Compare commits
No commits in common. 'cs10' and 'c9' have entirely different histories.
@ -1,4 +1,3 @@
|
||||
de143fc38b339d982079517b6f01bcec5246cf5e SOURCES/DBXUpdate-20230509.x64.bin
|
||||
19a95204dd787b4809886db15655082cb28718e9 SOURCES/dtc-1.7.0.tar.xz
|
||||
a0cdc45f583976eda09dd85740264e57333b3df2 SOURCES/edk2-0f3867fa6ef0.tar.xz
|
||||
6da44cf37c27ab03f2940769c58515b07271e047 SOURCES/edk2-3e722403cd.tar.xz
|
||||
0a9cfae889c6436333fab963250b069058eec6cf SOURCES/openssl-rhel-0205b589887203b065154ddc8e8107c4ac8625a1.tar.xz
|
||||
|
||||
@ -1,4 +1,3 @@
|
||||
SOURCES/DBXUpdate-20230509.x64.bin
|
||||
SOURCES/dtc-1.7.0.tar.xz
|
||||
SOURCES/edk2-0f3867fa6ef0.tar.xz
|
||||
SOURCES/edk2-3e722403cd.tar.xz
|
||||
SOURCES/openssl-rhel-0205b589887203b065154ddc8e8107c4ac8625a1.tar.xz
|
||||
|
||||
@ -0,0 +1,49 @@
|
||||
From 3d02fb6da82331176952e480160223136679ce74 Mon Sep 17 00:00:00 2001
|
||||
From: Gerd Hoffmann <kraxel@redhat.com>
|
||||
Date: Tue, 28 Feb 2023 15:47:00 +0100
|
||||
Subject: [PATCH] UefiCpuPkg/MpInitLib: fix apic mode for cpu hotplug
|
||||
|
||||
RH-Author: Gerd Hoffmann <kraxel@redhat.com>
|
||||
RH-MergeRequest: 42: UefiCpuPkg/MpInitLib: fix apic mode for cpu hotplug
|
||||
RH-Bugzilla: 2124143
|
||||
RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
|
||||
RH-Commit: [1/1] 5168501c31541a57aaeb3b3bd7c3602205eb7cdf (kraxel/centos-edk2)
|
||||
|
||||
In case the number of CPUs can in increase beyond 255
|
||||
due to CPU hotplug choose x2apic mode.
|
||||
|
||||
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
||||
|
||||
patch_name: edk2-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch
|
||||
present_in_specfile: true
|
||||
location_in_specfile: 38
|
||||
---
|
||||
UefiCpuPkg/Library/MpInitLib/MpLib.c | 8 +++++++-
|
||||
1 file changed, 7 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/UefiCpuPkg/Library/MpInitLib/MpLib.c b/UefiCpuPkg/Library/MpInitLib/MpLib.c
|
||||
index d724456502..c478878bb0 100644
|
||||
--- a/UefiCpuPkg/Library/MpInitLib/MpLib.c
|
||||
+++ b/UefiCpuPkg/Library/MpInitLib/MpLib.c
|
||||
@@ -534,7 +534,9 @@ CollectProcessorCount (
|
||||
//
|
||||
// Enable x2APIC mode if
|
||||
// 1. Number of CPU is greater than 255; or
|
||||
- // 2. There are any logical processors reporting an Initial APIC ID of 255 or greater.
|
||||
+ // 2. The platform exposed the exact *boot* CPU count to us in advance, and
|
||||
+ // more than 255 logical processors are possible later, with hotplug; or
|
||||
+ // 3. There are any logical processors reporting an Initial APIC ID of 255 or greater.
|
||||
//
|
||||
X2Apic = FALSE;
|
||||
if (CpuMpData->CpuCount > 255) {
|
||||
@@ -542,6 +544,10 @@ CollectProcessorCount (
|
||||
// If there are more than 255 processor found, force to enable X2APIC
|
||||
//
|
||||
X2Apic = TRUE;
|
||||
+ } else if ((PcdGet32 (PcdCpuBootLogicalProcessorNumber) > 0) &&
|
||||
+ (PcdGet32 (PcdCpuMaxLogicalProcessorNumber) > 255))
|
||||
+ {
|
||||
+ X2Apic = TRUE;
|
||||
} else {
|
||||
CpuInfoInHob = (CPU_INFO_IN_HOB *)(UINTN)CpuMpData->CpuInfoInHob;
|
||||
for (Index = 0; Index < CpuMpData->CpuCount; Index++) {
|
||||
@ -1,4 +1,4 @@
|
||||
From 0454b8eaabf7fa0240b6d7c4f6409584161552d4 Mon Sep 17 00:00:00 2001
|
||||
From 7a07b2f16eabf460891a21c05b30cd9c2f875a2a Mon Sep 17 00:00:00 2001
|
||||
From: Gerd Hoffmann <kraxel@redhat.com>
|
||||
Date: Mon, 28 Aug 2023 13:11:02 +0200
|
||||
Subject: [PATCH] CryptoPkg/CrtLib: add stat.h include file.
|
||||
@ -0,0 +1,194 @@
|
||||
From 4c49c1bcb2db128cc4d2ebb29b1ac53fe3ef6b18 Mon Sep 17 00:00:00 2001
|
||||
From: Gerd Hoffmann <kraxel@redhat.com>
|
||||
Date: Tue, 30 Jan 2024 14:04:38 +0100
|
||||
Subject: [PATCH] OvmfPkg/Sec: Setup MTRR early in the boot process.
|
||||
|
||||
RH-Author: Gerd Hoffmann <None>
|
||||
RH-MergeRequest: 55: OvmfPkg/Sec: Setup MTRR early in the boot process.
|
||||
RH-Jira: RHEL-21704
|
||||
RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
|
||||
RH-Commit: [1/4] c4061788d34f409944898b48642d610c259161f3 (kraxel.rh/centos-src-edk2)
|
||||
|
||||
Specifically before running lzma uncompress of the main firmware volume.
|
||||
This is needed to make sure caching is enabled, otherwise the uncompress
|
||||
can be extremely slow.
|
||||
|
||||
Adapt the ASSERTs and MTRR setup in PlatformInitLib to the changes.
|
||||
|
||||
Background: Depending on virtual machine configuration kvm may uses EPT
|
||||
memory types to apply guest MTRR settings. In case MTRRs are disabled
|
||||
kvm will use the uncachable memory type for all mappings. The
|
||||
vmx_get_mt_mask() function in the linux kernel handles this and can be
|
||||
found here:
|
||||
|
||||
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/arch/x86/kvm/vmx/vmx.c?h=v6.7.1#n7580
|
||||
|
||||
In most VM configurations kvm uses MTRR_TYPE_WRBACK unconditionally. In
|
||||
case the VM has a mdev device assigned that is not the case though.
|
||||
|
||||
Before commit e8aa4c6546ad ("UefiCpuPkg/ResetVector: Cache Disable
|
||||
should not be set by default in CR0") kvm also ended up using
|
||||
MTRR_TYPE_WRBACK due to KVM_X86_QUIRK_CD_NW_CLEARED. After that commit
|
||||
kvm evaluates guest mtrr settings, which why setting up MTRRs early is
|
||||
important now.
|
||||
|
||||
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
|
||||
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
||||
Message-ID: <20240130130441.772484-2-kraxel@redhat.com>
|
||||
|
||||
[ kraxel: Downstream-only for now. Timely upstream merge is unlikely
|
||||
due to chinese holidays and rhel-9.4 deadlines are close.
|
||||
QE regression testing passed. So go with upstream posted
|
||||
series v3 ]
|
||||
|
||||
patch_name: edk2-OvmfPkg-Sec-Setup-MTRR-early-in-the-boot-process.patch
|
||||
present_in_specfile: true
|
||||
location_in_specfile: 49
|
||||
---
|
||||
OvmfPkg/IntelTdx/Sec/SecMain.c | 32 +++++++++++++++++++++
|
||||
OvmfPkg/Library/PlatformInitLib/MemDetect.c | 10 +++----
|
||||
OvmfPkg/Sec/SecMain.c | 32 +++++++++++++++++++++
|
||||
3 files changed, 69 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/OvmfPkg/IntelTdx/Sec/SecMain.c b/OvmfPkg/IntelTdx/Sec/SecMain.c
|
||||
index 4e750755bf..7094d86159 100644
|
||||
--- a/OvmfPkg/IntelTdx/Sec/SecMain.c
|
||||
+++ b/OvmfPkg/IntelTdx/Sec/SecMain.c
|
||||
@@ -26,6 +26,8 @@
|
||||
#include <Library/TdxHelperLib.h>
|
||||
#include <Library/CcProbeLib.h>
|
||||
#include <Library/PeilessStartupLib.h>
|
||||
+#include <Register/Intel/ArchitecturalMsr.h>
|
||||
+#include <Register/Intel/Cpuid.h>
|
||||
|
||||
#define SEC_IDT_ENTRY_COUNT 34
|
||||
|
||||
@@ -47,6 +49,31 @@ IA32_IDT_GATE_DESCRIPTOR mIdtEntryTemplate = {
|
||||
}
|
||||
};
|
||||
|
||||
+//
|
||||
+// Enable MTRR early, set default type to write back.
|
||||
+// Needed to make sure caching is enabled,
|
||||
+// without this lzma decompress can be very slow.
|
||||
+//
|
||||
+STATIC
|
||||
+VOID
|
||||
+SecMtrrSetup (
|
||||
+ VOID
|
||||
+ )
|
||||
+{
|
||||
+ CPUID_VERSION_INFO_EDX Edx;
|
||||
+ MSR_IA32_MTRR_DEF_TYPE_REGISTER DefType;
|
||||
+
|
||||
+ AsmCpuid (CPUID_VERSION_INFO, NULL, NULL, NULL, &Edx.Uint32);
|
||||
+ if (!Edx.Bits.MTRR) {
|
||||
+ return;
|
||||
+ }
|
||||
+
|
||||
+ DefType.Uint64 = AsmReadMsr64 (MSR_IA32_MTRR_DEF_TYPE);
|
||||
+ DefType.Bits.Type = 6; /* write back */
|
||||
+ DefType.Bits.E = 1; /* enable */
|
||||
+ AsmWriteMsr64 (MSR_IA32_MTRR_DEF_TYPE, DefType.Uint64);
|
||||
+}
|
||||
+
|
||||
VOID
|
||||
EFIAPI
|
||||
SecCoreStartupWithStack (
|
||||
@@ -203,6 +230,11 @@ SecCoreStartupWithStack (
|
||||
InitializeApicTimer (0, MAX_UINT32, TRUE, 5);
|
||||
DisableApicTimerInterrupt ();
|
||||
|
||||
+ //
|
||||
+ // Initialize MTRR
|
||||
+ //
|
||||
+ SecMtrrSetup ();
|
||||
+
|
||||
PeilessStartup (&SecCoreData);
|
||||
|
||||
ASSERT (FALSE);
|
||||
diff --git a/OvmfPkg/Library/PlatformInitLib/MemDetect.c b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
|
||||
index e64c0ee324..b6ba63ef95 100644
|
||||
--- a/OvmfPkg/Library/PlatformInitLib/MemDetect.c
|
||||
+++ b/OvmfPkg/Library/PlatformInitLib/MemDetect.c
|
||||
@@ -1164,18 +1164,18 @@ PlatformQemuInitializeRam (
|
||||
MtrrGetAllMtrrs (&MtrrSettings);
|
||||
|
||||
//
|
||||
- // MTRRs disabled, fixed MTRRs disabled, default type is uncached
|
||||
+ // See SecMtrrSetup(), default type should be write back
|
||||
//
|
||||
- ASSERT ((MtrrSettings.MtrrDefType & BIT11) == 0);
|
||||
+ ASSERT ((MtrrSettings.MtrrDefType & BIT11) != 0);
|
||||
ASSERT ((MtrrSettings.MtrrDefType & BIT10) == 0);
|
||||
- ASSERT ((MtrrSettings.MtrrDefType & 0xFF) == 0);
|
||||
+ ASSERT ((MtrrSettings.MtrrDefType & 0xFF) == MTRR_CACHE_WRITE_BACK);
|
||||
|
||||
//
|
||||
// flip default type to writeback
|
||||
//
|
||||
- SetMem (&MtrrSettings.Fixed, sizeof MtrrSettings.Fixed, 0x06);
|
||||
+ SetMem (&MtrrSettings.Fixed, sizeof MtrrSettings.Fixed, MTRR_CACHE_WRITE_BACK);
|
||||
ZeroMem (&MtrrSettings.Variables, sizeof MtrrSettings.Variables);
|
||||
- MtrrSettings.MtrrDefType |= BIT11 | BIT10 | 6;
|
||||
+ MtrrSettings.MtrrDefType |= BIT10;
|
||||
MtrrSetAllMtrrs (&MtrrSettings);
|
||||
|
||||
//
|
||||
diff --git a/OvmfPkg/Sec/SecMain.c b/OvmfPkg/Sec/SecMain.c
|
||||
index 60dfa61842..725b57e2fa 100644
|
||||
--- a/OvmfPkg/Sec/SecMain.c
|
||||
+++ b/OvmfPkg/Sec/SecMain.c
|
||||
@@ -29,6 +29,8 @@
|
||||
#include <Ppi/MpInitLibDep.h>
|
||||
#include <Library/TdxHelperLib.h>
|
||||
#include <Library/CcProbeLib.h>
|
||||
+#include <Register/Intel/ArchitecturalMsr.h>
|
||||
+#include <Register/Intel/Cpuid.h>
|
||||
#include "AmdSev.h"
|
||||
|
||||
#define SEC_IDT_ENTRY_COUNT 34
|
||||
@@ -743,6 +745,31 @@ FindAndReportEntryPoints (
|
||||
return;
|
||||
}
|
||||
|
||||
+//
|
||||
+// Enable MTRR early, set default type to write back.
