Compare commits
No commits in common. 'c9' and 'i10cs' have entirely different histories.
@ -1,3 +1,4 @@
|
|||||||
de143fc38b339d982079517b6f01bcec5246cf5e SOURCES/DBXUpdate-20230509.x64.bin
|
de143fc38b339d982079517b6f01bcec5246cf5e SOURCES/DBXUpdate-20230509.x64.bin
|
||||||
6da44cf37c27ab03f2940769c58515b07271e047 SOURCES/edk2-3e722403cd.tar.xz
|
19a95204dd787b4809886db15655082cb28718e9 SOURCES/dtc-1.7.0.tar.xz
|
||||||
|
a0cdc45f583976eda09dd85740264e57333b3df2 SOURCES/edk2-0f3867fa6ef0.tar.xz
|
||||||
0a9cfae889c6436333fab963250b069058eec6cf SOURCES/openssl-rhel-0205b589887203b065154ddc8e8107c4ac8625a1.tar.xz
|
0a9cfae889c6436333fab963250b069058eec6cf SOURCES/openssl-rhel-0205b589887203b065154ddc8e8107c4ac8625a1.tar.xz
|
||||||
|
|||||||
@ -1,3 +1,4 @@
|
|||||||
SOURCES/DBXUpdate-20230509.x64.bin
|
SOURCES/DBXUpdate-20230509.x64.bin
|
||||||
SOURCES/edk2-3e722403cd.tar.xz
|
SOURCES/dtc-1.7.0.tar.xz
|
||||||
|
SOURCES/edk2-0f3867fa6ef0.tar.xz
|
||||||
SOURCES/openssl-rhel-0205b589887203b065154ddc8e8107c4ac8625a1.tar.xz
|
SOURCES/openssl-rhel-0205b589887203b065154ddc8e8107c4ac8625a1.tar.xz
|
||||||
|
|||||||
@ -1,49 +0,0 @@
|
|||||||
From 3d02fb6da82331176952e480160223136679ce74 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Gerd Hoffmann <kraxel@redhat.com>
|
|
||||||
Date: Tue, 28 Feb 2023 15:47:00 +0100
|
|
||||||
Subject: [PATCH] UefiCpuPkg/MpInitLib: fix apic mode for cpu hotplug
|
|
||||||
|
|
||||||
RH-Author: Gerd Hoffmann <kraxel@redhat.com>
|
|
||||||
RH-MergeRequest: 42: UefiCpuPkg/MpInitLib: fix apic mode for cpu hotplug
|
|
||||||
RH-Bugzilla: 2124143
|
|
||||||
RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
|
|
||||||
RH-Commit: [1/1] 5168501c31541a57aaeb3b3bd7c3602205eb7cdf (kraxel/centos-edk2)
|
|
||||||
|
|
||||||
In case the number of CPUs can in increase beyond 255
|
|
||||||
due to CPU hotplug choose x2apic mode.
|
|
||||||
|
|
||||||
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
||||||
|
|
||||||
patch_name: edk2-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch
|
|
||||||
present_in_specfile: true
|
|
||||||
location_in_specfile: 38
|
|
||||||
---
|
|
||||||
UefiCpuPkg/Library/MpInitLib/MpLib.c | 8 +++++++-
|
|
||||||
1 file changed, 7 insertions(+), 1 deletion(-)
|
|
||||||
|
|
||||||
diff --git a/UefiCpuPkg/Library/MpInitLib/MpLib.c b/UefiCpuPkg/Library/MpInitLib/MpLib.c
|
|
||||||
index d724456502..c478878bb0 100644
|
|
||||||
--- a/UefiCpuPkg/Library/MpInitLib/MpLib.c
|
|
||||||
+++ b/UefiCpuPkg/Library/MpInitLib/MpLib.c
|
|
||||||
@@ -534,7 +534,9 @@ CollectProcessorCount (
|
|
||||||
//
|
|
||||||
// Enable x2APIC mode if
|
|
||||||
// 1. Number of CPU is greater than 255; or
|
|
||||||
- // 2. There are any logical processors reporting an Initial APIC ID of 255 or greater.
|
|
||||||
+ // 2. The platform exposed the exact *boot* CPU count to us in advance, and
|
|
||||||
+ // more than 255 logical processors are possible later, with hotplug; or
|
|
||||||
+ // 3. There are any logical processors reporting an Initial APIC ID of 255 or greater.
|
|
||||||
//
|
|
||||||
X2Apic = FALSE;
|
|
||||||
if (CpuMpData->CpuCount > 255) {
|
|
||||||
@@ -542,6 +544,10 @@ CollectProcessorCount (
|
|
||||||
// If there are more than 255 processor found, force to enable X2APIC
|
|
||||||
//
|
|
||||||
X2Apic = TRUE;
|
|
||||||
+ } else if ((PcdGet32 (PcdCpuBootLogicalProcessorNumber) > 0) &&
|
|
||||||
+ (PcdGet32 (PcdCpuMaxLogicalProcessorNumber) > 255))
|
|
||||||
+ {
|
|
||||||
+ X2Apic = TRUE;
|
|
||||||
} else {
|
|
||||||
CpuInfoInHob = (CPU_INFO_IN_HOB *)(UINTN)CpuMpData->CpuInfoInHob;
|
|
||||||
for (Index = 0; Index < CpuMpData->CpuCount; Index++) {
|
|
||||||
@ -1,4 +1,4 @@
|
|||||||
From 7a07b2f16eabf460891a21c05b30cd9c2f875a2a Mon Sep 17 00:00:00 2001
|
From 0454b8eaabf7fa0240b6d7c4f6409584161552d4 Mon Sep 17 00:00:00 2001
|
||||||
From: Gerd Hoffmann <kraxel@redhat.com>
|
From: Gerd Hoffmann <kraxel@redhat.com>
|
||||||
Date: Mon, 28 Aug 2023 13:11:02 +0200
|
Date: Mon, 28 Aug 2023 13:11:02 +0200
|
||||||
Subject: [PATCH] CryptoPkg/CrtLib: add stat.h include file.
|
Subject: [PATCH] CryptoPkg/CrtLib: add stat.h include file.
|
||||||
@ -1,194 +0,0 @@
|
|||||||
From 4c49c1bcb2db128cc4d2ebb29b1ac53fe3ef6b18 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Gerd Hoffmann <kraxel@redhat.com>
|
|
||||||
Date: Tue, 30 Jan 2024 14:04:38 +0100
|
|
||||||
Subject: [PATCH] OvmfPkg/Sec: Setup MTRR early in the boot process.
|
|
||||||
|
|
||||||
RH-Author: Gerd Hoffmann <None>
|
|
||||||
RH-MergeRequest: 55: OvmfPkg/Sec: Setup MTRR early in the boot process.
|
|
||||||
RH-Jira: RHEL-21704
|
|
||||||
RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
|
|
||||||
RH-Commit: [1/4] c4061788d34f409944898b48642d610c259161f3 (kraxel.rh/centos-src-edk2)
|
|
||||||
|
|
||||||
Specifically before running lzma uncompress of the main firmware volume.
|
|
||||||
This is needed to make sure caching is enabled, otherwise the uncompress
|
|
||||||
can be extremely slow.
|
|
||||||
|
|
||||||
Adapt the ASSERTs and MTRR setup in PlatformInitLib to the changes.
|
|
||||||
|
|
||||||
Background: Depending on virtual machine configuration kvm may uses EPT
|
|
||||||
memory types to apply guest MTRR settings. In case MTRRs are disabled
|
|
||||||
kvm will use the uncachable memory type for all mappings. The
|
|
||||||
vmx_get_mt_mask() function in the linux kernel handles this and can be
|
|
||||||
found here:
|
|
||||||
|
|
||||||
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/arch/x86/kvm/vmx/vmx.c?h=v6.7.1#n7580
|
|
||||||
|
|
||||||
In most VM configurations kvm uses MTRR_TYPE_WRBACK unconditionally. In
|
|
||||||
case the VM has a mdev device assigned that is not the case though.
|
|
||||||
|
|
||||||
Before commit e8aa4c6546ad ("UefiCpuPkg/ResetVector: Cache Disable
|
|
||||||
should not be set by default in CR0") kvm also ended up using
|
|
||||||
MTRR_TYPE_WRBACK due to KVM_X86_QUIRK_CD_NW_CLEARED. After that commit
|
|
||||||
kvm evaluates guest mtrr settings, which why setting up MTRRs early is
|
|
||||||
important now.
|
|
||||||
|
|
||||||
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
|
|
||||||
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
||||||
Message-ID: <20240130130441.772484-2-kraxel@redhat.com>
|
|
||||||
|
|
||||||
[ kraxel: Downstream-only for now. Timely upstream merge is unlikely
|
|
||||||
due to chinese holidays and rhel-9.4 deadlines are close.
|
|
||||||
QE regression testing passed. So go with upstream posted
|
|
||||||
series v3 ]
|
|
||||||
|
|
||||||
patch_name: edk2-OvmfPkg-Sec-Setup-MTRR-early-in-the-boot-process.patch
|
|
||||||
present_in_specfile: true
|
|
||||||
location_in_specfile: 49
|
|
||||||
---
|
|
||||||
OvmfPkg/IntelTdx/Sec/SecMain.c | 32 +++++++++++++++++++++
|
|
||||||
OvmfPkg/Library/PlatformInitLib/MemDetect.c | 10 +++----
|
|
||||||
OvmfPkg/Sec/SecMain.c | 32 +++++++++++++++++++++
|
|
||||||
3 files changed, 69 insertions(+), 5 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/OvmfPkg/IntelTdx/Sec/SecMain.c b/OvmfPkg/IntelTdx/Sec/SecMain.c
|
|
||||||
index 4e750755bf..7094d86159 100644
|
|
||||||
--- a/OvmfPkg/IntelTdx/Sec/SecMain.c
|
|
||||||
+++ b/OvmfPkg/IntelTdx/Sec/SecMain.c
|
|
||||||
@@ -26,6 +26,8 @@
|
|
||||||
#include <Library/TdxHelperLib.h>
|
|
||||||
#include <Library/CcProbeLib.h>
|
|
||||||
#include <Library/PeilessStartupLib.h>
|
|
||||||
+#include <Register/Intel/ArchitecturalMsr.h>
|
|
||||||
+#include <Register/Intel/Cpuid.h>
|
|
||||||
|
|
||||||
#define SEC_IDT_ENTRY_COUNT 34
|
|
||||||
|
|
||||||
@@ -47,6 +49,31 @@ IA32_IDT_GATE_DESCRIPTOR mIdtEntryTemplate = {
|
|
||||||
}
|
|
||||||
};
|
|
||||||
|
|
||||||
+//
|
|
||||||
+// Enable MTRR early, set default type to write back.
|
|
||||||
+// Needed to make sure caching is enabled,
|
|
||||||
+// without this lzma decompress can be very slow.
|
|
||||||
+//
|
|
||||||
+STATIC
|
|
||||||
+VOID
|
|
||||||
+SecMtrrSetup (
|
|
||||||
+ VOID
|
|
||||||
+ )
|
|
||||||
+{
|
|
||||||
+ CPUID_VERSION_INFO_EDX Edx;
|
|
||||||
+ MSR_IA32_MTRR_DEF_TYPE_REGISTER DefType;
|
|
||||||
+
|
|
||||||
+ AsmCpuid (CPUID_VERSION_INFO, NULL, NULL, NULL, &Edx.Uint32);
|
|
||||||
+ if (!Edx.Bits.MTRR) {
|
|
||||||
+ return;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ DefType.Uint64 = AsmReadMsr64 (MSR_IA32_MTRR_DEF_TYPE);
|
|
||||||
+ DefType.Bits.Type = 6; /* write back */
|
|
||||||
+ DefType.Bits.E = 1; /* enable */
|
|
||||||
+ AsmWriteMsr64 (MSR_IA32_MTRR_DEF_TYPE, DefType.Uint64);
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
VOID
|
|
||||||
EFIAPI
|
|
||||||
SecCoreStartupWithStack (
|
|
||||||
@@ -203,6 +230,11 @@ SecCoreStartupWithStack (
|
|
||||||
InitializeApicTimer (0, MAX_UINT32, TRUE, 5);
|
|
||||||
DisableApicTimerInterrupt ();
|
|
||||||
|
|
||||||
+ //
|
|
||||||
+ // Initialize MTRR
|
|
||||||
+ //
|
|
||||||
+ SecMtrrSetup ();
|
|
||||||
+
|
|
||||||
PeilessStartup (&SecCoreData);
|
|
||||||
|
|
||||||
ASSERT (FALSE);
|
|
||||||
diff --git a/OvmfPkg/Library/PlatformInitLib/MemDetect.c b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
|
|
||||||
index e64c0ee324..b6ba63ef95 100644
|
|
||||||
--- a/OvmfPkg/Library/PlatformInitLib/MemDetect.c
|
|
||||||
+++ b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
|
|
||||||
@@ -1164,18 +1164,18 @@ PlatformQemuInitializeRam (
|
|
||||||
MtrrGetAllMtrrs (&MtrrSettings);
|
|
||||||
|
|
||||||
//
|
|
||||||
- // MTRRs disabled, fixed MTRRs disabled, default type is uncached
|
|
||||||
+ // See SecMtrrSetup(), default type should be write back
|
|
||||||
//
|
|
||||||
- ASSERT ((MtrrSettings.MtrrDefType & BIT11) == 0);
|
|
||||||
+ ASSERT ((MtrrSettings.MtrrDefType & BIT11) != 0);
|
|
||||||
ASSERT ((MtrrSettings.MtrrDefType & BIT10) == 0);
|
|
||||||
- ASSERT ((MtrrSettings.MtrrDefType & 0xFF) == 0);
|
|
||||||
+ ASSERT ((MtrrSettings.MtrrDefType & 0xFF) == MTRR_CACHE_WRITE_BACK);
|
|
||||||
|
|
||||||
//
|
|
||||||
// flip default type to writeback
|
|
||||||
//
|
|
||||||
- SetMem (&MtrrSettings.Fixed, sizeof MtrrSettings.Fixed, 0x06);
|
|
||||||
+ SetMem (&MtrrSettings.Fixed, sizeof MtrrSettings.Fixed, MTRR_CACHE_WRITE_BACK);
|
|
||||||
ZeroMem (&MtrrSettings.Variables, sizeof MtrrSettings.Variables);
|
|
||||||
- MtrrSettings.MtrrDefType |= BIT11 | BIT10 | 6;
|
|
||||||
+ MtrrSettings.MtrrDefType |= BIT10;
|
|
||||||
MtrrSetAllMtrrs (&MtrrSettings);
|
|
||||||
|
|
||||||
//
|
|
||||||
diff --git a/OvmfPkg/Sec/SecMain.c b/OvmfPkg/Sec/SecMain.c
|
|
||||||
index 60dfa61842..725b57e2fa 100644
|
|
||||||
--- a/OvmfPkg/Sec/SecMain.c
|
|
||||||
+++ b/OvmfPkg/Sec/SecMain.c
|
|
||||||
@@ -29,6 +29,8 @@
|
|
||||||
#include <Ppi/MpInitLibDep.h>
|
|
||||||
#include <Library/TdxHelperLib.h>
|
|
||||||
#include <Library/CcProbeLib.h>
|
|
||||||
+#include <Register/Intel/ArchitecturalMsr.h>
|
|
||||||
+#include <Register/Intel/Cpuid.h>
|
|
||||||
#include "AmdSev.h"
|
|
||||||
|
|
||||||
#define SEC_IDT_ENTRY_COUNT 34
|
|
||||||
@@ -743,6 +745,31 @@ FindAndReportEntryPoints (
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
+//
|
|
||||||
+// Enable MTRR early, set default type to write back.
