Re: [PATCH V1 1/1] OvmfPkg/PlatformPei: Skip PlatformInitEmuVariableNvStore in SEV guest

["Min Xu" <min.m.xu@intel.com>]

On Friday, April 7, 2023 4:29 AM, Tom Lendacky wrote:
> On 4/5/23 20:42, Xu, Min M wrote:
> > On April 3, 2023 7:21 PM, Gerd Hoffmann wrote:
> >>>> I agree that the efi variable store is not secure without smm. But
> >>>> after 58eb8517ad7b be introduced, the -D SECURE_BOOT_ENABLE
> doesn't
> >>>> work with SEV. System just hangs in "NvVarStore FV headers were
> invalid."
> >>> Hi, Joeyli
> >>> ASSERT is triggered in DEBUG version. In RELEASE version ASSERT is
> >>> skipped
> >> and an error code is returned. So system will not hang.
> >>> So another solution is simply remove the ASSERT. Then an error
> >>> message is
> >> dumped out and system continues.
> >>>
> >>> @Gerd Hoffmann @Tom Lendacky @joeyli What's your thought?
> >>
> >> Maybe we just need to call ReserveEmuVariableNvStore a bit later?
> >>
> > I think we can still call ReserveEmuVariableNvStore at PEI phase, but
> > move the initialization of EmuVariableNvStore to
> >
> https://github.com/tianocore/edk2/blob/master/OvmfPkg/EmuVariableFvbR
> u
> > ntimeDxe/Fvb.c#L780-L783 @Tom Lendacky  At this moment, is SEV guest
> > available to read the content from VarStore?
> 
> It's quite possible. If you can work up a quick patch, I'll test it out.
> 
Yes, the patch is uploaded here https://bugzilla.tianocore.org/show_bug.cgi?id=4379#c17

Thanks
Min