diff options
| author | Gerd Hoffmann <kraxel@redhat.com> | 2024-04-22 12:47:27 +0200 |
|---|---|---|
| committer | mergify[bot] <37929162+mergify[bot]@users.noreply.github.com> | 2024-04-22 13:05:21 +0000 |
| commit | ddc43e7a41fac5b1dc93b1d0bb1e71319acfba4e (patch) | |
| tree | b24aa5a2ed02e410dfacf3bfb35f5faa6c6d8ac4 /OvmfPkg/VirtHstiDxe/QemuQ35.c | |
| parent | 538b8944c1befbd5ed8b7723c52085242ff780b1 (diff) | |
| download | edk2-ddc43e7a41fac5b1dc93b1d0bb1e71319acfba4e.zip edk2-ddc43e7a41fac5b1dc93b1d0bb1e71319acfba4e.tar.gz edk2-ddc43e7a41fac5b1dc93b1d0bb1e71319acfba4e.tar.bz2 | |
OvmfPkg/VirtHstiDxe: add varstore flash check
Detects qemu config issue: vars pflash is not in secure mode (write
access restricted to smm). Applies to Q35 with SMM only.
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Konstantin Kostiuk <kkostiuk@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Jiewen Yao <Jiewen.yao@intel.com>
Diffstat (limited to 'OvmfPkg/VirtHstiDxe/QemuQ35.c')
| -rw-r--r-- | OvmfPkg/VirtHstiDxe/QemuQ35.c | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/OvmfPkg/VirtHstiDxe/QemuQ35.c b/OvmfPkg/VirtHstiDxe/QemuQ35.c index 5eab4aa..2dcfa52 100644 --- a/OvmfPkg/VirtHstiDxe/QemuQ35.c +++ b/OvmfPkg/VirtHstiDxe/QemuQ35.c @@ -29,6 +29,7 @@ VirtHstiQemuQ35Init ( {
if (FeaturePcdGet (PcdSmmSmramRequire)) {
VirtHstiSetSupported (&mHstiQ35, 0, VIRT_HSTI_BYTE0_SMM_SMRAM_LOCK);
+ VirtHstiSetSupported (&mHstiQ35, 0, VIRT_HSTI_BYTE0_SMM_SECURE_VARS_FLASH);
}
return &mHstiQ35;
@@ -55,4 +56,16 @@ VirtHstiQemuQ35Verify ( VirtHstiTestResult (ErrorMsg, 0, VIRT_HSTI_BYTE0_SMM_SMRAM_LOCK);
}
+
+ if (VirtHstiIsSupported (&mHstiQ35, 0, VIRT_HSTI_BYTE0_SMM_SECURE_VARS_FLASH)) {
+ CHAR16 *ErrorMsg = NULL;
+
+ switch (VirtHstiQemuFirmwareFlashCheck (PcdGet32 (PcdOvmfFlashNvStorageVariableBase))) {
+ case QEMU_FIRMWARE_FLASH_WRITABLE:
+ ErrorMsg = L"qemu vars pflash is not secure";
+ break;
+ }
+
+ VirtHstiTestResult (ErrorMsg, 0, VIRT_HSTI_BYTE0_SMM_SECURE_VARS_FLASH);
+ }
}
|