OvmfPkg/TpmMmioSevDecryptPei: Mark TPM MMIO range as unencrypted for SEV-ES

[mirror_edk2.git] / OvmfPkg / OvmfPkgX64.dsc

diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc
index 643e6041ad53e7f222940c5e852cc19badc8ac7b..999738dc39cd479e115ae89a7b06543fa757a80a 100644 (file)
--- a/OvmfPkg/OvmfPkgX64.dsc
+++ b/OvmfPkg/OvmfPkgX64.dsc
@@ -1,8 +1,9 @@
 ## @file\r
 #  EFI/Framework Open Virtual Machine Firmware (OVMF) platform\r
 #\r
-#  Copyright (c) 2006 - 2019, Intel Corporation. All rights reserved.<BR>\r
+#  Copyright (c) 2006 - 2021, Intel Corporation. All rights reserved.<BR>\r
 #  (C) Copyright 2016 Hewlett Packard Enterprise Development LP<BR>\r
+#  Copyright (c) Microsoft Corporation.\r
 #\r
 #  SPDX-License-Identifier: BSD-2-Clause-Patent\r
 #\r
@@ -41,6 +42,7 @@
   DEFINE NETWORK_IP6_ENABLE             = FALSE\r
   DEFINE NETWORK_HTTP_BOOT_ENABLE       = FALSE\r
   DEFINE NETWORK_ALLOW_HTTP_CONNECTIONS = TRUE\r
+  DEFINE NETWORK_ISCSI_ENABLE           = TRUE\r
 \r
 !include NetworkPkg/NetworkDefines.dsc.inc\r
 \r
@@ -49,6 +51,7 @@
   #\r
   DEFINE PVSCSI_ENABLE           = TRUE\r
   DEFINE MPT_SCSI_ENABLE         = TRUE\r
+  DEFINE LSI_SCSI_ENABLE         = FALSE\r
 \r
   #\r
   # Flash size selection. Setting FD_SIZE_IN_KB on the command line directly to\r
@@ -81,6 +84,7 @@
   GCC:*_*_X64_GENFW_FLAGS   = --keepexceptiontable\r
   INTEL:*_*_X64_GENFW_FLAGS = --keepexceptiontable\r
 !endif\r
+  RELEASE_*_*_GENFW_FLAGS = --zero\r
 \r
   #\r
   # Disable deprecated APIs.\r
@@ -89,6 +93,8 @@
   INTEL:*_*_*_CC_FLAGS = /D DISABLE_NEW_DEPRECATED_INTERFACES\r
   GCC:*_*_*_CC_FLAGS = -D DISABLE_NEW_DEPRECATED_INTERFACES\r
 \r
+!include NetworkPkg/NetworkBuildOptions.dsc.inc\r
+\r
 [BuildOptions.common.EDKII.DXE_RUNTIME_DRIVER]\r
   GCC:*_*_*_DLINK_FLAGS = -z common-page-size=0x1000\r
   XCODE:*_*_*_DLINK_FLAGS = -seg1addr 0x1000 -segalign 0x1000\r
@@ -116,6 +122,9 @@
 # Library Class section - list of all Library Classes needed by this Platform.\r
 #\r
 ################################################################################\r
+\r
+!include MdePkg/MdeLibs.dsc.inc\r
+\r
 [LibraryClasses]\r
   PcdLib|MdePkg/Library/BasePcdLibNull/BasePcdLibNull.inf\r
   TimerLib|OvmfPkg/Library/AcpiTimerLib/BaseAcpiTimerLib.inf\r
@@ -124,6 +133,7 @@
   BaseMemoryLib|MdePkg/Library/BaseMemoryLibRepStr/BaseMemoryLibRepStr.inf\r
   BaseLib|MdePkg/Library/BaseLib/BaseLib.inf\r
   SafeIntLib|MdePkg/Library/BaseSafeIntLib/BaseSafeIntLib.inf\r
+  TimeBaseLib|EmbeddedPkg/Library/TimeBaseLib/TimeBaseLib.inf\r
   BmpSupportLib|MdeModulePkg/Library/BaseBmpSupportLib/BaseBmpSupportLib.inf\r
   SynchronizationLib|MdePkg/Library/BaseSynchronizationLib/BaseSynchronizationLib.inf\r
   CpuLib|MdePkg/Library/BaseCpuLib/BaseCpuLib.inf\r
@@ -152,6 +162,7 @@
   OemHookStatusCodeLib|MdeModulePkg/Library/OemHookStatusCodeLibNull/OemHookStatusCodeLibNull.inf\r
   SerialPortLib|PcAtChipsetPkg/Library/SerialIoLib/SerialIoLib.inf\r