|
|
||||||
+// Needed to make sure caching is enabled,
|
|
||||||
+// without this lzma decompress can be very slow.
|
|
||||||
+//
|
|
||||||
+STATIC
|
|
||||||
+VOID
|
|
||||||
+SecMtrrSetup (
|
|
||||||
+ VOID
|
|
||||||
+ )
|
|
||||||
+{
|
|
||||||
+ CPUID_VERSION_INFO_EDX Edx;
|
|
||||||
+ MSR_IA32_MTRR_DEF_TYPE_REGISTER DefType;
|
|
||||||
+
|
|
||||||
+ AsmCpuid (CPUID_VERSION_INFO, NULL, NULL, NULL, &Edx.Uint32);
|
|
||||||
+ if (!Edx.Bits.MTRR) {
|
|
||||||
+ return;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ DefType.Uint64 = AsmReadMsr64 (MSR_IA32_MTRR_DEF_TYPE);
|
|
||||||
+ DefType.Bits.Type = 6; /* write back */
|
|
||||||
+ DefType.Bits.E = 1; /* enable */
|
|
||||||
+ AsmWriteMsr64 (MSR_IA32_MTRR_DEF_TYPE, DefType.Uint64);
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
VOID
|
|
||||||
EFIAPI
|
|
||||||
SecCoreStartupWithStack (
|
|
||||||
@@ -942,6 +969,11 @@ SecCoreStartupWithStack (
|
|
||||||
InitializeApicTimer (0, MAX_UINT32, TRUE, 5);
|
|
||||||
DisableApicTimerInterrupt ();
|
|
||||||
|
|
||||||
+ //
|
|
||||||
+ // Initialize MTRR
|
|
||||||
+ //
|
|
||||||
+ SecMtrrSetup ();
|
|
||||||
+
|
|
||||||
//
|
|
||||||
// Initialize Debug Agent to support source level debug in SEC/PEI phases before memory ready.
|
|
||||||
//
|
|
||||||
@ -1,41 +0,0 @@
|
|||||||
From 3124da27dc460926f40477d247e021ceeabe0be3 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Gerd Hoffmann <kraxel@redhat.com>
|
|
||||||
Date: Tue, 30 Jan 2024 14:04:39 +0100
|
|
||||||
Subject: [PATCH] MdePkg/ArchitecturalMsr.h: add #defines for MTRR cache types
|
|
||||||
|
|
||||||
RH-Author: Gerd Hoffmann <None>
|
|
||||||
RH-MergeRequest: 55: OvmfPkg/Sec: Setup MTRR early in the boot process.
|
|
||||||
RH-Jira: RHEL-21704
|
|
||||||
RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
|
|
||||||
RH-Commit: [2/4] a568bc2793d677462a2971aae9566a9bbc64b063 (kraxel.rh/centos-src-edk2)
|
|
||||||
|
|
||||||
Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
|
|
||||||
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
|
|
||||||
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
||||||
Message-ID: <20240130130441.772484-3-kraxel@redhat.com>
|
|
||||||
|
|
||||||
patch_name: edk2-MdePkg-ArchitecturalMsr.h-add-defines-for-MTRR-cache.patch
|
|
||||||
present_in_specfile: true
|
|
||||||
location_in_specfile: 50
|
|
||||||
---
|
|
||||||
MdePkg/Include/Register/Intel/ArchitecturalMsr.h | 7 +++++++
|
|
||||||
1 file changed, 7 insertions(+)
|
|
||||||
|
|
||||||
diff --git a/MdePkg/Include/Register/Intel/ArchitecturalMsr.h b/MdePkg/Include/Register/Intel/ArchitecturalMsr.h
|
|
||||||
index 756e7c86ec..08ba949cf7 100644
|
|
||||||
--- a/MdePkg/Include/Register/Intel/ArchitecturalMsr.h
|
|
||||||
+++ b/MdePkg/Include/Register/Intel/ArchitecturalMsr.h
|
|
||||||
@@ -2103,6 +2103,13 @@ typedef union {
|
|
||||||
#define MSR_IA32_MTRR_PHYSBASE9 0x00000212
|
|
||||||
/// @}
|
|
||||||
|
|
||||||
+#define MSR_IA32_MTRR_CACHE_UNCACHEABLE 0
|
|
||||||
+#define MSR_IA32_MTRR_CACHE_WRITE_COMBINING 1
|
|
||||||
+#define MSR_IA32_MTRR_CACHE_WRITE_THROUGH 4
|
|
||||||
+#define MSR_IA32_MTRR_CACHE_WRITE_PROTECTED 5
|
|
||||||
+#define MSR_IA32_MTRR_CACHE_WRITE_BACK 6
|
|
||||||
+#define MSR_IA32_MTRR_CACHE_INVALID_TYPE 7
|
|
||||||
+
|
|
||||||
/**
|
|
||||||
MSR information returned for MSR indexes #MSR_IA32_MTRR_PHYSBASE0 to
|
|
||||||
#MSR_IA32_MTRR_PHYSBASE9
|
|
||||||
@ -0,0 +1,37 @@
|
|||||||
|
From ee75d5f03a473eb4007f7aaa58a41719adca0429 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Tom Lendacky <thomas.lendacky@amd.com>
|
||||||
|
Date: Mon, 18 Nov 2024 12:59:32 -0600
|
||||||
|
Subject: [PATCH] OvmfPkg/QemuFlashFvbServicesRuntimeDxe: Do not use flash with
|
||||||
|
SEV-SNP
|
||||||
|
|
||||||
|
SEV-SNP does not support the use of the Qemu flash device as SEV-SNP
|
||||||
|
guests are started using the Qemu -bios option instead of the Qemu -drive
|
||||||
|
if=pflash option. Perform runtime detection of SEV-SNP and exit early from
|
||||||
|
the Qemu flash device initialization, indicating the Qemu flash device is
|
||||||
|
not present. SEV-SNP guests will use the emulated variable support.
|
||||||
|
|
||||||
|
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
|
||||||
|
(cherry picked from commit f0d2bc3ab268c8e3c6da4158208df38bc9d3677e)
|
||||||
|
---
|
||||||
|
OvmfPkg/QemuFlashFvbServicesRuntimeDxe/QemuFlash.c | 8 ++++++++
|
||||||
|
1 file changed, 8 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/OvmfPkg/QemuFlashFvbServicesRuntimeDxe/QemuFlash.c b/OvmfPkg/QemuFlashFvbServicesRuntimeDxe/QemuFlash.c
|
||||||
|
index a577aea556..5e393e98ed 100644
|
||||||
|
--- a/OvmfPkg/QemuFlashFvbServicesRuntimeDxe/QemuFlash.c
|
||||||
|
+++ b/OvmfPkg/QemuFlashFvbServicesRuntimeDxe/QemuFlash.c
|
||||||
|
@@ -259,6 +259,14 @@ QemuFlashInitialize (
|
||||||
|
VOID
|
||||||
|
)
|
||||||
|
{
|
||||||
|
+ //
|
||||||
|
+ // The SNP model does not provide for QEMU flash device support, so exit
|
||||||
|
+ // early before attempting to initialize any QEMU flash device support.
|
||||||
|
+ //
|
||||||
|
+ if (MemEncryptSevSnpIsEnabled ()) {
|
||||||
|
+ return EFI_UNSUPPORTED;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
mFlashBase = (UINT8 *)(UINTN)PcdGet32 (PcdOvmfFdBaseAddress);
|
||||||
|
mFdBlockSize = PcdGet32 (PcdOvmfFirmwareBlockSize);
|
||||||
|
ASSERT (PcdGet32 (PcdOvmfFirmwareFdSize) % mFdBlockSize == 0);
|
||||||
@ -1,70 +0,0 @@
|
|||||||
From f015a541308b2d752c399b9ef9597c4585218032 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Gerd Hoffmann <kraxel@redhat.com>
|
|
||||||
Date: Tue, 30 Jan 2024 14:04:40 +0100
|
|
||||||
Subject: [PATCH] UefiCpuPkg/MtrrLib.h: use cache type #defines from
|
|
||||||
ArchitecturalMsr.h
|
|
||||||
|
|
||||||
RH-Author: Gerd Hoffmann <None>
|
|
||||||
RH-MergeRequest: 55: OvmfPkg/Sec: Setup MTRR early in the boot process.
|
|
||||||
RH-Jira: RHEL-21704
|
|
||||||
RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
|
|
||||||
RH-Commit: [3/4] 8b766c97b247a8665662697534455c19423ff23c (kraxel.rh/centos-src-edk2)
|
|
||||||
|
|
||||||
Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
|
|
||||||
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
|
|
||||||
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
||||||
Message-ID: <20240130130441.772484-4-kraxel@redhat.com>
|
|
||||||
|
|
||||||
patch_name: edk2-UefiCpuPkg-MtrrLib.h-use-cache-type-defines-from-Arc.patch
|
|
||||||
present_in_specfile: true
|
|
||||||
location_in_specfile: 51
|
|
||||||
---
|
|
||||||
UefiCpuPkg/Include/Library/MtrrLib.h | 26 ++++++++++++++------------
|
|
||||||
1 file changed, 14 insertions(+), 12 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/UefiCpuPkg/Include/Library/MtrrLib.h b/UefiCpuPkg/Include/Library/MtrrLib.h
|
|
||||||
index 86cc1aab3b..287d249a99 100644
|
|
||||||
--- a/UefiCpuPkg/Include/Library/MtrrLib.h
|
|
||||||
+++ b/UefiCpuPkg/Include/Library/MtrrLib.h
|
|
||||||
@@ -9,6 +9,8 @@
|
|
||||||
#ifndef _MTRR_LIB_H_
|
|
||||||
#define _MTRR_LIB_H_
|
|
||||||
|
|
||||||
+#include <Register/Intel/ArchitecturalMsr.h>
|
|
||||||
+
|
|
||||||
//
|
|
||||||
// According to IA32 SDM, MTRRs number and MSR offset are always consistent
|
|
||||||
// for IA32 processor family
|
|
||||||
@@ -82,20 +84,20 @@ typedef struct _MTRR_SETTINGS_ {
|
|
||||||
// Memory cache types
|
|
||||||
//
|
|
||||||
typedef enum {
|
|
||||||
- CacheUncacheable = 0,
|
|
||||||
- CacheWriteCombining = 1,
|
|
||||||
- CacheWriteThrough = 4,
|
|
||||||
- CacheWriteProtected = 5,
|
|
||||||
- CacheWriteBack = 6,
|
|
||||||
- CacheInvalid = 7
|
|
||||||
+ CacheUncacheable = MSR_IA32_MTRR_CACHE_UNCACHEABLE,
|
|
||||||
+ CacheWriteCombining = MSR_IA32_MTRR_CACHE_WRITE_COMBINING,
|
|
||||||
+ CacheWriteThrough = MSR_IA32_MTRR_CACHE_WRITE_THROUGH,
|
|
||||||
+ CacheWriteProtected = MSR_IA32_MTRR_CACHE_WRITE_PROTECTED,
|
|
||||||
+ CacheWriteBack = MSR_IA32_MTRR_CACHE_WRITE_BACK,
|
|
||||||
+ CacheInvalid = MSR_IA32_MTRR_CACHE_INVALID_TYPE,
|
|
||||||
} MTRR_MEMORY_CACHE_TYPE;
|
|
||||||
|
|
||||||
-#define MTRR_CACHE_UNCACHEABLE 0
|
|
||||||
-#define MTRR_CACHE_WRITE_COMBINING 1
|
|
||||||
-#define MTRR_CACHE_WRITE_THROUGH 4
|
|
||||||
-#define MTRR_CACHE_WRITE_PROTECTED 5
|
|
||||||
-#define MTRR_CACHE_WRITE_BACK 6
|
|
||||||
-#define MTRR_CACHE_INVALID_TYPE 7
|
|
||||||
+#define MTRR_CACHE_UNCACHEABLE MSR_IA32_MTRR_CACHE_UNCACHEABLE
|
|
||||||
+#define MTRR_CACHE_WRITE_COMBINING MSR_IA32_MTRR_CACHE_WRITE_COMBINING
|
|
||||||
+#define MTRR_CACHE_WRITE_THROUGH MSR_IA32_MTRR_CACHE_WRITE_THROUGH
|
|
||||||
+#define MTRR_CACHE_WRITE_PROTECTED MSR_IA32_MTRR_CACHE_WRITE_PROTECTED
|
|
||||||
+#define MTRR_CACHE_WRITE_BACK MSR_IA32_MTRR_CACHE_WRITE_BACK
|
|
||||||
+#define MTRR_CACHE_INVALID_TYPE MSR_IA32_MTRR_CACHE_INVALID_TYPE
|
|
||||||
|
|
||||||
typedef struct {
|
|
||||||
UINT64 BaseAddress;
|
|
||||||
@ -0,0 +1,52 @@
|
|||||||
|
From 6fc76f3572566a83a34bb26d21e16c0e75de3609 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Tom Lendacky <thomas.lendacky@amd.com>
|
||||||
|
Date: Mon, 18 Nov 2024 12:59:32 -0600
|
||||||
|
Subject: [PATCH] OvmfPkg/PlatformPei: Move NV vars init to after SEV-SNP
|
||||||
|
memory acceptance
|
||||||
|
|
||||||
|
When OVMF is built with the SECURE_BOOT_ENABLE set to true, reserving and
|
||||||
|
initializing the emulated variable store happens before memory has been
|
||||||
|
accepted under SEV-SNP. This results in a #VC exception for accessing
|
||||||
|
memory that hasn't been validated (error code 0x404). The #VC handler
|
||||||
|
treats this error code as a fatal error, causing the OVMF boot to fail.
