From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail05.groups.io (mail05.groups.io [45.79.224.7]) by spool.mail.gandi.net (Postfix) with ESMTPS id 59F3D941739 for ; Thu, 30 May 2024 15:52:05 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=YPZnRE66Ehr+tcoC9TacCJB2qARjkCFHjCnb1nj1VoA=; c=relaxed/simple; d=groups.io; h=Message-ID:Date:User-Agent:Subject:To:Cc:References:From:In-Reply-To:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Resent-Date:Resent-From:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Language:Content-Type:Content-Transfer-Encoding; s=20240206; t=1717084325; v=1; b=B5sNEQFmcLz7zwyz7JBavYawWR/1wvMvtNxxneEHXk8gLVeSwMffLs0eJIVUzmvZY/WVTE2E n9o1mftCI8ZxNaoUI9J4UoSdOTvcPrKkMIIRaDNGIsOd6p6SPqZ0m2cYysSGRBrju4MM/AjNs1b 6DYP7uPLeXovq+l5mix6Utx07TNowH0lm1Ps7rUJJJWh+sy0xf6EX8wxfXa5nSljCPiamWZ+/ZN 2eLWnsiS18ZFrBKZzsXpWbADMu0C2yxUlihsvkaeJea+W8mbhsOt8GC8FN61p9xxP1DGmCICaHa SIYLBS6TbIWBpmVhFpgUEDeK0Ebzmq7BeFl7S2z7EbXxg== X-Received: by 127.0.0.2 with SMTP id B7eTYY7687511xZO0bQUW0aX; Thu, 30 May 2024 08:52:03 -0700 X-Received: from NAM10-DM6-obe.outbound.protection.outlook.com (NAM10-DM6-obe.outbound.protection.outlook.com [40.107.93.55]) by mx.groups.io with SMTP id smtpd.web10.13458.1717084323070761636 for ; Thu, 30 May 2024 08:52:03 -0700 X-Received: from BL1PR12MB5732.namprd12.prod.outlook.com (2603:10b6:208:387::17) by DM4PR12MB5937.namprd12.prod.outlook.com (2603:10b6:8:68::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7611.30; Thu, 30 May 2024 15:52:00 +0000 X-Received: from BL1PR12MB5732.namprd12.prod.outlook.com ([fe80::bf0:d462:345b:dc52]) by BL1PR12MB5732.namprd12.prod.outlook.com ([fe80::bf0:d462:345b:dc52%7]) with mapi id 15.20.7611.030; Thu, 30 May 2024 15:52:00 +0000 Message-ID: <096d5199-b85c-74ee-6ca6-a4bcbe6c45ad@amd.com> Date: Thu, 30 May 2024 10:51:58 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.15.1 Subject: Re: [edk2-devel] [PATCH 2/2] AmdSev: Halt on failed blob allocation To: Tobin Feldman-Fitzthum , devel@edk2.groups.io, Gerd Hoffmann , Ard Biesheuvel Cc: dov.murik@gmail.com, james.bottomley@hansenpartnership.com, tobin@ibm.com References: <267051ecc086a193b9f22377d0159022d49c0100.1715024059.git.tobin@linux.ibm.com> From: "Lendacky, Thomas via groups.io" In-Reply-To: <267051ecc086a193b9f22377d0159022d49c0100.1715024059.git.tobin@linux.ibm.com> X-ClientProxiedBy: SN7PR04CA0118.namprd04.prod.outlook.com (2603:10b6:806:122::33) To BL1PR12MB5732.namprd12.prod.outlook.com (2603:10b6:208:387::17) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: BL1PR12MB5732:EE_|DM4PR12MB5937:EE_ X-MS-Office365-Filtering-Correlation-Id: 4f91755c-738d-4a8d-95da-08dc80c07144 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam-Message-Info: =?utf-8?B?aHdpVTcrNTJGTS9sYWx2Ynpyd0p4Yi96V2MzSkNVU2l4eUpvaG42TThyZUFk?