From 1f695483e6bc2be8054d2cc677662e7df61e3962 Mon Sep 17 00:00:00 2001 From: Laszlo Ersek Date: Mon, 30 Nov 2015 18:41:10 +0000 Subject: [PATCH] OvmfPkg: introduce -D SMM_REQUIRE and PcdSmmSmramRequire This build time flag and corresponding Feature PCD will control whether OVMF supports (and, equivalently, requires) SMM/SMRAM support from QEMU. Contributed-under: TianoCore Contribution Agreement 1.0 Signed-off-by: Laszlo Ersek Reviewed-by: Jordan Justen git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19034 6f19259b-4bc3-4df7-8a09-765794883524 --- OvmfPkg/OvmfPkg.dec | 10 ++++++++++ OvmfPkg/OvmfPkgIa32.dsc | 4 ++++ OvmfPkg/OvmfPkgIa32X64.dsc | 4 ++++ OvmfPkg/OvmfPkgX64.dsc | 4 ++++ 4 files changed, 22 insertions(+) diff --git a/OvmfPkg/OvmfPkg.dec b/OvmfPkg/OvmfPkg.dec index 049f6edd05..47b0e69629 100644 --- a/OvmfPkg/OvmfPkg.dec +++ b/OvmfPkg/OvmfPkg.dec @@ -117,3 +117,13 @@ gUefiOvmfPkgTokenSpaceGuid.PcdSecureBootEnable|FALSE|BOOLEAN|3 gUefiOvmfPkgTokenSpaceGuid.PcdQemuBootOrderPciTranslation|TRUE|BOOLEAN|0x1c gUefiOvmfPkgTokenSpaceGuid.PcdQemuBootOrderMmioTranslation|FALSE|BOOLEAN|0x1d + + ## This feature flag enables SMM/SMRAM support. Note that it also requires + # such support from the underlying QEMU instance; if that support is not + # present, the firmware will reject continuing after a certain point. + # + # The flag also acts as a general "security switch"; when TRUE, many + # components will change behavior, with the goal of preventing a malicious + # runtime OS from tampering with firmware structures (special memory ranges + # used by OVMF, the varstore pflash chip, LockBox etc). + gUefiOvmfPkgTokenSpaceGuid.PcdSmmSmramRequire|FALSE|BOOLEAN|0x1e diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc index 77fd21cd59..74f6e784f3 100644 --- a/OvmfPkg/OvmfPkgIa32.dsc +++ b/OvmfPkg/OvmfPkgIa32.dsc @@ -36,6 +36,7 @@ DEFINE SECURE_BOOT_ENABLE = FALSE DEFINE NETWORK_IP6_ENABLE = FALSE DEFINE HTTP_BOOT_ENABLE = FALSE + DEFINE SMM_REQUIRE = FALSE [BuildOptions] GCC:*_UNIXGCC_*_CC_FLAGS = -DMDEPKG_NDEBUG @@ -310,6 +311,9 @@ !if $(SECURE_BOOT_ENABLE) == TRUE gUefiOvmfPkgTokenSpaceGuid.PcdSecureBootEnable|TRUE !endif +!if $(SMM_REQUIRE) == TRUE + gUefiOvmfPkgTokenSpaceGuid.PcdSmmSmramRequire|TRUE +!endif [PcdsFixedAtBuild] gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeMemorySize|1 diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc index 47cc311165..cdf4e0cb90 100644 --- a/OvmfPkg/OvmfPkgIa32X64.dsc +++ b/OvmfPkg/OvmfPkgIa32X64.dsc @@ -36,6 +36,7 @@ DEFINE SECURE_BOOT_ENABLE = FALSE DEFINE NETWORK_IP6_ENABLE = FALSE DEFINE HTTP_BOOT_ENABLE = FALSE + DEFINE SMM_REQUIRE = FALSE [BuildOptions] GCC:*_UNIXGCC_*_CC_FLAGS = -DMDEPKG_NDEBUG @@ -315,6 +316,9 @@ !if $(SECURE_BOOT_ENABLE) == TRUE gUefiOvmfPkgTokenSpaceGuid.PcdSecureBootEnable|TRUE !endif +!if $(SMM_REQUIRE) == TRUE + gUefiOvmfPkgTokenSpaceGuid.PcdSmmSmramRequire|TRUE +!endif [PcdsFixedAtBuild] gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeMemorySize|1 diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc index 44b9c792e1..2b0ad9d05d 100644 --- a/OvmfPkg/OvmfPkgX64.dsc +++ b/OvmfPkg/OvmfPkgX64.dsc @@ -36,6 +36,7 @@ DEFINE SECURE_BOOT_ENABLE = FALSE DEFINE NETWORK_IP6_ENABLE = FALSE DEFINE HTTP_BOOT_ENABLE = FALSE + DEFINE SMM_REQUIRE = FALSE [BuildOptions] GCC:*_UNIXGCC_*_CC_FLAGS = -DMDEPKG_NDEBUG @@ -315,6 +316,9 @@ !if $(SECURE_BOOT_ENABLE) == TRUE gUefiOvmfPkgTokenSpaceGuid.PcdSecureBootEnable|TRUE !endif +!if $(SMM_REQUIRE) == TRUE + gUefiOvmfPkgTokenSpaceGuid.PcdSmmSmramRequire|TRUE +!endif [PcdsFixedAtBuild] gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeMemorySize|1 -- 2.39.2