From nobody Mon May 6 01:27:21 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+93172+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+93172+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1662438978; cv=none; d=zohomail.com; s=zohoarc; b=AShJaeX4upD8B/90I+LexNxceffIO1C4+br2cIzaPI44osmxcGhpDbV5QLHzRbSylfMh/ghmB41rSnYXv45Eaz6z+aQReGgD4NQjswM23XLeK+PtHUk6wmkhDnsBqrCjOGULSTbl500ECCKnOaT5h97+ohf292327fEkxSzdRhc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1662438978; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=Duq0040DhpV9peWOFLpa8CjoUjgFNN92r1pBS4jlvfg=; b=QXu8vXRGIfnQWjaOTDaVl8fFdR7kGC8HlzBdZYEXHnVcTQXUOA05Tc0ph42uIF7hZ0NPE+YNONiV+5txY/UfQU9/7tkvPkdvgr0ImICUnMa2+jPpUHY5XOKxAbZo/0AoC57340E/sIwKcj/iwllHvQ9kYmBpqctW9vv2rkLfdAI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+93172+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1662438978869271.4417744456798; Mon, 5 Sep 2022 21:36:18 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id eXUgYY1788612xY5fpjCTFq6; Mon, 05 Sep 2022 21:36:18 -0700 X-Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by mx.groups.io with SMTP id smtpd.web12.303.1662438976985344787 for ; Mon, 05 Sep 2022 21:36:17 -0700 X-IronPort-AV: E=McAfee;i="6500,9779,10461"; a="296502056" X-IronPort-AV: E=Sophos;i="5.93,293,1654585200"; d="scan'208";a="296502056" X-Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga103.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 05 Sep 2022 21:36:17 -0700 X-IronPort-AV: E=Sophos;i="5.93,293,1654585200"; d="scan'208";a="675517285" X-Received: from mxu9-mobl1.ccr.corp.intel.com ([10.238.4.118]) by fmsmga008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 05 Sep 2022 21:36:16 -0700 From: "Min Xu" To: devel@edk2.groups.io Cc: Min M Xu , Leif Lindholm , Ard Biesheuvel , Abner Chang , Daniel Schaefer , Gerd Hoffmann Subject: [edk2-devel] [PATCH V5 1/8] EmbeddedPkg: Add AllocateRuntimePages in PrePiMemoryAllocationLib Date: Tue, 6 Sep 2022 12:35:53 +0800 Message-Id: <37f4a6991238ab679abe674d4f48141d59b06e42.1662423715.git.min.m.xu@intel.com> In-Reply-To: References: MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,min.m.xu@intel.com X-Gm-Message-State: cNxQKWTuqYJ47Q8upWR0QPclx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1662438978; bh=EgYAzabqWePv3UO+IKKIpSeY+tODbFSxmLXNT3Opvzg=; h=Cc:Date:From:Reply-To:Subject:To; b=dCNkb63KowEioXoN0zSrI06C0/3Tg6yUDWdrIRHRsoa8gZ2ErMJXMKK/LW19TQeZEa1 5OKqQDtqpiI58KO038dAWpUHwYxeH5cCayN1U55TNzrqrE7ejffV6KQbvyL+G4F0Py0iI zqqlzLHJxPezZ/9liF6j3wTGf3FLf3JK82E= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1662438979733100005 Content-Type: text/plain; charset="utf-8" From: Min M Xu AllocateRuntimePages is used to allocate one or more 4KB pages of type EfiRuntimeServicesData. Cc: Leif Lindholm Cc: Ard Biesheuvel Cc: Abner Chang Cc: Daniel Schaefer Cc: Gerd Hoffmann Reviewed-by: Ard Biesheuvel Acked-by: Gerd Hoffmann Signed-off-by: Min Xu Reviewed-by: Jiewen Yao --- EmbeddedPkg/Include/Library/PrePiLib.h | 19 ++++++ .../MemoryAllocationLib.c | 65 ++++++++++++++----- 2 files changed, 68 insertions(+), 16 deletions(-) diff --git a/EmbeddedPkg/Include/Library/PrePiLib.h b/EmbeddedPkg/Include/L= ibrary/PrePiLib.h index 7b2cea296f1c..3741b08c4478 100644 --- a/EmbeddedPkg/Include/Library/PrePiLib.h +++ b/EmbeddedPkg/Include/Library/PrePiLib.h @@ -665,6 +665,25 @@ AllocatePages ( IN UINTN Pages ); =20 +/** + Allocates one or more 4KB pages of type EfiRuntimeServicesData. + + Allocates the number of 4KB pages of type EfiRuntimeServicesData and ret= urns a pointer to the + allocated buffer. The buffer returned is aligned on a 4KB boundary. If= Pages is 0, then NULL + is returned. If there is not enough memory remaining to satisfy the req= uest, then NULL is + returned. + + @param Pages The number of 4 KB pages to allocate. + + @return A pointer to the allocated buffer or NULL if allocation fails. + +**/ +VOID * +EFIAPI +AllocateRuntimePages ( + IN UINTN Pages + ); + /** Allocates a buffer of type EfiBootServicesData. =20 diff --git a/EmbeddedPkg/Library/PrePiMemoryAllocationLib/MemoryAllocationL= ib.c b/EmbeddedPkg/Library/PrePiMemoryAllocationLib/MemoryAllocationLib.c index 78f8da5e9527..2cc2a7112197 100644 --- a/EmbeddedPkg/Library/PrePiMemoryAllocationLib/MemoryAllocationLib.c +++ b/EmbeddedPkg/Library/PrePiMemoryAllocationLib/MemoryAllocationLib.c @@ -14,23 +14,12 @@ #include #include =20 -/** - Allocates one or more 4KB pages of type EfiBootServicesData. - - Allocates the number of 4KB pages of MemoryType and returns a pointer to= the - allocated buffer. The buffer returned is aligned on a 4KB boundary. If= Pages is 0, then NULL - is returned. If there is not enough memory remaining to satisfy the req= uest, then NULL is - returned. - - @param Pages The number of 4 KB pages to allocate. - - @return A pointer to the allocated buffer or NULL if allocation fails. - -**/ +STATIC VOID * EFIAPI -AllocatePages ( - IN UINTN Pages +InternalAllocatePages ( + IN UINTN Pages, + IN EFI_MEMORY_TYPE MemoryType ) { EFI_PEI_HOB_POINTERS Hob; @@ -65,12 +54,56 @@ AllocatePages ( BuildMemoryAllocationHob ( Hob.HandoffInformationTable->EfiFreeMemoryTop, Pages * EFI_PAGE_SIZE, - EfiBootServicesData + MemoryType ); return (VOID *)(UINTN)Hob.HandoffInformationTable->EfiFreeMemoryTop; } } =20 +/** + Allocates one or more 4KB pages of type EfiBootServicesData. + + Allocates the number of 4KB pages of MemoryType and returns a pointer to= the + allocated buffer. The buffer returned is aligned on a 4KB boundary. If= Pages is 0, then NULL + is returned. If there is not enough memory remaining to satisfy the req= uest, then NULL is + returned. + + @param Pages The number of 4 KB pages to allocate. + + @return A pointer to the allocated buffer or NULL if allocation fails. + +**/ +VOID * +EFIAPI +AllocatePages ( + IN UINTN Pages + ) +{ + return InternalAllocatePages (Pages, EfiBootServicesData); +} + +/** + Allocates one or more 4KB pages of type EfiRuntimeServicesData. + + Allocates the number of 4KB pages of type EfiRuntimeServicesData and ret= urns a pointer to the + allocated buffer. The buffer returned is aligned on a 4KB boundary. If= Pages is 0, then NULL + is returned. If there is not enough memory remaining to satisfy the req= uest, then NULL is + returned. + + @param Pages The number of 4 KB pages to allocate. + + @return A pointer to the allocated buffer or NULL if allocation fails. + +**/ +VOID * +EFIAPI +AllocateRuntimePages ( + IN UINTN Pages + ) +{ + return InternalAllocatePages (Pages, EfiRuntimeServicesData); +} + /** Allocates one or more 4KB pages of type EfiBootServicesData at a specifi= ed alignment. =20 --=20 2.29.2.