|
||||||
|
|
||||||
|
Move the call to ReserveEmuVariableNvStore() to after memory has been
|
||||||
|
accepted by AmdSevInitialize().
|
||||||
|
|
||||||
|
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
|
||||||
|
(cherry picked from commit 52fa7e78d282f8434b41aff24b3a5a745611ff87)
|
||||||
|
---
|
||||||
|
OvmfPkg/PlatformPei/Platform.c | 14 ++++++++++----
|
||||||
|
1 file changed, 10 insertions(+), 4 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/OvmfPkg/PlatformPei/Platform.c b/OvmfPkg/PlatformPei/Platform.c
|
||||||
|
index 05b924f99f..54903cfca2 100644
|
||||||
|
--- a/OvmfPkg/PlatformPei/Platform.c
|
||||||
|
+++ b/OvmfPkg/PlatformPei/Platform.c
|
||||||
|
@@ -365,10 +365,6 @@ InitializePlatform (
|
||||||
|
InitializeRamRegions (PlatformInfoHob);
|
||||||
|
|
||||||
|
if (PlatformInfoHob->BootMode != BOOT_ON_S3_RESUME) {
|
||||||
|
- if (!PlatformInfoHob->SmmSmramRequire) {
|
||||||
|
- ReserveEmuVariableNvStore ();
|
||||||
|
- }
|
||||||
|
-
|
||||||
|
PeiFvInitialization (PlatformInfoHob);
|
||||||
|
MemTypeInfoInitialization (PlatformInfoHob);
|
||||||
|
MemMapInitialization (PlatformInfoHob);
|
||||||
|
@@ -391,5 +387,15 @@ InitializePlatform (
|
||||||
|
RelocateSmBase ();
|
||||||
|
}
|
||||||
|
|
||||||
|
+ //
|
||||||
|
+ // Performed after CoCo (SEV/TDX) initialization to allow the memory
|
||||||
|
+ // used to be validated before being used.
|
||||||
|
+ //
|
||||||
|
+ if (PlatformInfoHob->BootMode != BOOT_ON_S3_RESUME) {
|
||||||
|
+ if (!PlatformInfoHob->SmmSmramRequire) {
|
||||||
|
+ ReserveEmuVariableNvStore ();
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
return EFI_SUCCESS;
|
||||||
|
}
|
||||||
@ -1,49 +0,0 @@
|
|||||||
From dd543686c34fc3c6ddfafc0104066889ad9d1813 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Gerd Hoffmann <kraxel@redhat.com>
|
|
||||||
Date: Tue, 30 Jan 2024 14:04:41 +0100
|
|
||||||
Subject: [PATCH] OvmfPkg/Sec: use cache type #defines from ArchitecturalMsr.h
|
|
||||||
|
|
||||||
RH-Author: Gerd Hoffmann <None>
|
|
||||||
RH-MergeRequest: 55: OvmfPkg/Sec: Setup MTRR early in the boot process.
|
|
||||||
RH-Jira: RHEL-21704
|
|
||||||
RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
|
|
||||||
RH-Commit: [4/4] 55f00e3e153ca945ca458e7abc26780a8d83ac85 (kraxel.rh/centos-src-edk2)
|
|
||||||
|
|
||||||
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
|
|
||||||
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
||||||
Message-ID: <20240130130441.772484-5-kraxel@redhat.com>
|
|
||||||
|
|
||||||
patch_name: edk2-OvmfPkg-Sec-use-cache-type-defines-from-Architectura.patch
|
|
||||||
present_in_specfile: true
|
|
||||||
location_in_specfile: 52
|
|
||||||
---
|
|
||||||
OvmfPkg/IntelTdx/Sec/SecMain.c | 2 +-
|
|
||||||
OvmfPkg/Sec/SecMain.c | 2 +-
|
|
||||||
2 files changed, 2 insertions(+), 2 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/OvmfPkg/IntelTdx/Sec/SecMain.c b/OvmfPkg/IntelTdx/Sec/SecMain.c
|
|
||||||
index 7094d86159..1a19f26178 100644
|
|
||||||
--- a/OvmfPkg/IntelTdx/Sec/SecMain.c
|
|
||||||
+++ b/OvmfPkg/IntelTdx/Sec/SecMain.c
|
|
||||||
@@ -69,7 +69,7 @@ SecMtrrSetup (
|
|
||||||
}
|
|
||||||
|
|
||||||
DefType.Uint64 = AsmReadMsr64 (MSR_IA32_MTRR_DEF_TYPE);
|
|
||||||
- DefType.Bits.Type = 6; /* write back */
|
|
||||||
+ DefType.Bits.Type = MSR_IA32_MTRR_CACHE_WRITE_BACK;
|
|
||||||
DefType.Bits.E = 1; /* enable */
|
|
||||||
AsmWriteMsr64 (MSR_IA32_MTRR_DEF_TYPE, DefType.Uint64);
|
|
||||||
}
|
|
||||||
diff --git a/OvmfPkg/Sec/SecMain.c b/OvmfPkg/Sec/SecMain.c
|
|
||||||
index 725b57e2fa..26963b924d 100644
|
|
||||||
--- a/OvmfPkg/Sec/SecMain.c
|
|
||||||
+++ b/OvmfPkg/Sec/SecMain.c
|
|
||||||
@@ -765,7 +765,7 @@ SecMtrrSetup (
|
|
||||||
}
|
|
||||||
|
|
||||||
DefType.Uint64 = AsmReadMsr64 (MSR_IA32_MTRR_DEF_TYPE);
|
|
||||||
- DefType.Bits.Type = 6; /* write back */
|
|
||||||
+ DefType.Bits.Type = MSR_IA32_MTRR_CACHE_WRITE_BACK;
|
|
||||||
DefType.Bits.E = 1; /* enable */
|
|
||||||
AsmWriteMsr64 (MSR_IA32_MTRR_DEF_TYPE, DefType.Uint64);
|
|
||||||
}
|
|
||||||
@ -0,0 +1,103 @@
|
|||||||
|
From 3ae6cb5329ce5e48efc29989943e19cfccbfb38b Mon Sep 17 00:00:00 2001
|
||||||
|
From: Tom Lendacky <thomas.lendacky@amd.com>
|
||||||
|
Date: Mon, 18 Nov 2024 12:59:32 -0600
|
||||||
|
Subject: [PATCH] OvmfPkg/PlatformInitLib: Retry NV vars FV check as shared
|
||||||
|
|
||||||
|
When OVMF is built with SECURE_BOOT_ENABLE, the variable store will be
|
||||||
|
populated and validated in PlatformValidateNvVarStore(). When an SEV
|
||||||
|
or an SEV-ES guest is running, this may be encrypted or unencrypted
|
||||||
|
depending on how the guest was started. If the guest was started with the
|
||||||
|
combined code and variable contents (OVMF.fd), then the variable store
|
||||||
|
will be encrypted. If the guest was started with the separate code and
|
||||||
|
variables contents (OVMF_CODE.fd and OVMF_VARS.fd), then the variable
|
||||||
|
store will be unencrypted.
|
||||||
|
|
||||||
|
When PlatformValidateNvVarStore() is first invoked, the variable store
|
||||||
|
area is initially mapped encrypted, which may or may not pass the variable
|
||||||
|
validation step depending how the guest was launched. To accomodate this,
|
||||||
|
retry the validation step on failure after remapping the variable store
|
||||||
|
area as unencrypted.
|
||||||
|
|
||||||
|
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
|
||||||
|
(cherry picked from commit d502cc7702e4d537c2bcbe5256e26cba6d4ca8c6)
|
||||||
|
---
|
||||||
|
OvmfPkg/Library/PlatformInitLib/Platform.c | 32 +++++++++++++++++--
|
||||||
|
.../PlatformInitLib/PlatformInitLib.inf | 1 +
|
||||||
|
2 files changed, 31 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/OvmfPkg/Library/PlatformInitLib/Platform.c b/OvmfPkg/Library/PlatformInitLib/Platform.c
|
||||||
|
index 10fc17355f..715533b1f2 100644
|
||||||
|
--- a/OvmfPkg/Library/PlatformInitLib/Platform.c
|
||||||
|
+++ b/OvmfPkg/Library/PlatformInitLib/Platform.c
|
||||||
|
@@ -34,6 +34,7 @@
|
||||||
|
#include <Guid/VariableFormat.h>
|
||||||
|
#include <OvmfPlatforms.h>
|
||||||
|
#include <Library/TdxLib.h>
|
||||||
|
+#include <Library/MemEncryptSevLib.h>
|
||||||
|
|
||||||
|
#include <Library/PlatformInitLib.h>
|
||||||
|
|
||||||
|
@@ -774,6 +775,8 @@ PlatformValidateNvVarStore (
|
||||||
|
EFI_FIRMWARE_VOLUME_HEADER *NvVarStoreFvHeader;
|
||||||
|
VARIABLE_STORE_HEADER *NvVarStoreHeader;
|
||||||
|
AUTHENTICATED_VARIABLE_HEADER *VariableHeader;
|
||||||
|
+ BOOLEAN Retry;
|
||||||
|
+ EFI_STATUS Status;
|
||||||
|
|
||||||
|
static EFI_GUID FvHdrGUID = EFI_SYSTEM_NV_DATA_FV_GUID;
|
||||||
|
static EFI_GUID VarStoreHdrGUID = EFI_AUTHENTICATED_VARIABLE_GUID;
|
||||||
|
@@ -792,6 +795,15 @@ PlatformValidateNvVarStore (
|
||||||
|
//
|
||||||
|
NvVarStoreFvHeader = (EFI_FIRMWARE_VOLUME_HEADER *)NvVarStoreBase;
|
||||||
|
|
||||||
|
+ //
|
||||||
|
+ // SEV and SEV-ES can use separate flash devices for OVMF code and
|
||||||
|
+ // OVMF variables. In this case, the OVMF variables will need to be
|
||||||
|
+ // mapped unencrypted. If the initial validation fails, remap the
|
||||||
|
+ // NV variable store as unencrypted and retry the validation.
|
||||||
|
+ //
|
||||||
|
+ Retry = MemEncryptSevIsEnabled ();
|
||||||
|
+
|
||||||
|
+RETRY:
|
||||||
|
if ((!IsZeroBuffer (NvVarStoreFvHeader->ZeroVector, 16)) ||
|
||||||
|
(!CompareGuid (&FvHdrGUID, &NvVarStoreFvHeader->FileSystemGuid)) ||
|
||||||
|
(NvVarStoreFvHeader->Signature != EFI_FVH_SIGNATURE) ||
|
||||||
|
@@ -801,8 +813,24 @@ PlatformValidateNvVarStore (
|
||||||
|
(NvVarStoreFvHeader->FvLength != NvVarStoreSize)
|
||||||
|
)
|
||||||
|
{
|
||||||
|
- DEBUG ((DEBUG_ERROR, "NvVarStore FV headers were invalid.\n"));
|
||||||
|
- return FALSE;
|
||||||
|
+ if (!Retry) {
|
||||||
|
+ DEBUG ((DEBUG_ERROR, "NvVarStore FV headers were invalid.\n"));
|
||||||
|
+ return FALSE;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ DEBUG ((DEBUG_INFO, "Remapping NvVarStore as shared\n"));
|
||||||
|
+ Status = MemEncryptSevClearMmioPageEncMask (
|
||||||
|
+ 0,
|
||||||
|
+ (UINTN)NvVarStoreBase,
|
||||||
|
+ EFI_SIZE_TO_PAGES (NvVarStoreSize)
|
||||||
|
+ );
|
||||||
|
+ if (EFI_ERROR (Status)) {
|
||||||
|
+ DEBUG ((DEBUG_ERROR, "Failed to map NvVarStore as shared\n"));
|
||||||
|
+ return FALSE;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ Retry = FALSE;
|
||||||
|
+ goto RETRY;
|
||||||
|
}
|
||||||
|
|
||||||
|
//
|
||||||
|
diff --git a/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf b/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf
|
||||||
|
index 3e63ef4423..fb179e6791 100644
|
||||||
|
--- a/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf
|
||||||
|
+++ b/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf
|
||||||
|
@@ -48,6 +48,7 @@
|
||||||
|
HobLib
|
||||||
|
QemuFwCfgLib
|
||||||
|
QemuFwCfgSimpleParserLib
|
||||||
|
+ MemEncryptSevLib
|
||||||
|
MemoryAllocationLib
|
||||||
|
MtrrLib
|
||||||
|
PcdLib
|
||||||
@ -0,0 +1,28 @@
|
|||||||
|
From 6944acabf2aa916e7f321c28f19e7d95b155df99 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Tom Lendacky <thomas.lendacky@amd.com>
|
||||||
|
Date: Mon, 18 Nov 2024 12:59:32 -0600
|
||||||
|
Subject: [PATCH] OvmfPkg/EmuVariableFvbRuntimeDxe: Issue NV vars
|
||||||
|
initializitation message
|
||||||
|
|
||||||
|
Add a debug message that indicates when the NV variables are being
|
||||||
|
initialized through the template structure.
|
||||||
|
|
||||||
|
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
|
||||||
|
(cherry picked from commit 6142f0a8a53557ba50300c762a15bf3c18382162)
|
||||||
|
---
|
||||||
|
OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.c | 2 ++
|
||||||
|
1 file changed, 2 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.c b/OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.c
|
||||||
|
index c07e38966e..cc476c7df2 100644
|
||||||
|
--- a/OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.c
|
||||||
|
+++ b/OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.c
|
||||||
|
@@ -692,6 +692,8 @@ InitializeFvAndVariableStoreHeaders (
|
||||||
|
//
|
||||||
|
Fv = (EFI_FIRMWARE_VOLUME_HEADER *)Ptr;
|
||||||
|
Fv->Checksum = CalculateCheckSum16 (Ptr, Fv->HeaderLength);
|
||||||
|
+
|
||||||
|
+ DEBUG ((DEBUG_INFO, "EMU Variable FVB: Initialized FV using template structure\n"));
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
@ -1,127 +0,0 @@
|
|||||||
From 3f8eab199430de18c1c6a98d1d0772499b17cc86 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Gerd Hoffmann <kraxel@redhat.com>
|
|
||||||
Date: Wed, 8 May 2024 13:14:26 +0200
|
|
||||||
Subject: [PATCH] OvmfPkg: add morlock support
|
|
||||||
|
|
||||||
Add dsc + fdf include files to add the MorLock drivers to the build.
