summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* pip: bump edk2-pytool-library from 0.20.0 to 0.21.5dependabot/pip/edk2-pytool-library-0.21.5dependabot[bot]13 days1-1/+1
| | | | | | | | | | | | | | Bumps [edk2-pytool-library](https://github.com/tianocore/edk2-pytool-library) from 0.20.0 to 0.21.5. - [Release notes](https://github.com/tianocore/edk2-pytool-library/releases) - [Commits](https://github.com/tianocore/edk2-pytool-library/compare/v0.20.0...v0.21.5) --- updated-dependencies: - dependency-name: edk2-pytool-library dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
* IntelFsp2Pkg/PatchFv.py: FIX for GCC 32BIT build errorDuggapu Chinni B14 days1-1/+1
| | | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4762 Map file generating 8 byte address offset is not matched with the pattern defined in patchFv tool resulting build error. Cc: Chasel Chiu <chasel.chiu@intel.com> Reviewed-by: Nate DeSimone <nathaniel.l.desimone@intel.com> Cc: Duggapu Chinni B <chinni.b.duggapu@intel.com> Reviewed-by: Ashraf Ali S <ashraf.ali.s@intel.com> Cc: Ted Kuo <ted.kuo@intel.com> Signed-off-by: Duggapu Chinni B <chinni.b.duggapu@intel.com>
* OvmfPkg/CcExitLib: Drop special handling for Encrypted MMIO to APICMichael Roth14 days1-11/+1
| | | | | | | | | | | | | | | | | | | The current #VC handler guards against MMIO to addresses that are mapped with the encryption bit set, but has an special exception for MMIO accesses to the APIC base address so allow for early access during SEC. Now that the SEC page table has the encryption bit cleared for the APIC base address range, there is no longer any need for this special handling. Go ahead and remove it. Cc: Ard Biesheuvel <ardb@kernel.org> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Erdem Aktas <erdemaktas@google.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Min Xu <min.m.xu@intel.com> Cc: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: Michael Roth <michael.roth@amd.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
* OvmfPkg: Don't make APIC MMIO accesses with encryption bit setMichael Roth14 days10-3/+97
| | | | | | | | | | | | | | | | | | | | | | | | | For the most part, OVMF will clear the encryption bit for MMIO regions, but there is currently one known exception during SEC when the APIC base address is accessed via MMIO with the encryption bit set for SEV-ES/SEV-SNP guests. In the case of SEV-SNP, this requires special handling on the hypervisor side which may not be available in the future[1], so make the necessary changes in the SEC-configured page table to clear the encryption bit for 4K region containing the APIC base address. [1] https://lore.kernel.org/lkml/20240208002420.34mvemnzrwwsaesw@amd.com/#t Suggested-by: Tom Lendacky <thomas.lendacky@amd.com> Cc: Ard Biesheuvel <ardb@kernel.org> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Erdem Aktas <erdemaktas@google.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Min Xu <min.m.xu@intel.com> Cc: Tom Lendacky <thomas.lendacky@amd.com> Cc: Jianyong Wu <jianyong.wu@arm.com> Cc: Anatol Belski <anbelski@linux.microsoft.com> Signed-off-by: Michael Roth <michael.roth@amd.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
* OvmfPkg/ResetVector: Clear SEV encryption bit for non-leaf PTEsMichael Roth14 days2-11/+14
| | | | | | | | | | | | | | | | | | Future changes will make use of CpuPageTableLib to handle splitting page table mappings during SEC phase. While it's not strictly required by hardware, CpuPageTableLib relies on non-leaf PTEs never having the encryption bit set, so go ahead change the page table setup code to satisfy this expectation. Suggested-by: Tom Lendacky <thomas.lendacky@amd.com> Cc: Ard Biesheuvel <ardb@kernel.org> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Erdem Aktas <erdemaktas@google.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Min Xu <min.m.xu@intel.com> Cc: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: Michael Roth <michael.roth@amd.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
* Maintainers.txt: Update my email addressAnthony PERARD14 days1-1/+1
| | | | | | Cc: Michael D Kinney <michael.d.kinney@intel.com> Signed-off-by: Anthony PERARD <anthony.perard@citrix.com> Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