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#93172): https://edk2.groups.io/g/devel/message/93172 Mute This Topic: https://groups.io/mt/93494904/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Mon May 6 01:27:21 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+93173+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+93173+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1662438980; cv=none; d=zohomail.com; s=zohoarc; b=c8vhyJ+ZMt8K8Ee2WJqsSuRufXew8O/Fclgvh/OAsbVKLBRgiUnRZpcFfXUP+GsTbdptpVGRHHrkD2HPohkGcMmDDCAEl+EXOF6/PPm+V8au/KnE34pxVJHA5EU1WPlOczObuaW4DXAnUowYGs2+X9pBLRH7Rqa5xecDwxI6wb4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1662438980; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=hGBS770IoLlOj65f2OMD71b8df6ssFae3uIhjYyZq2Y=; b=cJEaneTT29t6uHtvtb6WLWTc4v+PiS1gmGAncsD5YBhvhFiKCxK6SDIx7/mi+nBgRTO2BjKT7Gl97q+SDPuSeebBki1GRcktT588PrLikXOGj5Zg1l6eojZEmZdiLB0my4QrsAnfmFIgDqrLgEzOUSknHihhR8ksihl2KHi5a1A= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+93173+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 166243898061564.91535031808644; Mon, 5 Sep 2022 21:36:20 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id X4x5YY1788612xvMmvWIIR8w; Mon, 05 Sep 2022 21:36:20 -0700 X-Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by mx.groups.io with SMTP id smtpd.web12.303.1662438976985344787 for ; Mon, 05 Sep 2022 21:36:19 -0700 X-IronPort-AV: E=McAfee;i="6500,9779,10461"; a="296502070" X-IronPort-AV: E=Sophos;i="5.93,293,1654585200"; d="scan'208";a="296502070" X-Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga103.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 05 Sep 2022 21:36:19 -0700 X-IronPort-AV: E=Sophos;i="5.93,293,1654585200"; d="scan'208";a="675517297" X-Received: from mxu9-mobl1.ccr.corp.intel.com ([10.238.4.118]) by fmsmga008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 05 Sep 2022 21:36:17 -0700 From: "Min Xu" To: devel@edk2.groups.io Cc: Min M Xu , Erdem Aktas , James Bottomley , Jiewen Yao , Tom Lendacky , Gerd Hoffmann Subject: [edk2-devel] [PATCH V5 2/8] OvmfPkg/PeilessStartupLib: Delete TdxValidateCfv Date: Tue, 6 Sep 2022 12:35:54 +0800 Message-Id: <5ac85169d838a157e806fecf282c3a91a6d4381b.1662423715.git.min.m.xu@intel.com> In-Reply-To: References: MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,min.m.xu@intel.com X-Gm-Message-State: Z9WGOejWqfIHsqfPNGjxOc5Sx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1662438980; bh=LgWz2TDKrPfh9v3+//5WhKIboJj3KvtDunFsctSUn1E=; h=Cc:Date:From:Reply-To:Subject:To; b=gMKPl6X9fLMJjtGK8iPlV4nBkIwD6Lsn2WO3gUYjU7UQg0eddtgm46rEWFKctkOBBbM 6mtr7nb7MEGDw4IeafmeIuo+DW+WQpFJ+ilEqkb5AAbsJogXoX/XFHZOPIMBIcYivb1u/ VzKquIqe+JIfoVQ0THYgn9qUOhIrN0pHWrY= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1662438981785100011 Content-Type: text/plain; charset="utf-8" From: Min M Xu TdxValidateCfv is used to validate the integrity of FlashNvVarStore (PcdOvmfFlashNvStorageVariableBase) and it is not Tdx specific. So it will be moved to PlatformInitLib and be renamed to PlatformValidateNvVarStore in the following patch. And it will be called before EmuVaribleNvStore is initialized with the content in FlashNvVarStore. Cc: Erdem Aktas Cc: James Bottomley Cc: Jiewen Yao Cc: Tom Lendacky Cc: Gerd Hoffmann Acked-by: Gerd Hoffmann Signed-off-by: Min Xu Reviewed-by: Jiewen Yao --- OvmfPkg/Library/PeilessStartupLib/IntelTdx.c | 153 ------------------ .../PeilessStartupLib/PeilessStartup.c | 8 - .../PeilessStartupInternal.h | 17 -- 3 files changed, 178 deletions(-) diff --git a/OvmfPkg/Library/PeilessStartupLib/IntelTdx.c b/OvmfPkg/Library= /PeilessStartupLib/IntelTdx.c index 484fd21057c8..216c413caad5 100644 --- a/OvmfPkg/Library/PeilessStartupLib/IntelTdx.c +++ b/OvmfPkg/Library/PeilessStartupLib/IntelTdx.c @@ -7,8 +7,6 @@ #include #include #include -#include -#include #include #include #include @@ -37,157 +35,6 @@ typedef struct { =20 #pragma pack() =20 -/** - Check padding data all bit should be 1. - - @param[in] Buffer - A pointer to buffer header - @param[in] BufferSize - Buffer size - - @retval TRUE - The padding data is valid. - @retval TRUE - The padding data is invalid. - -**/ -BOOLEAN -CheckPaddingData ( - IN UINT8 *Buffer, - IN UINT32 BufferSize - ) -{ - UINT32 index; - - for (index =3D 0; index < BufferSize; index++) { - if (Buffer[index] !=3D 0xFF) { - return FALSE; - } - } - - return TRUE; -} - -/** - Check the integrity of CFV data. - - @param[in] TdxCfvBase - A pointer to CFV header - @param[in] TdxCfvSize - CFV data size - - @retval TRUE - The CFV data is valid. - @retval FALSE - The CFV data is invalid. - -**/ -BOOLEAN -EFIAPI -TdxValidateCfv ( - IN UINT8 *TdxCfvBase, - IN UINT32 TdxCfvSize - ) -{ - UINT16 Checksum; - UINTN VariableBase; - UINT32 VariableOffset; - UINT32 VariableOffsetBeforeAlign; - EFI_FIRMWARE_VOLUME_HEADER *CfvFvHeader; - VARIABLE_STORE_HEADER *CfvVariableStoreHeader; - AUTHENTICATED_VARIABLE_HEADER *VariableHeader; - - static EFI_GUID FvHdrGUID =3D EFI_SYSTEM_NV_DATA_FV_GUID; - static EFI_GUID VarStoreHdrGUID =3D EFI_AUTHENTICATED_VARIABLE_GUID; - - VariableOffset =3D 0; - - if (TdxCfvBase =3D=3D NULL) { - DEBUG ((DEBUG_ERROR, "TDX CFV: CFV pointer is NULL\n")); - return FALSE; - } - - // - // Verify the header zerovetor, filesystemguid, - // revision, signature, attributes, fvlength, checksum - // HeaderLength cannot be an odd number - // - CfvFvHeader =3D (EFI_FIRMWARE_VOLUME_HEADER *)TdxCfvBase; - - if ((!IsZeroBuffer (CfvFvHeader->ZeroVector, 16)) || - (!CompareGuid (&FvHdrGUID, &CfvFvHeader->FileSystemGuid)) || - (CfvFvHeader->Signature !=3D EFI_FVH_SIGNATURE) || - (CfvFvHeader->Attributes !=3D 0x4feff) || - (CfvFvHeader->Revision !=3D EFI_FVH_REVISION) || - (CfvFvHeader->FvLength !=3D TdxCfvSize) - ) - { - DEBUG ((DEBUG_ERROR, "TDX CFV: Basic FV headers were invalid\n")); - return FALSE; - } - - // - // Verify the header checksum - // - Checksum =3D CalculateSum16 ((VOID *)CfvFvHeader, CfvFvHeader->HeaderLen= gth); - - if (Checksum !=3D 0) { - DEBUG ((DEBUG_ERROR, "TDX CFV: FV checksum was invalid\n")); - return FALSE; - } - - // - // Verify the header signature, size, format, state - // - CfvVariableStoreHeader =3D (VARIABLE_STORE_HEADER *)(TdxCfvBase + CfvFvH= eader->HeaderLength); - if ((!CompareGuid (&VarStoreHdrGUID, &CfvVariableStoreHeader->Signature)= ) || - (CfvVariableStoreHeader->Format !=3D VARIABLE_STORE_FORMATTED) || - (CfvVariableStoreHeader->State !=3D VARIABLE_STORE_HEALTHY) || - (CfvVariableStoreHeader->Size > (CfvFvHeader->FvLength - CfvFvHeader= ->HeaderLength)) || - (CfvVariableStoreHeader->Size < sizeof (VARIABLE_STORE_HEADER)) - ) - { - DEBUG ((DEBUG_ERROR, "TDX CFV: Variable Store header was invalid\n")); - return FALSE; - } - - // - // Verify the header startId, state - // Verify data to the end - // - VariableBase =3D (UINTN)TdxCfvBase + CfvFvHeader->HeaderLength + sizeof = (VARIABLE_STORE_HEADER); - while (VariableOffset < (CfvVariableStoreHeader->Size - sizeof (VARIABL= E_STORE_HEADER))) { - VariableHeader =3D (AUTHENTICATED_VARIABLE_HEADER *)(VariableBase + Va= riableOffset); - if (VariableHeader->StartId !