audk/OvmfPkg/VirtHstiDxe/README.md

virtual machine platform hsti driver

This driver supports three tests.

VIRT_HSTI_BYTE0_SMM_SMRAM_LOCK

Verify the SMM memory is properly locked down.

Supported platforms:

• Qemu Q35 (SMM_REQUIRE=TRUE builds).

VIRT_HSTI_BYTE0_SMM_SECURE_VARS_FLASH

Verify the variable store is not writable for normal (not SMM) code.

Supported platforms:

• Qemu Q35 (SMM_REQUIRE=TRUE builds).

VIRT_HSTI_BYTE0_READONLY_CODE_FLASH

Verify the firmware code is not writable for the guest.

Supported platforms:

• Qemu Q35
• Qemu PC

qemu flash configuration

With qemu being configured properly flash behavior should be this:

configuration	OVMF_CODE.fd	OVMF_VARS.fd
SMM_REQUIRE=TRUE, SMM mode	read-only	writable
SMM_REQUIRE=TRUE, normal mode	read-only (1)	read-only (2)
SMM_REQUIRE=FALSE	read-only (3)	writable

VIRT_HSTI_BYTE0_READONLY_CODE_FLASH will verify (1) + (3). VIRT_HSTI_BYTE0_SMM_SECURE_VARS_FLASH will verify (2).

qemu command line for SMM_REQUIRE=TRUE builds

qemu-system-x86-64 -M q35,smm=on,pflash0=code,pflash1=vars \
  -blockdev node-name=code,driver=file,filename=OVMF_CODE.fd,read-only=on \
  -blockdev node-name=vars,driver=file,filename=OVMF_VARS.fd \
  -global driver=cfi.pflash01,property=secure,value=on \
  [ ... more options here ... ]