[edk2-devel] [PATCH 0/5] OvmfPkg: improve SMM comms security with adaptive MemoryTypeInformation

[Laszlo Ersek]

Repo:   https://pagure.io/lersek/edk2.git
Branch: mem_type_info
Ref:    https://bugzilla.tianocore.org/show_bug.cgi?id=386

The following "A Tour Beyond BIOS" whitepapers, available at

  https://github.com/tianocore/tianocore.github.io/wiki/EDK-II-white-papers

discuss the WSMT ACPI table:

- "Secure SMM Communication"
- "Memory Protection in UEFI BIOS"
- "Memory Map and Practices in UEFI BIOS"

With time, OVMF should install the WSMT ACPI table. I made an effort to
analyze what was missing for that, here:

  [edk2-devel] WSMT bits
  http://mid.mail-archive.com/3c32815c-3ee9-261a-b473-1be341bdfb0c@redhat.com
  https://edk2.groups.io/g/devel/message/55715

The part (or, well, "one part") that OVMF seems to miss is
Assumption/Recommendation #3 from "Secure SMM Communication", so this
series supplies that.

This series overlaps with TianoCore#386 (although the series is
motivated differently from the BZ). I used TianoCore#386 as the BZ
reference in the patches, for simplicity.

Cc: Ard Biesheuvel <ard.biesheuvel at linaro.org>
Cc: Jordan Justen <jordan.l.justen at intel.com>
Cc: Philippe Mathieu-Daudé <philmd at redhat.com>

Thanks
Laszlo

Laszlo Ersek (5):
  OvmfPkg/QemuFlashFvbServicesRuntimeDxe: drop unused PCDs
  OvmfPkg/QemuFlashFvbServices: factor out
    SetPcdFlashNvStorageBaseAddresses
  OvmfPkg: set fixed FlashNvStorage base addresses with -D SMM_REQUIRE
  OvmfPkg: include FaultTolerantWritePei and VariablePei with -D
    SMM_REQUIRE
  OvmfPkg: improve SMM comms security with adaptive
    MemoryTypeInformation

 OvmfPkg/OvmfPkg.fdf.inc                                          |   6 +
 OvmfPkg/OvmfPkgIa32.dsc                                          |   6 +
 OvmfPkg/OvmfPkgIa32.fdf                                          |   2 +
 OvmfPkg/OvmfPkgIa32X64.dsc                                       |   6 +
 OvmfPkg/OvmfPkgIa32X64.fdf                                       |   2 +
 OvmfPkg/OvmfPkgX64.dsc                                           |   6 +
 OvmfPkg/OvmfPkgX64.fdf                                           |   2 +
 OvmfPkg/PlatformPei/MemTypeInfo.c                                | 147 ++++++++++++++++++++
 OvmfPkg/PlatformPei/Platform.c                                   |  23 +--
 OvmfPkg/PlatformPei/Platform.h                                   |   5 +
 OvmfPkg/PlatformPei/PlatformPei.inf                              |   2 +
 OvmfPkg/QemuFlashFvbServicesRuntimeDxe/FvbServicesRuntimeDxe.inf |   2 -
 OvmfPkg/QemuFlashFvbServicesRuntimeDxe/FvbServicesSmm.inf        |   7 -
 OvmfPkg/QemuFlashFvbServicesRuntimeDxe/FwBlockService.c          |  19 +--
 OvmfPkg/QemuFlashFvbServicesRuntimeDxe/FwBlockService.h          |   5 +
 OvmfPkg/QemuFlashFvbServicesRuntimeDxe/FwBlockServiceDxe.c       |  27 ++++
 OvmfPkg/QemuFlashFvbServicesRuntimeDxe/FwBlockServiceSmm.c       |  10 ++
 17 files changed, 228 insertions(+), 49 deletions(-)
 create mode 100644 OvmfPkg/PlatformPei/MemTypeInfo.c

-- 
2.19.1.3.g30247aa5d201


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.

View/Reply Online (#55726): https://edk2.groups.io/g/devel/message/55726
Mute This Topic: https://groups.io/mt/71867505/1813853
Group Owner: devel+owner at edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub  [edk2-devel-archive at redhat.com]
-=-=-=-=-=-=-=-=-=-=-=-