From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from NAM10-DM6-obe.outbound.protection.outlook.com (NAM10-DM6-obe.outbound.protection.outlook.com [40.107.93.80]) by mx.groups.io with SMTP id smtpd.web09.831.1631557213711474377 for ; Mon, 13 Sep 2021 11:20:13 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="body hash did not verify" header.i=@amd.com header.s=selector1 header.b=4lH2o2Wn; spf=permerror, err=parse error for token &{10 18 %{i}._ip.%{h}._ehlo.%{d}._spf.vali.email}: invalid domain name (domain: amd.com, ip: 40.107.93.80, mailfrom: brijesh.singh@amd.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=OE0rwOlM4i1EUkLD6RZqwtc58jNz7VhT+MAdEkzewE22xZxKRwRBoYAAc73Rp2s6clm7jJJqWTPyc5xdL8K3O8K5GjuZ3sKhbKDx9N9nr/CbAiod0ww1IRLSABIEmOWhZPjneywpiBkWWITQv84K0gq9Hi5VgkL5Q3jnasXJGSyjaybC0Ais4G06aEEWWMja70W8LVRGFq5hX6E23iwPU6o3yH908oZuaXe5VeVmpZzga2c4m7EHlmLFXa43sGZCqk6qTV7sFkXbG9mXelwkDbqPL+rQmbTDpJiBQ6p9QrB8hgQWFHKVQNTPmtTNaGubt/MKpHeH5GXnna52z0LIHA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version; bh=d6QlqwMvVA5/MpyI9WOkUO3hPCuZMkQqlO6jxIn3qTg=; b=oJL81FFOByFzAshEHa05Lug3s240IBUxgNdrdSq8TcIyaKDPfRtcBQnR/+spTbVbPC1MTImOUZ4GKLTohr3NSmEy4kL/S5CfH/9mlG4K1U9Q2JM9z2WBQ9Y2lQk+wMLn1bhQE4Yz9gRoADG9bOlNXsi6AYluajSBbrDC1HBsQdiEaaYuEczLpvHxTJfHBCYDt6IkVpgquuAjowC9IGAiEAQYbu9Gof4UgdXDxrpiTgHtAmbG2g3vMTZITKL8+ND2YaX3RUpYZ3mvgxC3/KgaPUr9HRMbV6BcSiQWGKiq0COizfmjGszlqQXa4T7W56YXcFpGC5UJHWAIlwZZ8/WtEw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=d6QlqwMvVA5/MpyI9WOkUO3hPCuZMkQqlO6jxIn3qTg=; b=4lH2o2WnV5l2BuINn0GE0wEbKLL+7U/WaJuyKSCstHFbvWPlVd6dNY1AeLyQ+XtGW9ewAn8JSLOWrOO5Yo7qyZ8wnxic9uBKFQbUU/OKCkXHkNIlpcqMRSHFG1d4aWsxfvSA1kVQhEXuQwk0t7o17Ac4Q3ZseQP5sA7RQlZ6Bpo= Authentication-Results: edk2.groups.io; dkim=none (message not signed) header.d=none;edk2.groups.io; dmarc=none action=none header.from=amd.com; Received: from SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) by SA0PR12MB4557.namprd12.prod.outlook.com (2603:10b6:806:9d::10) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4500.17; Mon, 13 Sep 2021 18:20:12 +0000 Received: from SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3]) by SN6PR12MB2718.namprd12.prod.outlook.com ([fe80::78b7:7336:d363:9be3%6]) with mapi id 15.20.4500.019; Mon, 13 Sep 2021 18:20:12 +0000 From: "Brijesh Singh" To: devel@edk2.groups.io CC: James Bottomley , Min Xu , Jiewen Yao , Tom Lendacky , Jordan Justen , Ard Biesheuvel , Erdem Aktas , Michael Roth , Gerd Hoffmann , Brijesh Singh , Michael Roth Subject: [PATCH v7 17/31] OvmfPkg/SecMain: pre-validate the memory used for decompressing Fv Date: Mon, 13 Sep 2021 13:19:27 -0500 Message-ID: <20210913181941.23405-18-brijesh.singh@amd.