* Maintainers.txt: Update StandaloneMmPkg and UefiCpuPkg ReviewerJiaxin Wu2024-04-301-0/+2
| | | | | | | | | | | | This is to update StandaloneMmPkg and UefiCpuPkg Reviewer. Cc: Ray Ni <ray.ni@intel.com> Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Sami Mujawar <sami.mujawar@arm.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Jiaxin Wu <jiaxin.wu@intel.com> Reviewed-by: Ray Ni <ray.ni@intel.com>
* OvmfPkg: Remove QemuFwCfgLibMmio.infChao Li2024-04-301-54/+0
| | | | | | | | | | | | All of platforms are switching to QemuFwCfgMmioDxeLib.inf, remove QemuFwCfgLibMmio.inf now. BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4755 Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Chao Li <lichao@loongson.cn>
* OvmfPkg/RiscVVirt: Enable QemuFwCfgMmioDxeLib.infChao Li2024-04-301-1/+1
| | | | | | | | | | | | | | | Enable QemuFwCfgMmioDxeLib.inf in RiscVVirtQemu.dsc Build-tested only (with "RiscVVirtQemu.dsc"). BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4755 Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Sunil V L <sunilvl@ventanamicro.com> Cc: Andrei Warkentin <andrei.warkentin@intel.com> Signed-off-by: Chao Li <lichao@loongson.cn>
* ArmVirtPkg: Enable QemuFwCfgMmioDxeLib.infChao Li2024-04-302-2/+2
| | | | | | | | | | | | | | | | Enable QemuFwCfgMmioDxeLib.inf in ArmVirtQemu.dsc and ArmVirtQemuKernel.dsc. Build-tested only (with "ArmVirtQemu.dsc"). BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4755 Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Leif Lindholm <quic_llindhol@quicinc.com> Cc: Sami Mujawar <sami.mujawar@arm.com> Signed-off-by: Chao Li <lichao@loongson.cn>
* OvmfPkg: Copy the same new INF as QemuFwCfgLibMmio.infChao Li2024-04-301-0/+54
| | | | | | | | | | | | | Copy QemuFwCfgLibMmio.inf to QemuFwCfgMmioDxeLib.inf, QemuFwCfgLibMmio.inf will be deleted when all platforms switching is completed. BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4755 Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Chao Li <lichao@loongson.cn>
* OvmfPkg: Add the QemuFwCfgMmioLib PEI stage versionChao Li2024-04-302-0/+281
| | | | | | | | | | | | | Added the PEI stage library for QemuFwCfgMmioLib, which uses the FDT to find the fw_cfg and parse it. BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4755 Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Co-authored-by: Xianglai Li <lixianglai@loongson.cn> Signed-off-by: Chao Li <lichao@loongson.cn>
* OvmfPkg: Add the way of HOBs in QemuFwCfgLibMmioChao Li2024-04-304-27/+216
| | | | | | | | | | | | | | | | | | | Added the HOB methods to load and store the QEMU firmware configure address, data address and DMA address, which are not enabled during the DXE stage. Build-tested only (with "ArmVirtQemu.dsc and RiscVVirtQemu.dsc"). BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4755 Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Leif Lindholm <quic_llindhol@quicinc.com> Cc: Sami Mujawar <sami.mujawar@arm.com> Cc: Sunil V L <sunilvl@ventanamicro.com> Cc: Andrei Warkentin <andrei.warkentin@intel.com> Signed-off-by: Chao Li <lichao@loongson.cn>
* OvmfPkg: Separate QemuFwCfgLibMmio.c into two filesChao Li2024-04-304-186/+327
| | | | | | | | | | | | | | | | | | | | | | Separate QemuFwCfgLibMmio.c into two files named QemuFwCfgLibMmio.c and QemuFwCfgLibMmioDxe.c, added a new header named QemuFwCfgLibMmioInternal.h for MMIO version. Some DXE stage variables became non-static in this patch, they will be restored to static in the next patch. Build-tested only (with "ArmVirtQemu.dsc and RiscVVirtQemu.dsc"). BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4755 Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Leif Lindholm <quic_llindhol@quicinc.com> Cc: Sami Mujawar <sami.mujawar@arm.com> Cc: Sunil V L <sunilvl@ventanamicro.com> Cc: Andrei Warkentin <andrei.warkentin@intel.com> Signed-off-by: Chao Li <lichao@loongson.cn>
* OvmfPkg: Add a GUID for QemuFwCfgLibChao Li2024-04-301-0/+1
| | | | | | | | | | | | | Added a new GUID for QemuFwCfgLib MMIO version, called gQemuFirmwareResourceHobGuid, which is used to save QEMU firmware configure resource during PEI stage. BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4755 Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Chao Li <lichao@loongson.cn>
* UefiCpuPkg/Library: Cleanup debug message in LmceSupportJiaxin Wu2024-04-301-4/+1