=3D VARIABLE_DATA) { - if (!CheckPaddingData ((UINT8 *)VariableHeader, CfvVariableStoreHead= er->Size - sizeof (VARIABLE_STORE_HEADER) - VariableOffset)) { - DEBUG ((DEBUG_ERROR, "TDX CFV: Variable header was invalid\n")); - return FALSE; - } - - VariableOffset =3D CfvVariableStoreHeader->Size - sizeof (VARIABLE_S= TORE_HEADER); - } else { - if (!((VariableHeader->State =3D=3D VAR_IN_DELETED_TRANSITION) || - (VariableHeader->State =3D=3D VAR_DELETED) || - (VariableHeader->State =3D=3D VAR_HEADER_VALID_ONLY) || - (VariableHeader->State =3D=3D VAR_ADDED))) - { - DEBUG ((DEBUG_ERROR, "TDX CFV: Variable header was invalid\n")); - return FALSE; - } - - VariableOffset +=3D sizeof (AUTHENTICATED_VARIABLE_HEADER) + Variabl= eHeader->NameSize + VariableHeader->DataSize; - // Verify VariableOffset should be less than or equal CfvVariableSto= reHeader->Size - sizeof(VARIABLE_STORE_HEADER) - if (VariableOffset > (CfvVariableStoreHeader->Size - sizeof (VARIABL= E_STORE_HEADER))) { - DEBUG ((DEBUG_ERROR, "TDX CFV: Variable header was invalid\n")); - return FALSE; - } - - VariableOffsetBeforeAlign =3D VariableOffset; - // 4 byte align - VariableOffset =3D (VariableOffset + 3) & (UINTN)(~3); - - if (!CheckPaddingData ((UINT8 *)(VariableBase + VariableOffsetBefore= Align), VariableOffset - VariableOffsetBeforeAlign)) { - DEBUG ((DEBUG_ERROR, "TDX CFV: Variable header was invalid\n")); - return FALSE; - } - } - } - - return TRUE; -} - /** Measure the Hoblist passed from the VMM. =20 diff --git a/OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c b/OvmfPkg/L= ibrary/PeilessStartupLib/PeilessStartup.c index fdfefd00d732..7502ec44669e 100644 --- a/OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c +++ b/OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c @@ -179,14 +179,6 @@ PeilessStartup ( CpuDeadLoop (); } =20 - // - // Validate Tdx CFV - // - if (!TdxValidateCfv (CfvBase, FixedPcdGet32 (PcdCfvRawDataSize))) { - ASSERT (FALSE); - CpuDeadLoop (); - } - // // Measure Tdx CFV // diff --git a/OvmfPkg/Library/PeilessStartupLib/PeilessStartupInternal.h b/O= vmfPkg/Library/PeilessStartupLib/PeilessStartupInternal.h index 74b5f46552c2..09cac3e26c67 100644 --- a/OvmfPkg/Library/PeilessStartupLib/PeilessStartupInternal.h +++ b/OvmfPkg/Library/PeilessStartupLib/PeilessStartupInternal.h @@ -52,23 +52,6 @@ EFIAPI ConstructSecHobList ( ); =20 -/** - Check the integrity of CFV data. - - @param[in] TdxCfvBase - A pointer to CFV header - @param[in] TdxCfvSize - CFV data size - - @retval TRUE - The CFV data is valid. - @retval FALSE - The CFV data is invalid. - -**/ -BOOLEAN -EFIAPI -TdxValidateCfv ( - IN UINT8 *TdxCfvBase, - IN UINT32 TdxCfvSize - ); - /** Measure the Hoblist passed from the VMM. =20 --=20 2.29.2.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#93173): https://edk2.groups.io/g/devel/message/93173 Mute This Topic: https://groups.io/mt/93494905/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Mon May 6 01:27:21 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+93174+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+93174+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1662438982; cv=none; d=zohomail.com; s=zohoarc; b=fu+GXLmP3lGp4B7ljsilDP7RrcPdT5msJ+yamVBUxtgIaBHZiw9Ow9GN2J/zH+c+VES4e7/2eiBpxO0xq+70PtBKNVXDWTiUAhFCNZM8mX7bL8ArNA8MPCY4HEX6JWEDZbLb1F4or01DLbKvM6URGd8LKpTCCW1+TGtVFD71OiQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1662438982; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=b0RzHzjXO/NK+cctv6xsnpKTkoLc4yFoWwpbckkmTCg=; b=J2bPz4YqfKNogN3nnLXirR/V+g5+WhjrngHXENQTOB2vosL+2kCP9K4nQAhB0yVEGjzv3nhlmJG92/1zF17POr4ibuApGwNjXGaUt0gODhVDFeFWy060QrvfZ/UnueLqG9cLebXX4Am6kFYSEi5g+PcqO9OaaZKaJ7tP3k1xUCw= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+93174+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1662438982563832.1076832862127; Mon, 5 Sep 2022 21:36:22 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id qaimYY1788612xoJCq1A9UXB; Mon, 05 Sep 2022 21:36:22 -0700 X-Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by mx.groups.io with SMTP id smtpd.web12.303.1662438976985344787 for ; Mon, 05 Sep 2022 21:36:21 -0700 X-IronPort-AV: E=McAfee;i="6500,9779,10461"; a="296502074" X-IronPort-AV: E=Sophos;i="5.93,293,1654585200"; d="scan'208";a="296502074" X-Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga103.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 05 Sep 2022 21:36:21 -0700 X-IronPort-AV: E=Sophos;i="5.93,293,1654585200"; d="scan'208";a="675517306" X-Received: from mxu9-mobl1.ccr.corp.intel.com ([10.238.4.118]) by fmsmga008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 05 Sep 2022 21:36:19 -0700 From: "Min Xu" To: devel@edk2.groups.io Cc: Min M Xu , Erdem Aktas , James Bottomley , Jiewen Yao , Tom Lendacky , Gerd Hoffmann Subject: [edk2-devel] [PATCH V5 3/8] OvmfPkg/PlatformInitLib: Add functions for EmuVariableNvStore Date: Tue, 6 Sep 2022 12:35:55 +0800 Message-Id: <4f48905899b288705b9f6f3016af025821961f06.1662423715.git.min.m.xu@intel.com> In-Reply-To: References: MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,min.m.xu@intel.com X-Gm-Message-State: xuz4p6nFj40vOzIzyPGPCWvrx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1662438982; bh=guLDAtsxAnL9PAOx5OJVEUM8U5t+UvX9XiF6fD4pzI0=; h=Cc:Date:From:Reply-To:Subject:To; b=i1GvWyLXEZhmGurw/9qGRYZk0YBm7wCIP7zX1DDyWJIbtrkDRypF3xmrtQfVg+czJZR JHWGg5+S7/sMVTGY0F5+Gj/gKm159WfxdlZPaMjNn1fVDPXOJ1IeWt6fw9nYD2INfjauk 0WubGNV3Glf5PbUYjsdQvVj12mfX8DqnmZk= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1662438983791100015 Content-Type: text/plain; charset="utf-8" From: Min M Xu There are 3 functions added for EmuVariableNvStore: - PlatformReserveEmuVariableNvStore - PlatformInitEmuVariableNvStore - PlatformValidateNvVarStore PlatformReserveEmuVariableNvStore allocate storage for NV variables early on so it will be at a consistent address. PlatformInitEmuVariableNvStore copies the content in PcdOvmfFlashNvStorageVariableBase to the storage allocated by PlatformReserveEmuVariableNvStore. This is used in the case that OVMF is launched with -bios parameter. Because in that situation UEFI variables will be partially emulated, and non-volatile variables may lose their contents after a reboot. This makes the secure boot feature not working. PlatformValidateNvVarStore is renamed from TdxValidateCfv and it is used to validate the integrity of FlashNvVarStore (PcdOvmfFlashNvStorageVariableBase). It should be called before PlatformInitEmuVariableNvStore is called to copy over the content. Cc: Erdem Aktas Cc: James Bottomley Cc: Jiewen Yao Cc: Tom Lendacky Cc: Gerd Hoffmann Acked-by: Gerd Hoffmann Signed-off-by: Min Xu Reviewed-by: Jiewen Yao --- OvmfPkg/Include/Library/PlatformInitLib.h | 51 ++++ OvmfPkg/Library/PlatformInitLib/Platform.c | 238 ++++++++++++++++++ .../PlatformInitLib/PlatformInitLib.inf | 3 + 3 files changed, 292 insertions(+) diff --git a/OvmfPkg/Include/Library/PlatformInitLib.h b/OvmfPkg/Include/Li= brary/PlatformInitLib.h index 2987a367cc9c..c5234bf26d45 100644 --- a/OvmfPkg/Include/Library/PlatformInitLib.h +++ b/OvmfPkg/Include/Library/PlatformInitLib.h @@ -234,4 +234,55 @@ PlatformTdxPublishRamRegions ( VOID ); =20 +/** + Check the integrity of NvVarStore. + + @param[in] NvVarStoreBase - A pointer to NvVarStore header + @param[in] NvVarStoreSize - NvVarStore size + + @retval TRUE - The NvVarStore is valid. + @retval FALSE - The NvVarStore is invalid. + +**/ +BOOLEAN +EFIAPI +PlatformValidateNvVarStore ( + IN UINT8 *NvVarStoreBase, + IN UINT32 NvVarStoreSize + ); + +/** + Allocate storage for NV variables early on so it will be + at a consistent address. Since VM memory is preserved + across reboots, this allows the NV variable storage to survive + a VM reboot. + + * + * @retval VOID* The pointer to the storage for NV Variables + */ +VOID * +EFIAPI +PlatformReserveEmuVariableNvStore ( + VOID + ); + +/** + When OVMF is lauched with -bios parameter, UEFI variables will be + partially emulated, and non-volatile variables may lose their contents + after a reboot. This makes the secure boot feature not working. + + This function is used to initialize the EmuVariableNvStore + with the conent in PcdOvmfFlashNvStorageVariableBase. + + @param[in] EmuVariableNvStore - A pointer to EmuVariableNvStore + + @retval EFI_SUCCESS - Successfully init the EmuVariableNvStore + @retval Others - As the error code indicates + */ +EFI_STATUS +EFIAPI +PlatformInitEmuVariableNvStore ( + IN VOID *EmuVariableNvStore + ); + #endif // PLATFORM_INIT_LIB_H_ diff --git a/OvmfPkg/Library/PlatformInitLib/Platform.c b/OvmfPkg/Library/P= latformInitLib/Platform.c index c3d34e43af5a..2582689ffe35 100644 --- a/OvmfPkg/Library/PlatformInitLib/Platform.c +++ b/OvmfPkg/Library/PlatformInitLib/Platform.c @@ -25,10 +25,13 @@ #include #include #include +#include #include #include #include #include +#include +#include #include =20 #include @@ -576,3 +579,238 @@ PlatformMaxCpuCountInitialization ( PlatformInfoHob->PcdCpuMaxLogicalProcessorNumber =3D MaxCpuCount; PlatformInfoHob->PcdCpuBootLogicalProcessorNumber =3D BootCpuCount; } + +/** + Check padding data all bit should be 1. + + @param[in] Buffer - A pointer to buffer header + @param[in] BufferSize - Buffer size + + @retval TRUE - The padding data is valid. + @retval TRUE - The padding data is invalid. + +**/ +BOOLEAN +CheckPaddingData ( + IN UINT8 *Buffer, + IN UINT32 BufferSize + ) +{ + UINT32 index; + + for (index =3D 0; index < BufferSize; index++) { + if (Buffer[index] !=3D 0xFF) { + return FALSE; + } + } + + return TRUE; +} + +/** + Check the integrity of NvVarStore. + + @param[in] NvVarStoreBase - A pointer to NvVarStore header + @param[in] NvVarStoreSize - NvVarStore size + + @retval TRUE - The NvVarStore is valid. + @retval FALSE - The NvVarStore is invalid. + +**/ +BOOLEAN +EFIAPI +PlatformValidateNvVarStore ( + IN UINT8 *NvVarStoreBase, + IN UINT32 NvVarStoreSize + ) +{ + UINT16 Checksum; + UINTN VariableBase; + UINT32 VariableOffset; + UINT32 VariableOffsetBeforeAlign; + EFI_FIRMWARE_VOLUME_HEADER *NvVarStoreFvHeader; + VARIABLE_STORE_HEADER *NvVarStoreHeader; + AUTHENTICATED_VARIABLE_HEADER *VariableHeader; + + static EFI_GUID FvHdrGUID =3D EFI_SYSTEM_NV_DATA_FV_GUID; + static EFI_GUID VarStoreHdrGUID =3D EFI_AUTHENTICATED_VARIABLE_GUID; + + VariableOffset =3D 0; + + if (NvVarStoreBase =3D=3D NULL) { + DEBUG ((DEBUG_ERROR, "NvVarStore pointer is NULL.\n")); + return FALSE; + } + + // + // Verify the header zerovetor, filesystemguid, + // revision, signature, attributes, fvlength, checksum + // HeaderLength cannot be an odd number + // + NvVarStoreFvHeader =3D (EFI_FIRMWARE_VOLUME_HEADER *)NvVarStoreBase; + + if ((!IsZeroBuffer (NvVarStoreFvHeader->ZeroVector, 16)) || + (!CompareGuid (&FvHdrGUID, &NvVarStoreFvHeader->FileSystemGuid)) || + (NvVarStoreFvHeader->Signature !=3D EFI_FVH_SIGNATURE) || + (NvVarStoreFvHeader->Attributes !=3D 0x4feff) || + (NvVarStoreFvHeader->Revision !=3D EFI_FVH_REVISION) || + (NvVarStoreFvHeader->FvLength !=3D NvVarStoreSize) + ) + { + DEBUG ((DEBUG_ERROR, "NvVarStore FV headers were invalid.\n")); + return FALSE; + } + + // + // Verify the header checksum + // + Checksum =3D CalculateSum16 ((VOID *)NvVarStoreFvHeader, NvVarStoreFvHea= der->HeaderLength); + + if (Checksum !=3D 0) { + DEBUG ((DEBUG_ERROR, "NvVarStore FV checksum was invalid.\n")); + return FALSE; + } + + // + // Verify the header signature, size, format, state + // + NvVarStoreHeader =3D (VARIABLE_STORE_HEADER *)(NvVarStoreBase + NvVarSto= reFvHeader->HeaderLength); + if ((!CompareGuid (&VarStoreHdrGUID, &NvVarStoreHeader->Signature)) || + (NvVarStoreHeader->Format !=3D VARIABLE_STORE_FORMATTED) || + (NvVarStoreHeader->State !=3D VARIABLE_STORE_HEALTHY) || + (NvVarStoreHeader->Size > (NvVarStoreFvHeader->FvLength - NvVarStore= FvHeader->HeaderLength)) || + (NvVarStoreHeader->Size < sizeof (VARIABLE_STORE_HEADER)) + ) + { + DEBUG ((DEBUG_ERROR, "NvVarStore header signature/size/format/state we= re invalid.\n")); + return FALSE; + } + + // + // Verify the header startId, state + // Verify data to the end + // + VariableBase =3D (UINTN)NvVarStoreBase + NvVarStoreFvHeader->HeaderLengt= h + sizeof (VARIABLE_STORE_HEADER); + while (VariableOffset < (NvVarStoreHeader->Size - sizeof (VARIABLE_STOR= E_HEADER))) { + VariableHeader =3D (AUTHENTICATED_VARIABLE_HEADER *)(VariableBase + Va= riableOffset); + if (VariableHeader->StartId !=3D VARIABLE_DATA) { + if (!CheckPaddingData ((UINT8 *)VariableHeader, NvVarStoreHeader->Si= ze - sizeof (VARIABLE_STORE_HEADER) - VariableOffset)) { + DEBUG ((DEBUG_ERROR, "NvVarStore variable header StartId was inval= id.\n")); + return FALSE; + } + + VariableOffset =3D NvVarStoreHeader->Size - sizeof (VARIABLE_STORE_H= EADER); + } else { + if (!((VariableHeader->State =3D=3D VAR_IN_DELETED_TRANSITION) || + (VariableHeader->State =3D=3D VAR_DELETED) || + (VariableHeader->State =3D=3D VAR_HEADER_VALID_ONLY) || + (VariableHeader->State =3D=3D VAR_ADDED))) + { + DEBUG ((DEBUG_ERROR, "NvVarStore Variable header State was invalid= .\n")); + return FALSE; + } + + VariableOffset +=3D sizeof (AUTHENTICATED_VARIABLE_HEADER) + Variabl= eHeader->NameSize + VariableHeader->DataSize; + // Verify VariableOffset should be less than or equal NvVarStoreHead= er->Size - sizeof(VARIABLE_STORE_HEADER) + if (VariableOffset > (NvVarStoreHeader->Size - sizeof (VARIABLE_STOR= E_HEADER))) { + DEBUG ((DEBUG_ERROR, "NvVarStore Variable header VariableOffset wa= s invalid.