OvmfPkg/IntelTdx: Enable separate-fv in IntelTdx/IntelTdxX64.fdf

BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4152

In current DXE FV there are 100+ drivers. Some of the drivers are not
used in Td guest. (Such as USB support drivers, network related drivers,
etc).

From the security perspective if a driver is not used, we'd should prevent
it from being loaded / started. There are 2 benefits:
1. Reduce the attack surface
2. Improve the boot performance

So we separate DXEFV into 2 FVs: DXEFV and NCCFV. All the drivers which
are not needed by a Confidential Computing guest are moved from DXEFV
to NCCFV.

The following patch will find NCCFV for non-cc guest and build FVHob
so that NCCFV drivers can be loaded / started in DXE phase.

Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Erdem Aktas <erdemaktas@google.com>
Cc: James Bottomley <jejb@linux.ibm.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Min Xu <min.m.xu@intel.com>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>

1 files changed, 10 insertions, 1 deletions

diff --git a/OvmfPkg/IntelTdx/IntelTdxX64.dsc b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
index 81511e3556..0f1e970fbb 100644
--- a/OvmfPkg/IntelTdx/IntelTdxX64.dsc
+++ b/OvmfPkg/IntelTdx/IntelTdxX64.dsc
@@ -32,6 +32,11 @@
   DEFINE SECURE_BOOT_ENABLE      = FALSE

 

   #

+  # Shell can be useful for debugging but should not be enabled for production

+  #

+  DEFINE BUILD_SHELL             = TRUE

+

+  #

   # Device drivers

   #

   DEFINE PVSCSI_ENABLE           = FALSE

@@ -204,7 +209,9 @@
   VariablePolicyHelperLib|MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf

   VariableFlashInfoLib|MdeModulePkg/Library/BaseVariableFlashInfoLib/BaseVariableFlashInfoLib.inf

 

+!if $(BUILD_SHELL) == TRUE

   ShellLib|ShellPkg/Library/UefiShellLib/UefiShellLib.inf

+!endif

   ShellCEntryLib|ShellPkg/Library/UefiShellCEntryLib/UefiShellCEntryLib.inf

   S3BootScriptLib|MdeModulePkg/Library/PiDxeS3BootScriptLib/DxeS3BootScriptLib.inf

   SmbusLib|MdePkg/Library/BaseSmbusLibNull/BaseSmbusLibNull.inf

@@ -720,12 +727,13 @@
   MdeModulePkg/Bus/Usb/UsbKbDxe/UsbKbDxe.inf

   MdeModulePkg/Bus/Usb/UsbMassStorageDxe/UsbMassStorageDxe.inf

 

-!if $(TOOL_CHAIN_TAG) != "XCODE5"

+!if $(TOOL_CHAIN_TAG) != "XCODE5" && $(BUILD_SHELL) == TRUE

   OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {

     <PcdsFixedAtBuild>

       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE

   }

 !endif

+!if $(BUILD_SHELL) == TRUE

   ShellPkg/Application/Shell/Shell.inf {

     <LibraryClasses>

       ShellCommandLib|ShellPkg/Library/UefiShellCommandLib/UefiShellCommandLib.inf

@@ -744,6 +752,7 @@
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE

       gEfiMdePkgTokenSpaceGuid.PcdUefiLibMaxPrintBufferSize|8000

   }

+!endif

 

 !if $(SECURE_BOOT_ENABLE) == TRUE

   SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf