOID * +EFIAPI +AllocateRuntimePages ( + IN UINTN Pages + ); + /** Allocates a buffer of type EfiBootServicesData. =20 diff --git a/EmbeddedPkg/Library/PrePiMemoryAllocationLib/MemoryAllocationL= ib.c b/EmbeddedPkg/Library/PrePiMemoryAllocationLib/MemoryAllocationLib.c index 78f8da5e9527..9d7b34ad28fa 100644 --- a/EmbeddedPkg/Library/PrePiMemoryAllocationLib/MemoryAllocationLib.c +++ b/EmbeddedPkg/Library/PrePiMemoryAllocationLib/MemoryAllocationLib.c @@ -14,23 +14,11 @@ #include #include =20 -/** - Allocates one or more 4KB pages of type EfiBootServicesData. - - Allocates the number of 4KB pages of MemoryType and returns a pointer to= the - allocated buffer. The buffer returned is aligned on a 4KB boundary. If= Pages is 0, then NULL - is returned. If there is not enough memory remaining to satisfy the req= uest, then NULL is - returned. - - @param Pages The number of 4 KB pages to allocate. - - @return A pointer to the allocated buffer or NULL if allocation fails. - -**/ VOID * EFIAPI -AllocatePages ( - IN UINTN Pages +InternalAllocatePages ( + IN UINTN Pages, + IN EFI_MEMORY_TYPE MemoryType ) { EFI_PEI_HOB_POINTERS Hob; @@ -65,12 +53,56 @@ AllocatePages ( BuildMemoryAllocationHob ( Hob.HandoffInformationTable->EfiFreeMemoryTop, Pages * EFI_PAGE_SIZE, - EfiBootServicesData + MemoryType ); return (VOID *)(UINTN)Hob.HandoffInformationTable->EfiFreeMemoryTop; } } =20 +/** + Allocates one or more 4KB pages of type EfiBootServicesData. + + Allocates the number of 4KB pages of MemoryType and returns a pointer to= the + allocated buffer. The buffer returned is aligned on a 4KB boundary. If= Pages is 0, then NULL + is returned. If there is not enough memory remaining to satisfy the req= uest, then NULL is + returned. + + @param Pages The number of 4 KB pages to allocate. + + @return A pointer to the allocated buffer or NULL if allocation fails. + +**/ +VOID * +EFIAPI +AllocatePages ( + IN UINTN Pages + ) +{ + return InternalAllocatePages (Pages, EfiBootServicesData); +} + +/** + Allocates one or more 4KB pages of type EfiRuntimeServicesData. + + Allocates the number of 4KB pages of type EfiRuntimeServicesData and ret= urns a pointer to the + allocated buffer. The buffer returned is aligned on a 4KB boundary. If= Pages is 0, then NULL + is returned. If there is not enough memory remaining to satisfy the req= uest, then NULL is + returned. + + @param Pages The number of 4 KB pages to allocate. + + @return A pointer to the allocated buffer or NULL if allocation fails. + +**/ +VOID * +EFIAPI +AllocateRuntimePages ( + IN UINTN Pages + ) +{ + return InternalAllocatePages (Pages, EfiRuntimeServicesData); +} + /** Allocates one or more 4KB pages of type EfiBootServicesData at a specifi= ed alignment. =20 --=20 2.29.2.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#90755): https://edk2.groups.io/g/devel/message/90755 Mute This Topic: https://groups.io/mt/91995190/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Sat May 4 00:27:45 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+90756+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+90756+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1656212780147421.34126537729196; Sat, 25 Jun 2022 20:06:20 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id 0hJXYY1788612xMjtMhIGsHi; Sat, 25 Jun 2022 20:06:19 -0700 X-Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by mx.groups.io with SMTP id smtpd.web09.26612.1656212770864849318 for ; Sat, 25 Jun 2022 20:06:18 -0700 X-IronPort-AV: E=McAfee;i="6400,9594,10389"; a="367554851" X-IronPort-AV: E=Sophos;i="5.92,223,1650956400"; d="scan'208";a="367554851" X-Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 25 Jun 2022 20:06:17 -0700 X-IronPort-AV: E=Sophos;i="5.92,223,1650956400"; d="scan'208";a="645862110" X-Received: from mxu9-mobl1.ccr.corp.intel.com ([10.255.30.236]) by fmsmga008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 25 Jun 2022 20:06:16 -0700 From: "Min Xu" To: devel@edk2.groups.io Cc: Min M Xu , Erdem Aktas , James Bottomley , Jiewen Yao , Tom Lendacky , Gerd Hoffmann Subject: [edk2-devel] [PATCH V2 4/8] OvmfPkg/PlatformInitLib: Add functions for EmuVariableNvStore Date: Sun, 26 Jun 2022 11:05:53 +0800 Message-Id: In-Reply-To: References: MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,min.m.xu@intel.com X-Gm-Message-State: geZ5PjKX19xmNGvamlTjIW89x1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1656212779; bh=DnQk1loAT8frzWIvw2DGpibYsi1ZkBBchOnRCeldWYU=; h=Cc:Date:From:Reply-To:Subject:To; b=GsErHDkqZIE/cFFkQ8BTGZ/i1WfcY2ED2H1dmiimU8c7cfv9cMLvp1tjyoBWW0rukyu SJHgXQ6Wkf7mKgT2nhhia5i5/WIG+Z0OfNo3QNh49Sh/FGSqe/VSaLjGs7qfdfR/LMMcV vFW2RJtXsbXgsnqKDqOcrPrjGQl/IdoneXs= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1656212781462100020 Content-Type: text/plain; charset="utf-8" From: Min M Xu There are 2 functions added for EmuVariableNvStore: - PlatformReserveEmuVariableNvStore - PlatformInitEmuVariableNvStore PlatformReserveEmuVariableNvStore allocate storage for NV variables early on so it will be at a consistent address. PlatformInitEmuVariableNvStore copies the content in PcdOvmfFlashNvStorageVariableBase to the storage allocated by PlatformReserveEmuVariableNvStore. This is used in the case that OVMF is launched with -bios parameter. Because in that situation UEFI variables will be partially emulated, and non-volatile variables may lose their contents after a reboot. This makes the secure boot feature not working. Cc: Erdem Aktas Cc: James Bottomley [jejb] Cc: Jiewen Yao [jyao1] Cc: Tom Lendacky [tlendacky] Cc: Gerd Hoffmann Signed-off-by: Min Xu --- OvmfPkg/Include/Library/PlatformInitLib.h | 34 ++++++++ OvmfPkg/Library/PlatformInitLib/Platform.c | 77 +++++++++++++++++++ .../PlatformInitLib/PlatformInitLib.inf | 2 + 3 files changed, 113 insertions(+) diff --git a/OvmfPkg/Include/Library/PlatformInitLib.h b/OvmfPkg/Include/Li= brary/PlatformInitLib.h index a3acfb1fb196..3a84a56be3c1 100644 --- a/OvmfPkg/Include/Library/PlatformInitLib.h +++ b/OvmfPkg/Include/Library/PlatformInitLib.h @@ -251,4 +251,38 @@ TdxValidateCfv ( IN UINT32 TdxCfvSize ); =20 +/** + Allocate storage for NV variables early on so it will be + at a consistent address. Since VM memory is preserved + across reboots, this allows the NV variable storage to survive + a VM reboot. + + * + * @retval VOID* The pointer to the storage for NV Variables + */ +VOID * +EFIAPI +PlatformReserveEmuVariableNvStore ( + VOID + ); + +/** + When OVMF is lauched with -bios parameter, UEFI variables will be + partially emulated, and non-volatile variables may lose their contents + after a reboot. This makes the secure boot feature not working. + + This function is used to initialize the EmuVariableNvStore + with the conent in PcdOvmfFlashNvStorageVariableBase. + + @param[in] EmuVariableNvStore - A pointer to EmuVariableNvStore + + @retval EFI_SUCCESS - Successfully init the EmuVariableNvStore + @retval Others - As the error code