| | | | | | | | | | | | | | | | ProcessorNumber 0 is not always BSP. Debug message based on 0 of ProcessorNumber is incorrect. This patch is to clean the debug message in LmceSupport directly. Cc: Ray Ni <ray.ni@intel.com> Cc: Zeng Star <star.zeng@intel.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Signed-off-by: Jiaxin Wu <jiaxin.wu@intel.com> Reviewed-by: Zeng Star <star.zeng@intel.com> Reviewed-by: Ray Ni <ray.ni@intel.com>
* ReadMe.rst: Add libspdm submodule licenseWenxing Hou2024-04-301-0/+1
| | | | | | | | | | This patch add libspdm submodule license. Cc: Andrew Fish <afish@apple.com> Cc: Leif Lindholm <quic_llindhol@quicinc.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg: Add libspdm submoduleWenxing Hou2024-04-301-0/+0
| | | | | | | | libspdm is submodule to support DeviceSecurity feature. Cc: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* .gitmodule: Add libspdm submodule for EDKIIWenxing Hou2024-04-301-0/+3
| | | | | | | | | | | libspdm is submodule, which will be used in DeviceSecurity. Cc: Andrew Fish <afish@apple.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com> Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
* .pytool/CISettings.py: add libspdm submodule.Wenxing Hou2024-04-301-0/+2
| | | | | | | | | | | Add DeviceSecurity submodule libspdm. Cc: Sean Brogan <sean.brogan@microsoft.com> Cc: Joey Vagedes <joey.vagedes@gmail.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Joey Vagedes <joey.vagedes@gmail.com>
* SecurityPkg: add DeviceSecurity supportWenxing Hou2024-04-3032-6/+5611
| | | | | | | | | | | This patch implement the SpdmSecurityLib, which is the core of DeviceSecurity. And the SpdmSecurityLib include Device Authentication and Measurement. The other library is to support SpdmSecurityLib. Cc: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* SecurityPkg: Add TCG PFP 1.06 support.Wenxing Hou2024-04-305-20/+278
| | | | | | | | | | Add new api Tpm2ExtendNvIndex. It is uesd in HashCompleteAndExtend when PcrIndex > MAX_PCR_INDEX. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* MdeModulePkg/Variable: Add TCG SPDM device measurement updateWenxing Hou2024-04-304-6/+43
| | | | | | | | | Add EV_EFI_SPDM_DEVICE_POLICY support for MeasureVariable. Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* MdePkg: Add devAuthBoot GlobalVariableWenxing Hou2024-04-302-2/+11
| | | | | | | | | | | | | According to UEFI 2.10 spec 3.3 Globally Defined Variables section, add devAuthBoot GlobalVariable. Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Zhiguang Liu <zhiguang.liu@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* MdePkg: Add TCG PFP 1.06 support.Wenxing Hou2024-04-302-3/+187
| | | | | | | | | | | | | Add support for TCG PC Client Platform Firmware Profile Specification 1.06. Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Zhiguang Liu <zhiguang.liu@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* MdePkg: Add SPDM1.2 support.Wenxing Hou2024-04-301-49/+1061
| | | | | | | | | | | | | | Update Spdm.h to support 1.2 new features, such as: Authentication and measurement. It wil be used in DeviceSecurity. The DeviceSecurity feature is from TCG PC Client Platform Firmware Profile Specification 1.06. Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Zhiguang Liu <zhiguang.liu@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Wenxing Hou <wenxing.hou@intel.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* MdePkg: Add Cxl30.h into IndustryStandardFoster Nong2024-04-292-1/+317
| | | | | | | | | | | | | | | REF: https://bugzilla.tianocore.org/show_bug.cgi?id=4516 1) Add CXL 3.0 header file to comply with CXL 3.0 specification 2) CXL 3.0 header will embed Cxl20.h 3) Updated Cxl.h to point to 3.0 header file Signed-off-by: Foster Nong <foster.nong@intel.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Ray Ni <ray.ni@intel.com> Cc: Chris Li <chrisli@os.amperecomputing.com> Acked-by: Liming Gao <gaoliming@byosoft.com.cn>
* BaseTools/GetUtcDateTime.py: Python 3.12 supportGua Guo2024-04-261-1/+1
| | | | | | | | | | | | | Ref to https://docs.python.org/3/whatsnew/3.12.html utcnow() and utcfromtimestamp() are deprecated Prevent use it cause build error. Cc: Rebecca Cran <rebecca@bsdio.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Bob Feng <bob.c.feng@intel.com> Cc: Yuwei Chen <yuwei.chen@intel.com> Signed-off-by: Gua Guo <gua.guo@intel.com> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