\n")); + return FALSE; + } + + VariableOffsetBeforeAlign =3D VariableOffset; + // 4 byte align + VariableOffset =3D (VariableOffset + 3) & (UINTN)(~3); + + if (!CheckPaddingData ((UINT8 *)(VariableBase + VariableOffsetBefore= Align), VariableOffset - VariableOffsetBeforeAlign)) { + DEBUG ((DEBUG_ERROR, "NvVarStore Variable header PaddingData was i= nvalid.\n")); + return FALSE; + } + } + } + + return TRUE; +} + +/** + Allocate storage for NV variables early on so it will be + at a consistent address. Since VM memory is preserved + across reboots, this allows the NV variable storage to survive + a VM reboot. + + * + * @retval VOID* The pointer to the storage for NV Variables + */ +VOID * +EFIAPI +PlatformReserveEmuVariableNvStore ( + VOID + ) +{ + VOID *VariableStore; + UINT32 VarStoreSize; + + VarStoreSize =3D 2 * PcdGet32 (PcdFlashNvStorageFtwSpareSize); + // + // Allocate storage for NV variables early on so it will be + // at a consistent address. Since VM memory is preserved + // across reboots, this allows the NV variable storage to survive + // a VM reboot. + // + VariableStore =3D + AllocateRuntimePages ( + EFI_SIZE_TO_PAGES (VarStoreSize) + ); + DEBUG (( + DEBUG_INFO, + "Reserved variable store memory: 0x%p; size: %dkb\n", + VariableStore, + VarStoreSize / 1024 + )); + + return VariableStore; +} + +/** + When OVMF is lauched with -bios parameter, UEFI variables will be + partially emulated, and non-volatile variables may lose their contents + after a reboot. This makes the secure boot feature not working. + + This function is used to initialize the EmuVariableNvStore + with the conent in PcdOvmfFlashNvStorageVariableBase. + + @param[in] EmuVariableNvStore - A pointer to EmuVariableNvStore + + @retval EFI_SUCCESS - Successfully init the EmuVariableNvStore + @retval Others - As the error code indicates + */ +EFI_STATUS +EFIAPI +PlatformInitEmuVariableNvStore ( + IN VOID *EmuVariableNvStore + ) +{ + UINT8 *Base; + UINT32 Size; + UINT32 EmuVariableNvStoreSize; + + EmuVariableNvStoreSize =3D 2 * PcdGet32 (PcdFlashNvStorageFtwSpareSize); + if ((EmuVariableNvStore =3D=3D NULL) || (EmuVariableNvStoreSize =3D=3D 0= )) { + DEBUG ((DEBUG_ERROR, "Invalid EmuVariableNvStore parameter.\n")); + return EFI_INVALID_PARAMETER; + } + + Base =3D (UINT8 *)(UINTN)PcdGet32 (PcdOvmfFlashNvStorageVariableBase); + Size =3D (UINT32)PcdGet32 (PcdFlashNvStorageVariableSize); + ASSERT (Size < EmuVariableNvStoreSize); + + if (!PlatformValidateNvVarStore (Base, PcdGet32 (PcdCfvRawDataSize))) { + ASSERT (FALSE); + return EFI_INVALID_PARAMETER; + } + + DEBUG ((DEBUG_INFO, "Init EmuVariableNvStore with the content in FlashNv= Storage\n")); + + CopyMem (EmuVariableNvStore, Base, Size); + + return EFI_SUCCESS; +} diff --git a/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf b/OvmfPkg/= Library/PlatformInitLib/PlatformInitLib.inf index d2fa2d998df8..86a82ad3e084 100644 --- a/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf +++ b/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf @@ -47,6 +47,7 @@ HobLib QemuFwCfgLib QemuFwCfgSimpleParserLib + MemoryAllocationLib MtrrLib PcdLib PciLib @@ -96,6 +97,8 @@ gUefiOvmfPkgTokenSpaceGuid.PcdGuidedExtractHandlerTableSize =20 gUefiOvmfPkgTokenSpaceGuid.PcdTdxAcceptPageSize + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfFlashNvStorageVariableBase + gUefiOvmfPkgTokenSpaceGuid.PcdCfvRawDataSize =20 [FeaturePcd] gEfiMdeModulePkgTokenSpaceGuid.PcdDxeIplSwitchToLongMode --=20 2.29.2.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#93174): https://edk2.groups.io/g/devel/message/93174 Mute This Topic: https://groups.io/mt/93494906/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Mon May 6 01:27:21 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+93175+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+93175+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1662438984; cv=none; d=zohomail.com; s=zohoarc; b=hSr6k6sSFdBTRh8/Moj+1TO6CW+7ABZXEFBgaHIpR4J68rcSb7I2ZHdyc9Rc0OgvgpRJBfOPQz4Qb6AJZhGiwxCtd9cX3LJDI3NiNPZBrMlOlL3dTy8D4N3hBWgsgZiHjr2YhIXVqudHYsqBdWMoiLJK1wFwW6B+5yDAp6/LULk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1662438984; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=c5iLvTJ2hai8wif+kTEwqj2vyEdPnBRjY7ofeyFkFqY=; b=KJyoI86qdDawec4y4qwsvPoEnMfTd8vai45F9lTkd7ZKjKG9O4kqegbMsj9Nxot5tu/l7LDHs6NQYSJFzs6MyxGWqYP4AJhoj3vXB+oqdPLqG787XpxXEcIZWuhqbO3Z1kpSGr75F+ycN1m8lDPulDTWDFnXZaApfo1zfjJNyQc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+93175+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1662438984320761.893232638665; Mon, 5 Sep 2022 21:36:24 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id FKtwYY1788612xUu3fAxt4Y4; Mon, 05 Sep 2022 21:36:24 -0700 X-Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by mx.groups.io with SMTP id smtpd.web12.303.1662438976985344787 for ; Mon, 05 Sep 2022 21:36:23 -0700 X-IronPort-AV: E=McAfee;i="6500,9779,10461"; a="296502078" X-IronPort-AV: E=Sophos;i="5.93,293,1654585200"; d="scan'208";a="296502078" X-Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga103.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 05 Sep 2022 21:36:23 -0700 X-IronPort-AV: E=Sophos;i="5.93,293,1654585200"; d="scan'208";a="675517312" X-Received: from mxu9-mobl1.ccr.corp.intel.com ([10.238.4.118]) by fmsmga008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 05 Sep 2022 21:36:21 -0700 From: "Min Xu" To: devel@edk2.groups.io Cc: Min M Xu , Erdem Aktas , James Bottomley , Jiewen Yao , Tom Lendacky , Gerd Hoffmann Subject: [edk2-devel] [PATCH V5 4/8] OvmfPkg/PlatformPei: Update ReserveEmuVariableNvStore Date: Tue, 6 Sep 2022 12:35:56 +0800 Message-Id: In-Reply-To: References: MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,min.m.xu@intel.com X-Gm-Message-State: obbhhe2wnNUPGmsE5pqOEHIKx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1662438984; bh=8gfYfJZW2s3B+DQiCQsdFyobli4HJZjuyuf/FkpBx0A=; h=Cc:Date:From:Reply-To:Subject:To; b=krnPeelpcfmUK+QrtQzW26etetwPeOH1tQTWgNtEjOObIZANMIVBAEXyH5GRMBPW75p Ygocp36mE1grxmqFzzFbQMeoeAFwUc7y0qttbpdj6CB4ngaamTN8mVVmm58wCvSS/qUJo 208lQdQRaGPp1g8+tp7yqMSq9KHQ+2MpT7U= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1662438985744100019 Content-Type: text/plain; charset="utf-8" From: Min M Xu ReserveEmuVariableNvStore is updated with below 2 functions defined in PlatformInitLib: - PlatformReserveEmuVariableNvStore - PlatformInitEmuVariableNvStore PlatformInitEmuVariableNvStore works when secure boot feature is enabled. This is because secure boot needs the EFI variables (PK/KEK/DB/DBX, etc) and EmuVariableNvStore is cleared when OVMF is launched with -bios parameter. Cc: Erdem Aktas Cc: James Bottomley Cc: Jiewen Yao Cc: Tom Lendacky Cc: Gerd Hoffmann Acked-by: Gerd Hoffmann Signed-off-by: Min Xu Reviewed-by: Jiewen Yao --- OvmfPkg/PlatformPei/Platform.c | 25 +++++++------------------ 1 file changed, 7 insertions(+), 18 deletions(-) diff --git a/OvmfPkg/PlatformPei/Platform.c b/OvmfPkg/PlatformPei/Platform.c index 