|
|
||||||
Add the include files to OVMF build configurations.
|
|
||||||
|
|
||||||
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
||||||
(cherry picked from commit b45aff0dc9cb87f316eb17a11e5d4438175d9cca)
|
|
||||||
---
|
|
||||||
OvmfPkg/Include/Dsc/MorLock.dsc.inc | 10 ++++++++++
|
|
||||||
OvmfPkg/Include/Fdf/MorLock.fdf.inc | 10 ++++++++++
|
|
||||||
OvmfPkg/OvmfPkgIa32.dsc | 1 +
|
|
||||||
OvmfPkg/OvmfPkgIa32.fdf | 1 +
|
|
||||||
OvmfPkg/OvmfPkgIa32X64.dsc | 1 +
|
|
||||||
OvmfPkg/OvmfPkgIa32X64.fdf | 1 +
|
|
||||||
OvmfPkg/OvmfPkgX64.dsc | 1 +
|
|
||||||
OvmfPkg/OvmfPkgX64.fdf | 1 +
|
|
||||||
8 files changed, 26 insertions(+)
|
|
||||||
create mode 100644 OvmfPkg/Include/Dsc/MorLock.dsc.inc
|
|
||||||
create mode 100644 OvmfPkg/Include/Fdf/MorLock.fdf.inc
|
|
||||||
|
|
||||||
diff --git a/OvmfPkg/Include/Dsc/MorLock.dsc.inc b/OvmfPkg/Include/Dsc/MorLock.dsc.inc
|
|
||||||
new file mode 100644
|
|
||||||
index 0000000000..a8c5fb24b8
|
|
||||||
--- /dev/null
|
|
||||||
+++ b/OvmfPkg/Include/Dsc/MorLock.dsc.inc
|
|
||||||
@@ -0,0 +1,10 @@
|
|
||||||
+##
|
|
||||||
+# SPDX-License-Identifier: BSD-2-Clause-Patent
|
|
||||||
+#
|
|
||||||
+# MorLock support
|
|
||||||
+##
|
|
||||||
+
|
|
||||||
+ SecurityPkg/Tcg/MemoryOverwriteControl/TcgMor.inf
|
|
||||||
+!if $(SMM_REQUIRE) == TRUE
|
|
||||||
+ SecurityPkg/Tcg/MemoryOverwriteRequestControlLock/TcgMorLockSmm.inf
|
|
||||||
+!endif
|
|
||||||
diff --git a/OvmfPkg/Include/Fdf/MorLock.fdf.inc b/OvmfPkg/Include/Fdf/MorLock.fdf.inc
|
|
||||||
new file mode 100644
|
|
||||||
index 0000000000..20b7d6619a
|
|
||||||
--- /dev/null
|
|
||||||
+++ b/OvmfPkg/Include/Fdf/MorLock.fdf.inc
|
|
||||||
@@ -0,0 +1,10 @@
|
|
||||||
+##
|
|
||||||
+# SPDX-License-Identifier: BSD-2-Clause-Patent
|
|
||||||
+#
|
|
||||||
+# MorLock support
|
|
||||||
+##
|
|
||||||
+
|
|
||||||
+INF SecurityPkg/Tcg/MemoryOverwriteControl/TcgMor.inf
|
|
||||||
+!if $(SMM_REQUIRE) == TRUE
|
|
||||||
+INF SecurityPkg/Tcg/MemoryOverwriteRequestControlLock/TcgMorLockSmm.inf
|
|
||||||
+!endif
|
|
||||||
diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
|
|
||||||
index d8ae542686..65a866ae0c 100644
|
|
||||||
--- a/OvmfPkg/OvmfPkgIa32.dsc
|
|
||||||
+++ b/OvmfPkg/OvmfPkgIa32.dsc
|
|
||||||
@@ -887,6 +887,7 @@
|
|
||||||
MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
|
|
||||||
|
|
||||||
!include OvmfPkg/Include/Dsc/ShellComponents.dsc.inc
|
|
||||||
+!include OvmfPkg/Include/Dsc/MorLock.dsc.inc
|
|
||||||
|
|
||||||
!if $(SECURE_BOOT_ENABLE) == TRUE
|
|
||||||
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
|
|
||||||
diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
|
|
||||||
index 0ffa3be750..10eb6fe72b 100644
|
|
||||||
--- a/OvmfPkg/OvmfPkgIa32.fdf
|
|
||||||
+++ b/OvmfPkg/OvmfPkgIa32.fdf
|
|
||||||
@@ -355,6 +355,7 @@ INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
|
|
||||||
!include OvmfPkg/Include/Fdf/OvmfTpmDxe.fdf.inc
|
|
||||||
|
|
||||||
!include OvmfPkg/Include/Fdf/ShellDxe.fdf.inc
|
|
||||||
+!include OvmfPkg/Include/Fdf/MorLock.fdf.inc
|
|
||||||
|
|
||||||
!if $(LOAD_X64_ON_IA32_ENABLE) == TRUE
|
|
||||||
INF OvmfPkg/CompatImageLoaderDxe/CompatImageLoaderDxe.inf
|
|
||||||
diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
|
|
||||||
index 52ac2c96fc..679e25501b 100644
|
|
||||||
--- a/OvmfPkg/OvmfPkgIa32X64.dsc
|
|
||||||
+++ b/OvmfPkg/OvmfPkgIa32X64.dsc
|
|
||||||
@@ -901,6 +901,7 @@
|
|
||||||
MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
|
|
||||||
|
|
||||||
!include OvmfPkg/Include/Dsc/ShellComponents.dsc.inc
|
|
||||||
+!include OvmfPkg/Include/Dsc/MorLock.dsc.inc
|
|
||||||
|
|
||||||
!if $(SECURE_BOOT_ENABLE) == TRUE
|
|
||||||
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
|
|
||||||
diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
|
|
||||||
index c4f3ec0735..ff06bbfc6f 100644
|
|
||||||
--- a/OvmfPkg/OvmfPkgIa32X64.fdf
|
|
||||||
+++ b/OvmfPkg/OvmfPkgIa32X64.fdf
|
|
||||||
@@ -362,6 +362,7 @@ INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
|
|
||||||
!include OvmfPkg/Include/Fdf/OvmfTpmDxe.fdf.inc
|
|
||||||
|
|
||||||
!include OvmfPkg/Include/Fdf/ShellDxe.fdf.inc
|
|
||||||
+!include OvmfPkg/Include/Fdf/MorLock.fdf.inc
|
|
||||||
|
|
||||||
################################################################################
|
|
||||||
|
|
||||||
diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
|
|
||||||
index f76d0ef7bc..d294fd4625 100644
|
|
||||||
--- a/OvmfPkg/OvmfPkgX64.dsc
|
|
||||||
+++ b/OvmfPkg/OvmfPkgX64.dsc
|
|
||||||
@@ -969,6 +969,7 @@
|
|
||||||
MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
|
|
||||||
|
|
||||||
!include OvmfPkg/Include/Dsc/ShellComponents.dsc.inc
|
|
||||||
+!include OvmfPkg/Include/Dsc/MorLock.dsc.inc
|
|
||||||
|
|
||||||
!if $(SECURE_BOOT_ENABLE) == TRUE
|
|
||||||
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
|
|
||||||
diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
|
|
||||||
index bedd85ef7a..f3b787201f 100644
|
|
||||||
--- a/OvmfPkg/OvmfPkgX64.fdf
|
|
||||||
+++ b/OvmfPkg/OvmfPkgX64.fdf
|
|
||||||
@@ -402,6 +402,7 @@ INF OvmfPkg/Tcg/TdTcg2Dxe/TdTcg2Dxe.inf
|
|
||||||
!include OvmfPkg/Include/Fdf/OvmfTpmDxe.fdf.inc
|
|
||||||
|
|
||||||
!include OvmfPkg/Include/Fdf/ShellDxe.fdf.inc
|
|
||||||
+!include OvmfPkg/Include/Fdf/MorLock.fdf.inc
|
|
||||||
|
|
||||||
################################################################################
|
|
||||||
|
|
||||||
@ -1,192 +0,0 @@
|
|||||||
From 3899f089b8197f52ca63fe1561f8e5e1341f8198 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Pedro Falcato <pedro.falcato@gmail.com>
|
|
||||||
Date: Tue, 22 Nov 2022 22:31:03 +0000
|
|
||||||
Subject: [PATCH] MdePkg/BaseRngLib: Add a smoketest for RDRAND and check CPUID
|
|
||||||
|
|
||||||
RDRAND has notoriously been broken many times over its lifespan.
|
|
||||||
Add a smoketest to RDRAND, in order to better sniff out potential
|
|
||||||
security concerns.
|
|
||||||
|
|
||||||
Also add a proper CPUID test in order to support older CPUs which may
|
|
||||||
not have it; it was previously being tested but then promptly ignored.
|
|
||||||
|
|
||||||
Testing algorithm inspired by linux's arch/x86/kernel/cpu/rdrand.c
|
|
||||||
:x86_init_rdrand() per commit 049f9ae9..
|
|
||||||
|
|
||||||
Many thanks to Jason Donenfeld for relicensing his linux RDRAND detection
|
|
||||||
code to MIT and the public domain.
|
|
||||||
|
|
||||||
>On Tue, Nov 22, 2022 at 2:21 PM Jason A. Donenfeld <Jason@zx2c4.com> wrote:
|
|
||||||
<..>
|
|
||||||
> I (re)wrote that function in Linux. I hereby relicense it as MIT, and
|
|
||||||
> also place it into public domain. Do with it what you will now.
|
|
||||||
>
|
|
||||||
> Jason
|
|
||||||
|
|
||||||
BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4163
|
|
||||||
|
|
||||||
Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
|
|
||||||
Cc: Michael D Kinney <michael.d.kinney@intel.com>
|
|
||||||
Cc: Liming Gao <gaoliming@byosoft.com.cn>
|
|
||||||
Cc: Zhiguang Liu <zhiguang.liu@intel.com>
|
|
||||||
Cc: Jason A. Donenfeld <Jason@zx2c4.com>
|
|
||||||
(cherry picked from commit c3a8ca7b54a9fd17acdf16c6282a92cc989fa92a)
|
|
||||||
---
|
|
||||||
MdePkg/Library/BaseRngLib/Rand/RdRand.c | 99 +++++++++++++++++++++++--
|
|
||||||
1 file changed, 91 insertions(+), 8 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/MdePkg/Library/BaseRngLib/Rand/RdRand.c b/MdePkg/Library/BaseRngLib/Rand/RdRand.c
|
|
||||||
index 9bd68352f9..06d2a6f12d 100644
|
|
||||||
--- a/MdePkg/Library/BaseRngLib/Rand/RdRand.c
|
|
||||||
+++ b/MdePkg/Library/BaseRngLib/Rand/RdRand.c
|
|
||||||
@@ -3,6 +3,7 @@
|
|
||||||
to provide high-quality random numbers.
|
|
||||||
|
|
||||||
Copyright (c) 2023, Arm Limited. All rights reserved.<BR>
|
|
||||||
+Copyright (c) 2022, Pedro Falcato. All rights reserved.<BR>
|
|
||||||
Copyright (c) 2021, NUVIA Inc. All rights reserved.<BR>
|
|
||||||
Copyright (c) 2015, Intel Corporation. All rights reserved.<BR>
|
|
||||||
|
|
||||||
@@ -24,6 +25,88 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
|
|
||||||
|
|
||||||
STATIC BOOLEAN mRdRandSupported;
|
|
||||||
|
|
||||||
+//
|
|
||||||
+// Intel SDM says 10 tries is good enough for reliable RDRAND usage.
|
|
||||||
+//
|
|
||||||
+#define RDRAND_RETRIES 10
|
|
||||||
+
|
|
||||||
+#define RDRAND_TEST_SAMPLES 8
|
|
||||||
+
|
|
||||||
+#define RDRAND_MIN_CHANGE 5
|
|
||||||
+
|
|
||||||
+//
|
|
||||||
+// Add a define for native-word RDRAND, just for the test.
|
|
||||||
+//
|
|
||||||
+#ifdef MDE_CPU_X64
|
|
||||||
+#define ASM_RDRAND AsmRdRand64
|
|
||||||
+#else
|
|
||||||
+#define ASM_RDRAND AsmRdRand32
|
|
||||||
+#endif
|
|
||||||
+
|
|
||||||
+/**
|
|
||||||
+ Tests RDRAND for broken implementations.
|
|
||||||
+
|
|
||||||
+ @retval TRUE RDRAND is reliable (and hopefully safe).
|
|
||||||
+ @retval FALSE RDRAND is unreliable and should be disabled, despite CPUID.
|
|
||||||
+
|
|
||||||
+**/
|
|
||||||
+STATIC
|
|
||||||
+BOOLEAN
|
|
||||||
+TestRdRand (
|
|
||||||
+ VOID
|
|
||||||
+ )
|
|
||||||
+{
|
|
||||||
+ //
|
|
||||||
+ // Test for notoriously broken rdrand implementations that always return the same
|
|
||||||
+ // value, like the Zen 3 uarch (all-1s) or other several AMD families on suspend/resume (also all-1s).
|
|
||||||
+ // Note that this should be expanded to extensively test for other sorts of possible errata.
|
|
||||||
+ //
|
|
||||||
+
|
|
||||||
+ //
|
|
||||||
+ // Our algorithm samples rdrand $RDRAND_TEST_SAMPLES times and expects
|
|
||||||
+ // a different result $RDRAND_MIN_CHANGE times for reliable RDRAND usage.
