On Wed, Jun 29, 2022 at 04:56:56PM +0800, Min Xu wrote: > Secure-Boot related variables include the PK/KEK/DB/DBX and they are > stored in NvVarStore (OVMF_VARS.fd). When lauching with -pflash, > QEMU/OVMF will use emulated flash, and fully support UEFI variables. > But when launching with -bios parameter, UEFI variables will be partially > emulated, and non-volatile variables may lose their contents after a > reboot. See OvmfPkg/README. > > Tdx guest is an example that -pflash is not supported. So this patch-set > is designed to initialize the NvVarStore with the content of in > OVMF_VARS.fd. > > patch 1: > Add a new function (AllocateRuntimePages) in PrePiMemoryAllocationLib. > This function will be used in PeilessStartupLib which will run > in SEC phase. > > patch 2: > Delete the TdxValidateCfv in PeilessStartupLib. Because it is going to > be renamed to PlatformValidateNvVarStore and be moved to PlatformInitLib. > > patch 3 - 7: > Then we add functions for EmuVariableNvStore in PlatformInitLib. This > lib will then be called in OvmfPkg/PlatformPei and PeilessStartupLib. > We also shortcut ConnectNvVarsToFileSystem in secure-boot. > > patch 8: > At last a build-flag (SECURE_BOOT_FEATURE_ENABLED) is introduced in > the dsc in OvmfPkg. Because the copy over of OVMR_VARS.fd to > EmuVariableNvStore is only required when secure-boot is enabled. > > Code: https://github.com/mxu9/edk2/tree/secure-boot.v3
/usr/bin/ld: /home/kraxel/projects/edk2/Build/IntelTdx/DEBUG_GCC5/X64/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib/OUTPUT/SecPeiCpuExceptionHandlerLib.lib(ExceptionHandlerAsm.obj): warning: relocation in read-only section `.text' /usr/bin/ld: /tmp/ccCEPSuH.ltrans0.ltrans.o: in function `SecCoreStartupWithStack': /home/kraxel/projects/edk2/OvmfPkg/Library/PlatformInitLib/Platform.c:760: undefined reference to `AllocateRuntimePages' /usr/bin/ld: /tmp/ccCEPSuH.ltrans0.ltrans.o:/home/kraxel/projects/edk2/OvmfPkg/Library/PlatformInitLib/Platform.c:760: undefined reference to `AllocateRuntimePages' /usr/bin/ld: warning: creating DT_TEXTREL in a PIE collect2: error: ld returned 1 exit status make: *** [GNUmakefile:431: /home/kraxel/projects/edk2/Build/IntelTdx/DEBUG_GCC5/X64/OvmfPkg/IntelTdx/Sec/SecMain/DEBUG/SecMain.dll] Error 1 adding a build test for intel tdx to ci is probably a good idea ... take care, Gerd -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#90929): https://edk2.groups.io/g/devel/message/90929 Mute This Topic: https://groups.io/mt/92061200/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