   MtrrLib|UefiCpuPkg/Library/MtrrLib/MtrrLib.inf\r
+  MicrocodeLib|UefiCpuPkg/Library/MicrocodeLib/MicrocodeLib.inf\r
   UefiLib|MdePkg/Library/UefiLib/UefiLib.inf\r
   UefiBootServicesTableLib|MdePkg/Library/UefiBootServicesTableLib/UefiBootServicesTableLib.inf\r
   UefiRuntimeServicesTableLib|MdePkg/Library/UefiRuntimeServicesTableLib/UefiRuntimeServicesTableLib.inf\r
@@ -168,7 +179,7 @@
   QemuFwCfgSimpleParserLib|OvmfPkg/Library/QemuFwCfgSimpleParserLib/QemuFwCfgSimpleParserLib.inf\r
   VirtioLib|OvmfPkg/Library/VirtioLib/VirtioLib.inf\r
   LoadLinuxLib|OvmfPkg/Library/LoadLinuxLib/LoadLinuxLib.inf\r
-  MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/BaseMemEncryptSevLib.inf\r
+  MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/DxeMemEncryptSevLib.inf\r
 !if $(SMM_REQUIRE) == FALSE\r
   LockBoxLib|OvmfPkg/Library/LockBoxLib/LockBoxBaseLib.inf\r
 !endif\r
@@ -192,6 +203,7 @@
 !else\r
   OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf\r
 !endif\r
+  RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf\r
 \r
 !if $(SECURE_BOOT_ENABLE) == TRUE\r
   PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf\r
@@ -200,6 +212,8 @@
   AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf\r
 !endif\r
   VarCheckLib|MdeModulePkg/Library/VarCheckLib/VarCheckLib.inf\r
+  VariablePolicyLib|MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf\r
+  VariablePolicyHelperLib|MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf\r
 \r
 \r
   #\r
@@ -232,6 +246,7 @@
 \r
 [LibraryClasses.common]\r
   BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf\r
+  VmgExitLib|OvmfPkg/Library/VmgExitLib/VmgExitLib.inf\r
 \r
 [LibraryClasses.common.SEC]\r
   TimerLib|OvmfPkg/Library/AcpiTimerLib/BaseRomAcpiTimerLib.inf\r
@@ -255,6 +270,8 @@
 !else\r
   CpuExceptionHandlerLib|UefiCpuPkg/Library/CpuExceptionHandlerLib/SecPeiCpuExceptionHandlerLib.inf\r
 !endif\r
+  VmgExitLib|OvmfPkg/Library/VmgExitLib/SecVmgExitLib.inf\r
+  MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/SecMemEncryptSevLib.inf\r
 \r
 [LibraryClasses.common.PEI_CORE]\r
   HobLib|MdePkg/Library/PeiHobLib/PeiHobLib.inf\r
@@ -304,6 +321,8 @@
   Tpm2DeviceLib|SecurityPkg/Library/Tpm2DeviceLibDTpm/Tpm2DeviceLibDTpm.inf\r
 !endif\r
 \r
+  MemEncryptSevLib|OvmfPkg/Library/BaseMemEncryptSevLib/PeiMemEncryptSevLib.inf\r
+\r
 [LibraryClasses.common.DXE_CORE]\r
   HobLib|MdePkg/Library/DxeCoreHobLib/DxeCoreHobLib.inf\r
   DxeCoreEntryPoint|MdePkg/Library/DxeCoreEntryPoint/DxeCoreEntryPoint.inf\r
@@ -338,6 +357,10 @@
   BaseCryptLib|CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf\r
   PciLib|OvmfPkg/Library/DxePciLibI440FxQ35/DxePciLibI440FxQ35.inf\r
   QemuFwCfgS3Lib|OvmfPkg/Library/QemuFwCfgS3Lib/DxeQemuFwCfgS3LibFwCfg.inf\r
+  VariablePolicyLib|MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf\r
+!if $(SMM_REQUIRE) == TRUE\r
+  MmUnblockMemoryLib|MdePkg/Library/MmUnblockMemoryLib/MmUnblockMemoryLibNull.inf\r
+!endif\r
 \r
 [LibraryClasses.common.UEFI_DRIVER]\r
