rpms/edk2
7
0
Fork 0
Code Issues 1 Pull Requests Releases Activity

* Mon Aug 03 2026 Miroslav Rezanina <mrezanin@redhat.com> - 20260221-6

Browse Source 
- edk2-OvmfPkg-EmuVariableFvbRuntimeDxe-fix-ValidateFvHeade.patch [RHEL-220548]
- Resolves: RHEL-220548
  ([RHEL 10.3] TDX Secure Boot Setup Mode with OVMF.inteltdx.secboot.fd)
This commit is contained in:
Miroslav Rezanina 2026-08-03 08:49:00 +02:00
parent 54b8ff55e6
commit dae9441ee6
2 changed files with 112 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

104
edk2-OvmfPkg-EmuVariableFvbRuntimeDxe-fix-ValidateFvHeade.patch Normal file
View File

@ -0,0 +1,104 @@
From 731f7856dd9b8fe807a3b9c60f1888f8f114ba0c Mon Sep 17 00:00:00 2001
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Thu, 30 Jul 2026 10:44:31 +0200
Subject: [PATCH] OvmfPkg/EmuVariableFvbRuntimeDxe: fix ValidateFvHeader in tdx
mode.
RH-Author: Gerd Hoffmann <kraxel@redhat.com>
RH-MergeRequest: 115: OvmfPkg/EmuVariableFvbRuntimeDxe: fix ValidateFvHeader in tdx mode.
RH-Jira: RHEL-220548
RH-Acked-by: Luigi Leonardi <None>
RH-Commit: [1/1] df1ee44a2c9af76f327a9f6bbd7f8a0ce67f1fac (kraxel.rh/centos-src-edk2)
In TDX mode MmioRead* functions can not access memory, so avoid that.
See added source code comments for details.
Fixes: 0917ddad2529 ("OvmfPkg/EmuVariableFvbRuntimeDxe: avoid accessing varstore header with cmp")
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Resolves: https://redhat.atlassian.net/browse/RHEL-220548
---
OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.c | 41 +++++++++++++++++++++---
OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.inf | 1 +
2 files changed, 38 insertions(+), 4 deletions(-)
diff --git a/OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.c b/OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.c
index 66e3929ec81..12b7fae2a1e 100644
--- a/OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.c
+++ b/OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.c
@@ -8,6 +8,9 @@
**/
#include "PiDxe.h"
+
+#include <ConfidentialComputingGuestAttr.h>
+
#include <Guid/EventGroup.h>
#include <Guid/SystemNvDataGuid.h>
#include <Guid/VariableFormat.h>
@@ -567,16 +570,46 @@ ValidateFvHeader (
)
{
UINT16 Checksum;
+ UINT8 Revision;
+ UINT32 Signature;
+ UINT64 FvLength;
+ UINT16 HeaderLength;
+
+ if (CC_GUEST_IS_TDX (PcdGet64 (PcdConfidentialComputingGuestAttr))) {
+ /*
+ * When in tdx mode the varstore must be in ram not pflash, so there are no
+ * mmio reads/writes needed. Also in tdx mode BaseIoLibIntrinsic will
+ * translate the mmio access into TDVMCALL_MMIO calls instead of mov
+ * instructions, so memory access with MmioRead* functions does not work.
+ */
+ Revision = FwVolHeader->Revision;
+ Signature = FwVolHeader->Signature;
+ FvLength = FwVolHeader->FvLength;
+ HeaderLength = FwVolHeader->HeaderLength;
+ } else {
+ /*
+ * In sev mode with varstore in pflash we must use MmioRead* functions so to
+ * make sure the mov instruction used to access pflash/memory is supported
+ * by the #VC handler instruction emulator.
+ *
+ * Note: Only sev + sev-es need proper pflash handling, sev-snp is like tdx
+ * incompatible with pflash emulation.
+ */
+ Revision = MmioRead8 ((UINTN)(&FwVolHeader->Revision));
+ Signature = MmioRead32 ((UINTN)(&FwVolHeader->Signature));
+ FvLength = MmioRead64 ((UINTN)(&FwVolHeader->FvLength));
+ HeaderLength = MmioRead16 ((UINTN)(&FwVolHeader->HeaderLength));
+ }
//
// Verify the header revision, header signature, length
// Length of FvBlock cannot be 2**64-1
// HeaderLength cannot be an odd number
//
- if ((MmioRead8 ((UINTN)(&FwVolHeader->Revision)) != EFI_FVH_REVISION) ||
- (MmioRead32 ((UINTN)(&FwVolHeader->Signature)) != EFI_FVH_SIGNATURE) ||
- (MmioRead64 ((UINTN)(&FwVolHeader->FvLength)) != EMU_FVB_SIZE) ||
- (MmioRead16 ((UINTN)(&FwVolHeader->HeaderLength)) != EMU_FV_HEADER_LENGTH)
+ if ((Revision != EFI_FVH_REVISION) ||
+ (Signature != EFI_FVH_SIGNATURE) ||
+ (FvLength != EMU_FVB_SIZE) ||
+ (HeaderLength != EMU_FV_HEADER_LENGTH)
)
{
DEBUG ((DEBUG_INFO, "EMU Variable FVB: Basic FV headers were invalid\n"));
diff --git a/OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.inf b/OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.inf
index 396e6028b40..da1da9e0bd5 100644
--- a/OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.inf
+++ b/OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.inf
@@ -63,6 +63,7 @@
gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64
gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase64
gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved
+ gEfiMdePkgTokenSpaceGuid.PcdConfidentialComputingGuestAttr
[Depex]
TRUE
--
2.52.0

9
edk2.spec
View File

@ -25,7 +25,7 @@ ExclusiveArch: x86_64 aarch64 riscv64
Name: edk2
Version: %{GITDATE}
Release: 5%{?dist}
Release: 6%{?dist}
Summary: UEFI firmware for 64-bit virtual machines
License: BSD-2-Clause-Patent and Apache-2.0 and MIT
URL: http://www.tianocore.org
@ -95,6 +95,8 @@ Patch27: 0029-OvmfPkg-X64-add-opt-org.tianocore-UninstallMemAttrPr.patch
Patch28: edk2-Revert-OvmfPkg-X86QemuLoadImageLib-flip-default-for-.patch
# For RHEL-188305 - [edk2,rhel-10] Unable to allocate PCI BAR with edk2-20260221-1.el10
Patch29: edk2-Revert-MdeModulePkg-PciBusDxe-Degrade-MEM64-to-PMEM6.patch
# For RHEL-220548 - [RHEL 10.3] TDX Secure Boot Setup Mode with OVMF.inteltdx.secboot.fd
Patch30: edk2-OvmfPkg-EmuVariableFvbRuntimeDxe-fix-ValidateFvHeade.patch
# python3-devel and libuuid-devel are required for building tools.
# python3-devel is also needed for varstore template generation and
@ -491,6 +493,11 @@ install -m 0644 \
%changelog
* Mon Aug 03 2026 Miroslav Rezanina <mrezanin@redhat.com> - 20260221-6
- edk2-OvmfPkg-EmuVariableFvbRuntimeDxe-fix-ValidateFvHeade.patch [RHEL-220548]
- Resolves: RHEL-220548
([RHEL 10.3] TDX Secure Boot Setup Mode with OVMF.inteltdx.secboot.fd)
* Thu Jul 09 2026 Miroslav Rezanina <mrezanin@redhat.com> - 20260221-5
- edk2-update-dbx-to-20260630-v1.6.5.patch [RHEL-193127]
- Resolves: RHEL-193127