Hi,
> > I agree that the efi variable store is not secure without smm. But after
> > 58eb8517ad7b be introduced, the -D SECURE_BOOT_ENABLE doesn't work
> > with SEV. System just hangs in "NvVarStore FV headers were invalid."
> Hi, Joeyli
> ASSERT is triggered in DEBUG version. In RELEASE version ASSERT is skipped
> and an error code is returned. So system will not hang.
> So another solution is simply remove the ASSERT. Then an error message is
> dumped out and system continues.
>
> @Gerd Hoffmann @Tom Lendacky @joeyli What's your thought?
Maybe we just need to call ReserveEmuVariableNvStore a bit later?
take care,
Gerd
diff --git a/OvmfPkg/PlatformPei/Platform.c b/OvmfPkg/PlatformPei/Platform.c
index 148240342b4b..99d40636431f 100644
--- a/OvmfPkg/PlatformPei/Platform.c
+++ b/OvmfPkg/PlatformPei/Platform.c
@@ -377,10 +377,6 @@ InitializePlatform (
InitializeRamRegions (PlatformInfoHob);
if (PlatformInfoHob->BootMode != BOOT_ON_S3_RESUME) {
- if (!PlatformInfoHob->SmmSmramRequire) {
- ReserveEmuVariableNvStore ();
- }
-
PeiFvInitialization (PlatformInfoHob);
MemTypeInfoInitialization (PlatformInfoHob);
MemMapInitialization (PlatformInfoHob);
@@ -389,6 +385,12 @@ InitializePlatform (
InstallClearCacheCallback ();
AmdSevInitialize (PlatformInfoHob);
+
+ if (PlatformInfoHob->BootMode != BOOT_ON_S3_RESUME &&
+ !PlatformInfoHob->SmmSmramRequire) {
+ ReserveEmuVariableNvStore ();
+ }
+
if (PlatformInfoHob->HostBridgeDevId == 0xffff) {
MiscInitializationForMicrovm (PlatformInfoHob);
} else {
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#102385): https://edk2.groups.io/g/devel/message/102385
Mute This Topic: https://groups.io/mt/97922617/21656
Group Owner: [email protected]
Unsubscribe: https://edk2.groups.io/g/devel/unsub [[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