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20210913181941.23405-1-brijesh.singh@amd.com> References: <20210913181941.23405-1-brijesh.singh@amd.com> X-ClientProxiedBy: SA9P221CA0012.NAMP221.PROD.OUTLOOK.COM (2603:10b6:806:25::17) To SN6PR12MB2718.namprd12.prod.outlook.com (2603:10b6:805:6f::22) Return-Path: brijesh.singh@amd.com MIME-Version: 1.0 Received: from sbrijesh-desktop.amd.com (165.204.77.1) by SA9P221CA0012.NAMP221.PROD.OUTLOOK.COM (2603:10b6:806:25::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.4500.14 via Frontend Transport; Mon, 13 Sep 2021 18:20:11 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 6f001cbe-f6e3-4d77-27dc-08d976e32027 X-MS-TrafficTypeDiagnostic: SA0PR12MB4557: X-MS-Exchange-Transport-Forked: True X-Microsoft-Antispam-PRVS: X-MS-Oob-TLC-OOBClassifiers: OLM:7691; X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: EfrSljNn9ZFKR0XjRGt0Yvzwgrh+x7VMpsu7OU/fFobJRfSskTMFTtY6ava1U2JiONkjq6QjSOk0l5jTYUowfbAUXy35H4kzIF7WYnQsJL04Z3mFxJ9sxPrwbWSSVNT2L47UYUf5ytByY8liIILjWI+pyXrmuFUokwaLHKiMeL7gImBuAR1tbLuFR5B+uyJHPQFi4/kAgkixvJG5qPSDzgtr08c1ugR9JndY3J665pWa0DuXBbZoLdZiv8VO3c6Qs7eeQyHoYhybnCXHS55+s0iYMbh01rSMc8tuUEt/ABsoGsO8ExJoxx1ZfYBvXm2p0U3p4szpvuFqbWakpDV3lrfwW59f/YIpdEfEYmo4xiIokCd2uecL3j3REpdFwjWldLPyxmzRj67OOFGp3KwUr/xOHqOB59fB5pYL3v4rpSYWkYer7ytYfUijizX5KG9sy9CC5WsJIhnW3mnBBDFB87ACiWpZ9MSzkZ/JezuaCcIy0+b658Ki0ENNIzuPQbld4ShL09hOE6Y79fGecDyKF6ajFxyZ4Ay0qQm3Y9+j3CASmKSTMbS0FOC2i3ouYr/OP8uZkY+PoYdLcTVoK0cL5fbReR1S0cQ9E9LvIW0chOsZ4x2+lekXc3fff1ki7QiQ5fBYda+IKJbv0663sEIFbi862aJy4AJYU7IY880if6ZITLa0XRGhxEJGYAwXdb/3/yFc/bzgUiscq7E7CvxYkvi6vIcM4i2isrg9fdu2ncPoMFPpErXirSbeRaHTc8/Zz3Ohehz1MhI7aXT9BCJ9FLFwvZL3QnOILBvXHcM4rs0= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:SN6PR12MB2718.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(4636009)(396003)(136003)(366004)(346002)(39860400002)(376002)(478600001)(86362001)(7696005)(6916009)(966005)(316002)(52116002)(54906003)(15650500001)(44832011)(83380400001)(38350700002)(66556008)(5660300002)(36756003)(19627235002)(1076003)(4326008)(2906002)(186003)(956004)(26005)(8936002)(8676002)(2616005)(6486002)(38100700002)(6666004)(66476007)(66946007);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?2lfnd2aLvw3OeKmoVjuXncd1szJzzgbZ3ksGgOk2hInPNHqemGkD57E4eWIp?= =?us-ascii?Q?Wu1M0894nDLVYq1hIzV6Xa3wUvPHDLKGMz/ViSAlQFIzJgEaTxqNQJoeVU5g?= =?us-ascii?Q?/QdgPYdAkeURVH5reO2wjhrR6kXSjImKvNOuZZx2lpkl6F0FDyh70SccVoTB?= =?us-ascii?Q?qebr8WqU5nkv4q+3awcBF/wSGMh6HL6900LiXINv+73oHY69PF3fAqLC48VD?= =?us-ascii?Q?lRSQ9QxGBLQuJCDse3mve2QmDqII7IsOdN4mNAUSXUInsEr0+PJtdaPY7qAu?= =?us-ascii?Q?5mhuyQB10VEwfQd2/5mkM7uUzY/UPFccKsad/HYd8j5udegBT6Iz++0uiq3Z?= =?us-ascii?Q?Lavo/3RdhN9zbGOpTCSNTiAAq0Q3LXyFSBJa0O5bSjmbB4bxAYEVCIluNRkq?= =?us-ascii?Q?DbOtJEpR0/cDCZIqN9y+lGLsvbQQQc3ZkEWFXFI/I1I1brjUFcfB241kqO8C?= =?us-ascii?Q?89s2Xiy+lbeldhHD4gM2RyAxZ4xfrY2BFftrzjcIpwDojiSzCu6sKfb1TTuF?