indicates + */ +EFI_STATUS +EFIAPI +PlatformInitEmuVariableNvStore ( + IN VOID *EmuVariableNvStore + ); + #endif // PLATFORM_INIT_LIB_H_ diff --git a/OvmfPkg/Library/PlatformInitLib/Platform.c b/OvmfPkg/Library/P= latformInitLib/Platform.c index c3d34e43af5a..194768379f2b 100644 --- a/OvmfPkg/Library/PlatformInitLib/Platform.c +++ b/OvmfPkg/Library/PlatformInitLib/Platform.c @@ -25,6 +25,7 @@ #include #include #include +#include #include #include #include @@ -576,3 +577,79 @@ PlatformMaxCpuCountInitialization ( PlatformInfoHob->PcdCpuMaxLogicalProcessorNumber =3D MaxCpuCount; PlatformInfoHob->PcdCpuBootLogicalProcessorNumber =3D BootCpuCount; } + +/** + Allocate storage for NV variables early on so it will be + at a consistent address. Since VM memory is preserved + across reboots, this allows the NV variable storage to survive + a VM reboot. + + * + * @retval VOID* The pointer to the storage for NV Variables + */ +VOID * +EFIAPI +PlatformReserveEmuVariableNvStore ( + VOID + ) +{ + VOID *VariableStore; + UINT32 VarStoreSize; + + VarStoreSize =3D 2 * PcdGet32 (PcdFlashNvStorageFtwSpareSize); + // + // Allocate storage for NV variables early on so it will be + // at a consistent address. Since VM memory is preserved + // across reboots, this allows the NV variable storage to survive + // a VM reboot. + // + VariableStore =3D + AllocateRuntimePages ( + EFI_SIZE_TO_PAGES (VarStoreSize) + ); + DEBUG (( + DEBUG_INFO, + "Reserved variable store memory: 0x%p; size: %dkb\n", + VariableStore, + VarStoreSize / 1024 + )); + + return VariableStore; +} + +/** + When OVMF is lauched with -bios parameter, UEFI variables will be + partially emulated, and non-volatile variables may lose their contents + after a reboot. This makes the secure boot feature not working. + + This function is used to initialize the EmuVariableNvStore + with the conent in PcdOvmfFlashNvStorageVariableBase. + + @param[in] EmuVariableNvStore - A pointer to EmuVariableNvStore + + @retval EFI_SUCCESS - Successfully init the EmuVariableNvStore + @retval Others - As the error code indicates + */ +EFI_STATUS +EFIAPI +PlatformInitEmuVariableNvStore ( + IN VOID *EmuVariableNvStore + ) +{ + UINT8 *Base; + UINT32 Size; + UINT32 EmuVariableNvStoreSize; + + EmuVariableNvStoreSize =3D 2 * PcdGet32 (PcdFlashNvStorageFtwSpareSize); + if ((EmuVariableNvStore =3D=3D NULL) || (EmuVariableNvStoreSize =3D=3D 0= )) { + return EFI_INVALID_PARAMETER; + } + + Base =3D (UINT8 *)(UINTN)PcdGet32 (PcdOvmfFlashNvStorageVariableBase); + Size =3D (UINT32)PcdGet32 (PcdFlashNvStorageVariableSize); + ASSERT (Size < EmuVariableNvStoreSize); + + CopyMem (EmuVariableNvStore, Base, Size); + + return EFI_SUCCESS; +} diff --git a/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf b/OvmfPkg/= Library/PlatformInitLib/PlatformInitLib.inf index d2fa2d998df8..fec1f8f24314 100644 --- a/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf +++ b/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf @@ -47,6 +47,7 @@ HobLib QemuFwCfgLib QemuFwCfgSimpleParserLib + MemoryAllocationLib MtrrLib PcdLib PciLib @@ -96,6 +97,7 @@ gUefiOvmfPkgTokenSpaceGuid.PcdGuidedExtractHandlerTableSize =20 gUefiOvmfPkgTokenSpaceGuid.PcdTdxAcceptPageSize + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfFlashNvStorageVariableBase =20 [FeaturePcd] gEfiMdeModulePkgTokenSpaceGuid.PcdDxeIplSwitchToLongMode --=20 2.29.2.