This patch adds a virtual device to qemu which the uefi firmware can use
to store variables. This moves the UEFI variable management from
privileged guest code (managing vars in pflash) to the host. Main
advantage is that the need to have privilege separation in the guest
goes away.
On x86 privileged guest code runs in SMM. It's supported by kvm, but
not liked much by various stakeholders in cloud space due to the
complexity SMM emulation brings.
On arm privileged guest code runs in el3 (aka secure world). This is
not supported by kvm, which is unlikely to change anytime soon given
that even el2 support (nested virt) is being worked on for years and is
not yet in mainline.
The design idea is to reuse the request serialization protocol edk2 uses
for communication between SMM and non-SMM code, so large chunks of the
edk2 variable driver stack can be used unmodified. Only the driver
which traps into SMM mode must be replaced by a driver which talks to
qemu instead.
A edk2 test branch can be found here (build with "-D QEMU_PV_VARS=TRUE").
https://github.com/kraxel/edk2/commits/devel/secure-boot-external-vars
The uefi-vars device re-implements the privileged edk2 protocols
(i.e. the code running in SMM mode).
v5 changes:
- improve qapi documentation (Markus)
- fixes etc/hardware-info code (byte order, double free).
v4 changes:
- drop the isa variant in favor of a x64-specific sysbus variant using
mmio to expose the device registers.
- use etc/hardware-info for device discovery on x64.
- add pio transfer mode support.
v3 changes:
- switch sysbus device variant to use the qemu platform bus.
- misc minor changes.
v2 changes:
- fully implement authenticated variables.
- various cleanups and fixes.
enjoy & take care,
Gerd
Gerd Hoffmann (24):
Add support for etc/hardware-info fw_cfg file
hw/uefi: add include/hw/uefi/var-service-api.h
hw/uefi: add include/hw/uefi/var-service-edk2.h
hw/uefi: add include/hw/uefi/var-service.h
hw/uefi: add var-service-guid.c
hw/uefi: add var-service-utils.c
hw/uefi: add var-service-vars.c
hw/uefi: add var-service-auth.c
hw/uefi: add var-service-policy.c
hw/uefi: add var-service-core.c
hw/uefi: add var-service-pkcs7.c
hw/uefi: add var-service-pkcs7-stub.c
hw/uefi: add var-service-siglist.c
hw/uefi: add var-service-json.c + qapi for NV vars.
hw/uefi: add trace-events
hw/uefi: add UEFI_VARS to Kconfig
hw/uefi: add to meson
hw/uefi: add uefi-vars-sysbus device
hw/uefi-vars-sysbus: qemu platform bus support
hw/uefi-vars-sysbus: add x64 variant
hw/uefi-vars-sysbus: allow for arm virt
hw/uefi-vars-sysbus: allow for pc and q35
hw/uefi: add MAINTAINERS entry
docs: add uefi variable service documentation
include/hw/uefi/hardware-info.h | 35 ++
include/hw/uefi/var-service-api.h | 48 ++
include/hw/uefi/var-service-edk2.h | 227 +++++++++
include/hw/uefi/var-service.h | 191 ++++++++
hw/arm/virt.c | 2 +
hw/core/sysbus-fdt.c | 24 +
hw/i386/pc_piix.c | 2 +
hw/i386/pc_q35.c | 2 +
hw/uefi/hardware-info.c | 31 ++
hw/uefi/var-service-auth.c | 361 ++++++++++++++
hw/uefi/var-service-core.c | 321 +++++++++++++
hw/uefi/var-service-guid.c | 99 ++++
hw/uefi/var-service-json.c | 243 ++++++++++
hw/uefi/var-service-pkcs7-stub.c | 16 +
hw/uefi/var-service-pkcs7.c | 436 +++++++++++++++++
hw/uefi/var-service-policy.c | 370 +++++++++++++++
hw/uefi/var-service-siglist.c | 212 +++++++++
hw/uefi/var-service-sysbus.c | 124 +++++
hw/uefi/var-service-utils.c | 241 ++++++++++
hw/uefi/var-service-vars.c | 725 +++++++++++++++++++++++++++++
MAINTAINERS | 6 +
docs/devel/index-internals.rst | 1 +
docs/devel/uefi-vars.rst | 68 +++
hw/Kconfig | 1 +
hw/meson.build | 1 +
hw/uefi/Kconfig | 3 +
hw/uefi/LIMITATIONS.md | 7 +
hw/uefi/meson.build | 21 +
hw/uefi/trace-events | 17 +
meson.build | 1 +
qapi/meson.build | 1 +
qapi/qapi-schema.json | 1 +
qapi/uefi.json | 55 +++
33 files changed, 3893 insertions(+)
create mode 100644 include/hw/uefi/hardware-info.h
create mode 100644 include/hw/uefi/var-service-api.h
create mode 100644 include/hw/uefi/var-service-edk2.h
create mode 100644 include/hw/uefi/var-service.h
create mode 100644 hw/uefi/hardware-info.c
create mode 100644 hw/uefi/var-service-auth.c
create mode 100644 hw/uefi/var-service-core.c
create mode 100644 hw/uefi/var-service-guid.c
create mode 100644 hw/uefi/var-service-json.c
create mode 100644 hw/uefi/var-service-pkcs7-stub.c
create mode 100644 hw/uefi/var-service-pkcs7.c
create mode 100644 hw/uefi/var-service-policy.c
create mode 100644 hw/uefi/var-service-siglist.c
create mode 100644 hw/uefi/var-service-sysbus.c
create mode 100644 hw/uefi/var-service-utils.c
create mode 100644 hw/uefi/var-service-vars.c
create mode 100644 docs/devel/uefi-vars.rst
create mode 100644 hw/uefi/Kconfig
create mode 100644 hw/uefi/LIMITATIONS.md
create mode 100644 hw/uefi/meson.build
create mode 100644 hw/uefi/trace-events
create mode 100644 qapi/uefi.json
--
2.48.1