Update the AspireVn7Dash572G DSC files with assorted enhancements since the initial porting work. Some planned features, such as Secure Boot and measuring the default FSP UPDs to a TPM (which does have security relevance), are now fully working.
Enable the working advanced features in use on this board. Cc: Sai Chaganty <rangasai.v.chaga...@intel.com> Cc: Isaac Oram <isaac.w.o...@intel.com> Cc: Nate DeSimone <nathaniel.l.desim...@intel.com> Cc: Chasel Chiu <chasel.c...@intel.com> Signed-off-by: Benjamin Doron <benjamin.doro...@gmail.com> --- .../AspireVn7Dash572G/OpenBoardPkg.dsc | 63 +++++++++++-------- .../AspireVn7Dash572G/OpenBoardPkgPcd.dsc | 59 ++++++++++------- 2 files changed, 74 insertions(+), 48 deletions(-) diff --git a/Platform/Intel/KabylakeOpenBoardPkg/AspireVn7Dash572G/OpenBoardPkg.dsc b/Platform/Intel/KabylakeOpenBoardPkg/AspireVn7Dash572G/OpenBoardPkg.dsc index f4552ee83d6b..75c537f1253f 100644 --- a/Platform/Intel/KabylakeOpenBoardPkg/AspireVn7Dash572G/OpenBoardPkg.dsc +++ b/Platform/Intel/KabylakeOpenBoardPkg/AspireVn7Dash572G/OpenBoardPkg.dsc @@ -22,15 +22,6 @@ # DEFINE BIOS_SIZE_OPTION = SIZE_60 - # - # Debug logging - # - DEFINE USE_HDMI_DEBUG_PORT = FALSE - DEFINE USE_PEI_SPI_LOGGING = FALSE - DEFINE USE_MEMORY_LOGGING = FALSE - DEFINE RELEASE_LOGGING = ($(USE_HDMI_DEBUG_PORT) || $(USE_PEI_SPI_LOGGING) || $(USE_MEMORY_LOGGING)) - DEFINE TESTING = TRUE - PLATFORM_NAME = $(PLATFORM_PACKAGE) PLATFORM_GUID = AEEEF17C-36B6-4B68-949A-1E54CB33492F PLATFORM_VERSION = 0.1 @@ -40,9 +31,17 @@ BUILD_TARGETS = DEBUG|RELEASE SKUID_IDENTIFIER = ALL FLASH_DEFINITION = $(PROJECT)/OpenBoardPkg.fdf - FIX_LOAD_TOP_MEMORY_ADDRESS = 0x0 + # + # Debug logging + # + DEFINE USE_HDMI_DEBUG_PORT = FALSE + DEFINE USE_PEI_SPI_LOGGING = FALSE + DEFINE USE_MEMORY_LOGGING = FALSE + DEFINE RELEASE_LOGGING = ($(USE_HDMI_DEBUG_PORT) || $(USE_PEI_SPI_LOGGING) || $(USE_MEMORY_LOGGING)) + DEFINE TESTING = FALSE + # # Include PCD configuration for this board. # @@ -143,7 +142,7 @@ ####################################### FspWrapperApiLib|IntelFsp2WrapperPkg/Library/BaseFspWrapperApiLib/BaseFspWrapperApiLib.inf FspWrapperApiTestLib|IntelFsp2WrapperPkg/Library/PeiFspWrapperApiTestLib/PeiFspWrapperApiTestLib.inf - # This board will set debugging library instances; FIXME: UART2 not used + # Board DSC will select debug library instances; NOTE: UART2 not used SerialPortLib|MdePkg/Library/BaseSerialPortLibNull/BaseSerialPortLibNull.inf ####################################### @@ -198,12 +197,11 @@ ####################################### PlatformHookLib|MdeModulePkg/Library/BasePlatformHookLibNull/BasePlatformHookLibNull.inf -# NB: MinPlatform sets a NULL DebugLib and only overrides it for DEBUG builds -# TODO: Now that all debug logging is routed through RSC, correct the defines [LibraryClasses.IA32.SEC] ####################################### # Edk2 Packages ####################################### +# NOTE: No way that RSC avoids PeiServices in SEC? Even if valid on re-entry... DebugLib|MdePkg/Library/BaseDebugLibNull/BaseDebugLibNull.inf !if $(USE_HDMI_DEBUG_PORT) == TRUE @@ -231,7 +229,8 @@ # Edk2 Packages ####################################### # SPI logging requires local patch: InitializeMemoryServices() before ProcessLibraryConstructorList() -# In-memory logging may require too many services for early core debug output +# Strongly suspect DebugLibSerialPort constructor presents PeiDxeSerialPortLibMem dependency on services as a bug +# - While RSC calls Initialize after dependencies and constructors are satisfied !if $(RELEASE_LOGGING) == TRUE DebugLib|MdeModulePkg/Library/PeiDxeDebugLibReportStatusCode/PeiDxeDebugLibReportStatusCode.inf !endif @@ -257,7 +256,7 @@ FspWrapperPlatformLib|$(PLATFORM_PACKAGE)/FspWrapper/Library/PeiFspWrapperPlatformLib/PeiFspWrapperPlatformLib.inf MultiBoardInitSupportLib|$(PLATFORM_PACKAGE)/PlatformInit/Library/MultiBoardInitSupportLib/PeiMultiBoardInitSupportLib.inf TestPointLib|$(PLATFORM_PACKAGE)/Test/Library/TestPointLib/PeiTestPointLib.inf -!if ($(TARGET) == DEBUG || $(TESTING) == TRUE) +!if ($(TARGET) == DEBUG || $(RELEASE_LOGGING) == TRUE) TestPointCheckLib|$(PLATFORM_PACKAGE)/Test/Library/TestPointCheckLib/PeiTestPointCheckLib.inf !endif SetCacheMtrrLib|$(PLATFORM_PACKAGE)/Library/SetCacheMtrrLib/SetCacheMtrrLibNull.inf @@ -287,7 +286,8 @@ ####################################### # Edk2 Packages ####################################### -# In-memory logging may require too many services for early core debug output +# Strongly suspect DebugLibSerialPort constructor presents PeiDxeSerialPortLibMem dependency on services as a bug +# - While RSC calls Initialize after dependencies and constructors are satisfied !if ($(USE_MEMORY_LOGGING) == TRUE || $(USE_HDMI_DEBUG_PORT) == TRUE) DebugLib|MdeModulePkg/Library/PeiDxeDebugLibReportStatusCode/PeiDxeDebugLibReportStatusCode.inf !endif @@ -315,7 +315,7 @@ MultiBoardInitSupportLib|$(PLATFORM_PACKAGE)/PlatformInit/Library/MultiBoardInitSupportLib/DxeMultiBoardInitSupportLib.inf TestPointLib|$(PLATFORM_PACKAGE)/Test/Library/TestPointLib/DxeTestPointLib.inf -!if ($(TARGET) == DEBUG || $(TESTING) == TRUE) +!if ($(TARGET) == DEBUG || $(RELEASE_LOGGING) == TRUE) TestPointCheckLib|$(PLATFORM_PACKAGE)/Test/Library/TestPointCheckLib/DxeTestPointCheckLib.inf !endif ####################################### @@ -346,7 +346,8 @@ ####################################### # Edk2 Packages ####################################### -# In-memory logging may require too many services for early core debug output +# Strongly suspect DebugLibSerialPort constructor presents PeiDxeSerialPortLibMem dependency on services as a bug +# - While RSC calls Initialize after dependencies and constructors are satisfied !if ($(USE_MEMORY_LOGGING) == TRUE || $(USE_HDMI_DEBUG_PORT) == TRUE) DebugLib|MdeModulePkg/Library/PeiDxeDebugLibReportStatusCode/PeiDxeDebugLibReportStatusCode.inf !endif @@ -370,7 +371,7 @@ BoardAcpiEnableLib|$(PLATFORM_PACKAGE)/Acpi/Library/MultiBoardAcpiSupportLib/SmmMultiBoardAcpiSupportLib.inf MultiBoardAcpiSupportLib|$(PLATFORM_PACKAGE)/Acpi/Library/MultiBoardAcpiSupportLib/SmmMultiBoardAcpiSupportLib.inf TestPointLib|$(PLATFORM_PACKAGE)/Test/Library/TestPointLib/SmmTestPointLib.inf -!if ($(TARGET) == DEBUG || $(TESTING) == TRUE) +!if ($(TARGET) == DEBUG || $(RELEASE_LOGGING) == TRUE) TestPointCheckLib|$(PLATFORM_PACKAGE)/Test/Library/TestPointCheckLib/SmmTestPointCheckLib.inf !endif @@ -408,12 +409,12 @@ MdeModulePkg/Universal/StatusCodeHandler/Pei/StatusCodeHandlerPei.inf { <LibraryClasses> DebugLib|MdePkg/Library/BaseDebugLibNull/BaseDebugLibNull.inf + # Reverse-ranked priority list +!if $(USE_MEMORY_LOGGING) == TRUE + SerialPortLib|MdeModulePkg/Library/PeiDxeSerialPortLibMem/PeiSerialPortLibMem.inf +!endif !if $(USE_PEI_SPI_LOGGING) == TRUE SerialPortLib|$(PLATFORM_BOARD_PACKAGE)/Library/PeiSerialPortLibSpiFlash/PeiSerialPortLibSpiFlash.inf -!else -!if $(USE_MEMORY_LOGGING) == TRUE - SerialPortLib|MdeModulePkg/Library/PeiDxeSerialPortLibMem/PeiSerialPortLibMem.inf -!endif !endif !if $(USE_HDMI_DEBUG_PORT) == TRUE SerialPortLib|$(PLATFORM_BOARD_PACKAGE)/Library/I2cHdmiDebugSerialPortLib/PeiI2cHdmiDebugSerialPortLib.inf @@ -431,10 +432,14 @@ IntelFsp2WrapperPkg/FspmWrapperPeim/FspmWrapperPeim.inf { <LibraryClasses> SiliconPolicyInitLib|$(PLATFORM_SI_PACKAGE)/Library/PeiSiliconPolicyInitLibDependency/PeiPreMemSiliconPolicyInitLibDependency.inf + NULL|SecurityPkg/Library/HashInstanceLibSha1/HashInstanceLibSha1.inf + NULL|SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.inf } IntelFsp2WrapperPkg/FspsWrapperPeim/FspsWrapperPeim.inf { <LibraryClasses> SiliconPolicyInitLib|$(PLATFORM_SI_PACKAGE)/Library/PeiSiliconPolicyInitLibDependency/PeiPostMemSiliconPolicyInitLibDependency.inf + NULL|SecurityPkg/Library/HashInstanceLibSha1/HashInstanceLibSha1.inf + NULL|SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.inf } !else # @@ -444,6 +449,8 @@ IntelFsp2WrapperPkg/FspmWrapperPeim/FspmWrapperPeim.inf { <LibraryClasses> SiliconPolicyInitLib|MinPlatformPkg/PlatformInit/Library/SiliconPolicyInitLibNull/SiliconPolicyInitLibNull.inf + NULL|SecurityPkg/Library/HashInstanceLibSha1/HashInstanceLibSha1.inf + NULL|SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.inf } # # In FSP Dispatch mode the policy will be installed after FSP-S dispatched (only PrePolicy silicon-init executed). @@ -452,6 +459,8 @@ IntelFsp2WrapperPkg/FspsWrapperPeim/FspsWrapperPeim.inf { <LibraryClasses> SiliconPolicyInitLib|MinPlatformPkg/PlatformInit/Library/SiliconPolicyInitLibNull/SiliconPolicyInitLibNull.inf + NULL|SecurityPkg/Library/HashInstanceLibSha1/HashInstanceLibSha1.inf + NULL|SecurityPkg/Library/HashInstanceLibSha256/HashInstanceLibSha256.inf } !endif @@ -555,6 +564,7 @@ MdeModulePkg/Universal/StatusCodeHandler/RuntimeDxe/StatusCodeHandlerRuntimeDxe.inf { <LibraryClasses> DebugLib|MdePkg/Library/BaseDebugLibNull/BaseDebugLibNull.inf + # Reverse-ranked priority list !if $(USE_MEMORY_LOGGING) == TRUE SerialPortLib|MdeModulePkg/Library/PeiDxeSerialPortLibMem/DxeSerialPortLibMem.inf !endif @@ -563,12 +573,12 @@ !endif <PcdsFixedAtBuild> gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeUseSerial|($(USE_MEMORY_LOGGING) || $(USE_HDMI_DEBUG_PORT)) - gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeMemorySize|512 + gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeMemorySize|1024 } - # TODO: Still requires a little more thought MdeModulePkg/Universal/StatusCodeHandler/Smm/StatusCodeHandlerSmm.inf { <LibraryClasses> DebugLib|MdePkg/Library/BaseDebugLibNull/BaseDebugLibNull.inf + # Reverse-ranked priority list !if $(USE_MEMORY_LOGGING) == TRUE SerialPortLib|MdeModulePkg/Library/PeiDxeSerialPortLibMem/SmmSerialPortLibMem.inf !endif @@ -577,8 +587,9 @@ !endif <PcdsFixedAtBuild> gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeUseSerial|($(USE_MEMORY_LOGGING) || $(USE_HDMI_DEBUG_PORT)) - gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeMemorySize|512 + gEfiMdeModulePkgTokenSpaceGuid.PcdStatusCodeMemorySize|1024 } +# TODO: Add NvmExpressDxe if supporting Newgate and RayleighSLS MdeModulePkg/Bus/Ata/AtaAtapiPassThru/AtaAtapiPassThru.inf MdeModulePkg/Bus/Ata/AtaBusDxe/AtaBusDxe.inf MdeModulePkg/Bus/Pci/PciHostBridgeDxe/PciHostBridgeDxe.inf diff --git a/Platform/Intel/KabylakeOpenBoardPkg/AspireVn7Dash572G/OpenBoardPkgPcd.dsc b/Platform/Intel/KabylakeOpenBoardPkg/AspireVn7Dash572G/OpenBoardPkgPcd.dsc index 490c3ee6bf76..3991c6f17c44 100644 --- a/Platform/Intel/KabylakeOpenBoardPkg/AspireVn7Dash572G/OpenBoardPkgPcd.dsc +++ b/Platform/Intel/KabylakeOpenBoardPkg/AspireVn7Dash572G/OpenBoardPkgPcd.dsc @@ -13,9 +13,10 @@ # ################################################################################ -# TODO: Harden and tune platform by PCDs -# TODO: Consider removing PCDs declared by build report to be unused (but confirm first) -# - Also, consider more "fixed" and more "dynamic"/"patchable" +# TODO: +# - Harden and tune platform by PCDs +# - Consider removing PCDs declared by build report to be unused (but confirm first) +# - Also, consider more "fixed" and more "dynamic"/"patchable" [PcdsFixedAtBuild.common] ###################################### @@ -118,13 +119,14 @@ gEfiMdeModulePkgTokenSpaceGuid.PcdPs2MouseExtendedVerification|FALSE # TODO/TEST gEfiMdeModulePkgTokenSpaceGuid.PcdHiiOsRuntimeSupport|FALSE gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmEnableBspElection|FALSE + # TODO: Hook-up memory, SMM and SMI handler profiling gUefiCpuPkgTokenSpaceGuid.PcdCpuSmmProfileEnable|FALSE # TODO: Prune this list to relevant features only !if gMinPlatformPkgTokenSpaceGuid.PcdBootStage >= 6 - # FIXME: SMM path also