= =?utf-8?B?M1QzQkI5SHJHQXFYdE41My8wWGZkQUJ1eUxuS3RlazNmYzd5RGVraXVTb2Zs?= =?utf-8?B?STdCd0MxZVU3VFlMRzRuRTR3SEFCQzFqRUtFWENyeHVtT0U4U0x4emJTd1hR?= =?utf-8?B?bitoeXlNb0JUcFZrNGR4VDhhMFY2TEt0WkljN3NBRHpLcTZERWIvMjhpUy9X?= =?utf-8?B?bXFLbHhIUG85YU41MXM0VHp2STd4Y3lVaCtQT2VRdnA1aEY1eVorNS9mYjhU?= =?utf-8?B?VGgvSFZRVmRQMEROdzhDSDZxQ1VIT3JFdkxhYVEraktzYUhyWUxseEtMNXA5?= =?utf-8?B?eE9pc2F4N2FvbWlBQXRSa0p6Q0lLcTc1Sy9zUzZCNkdheHhWT3F1NzVSV3JX?= =?utf-8?B?RTlwb3VXNUZwMEFUb002eVdhaTlyN0p4SEhCR3FGMVBTOXF2QkJVK2VjcXU0?= =?utf-8?B?Zm9uV2dJbG1LU1gyWEN3aytRN0VESE04TE82MzdZdTl2ZkxlTkpid1kzaVcr?= =?utf-8?B?eGk2ZVRTemp0NXN5bWtTMjVyM2ZXWVo3SEROMjNUb3dydFF6K1NCbjJkYjhU?= =?utf-8?B?RDJhb1JNSUJ5dUZ5WHdYZjRLeGlVS3E4cmtYbE1ZQmJSVzFFaDVaN1I1U0dp?= =?utf-8?B?MXJwMStKTHpuaDZzK0Y1Y3F4UllJV3dCOWxQMWVyTUIzeUMwR1YwSGljV2pH?= =?utf-8?B?dWxTNEluTWhCajVXRWRGYTJpRVYxRUUxREczL2VWZnJBOGJVaWVmMDJnbUYr?= =?utf-8?B?VlRjSUQvcXhxWHdFWHFNUkdtMkZ6Rm1TQm9WL0RIeGZkeGQvcUxuZk42NVZW?= =?utf-8?B?YXFDVnBRWXlybDk5bCtNUXRoT3VXY0dwaDRNb0FxZ24rUTF3dXJvQlorTGdl?= =?utf-8?B?NTBtTzBDVGtXZTdFVjdmS3ArVTdtOTJZajlpYTkweG5UUDFJamsvdnZyaG5W?= =?utf-8?B?Q0hHMzVJOFl2VjVQemZPb3lkOFUyYmJuK1hzQVk5T09kTFd3VEhYcURSWitN?= =?utf-8?B?WTNIZlBCcHFxYkcyVTdrQTlicmh3ZGsyOHBjZzJzczlXL09ZVytBc2NSZldq?= =?utf-8?B?b1orUm5HVk05UVpybEwrd1BSNWE5WG9NMFN4QUh4MktLVWJ1dEgvdFR4eGly?= =?utf-8?B?M2prRlBpcmNLRzR1ZiszQkdSSFltODRBS0hvUlJRSlliVFRyOHlHWjRnM21Y?= =?utf-8?B?NkFmUVpqUnF5cHlTaVpES1VvbzAraUpEbnAwZkhGSENxcmJTUEhNWmdxK1hh?= =?utf-8?B?d28reHAraSs3ajdtUFRvZjA5MmdDRmIwOHptcE9PR2pPZTlYazllWVZ6MDI2?= =?utf-8?B?K25nY0lIa29ZclJ1Mkt2UHY0L05EQmh1OGtGNmFLSUdiWVZWNVJUMkIzMEpk?= =?utf-8?B?NlR2R3lJTzNkdWRaOEtLa3J3S0ROMHZIK3F2R09nbG93MFZtdUZFcjRiaWFj?= =?utf-8?B?K2hzNVVnUVUzZVdjWUZaNk5vS2hWV1BEenpYQTB3czZNcEdPaHZKZmhWcVg4?= =?utf-8?B?V2lJU3JMRm1ETGFsT2YvbmFoSEp1THJCb3NFbFdkVFowRTA1RkNCS05RZUxr?= =?utf-8?B?cXdidmQvTjR4K1VReUxpU2l5aU1ZWUhIcm15dHNpdVpUQXNNWG9EenFPYmtx?= =?utf-8?B?ZmlKNmovUVhNbW5nRjFXRDBteHgxQmJmeVA0ZFFtUTZ4WFE1M3NFeDJRNk1h?= =?utf-8?B?NDNMcWVlZDFsMGRwWDRacXo0Um1tSzVFckVCZ0JhdFBsYlQydVk2UHNBPT0=?= X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?MEdDSXB3UmpQaFM3UzhBaVEyT2JzTmF2UHF2clp1d25Qbkd6WkJCYnFWTEU2?= =?utf-8?B?eHhvQ1kwWHgxMkxHUDljREY5Uk1yWEdVQi9oT0YzK1p5SjQrOG1IMlVFWGh4?= =?utf-8?B?cExScHBkRVBGZzFOWnltV2oxZDY3NVNBenJ1d1lNRjBsQ1A2Y3p4TVhTOWh6?= =?utf-8?B?SkNCam5jQnFtQjhtbWFXOXpTQ1VaclNBSDRFVGdSc01YS0tKZ0xnZ3ZxdmVD?= =?utf-8?B?aGY4aUYyK0FraHZkeXBOY2pvWmIvVWFTY3FLNE05TjF5akpYWjFJc1o3YURT?= =?utf-8?B?enoyTjBHUjBwSyt6NzZjNFBOUmRTMlZ6YXpIR2tGNzBhSHEzTC9tL04xV3RY?= =?utf-8?B?d3BoYVU3bmlONVJuWGdITTdjNTVxbitJeis2NjVVYkluazJhcllnT1plNWZh?= =?utf-8?B?dnNHeTBYMFFiUVFubjkrM1g5K3pEVHRvaGRRTTZPc09nM1VNemt5ZmF5bkhL?= =?utf-8?B?WCtVeDR1eG5Yd2FVcnZWQU5xM29TdnJYeDlIZGtNUFMvRmlVTjVaTHVJZmRt?= =?utf-8?B?d29IZnB1WjFiY3pDMkZYRlJxWWZYeCs5b1VCejQrdzRWaytwTnQwRStneTMr?= =?utf-8?B?S3hkWjRLc1Y2ckV3WU1RUERnTXNNNXlVWkxmSVloVkE2Q3A3MHdpVklKM0dJ?