summaryrefslogtreecommitdiffstats
path: root/OvmfPkg/OvmfPkgX64.dsc
diff options
context:
space:
mode:
authorLaszlo Ersek <lersek@redhat.com>2020-03-10 23:27:39 +0100
committermergify[bot] <37929162+mergify[bot]@users.noreply.github.com>2020-03-12 21:14:46 +0000
commitd42fdd6f8384bb4681d93e4a25d8f57db1e63adb (patch)
treebebabc8a88045ea38c041a5bd1de07f92baa2401 /OvmfPkg/OvmfPkgX64.dsc
parent89465fe9e0ccd03168f822289ec8878676d5df8b (diff)
downloadedk2-d42fdd6f8384bb4681d93e4a25d8f57db1e63adb.tar.gz
edk2-d42fdd6f8384bb4681d93e4a25d8f57db1e63adb.tar.bz2
edk2-d42fdd6f8384bb4681d93e4a25d8f57db1e63adb.zip
OvmfPkg: improve SMM comms security with adaptive MemoryTypeInformation
* In the Intel whitepaper: --v-- A Tour Beyond BIOS -- Secure SMM Communication https://github.com/tianocore/tianocore.github.io/wiki/EDK-II-Security-White-Papers https://github.com/tianocore-docs/Docs/raw/master/White_Papers/A_Tour_Beyond_BIOS_Secure_SMM_Communication.pdf --^-- bullet#3 in section "Assumption and Recommendation", and bullet#4 in "Call for action", recommend enabling the (adaptive) Memory Type Information feature. * In the Intel whitepaper: --v-- A Tour Beyond BIOS -- Memory Map and Practices in UEFI BIOS https://github.com/tianocore/tianocore.github.io/wiki/EDK-II-white-papers https://github.com/tianocore-docs/Docs/raw/master/White_Papers/A_Tour_Beyond_BIOS_Memory_Map_And_Practices_in_UEFI_BIOS_V2.pdf --^-- figure#6 describes the Memory Type Information feature in detail; namely as a feedback loop between the Platform PEIM, the DXE IPL PEIM, the DXE Core, and BDS. Implement the missing PlatformPei functionality in OvmfPkg, for fulfilling the Secure SMM Communication recommendation. In the longer term, OVMF should install the WSMT ACPI table, and this patch contributes to that. Notes: - the step in figure#6 where the UEFI variable is copied into the HOB is covered by the DXE IPL PEIM, in the DxeLoadCore() function, - "PcdResetOnMemoryTypeInformationChange" must be reverted to the DEC default TRUE value, because both whitepapers indicate that BDS needs to reset the system if the Memory Type Information changes. Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Philippe Mathieu-Daudé <philmd@redhat.com> Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=386 Signed-off-by: Laszlo Ersek <lersek@redhat.com> Message-Id: <20200310222739.26717-6-lersek@redhat.com> Acked-by: Leif Lindholm <leif@nuviainc.com>
Diffstat (limited to 'OvmfPkg/OvmfPkgX64.dsc')
-rw-r--r--OvmfPkg/OvmfPkgX64.dsc2
1 files changed, 2 insertions, 0 deletions
diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
index 0e74b6f4d2..b2dccc40a8 100644
--- a/OvmfPkg/OvmfPkgX64.dsc
+++ b/OvmfPkg/OvmfPkgX64.dsc
@@ -452,7 +452,9 @@
[PcdsFixedAtBuild]
gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeMemorySize|1
+!if $(SMM_REQUIRE) == FALSE
gEfiMdeModulePkgTokenSpaceGuid.PcdResetOnMemoryTypeInformationChange|FALSE
+!endif
gEfiMdePkgTokenSpaceGuid.PcdMaximumGuidedExtractHandler|0x10
!if ($(FD_SIZE_IN_KB) == 1024) || ($(FD_SIZE_IN_KB) == 2048)
gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x2000