* OvmfPkg/VirtHstiDxe: do not load driver in confidential guestsGerd Hoffmann2024-04-252-0/+7
| | | | | | | | | | | | | | The VirtHstiDxe does not work in confidential guests. There also isn't anything we can reasonably test, neither flash storage nor SMM mode will be used in that case. So just skip driver load when running in a confidential guest. Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Jiewen Yao <jiewen.yao@intel.com> Fixes: 506740982bba ("OvmfPkg/VirtHstiDxe: add code flash check") Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Tested-by: Srikanth Aithal <sraithal@amd.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* Update to CodeQL 2.16.1Michael Kubacki2024-04-243-9/+9
| | | | | | | | | | | | | | | | | | | | | | | | Updates CodeQL to work with the latest queries. Includes functional and security fixes within the CodeQL CLI binary. For more information on release details see: https://github.com/github/codeql-cli-binaries/releases For changes between the previous version (2.14.5) and 2.16.1 see: https://github.com/github/codeql-cli-binaries/compare/v2.14.5...v2.16.1 Cc: Bob Feng <bob.c.feng@intel.com> Cc: Joey Vagedes <joey.vagedes@gmail.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Rebecca Cran <rebecca@bsdio.com> Cc: Sean Brogan <sean.brogan@microsoft.com> Cc: Yuwei Chen <yuwei.chen@intel.com> Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com> Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Joey Vagedes <joey.vagedes@gmail.com>
* BaseTools/Fmmt.py: Python 3.12 supportGua Guo2024-04-231-1/+1
| | | | | | | | | | | | | Ref to https://docs.python.org/3/whatsnew/3.12.html A backslash-character pair that is not a valid escape sequence now generates Cc: Rebecca Cran <rebecca@bsdio.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Bob Feng <bob.c.feng@intel.com> Cc: Yuwei Chen <yuwei.chen@intel.com> Signed-off-by: Gua Guo <gua.guo@intel.com> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
* OvmfPkg: Harden #VC instruction emulation somewhat (CVE-2024-25742)Adam Dunlap2024-04-231-11/+173
| | | | | | | | | | | | | | | | | | Ensure that when a #VC exception happens, the instruction at the instruction pointer matches the instruction that is expected given the error code. This is to mitigate the ahoi WeSee attack [1] that could allow hypervisors to breach integrity and confidentiality of the firmware by maliciously injecting interrupts. This change is a translated version of a linux patch e3ef461af35a ("x86/sev: Harden #VC instruction emulation somewhat") [1] https://ahoi-attacks.github.io/wesee/ Cc: Borislav Petkov (AMD) <bp@alien8.de> Cc: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: Adam Dunlap <acdunlap@google.com> Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com> Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
* IntelFsp2Pkg/PatchFv.py: Python 3.12 supportGua Guo2024-04-221-12/+12
| | | | | | | | | | | | | | | Ref to https://docs.python.org/3/whatsnew/3.12.html A backslash-character pair that is not a valid escape sequence now generates Cc: Chasel Chiu <chasel.chiu@intel.com> Cc: Nate DeSimone <nathaniel.l.desimone@intel.com> Cc: Duggapu Chinni B <chinni.b.duggapu@intel.com> Cc: Star Zeng <star.zeng@intel.com> Cc: Ted Kuo <ted.kuo@intel.com> Reviewed-by: Ashraf Ali S <ashraf.ali.s@intel.com> Cc: Susovan Mohapatra <susovan.mohapatra@intel.com> Signed-off-by: Gua Guo <gua.guo@intel.com>
* IntelFsp2Pkg/GenCfgOpt.py: Python 3.12 supportGua Guo2024-04-221-48/+48
| | | | | | | | | | | | | | | Ref to https://docs.python.org/3/whatsnew/3.12.html A backslash-character pair that is not a valid escape sequence now generates Cc: Chasel Chiu <chasel.chiu@intel.com> Cc: Nate DeSimone <nathaniel.l.desimone@intel.com> Cc: Duggapu Chinni B <chinni.b.duggapu@intel.com> Cc: Star Zeng <star.zeng@intel.com> Cc: Ted Kuo <ted.kuo@intel.com> Reviewed-by: Ashraf Ali S <ashraf.ali.s@intel.com> Cc: Susovan Mohapatra <susovan.mohapatra@intel.com> Signed-off-by: Gua Guo <gua.guo@intel.com>