|
|
||||||
+ //
|
|
||||||
+ UINTN Prev;
|
|
||||||
+ UINT8 Idx;
|
|
||||||
+ UINT8 TestIteration;
|
|
||||||
+ UINT32 Changed;
|
|
||||||
+
|
|
||||||
+ Changed = 0;
|
|
||||||
+
|
|
||||||
+ for (TestIteration = 0; TestIteration < RDRAND_TEST_SAMPLES; TestIteration++) {
|
|
||||||
+ UINTN Sample;
|
|
||||||
+ //
|
|
||||||
+ // Note: We use a retry loop for rdrand. Normal users get this in BaseRng.c
|
|
||||||
+ // Any failure to get a random number will assume RDRAND does not work.
|
|
||||||
+ //
|
|
||||||
+ for (Idx = 0; Idx < RDRAND_RETRIES; Idx++) {
|
|
||||||
+ if (ASM_RDRAND (&Sample)) {
|
|
||||||
+ break;
|
|
||||||
+ }
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ if (Idx == RDRAND_RETRIES) {
|
|
||||||
+ DEBUG ((DEBUG_ERROR, "BaseRngLib/x86: CPU BUG: Failed to get an RDRAND random number - disabling\n"));
|
|
||||||
+ return FALSE;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ if (TestIteration != 0) {
|
|
||||||
+ Changed += Sample != Prev;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ Prev = Sample;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ if (Changed < RDRAND_MIN_CHANGE) {
|
|
||||||
+ DEBUG ((DEBUG_ERROR, "BaseRngLib/x86: CPU BUG: RDRAND not reliable - disabling\n"));
|
|
||||||
+ return FALSE;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ return TRUE;
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+#undef ASM_RDRAND
|
|
||||||
+
|
|
||||||
/**
|
|
||||||
The constructor function checks whether or not RDRAND instruction is supported
|
|
||||||
by the host hardware.
|
|
||||||
@@ -48,10 +131,13 @@ BaseRngLibConstructor (
|
|
||||||
// CPUID. A value of 1 indicates that processor support RDRAND instruction.
|
|
||||||
//
|
|
||||||
AsmCpuid (1, 0, 0, &RegEcx, 0);
|
|
||||||
- ASSERT ((RegEcx & RDRAND_MASK) == RDRAND_MASK);
|
|
||||||
|
|
||||||
mRdRandSupported = ((RegEcx & RDRAND_MASK) == RDRAND_MASK);
|
|
||||||
|
|
||||||
+ if (mRdRandSupported) {
|
|
||||||
+ mRdRandSupported = TestRdRand ();
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
return EFI_SUCCESS;
|
|
||||||
}
|
|
||||||
|
|
||||||
@@ -70,6 +156,7 @@ ArchGetRandomNumber16 (
|
|
||||||
OUT UINT16 *Rand
|
|
||||||
)
|
|
||||||
{
|
|
||||||
+ ASSERT (mRdRandSupported);
|
|
||||||
return AsmRdRand16 (Rand);
|
|
||||||
}
|
|
||||||
|
|
||||||
@@ -88,6 +175,7 @@ ArchGetRandomNumber32 (
|
|
||||||
OUT UINT32 *Rand
|
|
||||||
)
|
|
||||||
{
|
|
||||||
+ ASSERT (mRdRandSupported);
|
|
||||||
return AsmRdRand32 (Rand);
|
|
||||||
}
|
|
||||||
|
|
||||||
@@ -106,6 +194,7 @@ ArchGetRandomNumber64 (
|
|
||||||
OUT UINT64 *Rand
|
|
||||||
)
|
|
||||||
{
|
|
||||||
+ ASSERT (mRdRandSupported);
|
|
||||||
return AsmRdRand64 (Rand);
|
|
||||||
}
|
|
||||||
|
|
||||||
@@ -122,13 +211,7 @@ ArchIsRngSupported (
|
|
||||||
VOID
|
|
||||||
)
|
|
||||||
{
|
|
||||||
- /*
|
|
||||||
- Existing software depends on this always returning TRUE, so for
|
|
||||||
- now hard-code it.
|
|
||||||
-
|
|
||||||
- return mRdRandSupported;
|
|
||||||
- */
|
|
||||||
- return TRUE;
|
|
||||||
+ return mRdRandSupported;
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
@ -0,0 +1,51 @@
|
|||||||
|
From 87a3869f6d509e36d8c5dfe5a1bd8dea62195dab Mon Sep 17 00:00:00 2001
|
||||||
|
From: Gerd Hoffmann <kraxel@redhat.com>
|
||||||
|
Date: Fri, 23 Aug 2024 11:55:31 +0200
|
||||||
|
Subject: [PATCH] OvmfPkg/PlatformInitLib: enable x2apic mode if needed
|
||||||
|
|
||||||
|
Enable x2apic mode in case the number of possible CPUs (including
|
||||||
|
hotplug-able CPus which are not (yet) online) is larger than 255.
|
||||||
|
|
||||||
|
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
||||||
|
(cherry picked from commit 8c8e05db24d8578cf87669e491f983fbd8357d55)
|
||||||
|
---
|
||||||
|
OvmfPkg/Library/PlatformInitLib/Platform.c | 6 ++++++
|
||||||
|
OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf | 1 +
|
||||||
|
2 files changed, 7 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/OvmfPkg/Library/PlatformInitLib/Platform.c b/OvmfPkg/Library/PlatformInitLib/Platform.c
|
||||||
|
index 715533b1f2..afe8b0abd6 100644
|
||||||
|
--- a/OvmfPkg/Library/PlatformInitLib/Platform.c
|
||||||
|
+++ b/OvmfPkg/Library/PlatformInitLib/Platform.c
|
||||||
|
@@ -30,6 +30,7 @@
|
||||||
|
#include <Library/QemuFwCfgS3Lib.h>
|
||||||
|
#include <Library/QemuFwCfgSimpleParserLib.h>
|
||||||
|
#include <Library/PciLib.h>
|
||||||
|
+#include <Library/LocalApicLib.h>
|
||||||
|
#include <Guid/SystemNvDataGuid.h>
|
||||||
|
#include <Guid/VariableFormat.h>
|
||||||
|
#include <OvmfPlatforms.h>
|
||||||
|
@@ -720,6 +721,11 @@ PlatformMaxCpuCountInitialization (
|
||||||
|
));
|
||||||
|
ASSERT (BootCpuCount <= MaxCpuCount);
|
||||||
|
|
||||||
|
+ if (MaxCpuCount > 255) {
|
||||||
|
+ DEBUG ((DEBUG_INFO, "%a: enable x2apic mode\n", __func__));
|
||||||
|
+ SetApicMode (LOCAL_APIC_MODE_X2APIC);
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
PlatformInfoHob->PcdCpuMaxLogicalProcessorNumber = MaxCpuCount;
|
||||||
|
PlatformInfoHob->PcdCpuBootLogicalProcessorNumber = BootCpuCount;
|
||||||
|
}
|
||||||
|
diff --git a/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf b/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf
|
||||||
|
index fb179e6791..c79b2ee106 100644
|
||||||
|
--- a/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf
|
||||||
|
+++ b/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf
|
||||||
|
@@ -48,6 +48,7 @@
|
||||||
|
HobLib
|
||||||
|
QemuFwCfgLib
|
||||||
|
QemuFwCfgSimpleParserLib
|
||||||
|
+ LocalApicLib
|
||||||
|
MemEncryptSevLib
|
||||||
|
MemoryAllocationLib
|
||||||
|
MtrrLib
|
||||||
@ -1,43 +0,0 @@
|
|||||||
From 4947d363211159647e9266fa20ad9d4c8bc52f71 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Gerd Hoffmann <kraxel@redhat.com>
|
|
||||||
Date: Fri, 31 May 2024 09:49:13 +0200
|
|
||||||
Subject: [PATCH] SecurityPkg/RngDxe: add rng test
|
|
||||||
|
|
||||||
Check whenever RngLib actually returns random numbers, only return
|
|
||||||
a non-zero number of Algorithms if that is the case.
|
|
||||||
|
|
||||||
This has the effect that RndDxe loads and installs EFI_RNG_PROTOCOL
|
|
||||||
only in case it can actually deliver random numbers.
|
|
||||||
|
|
||||||
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
||||||
(cherry picked from commit a61bc0accb8a76edba4f073fdc7bafc908df045d)
|
|
||||||
---
|
|
||||||
SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c | 8 +++++++-
|
|
||||||
1 file changed, 7 insertions(+), 1 deletion(-)
|
|
||||||
|
|
||||||
diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
|
|
||||||
index 5723ed6957..8b0742bab6 100644
|
|
||||||
--- a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
|
|
||||||
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
|
|
||||||
@@ -23,6 +23,7 @@
|
|
||||||
|
|
||||||
#include <Library/BaseLib.h>
|
|
||||||
#include <Library/BaseMemoryLib.h>
|
|
||||||
+#include <Library/RngLib.h>
|
|
||||||
|
|
||||||
#include "RngDxeInternals.h"
|
|
||||||
|
|
||||||
@@ -43,7 +44,12 @@ GetAvailableAlgorithms (
|
|
||||||
VOID
|
|
||||||
)
|
|
||||||
{
|
|
||||||
- mAvailableAlgoArrayCount = RNG_ALGORITHM_COUNT;
|
|
||||||
+ UINT64 RngTest;
|
|
||||||
+
|
|
||||||
+ if (GetRandomNumber64 (&RngTest)) {
|
|
||||||
+ mAvailableAlgoArrayCount = RNG_ALGORITHM_COUNT;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
return EFI_SUCCESS;
|
|
||||||
}
|
|
||||||
|
|
||||||
@ -1,301 +0,0 @@
|
|||||||
From 0aa96c512c689426838ec1cf4aa78ff088c03a1e Mon Sep 17 00:00:00 2001
|
|
||||||
From: Gerd Hoffmann <kraxel@redhat.com>
|
|
||||||
Date: Fri, 24 May 2024 12:51:17 +0200
|
|
||||||
Subject: [PATCH] OvmfPkg: wire up RngDxe
|
|
||||||
|
|
||||||
Add OvmfRng include snippets with the random number generator
|
|
||||||
configuration for OVMF. Include RngDxe, build with BaseRngLib,
|
|
||||||
so the rdrand instruction is used (if available).
|
|
||||||
|
|
||||||
Also move VirtioRng to the include snippets.
|
|
||||||
|
|
||||||
Use the new include snippets for OVMF builds.