009db67ee60a..b1f8140d6041 100644 --- a/OvmfPkg/PlatformPei/Platform.c +++ b/OvmfPkg/PlatformPei/Platform.c @@ -220,24 +220,13 @@ ReserveEmuVariableNvStore ( EFI_PHYSICAL_ADDRESS VariableStore; RETURN_STATUS PcdStatus; =20 - // - // Allocate storage for NV variables early on so it will be - // at a consistent address. Since VM memory is preserved - // across reboots, this allows the NV variable storage to survive - // a VM reboot. - // - VariableStore =3D - (EFI_PHYSICAL_ADDRESS)(UINTN) - AllocateRuntimePages ( - EFI_SIZE_TO_PAGES (2 * PcdGet32 (PcdFlashNvStorageFtwSpareSize)) - ); - DEBUG (( - DEBUG_INFO, - "Reserved variable store memory: 0x%lX; size: %dkb\n", - VariableStore, - (2 * PcdGet32 (PcdFlashNvStorageFtwSpareSize)) / 1024 - )); - PcdStatus =3D PcdSet64S (PcdEmuVariableNvStoreReserved, VariableStore); + VariableStore =3D (EFI_PHYSICAL_ADDRESS)(UINTN)PlatformReserveEmuVariabl= eNvStore (); + PcdStatus =3D PcdSet64S (PcdEmuVariableNvStoreReserved, VariableStor= e); + + #ifdef SECURE_BOOT_FEATURE_ENABLED + PlatformInitEmuVariableNvStore ((VOID *)(UINTN)VariableStore); + #endif + ASSERT_RETURN_ERROR (PcdStatus); } =20 --=20 2.29.2.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#93175): https://edk2.groups.io/g/devel/message/93175 Mute This Topic: https://groups.io/mt/93494907/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Mon May 6 01:27:21 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+93176+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+93176+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1662438986; cv=none; d=zohomail.com; s=zohoarc; b=WK/H2qRvOG5590QCaHrYjSbQ9exPQE+K9iYhYIYCJpIRHNWjSxbHM3+vz2r2K+CHFHGJtYARDupgVsH5haYAOOepXw9O9sloXa9em4mX3qNcm8K5Ra9aEsf0GBs3cuobWoayM96K+MD9QlLvvdM4pvwClSsDp5zXrag3E44ObL0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1662438986; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=qTq2H9uD1ZddbdCZgt2runGaHym+P0ae6UYlxyrw9Nc=; b=cMMQ6xv4AR6/pwjSxrqwgIsH7WJ7hLYTHv9J1q98SKDmpYw/Cy08w6w9NmN801kHTt/vOsc2d1kqGkh3JG500nzBN7NL59E6Ru1TKQEtdUKLw0D/7ysXE/cu+v0EOkjYM+tQ4k5XWmjMFurRTxOU1wpF53+U6QK3pjZuRdENrBQ= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+93176+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1662438986146135.15675442822248; Mon, 5 Sep 2022 21:36:26 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id BP27YY1788612xPpf5zg2q3X; Mon, 05 Sep 2022 21:36:25 -0700 X-Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by mx.groups.io with SMTP id smtpd.web12.303.1662438976985344787 for ; Mon, 05 Sep 2022 21:36:25 -0700 X-IronPort-AV: E=McAfee;i="6500,9779,10461"; a="296502090" X-IronPort-AV: E=Sophos;i="5.93,293,1654585200"; d="scan'208";a="296502090" X-Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga103.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 05 Sep 2022 21:36:25 -0700 X-IronPort-AV: E=Sophos;i="5.93,293,1654585200"; d="scan'208";a="675517321" X-Received: from mxu9-mobl1.ccr.corp.intel.com ([10.238.4.118]) by fmsmga008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 05 Sep 2022 21:36:23 -0700 From: "Min Xu" To: devel@edk2.groups.io Cc: Min M Xu , Erdem Aktas , James Bottomley , Jiewen Yao , Tom Lendacky , Gerd Hoffmann Subject: [edk2-devel] [PATCH V5 5/8] OvmfPkg: Reserve and init EmuVariableNvStore in Pei-less Startup Date: Tue, 6 Sep 2022 12:35:57 +0800 Message-Id: <5ea1dbaa18b8358d05c3498dc5a049a9d7ad8d82.1662423715.git.min.m.xu@intel.com> In-Reply-To: References: MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,min.m.xu@intel.com X-Gm-Message-State: Oq7mbbE4iLDb8HzDRDQnIQlHx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1662438985; bh=OuohwWgiL5UJNqtjmN46nJ9Bt29rhupf05wnm5b2Wpo=; h=Cc:Date:From:Reply-To:Subject:To; b=Pu5seblixGnjZZgMrKAG6tvGlyI/GB1nBycObYxrpWkIRrF+mBjUALW2fkyKJlMvOpK Ea6bZzmb96T1LcnbC9rjRRpBoQudW78eu/JyGSYPqGEcpsbuaKgHI8bJPhMwgGFdrDCDU T5I/8Cl9X4BVWaSn7ke99ncE67d46rgxzQk= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1662438987859100023 Content-Type: text/plain; charset="utf-8" From: Min M Xu EmuVariableNvStore is reserved and init with below 2 functions defined in PlatformInitLib: - PlatformReserveEmuVariableNvStore - PlatformInitEmuVariableNvStore PlatformInitEmuVariableNvStore works when secure boot feature is enabled. This is because secure boot needs the EFI variables (PK/KEK/DB/DBX, etc) and EmuVariableNvStore is cleared when OVMF is launched with -bios parameter. Cc: Erdem Aktas Cc: James Bottomley Cc: Jiewen Yao Cc: Tom Lendacky Cc: Gerd Hoffmann Acked-by: Gerd Hoffmann Signed-off-by: Min Xu Reviewed-by: Jiewen Yao --- OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c b/OvmfPkg/L= ibrary/PeilessStartupLib/PeilessStartup.c index 7502ec44669e..380e71597206 100644 --- a/OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c +++ b/OvmfPkg/Library/PeilessStartupLib/PeilessStartup.c @@ -42,6 +42,7 @@ InitializePlatform ( ) { UINT32 LowerMemorySize; + VOID *VariableStore; =20 DEBUG ((DEBUG_INFO, "InitializePlatform in Pei-less boot\n")); PlatformDebugDumpCmos (); @@ -79,6 +80,12 @@ InitializePlatform ( LowerMemorySize )); =20 + VariableStore =3D PlatformReserveEmuVar= iableNvStore (); + PlatformInfoHob->PcdEmuVariableNvStoreReserved =3D (UINT64)(UINTN)Variab= leStore; + #ifdef SECURE_BOOT_FEATURE_ENABLED + PlatformInitEmuVariableNvStore (VariableStore); + #endif + if (TdIsEnabled ()) { PlatformTdxPublishRamRegions (); } else { --=20 2.29.2.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#93176): https://edk2.groups.io/g/devel/message/93176 Mute This Topic: https://groups.io/mt/93494908/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Mon May 6 01:27:21 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+93177+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+93177+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1662438988; cv=none; d=zohomail.com; s=zohoarc; b=hCJ3kiR6Q71ZfqYSRqqEIWBnx4R9OlNtBBziAlp8UBxC32FRGNmIIPdH+Onxl2ks5bd7LJyGkO5psOj/UkD/ZeEr46jwa0O4ANFYg0IYa7LNBq0jg+JJzulvMeCQW5rG0IMM/JtFnqGEhWrtIUZnmze3t4lsebQByosd+Rj4hYM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1662438988; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=yT4F/o8xloNwhMRcUcwIx7Nej2zoswY3JHFQf5y1yKc=; b=PcRJCNhj6+quUtKOK+e4YgVksk4h8CYCD3VhpJHYvUGavx1/lYhvwul6ObhFTCI/4DA8w10HeS8J4dI7yoR8m0jkhnHs8B676hzl2zXa1uW7a1l8MWUM1jRKfIx85CZcUnd2vIWZ2mJqx0AJzFo1vMy9nFfD7EF60ICEfXPQzPc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+93177+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1662438988249704.4559992011312; Mon, 5 Sep 2022 21:36:28 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id isUVYY1788612xaIKme9wbYu; Mon, 05 Sep 2022 21:36:27 -0700 X-Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by mx.groups.io with SMTP id smtpd.web12.303.1662438976985344787 for ; Mon, 05 Sep 2022 21:36:27 -0700 X-IronPort-AV: E=McAfee;i="6500,9779,10461"; a="296502117" X-IronPort-AV: E=Sophos;i="5.93,293,1654585200"; d="scan'208";a="296502117" X-Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga103.