PatchAndLoadAcpiTable() - gAcpiDebugFeaturePkgTokenSpaceGuid.PcdAcpiDebugFeatureEnable |FALSE - # PcdIpmiFeatureEnable will not be enabled (no BMC) + gAcpiDebugFeaturePkgTokenSpaceGuid.PcdAcpiDebugFeatureEnable |TRUE + gAcpiDebugFeaturePkgTokenSpaceGuid.PcdUseSmmVersion |FALSE +# NOTE: PcdIpmiFeatureEnable will not be enabled (no BMC) # TODO: Can be build-time (user) choice gNetworkFeaturePkgTokenSpaceGuid.PcdNetworkFeatureEnable |FALSE gS3FeaturePkgTokenSpaceGuid.PcdS3FeatureEnable |TRUE @@ -132,12 +134,9 @@ gSmbiosFeaturePkgTokenSpaceGuid.PcdSmbiosFeatureEnable |TRUE # Requires actual hook-up gUsb3DebugFeaturePkgTokenSpaceGuid.PcdUsb3DebugFeatureEnable |FALSE - # FIXME: (Similar) DXE module is duplicate? - gUserAuthFeaturePkgTokenSpaceGuid.PcdUserAuthenticationFeatureEnable |FALSE - # FIXME: Must BootLogoEnableLogo() to turn platform logo into boot logo - # - BGRT must be BMP, but this duplicates FSP logo. Can GetSectionFromAnyFv()? - gLogoFeaturePkgTokenSpaceGuid.PcdLogoFeatureEnable |FALSE - gLogoFeaturePkgTokenSpaceGuid.PcdJpgEnable |FALSE + # FIXME: Version2 not working - doesn't challenge for password + gUserAuthFeaturePkgTokenSpaceGuid.PcdUserAuthenticationFeatureEnable |TRUE + gLogoFeaturePkgTokenSpaceGuid.PcdLogoFeatureEnable |TRUE !endif ###################################### @@ -209,7 +208,7 @@ # Board Configuration ###################################### gKabylakeOpenBoardPkgTokenSpaceGuid.PcdMultiBoardSupport|FALSE - gKabylakeOpenBoardPkgTokenSpaceGuid.PcdTbtEnable|FALSE # TODO: Enable if supporting Newgate + gKabylakeOpenBoardPkgTokenSpaceGuid.PcdTbtEnable|FALSE # TODO: Enable if supporting Newgate and RayleighSLS [PcdsFixedAtBuild.common] ###################################### @@ -245,16 +244,29 @@ gEfiMdeModulePkgTokenSpaceGuid.PcdBrowserSubtitleTextColor|0x0 gEfiMdeModulePkgTokenSpaceGuid.PcdCpuStackGuard|TRUE gEfiMdeModulePkgTokenSpaceGuid.PcdFastPS2Detection|TRUE # TODO/TEST +!if FALSE # FIXME: Causes DxeTestPointCheck ASSERT + # Guard DXE phase in non-stop mode, preferred over UAF detection (mutually exclusive) + # NOTE: SMM phase requires disabling PcdCpuSmmRestrictedMemoryAccess, so only enable to test + # TODO/TEST: Also test with guarded pool-head and with UAF detection feature + gEfiMdeModulePkgTokenSpaceGuid.PcdHeapGuardPropertyMask|0x43 +#!else + # Guard DXE phase preferred over UAF detection (mutually exclusive) + # TODO: Consider performance impact on release builds + gEfiMdeModulePkgTokenSpaceGuid.PcdHeapGuardPropertyMask|0x03 +!endif + # Protects loader, BS and RT code and data. TODO: Should not protect code and also ACPI memory? + gEfiMdeModulePkgTokenSpaceGuid.PcdHeapGuardPageType|0x7E + gEfiMdeModulePkgTokenSpaceGuid.PcdHeapGuardPoolType|0x7E gEfiMdeModulePkgTokenSpaceGuid.PcdHwErrStorageSize|0x00000800 gEfiMdeModulePkgTokenSpaceGuid.PcdLoadModuleAtFixAddressEnable|$(TOP_MEMORY_ADDRESS) gEfiMdeModulePkgTokenSpaceGuid.PcdMaxHardwareErrorVariableSize|0x400 gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x8000 -!if $(TESTING) == TRUE - # Test with non-stop mode, so not disabling for loader. - gEfiMdeModulePkgTokenSpaceGuid.PcdNullPointerDetectionPropertyMask|0x43 +!if $(RELEASE_LOGGING) == TRUE + # Using non-stop mode, so not disabling for loader. NOTE/TEST: Reconsider use with SMM, which causes SMM profiling to be enabled + gEfiMdeModulePkgTokenSpaceGuid.PcdNullPointerDetectionPropertyMask|0x41 !else - # FIXME: Can be broken for CSM. At this time, be permissive for loader. - gEfiMdeModulePkgTokenSpaceGuid.PcdNullPointerDetectionPropertyMask|0x83 + # FIXME: At this time, be permissive for loader + gEfiMdeModulePkgTokenSpaceGuid.PcdNullPointerDetectionPropertyMask|0x81 !endif gEfiMdeModulePkgTokenSpaceGuid.PcdReclaimVariableSpaceAtEndOfDxe|TRUE gEfiMdeModulePkgTokenSpaceGuid.PcdSetNxForStack|TRUE @@ -269,10 +281,10 @@ gEfiMdeModulePkgTokenSpaceGuid.PcdSerialUseHardwareFlowControl|FALSE !endif - # UPDs are updated at runtime, don't bother measuring + # Measure default UPDs, code to update UPDs is measured as well # BUGBUG: FSP-S measurement returns DEVICE_ERROR from PtpCrbTpmCommand() - Step 0. # - Similarly, Tcg2Dxe.c:Tpm2GetCapabilityManufactureID() - first command - fails? - gIntelFsp2WrapperTokenSpaceGuid.PcdFspMeasurementConfig|0x00000006 + gIntelFsp2WrapperTokenSpaceGuid.PcdFspMeasurementConfig|0x80000006 gPcAtChipsetPkgTokenSpaceGuid.PcdAcpiIoBarEnableMask|0x80 gPcAtChipsetPkgTokenSpaceGuid.PcdAcpiIoPciBarRegisterOffset|0x40 @@ -435,6 +447,9 @@ # @ValidRange 0x80000001 | 0 - 4 gEfiMdePkgTokenSpaceGuid.PcdDefaultTerminalType|3 + # Hypothetically, remove all but the trusted console input, but there's no callback + gEfiSecurityPkgTokenSpaceGuid.PcdUserPhysicalPresence|TRUE + [PcdsFixedAtBuild.IA32] ###################################### # Edk2 Configuration @@ -522,7 +537,7 @@ gKabylakeOpenBoardPkgTokenSpaceGuid.PcdLowPowerS0Idle|1 gKabylakeOpenBoardPkgTokenSpaceGuid.PcdPciExpNative|1 - # Thunderbolt Configuration (FIXME: Remove if not supporting Newgate) + # Thunderbolt Configuration (FIXME: Remove if not supporting Newgate and RayleighSLS) gKabylakeOpenBoardPkgTokenSpaceGuid.PcdDTbtAcDcSwitch|0x0 gKabylakeOpenBoardPkgTokenSpaceGuid.PcdDTbtAcpiGpeSignature|0 gKabylakeOpenBoardPkgTokenSpaceGuid.PcdDTbtAcpiGpeSignaturePorting|0 @@ -567,5 +582,5 @@ !endif !if gMinPlatformPkgTokenSpaceGuid.PcdTpm2Enable == TRUE gEfiSecurityPkgTokenSpaceGuid.PcdTcgPhysicalPresenceInterfaceVer|L"TCG2_VERSION"|gTcg2ConfigFormSetGuid|0x0|"1.3"|NV,BS - gEfiSecurityPkgTokenSpaceGuid.PcdTpm2AcpiTableRev|L"TCG2_VERSION"|gTcg2ConfigFormSetGuid|0x8|3|NV,BS + gEfiSecurityPkgTokenSpaceGuid.PcdTpm2AcpiTableRev|L"TCG2_VERSION"|gTcg2ConfigFormSetGuid|0x8|4|NV,BS !endif -- 2.37.2 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#93287): https://edk2.groups.io/g/devel/message/93287 Mute This Topic: https://groups.io/mt/93507096/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-