Secure-Boot related variables include the PK/KEK/DB/DBX and they are
stored in NvVarStore (OVMF_VARS.fd). When lauching with -pflash,
QEMU/OVMF will use emulated flash, and fully support UEFI variables.
But when launching with -bios parameter, UEFI variables will be partially
emulated, and non-volatile variables may lose their contents after a
reboot. See OvmfPkg/README.

Tdx guest is an example that -pflash is not supported. So this patch-set
is designed to initialize the NvVarStore with the content of in
OVMF_VARS.fd.

patch 1:
 Add a new function (AllocateRuntimePages) in PrePiMemoryAllocationLib.
 This function will be used in PeilessStartupLib which will run
 in SEC phase.

patch 2:
 Delete the TdxValidateCfv in PeilessStartupLib. Because it is going to
 be renamed to PlatformValidateNvVarStore and be moved to PlatformInitLib.

patch 3 - 7:
 Then we add functions for EmuVariableNvStore in PlatformInitLib. This
 lib will then be called in OvmfPkg/PlatformPei and PeilessStartupLib.
 We also shortcut ConnectNvVarsToFileSystem in secure-boot.

patch 8:
 At last a build-flag (SECURE_BOOT_FEATURE_ENABLED) is introduced in
 the dsc in OvmfPkg. Because the copy over of OVMR_VARS.fd to
 EmuVariableNvStore is only required when secure-boot is enabled.

Code: https://github.com/mxu9/edk2/tree/secure-boot.v3

v3 changes:
 - Renamed TdxValidateCfv to PlatformValidateNvVarStore and implemented
   in PlatformInitlLib/Platform.c.
 - Shortcut ConnectNvVarsToFileSystem in secure-boot.
 - Other minor changes, such as adding log in
   PlatformInitEmuVariableNvStore.

v2 changes:
 - The v1 title is "Enable Secure-Boot in Tdx guest". Because the
   patch-setwe was first designed to fix the gap when secure-boot feature
   was enabled in Tdx guest. After discussing with the community (see
   the disuccsions under https://edk2.groups.io/g/devel/message/90589)
   this patch-set can fix the secure-boot issue when OVMF is lauched
   with -bios parameter. So the title is updated.
 - Add a new function (AllocateRuntimePages) in PrePiMemoryAllocationLib.
 - Add build-flag SECURE_BOOT_FEATURE_ENABLED to control the copy over
   of OVMF_VARS.fd to EmuVariableNvStore.

Cc: Leif Lindholm <quic_llindhol@quicinc.com>
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Abner Chang <abner.chang@hpe.com>
Cc: Daniel Schaefer <daniel.schaefer@hpe.com>
Cc: Erdem Aktas <erdemaktas@google.com>
Cc: James Bottomley <jejb@linux.ibm.com> [jejb]
Cc: Jiewen Yao <jiewen.yao@intel.com> [jyao1]
Cc: Tom Lendacky <thomas.lendacky@amd.com> [tlendacky]
Cc: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Min Xu <min.m.xu@intel.com>

Min M Xu (7):
  OvmfPkg/PeilessStartupLib: Delete TdxValidateCfv
  OvmfPkg/PlatformInitLib: Add functions for EmuVariableNvStore
  OvmfPkg/PlatformPei: Update ReserveEmuVariableNvStore
  OvmfPkg: Reserve and init EmuVariableNvStore in Pei-less Startup
  OvmfPkg/NvVarsFileLib: Shortcut ConnectNvVarsToFileSystem in
    secure-boot
  OvmfPkg/TdxDxe: Set PcdEmuVariableNvStoreReserved
  OvmfPkg: Add build-flag SECURE_BOOT_FEATURE_ENABLED