= =?utf-8?B?dW9OSXhGT21xSjJMTFJ6SGY5Ry9LSlBrMVF5ZmUvQVVFdm9oQmJaV29UU3Bw?= =?utf-8?B?TC9lMXFPVitZZUJlZUlXT0pMaWZTQVB0bnZKdXF5cGl5VXB1QzRYWjcwVVpT?= =?utf-8?B?OVlKTTFpSnBEdGFrdXBqSFdWVVJYdXAvU1FQdEhxNk13RTBWT2cxYVlaYVQ2?= =?utf-8?B?OTQ2U1NrVTd4cDFCK2g1dVE4bVJrTGtLcjJXME1UYkgrTlIvL2p1K1o3NE92?= =?utf-8?B?WWxmYzBwSkNvSWRCOW9od2ZBZlM2NituREREL2NHRFhMNC9wQVFpVGZPOWhP?= =?utf-8?B?ZmJDamxabG9PV2pleHBaQm1YNTJPdFB2NVQvTzJJZ3lTUDFkMGJydW1oMGt5?= =?utf-8?B?YVdCQXM5T1VNeHFhTDA0TUQrNzBsU1hGU3ZWRENUWldweGdOenZRRW1UcDJG?= =?utf-8?B?aFBpQjBkcXlBQVVFcE02bjRJTUVRNkh3aTBQN2h4aDc5b1p6Z3I2ZGF6ckU4?= =?utf-8?B?TUNLU2JYUW01TzU0ckJtU0IrSG5pTUJSdnh3MEllbldhelRvK3dJWkVRd1Na?= =?utf-8?B?R2I4YlBzYUh5WWlJM2FDb0wvU05wRDRCYnFwR2ExQjdTYlJHc3VZdUI5UERG?= =?utf-8?B?YU1uWDNIZmVJbmNiNVRuT0VVMU1qUVdkT2FUOTBTTVI4T25qQzF4R29RalJh?= =?utf-8?B?WGErVEZjT2RWZENmaUtodVhkTWtLaWR5U2s5UGRpd05XQWdLdWxXTXJLeE55?= =?utf-8?B?R08rMDlUNUVCSEtQaXVJZmFUUjJFT0FRVmhYR1Iwdlg3c3lkZ0lVMS8rcE5O?= =?utf-8?B?Mm42UU9HYW1mb3ZVMEVpS2J1Wk5HRG5IZXo2ZlR2aSs5VFpMclF4U0xPZnZv?= =?utf-8?B?aFVGNDAvc05IcE9SY0Y5bEZWSTlxSFNkMnpwcnlWaGFmZUhqNUxHY3BsTGNK?= =?utf-8?B?aGkvQUZpTTVLTE83cDNtRnh3N2dvNW1VcWkrWHEyMnJOajQrRWdFZjN2MStj?= =?utf-8?B?U1JMQjRISEp2OHF3blNSY2ZuRUZaOG1uUjdIbldIZWZIK1ZydllSOExCaWgx?= =?utf-8?B?blJtUStPWUZ0RStHemloZ0hNRjNkNVJJbWtEbWZpUW1yN1Q0V2NhQ0xZZldy?= =?utf-8?B?SXFqV01XcVl4dS94QjIxNVZvbVlRSnFwS2NZamxFOUFKNUNNQXNJZ2tOUkk1?= =?utf-8?B?RHNWY2x4cXlISVVaR0pqeHZycyt4Q3ZrU01mZHpmeTU1SUxyY2QyQnB6NW9j?= =?utf-8?B?REh2MDdZVE5Ubmp0SDhaeHlUSWlpSitkWGtrcEFTeXEwbUtVc2lDSW1nTFNN?= =?utf-8?B?SHphdklEV2d2d25kbWJwTW12dzd4ejViWTFUNXZlZ2F5cFljalVKVks4Z1RK?= =?utf-8?B?QlJ6WlNvdmpLcTRHTElaM2dNbW1reXNnVWVBTFVxdFJrZ1dBSkJGTEp1ZXht?= =?utf-8?B?Z1JzVi9hZ1d5ak0yR0NFSlI2ZFllWVFmYmJueUxmY1BOcjN6ZDlsVFBTZ2pm?= =?utf-8?Q?DCNBM8nehU352M8N6N2x8u7aD?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 4f91755c-738d-4a8d-95da-08dc80c07144 X-MS-Exchange-CrossTenant-AuthSource: BL1PR12MB5732.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 May 2024 15:52:00.3672 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: +Y2zCFgWdVBDDWxi1DKlfYWAGyKqBFeQX6ek/Wi4GjFVSzCP4pwPUnBVNan/Yoj71rAvqmTmV1i7VvJOaJAVew== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM4PR12MB5937 Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Resent-Date: Thu, 30 May 2024 08:52:03 -0700 Resent-From: thomas.lendacky@amd.com Reply-To: devel@edk2.groups.io,thomas.lendacky@amd.