Changeset 106386 in vbox for trunk/src/VBox/Devices/EFI/Firmware

Timestamp:

Oct 16, 2024 2:15:04 PM (4 months ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

165199

Message:

Devices/EFI/Firmware: Make the BaseRngLib work on ARM platform where the initial firmware is mapped RX, bugref:10777

Location:

trunk/src/VBox/Devices/EFI/Firmware

Files:

• Makefile.kmk (modified) (1 diff)
• MdePkg/Library/BaseRngLib/AArch64/Rndr.c (modified) (5 diffs)
• SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c (modified) (1 diff)

trunk/src/VBox/Devices/EFI/Firmware/Makefile.kmk

@@ -284 +284 @@
         -D NETWORK_IP6_ENABLE=1 -D NETWORK_ISCSI_ENABLE=1 \
         $(if $(VBOX_WITH_EFI_SECURE_BOOT),-D "SECURE_BOOT_ENABLE=1") \
-        $(if $(VBOX_WITH_EFI_TPM),-D "TPM_ENABLE=1" -D "TPM1_ENABLE" -D "TPM2_ENABLE") \
-        $(if $(VBOX_WITH_EFI_TPM),-D "TPM_CONFIG_ENABLE=1") \
+        $(if $(VBOX_WITH_EFI_TPM),-D "TPM_ENABLE=1" -D "TPM1_ENABLE=1" -D "TPM2_ENABLE=1") \
+        $(if $(VBOX_WITH_EFI_TPM),-D "TPM_CONFIG_ENABLE=1" -D "TPM2_CONFIG_ENABLE=1") \
+        $(if $(VBOX_WITH_LSILOGIC),-D "MPT_SCSI_ENABLE=1") \
         $(if $(VBOX_WITH_LSILOGIC),-D "MPT_SCSI_ENABLE=1") \
         -D BUILD_NEW_SHELL=1 \

trunk/src/VBox/Devices/EFI/Firmware/MdePkg/Library/BaseRngLib/AArch64/Rndr.c

@@ -20 +20 @@
 #include "BaseRngLibInternals.h"
 
+/*
+ * This is non XIP (eXecute In Place) safe.
+ * This is used very early on in the TPM code when tings are still directly running from the ROM region which is RX only,
+ * causing a write access fault, so avoid caching the flag and query it always.
+ */
+#ifndef VBOX
 STATIC BOOLEAN  mRndrSupported;
+#endif
 
 //
@@ -44 +51 @@
   )
 {
+#ifndef VBOX
   UINT64  Isar0;
 
@@ -53 +61 @@
 
   mRndrSupported = ((Isar0 & RNDR_MASK) != 0);
+#endif
 
   return EFI_SUCCESS;
@@ -138 +147 @@
   )
 {
+#ifndef VBOX
   return mRndrSupported;
+#else
+  return (ArmReadIdIsar0() & RNDR_MASK) != 0;
+#endif
 }
 
@@ -163 +176 @@
   }
 
+#ifndef VBOX
   if (!mRndrSupported) {
     return EFI_UNSUPPORTED;
   }
+#else
+  if (!(ArmReadIdIsar0() & RNDR_MASK)) {
+    return EFI_UNSUPPORTED;
+  }
+#endif
 
   //

trunk/src/VBox/Devices/EFI/Firmware/SecurityPkg/Tcg/Tcg2Pei/Tcg2Pei.c

@@ -971 +971 @@
   }
 
+  /*
+   * Measuring the BIOS would break BitLocker when updating VirtualBox with a new UEFI firmware
+   * as the measurement would change requiring the user to enter the recovery key.
+   * As we have to trust the hypervisor anyway for now we also trust it with providing an untampered
+   * UEFI firmware image.
+   */
+#ifndef VBOX
   Status = MeasureMainBios ();
   if (EFI_ERROR (Status)) {
     return Status;
   }
+#endif
 
   //