|
|
||||||
|
|
||||||
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
||||||
(cherry picked from commit 712797cf19acd292bf203522a79e40e7e13d268b)
|
|
||||||
---
|
|
||||||
OvmfPkg/AmdSev/AmdSevX64.dsc | 2 +-
|
|
||||||
OvmfPkg/AmdSev/AmdSevX64.fdf | 2 +-
|
|
||||||
OvmfPkg/Include/Dsc/OvmfRngComponents.dsc.inc | 9 +++++++++
|
|
||||||
OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc | 6 ++++++
|
|
||||||
OvmfPkg/IntelTdx/IntelTdxX64.dsc | 2 +-
|
|
||||||
OvmfPkg/IntelTdx/IntelTdxX64.fdf | 2 +-
|
|
||||||
OvmfPkg/Microvm/MicrovmX64.dsc | 2 +-
|
|
||||||
OvmfPkg/Microvm/MicrovmX64.fdf | 2 +-
|
|
||||||
OvmfPkg/OvmfPkgIa32.dsc | 2 +-
|
|
||||||
OvmfPkg/OvmfPkgIa32.fdf | 2 +-
|
|
||||||
OvmfPkg/OvmfPkgIa32X64.dsc | 2 +-
|
|
||||||
OvmfPkg/OvmfPkgIa32X64.fdf | 2 +-
|
|
||||||
OvmfPkg/OvmfPkgX64.dsc | 2 +-
|
|
||||||
OvmfPkg/OvmfPkgX64.fdf | 2 +-
|
|
||||||
14 files changed, 27 insertions(+), 12 deletions(-)
|
|
||||||
create mode 100644 OvmfPkg/Include/Dsc/OvmfRngComponents.dsc.inc
|
|
||||||
create mode 100644 OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc
|
|
||||||
|
|
||||||
diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
|
|
||||||
index cf1ad83e09..4edc2a9069 100644
|
|
||||||
--- a/OvmfPkg/AmdSev/AmdSevX64.dsc
|
|
||||||
+++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
|
|
||||||
@@ -649,7 +649,6 @@
|
|
||||||
OvmfPkg/Virtio10Dxe/Virtio10.inf
|
|
||||||
OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
|
|
||||||
OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
|
|
||||||
- OvmfPkg/VirtioRngDxe/VirtioRng.inf
|
|
||||||
!if $(PVSCSI_ENABLE) == TRUE
|
|
||||||
OvmfPkg/PvScsiDxe/PvScsiDxe.inf
|
|
||||||
!endif
|
|
||||||
@@ -740,6 +739,7 @@
|
|
||||||
OvmfPkg/AmdSev/Grub/Grub.inf
|
|
||||||
|
|
||||||
!include OvmfPkg/Include/Dsc/ShellComponents.dsc.inc
|
|
||||||
+!include OvmfPkg/Include/Dsc/OvmfRngComponents.dsc.inc
|
|
||||||
|
|
||||||
OvmfPkg/PlatformDxe/Platform.inf
|
|
||||||
OvmfPkg/AmdSevDxe/AmdSevDxe.inf {
|
|
||||||
diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
|
|
||||||
index c56c98dc85..480837b0fa 100644
|
|
||||||
--- a/OvmfPkg/AmdSev/AmdSevX64.fdf
|
|
||||||
+++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
|
|
||||||
@@ -227,7 +227,6 @@ INF OvmfPkg/VirtioPciDeviceDxe/VirtioPciDeviceDxe.inf
|
|
||||||
INF OvmfPkg/Virtio10Dxe/Virtio10.inf
|
|
||||||
INF OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
|
|
||||||
INF OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
|
|
||||||
-INF OvmfPkg/VirtioRngDxe/VirtioRng.inf
|
|
||||||
!if $(PVSCSI_ENABLE) == TRUE
|
|
||||||
INF OvmfPkg/PvScsiDxe/PvScsiDxe.inf
|
|
||||||
!endif
|
|
||||||
@@ -318,6 +317,7 @@ INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
|
|
||||||
!include OvmfPkg/Include/Fdf/OvmfTpmDxe.fdf.inc
|
|
||||||
|
|
||||||
!include OvmfPkg/Include/Fdf/ShellDxe.fdf.inc
|
|
||||||
+!include OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc
|
|
||||||
|
|
||||||
################################################################################
|
|
||||||
|
|
||||||
diff --git a/OvmfPkg/Include/Dsc/OvmfRngComponents.dsc.inc b/OvmfPkg/Include/Dsc/OvmfRngComponents.dsc.inc
|
|
||||||
new file mode 100644
|
|
||||||
index 0000000000..68839a0caa
|
|
||||||
--- /dev/null
|
|
||||||
+++ b/OvmfPkg/Include/Dsc/OvmfRngComponents.dsc.inc
|
|
||||||
@@ -0,0 +1,9 @@
|
|
||||||
+##
|
|
||||||
+# SPDX-License-Identifier: BSD-2-Clause-Patent
|
|
||||||
+##
|
|
||||||
+
|
|
||||||
+ SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf {
|
|
||||||
+ <LibraryClasses>
|
|
||||||
+ RngLib|MdePkg/Library/BaseRngLib/BaseRngLib.inf
|
|
||||||
+ }
|
|
||||||
+ OvmfPkg/VirtioRngDxe/VirtioRng.inf
|
|
||||||
diff --git a/OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc b/OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc
|
|
||||||
new file mode 100644
|
|
||||||
index 0000000000..99cb4a32b1
|
|
||||||
--- /dev/null
|
|
||||||
+++ b/OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc
|
|
||||||
@@ -0,0 +1,6 @@
|
|
||||||
+##
|
|
||||||
+# SPDX-License-Identifier: BSD-2-Clause-Patent
|
|
||||||
+##
|
|
||||||
+
|
|
||||||
+INF SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
|
|
||||||
+INF OvmfPkg/VirtioRngDxe/VirtioRng.inf
|
|
||||||
diff --git a/OvmfPkg/IntelTdx/IntelTdxX64.dsc b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
|
|
||||||
index 9f49b60ff0..4b7e1596fc 100644
|
|
||||||
--- a/OvmfPkg/IntelTdx/IntelTdxX64.dsc
|
|
||||||
+++ b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
|
|
||||||
@@ -636,7 +636,6 @@
|
|
||||||
OvmfPkg/Virtio10Dxe/Virtio10.inf
|
|
||||||
OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
|
|
||||||
OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
|
|
||||||
- OvmfPkg/VirtioRngDxe/VirtioRng.inf
|
|
||||||
!if $(PVSCSI_ENABLE) == TRUE
|
|
||||||
OvmfPkg/PvScsiDxe/PvScsiDxe.inf
|
|
||||||
!endif
|
|
||||||
@@ -719,6 +718,7 @@
|
|
||||||
MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
|
|
||||||
|
|
||||||
!include OvmfPkg/Include/Dsc/ShellComponents.dsc.inc
|
|
||||||
+!include OvmfPkg/Include/Dsc/OvmfRngComponents.dsc.inc
|
|
||||||
|
|
||||||
!if $(SECURE_BOOT_ENABLE) == TRUE
|
|
||||||
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
|
|
||||||
diff --git a/OvmfPkg/IntelTdx/IntelTdxX64.fdf b/OvmfPkg/IntelTdx/IntelTdxX64.fdf
|
|
||||||
index ce5d542048..88d0f75ae2 100644
|
|
||||||
--- a/OvmfPkg/IntelTdx/IntelTdxX64.fdf
|
|
||||||
+++ b/OvmfPkg/IntelTdx/IntelTdxX64.fdf
|
|
||||||
@@ -285,7 +285,6 @@ READ_LOCK_STATUS = TRUE
|
|
||||||
#
|
|
||||||
INF MdeModulePkg/Universal/EbcDxe/EbcDxe.inf
|
|
||||||
INF OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
|
|
||||||
-INF OvmfPkg/VirtioRngDxe/VirtioRng.inf
|
|
||||||
!if $(PVSCSI_ENABLE) == TRUE
|
|
||||||
INF OvmfPkg/PvScsiDxe/PvScsiDxe.inf
|
|
||||||
!endif
|
|
||||||
@@ -326,6 +325,7 @@ INF OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
|
|
||||||
INF OvmfPkg/PlatformDxe/Platform.inf
|
|
||||||
|
|
||||||
!include OvmfPkg/Include/Fdf/ShellDxe.fdf.inc
|
|
||||||
+!include OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc
|
|
||||||
|
|
||||||
################################################################################
|
|
||||||
|
|
||||||
diff --git a/OvmfPkg/Microvm/MicrovmX64.dsc b/OvmfPkg/Microvm/MicrovmX64.dsc
|
|
||||||
index fb73f2e089..9206f01816 100644
|
|
||||||
--- a/OvmfPkg/Microvm/MicrovmX64.dsc
|
|
||||||
+++ b/OvmfPkg/Microvm/MicrovmX64.dsc
|
|
||||||
@@ -760,7 +760,6 @@
|
|
||||||
OvmfPkg/Virtio10Dxe/Virtio10.inf
|
|
||||||
OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
|
|
||||||
OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
|
|
||||||
- OvmfPkg/VirtioRngDxe/VirtioRng.inf
|
|
||||||
OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
|
|
||||||
MdeModulePkg/Universal/WatchdogTimerDxe/WatchdogTimer.inf
|
|
||||||
MdeModulePkg/Universal/MonotonicCounterRuntimeDxe/MonotonicCounterRuntimeDxe.inf
|
|
||||||
@@ -846,6 +845,7 @@
|
|
||||||
MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
|
|
||||||
|
|
||||||
!include OvmfPkg/Include/Dsc/ShellComponents.dsc.inc
|
|
||||||
+!include OvmfPkg/Include/Dsc/OvmfRngComponents.dsc.inc
|
|
||||||
|
|
||||||
!if $(SECURE_BOOT_ENABLE) == TRUE
|
|
||||||
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
|
|
||||||
diff --git a/OvmfPkg/Microvm/MicrovmX64.fdf b/OvmfPkg/Microvm/MicrovmX64.fdf
|
|
||||||
index 055e659a35..c8268d7e8c 100644
|
|
||||||
--- a/OvmfPkg/Microvm/MicrovmX64.fdf
|
|
||||||
+++ b/OvmfPkg/Microvm/MicrovmX64.fdf
|
|
||||||
@@ -207,7 +207,6 @@ INF OvmfPkg/VirtioPciDeviceDxe/VirtioPciDeviceDxe.inf
|
|
||||||
INF OvmfPkg/Virtio10Dxe/Virtio10.inf
|
|
||||||
INF OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
|
|
||||||
INF OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
|
|
||||||
-INF OvmfPkg/VirtioRngDxe/VirtioRng.inf
|
|
||||||
INF OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
|
|
||||||
|
|
||||||
!if $(SECURE_BOOT_ENABLE) == TRUE
|
|
||||||
@@ -299,6 +298,7 @@ INF MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf
|
|
||||||
INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
|
|
||||||
|
|
||||||
!include OvmfPkg/Include/Fdf/ShellDxe.fdf.inc
|
|
||||||
+!include OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc
|
|
||||||
|
|
||||||
################################################################################
|
|
||||||
|
|
||||||
diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
|
|
||||||
index 65a866ae0c..b64c215585 100644
|
|
||||||
--- a/OvmfPkg/OvmfPkgIa32.dsc
|
|
||||||
+++ b/OvmfPkg/OvmfPkgIa32.dsc
|
|
||||||
@@ -784,7 +784,6 @@
|
|
||||||
OvmfPkg/Virtio10Dxe/Virtio10.inf
|
|
||||||
OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
|
|
||||||
OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
|
|
||||||
- OvmfPkg/VirtioRngDxe/VirtioRng.inf
|
|
||||||
OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
|
|
||||||
!if $(PVSCSI_ENABLE) == TRUE
|
|
||||||
OvmfPkg/PvScsiDxe/PvScsiDxe.inf
|
|
||||||
@@ -888,6 +887,7 @@
|
|
||||||
|
|
||||||
!include OvmfPkg/Include/Dsc/ShellComponents.dsc.inc
|
|
||||||
!include OvmfPkg/Include/Dsc/MorLock.dsc.inc
|
|
||||||
+!include OvmfPkg/Include/Dsc/OvmfRngComponents.dsc.inc
|
|
||||||
|
|
||||||
!if $(SECURE_BOOT_ENABLE) == TRUE
|
|
||||||
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
|
|
||||||
diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
|
|
||||||
index 10eb6fe72b..c31276e4a3 100644
|
|
||||||
--- a/OvmfPkg/OvmfPkgIa32.fdf
|
|
||||||
+++ b/OvmfPkg/OvmfPkgIa32.fdf
|
|
||||||
@@ -231,7 +231,6 @@ INF OvmfPkg/VirtioPciDeviceDxe/VirtioPciDeviceDxe.inf
|
|
||||||
INF OvmfPkg/Virtio10Dxe/Virtio10.inf
|
|
||||||
INF OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
|
|
||||||
INF OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
|
|
||||||
-INF OvmfPkg/VirtioRngDxe/VirtioRng.inf
|
|
||||||
INF OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
|
|
||||||
!if $(PVSCSI_ENABLE) == TRUE
|
|
||||||
INF OvmfPkg/PvScsiDxe/PvScsiDxe.inf
|
|
||||||
@@ -356,6 +355,7 @@ INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
|
|
||||||
|
|
||||||
!include OvmfPkg/Include/Fdf/ShellDxe.fdf.inc
|
|
||||||
!include OvmfPkg/Include/Fdf/MorLock.fdf.inc
|
|
||||||
+!include OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc
|
|
||||||
|
|
||||||
!if $(LOAD_X64_ON_IA32_ENABLE) == TRUE
|
|
||||||
INF OvmfPkg/CompatImageLoaderDxe/CompatImageLoaderDxe.inf
|
|
||||||
diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
|
|
||||||
index 679e25501b..ececac3757 100644
|
|
||||||
--- a/OvmfPkg/OvmfPkgIa32X64.dsc
|
|
||||||
+++ b/OvmfPkg/OvmfPkgIa32X64.dsc
|
|
||||||
@@ -798,7 +798,6 @@
|
|
||||||
OvmfPkg/Virtio10Dxe/Virtio10.inf
|
|
||||||
OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
|
|
||||||
OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
|
|
||||||
- OvmfPkg/VirtioRngDxe/VirtioRng.inf
|
|
||||||
OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
|
|
||||||
!if $(PVSCSI_ENABLE) == TRUE
|
|
||||||
OvmfPkg/PvScsiDxe/PvScsiDxe.inf
|
|
||||||
@@ -902,6 +901,7 @@
|
|
||||||
|
|
||||||
!include OvmfPkg/Include/Dsc/ShellComponents.dsc.inc
|
|
||||||
!include OvmfPkg/Include/Dsc/MorLock.dsc.inc
|
|
||||||
+!include OvmfPkg/Include/Dsc/OvmfRngComponents.dsc.inc
|
|
||||||
|
|
||||||
!if $(SECURE_BOOT_ENABLE) == TRUE
|
|
||||||
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
|
|
||||||
diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
|
|
||||||
index ff06bbfc6f..a7b4aeac08 100644
|
|
||||||
--- a/OvmfPkg/OvmfPkgIa32X64.fdf
|
|
||||||
+++ b/OvmfPkg/OvmfPkgIa32X64.fdf
|
|
||||||
@@ -232,7 +232,6 @@ INF OvmfPkg/VirtioPciDeviceDxe/VirtioPciDeviceDxe.inf
|
|
||||||
INF OvmfPkg/Virtio10Dxe/Virtio10.inf
|
|
||||||
INF OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
|
|
||||||
INF OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
|
|
||||||
-INF OvmfPkg/VirtioRngDxe/VirtioRng.inf
|
|
||||||
INF OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
|
|
||||||
!if $(PVSCSI_ENABLE) == TRUE
|
|
||||||
INF OvmfPkg/PvScsiDxe/PvScsiDxe.inf
|
|
||||||
@@ -363,6 +362,7 @@ INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
|
|
||||||
|
|
||||||
!include OvmfPkg/Include/Fdf/ShellDxe.fdf.inc
|
|
||||||
!include OvmfPkg/Include/Fdf/MorLock.fdf.inc
|
|
||||||
+!include OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc
|
|
||||||
|
|
||||||
################################################################################
|
|
||||||
|
|
||||||
diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
|
|
||||||
index d294fd4625..0ab4d3df06 100644
|
|
||||||
--- a/OvmfPkg/OvmfPkgX64.dsc
|
|
||||||
+++ b/OvmfPkg/OvmfPkgX64.dsc
|
|
||||||
@@ -866,7 +866,6 @@
|
|
||||||
OvmfPkg/Virtio10Dxe/Virtio10.inf
|
|
||||||
OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
|
|
||||||
OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
|
|
||||||
- OvmfPkg/VirtioRngDxe/VirtioRng.inf
|
|
||||||
OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
|
|
||||||
!if $(PVSCSI_ENABLE) == TRUE
|
|
||||||
OvmfPkg/PvScsiDxe/PvScsiDxe.inf
|
|
||||||
@@ -970,6 +969,7 @@
|
|
||||||
|
|
||||||
!include OvmfPkg/Include/Dsc/ShellComponents.dsc.inc
|
|
||||||
!include OvmfPkg/Include/Dsc/MorLock.dsc.inc
|
|
||||||
+!include OvmfPkg/Include/Dsc/OvmfRngComponents.dsc.inc
|
|
||||||
|
|
||||||
!if $(SECURE_BOOT_ENABLE) == TRUE
|
|
||||||
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
|
|
||||||
diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
|
|
||||||
index f3b787201f..ae08ac4fe9 100644
|
|
||||||
--- a/OvmfPkg/OvmfPkgX64.fdf
|
|
||||||
+++ b/OvmfPkg/OvmfPkgX64.fdf
|
|
||||||
@@ -263,7 +263,6 @@ INF OvmfPkg/VirtioPciDeviceDxe/VirtioPciDeviceDxe.inf
|
|
||||||
INF OvmfPkg/Virtio10Dxe/Virtio10.inf
|
|
||||||
INF OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
|
|
||||||
INF OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
|
|
||||||
-INF OvmfPkg/VirtioRngDxe/VirtioRng.inf
|
|
||||||
INF OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
|
|
||||||
!if $(PVSCSI_ENABLE) == TRUE
|
|
||||||
INF OvmfPkg/PvScsiDxe/PvScsiDxe.inf
|
|
||||||
@@ -403,6 +402,7 @@ INF OvmfPkg/Tcg/TdTcg2Dxe/TdTcg2Dxe.inf
|
|
||||||
|
|
||||||
!include OvmfPkg/Include/Fdf/ShellDxe.fdf.inc
|
|
||||||
!include OvmfPkg/Include/Fdf/MorLock.fdf.inc
|
|
||||||
+!include OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc
|
|
||||||
|
|
||||||
################################################################################
|
|
||||||
|
|
||||||
@ -1,37 +0,0 @@
|
|||||||
From d5d19043e62a268a492f9a1ef6a11380d8f7e784 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Gerd Hoffmann <kraxel@redhat.com>
|
|
||||||
Date: Fri, 14 Jun 2024 11:45:49 +0200
|
|
||||||
Subject: [PATCH] CryptoPkg/Test: call ProcessLibraryConstructorList
|
|
||||||
|
|
||||||
Needed to properly initialize BaseRngLib.