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: aS7Ffpms7YIJ3388ZcyLRdXlx7686176AA= Content-Language: en-US Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: quoted-printable X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20240206 header.b=B5sNEQFm; dmarc=pass (policy=none) header.from=groups.io; spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 45.79.224.7 as permitted sender) smtp.mailfrom=bounce@groups.io On 5/6/24 15:27, Tobin Feldman-Fitzthum wrote: > A malicious host may be able to undermine the fw_cfg > interface such that loading a blob fails. >=20 > In this case rather than continuing to the next boot > option, the blob verifier should halt. >=20 > For non-confidential guests, the error should be non-fatal. >=20 > Signed-off-by: Tobin Feldman-Fitzthum > --- > .../BlobVerifierSevHashes.c | 17 ++++++++++++++++- > OvmfPkg/Include/Library/BlobVerifierLib.h | 14 ++++++++++---- > .../BlobVerifierLibNull/BlobVerifierNull.c | 13 ++++++++----- > .../QemuKernelLoaderFsDxe.c | 9 ++++----- > 4 files changed, 38 insertions(+), 15 deletions(-) >=20 > diff --git a/OvmfPkg/AmdSev/BlobVerifierLibSevHashes/BlobVerifierSevHashe= s.c b/OvmfPkg/AmdSev/BlobVerifierLibSevHashes/BlobVerifierSevHashes.c > index ee8bca509a..c550518d73 100644 > --- a/OvmfPkg/AmdSev/BlobVerifierLibSevHashes/BlobVerifierSevHashes.c > +++ b/OvmfPkg/AmdSev/BlobVerifierLibSevHashes/BlobVerifierSevHashes.c > @@ -83,6 +83,7 @@ FindBlobEntryGuid ( > @param[in] BlobName The name of the blob > @param[in] Buf The data of the blob > @param[in] BufSize The size of the blob in bytes > + @param[in] FetchStatus The status of the previous blob fetch > =20 > @retval EFI_SUCCESS The blob was verified successfully or w= as not > found in the hash table. > @@ -94,13 +95,27 @@ EFIAPI > VerifyBlob ( > IN CONST CHAR16 *BlobName, > IN CONST VOID *Buf, > - IN UINT32 BufSize > + IN UINT32 BufSize, > + IN EFI_STATUS FetchStatus > ) > { > CONST GUID *Guid; > INT32 Remaining; > HASH_TABLE *Entry; > =20 > + // Enter a dead loop if the fetching of this blob > + // failed. This prevents a malicious host from > + // circumventing the following checks. > + if (EFI_ERROR (FetchStatus)) { > + DEBUG (( > + DEBUG_ERROR, > + "%a: Fetching blob failed.\n", > + __func__ > + )); > + > + CpuDeadLoop (); > + } > + > if ((mHashesTable =3D=3D NULL) || (mHashesTableSize =3D=3D 0)) { > DEBUG (( > DEBUG_WARN, > diff --git a/OvmfPkg/Include/Library/BlobVerifierLib.h b/OvmfPkg/Include/= Library/BlobVerifierLib.h > index 7e1af27574..efe26734b1 100644 > --- a/OvmfPkg/Include/Library/BlobVerifierLib.h > +++ b/OvmfPkg/Include/Library/BlobVerifierLib.h > @@ -19,20 +19,26 @@ > /** > Verify blob from an external source. > =20 > + If a non-secure configuration is detected this function will enter a > + dead loop to prevent a boot. > + Probably shouldn't specify this here as the VerifyBlob() that is not in=20 AmdSev will not enter a dead loop. Thanks, Tom > @param[in] BlobName The name of the blob > @param[in] Buf The data of the blob > @param[in] BufSize The size of the blob in bytes > + @param[in] FetchStatus The status of fetching this blob > =20 > - @retval EFI_SUCCESS The blob was verified successfully. > - @retval EFI_ACCESS_DENIED