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 05 Sep 2022 21:36:26 -0700 X-IronPort-AV: E=Sophos;i="5.93,293,1654585200"; d="scan'208";a="675517336" X-Received: from mxu9-mobl1.ccr.corp.intel.com ([10.238.4.118]) by fmsmga008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 05 Sep 2022 21:36:25 -0700 From: "Min Xu" To: devel@edk2.groups.io Cc: Min M Xu , Erdem Aktas , James Bottomley , Jiewen Yao , Tom Lendacky , Gerd Hoffmann Subject: [edk2-devel] [PATCH V5 6/8] OvmfPkg/NvVarsFileLib: Shortcut ConnectNvVarsToFileSystem in secure-boot Date: Tue, 6 Sep 2022 12:35:58 +0800 Message-Id: In-Reply-To: References: MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,min.m.xu@intel.com X-Gm-Message-State: Hb8Bw7r0Ct2wGsie62f6Xzotx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1662438987; bh=CdqddfDUIl/ZXxu4+k/+2hYNjEGdK4Wp5wxUvhHX3cs=; h=Cc:Date:From:Reply-To:Subject:To; b=EfV/+v1gj3u0Wso9Un32zjfCUlDtG+B6HJqxf3CQ1rKD8tmUu4XMc4ijtRicPLKqgrz NLjdc+jgJMvBGJBxqNCVa69ooTgnTFNkRhHJFdTjM9VX7aj6UJrmNrzbAZe4mBY5myqyc HwkwuxzEeKSWj6fYBBykjvQQbH7JdDPAerA= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1662438989832100027 Content-Type: text/plain; charset="utf-8" From: Min M Xu OvmfPkg/Library/NvVarsFileLib allows loading variables into emulated varstore from a on-disk NvVars file. We can't allow that when secure boot is active. So check secure-boot feature and shortcut the ConnectNvVarsToFileSystem() function when sb is enabled. Cc: Erdem Aktas Cc: James Bottomley Cc: Jiewen Yao Cc: Tom Lendacky Cc: Gerd Hoffmann Suggested-by: Gerd Hoffmann Acked-by: Gerd Hoffmann Signed-off-by: Min Xu Reviewed-by: Jiewen Yao --- OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.c b/OvmfPkg/Librar= y/NvVarsFileLib/NvVarsFileLib.c index 21b71524ea48..72289da35819 100644 --- a/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.c +++ b/OvmfPkg/Library/NvVarsFileLib/NvVarsFileLib.c @@ -28,6 +28,12 @@ ConnectNvVarsToFileSystem ( IN EFI_HANDLE FsHandle ) { + #ifdef SECURE_BOOT_FEATURE_ENABLED + + return EFI_UNSUPPORTED; + + #else + EFI_STATUS Status; =20 // @@ -46,6 +52,7 @@ ConnectNvVarsToFileSystem ( } =20 return Status; + #endif } =20 /** --=20 2.29.2.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#93177): https://edk2.groups.io/g/devel/message/93177 Mute This Topic: https://groups.io/mt/93494909/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Mon May 6 01:27:21 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+93178+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+93178+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1662438990; cv=none; d=zohomail.com; s=zohoarc; b=NMwRL1tS0qOnKzPWIt5fUbvMaINwqOvt41ZGLVx7FD4xVfjRQrfJ4iySqmenITqXjymChFLrdeEWKA1cMrbzrxxxcDQv2P51KS6olm+bNCRnasOs7FVGF/IX81IpQSqX51OzQ3zobNEgDmHXurVlgA6EChbl1qtwD0ALbQBjryU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1662438990; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=Ns4aPAha7qOokVBcS4u62wb5fFhBkmfaGHsetIe/La8=; b=ADbFa1k3CDykEd1o1G9q0tSCMtVjxy4pYOtjWbYlJH1xyt1fgdlXX4GAjX9UqP2CxJNq7UIwwssWNoJlCmJd7UMgM3KZifLNWYnQ+is6Va1V3wMkfMgrjK0fJCvpCoK6MePN1NKTxrRTHa+efQrS5R0EPB7Py8T0WaZiTpmbzkY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+93178+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 166243899075741.72725300796992; Mon, 5 Sep 2022 21:36:30 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id 6q6yYY1788612xzyknpP1Dh3; Mon, 05 Sep 2022 21:36:30 -0700 X-Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by mx.groups.io with SMTP id smtpd.web12.303.1662438976985344787 for ; Mon, 05 Sep 2022 21:36:29 -0700 X-IronPort-AV: E=McAfee;i="6500,9779,10461"; a="296502151" X-IronPort-AV: E=Sophos;i="5.93,293,1654585200"; d="scan'208";a="296502151" X-Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga103.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 05 Sep 2022 21:36:28 -0700 X-IronPort-AV: E=Sophos;i="5.93,293,1654585200"; d="scan'208";a="675517348" X-Received: from mxu9-mobl1.ccr.corp.intel.com ([10.238.4.118]) by fmsmga008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 05 Sep 2022 21:36:27 -0700 From: "Min Xu" To: devel@edk2.groups.io Cc: Min M Xu , Erdem Aktas , James Bottomley , Jiewen Yao , Tom Lendacky , Gerd Hoffmann Subject: [edk2-devel] [PATCH V5 7/8] OvmfPkg/TdxDxe: Set PcdEmuVariableNvStoreReserved Date: Tue, 6 Sep 2022 12:35:59 +0800 Message-Id: In-Reply-To: References: MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,min.m.xu@intel.com X-Gm-Message-State: rlZeKfNjLSjbitf54udqH1dHx1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1662438990; bh=dTCYBOL7wMIpGPQo3hC1jCCgSZMobSz1BqLkMfTYlNE=; h=Cc:Date:From:Reply-To:Subject:To; b=QJBaCfF7o5HLPuzcffGBgy4lkpX4WnBazKc1vCN0N7rkQZUKT9OQfq57GL5GCzRb4zS VOISIy+3etSpEYf/U+KKpN7ARKvVJzdjzU+XRVwlM9OzvMTyWFsQ7J0RxrvOOAXXVI19V qAoanl2+SkJXSaGzZLrIKpDZBBTzc2JS9P4= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1662438991795100031 Content-Type: text/plain; charset="utf-8" From: Min M Xu Set PcdEmuVariableNvStoreReserved with the value in PlatformInfoHob. It is the address of the EmuVariableNvStore reserved in Pei-less startup. Cc: Erdem Aktas Cc: James Bottomley Cc: Jiewen Yao Cc: Tom Lendacky Cc: Gerd Hoffmann Acked-by: Gerd Hoffmann Signed-off-by: Min Xu Reviewed-by: Jiewen Yao --- OvmfPkg/TdxDxe/TdxDxe.c | 2 ++ OvmfPkg/TdxDxe/TdxDxe.inf | 1 + 2 files changed, 3 insertions(+) diff --git a/OvmfPkg/TdxDxe/TdxDxe.c b/OvmfPkg/TdxDxe/TdxDxe.c index 2318db989792..837f1f8e3024 100644 --- a/OvmfPkg/TdxDxe/TdxDxe.c +++ b/OvmfPkg/TdxDxe/TdxDxe.c @@ -64,6 +64,8 @@ SetPcdSettings ( PlatformInfoHob->PcdCpuBootLogicalProcessorNumber )); =20 + PcdSet64S (PcdEmuVariableNvStoreReserved, PlatformInfoHob->PcdEmuVariabl= eNvStoreReserved); + if (TdIsEnabled ()) { PcdStatus =3D PcdSet64S (PcdTdxSharedBitMask, TdSharedPageMask ()); ASSERT_RETURN_ERROR (PcdStatus); diff --git a/OvmfPkg/TdxDxe/TdxDxe.inf b/OvmfPkg/TdxDxe/TdxDxe.inf index a7e0abda1522..3ce8a5c32c98 100644 --- a/OvmfPkg/TdxDxe/TdxDxe.inf +++ b/OvmfPkg/TdxDxe/TdxDxe.inf @@ -68,3 +68,4 @@ gEfiMdePkgTokenSpaceGuid.PcdConfidentialComputingGuestAttr gEfiMdeModulePkgTokenSpaceGuid.PcdTdxSharedBitMask gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack + gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved --=20 2.29.2.