* ArmVirtPkg/ArmVirtQemu: always build XIP code with strict alignmentArd Biesheuvel2024-04-221-2/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The optimization that enabled entry with MMU and caches enabled at EL1 removed the strict alignment requirement for XIP code (roughly, any code that might execute with the MMU and caches off, which means SEC and PEI phase modules but also *all* BASE libraries), on the basis that QEMU can only run guest payloads at EL2 in TCG emulation, which used to ignore alignment violations, and execution at EL1 would always occur with the MMU enabled. This assumption no longer holds: not only does QEMU now enforce strict alignment for memory accesses with device semantics, there are also cases where this code might execute at EL2 under virtualization (i.e., under NV2 nested virtualization) where the strict alignment is required too. The latter case could be optimized too, by enabling VHE and pretending execution is occurring at EL1, which would allow the existing logic for entry with the MMU enabled to be reused. However, this would leave non-VHE CPUs behind. So in summary, strict alignment needs to be enforced for any code that may execute with the MMU off, so drop the override that sets the XIP flags to the empty string. Cc: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Ard Biesheuvel <ardb@kernel.org> Tested-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
* OvmfPkg/VirtHstiDxe: add README.mdGerd Hoffmann2024-04-221-0/+48
| | | | | | | | Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Konstantin Kostiuk <kkostiuk@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* OvmfPkg/VirtHstiDxe: add code flash checkGerd Hoffmann2024-04-224-0/+55
| | | | | | | | | | | Detects qemu config issue: code pflash is writable. Checked for both PC and Q35. Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Konstantin Kostiuk <kkostiuk@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* OvmfPkg/VirtHstiDxe: add varstore flash checkGerd Hoffmann2024-04-224-1/+122
| | | | | | | | | | | Detects qemu config issue: vars pflash is not in secure mode (write access restricted to smm). Applies to Q35 with SMM only. Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Konstantin Kostiuk <kkostiuk@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* OvmfPkg: Add VirtHstiDxe to OVMF firmware buildKonstantin Kostiuk2024-04-226-0/+9
| | | | | | | | Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Jiewen Yao <jiewen.yao@intel.com> Signed-off-by: Konstantin Kostiuk <kkostiuk@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* OvmfPkg: Add VirtHstiDxe driverKonstantin Kostiuk2024-04-225-0/+382
| | | | | | | | | | | | | | | | | | | The driver supports qemu machine types 'pc' and 'q35'. This patch adds some helper functions to manage the bitmasks. The implemented features depend on both OVMF build configuration and qemu VM configuration. For q35 a single security feature is supported and checked: In SMM-enabled builds the driver will verify smram is properly locked. That test should never fail. Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Konstantin Kostiuk <kkostiuk@redhat.com> Initial-patch-by: Konstantin Kostiuk <kkostiuk@redhat.com> Signed-off-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
* OvmfPkg/IntelTdx: Update TDVF READMEMin M Xu2024-04-221-26/+38
| | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4756 There are below updates in this patch: 1. Rename README to README.md so that it can be show as markdown document. 2. Update some information about TDVF. 2. Fix some typo. Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Min Xu <min.m.xu@intel.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
* Maintainers: AMD as SPI driver stack maintainerAbner Chang2024-04-201-0/+11
| | | | | | | | Signed-off-by: Abner Chang <abner.chang@amd.com> Cc: Andrew Fish <afish@apple.com> Cc: Leif Lindholm <quic_llindhol@quicinc.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Reviewed-by: Michael D Kinney <michael.d.kinney@intel.com>
* MdeModulePkg: Add SPI NOR FLash SFDP drivers to DSCabnchang2024-04-201-1/+3
| | | | | | | | | | | | | BZ#: 4471 SPI NOR Flash JEDEC Serial Flash Discoverable Driver implementation. Signed-off-by: Abner Chang <abner.chang@amd.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Abdul Lateef Attar <abdattar@amd.com> Cc: Brit Chesley <brit.chesley@amd.com> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