|
||||
+// Needed to make sure caching is enabled,
|
||||
+// without this lzma decompress can be very slow.
|
||||
+//
|
||||
+STATIC
|
||||
+VOID
|
||||
+SecMtrrSetup (
|
||||
+ VOID
|
||||
+ )
|
||||
+{
|
||||
+ CPUID_VERSION_INFO_EDX Edx;
|
||||
+ MSR_IA32_MTRR_DEF_TYPE_REGISTER DefType;
|
||||
+
|
||||
+ AsmCpuid (CPUID_VERSION_INFO, NULL, NULL, NULL, &Edx.Uint32);
|
||||
+ if (!Edx.Bits.MTRR) {
|
||||
+ return;
|
||||
+ }
|
||||
+
|
||||
+ DefType.Uint64 = AsmReadMsr64 (MSR_IA32_MTRR_DEF_TYPE);
|
||||
+ DefType.Bits.Type = 6; /* write back */
|
||||
+ DefType.Bits.E = 1; /* enable */
|
||||
+ AsmWriteMsr64 (MSR_IA32_MTRR_DEF_TYPE, DefType.Uint64);
|
||||
+}
|
||||
+
|
||||
VOID
|
||||
EFIAPI
|
||||
SecCoreStartupWithStack (
|
||||
@@ -942,6 +969,11 @@ SecCoreStartupWithStack (
|
||||
InitializeApicTimer (0, MAX_UINT32, TRUE, 5);
|
||||
DisableApicTimerInterrupt ();
|
||||
|
||||
+ //
|
||||
+ // Initialize MTRR
|
||||
+ //
|
||||
+ SecMtrrSetup ();
|
||||
+
|
||||
//
|
||||
// Initialize Debug Agent to support source level debug in SEC/PEI phases before memory ready.
|
||||
//
|
||||
@ -0,0 +1,41 @@
|
||||
From 3124da27dc460926f40477d247e021ceeabe0be3 Mon Sep 17 00:00:00 2001
|
||||
From: Gerd Hoffmann <kraxel@redhat.com>
|
||||
Date: Tue, 30 Jan 2024 14:04:39 +0100
|
||||
Subject: [PATCH] MdePkg/ArchitecturalMsr.h: add #defines for MTRR cache types
|
||||
|
||||
RH-Author: Gerd Hoffmann <None>
|
||||
RH-MergeRequest: 55: OvmfPkg/Sec: Setup MTRR early in the boot process.
|
||||
RH-Jira: RHEL-21704
|
||||
RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
|
||||
RH-Commit: [2/4] a568bc2793d677462a2971aae9566a9bbc64b063 (kraxel.rh/centos-src-edk2)
|
||||
|
||||
Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
|
||||
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
|
||||
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
||||
Message-ID: <20240130130441.772484-3-kraxel@redhat.com>
|
||||
|
||||
patch_name: edk2-MdePkg-ArchitecturalMsr.h-add-defines-for-MTRR-cache.patch
|
||||
present_in_specfile: true
|
||||
location_in_specfile: 50
|
||||
---
|
||||
MdePkg/Include/Register/Intel/ArchitecturalMsr.h | 7 +++++++
|
||||
1 file changed, 7 insertions(+)
|
||||
|
||||
diff --git a/MdePkg/Include/Register/Intel/ArchitecturalMsr.h b/MdePkg/Include/Register/Intel/ArchitecturalMsr.h
|
||||
index 756e7c86ec..08ba949cf7 100644
|
||||
--- a/MdePkg/Include/Register/Intel/ArchitecturalMsr.h
|
||||
+++ b/MdePkg/Include/Register/Intel/ArchitecturalMsr.h
|
||||
@@ -2103,6 +2103,13 @@ typedef union {
|
||||
#define MSR_IA32_MTRR_PHYSBASE9 0x00000212
|
||||
/// @}
|
||||
|
||||
+#define MSR_IA32_MTRR_CACHE_UNCACHEABLE 0
|
||||
+#define MSR_IA32_MTRR_CACHE_WRITE_COMBINING 1
|
||||
+#define MSR_IA32_MTRR_CACHE_WRITE_THROUGH 4
|
||||
+#define MSR_IA32_MTRR_CACHE_WRITE_PROTECTED 5
|
||||
+#define MSR_IA32_MTRR_CACHE_WRITE_BACK 6
|
||||
+#define MSR_IA32_MTRR_CACHE_INVALID_TYPE 7
|
||||
+
|
||||
/**
|
||||
MSR information returned for MSR indexes #MSR_IA32_MTRR_PHYSBASE0 to
|
||||
#MSR_IA32_MTRR_PHYSBASE9
|
||||
@ -1,37 +0,0 @@
|
||||
From ee75d5f03a473eb4007f7aaa58a41719adca0429 Mon Sep 17 00:00:00 2001
|
||||
From: Tom Lendacky <thomas.lendacky@amd.com>
|
||||
Date: Mon, 18 Nov 2024 12:59:32 -0600
|
||||
Subject: [PATCH] OvmfPkg/QemuFlashFvbServicesRuntimeDxe: Do not use flash with
|
||||
SEV-SNP
|
||||
|
||||
SEV-SNP does not support the use of the Qemu flash device as SEV-SNP
|
||||
guests are started using the Qemu -bios option instead of the Qemu -drive
|
||||
if=pflash option. Perform runtime detection of SEV-SNP and exit early from
|
||||
the Qemu flash device initialization, indicating the Qemu flash device is
|
||||
not present. SEV-SNP guests will use the emulated variable support.
|
||||
|
||||
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
|
||||
(cherry picked from commit f0d2bc3ab268c8e3c6da4158208df38bc9d3677e)
|
||||
---
|
||||
OvmfPkg/QemuFlashFvbServicesRuntimeDxe/QemuFlash.c | 8 ++++++++
|
||||
1 file changed, 8 insertions(+)
|
||||
|
||||
diff --git a/OvmfPkg/QemuFlashFvbServicesRuntimeDxe/QemuFlash.c b/OvmfPkg/QemuFlashFvbServicesRuntimeDxe/QemuFlash.c
|
||||
index a577aea556..5e393e98ed 100644
|
||||
--- a/OvmfPkg/QemuFlashFvbServicesRuntimeDxe/QemuFlash.c
|
||||
+++ b/OvmfPkg/QemuFlashFvbServicesRuntimeDxe/QemuFlash.c
|
||||
@@ -259,6 +259,14 @@ QemuFlashInitialize (
|
||||
VOID
|
||||
)
|
||||
{
|
||||
+ //
|
||||
+ // The SNP model does not provide for QEMU flash device support, so exit
|
||||
+ // early before attempting to initialize any QEMU flash device support.
|
||||
+ //
|
||||
+ if (MemEncryptSevSnpIsEnabled ()) {
|
||||
+ return EFI_UNSUPPORTED;
|
||||
+ }
|
||||
+
|
||||
mFlashBase = (UINT8 *)(UINTN)PcdGet32 (PcdOvmfFdBaseAddress);
|
||||
mFdBlockSize = PcdGet32 (PcdOvmfFirmwareBlockSize);
|
||||
ASSERT (PcdGet32 (PcdOvmfFirmwareFdSize) % mFdBlockSize == 0);
|
||||
@ -0,0 +1,70 @@
|
||||
From f015a541308b2d752c399b9ef9597c4585218032 Mon Sep 17 00:00:00 2001
|
||||
From: Gerd Hoffmann <kraxel@redhat.com>
|
||||
Date: Tue, 30 Jan 2024 14:04:40 +0100
|
||||
Subject: [PATCH] UefiCpuPkg/MtrrLib.h: use cache type #defines from
|
||||
ArchitecturalMsr.h
|
||||
|
||||
RH-Author: Gerd Hoffmann <None>
|
||||
RH-MergeRequest: 55: OvmfPkg/Sec: Setup MTRR early in the boot process.
|
||||
RH-Jira: RHEL-21704
|
||||
RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
|
||||
RH-Commit: [3/4] 8b766c97b247a8665662697534455c19423ff23c (kraxel.rh/centos-src-edk2)
|
||||
|
||||
Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
|
||||
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
|
||||
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
||||
Message-ID: <20240130130441.772484-4-kraxel@redhat.com>
|
||||
|
||||
patch_name: edk2-UefiCpuPkg-MtrrLib.h-use-cache-type-defines-from-Arc.patch
|
||||
present_in_specfile: true
|
||||
location_in_specfile: 51
|
||||
---
|
||||
UefiCpuPkg/Include/Library/MtrrLib.h | 26 ++++++++++++++------------
|
||||
1 file changed, 14 insertions(+), 12 deletions(-)
|
||||
|
||||
diff --git a/UefiCpuPkg/Include/Library/MtrrLib.h b/UefiCpuPkg/Include/Library/MtrrLib.h
|
||||
index 86cc1aab3b..287d249a99 100644
|
||||
--- a/UefiCpuPkg/Include/Library/MtrrLib.h
|
||||
+++ b/UefiCpuPkg/Include/Library/MtrrLib.h
|
||||
@@ -9,6 +9,8 @@
|
||||
#ifndef _MTRR_LIB_H_
|
||||
#define _MTRR_LIB_H_
|
||||
|
||||
+#include <Register/Intel/ArchitecturalMsr.h>
|
||||
+
|
||||
//
|
||||
// According to IA32 SDM, MTRRs number and MSR offset are always consistent
|
||||
// for IA32 processor family
|
||||
@@ -82,20 +84,20 @@ typedef struct _MTRR_SETTINGS_ {
|
||||
// Memory cache types
|
||||
//
|
||||
typedef enum {
|
||||
- CacheUncacheable = 0,
|
||||
- CacheWriteCombining = 1,
|
||||
- CacheWriteThrough = 4,
|
||||
- CacheWriteProtected = 5,
|
||||
- CacheWriteBack = 6,
|
||||
- CacheInvalid = 7
|
||||
+ CacheUncacheable = MSR_IA32_MTRR_CACHE_UNCACHEABLE,
|
||||
+ CacheWriteCombining = MSR_IA32_MTRR_CACHE_WRITE_COMBINING,
|
||||
+ CacheWriteThrough = MSR_IA32_MTRR_CACHE_WRITE_THROUGH,
|
||||
+ CacheWriteProtected = MSR_IA32_MTRR_CACHE_WRITE_PROTECTED,
|
||||
+ CacheWriteBack = MSR_IA32_MTRR_CACHE_WRITE_BACK,
|
||||
+ CacheInvalid = MSR_IA32_MTRR_CACHE_INVALID_TYPE,
|
||||
} MTRR_MEMORY_CACHE_TYPE;
|
||||
|
||||
-#define MTRR_CACHE_UNCACHEABLE 0
|
||||
-#define MTRR_CACHE_WRITE_COMBINING 1
|
||||
-#define MTRR_CACHE_WRITE_THROUGH 4
|
||||
-#define MTRR_CACHE_WRITE_PROTECTED 5
|
||||
-#define MTRR_CACHE_WRITE_BACK 6
|
||||
-#define MTRR_CACHE_INVALID_TYPE 7
|
||||
+#define MTRR_CACHE_UNCACHEABLE MSR_IA32_MTRR_CACHE_UNCACHEABLE
|
||||
+#define MTRR_CACHE_WRITE_COMBINING MSR_IA32_MTRR_CACHE_WRITE_COMBINING
|
||||
+#define MTRR_CACHE_WRITE_THROUGH MSR_IA32_MTRR_CACHE_WRITE_THROUGH
|
||||
+#define MTRR_CACHE_WRITE_PROTECTED MSR_IA32_MTRR_CACHE_WRITE_PROTECTED
|
||||
+#define MTRR_CACHE_WRITE_BACK MSR_IA32_MTRR_CACHE_WRITE_BACK
|
||||
+#define MTRR_CACHE_INVALID_TYPE MSR_IA32_MTRR_CACHE_INVALID_TYPE
|
||||
|
||||
typedef struct {
|
||||
UINT64 BaseAddress;
|
||||
@ -1,52 +0,0 @@
|
||||
From 6fc76f3572566a83a34bb26d21e16c0e75de3609 Mon Sep 17 00:00:00 2001
|
||||
From: Tom Lendacky <thomas.lendacky@amd.com>
|
||||
Date: Mon, 18 Nov 2024 12:59:32 -0600
|
||||
Subject: [PATCH] OvmfPkg/PlatformPei: Move NV vars init to after SEV-SNP
|
||||
memory acceptance
|
||||
|
||||
When OVMF is built with the SECURE_BOOT_ENABLE set to true, reserving and
|
||||
initializing the emulated variable store happens before memory has been
|
||||
accepted under SEV-SNP. This results in a #VC exception for accessing
|
||||
memory that hasn't been validated (error code 0x404). The #VC handler
|
||||
treats this error code as a fatal error, causing the OVMF boot to fail.
|
||||
|
||||
Move the call to ReserveEmuVariableNvStore() to after memory has been
|
||||
accepted by AmdSevInitialize().
|
||||
|
||||
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
|
||||
(cherry picked from commit 52fa7e78d282f8434b41aff24b3a5a745611ff87)
|
||||
---
|
||||
OvmfPkg/PlatformPei/Platform.c | 14 ++++++++++----
|
||||
1 file changed, 10 insertions(+), 4 deletions(-)
|
||||
|
||||
diff --git a/OvmfPkg/PlatformPei/Platform.c b/OvmfPkg/PlatformPei/Platform.c
|
||||
index 05b924f99f..54903cfca2 100644
|
||||
--- a/OvmfPkg/PlatformPei/Platform.c
|
||||
+++ b/OvmfPkg/PlatformPei/Platform.c
|
||||
@@ -365,10 +365,6 @@ InitializePlatform (
|
||||
InitializeRamRegions (PlatformInfoHob);
|
||||
|
||||
if (PlatformInfoHob->BootMode != BOOT_ON_S3_RESUME) {
|
||||
- if (!PlatformInfoHob->SmmSmramRequire) {
|
||||
- ReserveEmuVariableNvStore ();
|
||||
- }
|
||||
-
|
||||
PeiFvInitialization (PlatformInfoHob);
|
||||
MemTypeInfoInitialization (PlatformInfoHob);
|
||||
MemMapInitialization (PlatformInfoHob);
|
||||
@@ -391,5 +387,15 @@ InitializePlatform (
|
||||
RelocateSmBase ();
|
||||
}
|
||||
|
||||
+ //
|
||||
+ // Performed after CoCo (SEV/TDX) initialization to allow the memory
|
||||
+ // used to be validated before being used.
|
||||
+ //
|
||||
+ if (PlatformInfoHob->BootMode != BOOT_ON_S3_RESUME) {
|
||||
+ if (!PlatformInfoHob->SmmSmramRequire) {
|
||||
+ ReserveEmuVariableNvStore ();
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
return EFI_SUCCESS;
|
||||
}
|
||||
@ -0,0 +1,49 @@
|
||||
From dd543686c34fc3c6ddfafc0104066889ad9d1813 Mon Sep 17 00:00:00 2001
|
||||
From: Gerd Hoffmann <kraxel@redhat.com>
|
||||
Date: Tue, 30 Jan 2024 14:04:41 +0100
|
||||
Subject: [PATCH] OvmfPkg/Sec: use cache type #defines from ArchitecturalMsr.h
|
||||
|
||||
RH-Author: Gerd Hoffmann <None>
|
||||
RH-MergeRequest: 55: OvmfPkg/Sec: Setup MTRR early in the boot process.
|
||||
RH-Jira: RHEL-21704
|
||||
RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
|
||||
RH-Commit: [4/4] 55f00e3e153ca945ca458e7abc26780a8d83ac85 (kraxel.rh/centos-src-edk2)
|
||||
|
||||
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
|
||||
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
||||
Message-ID: <20240130130441.772484-5-kraxel@redhat.com>
|
||||
|
||||
patch_name: edk2-OvmfPkg-Sec-use-cache-type-defines-from-Architectura.patch
|
||||
present_in_specfile: true
|
||||
location_in_specfile: 52
|
||||
---
|
||||
OvmfPkg/IntelTdx/Sec/SecMain.c | 2 +-
|
||||
OvmfPkg/Sec/SecMain.c | 2 +-
|
||||
2 files changed, 2 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/OvmfPkg/IntelTdx/Sec/SecMain.c b/OvmfPkg/IntelTdx/Sec/SecMain.c
|
||||
index 7094d86159..1a19f26178 100644
|
||||
--- a/OvmfPkg/IntelTdx/Sec/SecMain.c
|
||||
+++ b/OvmfPkg/IntelTdx/Sec/SecMain.c
|
||||
@@ -69,7 +69,7 @@ SecMtrrSetup (
|
||||
}
|
||||
|
||||
DefType.Uint64 = AsmReadMsr64 (MSR_IA32_MTRR_DEF_TYPE);
|
||||
- DefType.Bits.Type = 6; /* write back */
|
||||
+ DefType.Bits.Type = MSR_IA32_MTRR_CACHE_WRITE_BACK;
|
||||
DefType.Bits.E = 1; /* enable */
|
||||
AsmWriteMsr64 (MSR_IA32_MTRR_DEF_TYPE, DefType.Uint64);
|
||||
}
|
||||
diff --git a/OvmfPkg/Sec/SecMain.c b/OvmfPkg/Sec/SecMain.c
|
||||
index 725b57e2fa..26963b924d 100644
|
||||
--- a/OvmfPkg/Sec/SecMain.c
|
||||
+++ b/OvmfPkg/Sec/SecMain.c
|
||||
@@ -765,7 +765,7 @@ SecMtrrSetup (
|
||||
}
|
||||
|
||||
DefType.Uint64 = AsmReadMsr64 (MSR_IA32_MTRR_DEF_TYPE);
|
||||
- DefType.Bits.Type = 6; /* write back */
|
||||
+ DefType.Bits.Type = MSR_IA32_MTRR_CACHE_WRITE_BACK;
|
||||
DefType.Bits.E = 1; /* enable */
|
||||
AsmWriteMsr64 (MSR_IA32_MTRR_DEF_TYPE, DefType.Uint64);
|
||||
}
|
||||
@ -1,103 +0,0 @@
|
||||
From 3ae6cb5329ce5e48efc29989943e19cfccbfb38b Mon Sep 17 00:00:00 2001
|
||||
From: Tom Lendacky <thomas.lendacky@amd.com>
|
||||
Date: Mon, 18 Nov 2024 12:59:32 -0600
|
||||
Subject: [PATCH] OvmfPkg/PlatformInitLib: Retry NV vars FV check as shared
|
||||
|
||||
When OVMF is built with SECURE_BOOT_ENABLE, the variable store will be
|
||||
populated and validated in PlatformValidateNvVarStore(). When an SEV
|
||||
or an SEV-ES guest is running, this may be encrypted or unencrypted
|
||||
depending on how the guest was started. If the guest was started with the
|
||||
combined code and variable contents (OVMF.fd), then the variable store
|
||||
will be encrypted. If the guest was started with the separate code and
|
||||
variables contents (OVMF_CODE.fd and OVMF_VARS.fd), then the variable
|
||||
store will be unencrypted.
|
||||
|
||||
When PlatformValidateNvVarStore() is first invoked, the variable store
|
||||
area is initially mapped encrypted, which may or may not pass the variable
|
||||
validation step depending how the guest was launched. To accomodate this,
|
||||
retry the validation step on failure after remapping the variable store
|
||||
area as unencrypted.
|
||||
|
||||
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
|
||||
(cherry picked from commit d502cc7702e4d537c2bcbe5256e26cba6d4ca8c6)
|
||||
---
|
||||
OvmfPkg/Library/PlatformInitLib/Platform.c | 32 +++++++++++++++++--
|
||||
.../PlatformInitLib/PlatformInitLib.inf | 1 +
|
||||
2 files changed, 31 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/OvmfPkg/Library/PlatformInitLib/Platform.c b/OvmfPkg/Library/PlatformInitLib/Platform.c
|
||||
index 10fc17355f..715533b1f2 100644
|
||||
--- a/OvmfPkg/Library/PlatformInitLib/Platform.c
|
||||
+++ b/OvmfPkg/Library/PlatformInitLib/Platform.c
|
||||
@@ -34,6 +34,7 @@
|
||||
#include <Guid/VariableFormat.h>
|
||||
#include <OvmfPlatforms.h>
|
||||
#include <Library/TdxLib.h>
|
||||
+#include <Library/MemEncryptSevLib.h>
|
||||
|
||||
#include <Library/PlatformInitLib.h>
|
||||
|
||||
@@ -774,6 +775,8 @@ PlatformValidateNvVarStore (
|
||||
EFI_FIRMWARE_VOLUME_HEADER *NvVarStoreFvHeader;
|
||||
VARIABLE_STORE_HEADER *NvVarStoreHeader;
|
||||
AUTHENTICATED_VARIABLE_HEADER *VariableHeader;
|
||||
+ BOOLEAN Retry;
|
||||
+ EFI_STATUS Status;
|
||||
|
||||
static EFI_GUID FvHdrGUID = EFI_SYSTEM_NV_DATA_FV_GUID;
|
||||
static EFI_GUID VarStoreHdrGUID = EFI_AUTHENTICATED_VARIABLE_GUID;
|
||||
@@ -792,6 +795,15 @@ PlatformValidateNvVarStore (
|
||||
//
|
||||
NvVarStoreFvHeader = (EFI_FIRMWARE_VOLUME_HEADER *)NvVarStoreBase;
|
||||
|
||||
+ //
|
||||
+ // SEV and SEV-ES can use separate flash devices for OVMF code and
|
||||
+ // OVMF variables. In this case, the OVMF variables will need to be
|
||||
+ // mapped unencrypted. If the initial validation fails, remap the
|
||||
+ // NV variable store as unencrypted and retry the validation.
|
||||
+ //
|
||||
+ Retry = MemEncryptSevIsEnabled ();
|
||||
+
|
||||
+RETRY:
|
||||
if ((!IsZeroBuffer (NvVarStoreFvHeader->ZeroVector, 16)) ||
|
||||
(!CompareGuid (&FvHdrGUID, &NvVarStoreFvHeader->FileSystemGuid)) ||
|
||||
(NvVarStoreFvHeader->Signature != EFI_FVH_SIGNATURE) ||
|
||||
@@ -801,8 +813,24 @@ PlatformValidateNvVarStore (
|
||||
(NvVarStoreFvHeader->FvLength != NvVarStoreSize)
|
||||
)
|
||||
{
|
||||
- DEBUG ((DEBUG_ERROR, "NvVarStore FV headers were invalid.\n"));
|
||||
- return FALSE;
|
||||
+ if (!Retry) {
|
||||
+ DEBUG ((DEBUG_ERROR, "NvVarStore FV headers were invalid.\n"));
|
||||
+ return FALSE;
|
||||
+ }
|
||||
+
|
||||
+ DEBUG ((DEBUG_INFO, "Remapping NvVarStore as shared\n"));
|
||||
+ Status = MemEncryptSevClearMmioPageEncMask (
|
||||
+ 0,
|
||||
+ (UINTN)NvVarStoreBase,
|
||||
+ EFI_SIZE_TO_PAGES (NvVarStoreSize)
|
||||
+ );
|
||||
+ if (EFI_ERROR (Status)) {
|
||||
+ DEBUG ((DEBUG_ERROR, "Failed to map NvVarStore as shared\n"));
|
||||
+ return FALSE;
|
||||
+ }
|
||||
+
|
||||
+ Retry = FALSE;
|
||||
+ goto RETRY;
|
||||
}
|
||||
|
||||
//
|
||||
diff --git a/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf b/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf
|
||||
index 3e63ef4423..fb179e6791 100644
|
||||
--- a/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf
|
||||
+++ b/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf
|
||||
@@ -48,6 +48,7 @@
|
||||
HobLib
|
||||
QemuFwCfgLib
|
||||
QemuFwCfgSimpleParserLib
|
||||
+ MemEncryptSevLib
|
||||
MemoryAllocationLib
|
||||
MtrrLib
|
||||
PcdLib
|
||||
@ -1,28 +0,0 @@
|
||||
From 6944acabf2aa916e7f321c28f19e7d95b155df99 Mon Sep 17 00:00:00 2001
|
||||
From: Tom Lendacky <thomas.lendacky@amd.com>
|
||||
Date: Mon, 18 Nov 2024 12:59:32 -0600
|
||||
Subject: [PATCH] OvmfPkg/EmuVariableFvbRuntimeDxe: Issue NV vars
|
||||
initializitation message
|
||||
|
||||
Add a debug message that indicates when the NV variables are being
|
||||
initialized through the template structure.
|
||||
|
||||
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
|
||||
(cherry picked from commit 6142f0a8a53557ba50300c762a15bf3c18382162)
|
||||
---
|
||||
OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.c | 2 ++
|
||||
1 file changed, 2 insertions(+)
|
||||
|
||||
diff --git a/OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.c b/OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.c
|
||||
index c07e38966e..cc476c7df2 100644
|
||||
--- a/OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.c
|
||||
+++ b/OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.c
|
||||
@@ -692,6 +692,8 @@ InitializeFvAndVariableStoreHeaders (
|
||||
//
|
||||
Fv = (EFI_FIRMWARE_VOLUME_HEADER *)Ptr;
|
||||
Fv->Checksum = CalculateCheckSum16 (Ptr, Fv->HeaderLength);
|
||||
+
|
||||
+ DEBUG ((DEBUG_INFO, "EMU Variable FVB: Initialized FV using template structure\n"));
|
||||
}
|
||||
|
||||
/**
|
||||
@ -0,0 +1,127 @@
|
||||
From 3f8eab199430de18c1c6a98d1d0772499b17cc86 Mon Sep 17 00:00:00 2001
|
||||
From: Gerd Hoffmann <kraxel@redhat.com>
|
||||
Date: Wed, 8 May 2024 13:14:26 +0200
|
||||
Subject: [PATCH] OvmfPkg: add morlock support
|
||||
|
||||
Add dsc + fdf include files to add the MorLock drivers to the build.