|
|
||||||
|
|
||||||
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
||||||
(cherry picked from commit 94961b8817eec6f8d0434555ac50a7aa51c22201)
|
|
||||||
---
|
|
||||||
.../Test/UnitTest/Library/BaseCryptLib/UnitTestMain.c | 7 +++++++
|
|
||||||
1 file changed, 7 insertions(+)
|
|
||||||
|
|
||||||
diff --git a/CryptoPkg/Test/UnitTest/Library/BaseCryptLib/UnitTestMain.c b/CryptoPkg/Test/UnitTest/Library/BaseCryptLib/UnitTestMain.c
|
|
||||||
index d0c1c7a4f7..48d463b8ad 100644
|
|
||||||
--- a/CryptoPkg/Test/UnitTest/Library/BaseCryptLib/UnitTestMain.c
|
|
||||||
+++ b/CryptoPkg/Test/UnitTest/Library/BaseCryptLib/UnitTestMain.c
|
|
||||||
@@ -8,6 +8,12 @@
|
|
||||||
**/
|
|
||||||
#include "TestBaseCryptLib.h"
|
|
||||||
|
|
||||||
+VOID
|
|
||||||
+EFIAPI
|
|
||||||
+ProcessLibraryConstructorList (
|
|
||||||
+ VOID
|
|
||||||
+ );
|
|
||||||
+
|
|
||||||
/**
|
|
||||||
Initialize the unit test framework, suite, and unit tests for the
|
|
||||||
sample unit tests and run the unit tests.
|
|
||||||
@@ -76,5 +82,6 @@ main (
|
|
||||||
char *argv[]
|
|
||||||
)
|
|
||||||
{
|
|
||||||
+ ProcessLibraryConstructorList ();
|
|
||||||
return UefiTestMain ();
|
|
||||||
}
|
|
||||||
@ -1,43 +0,0 @@
|
|||||||
From 320207a3df995771af36639c7bdf89c4203cf1c2 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Gerd Hoffmann <kraxel@redhat.com>
|
|
||||||
Date: Fri, 14 Jun 2024 11:45:53 +0200
|
|
||||||
Subject: [PATCH] MdePkg/X86UnitTestHost: set rdrand cpuid bit
|
|
||||||
|
|
||||||
Set the rdrand feature bit when faking cpuid for host test cases.
|
|
||||||
Needed to make the CryptoPkg test cases work.
|
|
||||||
|
|
||||||
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
||||||
(cherry picked from commit 5e776299a2604b336a947e68593012ab2cc16eb4)
|
|
||||||
---
|
|
||||||
MdePkg/Library/BaseLib/X86UnitTestHost.c | 11 ++++++++++-
|
|
||||||
1 file changed, 10 insertions(+), 1 deletion(-)
|
|
||||||
|
|
||||||
diff --git a/MdePkg/Library/BaseLib/X86UnitTestHost.c b/MdePkg/Library/BaseLib/X86UnitTestHost.c
|
|
||||||
index 8ba4f54a38..7f7276f7f4 100644
|
|
||||||
--- a/MdePkg/Library/BaseLib/X86UnitTestHost.c
|
|
||||||
+++ b/MdePkg/Library/BaseLib/X86UnitTestHost.c
|
|
||||||
@@ -66,6 +66,15 @@ UnitTestHostBaseLibAsmCpuid (
|
|
||||||
OUT UINT32 *Edx OPTIONAL
|
|
||||||
)
|
|
||||||
{
|
|
||||||
+ UINT32 RetEcx;
|
|
||||||
+
|
|
||||||
+ RetEcx = 0;
|
|
||||||
+ switch (Index) {
|
|
||||||
+ case 1:
|
|
||||||
+ RetEcx |= BIT30; /* RdRand */
|
|
||||||
+ break;
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
if (Eax != NULL) {
|
|
||||||
*Eax = 0;
|
|
||||||
}
|
|
||||||
@@ -75,7 +84,7 @@ UnitTestHostBaseLibAsmCpuid (
|
|
||||||
}
|
|
||||||
|
|
||||||
if (Ecx != NULL) {
|
|
||||||
- *Ecx = 0;
|
|
||||||
+ *Ecx = RetEcx;
|
|
||||||
}
|
|
||||||
|
|
||||||
if (Edx != NULL) {
|
|
||||||
@ -1,63 +0,0 @@
|
|||||||
From 481310a21104aba17bc0cddd236ecdf69d4ba662 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Oliver Steffen <osteffen@redhat.com>
|
|
||||||
Date: Mon, 26 Aug 2024 19:25:52 +0200
|
|
||||||
Subject: [PATCH] AmdSevDxe: Fix the shim fallback reboot workaround for SNP
|
|
||||||
|
|
||||||
RH-Author: Oliver Steffen <osteffen@redhat.com>
|
|
||||||
RH-MergeRequest: 68: AmdSevDxe: Fix the shim fallback reboot workaround for SNP
|
|
||||||
RH-Jira: RHEL-56081
|
|
||||||
RH-Acked-by: Gerd Hoffmann <None>
|
|
||||||
RH-Commit: [1/1] ab8678b61d171f9c19459e034483437b29037b4b (osteffen/edk2)
|
|
||||||
|
|
||||||
The shim fallback reboot workaround (introduced for SEV-ES) does
|
|
||||||
not always work for SEV-SNP, due to a conditional early return.
|
|
||||||
|
|
||||||
Let's just register the workaround earlier in this function to
|
|
||||||
fix that.
|
|
||||||
|
|
||||||
Signed-off-by: Oliver Steffen <osteffen@redhat.com>
|
|
||||||
---
|
|
||||||
OvmfPkg/AmdSevDxe/AmdSevDxe.c | 21 +++++++++++----------
|
|
||||||
1 file changed, 11 insertions(+), 10 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/OvmfPkg/AmdSevDxe/AmdSevDxe.c b/OvmfPkg/AmdSevDxe/AmdSevDxe.c
|
|
||||||
index 0eb88e50ff..ca345e95da 100644
|
|
||||||
--- a/OvmfPkg/AmdSevDxe/AmdSevDxe.c
|
|
||||||
+++ b/OvmfPkg/AmdSevDxe/AmdSevDxe.c
|
|
||||||
@@ -243,6 +243,17 @@ AmdSevDxeEntryPoint (
|
|
||||||
return EFI_UNSUPPORTED;
|
|
||||||
}
|
|
||||||
|
|
||||||
+ // Shim fallback reboot workaround
|
|
||||||
+ Status = gBS->CreateEventEx (
|
|
||||||
+ EVT_NOTIFY_SIGNAL,
|
|
||||||
+ TPL_CALLBACK,
|
|
||||||
+ PopulateVarstore,
|
|
||||||
+ SystemTable,
|
|
||||||
+ &gEfiEndOfDxeEventGroupGuid,
|
|
||||||
+ &PopulateVarstoreEvent
|
|
||||||
+ );
|
|
||||||
+ ASSERT_EFI_ERROR (Status);
|
|
||||||
+
|
|
||||||
//
|
|
||||||
// Iterate through the GCD map and clear the C-bit from MMIO and NonExistent
|
|
||||||
// memory space. The NonExistent memory space will be used for mapping the
|
|
||||||
@@ -393,15 +404,5 @@ AmdSevDxeEntryPoint (
|
|
||||||
);
|
|
||||||
}
|
|
||||||
|
|
||||||
- Status = gBS->CreateEventEx (
|
|
||||||
- EVT_NOTIFY_SIGNAL,
|
|
||||||
- TPL_CALLBACK,
|
|
||||||
- PopulateVarstore,
|
|
||||||
- SystemTable,
|
|
||||||
- &gEfiEndOfDxeEventGroupGuid,
|
|
||||||
- &PopulateVarstoreEvent
|
|
||||||
- );
|
|
||||||
- ASSERT_EFI_ERROR (Status);
|
|
||||||
-
|
|
||||||
return EFI_SUCCESS;
|
|
||||||
}
|
|
||||||
--
|
|
||||||
2.39.3
|
|
||||||
|
|
||||||
@ -1,43 +0,0 @@
|
|||||||
From 880c1ca7420b873c5f81563b122d7bd1ebad72cb Mon Sep 17 00:00:00 2001
|
|
||||||
From: Oliver Steffen <osteffen@redhat.com>
|
|
||||||
Date: Mon, 4 Mar 2024 15:32:58 +0100
|
|
||||||
Subject: [PATCH] MdeModulePkg: Warn if out of flash space when writing
|
|
||||||
variables
|
|
||||||
|
|
||||||
RH-Author: Oliver Steffen <osteffen@redhat.com>
|
|
||||||
RH-MergeRequest: 64: MdeModulePkg: Warn if out of flash space when writing variables
|
|
||||||
RH-Jira: RHEL-43442
|
|
||||||
RH-Acked-by: Gerd Hoffmann <None>
|
|
||||||
RH-Commit: [1/1] b65130800090192f47f13d67ff14f902a4f5bfb5 (osteffen/edk2)
|
|
||||||
|
|
||||||
Emit a DEBUG_WARN message if there is not enough flash space left to
|
|
||||||
write/update a variable. This condition is currently not logged
|
|
||||||
appropriately in all cases, given that full variable store can easily
|
|
||||||
render the system unbootable.
|
|
||||||
This new message helps identifying this condition.
|
|
||||||
|
|
||||||
Signed-off-by: Oliver Steffen <osteffen@redhat.com>
|
|
||||||
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
|
|
||||||
Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
||||||
(cherry picked from commit 80b59ff8320d1bd134bf689fe9c0ddf4e0473b88)
|
|
||||||
Signed-off-by: Oliver Steffen <osteffen@redhat.com>
|
|
||||||
---
|
|
||||||
MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c | 2 ++
|
|
||||||
1 file changed, 2 insertions(+)
|
|
||||||
|
|
||||||
diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c b/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c
|
|
||||||
index d394d237a5..1c7659031d 100644
|
|
||||||
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c
|
|
||||||
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c
|
|
||||||
@@ -2364,6 +2364,8 @@ Done:
|
|
||||||
);
|
|
||||||
ASSERT_EFI_ERROR (Status);
|
|
||||||
}
|
|
||||||
+ } else if (Status == EFI_OUT_OF_RESOURCES) {
|
|
||||||
+ DEBUG ((DEBUG_WARN, "UpdateVariable failed: Out of flash space\n"));
|
|
||||||
}
|
|
||||||
|
|
||||||
return Status;
|
|
||||||
--
|
|
||||||
2.39.3
|
|
||||||
|
|
||||||
@ -1,50 +0,0 @@
|
|||||||
From 10d25d4d502e419476c3846e0243bbf6be24d8e4 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Jon Maloy <jmaloy@redhat.com>
|
|
||||||
Date: Tue, 1 Oct 2024 18:40:41 -0400
|
|
||||||
Subject: [PATCH] MdePkg: Fix overflow issue in BasePeCoffLib
|
|
||||||
|
|
||||||
RH-Author: Jon Maloy <jmaloy@redhat.com>
|
|
||||||
RH-MergeRequest: 95: MdePkg: Fix overflow issue in BasePeCoffLib
|
|
||||||
RH-Jira: RHEL-60831
|
|
||||||
RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
|
|
||||||
RH-Commit: [1/1] 2f345a9e5f277598a78edc1aab33c6acc96c6caa
|
|
||||||
|
|
||||||
JIRA: https://issues.redhat.com/browse/RHEL-60831
|
|
||||||
CVE: CVE-2024-38796
|
|
||||||
Upstream: Merged
|
|
||||||
|
|
||||||
commit c95233b8525ca6828921affd1496146cff262e65
|
|
||||||
Author: Doug Flick <dougflick@microsoft.com>
|
|
||||||
Date: Fri Sep 27 12:08:55 2024 -0700
|
|
||||||
|
|
||||||
MdePkg: Fix overflow issue in BasePeCoffLib
|
|
||||||
|
|
||||||
The RelocDir->Size is a UINT32 value, and RelocDir->VirtualAddress is
|
|
||||||
also a UINT32 value. The current code does not check for overflow when
|
|
||||||
adding RelocDir->Size to RelocDir->VirtualAddress. This patch adds a
|
|
||||||
check to ensure that the addition does not overflow.