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#90756): https://edk2.groups.io/g/devel/message/90756 Mute This Topic: https://groups.io/mt/91995191/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Sat May 4 00:27:45 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+90757+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+90757+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1656212780880804.3079054162838; Sat, 25 Jun 2022 20:06:20 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id RshfYY1788612x9zHvfdAk5Q; Sat, 25 Jun 2022 20:06:20 -0700 X-Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by mx.groups.io with SMTP id smtpd.web09.26612.1656212770864849318 for ; Sat, 25 Jun 2022 20:06:20 -0700 X-IronPort-AV: E=McAfee;i="6400,9594,10389"; a="367554861" X-IronPort-AV: E=Sophos;i="5.92,223,1650956400"; d="scan'208";a="367554861" X-Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 25 Jun 2022 20:06:19 -0700 X-IronPort-AV: E=Sophos;i="5.92,223,1650956400"; d="scan'208";a="645862124" X-Received: from mxu9-mobl1.ccr.corp.intel.com ([10.255.30.236]) by fmsmga008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 25 Jun 2022 20:06:18 -0700 From: "Min Xu" To: devel@edk2.groups.io Cc: Min M Xu , Erdem Aktas , James Bottomley , Jiewen Yao , Tom Lendacky , Gerd Hoffmann Subject: [edk2-devel] [PATCH V2 5/8] OvmfPkg/PlatformPei: Update ReserveEmuVariableNvStore Date: Sun, 26 Jun 2022 11:05:54 +0800 Message-Id: <93072b2c22fbd173b6732baaf0dee9d22a3e5db8.1656210686.git.min.m.xu@intel.com> In-Reply-To: References: MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,min.m.xu@intel.com X-Gm-Message-State: VxfYw9qkcq9IX7wX9eAgAFTHx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1656212780; bh=Y3bXqS5Ez5Si9bkbrZa9ZwiLWHqJytcIt+GY/cARV+w=; h=Cc:Date:From:Reply-To:Subject:To; b=DClLuyZ/VMeJVWbOfuTzAoEnDyGKmLT1c1N0CAFX1kKn5fW+QgI12wBTvFpS8/z9E1W 9FFZosmV9h8+t4C35q32aAEJE1Dk8gP7PcNxTlBQCGU0dF1/gizOdN5B57zLbekLSsRGE 7RnhwAT75O4mdJQKgd2l1p+jqpmqIw+JfhI= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1656212781449100019 Content-Type: text/plain; charset="utf-8" From: Min M Xu ReserveEmuVariableNvStore is updated with below 2 functions defined in PlatformInitLib: - PlatformReserveEmuVariableNvStore - PlatformInitEmuVariableNvStore PlatformInitEmuVariableNvStore works when secure boot feature is enabled. This is because secure boot needs the EFI variables (PK/KEK/DB/DBX, etc) and EmuVariableNvStore is cleared when OVMF is launched with -bios parameter. Cc: Erdem Aktas Cc: James Bottomley [jejb] Cc: Jiewen Yao [jyao1] Cc: Tom Lendacky [tlendacky] Cc: Gerd Hoffmann Signed-off-by: Min Xu --- OvmfPkg/PlatformPei/Platform.c | 25 +++++++------------------ 1 file changed, 7 insertions(+), 18 deletions(-) diff --git a/OvmfPkg/PlatformPei/Platform.c b/OvmfPkg/PlatformPei/Platform.c index 009db67ee60a..b1f8140d6041 100644 --- a/OvmfPkg/PlatformPei/Platform.c +++ b/OvmfPkg/PlatformPei/Platform.c @@ -220,24 +220,13 @@ ReserveEmuVariableNvStore ( EFI_PHYSICAL_ADDRESS VariableStore; RETURN_STATUS PcdStatus; =20 - // - // Allocate storage for NV variables early on so it will be - // at a consistent address. Since VM memory is preserved - // across reboots, this allows the NV variable storage to survive - // a VM reboot. - // - VariableStore =3D - (EFI_PHYSICAL_ADDRESS)(UINTN) - AllocateRuntimePages ( - EFI_SIZE_TO_PAGES (2 * PcdGet32 (PcdFlashNvStorageFtwSpareSize)) - ); - DEBUG (( - DEBUG_INFO, - "Reserved variable store memory: 0x%lX; size: %dkb\n", - VariableStore, - (2 * PcdGet32 (PcdFlashNvStorageFtwSpareSize)) / 1024 - )); - PcdStatus =3D PcdSet64S (PcdEmuVariableNvStoreReserved, VariableStore); + VariableStore =3D (EFI_PHYSICAL_ADDRESS)(UINTN)PlatformReserveEmuVariabl= eNvStore (); + PcdStatus =3D PcdSet64S (PcdEmuVariableNvStoreReserved, VariableStor= e); + + #ifdef SECURE_BOOT_FEATURE_ENABLED + PlatformInitEmuVariableNvStore ((VOID *)(UINTN)VariableStore); + #endif + ASSERT_RETURN_ERROR (PcdStatus); } =20 --=20 2.29.2.