diff --git a/edk2-OvmfPkg-EmuVariableFvbRuntimeDxe-fix-ValidateFvHeade.patch b/edk2-OvmfPkg-EmuVariableFvbRuntimeDxe-fix-ValidateFvHeade.patch new file mode 100644 index 0000000..4fa205f --- /dev/null +++ b/edk2-OvmfPkg-EmuVariableFvbRuntimeDxe-fix-ValidateFvHeade.patch @@ -0,0 +1,104 @@ +From 731f7856dd9b8fe807a3b9c60f1888f8f114ba0c Mon Sep 17 00:00:00 2001 +From: Gerd Hoffmann +Date: Thu, 30 Jul 2026 10:44:31 +0200 +Subject: [PATCH] OvmfPkg/EmuVariableFvbRuntimeDxe: fix ValidateFvHeader in tdx + mode. + +RH-Author: Gerd Hoffmann +RH-MergeRequest: 115: OvmfPkg/EmuVariableFvbRuntimeDxe: fix ValidateFvHeader in tdx mode. +RH-Jira: RHEL-220548 +RH-Acked-by: Luigi Leonardi +RH-Commit: [1/1] df1ee44a2c9af76f327a9f6bbd7f8a0ce67f1fac (kraxel.rh/centos-src-edk2) + +In TDX mode MmioRead* functions can not access memory, so avoid that. +See added source code comments for details. + +Fixes: 0917ddad2529 ("OvmfPkg/EmuVariableFvbRuntimeDxe: avoid accessing varstore header with cmp") +Signed-off-by: Gerd Hoffmann + +Resolves: https://redhat.atlassian.net/browse/RHEL-220548 +--- + OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.c | 41 +++++++++++++++++++++--- + OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.inf | 1 + + 2 files changed, 38 insertions(+), 4 deletions(-) + +diff --git a/OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.c b/OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.c +index 66e3929ec81..12b7fae2a1e 100644 +--- a/OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.c ++++ b/OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.c +@@ -8,6 +8,9 @@ + **/ + + #include "PiDxe.h" ++ ++#include ++ + #include + #include + #include +@@ -567,16 +570,46 @@ ValidateFvHeader ( + ) + { + UINT16 Checksum; ++ UINT8 Revision; ++ UINT32 Signature; ++ UINT64 FvLength; ++ UINT16 HeaderLength; ++ ++ if (CC_GUEST_IS_TDX (PcdGet64 (PcdConfidentialComputingGuestAttr))) { ++ /* ++ * When in tdx mode the varstore must be in ram not pflash, so there are no ++ * mmio reads/writes needed. Also in tdx mode BaseIoLibIntrinsic will ++ * translate the mmio access into TDVMCALL_MMIO calls instead of mov ++ * instructions, so memory access with MmioRead* functions does not work. ++ */ ++ Revision = FwVolHeader->Revision; ++ Signature = FwVolHeader->Signature; ++ FvLength = FwVolHeader->FvLength; ++ HeaderLength = FwVolHeader->HeaderLength; ++ } else { ++ /* ++ * In sev mode with varstore in pflash we must use MmioRead* functions so to ++ * make sure the mov instruction used to access pflash/memory is supported ++ * by the #VC handler instruction emulator. ++ * ++ * Note: Only sev + sev-es need proper pflash handling, sev-snp is like tdx ++ * incompatible with pflash emulation. ++ */ ++ Revision = MmioRead8 ((UINTN)(&FwVolHeader->Revision)); ++ Signature = MmioRead32 ((UINTN)(&FwVolHeader->Signature)); ++ FvLength = MmioRead64 ((UINTN)(&FwVolHeader->FvLength)); ++ HeaderLength = MmioRead16 ((UINTN)(&FwVolHeader->HeaderLength)); ++ } + + // + // Verify the header revision, header signature, length + // Length of FvBlock cannot be 2**64-1 + // HeaderLength cannot be an odd number + // +- if ((MmioRead8 ((UINTN)(&FwVolHeader->Revision)) != EFI_FVH_REVISION) || +- (MmioRead32 ((UINTN)(&FwVolHeader->Signature)) != EFI_FVH_SIGNATURE) || +- (MmioRead64 ((UINTN)(&FwVolHeader->FvLength)) != EMU_FVB_SIZE) || +- (MmioRead16 ((UINTN)(&FwVolHeader->HeaderLength)) != EMU_FV_HEADER_LENGTH) ++ if ((Revision != EFI_FVH_REVISION) || ++ (Signature != EFI_FVH_SIGNATURE) || ++ (FvLength != EMU_FVB_SIZE) || ++ (HeaderLength != EMU_FV_HEADER_LENGTH) + ) + { + DEBUG ((DEBUG_INFO, "EMU Variable FVB: Basic FV headers were invalid\n")); +diff --git a/OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.inf b/OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.inf +index 396e6028b40..da1da9e0bd5 100644 +--- a/OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.inf ++++ b/OvmfPkg/EmuVariableFvbRuntimeDxe/Fvb.inf +@@ -63,6 +63,7 @@ + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase64 + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase64 + gEfiMdeModulePkgTokenSpaceGuid.PcdEmuVariableNvStoreReserved ++ gEfiMdePkgTokenSpaceGuid.PcdConfidentialComputingGuestAttr + + [Depex] + TRUE +-- +2.52.0 + diff --git a/edk2.spec b/edk2.spec index eabb823..58f3b29 100644 --- a/edk2.spec +++ b/edk2.spec @@ -25,7 +25,7 @@ ExclusiveArch: x86_64 aarch64 riscv64 Name: edk2 Version: %{GITDATE} -Release: 5%{?dist} +Release: 6%{?dist} Summary: UEFI firmware for 64-bit virtual machines License: BSD-2-Clause-Patent and Apache-2.0 and MIT URL: http://www.tianocore.org @@ -95,6 +95,8 @@ Patch27: 0029-OvmfPkg-X64-add-opt-org.tianocore-UninstallMemAttrPr.patch Patch28: edk2-Revert-OvmfPkg-X86QemuLoadImageLib-flip-default-for-.patch # For RHEL-188305 - [edk2,rhel-10] Unable to allocate PCI BAR with edk2-20260221-1.el10 Patch29: edk2-Revert-MdeModulePkg-PciBusDxe-Degrade-MEM64-to-PMEM6.patch +# For RHEL-220548 - [RHEL 10.3] TDX Secure Boot Setup Mode with OVMF.inteltdx.secboot.fd +Patch30: edk2-OvmfPkg-EmuVariableFvbRuntimeDxe-fix-ValidateFvHeade.patch # python3-devel and libuuid-devel are required for building tools. # python3-devel is also needed for varstore template generation and @@ -491,6 +493,11 @@ install -m 0644 \ %changelog +* Mon Aug 03 2026 Miroslav Rezanina - 20260221-6 +- edk2-OvmfPkg-EmuVariableFvbRuntimeDxe-fix-ValidateFvHeade.patch [RHEL-220548] +- Resolves: RHEL-220548 + ([RHEL 10.3] TDX Secure Boot Setup Mode with OVMF.inteltdx.secboot.fd) + * Thu Jul 09 2026 Miroslav Rezanina - 20260221-5 - edk2-update-dbx-to-20260630-v1.6.5.patch [RHEL-193127] - Resolves: RHEL-193127