|
|
||||||
|
|
||||||
Signed-off-by: Doug Flick <dougflick@microsoft.com>
|
|
||||||
Authored-by: sriraamx gobichettipalayam <sri..@intel.com>
|
|
||||||
|
|
||||||
Signed-off-by: Jon Maloy <jmaloy@redhat.com>
|
|
||||||
---
|
|
||||||
MdePkg/Library/BasePeCoffLib/BasePeCoff.c | 2 +-
|
|
||||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
||||||
|
|
||||||
diff --git a/MdePkg/Library/BasePeCoffLib/BasePeCoff.c b/MdePkg/Library/BasePeCoffLib/BasePeCoff.c
|
|
||||||
index 86ff2e769b..128090d98e 100644
|
|
||||||
--- a/MdePkg/Library/BasePeCoffLib/BasePeCoff.c
|
|
||||||
+++ b/MdePkg/Library/BasePeCoffLib/BasePeCoff.c
|
|
||||||
@@ -1054,7 +1054,7 @@ PeCoffLoaderRelocateImage (
|
|
||||||
RelocDir = &Hdr.Te->DataDirectory[0];
|
|
||||||
}
|
|
||||||
|
|
||||||
- if ((RelocDir != NULL) && (RelocDir->Size > 0)) {
|
|
||||||
+ if ((RelocDir != NULL) && (RelocDir->Size > 0) && (RelocDir->Size - 1 < MAX_UINT32 - RelocDir->VirtualAddress)) {
|
|
||||||
RelocBase = (EFI_IMAGE_BASE_RELOCATION *)PeCoffLoaderImageAddress (ImageContext, RelocDir->VirtualAddress, TeStrippedOffset);
|
|
||||||
RelocBaseEnd = (EFI_IMAGE_BASE_RELOCATION *)PeCoffLoaderImageAddress (
|
|
||||||
ImageContext,
|
|
||||||
--
|
|
||||||
2.39.3
|
|
||||||
|
|
||||||
@ -1,48 +0,0 @@
|
|||||||
From 7cbd00792445ad50e861e4835cdb5ba60466aae3 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Gerd Hoffmann <kraxel@redhat.com>
|
|
||||||
Date: Wed, 19 Jun 2024 09:07:56 +0200
|
|
||||||
Subject: [PATCH 1/2] NetworkPkg/DxeNetLib: adjust PseudoRandom error logging
|
|
||||||
|
|
||||||
RH-Author: Oliver Steffen <osteffen@redhat.com>
|
|
||||||
RH-MergeRequest: 67: NetworkPkg/DxeNetLib: adjust PseudoRandom error logging
|
|
||||||
RH-Jira: RHEL-45899
|
|
||||||
RH-Commit: [1/2] 15135d672cef4310cb29f8a55146f36b2ee1f15d (osteffen/edk2)
|
|
||||||
|
|
||||||
There is a list of allowed rng algorithms, if /one/ of them is not
|
|
||||||
supported this is not a problem, only /all/ of them failing is an
|
|
||||||
error condition.
|
|
||||||
|
|
||||||
Downgrade the message for a single unsupported algorithm from ERROR to
|
|
||||||
VERBOSE. Add an error message in case we finish the loop without
|
|
||||||
finding a supported algorithm.
|
|
||||||
|
|
||||||
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
||||||
(cherry picked from commit 6862b9d538d96363635677198899e1669e591259)
|
|
||||||
---
|
|
||||||
NetworkPkg/Library/DxeNetLib/DxeNetLib.c | 3 ++-
|
|
||||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
|
||||||
|
|
||||||
diff --git a/NetworkPkg/Library/DxeNetLib/DxeNetLib.c b/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
|
|
||||||
index 01c13c08d2..4dfbe91a55 100644
|
|
||||||
--- a/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
|
|
||||||
+++ b/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
|
|
||||||
@@ -951,7 +951,7 @@ PseudoRandom (
|
|
||||||
//
|
|
||||||
// Secure Algorithm was not supported on this platform
|
|
||||||
//
|
|
||||||
- DEBUG ((DEBUG_ERROR, "Failed to generate random data using secure algorithm %d: %r\n", AlgorithmIndex, Status));
|
|
||||||
+ DEBUG ((DEBUG_VERBOSE, "Failed to generate random data using secure algorithm %d: %r\n", AlgorithmIndex, Status));
|
|
||||||
|
|
||||||
//
|
|
||||||
// Try the next secure algorithm
|
|
||||||
@@ -971,6 +971,7 @@ PseudoRandom (
|
|
||||||
// If we get here, we failed to generate random data using any secure algorithm
|
|
||||||
// Platform owner should ensure that at least one secure algorithm is supported
|
|
||||||
//
|
|
||||||
+ DEBUG ((DEBUG_ERROR, "Failed to generate random data, no supported secure algorithm found\n"));
|
|
||||||
ASSERT_EFI_ERROR (Status);
|
|
||||||
return Status;
|
|
||||||
}
|
|
||||||
--
|
|
||||||
2.39.3
|
|
||||||
|
|
||||||
@ -1,46 +0,0 @@
|
|||||||
From 33ebaa6f0d476008ca6ba264657ac37faf63b723 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Gerd Hoffmann <kraxel@redhat.com>
|
|
||||||
Date: Thu, 29 Aug 2024 09:20:29 +0200
|
|
||||||
Subject: [PATCH 1/2] OvmfPkg/CpuHotplugSmm: delay SMM exit
|
|
||||||
|
|
||||||
RH-Author: Gerd Hoffmann <None>
|
|
||||||
RH-MergeRequest: 74: OvmfPkg/CpuHotplugSmm: delay SMM exit
|
|
||||||
RH-Jira: RHEL-56974
|
|
||||||
RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
|
|
||||||
RH-Commit: [1/1] e1fb3f4db68457ec9f59ca5db47606bf4c34e6c5 (kraxel.rh/centos-src-edk2)
|
|
||||||
|
|
||||||
Let APs wait until the BSP has completed the register updates to remove
|
|
||||||
the CPU. This makes sure all APs stay in SMM mode until the CPU
|
|
||||||
hot-unplug operation is complete, which in turn makes sure the ACPI lock
|
|
||||||
is released only after the CPU hot-unplug operation is complete.
|
|
||||||
|
|
||||||
Some background: The CPU hotplug SMI is triggered from an ACPI function
|
|
||||||
which is protected by an ACPI lock. The ACPI function is in the ACPI
|
|
||||||
tables generated by qemu.
|
|
||||||
|
|
||||||
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
||||||
|
|
||||||
upstream: submitted (https://github.com/tianocore/edk2/pull/6138)
|
|
||||||
---
|
|
||||||
OvmfPkg/CpuHotplugSmm/CpuHotplug.c | 5 +++++
|
|
||||||
1 file changed, 5 insertions(+)
|
|
||||||
|
|
||||||
diff --git a/OvmfPkg/CpuHotplugSmm/CpuHotplug.c b/OvmfPkg/CpuHotplugSmm/CpuHotplug.c
|
|
||||||
index d504163026..5af78211d3 100644
|
|
||||||
--- a/OvmfPkg/CpuHotplugSmm/CpuHotplug.c
|
|
||||||
+++ b/OvmfPkg/CpuHotplugSmm/CpuHotplug.c
|
|
||||||
@@ -355,6 +355,11 @@ EjectCpu (
|
|
||||||
//
|
|
||||||
QemuSelector = mCpuHotEjectData->QemuSelectorMap[ProcessorNum];
|
|
||||||
if (QemuSelector == CPU_EJECT_QEMU_SELECTOR_INVALID) {
|
|
||||||
+ /* wait until BSP is done */
|
|
||||||
+ while (mCpuHotEjectData->Handler != NULL) {
|
|
||||||
+ CpuPause ();
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
--
|
|
||||||
2.39.3
|
|
||||||
|
|
||||||
@ -1,142 +0,0 @@
|
|||||||
From c4aa4797fafa3a627205eaa346401e399d4a7146 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Gerd Hoffmann <kraxel@redhat.com>
|
|
||||||
Date: Tue, 27 Aug 2024 12:06:15 +0200
|
|
||||||
Subject: [PATCH] UefiCpuPkg/PiSmmCpuDxeSmm: skip PatchInstructionX86 calls if
|
|
||||||
not needed.
|
|
||||||
|
|
||||||
RH-Author: Oliver Steffen <osteffen@redhat.com>
|
|
||||||
RH-MergeRequest: 71: UefiCpuPkg/PiSmmCpuDxeSmm: skip PatchInstructionX86 calls if not needed.
|
|
||||||
RH-Jira: RHEL-45847
|
|
||||||
RH-Acked-by: Gerd Hoffmann <None>
|
|
||||||
RH-Commit: [1/1] 70ceffb2c1e695276af87d3aa334fe9be8e2e90e (osteffen/edk2)
|
|
||||||
|
|
||||||
Add the new global mMsrIa32MiscEnableSupported variable to track
|
|
||||||
whenever support for the IA32_MISC_ENABLE MSR is present or not.
|
|
||||||
|
|
||||||
Add new local PatchingNeeded variable to CheckFeatureSupported()
|
|
||||||
to track if patching the SMM setup code is needed or not.
|
|
||||||
|
|
||||||
Issue PatchInstructionX86() calls only if needed, i.e. if one of
|
|
||||||
the *Supported variables has been updated.
|
|
||||||
|
|
||||||
Result is that on a typical SMP machine where all processors are
|
|
||||||
identical the PatchInstructionX86() calls are issued only once,
|
|
||||||
when checking the first processor. Specifically this avoids
|
|
||||||
PatchInstructionX86() being called in OVMF on CPU hotplug. That
|
|
||||||
is important because instruction patching at runtime does not not
|
|
||||||
work and leads to page faults.
|
|
||||||
|
|
||||||
This fixes CPU hotplug on OVMF not working with AMD cpus.
|
|
||||||
|
|
||||||
Fixes: 6b3a89a9fdb5 ("OvmfPkg/PlatformPei: Relocate SmBases in PEI phase")
|
|
||||||
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
|
||||||
(cherry picked from commit 17ff8960848b2cb2e49fffb3dfbacd08865786a4)
|
|
||||||
---
|
|
||||||
UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.c | 49 +++++++++++++++++++++-----
|
|
||||||
1 file changed, 40 insertions(+), 9 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.c b/UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.c
|
|
||||||
index 8142d3ceac..8e299fd29a 100644
|
|
||||||
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.c
|
|
||||||
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.c
|
|
||||||
@@ -40,6 +40,11 @@ BOOLEAN mXdEnabled = FALSE;
|
|
||||||
//
|
|
||||||
BOOLEAN mBtsSupported = TRUE;
|
|
||||||
|
|
||||||
+//
|
|
||||||
+// The flag indicates if MSR_IA32_MISC_ENABLE is supported by processor
|
|
||||||
+//
|
|
||||||
+BOOLEAN mMsrIa32MiscEnableSupported = TRUE;
|
|
||||||
+
|
|
||||||
//
|
|
||||||
// The flag indicates if SMM profile starts to record data.
|
|
||||||
//
|
|
||||||
@@ -904,18 +909,23 @@ CheckFeatureSupported (
|
|
||||||
UINT32 RegEcx;
|
|
||||||
UINT32 RegEdx;
|
|
||||||
MSR_IA32_MISC_ENABLE_REGISTER MiscEnableMsr;
|
|
||||||
+ BOOLEAN PatchingNeeded = FALSE;
|
|
||||||
|
|
||||||
if ((PcdGet32 (PcdControlFlowEnforcementPropertyMask) != 0) && mCetSupported) {
|
|
||||||
AsmCpuid (CPUID_SIGNATURE, &RegEax, NULL, NULL, NULL);
|
|
||||||
if (RegEax >= CPUID_STRUCTURED_EXTENDED_FEATURE_FLAGS) {
|
|
||||||
AsmCpuidEx (CPUID_STRUCTURED_EXTENDED_FEATURE_FLAGS, CPUID_STRUCTURED_EXTENDED_FEATURE_FLAGS_SUB_LEAF_INFO, NULL, NULL, &RegEcx, NULL);
|
|
||||||
if ((RegEcx & CPUID_CET_SS) == 0) {
|
|
||||||
- mCetSupported = FALSE;
|
|
||||||
- PatchInstructionX86 (mPatchCetSupported, mCetSupported, 1);
|
|
||||||
+ if (mCetSupported) {
|
|
||||||
+ mCetSupported = FALSE;
|
|
||||||
+ PatchingNeeded = TRUE;
|
|
||||||
+ }
|
|
||||||
}
|
|
||||||
} else {
|
|
||||||
- mCetSupported = FALSE;
|
|
||||||
- PatchInstructionX86 (mPatchCetSupported, mCetSupported, 1);
|
|
||||||
+ if (mCetSupported) {
|
|
||||||
+ mCetSupported = FALSE;
|
|
||||||
+ PatchingNeeded = TRUE;
|
|
||||||
+ }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
@@ -925,8 +935,10 @@ CheckFeatureSupported (
|
|
||||||
//
|
|
||||||
// Extended CPUID functions are not supported on this processor.
|
|
||||||
//
|
|
||||||
- mXdSupported = FALSE;
|
|
||||||
- PatchInstructionX86 (gPatchXdSupported, mXdSupported, 1);
|
|
||||||
+ if (mXdSupported) {
|
|
||||||
+ mXdSupported = FALSE;
|
|
||||||
+ PatchingNeeded = TRUE;
|
|
||||||
+ }
|
|
||||||
}
|
|
||||||
|
|
||||||
AsmCpuid (CPUID_EXTENDED_CPU_SIG, NULL, NULL, NULL, &RegEdx);
|
|
||||||
@@ -934,15 +946,20 @@ CheckFeatureSupported (
|
|
||||||
//
|
|
||||||
// Execute Disable Bit feature is not supported on this processor.
|
|
||||||
//
|
|
||||||
- mXdSupported = FALSE;
|
|
||||||
- PatchInstructionX86 (gPatchXdSupported, mXdSupported, 1);
|
|
||||||
+ if (mXdSupported) {
|
|
||||||
+ mXdSupported = FALSE;
|
|
||||||
+ PatchingNeeded = TRUE;
|
|
||||||
+ }
|
|
||||||
}
|
|
||||||
|
|
||||||
if (StandardSignatureIsAuthenticAMD ()) {
|
|
||||||
//
|
|
||||||
// AMD processors do not support MSR_IA32_MISC_ENABLE
|
|
||||||
//
|
|
||||||
- PatchInstructionX86 (gPatchMsrIa32MiscEnableSupported, FALSE, 1);
|
|
||||||
+ if (mMsrIa32MiscEnableSupported) {
|
|
||||||
+ mMsrIa32MiscEnableSupported = FALSE;
|
|
||||||
+ PatchingNeeded = TRUE;
|
|
||||||
+ }
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
@@ -966,6 +983,20 @@ CheckFeatureSupported (
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
+
|
|
||||||
+ if (PatchingNeeded) {
|
|
||||||
+ if (!mCetSupported) {
|
|
||||||
+ PatchInstructionX86 (mPatchCetSupported, mCetSupported, 1);
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ if (!mXdSupported) {
|
|
||||||
+ PatchInstructionX86 (gPatchXdSupported, mXdSupported, 1);
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ if (!mMsrIa32MiscEnableSupported) {
|
|
||||||
+ PatchInstructionX86 (gPatchMsrIa32MiscEnableSupported, FALSE, 1);
|
|
||||||
+ }
|
|
||||||
+ }
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
--
|
|
||||||
2.39.3
|
|
||||||
|
|
||||||
File diff suppressed because it is too large
Load Diff
Loading…
Reference in new issue