= =?us-ascii?Q?CUptMn4cuuvdHnNr5Xziywhc98Zzq7XohvFmQrmsinhOA8xcn6PZ7xIbSj5P?= =?us-ascii?Q?wZTVm35h1rEdt4dDXm4WFXBk2jCmYCLCTdOGSybFKBdyzv0YnwBPd7fRgvrK?= =?us-ascii?Q?T4EV+zhNUzIklNuM47oV8ch/Tubm/88njYacXoozhS6cu82rxsTctjlQiYoZ?= =?us-ascii?Q?E6hXW76SKwImDWs27ee7b5Zktwq5qGQXTJzJXN8VvZuYQgQ0GoACMXIzIIdF?= =?us-ascii?Q?Z5aMJmiDVy4YqrETTIbaiGD0PrZXGU2lzdj1cakkFpYzRdSeAWdfHoWu0suH?= =?us-ascii?Q?B0QXf4mvmtBNplq5hjnnuB+dr+tcxZBhVp0MSDqyIr87I5GgfHj7jx7BMaPM?= =?us-ascii?Q?blXSjp84j8UHRGvMUcjxiY6BORU2Jsoz/mcxEvyiq1P3c5Kaqtgi4CZIVDEK?= =?us-ascii?Q?kqZJXae5YFEdPhw0q1GkcMq+SZuFu89MzHm5HnTK0z7e31JY1zWgqB4HhSCJ?= =?us-ascii?Q?rW6pBAfNvnHtTOlUKQAEMS9/4MNNwp+Dg4SKX2ZQe7ulPqHzA5zD75Cc4mGL?= =?us-ascii?Q?Ar+7b/nsbFFt85os+ZQFy1GH7ihwkwldj8bVcwncZpZlZwaxupoL79fC7z13?= =?us-ascii?Q?s7jpCgf/jXfZje8Ui5PW4kdMkrau49rprYdhVi/LG72Kw0HGzkibceI7BkiM?= =?us-ascii?Q?h+LmAmbC6WOnLH7aChpvFRHbku3mzHKxpy80MU2rHlc9XuR6JJOkcoXQNXm3?= =?us-ascii?Q?/gPOuop2CmnvnkxIT+6AxNa6K+PzaAzWZ6q25mPr45vHWc2i5Khv3DNlpNF/?= =?us-ascii?Q?sbk7iSfHyRYnjVDmcEDhdQRn?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 6f001cbe-f6e3-4d77-27dc-08d976e32027 X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 13 Sep 2021 18:20:12.0995 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: QDyRi07U2p4gQuVbD3XG0davqyYUW3nPpPLncjFWbi8lHjNFoqG48BPZLdRLlur14vdQm/oKhsGRyJE2KN93TA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR12MB4557 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain BZ: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3275 The VMM launch sequence should have pre-validated all the data pages used in the Reset vector. The range does not cover the data pages used during the SEC phase (mainly PEI and DXE firmware volume decompression memory). When SEV-SNP is active, the memory must be pre-validated before the access. Add support to pre-validate the memory range from SnpSecPreValidatedStart to SnpSecPreValidatedEnd. This should be sufficent to enter into the PEI phase. Cc: Michael Roth Cc: James Bottomley Cc: Min Xu Cc: Jiewen Yao Cc: Tom Lendacky Cc: Jordan Justen Cc: Ard Biesheuvel Cc: Erdem Aktas Cc: Gerd Hoffmann Acked-by: Jiewen Yao Signed-off-by: Brijesh Singh --- OvmfPkg/OvmfPkg.dec | 5 ++++ .../PeiMemEncryptSevLib.inf | 2 ++ OvmfPkg/Sec/SecMain.inf | 3 +++ OvmfPkg/Sec/AmdSev.h | 23 +++++++++++++++++++ .../X64/PeiSnpSystemRamValidate.c | 5 ++++ OvmfPkg/Sec/AmdSev.c | 20 +++++++++++++++- OvmfPkg/Sec/SecMain.c | 7 ++++++ OvmfPkg/FvmainCompactScratchEnd.fdf.inc | 5 ++++ 8 files changed, 69 insertions(+), 1 deletion(-) diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec index efa0de6d0600..e30cb6eafcb8 100644 --- a/OvmfPkg/OvmfPkg.dec +++ b/OvmfPkg/OvmfPkg.dec @@ -354,6 +354,11 @@ [PcdsFixedAtBuild] gUefiOvmfPkgTokenSpaceGuid.PcdOvmfCpuidBase|0|UINT32|0x54 