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#90757): https://edk2.groups.io/g/devel/message/90757 Mute This Topic: https://groups.io/mt/91995192/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Sat May 4 00:27:45 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+90758+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+90758+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1656212782674250.11552845278618; Sat, 25 Jun 2022 20:06:22 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id 78m8YY1788612x99FrhAAkzE; Sat, 25 Jun 2022 20:06:22 -0700 X-Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by mx.groups.io with SMTP id smtpd.web09.26612.1656212770864849318 for ; Sat, 25 Jun 2022 20:06:21 -0700 X-IronPort-AV: E=McAfee;i="6400,9594,10389"; a="367554882" X-IronPort-AV: E=Sophos;i="5.92,223,1650956400"; d="scan'208";a="367554882" X-Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 25 Jun 2022 20:06:21 -0700 X-IronPort-AV: E=Sophos;i="5.92,223,1650956400"; d="scan'208";a="645862140" X-Received: from mxu9-mobl1.ccr.corp.intel.com ([10.255.30.236]) by fmsmga008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 25 Jun 2022 20:06:19 -0700 From: "Min Xu" To: devel@edk2.groups.io Cc: Min M Xu , Erdem Aktas , James Bottomley , Jiewen Yao , Tom Lendacky , Gerd Hoffmann Subject: [edk2-devel] [PATCH V2 6/8] OvmfPkg: Reserve and init EmuVariableNvStore in Pei-less Startup Date: Sun, 26 Jun 2022 11:05:55 +0800 Message-Id: <760d2a35647b7b5360da20760865aa729b6cb0e5.1656210686.git.min.m.xu@intel.com> In-Reply-To: References: MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,min.m.xu@intel.com X-Gm-Message-State: FAgMZEIHUvLh3kQ94THyTIU6x1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1656212782; bh=NL6OOVXWeyhJFcylMSxda1skPjKdbnwQ4+K7h9Cx0lc=; h=Cc:Date:From:Reply-To:Subject:To; b=O96paH2DMBZKP9srgz0QQXwsKWFvn0274c0nzW+Oc9dlUhY9+30Y56AKuSX1qIS/k7r dwpErzUFN3RWC20KVugpfKWAqrJ7HHmFwFV8ZDr5S5kHGN+fNQ46tCK7oor8M3OjpR6Us pt1XL2oFsHig+dIrC/OXvZp9hgzDjsnyfaw= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1656212783439100025 Content-Type: text/plain; charset="utf-8" From: Min M Xu EmuVariableNvStore is reserved and init with below 2 functions defined in PlatformInitLib: - PlatformReserveEmuVariableNvStore - PlatformInitEmuVariableNvStore PlatformInitEmuVariableNvStore works when secure boot feature is enabled. This is because secure boot needs the EFI variables (PK/KEK/DB/DBX, etc) and EmuVariableNvStore is cleared when OVMF is launched with -bios parameter. Cc: Erdem Aktas Cc: James Bottomley [jejb] Cc: Jiewen Yao [jyao1] Cc: Tom Lendacky [tlendacky] Cc: Gerd Hoffmann Signed-off-by: Min Xu --- OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c b/OvmfPkg/L= ibrary/PeilessStartupLib/PeilessStartup.c index fdfefd00d732..663d5dacd3da 100644 --- a/OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c +++ b/OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c @@ -42,6 +42,7 @@ InitializePlatform ( ) { UINT32 LowerMemorySize; + VOID *VariableStore; =20 DEBUG ((DEBUG_INFO, "InitializePlatform in Pei-less boot\n")); PlatformDebugDumpCmos (); @@ -79,6 +80,12 @@ InitializePlatform ( LowerMemorySize )); =20 + VariableStore =3D PlatformReserveEmuVar= iableNvStore (); + PlatformInfoHob->PcdEmuVariableNvStoreReserved =3D (UINT64)(UINTN)Variab= leStore; + #ifdef SECURE_BOOT_FEATURE_ENABLED + PlatformInitEmuVariableNvStore (VariableStore); + #endif + if (TdIsEnabled ()) { PlatformTdxPublishRamRegions (); } else { --=20 2.29.2.