|
||||
Add the include files to OVMF build configurations.
|
||||
|
||||
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
||||
(cherry picked from commit b45aff0dc9cb87f316eb17a11e5d4438175d9cca)
|
||||
---
|
||||
OvmfPkg/Include/Dsc/MorLock.dsc.inc | 10 ++++++++++
|
||||
OvmfPkg/Include/Fdf/MorLock.fdf.inc | 10 ++++++++++
|
||||
OvmfPkg/OvmfPkgIa32.dsc | 1 +
|
||||
OvmfPkg/OvmfPkgIa32.fdf | 1 +
|
||||
OvmfPkg/OvmfPkgIa32X64.dsc | 1 +
|
||||
OvmfPkg/OvmfPkgIa32X64.fdf | 1 +
|
||||
OvmfPkg/OvmfPkgX64.dsc | 1 +
|
||||
OvmfPkg/OvmfPkgX64.fdf | 1 +
|
||||
8 files changed, 26 insertions(+)
|
||||
create mode 100644 OvmfPkg/Include/Dsc/MorLock.dsc.inc
|
||||
create mode 100644 OvmfPkg/Include/Fdf/MorLock.fdf.inc
|
||||
|
||||
diff --git a/OvmfPkg/Include/Dsc/MorLock.dsc.inc b/OvmfPkg/Include/Dsc/MorLock.dsc.inc
|
||||
new file mode 100644
|
||||
index 0000000000..a8c5fb24b8
|
||||
--- /dev/null
|
||||
+++ b/OvmfPkg/Include/Dsc/MorLock.dsc.inc
|
||||
@@ -0,0 +1,10 @@
|
||||
+##
|
||||
+# SPDX-License-Identifier: BSD-2-Clause-Patent
|
||||
+#
|
||||
+# MorLock support
|
||||
+##
|
||||
+
|
||||
+ SecurityPkg/Tcg/MemoryOverwriteControl/TcgMor.inf
|
||||
+!if $(SMM_REQUIRE) == TRUE
|
||||
+ SecurityPkg/Tcg/MemoryOverwriteRequestControlLock/TcgMorLockSmm.inf
|
||||
+!endif
|
||||
diff --git a/OvmfPkg/Include/Fdf/MorLock.fdf.inc b/OvmfPkg/Include/Fdf/MorLock.fdf.inc
|
||||
new file mode 100644
|
||||
index 0000000000..20b7d6619a
|
||||
--- /dev/null
|
||||
+++ b/OvmfPkg/Include/Fdf/MorLock.fdf.inc
|
||||
@@ -0,0 +1,10 @@
|
||||
+##
|
||||
+# SPDX-License-Identifier: BSD-2-Clause-Patent
|
||||
+#
|
||||
+# MorLock support
|
||||
+##
|
||||
+
|
||||
+INF SecurityPkg/Tcg/MemoryOverwriteControl/TcgMor.inf
|
||||
+!if $(SMM_REQUIRE) == TRUE
|
||||
+INF SecurityPkg/Tcg/MemoryOverwriteRequestControlLock/TcgMorLockSmm.inf
|
||||
+!endif
|
||||
diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
|
||||
index d8ae542686..65a866ae0c 100644
|
||||
--- a/OvmfPkg/OvmfPkgIa32.dsc
|
||||
+++ b/OvmfPkg/OvmfPkgIa32.dsc
|
||||
@@ -887,6 +887,7 @@
|
||||
MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
|
||||
|
||||
!include OvmfPkg/Include/Dsc/ShellComponents.dsc.inc
|
||||
+!include OvmfPkg/Include/Dsc/MorLock.dsc.inc
|
||||
|
||||
!if $(SECURE_BOOT_ENABLE) == TRUE
|
||||
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
|
||||
diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
|
||||
index 0ffa3be750..10eb6fe72b 100644
|
||||
--- a/OvmfPkg/OvmfPkgIa32.fdf
|
||||
+++ b/OvmfPkg/OvmfPkgIa32.fdf
|
||||
@@ -355,6 +355,7 @@ INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
|
||||
!include OvmfPkg/Include/Fdf/OvmfTpmDxe.fdf.inc
|
||||
|
||||
!include OvmfPkg/Include/Fdf/ShellDxe.fdf.inc
|
||||
+!include OvmfPkg/Include/Fdf/MorLock.fdf.inc
|
||||
|
||||
!if $(LOAD_X64_ON_IA32_ENABLE) == TRUE
|
||||
INF OvmfPkg/CompatImageLoaderDxe/CompatImageLoaderDxe.inf
|
||||
diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
|
||||
index 52ac2c96fc..679e25501b 100644
|
||||
--- a/OvmfPkg/OvmfPkgIa32X64.dsc
|
||||
+++ b/OvmfPkg/OvmfPkgIa32X64.dsc
|
||||
@@ -901,6 +901,7 @@
|
||||
MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
|
||||
|
||||
!include OvmfPkg/Include/Dsc/ShellComponents.dsc.inc
|
||||
+!include OvmfPkg/Include/Dsc/MorLock.dsc.inc
|
||||
|
||||
!if $(SECURE_BOOT_ENABLE) == TRUE
|
||||
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
|
||||
diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
|
||||
index c4f3ec0735..ff06bbfc6f 100644
|
||||
--- a/OvmfPkg/OvmfPkgIa32X64.fdf
|
||||
+++ b/OvmfPkg/OvmfPkgIa32X64.fdf
|
||||
@@ -362,6 +362,7 @@ INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
|
||||
!include OvmfPkg/Include/Fdf/OvmfTpmDxe.fdf.inc
|
||||
|
||||
!include OvmfPkg/Include/Fdf/ShellDxe.fdf.inc
|
||||
+!include OvmfPkg/Include/Fdf/MorLock.fdf.inc
|
||||
|
||||
################################################################################
|
||||
|
||||
diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
|
||||
index f76d0ef7bc..d294fd4625 100644
|
||||
--- a/OvmfPkg/OvmfPkgX64.dsc
|
||||
+++ b/OvmfPkg/OvmfPkgX64.dsc
|
||||
@@ -969,6 +969,7 @@
|
||||
MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
|
||||
|
||||
!include OvmfPkg/Include/Dsc/ShellComponents.dsc.inc
|
||||
+!include OvmfPkg/Include/Dsc/MorLock.dsc.inc
|
||||
|
||||
!if $(SECURE_BOOT_ENABLE) == TRUE
|
||||
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
|
||||
diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
|
||||
index bedd85ef7a..f3b787201f 100644
|
||||
--- a/OvmfPkg/OvmfPkgX64.fdf
|
||||
+++ b/OvmfPkg/OvmfPkgX64.fdf
|
||||
@@ -402,6 +402,7 @@ INF OvmfPkg/Tcg/TdTcg2Dxe/TdTcg2Dxe.inf
|
||||
!include OvmfPkg/Include/Fdf/OvmfTpmDxe.fdf.inc
|
||||
|
||||
!include OvmfPkg/Include/Fdf/ShellDxe.fdf.inc
|
||||
+!include OvmfPkg/Include/Fdf/MorLock.fdf.inc
|
||||
|
||||
################################################################################
|
||||
|
||||
@ -0,0 +1,192 @@
|
||||
From 3899f089b8197f52ca63fe1561f8e5e1341f8198 Mon Sep 17 00:00:00 2001
|
||||
From: Pedro Falcato <pedro.falcato@gmail.com>
|
||||
Date: Tue, 22 Nov 2022 22:31:03 +0000
|
||||
Subject: [PATCH] MdePkg/BaseRngLib: Add a smoketest for RDRAND and check CPUID
|
||||
|
||||
RDRAND has notoriously been broken many times over its lifespan.
|
||||
Add a smoketest to RDRAND, in order to better sniff out potential
|
||||
security concerns.
|
||||
|
||||
Also add a proper CPUID test in order to support older CPUs which may
|
||||
not have it; it was previously being tested but then promptly ignored.
|
||||
|
||||
Testing algorithm inspired by linux's arch/x86/kernel/cpu/rdrand.c
|
||||
:x86_init_rdrand() per commit 049f9ae9..
|
||||
|
||||
Many thanks to Jason Donenfeld for relicensing his linux RDRAND detection
|
||||
code to MIT and the public domain.
|
||||
|
||||
>On Tue, Nov 22, 2022 at 2:21 PM Jason A. Donenfeld <Jason@zx2c4.com> wrote:
|
||||
<..>
|
||||
> I (re)wrote that function in Linux. I hereby relicense it as MIT, and
|
||||
> also place it into public domain. Do with it what you will now.
|
||||
>
|
||||
> Jason
|
||||
|
||||
BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4163
|
||||
|
||||
Signed-off-by: Pedro Falcato <pedro.falcato@gmail.com>
|
||||
Cc: Michael D Kinney <michael.d.kinney@intel.com>
|
||||
Cc: Liming Gao <gaoliming@byosoft.com.cn>
|
||||
Cc: Zhiguang Liu <zhiguang.liu@intel.com>
|
||||
Cc: Jason A. Donenfeld <Jason@zx2c4.com>
|
||||
(cherry picked from commit c3a8ca7b54a9fd17acdf16c6282a92cc989fa92a)
|
||||
---
|
||||
MdePkg/Library/BaseRngLib/Rand/RdRand.c | 99 +++++++++++++++++++++++--
|
||||
1 file changed, 91 insertions(+), 8 deletions(-)
|
||||
|
||||
diff --git a/MdePkg/Library/BaseRngLib/Rand/RdRand.c b/MdePkg/Library/BaseRngLib/Rand/RdRand.c
|
||||
index 9bd68352f9..06d2a6f12d 100644
|
||||
--- a/MdePkg/Library/BaseRngLib/Rand/RdRand.c
|
||||
+++ b/MdePkg/Library/BaseRngLib/Rand/RdRand.c
|
||||
@@ -3,6 +3,7 @@
|
||||
to provide high-quality random numbers.
|
||||
|
||||
Copyright (c) 2023, Arm Limited. All rights reserved.<BR>
|
||||
+Copyright (c) 2022, Pedro Falcato. All rights reserved.<BR>
|
||||
Copyright (c) 2021, NUVIA Inc. All rights reserved.<BR>
|
||||
Copyright (c) 2015, Intel Corporation. All rights reserved.<BR>
|
||||
|
||||
@@ -24,6 +25,88 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
|
||||
|
||||
STATIC BOOLEAN mRdRandSupported;
|
||||
|
||||
+//
|
||||
+// Intel SDM says 10 tries is good enough for reliable RDRAND usage.
|
||||
+//
|
||||
+#define RDRAND_RETRIES 10
|
||||
+
|
||||
+#define RDRAND_TEST_SAMPLES 8
|
||||
+
|
||||
+#define RDRAND_MIN_CHANGE 5
|
||||
+
|
||||
+//
|
||||
+// Add a define for native-word RDRAND, just for the test.
|
||||
+//
|
||||
+#ifdef MDE_CPU_X64
|
||||
+#define ASM_RDRAND AsmRdRand64
|
||||
+#else
|
||||
+#define ASM_RDRAND AsmRdRand32
|
||||
+#endif
|
||||
+
|
||||
+/**
|
||||
+ Tests RDRAND for broken implementations.
|
||||
+
|
||||
+ @retval TRUE RDRAND is reliable (and hopefully safe).
|
||||
+ @retval FALSE RDRAND is unreliable and should be disabled, despite CPUID.
|
||||
+
|
||||
+**/
|
||||
+STATIC
|
||||
+BOOLEAN
|
||||
+TestRdRand (
|
||||
+ VOID
|
||||
+ )
|
||||
+{
|
||||
+ //
|
||||
+ // Test for notoriously broken rdrand implementations that always return the same
|
||||
+ // value, like the Zen 3 uarch (all-1s) or other several AMD families on suspend/resume (also all-1s).
|
||||
+ // Note that this should be expanded to extensively test for other sorts of possible errata.
|
||||
+ //
|
||||
+
|
||||
+ //
|
||||
+ // Our algorithm samples rdrand $RDRAND_TEST_SAMPLES times and expects
|
||||
+ // a different result $RDRAND_MIN_CHANGE times for reliable RDRAND usage.
|
||||
+ //
|
||||
+ UINTN Prev;
|
||||
+ UINT8 Idx;
|
||||
+ UINT8 TestIteration;
|
||||
+ UINT32 Changed;
|
||||
+
|
||||
+ Changed = 0;
|
||||
+
|
||||
+ for (TestIteration = 0; TestIteration < RDRAND_TEST_SAMPLES; TestIteration++) {
|
||||
+ UINTN Sample;
|
||||
+ //
|
||||
+ // Note: We use a retry loop for rdrand. Normal users get this in BaseRng.c
|
||||
+ // Any failure to get a random number will assume RDRAND does not work.