The blob could not be verified, and ther= efore > - should be considered non-secure. > + @retval EFI_SUCCESS The blob was verified successfully or wa= s not > + found in the hash table. > + @retval EFI_ACCESS_DENIED Kernel hashes not supported but the boot= can > + continue safely. > **/ > EFI_STATUS > EFIAPI > VerifyBlob ( > IN CONST CHAR16 *BlobName, > IN CONST VOID *Buf, > - IN UINT32 BufSize > + IN UINT32 BufSize, > + IN EFI_STATUS FetchStatus > ); > =20 > #endif > diff --git a/OvmfPkg/Library/BlobVerifierLibNull/BlobVerifierNull.c b/Ovm= fPkg/Library/BlobVerifierLibNull/BlobVerifierNull.c > index e817c3cc95..db5320571c 100644 > --- a/OvmfPkg/Library/BlobVerifierLibNull/BlobVerifierNull.c > +++ b/OvmfPkg/Library/BlobVerifierLibNull/BlobVerifierNull.c > @@ -16,18 +16,21 @@ > @param[in] BlobName The name of the blob > @param[in] Buf The data of the blob > @param[in] BufSize The size of the blob in bytes > + @param[in] FetchStatus The status of the fetch of this blob > =20 > - @retval EFI_SUCCESS The blob was verified successfully. > - @retval EFI_ACCESS_DENIED The blob could not be verified, and ther= efore > - should be considered non-secure. > + @retval EFI_SUCCESS The blob was verified successfully or wa= s not > + found in the hash table. > + @retval EFI_ACCESS_DENIED Kernel hashes not supported but the boot= can > + continue safely. > **/ > EFI_STATUS > EFIAPI > VerifyBlob ( > IN CONST CHAR16 *BlobName, > IN CONST VOID *Buf, > - IN UINT32 BufSize > + IN UINT32 BufSize, > + IN EFI_STATUS FetchStatus > ) > { > - return EFI_SUCCESS; > + return FetchStatus; > } > diff --git a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c b/Ovmf= Pkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c > index 3c12085f6c..cf58c97cd2 100644 > --- a/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c > +++ b/OvmfPkg/QemuKernelLoaderFsDxe/QemuKernelLoaderFsDxe.c > @@ -1042,6 +1042,7 @@ QemuKernelLoaderFsDxeEntrypoint ( > KERNEL_BLOB *CurrentBlob; > KERNEL_BLOB *KernelBlob; > EFI_STATUS Status; > + EFI_STATUS FetchStatus; > EFI_HANDLE FileSystemHandle; > EFI_HANDLE InitrdLoadFile2Handle; > =20 > @@ -1060,15 +1061,13 @@ QemuKernelLoaderFsDxeEntrypoint ( > // > for (BlobType =3D 0; BlobType < KernelBlobTypeMax; ++BlobType) { > CurrentBlob =3D &mKernelBlob[BlobType]; > - Status =3D FetchBlob (CurrentBlob); > - if (EFI_ERROR (Status)) { > - goto FreeBlobs; > - } > + FetchStatus =3D FetchBlob (CurrentBlob); > =20 > Status =3D VerifyBlob ( > CurrentBlob->Name, > CurrentBlob->Data, > - CurrentBlob->Size > + CurrentBlob->Size, > + FetchStatus > ); > if (EFI_ERROR (Status)) { > goto FreeBlobs; -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#119398): https://edk2.groups.io/g/devel/message/119398 Mute This Topic: https://groups.io/mt/105977015/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-