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#90758): https://edk2.groups.io/g/devel/message/90758 Mute This Topic: https://groups.io/mt/91995194/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Sat May 4 00:27:45 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+90759+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+90759+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1656212784880563.9718153710295; Sat, 25 Jun 2022 20:06:24 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id M21nYY1788612xXDs0bx9pUq; Sat, 25 Jun 2022 20:06:24 -0700 X-Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by mx.groups.io with SMTP id smtpd.web09.26612.1656212770864849318 for ; Sat, 25 Jun 2022 20:06:23 -0700 X-IronPort-AV: E=McAfee;i="6400,9594,10389"; a="367554905" X-IronPort-AV: E=Sophos;i="5.92,223,1650956400"; d="scan'208";a="367554905" X-Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 25 Jun 2022 20:06:23 -0700 X-IronPort-AV: E=Sophos;i="5.92,223,1650956400"; d="scan'208";a="645862170" X-Received: from mxu9-mobl1.ccr.corp.intel.com ([10.255.30.236]) by fmsmga008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 25 Jun 2022 20:06:21 -0700 From: "Min Xu" To: devel@edk2.groups.io Cc: Min M Xu , Erdem Aktas , James Bottomley , Jiewen Yao , Tom Lendacky , Gerd Hoffmann Subject: [edk2-devel] [PATCH V2 7/8] OvmfPkg/TdxDxe: Set PcdEmuVariableNvStoreReserved Date: Sun, 26 Jun 2022 11:05:56 +0800 Message-Id: <151d9cfaf028d199612e5c2adfe939d819c4538f.1656210686.git.min.m.xu@intel.com> In-Reply-To: References: MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,min.m.xu@intel.com X-Gm-Message-State: wvds1P1Rs10GrZieRShnBx1ix1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1656212784; bh=rTLG6Ys2BE3AXX9J8GFqfY8uei3xixlg9S5Tbbebu9g=; h=Cc:Date:From:Reply-To:Subject:To; b=mU0Myn6lUG4YTwcAjMyAlcqs0kyic+2R6rcW1EUAZAlfdXE+FzK/QvzBFqk6dUZRVvu +LAzk5cgrpxaUBcOF9QfJ5UWdJWv06qRNQdaglfr6ny9ST9+OFhOmWRddQvCtr/plN3tH PWEQx8yGKZP8hMNaMrumIUtx3+BVZMQKL/E= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1656212785442100029 Content-Type: text/plain; charset="utf-8" From: Min M Xu Set PcdEmuVariableNvStoreReserved with the value in PlatformInfoHob. It is the address of the EmuVariableNvStore reserved in Pei-less startup. Cc: Erdem Aktas Cc: James Bottomley [jejb] Cc: Jiewen Yao [jyao1] Cc: Tom Lendacky [tlendacky] Cc: Gerd Hoffmann Signed-off-by: Min Xu --- OvmfPkg/TdxDxe/TdxDxe.c | 2 ++ OvmfPkg/TdxDxe/TdxDxe.inf | 1 + 2 files changed, 3 insertions(+) diff --git a/OvmfPkg/TdxDxe/TdxDxe.c b/OvmfPkg/TdxDxe/TdxDxe.c index 2318db989792..837f1f8e3024 100644 --- a/OvmfPkg/TdxDxe/TdxDxe.c +++ b/OvmfPkg/TdxDxe/TdxDxe.c @@ -64,6 +64,8 @@ SetPcdSettings ( PlatformInfoHob->PcdCpuBootLogicalProcessorNumber )); =20 + PcdSet64S (PcdEmuVariableNvStoreReserved, PlatformInfoHob->PcdEmuVariabl= eNvStoreReserved); + if (TdIsEnabled ()) { PcdStatus =3D PcdSet64S (PcdTdxSharedBitMask, TdSharedPageMask ()); ASSERT_RETURN_ERROR (PcdStatus); diff --git a/OvmfPkg/TdxDxe/TdxDxe.inf b/OvmfPkg/TdxDxe/TdxDxe.inf index a7e0abda1522..3ce8a5c32c98 100644 --- a/OvmfPkg/TdxDxe/TdxDxe.inf +++ b/OvmfPkg/TdxDxe/TdxDxe.inf @@ -68,3 +68,4 @@ gEfiMdePkgTokenSpaceGuid.PcdConfidentialComputingGuestAttr gEfiMdeModulePkgTokenSpaceGuid.PcdTdxSharedBitMask gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack + gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved --=20 2.29.2.