   PcdLib|MdePkg/Library/DxePcdLib/DxePcdLib.inf\r
@@ -383,11 +406,7 @@
   PciLib|OvmfPkg/Library/DxePciLibI440FxQ35/DxePciLibI440FxQ35.inf\r
   MpInitLib|UefiCpuPkg/Library/MpInitLib/DxeMpInitLib.inf\r
   QemuFwCfgS3Lib|OvmfPkg/Library/QemuFwCfgS3Lib/DxeQemuFwCfgS3LibFwCfg.inf\r
-!if $(SECURE_BOOT_ENABLE) == TRUE\r
-  QemuLoadImageLib|OvmfPkg/Library/GenericQemuLoadImageLib/GenericQemuLoadImageLib.inf\r
-!else\r
   QemuLoadImageLib|OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.inf\r
-!endif\r
 !if $(TPM_ENABLE) == TRUE\r
   Tpm12DeviceLib|SecurityPkg/Library/Tpm12DeviceLibTcg/Tpm12DeviceLibTcg.inf\r
   Tpm2DeviceLib|SecurityPkg/Library/Tpm2DeviceLibTcg2/Tpm2DeviceLibTcg2.inf\r
@@ -453,8 +472,6 @@
 ################################################################################\r
 [PcdsFeatureFlag]\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdHiiOsRuntimeSupport|FALSE\r
-  gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeUseSerial|FALSE\r
-  gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeUseMemory|TRUE\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdDxeIplSupportUefiDecompress|FALSE\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdDxeIplSwitchToLongMode|FALSE\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdConOutGopSupport|TRUE\r
@@ -475,6 +492,7 @@
   gEfiMdeModulePkgTokenSpaceGuid.PcdResetOnMemoryTypeInformationChange|FALSE\r
 !endif\r
   gEfiMdePkgTokenSpaceGuid.PcdMaximumGuidedExtractHandler|0x10\r
+  gEfiMdePkgTokenSpaceGuid.PcdMaximumLinkedListLength|0\r
 !if ($(FD_SIZE_IN_KB) == 1024) || ($(FD_SIZE_IN_KB) == 2048)\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x2000\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x2800\r
@@ -497,6 +515,8 @@
 !endif\r
 \r
   gEfiMdeModulePkgTokenSpaceGuid.PcdVpdBaseAddress|0x0\r
+  gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeUseSerial|FALSE\r
+  gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeUseMemory|TRUE\r
 \r
   gEfiMdePkgTokenSpaceGuid.PcdReportStatusCodePropertyMask|0x07\r
 \r
@@ -540,11 +560,25 @@
   gEfiSourceLevelDebugPkgTokenSpaceGuid.PcdDebugLoadImageMethod|0x2\r
 !endif\r
 \r
+  #\r
+  # The NumberOfPages values below are ad-hoc. They are updated sporadically at\r
+  # best (please refer to git-blame for past updates). The values capture a set\r
+  # of BIN hints that made sense at a particular time, for some (now likely\r
+  # unknown) workloads / boot paths.\r
+  #\r
+  gEmbeddedTokenSpaceGuid.PcdMemoryTypeEfiACPIMemoryNVS|0x80\r
+  gEmbeddedTokenSpaceGuid.PcdMemoryTypeEfiACPIReclaimMemory|0x10\r
+  gEmbeddedTokenSpaceGuid.PcdMemoryTypeEfiReservedMemoryType|0x80\r
+  gEmbeddedTokenSpaceGuid.PcdMemoryTypeEfiRuntimeServicesCode|0x100\r
+  gEmbeddedTokenSpaceGuid.PcdMemoryTypeEfiRuntimeServicesData|0x100\r
+\r
   #\r
   # Network Pcds\r
   #\r
 !include NetworkPkg/NetworkPcds.dsc.inc\r
 \r
+  gEfiShellPkgTokenSpaceGuid.PcdShellFileOperationSize|0x20000\r
+\r
 !if $(SMM_REQUIRE) == TRUE\r
   gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmStackSize|0x4000\r
 !endif\r
@@ -607,6 +641,11 @@
   # Set memory encryption mask\r
   gEfiMdeModulePkgTokenSpaceGuid.PcdPteMemoryEncryptionAddressOrMask|0x0\r
 \r
+  # Set SEV-ES defaults\r
+  gEfiMdeModulePkgTokenSpaceGuid.PcdGhcbBase|0\r
+  gEfiMdeModulePkgTokenSpaceGuid.PcdGhcbSize|0\r
+  gUefiCpuPkgTokenSpaceGuid.PcdSevEsIsEnabled|0\r
+\r
 !if $(SMM_REQUIRE) == TRUE\r
   gUefiOvmfPkgTokenSpaceGuid.PcdQ35TsegMbytes|8\r
   gUefiOvmfPkgTokenSpaceGuid.PcdQ35SmramAtDefaultSmbase|FALSE\r
@@ -679,6 +718,7 @@
   UefiCpuPkg/CpuMpPei/CpuMpPei.inf\r
 \r
 !if $(TPM_ENABLE) == TRUE\r
+  OvmfPkg/Tcg/TpmMmioSevDecryptPei/TpmMmioSevDecryptPei.inf\r
   OvmfPkg/Tcg/Tcg2Config/Tcg2ConfigPei.inf\r
   SecurityPkg/Tcg/TcgPei/TcgPei.inf\r
   SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.inf {\r
@@ -731,6 +771,7 @@
   MdeModulePkg/Bus/Pci/PciHostBridgeDxe/PciHostBridgeDxe.inf {\r
     <LibraryClasses>\r
       PciHostBridgeLib|OvmfPkg/Library/PciHostBridgeLib/PciHostBridgeLib.inf\r
+      PciHostBridgeUtilityLib|OvmfPkg/Library/PciHostBridgeUtilityLib/PciHostBridgeUtilityLib.inf\r
       NULL|OvmfPkg/Library/PlatformHasIoMmuLib/PlatformHasIoMmuLib.inf\r
   }\r
   MdeModulePkg/Bus/Pci/PciBusDxe/PciBusDxe.inf {\r
@@ -773,6 +814,9 @@
 !endif\r
 !if $(MPT_SCSI_ENABLE) == TRUE\r
   OvmfPkg/MptScsiDxe/MptScsiDxe.inf\r
+!endif\r
+!if $(LSI_SCSI_ENABLE) == TRUE\r
+  OvmfPkg/LsiScsiDxe/LsiScsiDxe.inf\r
 !endif\r
   MdeModulePkg/Universal/WatchdogTimerDxe/WatchdogTimer.inf\r
   MdeModulePkg/Universal/MonotonicCounterRuntimeDxe/MonotonicCounterRuntimeDxe.inf\r
@@ -796,6 +840,7 @@
   MdeModulePkg/Universal/Disk/UnicodeCollation/EnglishDxe/EnglishDxe.inf\r
   FatPkg/EnhancedFatDxe/Fat.inf\r
   MdeModulePkg/Universal/Disk/UdfDxe/UdfDxe.inf\r
+  OvmfPkg/VirtioFsDxe/VirtioFsDxe.inf\r
   MdeModulePkg/Bus/Scsi/ScsiBusDxe/ScsiBusDxe.inf\r
   MdeModulePkg/Bus/Scsi/ScsiDiskDxe/ScsiDiskDxe.inf\r
   OvmfPkg/SataControllerDxe/SataControllerDxe.inf\r
@@ -881,11 +926,15 @@
     <PcdsFixedAtBuild>\r
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE\r
   }\r
-!endif\r
+  ShellPkg/DynamicCommand/HttpDynamicCommand/HttpDynamicCommand.inf {\r
+    <PcdsFixedAtBuild>\r
+      gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE\r
+  }\r
   OvmfPkg/LinuxInitrdDynamicShellCommand/LinuxInitrdDynamicShellCommand.inf {\r
     <PcdsFixedAtBuild>\r
       gEfiShellPkgTokenSpaceGuid.PcdShellLibAutoInitialize|FALSE\r
   }\r
+!endif\r
   ShellPkg/Application/Shell/Shell.inf {\r
     <LibraryClasses>\r
       ShellCommandLib|ShellPkg/Library/UefiShellCommandLib/UefiShellCommandLib.inf\r
@@ -956,6 +1005,7 @@
   MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf {\r
     <LibraryClasses>\r
       NULL|MdeModulePkg/Library/VarCheckUefiLib/VarCheckUefiLib.inf\r
+      NULL|MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf\r
   }\r
   MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf\r
 \r