|
||||
+ //
|
||||
+ for (Idx = 0; Idx < RDRAND_RETRIES; Idx++) {
|
||||
+ if (ASM_RDRAND (&Sample)) {
|
||||
+ break;
|
||||
+ }
|
||||
+ }
|
||||
+
|
||||
+ if (Idx == RDRAND_RETRIES) {
|
||||
+ DEBUG ((DEBUG_ERROR, "BaseRngLib/x86: CPU BUG: Failed to get an RDRAND random number - disabling\n"));
|
||||
+ return FALSE;
|
||||
+ }
|
||||
+
|
||||
+ if (TestIteration != 0) {
|
||||
+ Changed += Sample != Prev;
|
||||
+ }
|
||||
+
|
||||
+ Prev = Sample;
|
||||
+ }
|
||||
+
|
||||
+ if (Changed < RDRAND_MIN_CHANGE) {
|
||||
+ DEBUG ((DEBUG_ERROR, "BaseRngLib/x86: CPU BUG: RDRAND not reliable - disabling\n"));
|
||||
+ return FALSE;
|
||||
+ }
|
||||
+
|
||||
+ return TRUE;
|
||||
+}
|
||||
+
|
||||
+#undef ASM_RDRAND
|
||||
+
|
||||
/**
|
||||
The constructor function checks whether or not RDRAND instruction is supported
|
||||
by the host hardware.
|
||||
@@ -48,10 +131,13 @@ BaseRngLibConstructor (
|
||||
// CPUID. A value of 1 indicates that processor support RDRAND instruction.
|
||||
//
|
||||
AsmCpuid (1, 0, 0, &RegEcx, 0);
|
||||
- ASSERT ((RegEcx & RDRAND_MASK) == RDRAND_MASK);
|
||||
|
||||
mRdRandSupported = ((RegEcx & RDRAND_MASK) == RDRAND_MASK);
|
||||
|
||||
+ if (mRdRandSupported) {
|
||||
+ mRdRandSupported = TestRdRand ();
|
||||
+ }
|
||||
+
|
||||
return EFI_SUCCESS;
|
||||
}
|
||||
|
||||
@@ -70,6 +156,7 @@ ArchGetRandomNumber16 (
|
||||
OUT UINT16 *Rand
|
||||
)
|
||||
{
|
||||
+ ASSERT (mRdRandSupported);
|
||||
return AsmRdRand16 (Rand);
|
||||
}
|
||||
|
||||
@@ -88,6 +175,7 @@ ArchGetRandomNumber32 (
|
||||
OUT UINT32 *Rand
|
||||
)
|
||||
{
|
||||
+ ASSERT (mRdRandSupported);
|
||||
return AsmRdRand32 (Rand);
|
||||
}
|
||||
|
||||
@@ -106,6 +194,7 @@ ArchGetRandomNumber64 (
|
||||
OUT UINT64 *Rand
|
||||
)
|
||||
{
|
||||
+ ASSERT (mRdRandSupported);
|
||||
return AsmRdRand64 (Rand);
|
||||
}
|
||||
|
||||
@@ -122,13 +211,7 @@ ArchIsRngSupported (
|
||||
VOID
|
||||
)
|
||||
{
|
||||
- /*
|
||||
- Existing software depends on this always returning TRUE, so for
|
||||
- now hard-code it.
|
||||
-
|
||||
- return mRdRandSupported;
|
||||
- */
|
||||
- return TRUE;
|
||||
+ return mRdRandSupported;
|
||||
}
|
||||
|
||||
/**
|
||||
@ -1,51 +0,0 @@
|
||||
From 87a3869f6d509e36d8c5dfe5a1bd8dea62195dab Mon Sep 17 00:00:00 2001
|
||||
From: Gerd Hoffmann <kraxel@redhat.com>
|
||||
Date: Fri, 23 Aug 2024 11:55:31 +0200
|
||||
Subject: [PATCH] OvmfPkg/PlatformInitLib: enable x2apic mode if needed
|
||||
|
||||
Enable x2apic mode in case the number of possible CPUs (including
|
||||
hotplug-able CPus which are not (yet) online) is larger than 255.
|
||||
|
||||
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
||||
(cherry picked from commit 8c8e05db24d8578cf87669e491f983fbd8357d55)
|
||||
---
|
||||
OvmfPkg/Library/PlatformInitLib/Platform.c | 6 ++++++
|
||||
OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf | 1 +
|
||||
2 files changed, 7 insertions(+)
|
||||
|
||||
diff --git a/OvmfPkg/Library/PlatformInitLib/Platform.c b/OvmfPkg/Library/PlatformInitLib/Platform.c
|
||||
index 715533b1f2..afe8b0abd6 100644
|
||||
--- a/OvmfPkg/Library/PlatformInitLib/Platform.c
|
||||
+++ b/OvmfPkg/Library/PlatformInitLib/Platform.c
|
||||
@@ -30,6 +30,7 @@
|
||||
#include <Library/QemuFwCfgS3Lib.h>
|
||||
#include <Library/QemuFwCfgSimpleParserLib.h>
|
||||
#include <Library/PciLib.h>
|
||||
+#include <Library/LocalApicLib.h>
|
||||
#include <Guid/SystemNvDataGuid.h>
|
||||
#include <Guid/VariableFormat.h>
|
||||
#include <OvmfPlatforms.h>
|
||||
@@ -720,6 +721,11 @@ PlatformMaxCpuCountInitialization (
|
||||
));
|
||||
ASSERT (BootCpuCount <= MaxCpuCount);
|
||||
|
||||
+ if (MaxCpuCount > 255) {
|
||||
+ DEBUG ((DEBUG_INFO, "%a: enable x2apic mode\n", __func__));
|
||||
+ SetApicMode (LOCAL_APIC_MODE_X2APIC);
|
||||
+ }
|
||||
+
|
||||
PlatformInfoHob->PcdCpuMaxLogicalProcessorNumber = MaxCpuCount;
|
||||
PlatformInfoHob->PcdCpuBootLogicalProcessorNumber = BootCpuCount;
|
||||
}
|
||||
diff --git a/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf b/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf
|
||||
index fb179e6791..c79b2ee106 100644
|
||||
--- a/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf
|
||||
+++ b/OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf
|
||||
@@ -48,6 +48,7 @@
|
||||
HobLib
|
||||
QemuFwCfgLib
|
||||
QemuFwCfgSimpleParserLib
|
||||
+ LocalApicLib
|
||||
MemEncryptSevLib
|
||||
MemoryAllocationLib
|
||||
MtrrLib
|
||||
@ -0,0 +1,43 @@
|
||||
From 4947d363211159647e9266fa20ad9d4c8bc52f71 Mon Sep 17 00:00:00 2001
|
||||
From: Gerd Hoffmann <kraxel@redhat.com>
|
||||
Date: Fri, 31 May 2024 09:49:13 +0200
|
||||
Subject: [PATCH] SecurityPkg/RngDxe: add rng test
|
||||
|
||||
Check whenever RngLib actually returns random numbers, only return
|
||||
a non-zero number of Algorithms if that is the case.
|
||||
|
||||
This has the effect that RndDxe loads and installs EFI_RNG_PROTOCOL
|
||||
only in case it can actually deliver random numbers.
|
||||
|
||||
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
||||
(cherry picked from commit a61bc0accb8a76edba4f073fdc7bafc908df045d)
|
||||
---
|
||||
SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c | 8 +++++++-
|
||||
1 file changed, 7 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
|
||||
index 5723ed6957..8b0742bab6 100644
|
||||
--- a/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
|
||||
+++ b/SecurityPkg/RandomNumberGenerator/RngDxe/Rand/RngDxe.c
|
||||
@@ -23,6 +23,7 @@
|
||||
|
||||
#include <Library/BaseLib.h>
|
||||
#include <Library/BaseMemoryLib.h>
|
||||
+#include <Library/RngLib.h>
|
||||
|
||||
#include "RngDxeInternals.h"
|
||||
|
||||
@@ -43,7 +44,12 @@ GetAvailableAlgorithms (
|
||||
VOID
|
||||
)
|
||||
{
|
||||
- mAvailableAlgoArrayCount = RNG_ALGORITHM_COUNT;
|
||||
+ UINT64 RngTest;
|
||||
+
|
||||
+ if (GetRandomNumber64 (&RngTest)) {
|
||||
+ mAvailableAlgoArrayCount = RNG_ALGORITHM_COUNT;
|
||||
+ }
|
||||
+
|
||||
return EFI_SUCCESS;
|
||||
}
|
||||
|
||||
@ -0,0 +1,301 @@
|
||||
From 0aa96c512c689426838ec1cf4aa78ff088c03a1e Mon Sep 17 00:00:00 2001
|
||||
From: Gerd Hoffmann <kraxel@redhat.com>
|
||||
Date: Fri, 24 May 2024 12:51:17 +0200
|
||||
Subject: [PATCH] OvmfPkg: wire up RngDxe
|
||||
|
||||
Add OvmfRng include snippets with the random number generator
|
||||
configuration for OVMF. Include RngDxe, build with BaseRngLib,
|
||||
so the rdrand instruction is used (if available).
|
||||
|
||||
Also move VirtioRng to the include snippets.
|
||||
|
||||
Use the new include snippets for OVMF builds.
|
||||
|
||||
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
||||
(cherry picked from commit 712797cf19acd292bf203522a79e40e7e13d268b)
|
||||
---
|
||||
OvmfPkg/AmdSev/AmdSevX64.dsc | 2 +-
|
||||
OvmfPkg/AmdSev/AmdSevX64.fdf | 2 +-
|
||||
OvmfPkg/Include/Dsc/OvmfRngComponents.dsc.inc | 9 +++++++++
|
||||
OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc | 6 ++++++
|
||||
OvmfPkg/IntelTdx/IntelTdxX64.dsc | 2 +-
|
||||
OvmfPkg/IntelTdx/IntelTdxX64.fdf | 2 +-
|
||||
OvmfPkg/Microvm/MicrovmX64.dsc | 2 +-
|
||||
OvmfPkg/Microvm/MicrovmX64.fdf | 2 +-
|
||||
OvmfPkg/OvmfPkgIa32.dsc | 2 +-
|
||||
OvmfPkg/OvmfPkgIa32.fdf | 2 +-
|
||||
OvmfPkg/OvmfPkgIa32X64.dsc | 2 +-
|
||||
OvmfPkg/OvmfPkgIa32X64.fdf | 2 +-
|
||||
OvmfPkg/OvmfPkgX64.dsc | 2 +-
|
||||
OvmfPkg/OvmfPkgX64.fdf | 2 +-
|
||||
14 files changed, 27 insertions(+), 12 deletions(-)
|
||||
create mode 100644 OvmfPkg/Include/Dsc/OvmfRngComponents.dsc.inc
|
||||
create mode 100644 OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc
|
||||
|
||||
diff --git a/OvmfPkg/AmdSev/AmdSevX64.dsc b/OvmfPkg/AmdSev/AmdSevX64.dsc
|
||||
index cf1ad83e09..4edc2a9069 100644
|
||||
--- a/OvmfPkg/AmdSev/AmdSevX64.dsc
|
||||
+++ b/OvmfPkg/AmdSev/AmdSevX64.dsc
|
||||
@@ -649,7 +649,6 @@
|
||||
OvmfPkg/Virtio10Dxe/Virtio10.inf
|
||||
OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
|
||||
OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
|
||||
- OvmfPkg/VirtioRngDxe/VirtioRng.inf
|
||||
!if $(PVSCSI_ENABLE) == TRUE
|
||||
OvmfPkg/PvScsiDxe/PvScsiDxe.inf
|
||||
!endif
|
||||
@@ -740,6 +739,7 @@
|
||||
OvmfPkg/AmdSev/Grub/Grub.inf
|
||||
|
||||
!include OvmfPkg/Include/Dsc/ShellComponents.dsc.inc
|
||||
+!include OvmfPkg/Include/Dsc/OvmfRngComponents.dsc.inc
|
||||
|
||||
OvmfPkg/PlatformDxe/Platform.inf
|
||||
OvmfPkg/AmdSevDxe/AmdSevDxe.inf {
|
||||
diff --git a/OvmfPkg/AmdSev/AmdSevX64.fdf b/OvmfPkg/AmdSev/AmdSevX64.fdf
|
||||
index c56c98dc85..480837b0fa 100644
|
||||
--- a/OvmfPkg/AmdSev/AmdSevX64.fdf
|
||||
+++ b/OvmfPkg/AmdSev/AmdSevX64.fdf
|
||||
@@ -227,7 +227,6 @@ INF OvmfPkg/VirtioPciDeviceDxe/VirtioPciDeviceDxe.inf
|
||||
INF OvmfPkg/Virtio10Dxe/Virtio10.inf
|
||||
INF OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
|
||||
INF OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
|
||||
-INF OvmfPkg/VirtioRngDxe/VirtioRng.inf
|
||||
!if $(PVSCSI_ENABLE) == TRUE
|
||||
INF OvmfPkg/PvScsiDxe/PvScsiDxe.inf
|
||||
!endif
|
||||
@@ -318,6 +317,7 @@ INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
|
||||
!include OvmfPkg/Include/Fdf/OvmfTpmDxe.fdf.inc
|
||||
|
||||
!include OvmfPkg/Include/Fdf/ShellDxe.fdf.inc
|
||||
+!include OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc
|
||||
|
||||
################################################################################
|
||||
|
||||
diff --git a/OvmfPkg/Include/Dsc/OvmfRngComponents.dsc.inc b/OvmfPkg/Include/Dsc/OvmfRngComponents.dsc.inc
|
||||
new file mode 100644
|
||||
index 0000000000..68839a0caa
|
||||
--- /dev/null
|
||||
+++ b/OvmfPkg/Include/Dsc/OvmfRngComponents.dsc.inc
|
||||
@@ -0,0 +1,9 @@
|
||||
+##
|
||||
+# SPDX-License-Identifier: BSD-2-Clause-Patent
|
||||
+##
|
||||
+
|
||||
+ SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf {
|
||||
+ <LibraryClasses>
|
||||
+ RngLib|MdePkg/Library/BaseRngLib/BaseRngLib.inf
|
||||
+ }
|
||||
+ OvmfPkg/VirtioRngDxe/VirtioRng.inf
|
||||
diff --git a/OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc b/OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc
|
||||