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#93178): https://edk2.groups.io/g/devel/message/93178 Mute This Topic: https://groups.io/mt/93494910/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- From nobody Mon May 6 01:27:21 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+93179+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+93179+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=intel.com ARC-Seal: i=1; a=rsa-sha256; t=1662438992; cv=none; d=zohomail.com; s=zohoarc; b=h3oi2lsi4gYaUZtF2DLn1e1fp4BC3Eqf+IV25nAO3tZcJQGppQWXXxcRHgMsm3oKTBqN6Rp60EFaQU3U0gg4iAfRby4FIdQpdjzHvSv95GykQ2W4h8zMAt2sDM0fqa0ZUmIXF0swK2ymHPfotJx15ep61zc1kiSa+hI3v6ZwLcU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1662438992; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=S9+lovHYAhoYVFs5g8lEHdrCdpT5ZofqTAFF8r9pNqU=; b=NClCB78/SBfmo8npuQxr1r1ib05pxoNIuHvX4NRNQbJaWF93uIIgknNNupGnEmqxHXqK+Ayzd7pl9c9sab5hPZgLiBy3mx4lBhDaqZSWwjcJek0ABn1Q2YLAXrnr1o4XzfBaDRE+5QteYzu7zbG6Wp76OpqB8wtXREGizJA3BnE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+93179+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1662438992270537.676303071263; Mon, 5 Sep 2022 21:36:32 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id wCYTYY1788612xnCTuzfyl63; Mon, 05 Sep 2022 21:36:31 -0700 X-Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by mx.groups.io with SMTP id smtpd.web12.303.1662438976985344787 for ; Mon, 05 Sep 2022 21:36:31 -0700 X-IronPort-AV: E=McAfee;i="6500,9779,10461"; a="296502170" X-IronPort-AV: E=Sophos;i="5.93,293,1654585200"; d="scan'208";a="296502170" X-Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga103.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 05 Sep 2022 21:36:31 -0700 X-IronPort-AV: E=Sophos;i="5.93,293,1654585200"; d="scan'208";a="675517366" X-Received: from mxu9-mobl1.ccr.corp.intel.com ([10.238.4.118]) by fmsmga008-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 05 Sep 2022 21:36:28 -0700 From: "Min Xu" To: devel@edk2.groups.io Cc: Min M Xu , Erdem Aktas , James Bottomley , Jiewen Yao , Tom Lendacky , Gerd Hoffmann Subject: [edk2-devel] [PATCH V5 8/8] OvmfPkg: Add build-flag SECURE_BOOT_FEATURE_ENABLED Date: Tue, 6 Sep 2022 12:36:00 +0800 Message-Id: <77bac2315863904740edee3abc65fe461d4e3164.1662423715.git.min.m.xu@intel.com> In-Reply-To: References: MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,min.m.xu@intel.com X-Gm-Message-State: 4cgNegOBjQ1m3nkmyGrFyWM0x1787277AA= Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1662438991; bh=eMVNHnvnR7+Crwj6VIKoGoL6lO6c19HGhJU3crsa1/o=; h=Cc:Date:From:Reply-To:Subject:To; b=oDOjlJvdXzBN/JpQVn4l7OOfJbED3JvEGQnCVsOwDtJMGsRj7RuHv76cCU9RbLE0/iP LfSBii9JY0TY0G1IKrLwe1WNZGnZq2Y5jT3CQbv5qRolJ2q4ZAxSF8nzjKjCtwbyP3GTR iaP7AFt4TotTLgayisZCwujy65krZ3AO4nM= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1662438993855100033 Content-Type: text/plain; charset="utf-8" From: Min M Xu SECURE_BOOT_FEATURE_ENABLED is the build-flag defined when secure boot is enabled. Currently this flag is used in below lib: - OvmfPkg/PlatformPei - PeilessStartupLib So it is defined in below 5 .dsc - OvmfPkg/CloudHv/CloudHvX64.dsc - OvmfPkg/IntelTdx/IntelTdxX64.dsc - OvmfPkg/OvmfPkgIa32.dsc - OvmfPkg/OvmfPkgIa32X64.dsc - OvmfPkg/OvmfPkgX64.dsc Cc: Erdem Aktas Cc: James Bottomley Cc: Jiewen Yao Cc: Tom Lendacky Cc: Gerd Hoffmann Acked-by: Gerd Hoffmann Signed-off-by: Min Xu Reviewed-by: Jiewen Yao --- OvmfPkg/CloudHv/CloudHvX64.dsc | 9 +++++++++ OvmfPkg/IntelTdx/IntelTdxX64.dsc | 9 +++++++++ OvmfPkg/OvmfPkgIa32.dsc | 9 +++++++++ OvmfPkg/OvmfPkgIa32X64.dsc | 9 +++++++++ OvmfPkg/OvmfPkgX64.dsc | 9 +++++++++ 5 files changed, 45 insertions(+) diff --git a/OvmfPkg/CloudHv/CloudHvX64.dsc b/OvmfPkg/CloudHv/CloudHvX64.dsc index f0d700f14477..0f0fc9a1de73 100644 --- a/OvmfPkg/CloudHv/CloudHvX64.dsc +++ b/OvmfPkg/CloudHv/CloudHvX64.dsc @@ -93,6 +93,15 @@ INTEL:*_*_*_CC_FLAGS =3D /D DISABLE_NEW_DEPRECATED_INTERFACES GCC:*_*_*_CC_FLAGS =3D -D DISABLE_NEW_DEPRECATED_INTERFACES =20 + # + # SECURE_BOOT_FEATURE_ENABLED + # +!if $(SECURE_BOOT_ENABLE) =3D=3D TRUE + MSFT:*_*_*_CC_FLAGS =3D /D SECURE_BOOT_FEATURE_ENABLED + INTEL:*_*_*_CC_FLAGS =3D /D SECURE_BOOT_FEATURE_ENABLED + GCC:*_*_*_CC_FLAGS =3D -D SECURE_BOOT_FEATURE_ENABLED +!endif + !include NetworkPkg/NetworkBuildOptions.dsc.inc =20 [BuildOptions.common.EDKII.DXE_RUNTIME_DRIVER] diff --git a/OvmfPkg/IntelTdx/IntelTdxX64.dsc b/OvmfPkg/IntelTdx/IntelTdxX6= 4.dsc index 71b1cf8e7090..e05fe36cbfa8 100644 --- a/OvmfPkg/IntelTdx/IntelTdxX64.dsc +++ b/OvmfPkg/IntelTdx/IntelTdxX64.dsc @@ -85,6 +85,15 @@ INTEL:*_*_*_CC_FLAGS =3D /D TDX_PEI_LESS_BOOT GCC:*_*_*_CC_FLAGS =3D -D TDX_PEI_LESS_BOOT =20 + # + # SECURE_BOOT_FEATURE_ENABLED + # +!if $(SECURE_BOOT_ENABLE) =3D=3D TRUE + MSFT:*_*_*_CC_FLAGS =3D /D SECURE_BOOT_FEATURE_ENABLED + INTEL:*_*_*_CC_FLAGS =3D /D SECURE_BOOT_FEATURE_ENABLED + GCC:*_*_*_CC_FLAGS =3D -D SECURE_BOOT_FEATURE_ENABLED +!endif + [BuildOptions.common.EDKII.DXE_RUNTIME_DRIVER] GCC:*_*_*_DLINK_FLAGS =3D -z common-page-size=3D0x1000 XCODE:*_*_*_DLINK_FLAGS =3D -seg1addr 0x1000 -segalign 0x1000 diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc index 797a543b95a9..367ddeb2da5f 100644 --- a/OvmfPkg/OvmfPkgIa32.dsc +++ b/OvmfPkg/OvmfPkgIa32.dsc @@ -94,6 +94,15 @@ INTEL:*_*_*_CC_FLAGS =3D /D DISABLE_NEW_DEPRECATED_INTERFACES GCC:*_*_*_CC_FLAGS =3D -D DISABLE_NEW_DEPRECATED_INTERFACES =20 + # + # SECURE_BOOT_FEATURE_ENABLED + # +!if $(SECURE_BOOT_ENABLE) =3D=3D TRUE + MSFT:*_*_*_CC_FLAGS =3D /D SECURE_BOOT_FEATURE_ENABLED + INTEL:*_*_*_CC_FLAGS =3D /D SECURE_BOOT_FEATURE_ENABLED + GCC:*_*_*_CC_FLAGS =3D -D SECURE_BOOT_FEATURE_ENABLED +!endif + !include NetworkPkg/NetworkBuildOptions.dsc.inc =20 [BuildOptions.common.EDKII.DXE_RUNTIME_DRIVER] diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc index 9b1228e85024..37c4c2fadca4 100644 --- a/OvmfPkg/OvmfPkgIa32X64.dsc +++ b/OvmfPkg/OvmfPkgIa32X64.dsc @@ -98,6 +98,15 @@ INTEL:*_*_*_CC_FLAGS =3D /D DISABLE_NEW_DEPRECATED_INTERFACES GCC:*_*_*_CC_FLAGS =3D -D DISABLE_NEW_DEPRECATED_INTERFACES =20 + # + # SECURE_BOOT_FEATURE_ENABLED + # +!if $(SECURE_BOOT_ENABLE) =3D=3D TRUE + MSFT:*_*_*_CC_FLAGS =3D /D SECURE_BOOT_FEATURE_ENABLED + INTEL:*_*_*_CC_FLAGS =3D /D SECURE_BOOT_FEATURE_ENABLED + GCC:*_*_*_CC_FLAGS =3D -D SECURE_BOOT_FEATURE_ENABLED +!endif + !include NetworkPkg/NetworkBuildOptions.dsc.inc =20 [BuildOptions.common.EDKII.DXE_RUNTIME_DRIVER] diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc index 5a6b68bcb106..276bcc303779 100644 --- a/OvmfPkg/OvmfPkgX64.dsc +++ b/OvmfPkg/OvmfPkgX64.dsc @@ -111,6 +111,15 @@ INTEL:*_*_*_CC_FLAGS =3D /D TDX_GUEST_SUPPORTED GCC:*_*_*_CC_FLAGS =3D -D TDX_GUEST_SUPPORTED =20 + # + # SECURE_BOOT_FEATURE_ENABLED + # +!if $(SECURE_BOOT_ENABLE) =3D=3D TRUE + MSFT:*_*_*_CC_FLAGS =3D /D SECURE_BOOT_FEATURE_ENABLED + INTEL:*_*_*_CC_FLAGS =3D /D SECURE_BOOT_FEATURE_ENABLED + GCC:*_*_*_CC_FLAGS =3D -D SECURE_BOOT_FEATURE_ENABLED +!endif + !include NetworkPkg/NetworkBuildOptions.dsc.inc =20 [BuildOptions.common.EDKII.DXE_RUNTIME_DRIVER] --=20 2.29.2.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#93179): https://edk2.groups.io/g/devel/message/93179 Mute This Topic: https://groups.io/mt/93494912/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-