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#90759): https://edk2.groups.io/g/devel/message/90759 Mute This Topic: https://groups.io/mt/91995195/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Sat May 4 00:27:45 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+90760+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+90760+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1656212786494455.2075465361261; Sat, 25 Jun 2022 20:06:26 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id FuWWYY1788612xHWX6q4DtfT; Sat, 25 Jun 2022 20:06:26 -0700 X-Received: from mga05.intel.com (mga05.intel.com [192.55.52.43]) by mx.groups.io with SMTP id smtpd.web09.26612.1656212770864849318 for ; Sat, 25 Jun 2022 20:06:25 -0700 X-IronPort-AV: E=McAfee;i="6400,9594,10389"; a="367554920" X-IronPort-AV: E=Sophos;i="5.92,223,1650956400"; d="scan'208";a="367554920" X-Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga105.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 25 Jun 2022 20:06:25 -0700 X-IronPort-AV: E=Sophos;i="5.92,223,1650956400"; d="scan'208";a="645862184" X-Received: from mxu9-mobl1.ccr.corp.intel.com ([10.255.30.236]) by fmsmga008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 25 Jun 2022 20:06:23 -0700 From: "Min Xu" To: devel@edk2.groups.io Cc: Min M Xu , Erdem Aktas , James Bottomley , Jiewen Yao , Tom Lendacky , Gerd Hoffmann Subject: [edk2-devel] [PATCH V2 8/8] OvmfPkg: Add build-flag SECURE_BOOT_FEATURE_ENABLED Date: Sun, 26 Jun 2022 11:05:57 +0800 Message-Id: <261649c621bb138c091099e112e494bdcfa9ce16.1656210686.git.min.m.xu@intel.com> In-Reply-To: References: MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,min.m.xu@intel.com X-Gm-Message-State: y54vZ8vmCk9IAHThcSuR5lNmx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1656212786; bh=SuKGMy3oeJtUQ019xyPrioiiiCGRqGp4TBJL7Ad2Ht0=; h=Cc:Date:From:Reply-To:Subject:To; b=aYiRdQhMzPYyGZTh/ENicXPe/awA2UO7APZSY2AFkFqKhCVLH90c8FJczXCDRRK9VrA WoNas/CZGo4A5Licehlo/64ZWESPvuAU/bpd1nOGzbxsqirpILzvPYZR8wJwBdSl6w9AN 5HMAKKPrbgX7cOmQ8NPbj84+aH1PZ9xWDuI= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1656212787480100033 Content-Type: text/plain; charset="utf-8" From: Min M Xu SECURE_BOOT_FEATURE_ENABLED is the build-flag defined when secure boot is enabled. Currently this flag is used in below lib: - OvmfPkg/PlatformPei - PeilessStartupLib So it is defined in below 5 .dsc - OvmfPkg/CloudHv/CloudHvX64.dsc - OvmfPkg/IntelTdx/IntelTdxX64.dsc - OvmfPkg/OvmfPkgIa32.dsc - OvmfPkg/OvmfPkgIa32X64.dsc - OvmfPkg/OvmfPkgX64.dsc Cc: Erdem Aktas Cc: James Bottomley [jejb] Cc: Jiewen Yao [jyao1] Cc: Tom Lendacky [tlendacky] Cc: Gerd Hoffmann Signed-off-by: Min Xu --- OvmfPkg/CloudHv/CloudHvX64.dsc | 9 +++++++++ OvmfPkg/IntelTdx/IntelTdxX64.dsc | 9 +++++++++ OvmfPkg/OvmfPkgIa32.dsc | 9 +++++++++ OvmfPkg/OvmfPkgIa32X64.dsc | 9 +++++++++ OvmfPkg/OvmfPkgX64.dsc | 9 +++++++++ 5 files changed, 45 insertions(+) diff --git a/OvmfPkg/CloudHv/CloudHvX64.dsc b/OvmfPkg/CloudHv/CloudHvX64.dsc index ca601aa09d3a..2712731caf55 100644 --- a/OvmfPkg/CloudHv/CloudHvX64.dsc +++ b/OvmfPkg/CloudHv/CloudHvX64.dsc @@ -93,6 +93,15 @@ INTEL:*_*_*_CC_FLAGS =3D /D DISABLE_NEW_DEPRECATED_INTERFACES GCC:*_*_*_CC_FLAGS =3D -D DISABLE_NEW_DEPRECATED_INTERFACES =20 + # + # SECURE_BOOT_FEATURE_ENABLED + # +!if $(SECURE_BOOT_ENABLE) =3D=3D TRUE + MSFT:*_*_*_CC_FLAGS =3D /D SECURE_BOOT_FEATURE_ENABLED + INTEL:*_*_*_CC_FLAGS =3D /D SECURE_BOOT_FEATURE_ENABLED + GCC:*_*_*_CC_FLAGS =3D -D SECURE_BOOT_FEATURE_ENABLED +!endif + !include NetworkPkg/NetworkBuildOptions.dsc.inc =20 [BuildOptions.common.EDKII.DXE_RUNTIME_DRIVER] diff --git a/OvmfPkg/IntelTdx/IntelTdxX64.dsc b/OvmfPkg/IntelTdx/IntelTdxX6= 4.dsc index c662ae8720ff..f4f495a9d199 100644 --- a/OvmfPkg/IntelTdx/IntelTdxX64.dsc +++ b/OvmfPkg/IntelTdx/IntelTdxX64.dsc @@ -85,6 +85,15 @@ INTEL:*_*_*_CC_FLAGS =3D /D TDX_PEI_LESS_BOOT GCC:*_*_*_CC_FLAGS =3D -D TDX_PEI_LESS_BOOT =20 + # + # SECURE_BOOT_FEATURE_ENABLED + # +!if $(SECURE_BOOT_ENABLE) =3D=3D TRUE + MSFT:*_*_*_CC_FLAGS =3D /D SECURE_BOOT_FEATURE_ENABLED + INTEL:*_*_*_CC_FLAGS =3D /D SECURE_BOOT_FEATURE_ENABLED + GCC:*_*_*_CC_FLAGS =3D -D SECURE_BOOT_FEATURE_ENABLED +!endif + [BuildOptions.common.EDKII.DXE_RUNTIME_DRIVER] GCC:*_*_*_DLINK_FLAGS =3D -z common-page-size=3D0x1000 XCODE:*_*_*_DLINK_FLAGS =3D -seg1addr 0x1000 -segalign 0x1000 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc index 934edbbd2a7b..3126e695b7dd 100644 --- a/OvmfPkg/OvmfPkgIa32.dsc +++ b/OvmfPkg/OvmfPkgIa32.dsc @@ -89,6 +89,15 @@ INTEL:*_*_*_CC_FLAGS =3D /D DISABLE_NEW_DEPRECATED_INTERFACES GCC:*_*_*_CC_FLAGS =3D -D DISABLE_NEW_DEPRECATED_INTERFACES =20 + # + # SECURE_BOOT_FEATURE_ENABLED + # +!if $(SECURE_BOOT_ENABLE) =3D=3D TRUE + MSFT:*_*_*_CC_FLAGS =3D /D SECURE_BOOT_FEATURE_ENABLED + INTEL:*_*_*_CC_FLAGS =3D /D SECURE_BOOT_FEATURE_ENABLED + GCC:*_*_*_CC_FLAGS =3D -D SECURE_BOOT_FEATURE_ENABLED +!endif + !include NetworkPkg/NetworkBuildOptions.dsc.inc =20 [BuildOptions.common.EDKII.DXE_RUNTIME_DRIVER] diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc index 4f432c294958..0c86e0b4882d 100644 --- a/OvmfPkg/OvmfPkgIa32X64.dsc +++ b/OvmfPkg/OvmfPkgIa32X64.dsc @@ -93,6 +93,15 @@ INTEL:*_*_*_CC_FLAGS =3D /D DISABLE_NEW_DEPRECATED_INTERFACES GCC:*_*_*_CC_FLAGS =3D -D DISABLE_NEW_DEPRECATED_INTERFACES =20 + # + # SECURE_BOOT_FEATURE_ENABLED + # +!if $(SECURE_BOOT_ENABLE) =3D=3D TRUE + MSFT:*_*_*_CC_FLAGS =3D /D SECURE_BOOT_FEATURE_ENABLED + INTEL:*_*_*_CC_FLAGS =3D /D SECURE_BOOT_FEATURE_ENABLED + GCC:*_*_*_CC_FLAGS =3D -D SECURE_BOOT_FEATURE_ENABLED +!endif + !include NetworkPkg/NetworkBuildOptions.dsc.inc =20 [BuildOptions.common.EDKII.DXE_RUNTIME_DRIVER] diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc index b22da97d4f77..a36bcef4fd3c 100644 --- a/OvmfPkg/OvmfPkgX64.dsc +++ b/OvmfPkg/OvmfPkgX64.dsc @@ -106,6 +106,15 @@ INTEL:*_*_*_CC_FLAGS =3D /D TDX_GUEST_SUPPORTED GCC:*_*_*_CC_FLAGS =3D -D TDX_GUEST_SUPPORTED =20 + # + # SECURE_BOOT_FEATURE_ENABLED + # +!if $(SECURE_BOOT_ENABLE) =3D=3D TRUE + MSFT:*_*_*_CC_FLAGS =3D /D SECURE_BOOT_FEATURE_ENABLED + INTEL:*_*_*_CC_FLAGS =3D /D SECURE_BOOT_FEATURE_ENABLED + GCC:*_*_*_CC_FLAGS =3D -D SECURE_BOOT_FEATURE_ENABLED +!endif + !include NetworkPkg/NetworkBuildOptions.dsc.inc =20 [BuildOptions.common.EDKII.DXE_RUNTIME_DRIVER] --=20 2.29.2.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#90760): https://edk2.groups.io/g/devel/message/90760 Mute This Topic: https://groups.io/mt/91995196/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-