new file mode 100644
|
||||
index 0000000000..99cb4a32b1
|
||||
--- /dev/null
|
||||
+++ b/OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc
|
||||
@@ -0,0 +1,6 @@
|
||||
+##
|
||||
+# SPDX-License-Identifier: BSD-2-Clause-Patent
|
||||
+##
|
||||
+
|
||||
+INF SecurityPkg/RandomNumberGenerator/RngDxe/RngDxe.inf
|
||||
+INF OvmfPkg/VirtioRngDxe/VirtioRng.inf
|
||||
diff --git a/OvmfPkg/IntelTdx/IntelTdxX64.dsc b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
|
||||
index 9f49b60ff0..4b7e1596fc 100644
|
||||
--- a/OvmfPkg/IntelTdx/IntelTdxX64.dsc
|
||||
+++ b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
|
||||
@@ -636,7 +636,6 @@
|
||||
OvmfPkg/Virtio10Dxe/Virtio10.inf
|
||||
OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
|
||||
OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
|
||||
- OvmfPkg/VirtioRngDxe/VirtioRng.inf
|
||||
!if $(PVSCSI_ENABLE) == TRUE
|
||||
OvmfPkg/PvScsiDxe/PvScsiDxe.inf
|
||||
!endif
|
||||
@@ -719,6 +718,7 @@
|
||||
MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
|
||||
|
||||
!include OvmfPkg/Include/Dsc/ShellComponents.dsc.inc
|
||||
+!include OvmfPkg/Include/Dsc/OvmfRngComponents.dsc.inc
|
||||
|
||||
!if $(SECURE_BOOT_ENABLE) == TRUE
|
||||
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
|
||||
diff --git a/OvmfPkg/IntelTdx/IntelTdxX64.fdf b/OvmfPkg/IntelTdx/IntelTdxX64.fdf
|
||||
index ce5d542048..88d0f75ae2 100644
|
||||
--- a/OvmfPkg/IntelTdx/IntelTdxX64.fdf
|
||||
+++ b/OvmfPkg/IntelTdx/IntelTdxX64.fdf
|
||||
@@ -285,7 +285,6 @@ READ_LOCK_STATUS = TRUE
|
||||
#
|
||||
INF MdeModulePkg/Universal/EbcDxe/EbcDxe.inf
|
||||
INF OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
|
||||
-INF OvmfPkg/VirtioRngDxe/VirtioRng.inf
|
||||
!if $(PVSCSI_ENABLE) == TRUE
|
||||
INF OvmfPkg/PvScsiDxe/PvScsiDxe.inf
|
||||
!endif
|
||||
@@ -326,6 +325,7 @@ INF OvmfPkg/VirtioGpuDxe/VirtioGpu.inf
|
||||
INF OvmfPkg/PlatformDxe/Platform.inf
|
||||
|
||||
!include OvmfPkg/Include/Fdf/ShellDxe.fdf.inc
|
||||
+!include OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc
|
||||
|
||||
################################################################################
|
||||
|
||||
diff --git a/OvmfPkg/Microvm/MicrovmX64.dsc b/OvmfPkg/Microvm/MicrovmX64.dsc
|
||||
index fb73f2e089..9206f01816 100644
|
||||
--- a/OvmfPkg/Microvm/MicrovmX64.dsc
|
||||
+++ b/OvmfPkg/Microvm/MicrovmX64.dsc
|
||||
@@ -760,7 +760,6 @@
|
||||
OvmfPkg/Virtio10Dxe/Virtio10.inf
|
||||
OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
|
||||
OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
|
||||
- OvmfPkg/VirtioRngDxe/VirtioRng.inf
|
||||
OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
|
||||
MdeModulePkg/Universal/WatchdogTimerDxe/WatchdogTimer.inf
|
||||
MdeModulePkg/Universal/MonotonicCounterRuntimeDxe/MonotonicCounterRuntimeDxe.inf
|
||||
@@ -846,6 +845,7 @@
|
||||
MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf
|
||||
|
||||
!include OvmfPkg/Include/Dsc/ShellComponents.dsc.inc
|
||||
+!include OvmfPkg/Include/Dsc/OvmfRngComponents.dsc.inc
|
||||
|
||||
!if $(SECURE_BOOT_ENABLE) == TRUE
|
||||
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
|
||||
diff --git a/OvmfPkg/Microvm/MicrovmX64.fdf b/OvmfPkg/Microvm/MicrovmX64.fdf
|
||||
index 055e659a35..c8268d7e8c 100644
|
||||
--- a/OvmfPkg/Microvm/MicrovmX64.fdf
|
||||
+++ b/OvmfPkg/Microvm/MicrovmX64.fdf
|
||||
@@ -207,7 +207,6 @@ INF OvmfPkg/VirtioPciDeviceDxe/VirtioPciDeviceDxe.inf
|
||||
INF OvmfPkg/Virtio10Dxe/Virtio10.inf
|
||||
INF OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
|
||||
INF OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
|
||||
-INF OvmfPkg/VirtioRngDxe/VirtioRng.inf
|
||||
INF OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
|
||||
|
||||
!if $(SECURE_BOOT_ENABLE) == TRUE
|
||||
@@ -299,6 +298,7 @@ INF MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf
|
||||
INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
|
||||
|
||||
!include OvmfPkg/Include/Fdf/ShellDxe.fdf.inc
|
||||
+!include OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc
|
||||
|
||||
################################################################################
|
||||
|
||||
diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc
|
||||
index 65a866ae0c..b64c215585 100644
|
||||
--- a/OvmfPkg/OvmfPkgIa32.dsc
|
||||
+++ b/OvmfPkg/OvmfPkgIa32.dsc
|
||||
@@ -784,7 +784,6 @@
|
||||
OvmfPkg/Virtio10Dxe/Virtio10.inf
|
||||
OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
|
||||
OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
|
||||
- OvmfPkg/VirtioRngDxe/VirtioRng.inf
|
||||
OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
|
||||
!if $(PVSCSI_ENABLE) == TRUE
|
||||
OvmfPkg/PvScsiDxe/PvScsiDxe.inf
|
||||
@@ -888,6 +887,7 @@
|
||||
|
||||
!include OvmfPkg/Include/Dsc/ShellComponents.dsc.inc
|
||||
!include OvmfPkg/Include/Dsc/MorLock.dsc.inc
|
||||
+!include OvmfPkg/Include/Dsc/OvmfRngComponents.dsc.inc
|
||||
|
||||
!if $(SECURE_BOOT_ENABLE) == TRUE
|
||||
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
|
||||
diff --git a/OvmfPkg/OvmfPkgIa32.fdf b/OvmfPkg/OvmfPkgIa32.fdf
|
||||
index 10eb6fe72b..c31276e4a3 100644
|
||||
--- a/OvmfPkg/OvmfPkgIa32.fdf
|
||||
+++ b/OvmfPkg/OvmfPkgIa32.fdf
|
||||
@@ -231,7 +231,6 @@ INF OvmfPkg/VirtioPciDeviceDxe/VirtioPciDeviceDxe.inf
|
||||
INF OvmfPkg/Virtio10Dxe/Virtio10.inf
|
||||
INF OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
|
||||
INF OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
|
||||
-INF OvmfPkg/VirtioRngDxe/VirtioRng.inf
|
||||
INF OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
|
||||
!if $(PVSCSI_ENABLE) == TRUE
|
||||
INF OvmfPkg/PvScsiDxe/PvScsiDxe.inf
|
||||
@@ -356,6 +355,7 @@ INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
|
||||
|
||||
!include OvmfPkg/Include/Fdf/ShellDxe.fdf.inc
|
||||
!include OvmfPkg/Include/Fdf/MorLock.fdf.inc
|
||||
+!include OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc
|
||||
|
||||
!if $(LOAD_X64_ON_IA32_ENABLE) == TRUE
|
||||
INF OvmfPkg/CompatImageLoaderDxe/CompatImageLoaderDxe.inf
|
||||
diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc
|
||||
index 679e25501b..ececac3757 100644
|
||||
--- a/OvmfPkg/OvmfPkgIa32X64.dsc
|
||||
+++ b/OvmfPkg/OvmfPkgIa32X64.dsc
|
||||
@@ -798,7 +798,6 @@
|
||||
OvmfPkg/Virtio10Dxe/Virtio10.inf
|
||||
OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
|
||||
OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
|
||||
- OvmfPkg/VirtioRngDxe/VirtioRng.inf
|
||||
OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
|
||||
!if $(PVSCSI_ENABLE) == TRUE
|
||||
OvmfPkg/PvScsiDxe/PvScsiDxe.inf
|
||||
@@ -902,6 +901,7 @@
|
||||
|
||||
!include OvmfPkg/Include/Dsc/ShellComponents.dsc.inc
|
||||
!include OvmfPkg/Include/Dsc/MorLock.dsc.inc
|
||||
+!include OvmfPkg/Include/Dsc/OvmfRngComponents.dsc.inc
|
||||
|
||||
!if $(SECURE_BOOT_ENABLE) == TRUE
|
||||
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
|
||||
diff --git a/OvmfPkg/OvmfPkgIa32X64.fdf b/OvmfPkg/OvmfPkgIa32X64.fdf
|
||||
index ff06bbfc6f..a7b4aeac08 100644
|
||||
--- a/OvmfPkg/OvmfPkgIa32X64.fdf
|
||||
+++ b/OvmfPkg/OvmfPkgIa32X64.fdf
|
||||
@@ -232,7 +232,6 @@ INF OvmfPkg/VirtioPciDeviceDxe/VirtioPciDeviceDxe.inf
|
||||
INF OvmfPkg/Virtio10Dxe/Virtio10.inf
|
||||
INF OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
|
||||
INF OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
|
||||
-INF OvmfPkg/VirtioRngDxe/VirtioRng.inf
|
||||
INF OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
|
||||
!if $(PVSCSI_ENABLE) == TRUE
|
||||
INF OvmfPkg/PvScsiDxe/PvScsiDxe.inf
|
||||
@@ -363,6 +362,7 @@ INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
|
||||
|
||||
!include OvmfPkg/Include/Fdf/ShellDxe.fdf.inc
|
||||
!include OvmfPkg/Include/Fdf/MorLock.fdf.inc
|
||||
+!include OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc
|
||||
|
||||
################################################################################
|
||||
|
||||
diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
|
||||
index d294fd4625..0ab4d3df06 100644
|
||||
--- a/OvmfPkg/OvmfPkgX64.dsc
|
||||
+++ b/OvmfPkg/OvmfPkgX64.dsc
|
||||
@@ -866,7 +866,6 @@
|
||||
OvmfPkg/Virtio10Dxe/Virtio10.inf
|
||||
OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
|
||||
OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
|
||||
- OvmfPkg/VirtioRngDxe/VirtioRng.inf
|
||||
OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
|
||||
!if $(PVSCSI_ENABLE) == TRUE
|
||||
OvmfPkg/PvScsiDxe/PvScsiDxe.inf
|
||||
@@ -970,6 +969,7 @@
|
||||
|
||||
!include OvmfPkg/Include/Dsc/ShellComponents.dsc.inc
|
||||
!include OvmfPkg/Include/Dsc/MorLock.dsc.inc
|
||||
+!include OvmfPkg/Include/Dsc/OvmfRngComponents.dsc.inc
|
||||
|
||||
!if $(SECURE_BOOT_ENABLE) == TRUE
|
||||
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
|
||||
diff --git a/OvmfPkg/OvmfPkgX64.fdf b/OvmfPkg/OvmfPkgX64.fdf
|
||||
index f3b787201f..ae08ac4fe9 100644
|
||||
--- a/OvmfPkg/OvmfPkgX64.fdf
|
||||
+++ b/OvmfPkg/OvmfPkgX64.fdf
|
||||
@@ -263,7 +263,6 @@ INF OvmfPkg/VirtioPciDeviceDxe/VirtioPciDeviceDxe.inf
|
||||
INF OvmfPkg/Virtio10Dxe/Virtio10.inf
|
||||
INF OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
|
||||
INF OvmfPkg/VirtioScsiDxe/VirtioScsi.inf
|
||||
-INF OvmfPkg/VirtioRngDxe/VirtioRng.inf
|
||||
INF OvmfPkg/VirtioSerialDxe/VirtioSerial.inf
|
||||
!if $(PVSCSI_ENABLE) == TRUE
|
||||
INF OvmfPkg/PvScsiDxe/PvScsiDxe.inf
|
||||
@@ -403,6 +402,7 @@ INF OvmfPkg/Tcg/TdTcg2Dxe/TdTcg2Dxe.inf
|
||||
|
||||
!include OvmfPkg/Include/Fdf/ShellDxe.fdf.inc
|
||||
!include OvmfPkg/Include/Fdf/MorLock.fdf.inc
|
||||
+!include OvmfPkg/Include/Fdf/OvmfRngDxe.fdf.inc
|
||||
|
||||
################################################################################
|
||||
|
||||
@ -0,0 +1,37 @@
|
||||
From d5d19043e62a268a492f9a1ef6a11380d8f7e784 Mon Sep 17 00:00:00 2001
|
||||
From: Gerd Hoffmann <kraxel@redhat.com>
|
||||
Date: Fri, 14 Jun 2024 11:45:49 +0200
|
||||
Subject: [PATCH] CryptoPkg/Test: call ProcessLibraryConstructorList
|
||||
|
||||
Needed to properly initialize BaseRngLib.
