tyler.durden/audk
1
0
Fork 0
mirror of https://github.com/acidanthera/audk.git synced 2025-04-08 17:05:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

OvmfPkg/PlatformInitLib: Retry NV vars FV check as shared

Browse Source 
When OVMF is built with SECURE_BOOT_ENABLE, the variable store will be
populated and validated in PlatformValidateNvVarStore(). When an SEV
or an SEV-ES guest is running, this may be encrypted or unencrypted
depending on how the guest was started. If the guest was started with the
combined code and variable contents (OVMF.fd), then the variable store
will be encrypted. If the guest was started with the separate code and
variables contents (OVMF_CODE.fd and OVMF_VARS.fd), then the variable
store will be unencrypted.

When PlatformValidateNvVarStore() is first invoked, the variable store
area is initially mapped encrypted, which may or may not pass the variable
validation step depending how the guest was launched. To accomodate this,
retry the validation step on failure after remapping the variable store
area as unencrypted.

Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
This commit is contained in:
Tom Lendacky 2024-11-18 12:59:32 -06:00 committed by mergify[bot]
parent 52fa7e78d2
commit d502cc7702
2 changed files with 31 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
OvmfPkg/Library/PlatformInitLib/Platform.c
View File

@ -34,6 +34,7 @@
#include <Guid/VariableFormat.h>
#include <OvmfPlatforms.h>
#include <Library/TdxLib.h>
#include <Library/MemEncryptSevLib.h>
#include <Library/PlatformInitLib.h>
@ -774,6 +775,8 @@ PlatformValidateNvVarStore (
EFI_FIRMWARE_VOLUME_HEADER *NvVarStoreFvHeader;
VARIABLE_STORE_HEADER *NvVarStoreHeader;
AUTHENTICATED_VARIABLE_HEADER *VariableHeader;
BOOLEAN Retry;
EFI_STATUS Status;
static EFI_GUID FvHdrGUID = EFI_SYSTEM_NV_DATA_FV_GUID;
static EFI_GUID VarStoreHdrGUID = EFI_AUTHENTICATED_VARIABLE_GUID;
@ -792,6 +795,15 @@ PlatformValidateNvVarStore (
//
NvVarStoreFvHeader = (EFI_FIRMWARE_VOLUME_HEADER *)NvVarStoreBase;
//
// SEV and SEV-ES can use separate flash devices for OVMF code and
// OVMF variables. In this case, the OVMF variables will need to be
// mapped unencrypted. If the initial validation fails, remap the
// NV variable store as unencrypted and retry the validation.
//
Retry = MemEncryptSevIsEnabled ();
RETRY:
if ((!IsZeroBuffer (NvVarStoreFvHeader->ZeroVector, 16)) ||
(!CompareGuid (&FvHdrGUID, &NvVarStoreFvHeader->FileSystemGuid)) ||
(NvVarStoreFvHeader->Signature != EFI_FVH_SIGNATURE) ||
@ -801,8 +813,24 @@ PlatformValidateNvVarStore (
(NvVarStoreFvHeader->FvLength != NvVarStoreSize)
)
{
DEBUG ((DEBUG_ERROR, "NvVarStore FV headers were invalid.\n"));
return FALSE;
if (!Retry) {
DEBUG ((DEBUG_ERROR, "NvVarStore FV headers were invalid.\n"));
return FALSE;
}
DEBUG ((DEBUG_INFO, "Remapping NvVarStore as shared\n"));
Status = MemEncryptSevClearMmioPageEncMask (
0,
(UINTN)NvVarStoreBase,
EFI_SIZE_TO_PAGES (NvVarStoreSize)
);
if (EFI_ERROR (Status)) {
DEBUG ((DEBUG_ERROR, "Failed to map NvVarStore as shared\n"));
return FALSE;
}
Retry = FALSE;
goto RETRY;
}
//

1
OvmfPkg/Library/PlatformInitLib/PlatformInitLib.inf
View File

@ -48,6 +48,7 @@
HobLib
QemuFwCfgLib
QemuFwCfgSimpleParserLib
MemEncryptSevLib
MemoryAllocationLib
MtrrLib
PcdLib