gUefiOvmfPkgTokenSpaceGuid.PcdOvmfCpuidSize|0|UINT32|0x55 =20 + ## The range of memory that need to be pre-validated in the SEC phase + # when SEV-SNP is active in the guest VM. + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecPreValidatedStart|0|UINT32|0x56 + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecPreValidatedEnd|0|UINT32|0x57 + [PcdsDynamic, PcdsDynamicEx] gUefiOvmfPkgTokenSpaceGuid.PcdEmuVariableEvent|0|UINT64|2 gUefiOvmfPkgTokenSpaceGuid.PcdOvmfFlashVariablesEnable|FALSE|BOOLEAN|0x1= 0 diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf b= /OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf index 1cc9dd6691a2..01764ab3a1a8 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf @@ -78,3 +78,5 @@ [FixedPcd] gUefiOvmfPkgTokenSpaceGuid.PcdOvmfLockBoxStorageSize gEfiMdePkgTokenSpaceGuid.PcdGuidedExtractHandlerTableAddress gUefiOvmfPkgTokenSpaceGuid.PcdGuidedExtractHandlerTableSize + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecPreValidatedEnd + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecPreValidatedStart diff --git a/OvmfPkg/Sec/SecMain.inf b/OvmfPkg/Sec/SecMain.inf index 9523a8ea6c8f..7e2668ff2f66 100644 --- a/OvmfPkg/Sec/SecMain.inf +++ b/OvmfPkg/Sec/SecMain.inf @@ -51,6 +51,7 @@ [LibraryClasses] PeCoffExtraActionLib ExtractGuidedSectionLib LocalApicLib + MemEncryptSevLib CpuExceptionHandlerLib =20 [Ppis] @@ -73,6 +74,8 @@ [Pcd] gEfiMdeModulePkgTokenSpaceGuid.PcdInitValueInTempStack gUefiOvmfPkgTokenSpaceGuid.PcdOvmfConfidentialComputingWorkAreaHeader gUefiOvmfPkgTokenSpaceGuid.PcdOvmfWorkAreaBase + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecPreValidatedStart + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecPreValidatedEnd =20 [FeaturePcd] gUefiOvmfPkgTokenSpaceGuid.PcdSmmSmramRequire diff --git a/OvmfPkg/Sec/AmdSev.h b/OvmfPkg/Sec/AmdSev.h index adad96d23189..33af32b9925b 100644 --- a/OvmfPkg/Sec/AmdSev.h +++ b/OvmfPkg/Sec/AmdSev.h @@ -69,4 +69,27 @@ SevEsIsEnabled ( VOID ); =20 +/** + Pre-validate System RAM used for decompressing the PEI and DXE firmware v= olumes + when SEV-SNP is active. The PCDs SecPreValidatedStart and SecPreValidated= End are + set in OvmfPkg/FvmainCompactScratchEnd.fdf.inc. + +**/ +VOID +SevSnpSecPreValidateSystemRam ( + VOID + ); + +/** + Determine if SEV-SNP is active. + + @retval TRUE SEV-SNP is enabled + @retval FALSE SEV-SNP is not enabled + +**/ +BOOLEAN +SevSnpIsEnabled ( + VOID + ); + #endif diff --git a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValida= te.c b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValidate.c index a0803e1255dc..c51d565fc176 100644 --- a/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValidate.c +++ b/OvmfPkg/Library/BaseMemEncryptSevLib/X64/PeiSnpSystemRamValidate.c @@ -65,6 +65,11 @@ STATIC SNP_PRE_VALIDATED_RANGE mPreValidatedRange[] =3D = { FixedPcdGet32 (PcdOvmfSecPeiTempRamBase), FixedPcdGet32 (PcdOvmfSecPeiTempRamBase) + FixedPcdGet32 (PcdOvmfSecPe= iTempRamSize), }, + // The below range is pre-validated by the Sec/SecMain.c + { + FixedPcdGet32 (PcdOvmfSnpSecPreValidatedStart), + FixedPcdGet32 (PcdOvmfSnpSecPreValidatedEnd) + }, }; =20 STATIC diff --git a/OvmfPkg/Sec/AmdSev.c b/OvmfPkg/Sec/AmdSev.c index 7d4d7cc8a07c..e54a3fa23f6a 100644 --- a/OvmfPkg/Sec/AmdSev.c +++ b/OvmfPkg/Sec/AmdSev.c @@ -55,7 +55,6 @@ SevEsProtocolFailure ( @retval FALSE SEV-SNP is not enabled =20 **/ -STATIC BOOLEAN SevSnpIsEnabled ( VOID @@ -296,3 +295,22 @@ SevEsIsEnabled ( =20 return (SevEsWorkArea->SevEsEnabled !=3D 0); } + +/** + Pre-validate System RAM used for decompressing the PEI and DXE firmware v= olumes + when SEV-SNP is active. The PCDs SecPreValidatedStart and SecPreValidated= End are + set in OvmfPkg/FvmainCompactScratchEnd.fdf.inc. + +**/ +VOID +SevSnpSecPreValidateSystemRam ( + VOID + ) +{ + PHYSICAL_ADDRESS Start, End; + + Start =3D (EFI_PHYSICAL_ADDRESS) PcdGet32 (PcdOvmfSnpSecPreValidatedStar= t); + End =3D (EFI_PHYSICAL_ADDRESS) PcdGet32 (PcdOvmfSnpSecPreValidatedEnd); + + MemEncryptSevSnpPreValidateSystemRam (Start, EFI_SIZE_TO_PAGES (End - St= art)); +} diff --git a/OvmfPkg/Sec/SecMain.c b/OvmfPkg/Sec/SecMain.c index 406e3a25d0cd..0d80494b062c 100644 --- a/OvmfPkg/Sec/SecMain.c +++ b/OvmfPkg/Sec/SecMain.c @@ -847,6 +847,13 @@ SecCoreStartupWithStack ( SecCoreData.BootFirmwareVolumeBase =3D BootFv; SecCoreData.BootFirmwareVolumeSize =3D (UINTN) BootFv->FvLength; =20 + if (SevSnpIsEnabled ()) { + // + // Pre-validate the System RAM used in the SEC Phase + // + SevSnpSecPreValidateSystemRam (); + } + // // Make sure the 8259 is masked before initializing the Debug Agent and = the debug timer is enabled // diff --git a/OvmfPkg/FvmainCompactScratchEnd.fdf.inc b/OvmfPkg/FvmainCompac= tScratchEnd.fdf.inc index 46f52583297c..b560fb0b8e4f 100644 --- a/OvmfPkg/FvmainCompactScratchEnd.fdf.inc +++ b/OvmfPkg/FvmainCompactScratchEnd.fdf.inc @@ -63,3 +63,8 @@ DEFINE DECOMP_SCRATCH_BASE =3D (($(DECOMP_SCRATCH_BASE_UNALIGNED= ) + $(DECOMP_SCRATCH_BASE_ALIGNMENT)) & $(DECOMP_SCRATCH_BASE_MASK)) =20 SET gUefiOvmfPkgTokenSpaceGuid.PcdOvmfDecompressionScratchEnd =3D $(DECOMP= _SCRATCH_BASE) + $(DECOMP_SCRATCH_SIZE) + +# +# The range of pages that should be pre-validated during the SEC phase whe= n SEV-SNP is active in the guest VM. +SET gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecPreValidatedStart =3D $(MEMFD_= BASE_ADDRESS) + gUefiOvmfPkgTokenSpaceGuid.PcdOvmfPeiMemFvBase +SET gUefiOvmfPkgTokenSpaceGuid.PcdOvmfSnpSecPreValidatedEnd =3D $(DECOMP_S= CRATCH_BASE) + $(DECOMP_SCRATCH_SIZE) --=20 2.17.1