|
||||
|
||||
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
||||
(cherry picked from commit 94961b8817eec6f8d0434555ac50a7aa51c22201)
|
||||
---
|
||||
.../Test/UnitTest/Library/BaseCryptLib/UnitTestMain.c | 7 +++++++
|
||||
1 file changed, 7 insertions(+)
|
||||
|
||||
diff --git a/CryptoPkg/Test/UnitTest/Library/BaseCryptLib/UnitTestMain.c b/CryptoPkg/Test/UnitTest/Library/BaseCryptLib/UnitTestMain.c
|
||||
index d0c1c7a4f7..48d463b8ad 100644
|
||||
--- a/CryptoPkg/Test/UnitTest/Library/BaseCryptLib/UnitTestMain.c
|
||||
+++ b/CryptoPkg/Test/UnitTest/Library/BaseCryptLib/UnitTestMain.c
|
||||
@@ -8,6 +8,12 @@
|
||||
**/
|
||||
#include "TestBaseCryptLib.h"
|
||||
|
||||
+VOID
|
||||
+EFIAPI
|
||||
+ProcessLibraryConstructorList (
|
||||
+ VOID
|
||||
+ );
|
||||
+
|
||||
/**
|
||||
Initialize the unit test framework, suite, and unit tests for the
|
||||
sample unit tests and run the unit tests.
|
||||
@@ -76,5 +82,6 @@ main (
|
||||
char *argv[]
|
||||
)
|
||||
{
|
||||
+ ProcessLibraryConstructorList ();
|
||||
return UefiTestMain ();
|
||||
}
|
||||
@ -0,0 +1,43 @@
|
||||
From 320207a3df995771af36639c7bdf89c4203cf1c2 Mon Sep 17 00:00:00 2001
|
||||
From: Gerd Hoffmann <kraxel@redhat.com>
|
||||
Date: Fri, 14 Jun 2024 11:45:53 +0200
|
||||
Subject: [PATCH] MdePkg/X86UnitTestHost: set rdrand cpuid bit
|
||||
|
||||
Set the rdrand feature bit when faking cpuid for host test cases.
|
||||
Needed to make the CryptoPkg test cases work.
|
||||
|
||||
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
||||
(cherry picked from commit 5e776299a2604b336a947e68593012ab2cc16eb4)
|
||||
---
|
||||
MdePkg/Library/BaseLib/X86UnitTestHost.c | 11 ++++++++++-
|
||||
1 file changed, 10 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/MdePkg/Library/BaseLib/X86UnitTestHost.c b/MdePkg/Library/BaseLib/X86UnitTestHost.c
|
||||
index 8ba4f54a38..7f7276f7f4 100644
|
||||
--- a/MdePkg/Library/BaseLib/X86UnitTestHost.c
|
||||
+++ b/MdePkg/Library/BaseLib/X86UnitTestHost.c
|
||||
@@ -66,6 +66,15 @@ UnitTestHostBaseLibAsmCpuid (
|
||||
OUT UINT32 *Edx OPTIONAL
|
||||
)
|
||||
{
|
||||
+ UINT32 RetEcx;
|
||||
+
|
||||
+ RetEcx = 0;
|
||||
+ switch (Index) {
|
||||
+ case 1:
|
||||
+ RetEcx |= BIT30; /* RdRand */
|
||||
+ break;
|
||||
+ }
|
||||
+
|
||||
if (Eax != NULL) {
|
||||
*Eax = 0;
|
||||
}
|
||||
@@ -75,7 +84,7 @@ UnitTestHostBaseLibAsmCpuid (
|
||||
}
|
||||
|
||||
if (Ecx != NULL) {
|
||||
- *Ecx = 0;
|
||||
+ *Ecx = RetEcx;
|
||||
}
|
||||
|
||||
if (Edx != NULL) {
|
||||
@ -0,0 +1,63 @@
|
||||
From 481310a21104aba17bc0cddd236ecdf69d4ba662 Mon Sep 17 00:00:00 2001
|
||||
From: Oliver Steffen <osteffen@redhat.com>
|
||||
Date: Mon, 26 Aug 2024 19:25:52 +0200
|
||||
Subject: [PATCH] AmdSevDxe: Fix the shim fallback reboot workaround for SNP
|
||||
|
||||
RH-Author: Oliver Steffen <osteffen@redhat.com>
|
||||
RH-MergeRequest: 68: AmdSevDxe: Fix the shim fallback reboot workaround for SNP
|
||||
RH-Jira: RHEL-56081
|
||||
RH-Acked-by: Gerd Hoffmann <None>
|
||||
RH-Commit: [1/1] ab8678b61d171f9c19459e034483437b29037b4b (osteffen/edk2)
|
||||
|
||||
The shim fallback reboot workaround (introduced for SEV-ES) does
|
||||
not always work for SEV-SNP, due to a conditional early return.
|
||||
|
||||
Let's just register the workaround earlier in this function to
|
||||
fix that.
|
||||
|
||||
Signed-off-by: Oliver Steffen <osteffen@redhat.com>
|
||||
---
|
||||
OvmfPkg/AmdSevDxe/AmdSevDxe.c | 21 +++++++++++----------
|
||||
1 file changed, 11 insertions(+), 10 deletions(-)
|
||||
|
||||
diff --git a/OvmfPkg/AmdSevDxe/AmdSevDxe.c b/OvmfPkg/AmdSevDxe/AmdSevDxe.c
|
||||
index 0eb88e50ff..ca345e95da 100644
|
||||
--- a/OvmfPkg/AmdSevDxe/AmdSevDxe.c
|
||||
+++ b/OvmfPkg/AmdSevDxe/AmdSevDxe.c
|
||||
@@ -243,6 +243,17 @@ AmdSevDxeEntryPoint (
|
||||
return EFI_UNSUPPORTED;
|
||||
}
|
||||
|
||||
+ // Shim fallback reboot workaround
|
||||
+ Status = gBS->CreateEventEx (
|
||||
+ EVT_NOTIFY_SIGNAL,
|
||||
+ TPL_CALLBACK,
|
||||
+ PopulateVarstore,
|
||||
+ SystemTable,
|
||||
+ &gEfiEndOfDxeEventGroupGuid,
|
||||
+ &PopulateVarstoreEvent
|
||||
+ );
|
||||
+ ASSERT_EFI_ERROR (Status);
|
||||
+
|
||||
//
|
||||
// Iterate through the GCD map and clear the C-bit from MMIO and NonExistent
|
||||
// memory space. The NonExistent memory space will be used for mapping the
|
||||
@@ -393,15 +404,5 @@ AmdSevDxeEntryPoint (
|
||||
);
|
||||
}
|
||||
|
||||
- Status = gBS->CreateEventEx (
|
||||
- EVT_NOTIFY_SIGNAL,
|
||||
- TPL_CALLBACK,
|
||||
- PopulateVarstore,
|
||||
- SystemTable,
|
||||
- &gEfiEndOfDxeEventGroupGuid,
|
||||
- &PopulateVarstoreEvent
|
||||
- );
|
||||
- ASSERT_EFI_ERROR (Status);
|
||||
-
|
||||
return EFI_SUCCESS;
|
||||
}
|
||||
--
|
||||
2.39.3
|
||||
|
||||
@ -0,0 +1,43 @@
|
||||
From 880c1ca7420b873c5f81563b122d7bd1ebad72cb Mon Sep 17 00:00:00 2001
|
||||
From: Oliver Steffen <osteffen@redhat.com>
|
||||
Date: Mon, 4 Mar 2024 15:32:58 +0100
|
||||
Subject: [PATCH] MdeModulePkg: Warn if out of flash space when writing
|
||||
variables
|
||||
|
||||
RH-Author: Oliver Steffen <osteffen@redhat.com>
|
||||
RH-MergeRequest: 64: MdeModulePkg: Warn if out of flash space when writing variables
|
||||
RH-Jira: RHEL-43442
|
||||
RH-Acked-by: Gerd Hoffmann <None>
|
||||
RH-Commit: [1/1] b65130800090192f47f13d67ff14f902a4f5bfb5 (osteffen/edk2)
|
||||
|
||||
Emit a DEBUG_WARN message if there is not enough flash space left to
|
||||
write/update a variable. This condition is currently not logged
|
||||
appropriately in all cases, given that full variable store can easily
|
||||
render the system unbootable.
|
||||
This new message helps identifying this condition.
|
||||
|
||||
Signed-off-by: Oliver Steffen <osteffen@redhat.com>
|
||||
Reviewed-by: Laszlo Ersek <lersek@redhat.com>
|
||||
Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
|
||||
(cherry picked from commit 80b59ff8320d1bd134bf689fe9c0ddf4e0473b88)
|
||||
Signed-off-by: Oliver Steffen <osteffen@redhat.com>
|
||||
---
|
||||
MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c | 2 ++
|
||||
1 file changed, 2 insertions(+)
|
||||
|
||||
diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c b/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c
|
||||
index d394d237a5..1c7659031d 100644
|
||||
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c
|
||||
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c
|
||||
@@ -2364,6 +2364,8 @@ Done:
|
||||
);
|
||||
ASSERT_EFI_ERROR (Status);
|
||||
}
|
||||
+ } else if (Status == EFI_OUT_OF_RESOURCES) {
|
||||
+ DEBUG ((DEBUG_WARN, "UpdateVariable failed: Out of flash space\n"));
|
||||
}
|
||||
|
||||
return Status;
|
||||
--
|
||||
2.39.3
|
||||
|
||||
@ -0,0 +1,50 @@
|
||||
From 10d25d4d502e419476c3846e0243bbf6be24d8e4 Mon Sep 17 00:00:00 2001
|
||||
From: Jon Maloy <jmaloy@redhat.com>
|
||||
Date: Tue, 1 Oct 2024 18:40:41 -0400
|
||||
Subject: [PATCH] MdePkg: Fix overflow issue in BasePeCoffLib
|
||||
|
||||
RH-Author: Jon Maloy <jmaloy@redhat.com>
|
||||
RH-MergeRequest: 95: MdePkg: Fix overflow issue in BasePeCoffLib
|
||||
RH-Jira: RHEL-60831
|
||||
RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
|
||||
RH-Commit: [1/1] 2f345a9e5f277598a78edc1aab33c6acc96c6caa
|
||||
|
||||
JIRA: https://issues.redhat.com/browse/RHEL-60831
|
||||
CVE: CVE-2024-38796
|
||||
Upstream: Merged
|
||||
|
||||
commit c95233b8525ca6828921affd1496146cff262e65
|
||||
Author: Doug Flick <dougflick@microsoft.com>
|
||||
Date: Fri Sep 27 12:08:55 2024 -0700
|
||||
|
||||
MdePkg: Fix overflow issue in BasePeCoffLib
|
||||
|
||||
The RelocDir->Size is a UINT32 value, and RelocDir->VirtualAddress is
|
||||
also a UINT32 value. The current code does not check for overflow when
|
||||
adding RelocDir->Size to RelocDir->VirtualAddress. This patch adds a
|
||||
check to ensure that the addition does not overflow.
|
||||
|
||||
Signed-off-by: Doug Flick <dougflick@microsoft.com>
|
||||
Authored-by: sriraamx gobichettipalayam <sri..@intel.com>
|
||||
|
||||
Signed-off-by: Jon Maloy <jmaloy@redhat.com>
|
||||
---
|
||||
MdePkg/Library/BasePeCoffLib/BasePeCoff.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/MdePkg/Library/BasePeCoffLib/BasePeCoff.c b/MdePkg/Library/BasePeCoffLib/BasePeCoff.c
|
||||
index 86ff2e769b..128090d98e 100644
|
||||
--- a/MdePkg/Library/BasePeCoffLib/BasePeCoff.c
|
||||
+++ b/MdePkg/Library/BasePeCoffLib/BasePeCoff.c
|
||||
@@ -1054,7 +1054,7 @@ PeCoffLoaderRelocateImage (
|
||||
RelocDir = &Hdr.Te->DataDirectory[0];
|
||||
}
|
||||
|
||||
- if ((RelocDir != NULL) && (RelocDir->Size > 0)) {
|
||||
+ if ((RelocDir != NULL) && (RelocDir->Size > 0) && (RelocDir->Size - 1 < MAX_UINT32 - RelocDir->VirtualAddress)) {
|
||||
RelocBase = (EFI_IMAGE_BASE_RELOCATION *)PeCoffLoaderImageAddress (ImageContext, RelocDir->VirtualAddress, TeStrippedOffset);
|
||||
RelocBaseEnd = (EFI_IMAGE_BASE_RELOCATION *)PeCoffLoaderImageAddress (
|
||||
ImageContext,
|
||||
--
|
||||
2.39.3
|
||||
|
||||
@ -0,0 +1,48 @@
|
||||
From 7cbd00792445ad50e861e4835cdb5ba60466aae3 Mon Sep 17 00:00:00 2001
|
||||
From: Gerd Hoffmann <kraxel@redhat.com>
|
||||
Date: Wed, 19 Jun 2024 09:07:56 +0200
|
||||
Subject: [PATCH 1/2] NetworkPkg/DxeNetLib: adjust PseudoRandom error logging
|
||||
|
||||
RH-Author: Oliver Steffen <osteffen@redhat.com>
|
||||
RH-MergeRequest: 67: NetworkPkg/DxeNetLib: adjust PseudoRandom error logging
|
||||
RH-Jira: RHEL-45899
|
||||
RH-Commit: [1/2] 15135d672cef4310cb29f8a55146f36b2ee1f15d (osteffen/edk2)
|
||||
|
||||
There is a list of allowed rng algorithms, if /one/ of them is not
|
||||
supported this is not a problem, only /all/ of them failing is an
|
||||
error condition.