* MdeModulePkg/SpiNorFlashJedecSfdp: SPI NOR Flash JEDEC SFDPabnchang2024-04-2011-0/+4166
| | | | | | | | | | | | | BZ#: 4471 SPI NOR Flash JEDEC Serial Flash Discoverable Driver implementation. Signed-off-by: Abner Chang <abner.chang@amd.com> Cc: Hao A Wu <hao.a.wu@intel.com> Cc: Ray Ni <ray.ni@intel.com> Cc: Abdul Lateef Attar <abdattar@amd.com> Cc: Brit Chesley <brit.chesley@amd.com> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
* MdeModulePkg: Add definitions in DEC for SPI NOR Flash SFDP driverAbner Chang2024-04-201-1/+27
| | | | | | | | | | | BZ#: 4473 Signed-off-by: Abner Chang <abner.chang@amd.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Abdul Lateef Attar <abdattar@amd.com> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn> Reviewed-by: Abdul Lateef Attar <abdattar@amd.com>
* MdePkg/Include: Add SPI NOR Flash JEDEC SFDP header fileabnchang2024-04-201-0/+324
| | | | | | | | | | | | | | | | BZ#: 4472 Add definition of JEDEC Serial Flash Discoverable Parameters (SFDP) specification. https://www.jedec.org/standards-documents/docs/jesd216b Signed-off-by: Abner Chang <abner.chang@amd.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Zhiguang Liu <zhiguang.liu@intel.com> Cc: Abdul Lateef Attar <abdattar@amd.com> Cc: Brit Chesley <brit.chesley@amd.com> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn> Reviewed-by: Abdul Lateef Attar <abdattar@amd.com>
* MdePkg/Include: Update definitions of SPI related header filesabnchang2024-04-203-3/+35
| | | | | | | | | | | | | | BZ#: 4471 Update definitions according to PI spec 1.8 errata A Signed-off-by: Abner Chang <abner.chang@amd.com> Cc: Michael D Kinney <michael.d.kinney@intel.com> Cc: Liming Gao <gaoliming@byosoft.com.cn> Cc: Zhiguang Liu <zhiguang.liu@intel.com> Cc: Abdul Lateef Attar <abdattar@amd.com> Cc: Brit Chesley <brit.chesley@amd.com> Reviewed-by: Abdul Lateef Attar <abdattar@amd.com> Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>
* OvmfPkg/BaseMemEncryptLib: Check for presence of an SVSM when not at VMPL0Tom Lendacky2024-04-171-3/+6
| | | | | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654 Currently, an SEV-SNP guest will terminate if it is not running at VMPL0. The requirement for running at VMPL0 is removed if an SVSM is present. Update the current VMPL0 check to additionally check for the presence of an SVSM is the guest is not running at VMPL0. Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Erdem Aktas <erdemaktas@google.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Michael Roth <michael.roth@amd.com> Cc: Min Xu <min.m.xu@intel.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
* Ovmfpkg/CcExitLib: Provide SVSM discovery supportTom Lendacky2024-04-173-4/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654 The SVSM specification documents an alternative method of discovery for the SVSM using a reserved CPUID bit and a reserved MSR. For the CPUID support, the #VC handler of an SEV-SNP guest should modify the returned value in the EAX register for the 0x8000001f CPUID function by setting bit 28 when an SVSM is present. For the MSR support, new reserved MSR 0xc001f000 has been defined. A #VC should be generated when accessing this MSR. The #VC handler is expected to ignore writes to this MSR and return the physical calling area address (CAA) on reads of this MSR. Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Erdem Aktas <erdemaktas@google.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Michael Roth <michael.roth@amd.com> Cc: Min Xu <min.m.xu@intel.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
* UefiCpuPkg/MpInitLib: AP creation support under an SVSMTom Lendacky2024-04-171-9/+19
| | | | | | | | | | | | | | | | | BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=4654 When running under an SVSM, the VMPL level of the APs that are started must match the VMPL level provided by the SVSM. Additionally, each AP must have a Calling Area for use with the SVSM protocol. Update the AP creation to properly support running under an SVSM. Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Rahul Kumar <rahul1.kumar@intel.com> Cc: Ray Ni <ray.ni@intel.com> Acked-by: Ray Ni <ray.ni@intel.com> Acked-by: Gerd Hoffmann <kraxel@redhat.com> Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-16 12:30:56 +0000