 OvmfPkg/CloudHv/CloudHvX64.dsc                |   9 +
 OvmfPkg/Include/Library/PlatformInitLib.h     |  51 ++++
 OvmfPkg/IntelTdx/IntelTdxX64.dsc              |   9 +
 OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.c |   7 +
 OvmfPkg/Library/PeilessStartupLib/IntelTdx.c  | 153 -----------
 .../PeilessStartupLib/PeilessStartup.c        |  15 +-
 .../PeilessStartupInternal.h                  |  17 --
 OvmfPkg/Library/PlatformInitLib/Platform.c    | 238 ++++++++++++++++++
 .../PlatformInitLib/PlatformInitLib.inf       |   3 +
 OvmfPkg/OvmfPkgIa32.dsc                       |   9 +
 OvmfPkg/OvmfPkgIa32X64.dsc                    |   9 +
 OvmfPkg/OvmfPkgX64.dsc                        |   9 +
 OvmfPkg/PlatformPei/Platform.c                |  25 +-
 OvmfPkg/TdxDxe/TdxDxe.c                       |   2 +
 OvmfPkg/TdxDxe/TdxDxe.inf                     |   1 +
 15 files changed, 361 insertions(+), 196 deletions(-)

-- 
2.29.2.windows.2



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#90835): https://edk2.groups.io/g/devel/message/90835
Mute This Topic: https://groups.io/mt/92061200/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-

On Wed, Jun 29, 2022 at 04:56:56PM +0800, Min Xu wrote:
> Secure-Boot related variables include the PK/KEK/DB/DBX and they are
> stored in NvVarStore (OVMF_VARS.fd). When lauching with -pflash,
> QEMU/OVMF will use emulated flash, and fully support UEFI variables.
> But when launching with -bios parameter, UEFI variables will be partially
> emulated, and non-volatile variables may lose their contents after a
> reboot. See OvmfPkg/README.
> 
> Tdx guest is an example that -pflash is not supported. So this patch-set
> is designed to initialize the NvVarStore with the content of in
> OVMF_VARS.fd.
> 
> patch 1:
>  Add a new function (AllocateRuntimePages) in PrePiMemoryAllocationLib.
>  This function will be used in PeilessStartupLib which will run
>  in SEC phase.
> 
> patch 2:
>  Delete the TdxValidateCfv in PeilessStartupLib. Because it is going to
>  be renamed to PlatformValidateNvVarStore and be moved to PlatformInitLib.
> 
> patch 3 - 7:
>  Then we add functions for EmuVariableNvStore in PlatformInitLib. This
>  lib will then be called in OvmfPkg/PlatformPei and PeilessStartupLib.
>  We also shortcut ConnectNvVarsToFileSystem in secure-boot.
> 
> patch 8:
>  At last a build-flag (SECURE_BOOT_FEATURE_ENABLED) is introduced in
>  the dsc in OvmfPkg. Because the copy over of OVMR_VARS.fd to
>  EmuVariableNvStore is only required when secure-boot is enabled.
> 
> Code: https://github.com/mxu9/edk2/tree/secure-boot.v3

/usr/bin/ld: /home/kraxel/projects/edk2/Build/IntelTdx/DEBUG_GCC5/X64/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib/OUTPUT/SecPeiCpuExceptionHandlerLib.lib(ExceptionHandlerAsm.obj): warning: relocation in read-only section `.text'
/usr/bin/ld: /tmp/ccCEPSuH.ltrans0.ltrans.o: in function `SecCoreStartupWithStack':
/home/kraxel/projects/edk2/OvmfPkg/Library/PlatformInitLib/Platform.c:760: undefined reference to `AllocateRuntimePages'
/usr/bin/ld: /tmp/ccCEPSuH.ltrans0.ltrans.o:/home/kraxel/projects/edk2/OvmfPkg/Library/PlatformInitLib/Platform.c:760: undefined reference to `AllocateRuntimePages'
/usr/bin/ld: warning: creating DT_TEXTREL in a PIE
collect2: error: ld returned 1 exit status
make: *** [GNUmakefile:431: /home/kraxel/projects/edk2/Build/IntelTdx/DEBUG_GCC5/X64/OvmfPkg/IntelTdx/Sec/SecMain/DEBUG/SecMain.dll] Error 1

adding a build test for intel tdx to ci is probably a good idea ...