|
||||
|
||||
Downgrade the message for a single unsupported algorithm from ERROR to
|
||||
VERBOSE. Add an error message in case we finish the loop without
|
||||
finding a supported algorithm.
|
||||
|
||||
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
||||
(cherry picked from commit 6862b9d538d96363635677198899e1669e591259)
|
||||
---
|
||||
NetworkPkg/Library/DxeNetLib/DxeNetLib.c | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/NetworkPkg/Library/DxeNetLib/DxeNetLib.c b/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
|
||||
index 01c13c08d2..4dfbe91a55 100644
|
||||
--- a/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
|
||||
+++ b/NetworkPkg/Library/DxeNetLib/DxeNetLib.c
|
||||
@@ -951,7 +951,7 @@ PseudoRandom (
|
||||
//
|
||||
// Secure Algorithm was not supported on this platform
|
||||
//
|
||||
- DEBUG ((DEBUG_ERROR, "Failed to generate random data using secure algorithm %d: %r\n", AlgorithmIndex, Status));
|
||||
+ DEBUG ((DEBUG_VERBOSE, "Failed to generate random data using secure algorithm %d: %r\n", AlgorithmIndex, Status));
|
||||
|
||||
//
|
||||
// Try the next secure algorithm
|
||||
@@ -971,6 +971,7 @@ PseudoRandom (
|
||||
// If we get here, we failed to generate random data using any secure algorithm
|
||||
// Platform owner should ensure that at least one secure algorithm is supported
|
||||
//
|
||||
+ DEBUG ((DEBUG_ERROR, "Failed to generate random data, no supported secure algorithm found\n"));
|
||||
ASSERT_EFI_ERROR (Status);
|
||||
return Status;
|
||||
}
|
||||
--
|
||||
2.39.3
|
||||
|
||||
@ -0,0 +1,46 @@
|
||||
From 33ebaa6f0d476008ca6ba264657ac37faf63b723 Mon Sep 17 00:00:00 2001
|
||||
From: Gerd Hoffmann <kraxel@redhat.com>
|
||||
Date: Thu, 29 Aug 2024 09:20:29 +0200
|
||||
Subject: [PATCH 1/2] OvmfPkg/CpuHotplugSmm: delay SMM exit
|
||||
|
||||
RH-Author: Gerd Hoffmann <None>
|
||||
RH-MergeRequest: 74: OvmfPkg/CpuHotplugSmm: delay SMM exit
|
||||
RH-Jira: RHEL-56974
|
||||
RH-Acked-by: Oliver Steffen <osteffen@redhat.com>
|
||||
RH-Commit: [1/1] e1fb3f4db68457ec9f59ca5db47606bf4c34e6c5 (kraxel.rh/centos-src-edk2)
|
||||
|
||||
Let APs wait until the BSP has completed the register updates to remove
|
||||
the CPU. This makes sure all APs stay in SMM mode until the CPU
|
||||
hot-unplug operation is complete, which in turn makes sure the ACPI lock
|
||||
is released only after the CPU hot-unplug operation is complete.
|
||||
|
||||
Some background: The CPU hotplug SMI is triggered from an ACPI function
|
||||
which is protected by an ACPI lock. The ACPI function is in the ACPI
|
||||
tables generated by qemu.
|
||||
|
||||
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
||||
|
||||
upstream: submitted (https://github.com/tianocore/edk2/pull/6138)
|
||||
---
|
||||
OvmfPkg/CpuHotplugSmm/CpuHotplug.c | 5 +++++
|
||||
1 file changed, 5 insertions(+)
|
||||
|
||||
diff --git a/OvmfPkg/CpuHotplugSmm/CpuHotplug.c b/OvmfPkg/CpuHotplugSmm/CpuHotplug.c
|
||||
index d504163026..5af78211d3 100644
|
||||
--- a/OvmfPkg/CpuHotplugSmm/CpuHotplug.c
|
||||
+++ b/OvmfPkg/CpuHotplugSmm/CpuHotplug.c
|
||||
@@ -355,6 +355,11 @@ EjectCpu (
|
||||
//
|
||||
QemuSelector = mCpuHotEjectData->QemuSelectorMap[ProcessorNum];
|
||||
if (QemuSelector == CPU_EJECT_QEMU_SELECTOR_INVALID) {
|
||||
+ /* wait until BSP is done */
|
||||
+ while (mCpuHotEjectData->Handler != NULL) {
|
||||
+ CpuPause ();
|
||||
+ }
|
||||
+
|
||||
return;
|
||||
}
|
||||
|
||||
--
|
||||
2.39.3
|
||||
|
||||
@ -0,0 +1,142 @@
|
||||
From c4aa4797fafa3a627205eaa346401e399d4a7146 Mon Sep 17 00:00:00 2001
|
||||
From: Gerd Hoffmann <kraxel@redhat.com>
|
||||
Date: Tue, 27 Aug 2024 12:06:15 +0200
|
||||
Subject: [PATCH] UefiCpuPkg/PiSmmCpuDxeSmm: skip PatchInstructionX86 calls if
|
||||
not needed.
|
||||
|
||||
RH-Author: Oliver Steffen <osteffen@redhat.com>
|
||||
RH-MergeRequest: 71: UefiCpuPkg/PiSmmCpuDxeSmm: skip PatchInstructionX86 calls if not needed.
|
||||
RH-Jira: RHEL-45847
|
||||
RH-Acked-by: Gerd Hoffmann <None>
|
||||
RH-Commit: [1/1] 70ceffb2c1e695276af87d3aa334fe9be8e2e90e (osteffen/edk2)
|
||||
|
||||
Add the new global mMsrIa32MiscEnableSupported variable to track
|
||||
whenever support for the IA32_MISC_ENABLE MSR is present or not.
|
||||
|
||||
Add new local PatchingNeeded variable to CheckFeatureSupported()
|
||||
to track if patching the SMM setup code is needed or not.
|
||||
|
||||
Issue PatchInstructionX86() calls only if needed, i.e. if one of
|
||||
the *Supported variables has been updated.
|
||||
|
||||
Result is that on a typical SMP machine where all processors are
|
||||
identical the PatchInstructionX86() calls are issued only once,
|
||||
when checking the first processor. Specifically this avoids
|
||||
PatchInstructionX86() being called in OVMF on CPU hotplug. That
|
||||
is important because instruction patching at runtime does not not
|
||||
work and leads to page faults.
|
||||
|
||||
This fixes CPU hotplug on OVMF not working with AMD cpus.
|
||||
|
||||
Fixes: 6b3a89a9fdb5 ("OvmfPkg/PlatformPei: Relocate SmBases in PEI phase")
|
||||
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
|
||||
(cherry picked from commit 17ff8960848b2cb2e49fffb3dfbacd08865786a4)
|
||||
---
|
||||
UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.c | 49 +++++++++++++++++++++-----
|
||||
1 file changed, 40 insertions(+), 9 deletions(-)
|
||||
|
||||
diff --git a/UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.c b/UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.c
|
||||
index 8142d3ceac..8e299fd29a 100644
|
||||
--- a/UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.c
|
||||
+++ b/UefiCpuPkg/PiSmmCpuDxeSmm/SmmProfile.c
|
||||
@@ -40,6 +40,11 @@ BOOLEAN mXdEnabled = FALSE;
|
||||
//
|
||||
BOOLEAN mBtsSupported = TRUE;
|
||||
|
||||
+//
|
||||
+// The flag indicates if MSR_IA32_MISC_ENABLE is supported by processor
|
||||
+//
|
||||
+BOOLEAN mMsrIa32MiscEnableSupported = TRUE;
|
||||
+
|
||||
//
|
||||
// The flag indicates if SMM profile starts to record data.
|
||||
//
|
||||
@@ -904,18 +909,23 @@ CheckFeatureSupported (
|
||||
UINT32 RegEcx;
|
||||
UINT32 RegEdx;
|
||||
MSR_IA32_MISC_ENABLE_REGISTER MiscEnableMsr;
|
||||
+ BOOLEAN PatchingNeeded = FALSE;
|
||||
|
||||
if ((PcdGet32 (PcdControlFlowEnforcementPropertyMask) != 0) && mCetSupported) {
|
||||
AsmCpuid (CPUID_SIGNATURE, &RegEax, NULL, NULL, NULL);
|
||||
if (RegEax >= CPUID_STRUCTURED_EXTENDED_FEATURE_FLAGS) {
|
||||
AsmCpuidEx (CPUID_STRUCTURED_EXTENDED_FEATURE_FLAGS, CPUID_STRUCTURED_EXTENDED_FEATURE_FLAGS_SUB_LEAF_INFO, NULL, NULL, &RegEcx, NULL);
|
||||
if ((RegEcx & CPUID_CET_SS) == 0) {
|
||||
- mCetSupported = FALSE;
|
||||
- PatchInstructionX86 (mPatchCetSupported, mCetSupported, 1);
|
||||
+ if (mCetSupported) {
|
||||
+ mCetSupported = FALSE;
|
||||
+ PatchingNeeded = TRUE;
|
||||
+ }
|
||||
}
|
||||
} else {
|
||||
- mCetSupported = FALSE;
|
||||
- PatchInstructionX86 (mPatchCetSupported, mCetSupported, 1);
|
||||
+ if (mCetSupported) {
|
||||
+ mCetSupported = FALSE;
|
||||
+ PatchingNeeded = TRUE;
|
||||
+ }
|
||||
}
|
||||
}
|
||||
|
||||
@@ -925,8 +935,10 @@ CheckFeatureSupported (
|
||||
//
|
||||
// Extended CPUID functions are not supported on this processor.
|
||||
//
|
||||
- mXdSupported = FALSE;
|
||||
- PatchInstructionX86 (gPatchXdSupported, mXdSupported, 1);
|
||||
+ if (mXdSupported) {
|
||||
+ mXdSupported = FALSE;
|
||||
+ PatchingNeeded = TRUE;
|
||||
+ }
|
||||
}
|
||||
|
||||
AsmCpuid (CPUID_EXTENDED_CPU_SIG, NULL, NULL, NULL, &RegEdx);
|
||||
@@ -934,15 +946,20 @@ CheckFeatureSupported (
|
||||
//
|
||||
// Execute Disable Bit feature is not supported on this processor.
|
||||
//
|
||||
- mXdSupported = FALSE;
|
||||
- PatchInstructionX86 (gPatchXdSupported, mXdSupported, 1);
|
||||
+ if (mXdSupported) {
|
||||
+ mXdSupported = FALSE;
|
||||
+ PatchingNeeded = TRUE;
|
||||
+ }
|
||||
}
|
||||
|
||||
if (StandardSignatureIsAuthenticAMD ()) {
|
||||
//
|
||||
// AMD processors do not support MSR_IA32_MISC_ENABLE
|
||||
//
|
||||
- PatchInstructionX86 (gPatchMsrIa32MiscEnableSupported, FALSE, 1);
|
||||
+ if (mMsrIa32MiscEnableSupported) {
|
||||
+ mMsrIa32MiscEnableSupported = FALSE;
|
||||
+ PatchingNeeded = TRUE;
|
||||
+ }
|
||||
}
|
||||
}
|
||||
|
||||
@@ -966,6 +983,20 @@ CheckFeatureSupported (
|
||||
}
|
||||
}
|
||||
}
|
||||
+
|
||||
+ if (PatchingNeeded) {
|
||||
+ if (!mCetSupported) {
|
||||
+ PatchInstructionX86 (mPatchCetSupported, mCetSupported, 1);
|
||||
+ }
|
||||
+
|
||||
+ if (!mXdSupported) {
|
||||
+ PatchInstructionX86 (gPatchXdSupported, mXdSupported, 1);
|
||||
+ }
|
||||
+
|
||||
+ if (!mMsrIa32MiscEnableSupported) {
|
||||
+ PatchInstructionX86 (gPatchMsrIa32MiscEnableSupported, FALSE, 1);
|
||||
+ }
|
||||
+ }
|
||||
}
|
||||
|
||||
/**
|
||||
--
|
||||
2.39.3
|
||||
|
||||
File diff suppressed because it is too large
Load Diff
Loading…
Reference in new issue