Re: [PATCH V3 0/7] Enable secure-boot when lauch OVMF with -bios parameter

["Gerd Hoffmann" <kraxel@redhat.com>]

On Wed, Jun 29, 2022 at 04:56:56PM +0800, Min Xu wrote:
> Secure-Boot related variables include the PK/KEK/DB/DBX and they are
> stored in NvVarStore (OVMF_VARS.fd). When lauching with -pflash,
> QEMU/OVMF will use emulated flash, and fully support UEFI variables.
> But when launching with -bios parameter, UEFI variables will be partially
> emulated, and non-volatile variables may lose their contents after a
> reboot. See OvmfPkg/README.
> 
> Tdx guest is an example that -pflash is not supported. So this patch-set
> is designed to initialize the NvVarStore with the content of in
> OVMF_VARS.fd.
> 
> patch 1:
>  Add a new function (AllocateRuntimePages) in PrePiMemoryAllocationLib.
>  This function will be used in PeilessStartupLib which will run
>  in SEC phase.
> 
> patch 2:
>  Delete the TdxValidateCfv in PeilessStartupLib. Because it is going to
>  be renamed to PlatformValidateNvVarStore and be moved to PlatformInitLib.
> 
> patch 3 - 7:
>  Then we add functions for EmuVariableNvStore in PlatformInitLib. This
>  lib will then be called in OvmfPkg/PlatformPei and PeilessStartupLib.
>  We also shortcut ConnectNvVarsToFileSystem in secure-boot.
> 
> patch 8:
>  At last a build-flag (SECURE_BOOT_FEATURE_ENABLED) is introduced in
>  the dsc in OvmfPkg. Because the copy over of OVMR_VARS.fd to
>  EmuVariableNvStore is only required when secure-boot is enabled.
> 
> Code: https://github.com/mxu9/edk2/tree/secure-boot.v3

/usr/bin/ld: /home/kraxel/projects/edk2/Build/IntelTdx/DEBUG_GCC5/X64/UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib/OUTPUT/SecPeiCpuExceptionHandlerLib.lib(ExceptionHandlerAsm.obj): warning: relocation in read-only section `.text'
/usr/bin/ld: /tmp/ccCEPSuH.ltrans0.ltrans.o: in function `SecCoreStartupWithStack':
/home/kraxel/projects/edk2/OvmfPkg/Library/PlatformInitLib/Platform.c:760: undefined reference to `AllocateRuntimePages'
/usr/bin/ld: /tmp/ccCEPSuH.ltrans0.ltrans.o:/home/kraxel/projects/edk2/OvmfPkg/Library/PlatformInitLib/Platform.c:760: undefined reference to `AllocateRuntimePages'
/usr/bin/ld: warning: creating DT_TEXTREL in a PIE
collect2: error: ld returned 1 exit status
make: *** [GNUmakefile:431: /home/kraxel/projects/edk2/Build/IntelTdx/DEBUG_GCC5/X64/OvmfPkg/IntelTdx/Sec/SecMain/DEBUG/SecMain.dll] Error 1

adding a build test for intel tdx to ci is probably a good idea ...

take care,
  Gerd