take care,
  Gerd



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#90929): https://edk2.groups.io/g/devel/message/90929
Mute This Topic: https://groups.io/mt/92061200/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-

On June 30, 2022 9:28 PM, Gerd Hoffmann wrote:
> On Wed, Jun 29, 2022 at 04:56:56PM +0800, Min Xu wrote:
> > Secure-Boot related variables include the PK/KEK/DB/DBX and they are
> > stored in NvVarStore (OVMF_VARS.fd). When lauching with -pflash,
> > QEMU/OVMF will use emulated flash, and fully support UEFI variables.
> > But when launching with -bios parameter, UEFI variables will be
> > partially emulated, and non-volatile variables may lose their contents
> > after a reboot. See OvmfPkg/README.
> >
> > Tdx guest is an example that -pflash is not supported. So this
> > patch-set is designed to initialize the NvVarStore with the content of
> > in OVMF_VARS.fd.
> >
> > patch 1:
> >  Add a new function (AllocateRuntimePages) in PrePiMemoryAllocationLib.
> >  This function will be used in PeilessStartupLib which will run  in
> > SEC phase.
> >
> > patch 2:
> >  Delete the TdxValidateCfv in PeilessStartupLib. Because it is going
> > to  be renamed to PlatformValidateNvVarStore and be moved to
> PlatformInitLib.
> >
> > patch 3 - 7:
> >  Then we add functions for EmuVariableNvStore in PlatformInitLib. This
> > lib will then be called in OvmfPkg/PlatformPei and PeilessStartupLib.
> >  We also shortcut ConnectNvVarsToFileSystem in secure-boot.
> >
> > patch 8:
> >  At last a build-flag (SECURE_BOOT_FEATURE_ENABLED) is introduced in
> > the dsc in OvmfPkg. Because the copy over of OVMR_VARS.fd to
> > EmuVariableNvStore is only required when secure-boot is enabled.
> >
> > Code: https://github.com/mxu9/edk2/tree/secure-boot.v3
> 
> /usr/bin/ld:
> /home/kraxel/projects/edk2/Build/IntelTdx/DEBUG_GCC5/X64/UefiCpuPkg/
> Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib/OUTPUT/S
> ecPeiCpuExceptionHandlerLib.lib(ExceptionHandlerAsm.obj): warning:
> relocation in read-only section `.text'
> /usr/bin/ld: /tmp/ccCEPSuH.ltrans0.ltrans.o: in function
> `SecCoreStartupWithStack':
> /home/kraxel/projects/edk2/OvmfPkg/Library/PlatformInitLib/Platform.c:76
> 0: undefined reference to `AllocateRuntimePages'
> /usr/bin/ld:
> /tmp/ccCEPSuH.ltrans0.ltrans.o:/home/kraxel/projects/edk2/OvmfPkg/Libra
> ry/PlatformInitLib/Platform.c:760: undefined reference to
> `AllocateRuntimePages'
> /usr/bin/ld: warning: creating DT_TEXTREL in a PIE
> collect2: error: ld returned 1 exit status
> make: *** [GNUmakefile:431:
> /home/kraxel/projects/edk2/Build/IntelTdx/DEBUG_GCC5/X64/OvmfPkg/Int
> elTdx/Sec/SecMain/DEBUG/SecMain.dll] Error 1
> 
Ah  my bad. I forgot sending below patch in the series.
fec80e84db 2022-06-22 EmbeddedPkg: Add AllocateRuntimePages in PrePiMemoryAllocationLib [Min M Xu]
It is in https://github.com/mxu9/edk2/tree/secure-boot.v3
I will send a new version with this patch soon.

> adding a build test for intel tdx to ci is probably a good idea ...
I have submit  such build test and it has been acked-by. But it hasn't been merged. I will ask Jiewen to merge it.
https://edk2.groups.io/g/devel/message/89803

Thanks
Min


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#90938): https://edk2.groups.io/g/devel/message/90938
Mute This Topic: https://groups.io/mt/92061200/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-