fix(core): fix build uefi and ovmf

Signed-off-by: Nikita Korolev <[email protected]>

Author: universal-itengineer

cv/version_map.yml

@@ -1,4 +1,4 @@
 firmware:
   qemu: 9.2.0
   libvirt: 10.9.0
-  edk2: stable202411
+  edk2: stable202502

images/edk2/build.sh

@@ -28,6 +28,13 @@ EOF
     exit 0
 }
 
+echo_dbg() {
+  local str=$1
+  echo ""
+  echo "===$str==="
+  echo ""
+}
+
 parse_args() {
     while [[ $# -gt 0 ]]; do
     case "$1" in
@@ -81,22 +88,12 @@ fi
 EDK2_DIR="/${gitRepoName}-${edk2Branch}"
 FIRMWARE="/FIRMWARE"
 
-mv -f Logo.bmp $EDK2_DIR/MdeModulePkg/Logo/
+mv -f /Logo.bmp $EDK2_DIR/MdeModulePkg/Logo/
 echo "=== cd $EDK2_DIR ==="
 cd $EDK2_DIR
 
-echo "= pwd ="
-pwd
-
 mkdir -p ${FIRMWARE}
 
-echo_dbg() {
-  local str=$1
-  echo ""
-  echo "===$str==="
-  echo ""
-}
-
 # compiler
 CC_FLAGS="-t GCC5"
 CC_FLAGS="${CC_FLAGS} -b RELEASE"
@@ -109,7 +106,6 @@ CC_FLAGS="${CC_FLAGS} -D TPM1_ENABLE=FALSE"
 CC_FLAGS="${CC_FLAGS} -D CAVIUM_ERRATUM_27456=TRUE"
 
 # ovmf features
-OVMF_2M_FLAGS="${CC_FLAGS} -D FD_SIZE_2MB=TRUE -D NETWORK_TLS_ENABLE=FALSE -D NETWORK_ISCSI_ENABLE=FALSE"
 OVMF_4M_FLAGS="${CC_FLAGS} -D FD_SIZE_4MB=TRUE -D NETWORK_TLS_ENABLE=TRUE -D NETWORK_ISCSI_ENABLE=TRUE"
 
 # secure boot features
@@ -118,9 +114,14 @@ OVMF_SB_FLAGS="${OVMF_SB_FLAGS} -D SMM_REQUIRE=TRUE"
 OVMF_SB_FLAGS="${OVMF_SB_FLAGS} -D EXCLUDE_SHELL_FROM_FD=TRUE -D BUILD_SHELL=FALSE"
 
 # unset MAKEFLAGS
-echo "run source edksetup.sh"
-source ./edksetup.sh BaseTools
-source ./edksetup.sh
+echo "run . edksetup.sh"
+. ./edksetup.sh
+
+if ! command -v build 2>&1 >/dev/null
+then
+    echo "build could not be found"
+    exit 1
+fi
 
 build_iso() {
   dir="$1"
@@ -156,31 +157,57 @@ build_iso() {
     -o "$ISO_IMAGE" "$UEFI_SHELL_IMAGE"
 }
 
+prep() {
+  build -a X64 -p MdeModulePkg/MdeModulePkg.dsc -t GCC5 -b RELEASE
+}
+
 # Build with SB and SMM; exclude UEFI shell.
 build_ovmf() {
   echo_dbg "build ${OVMF_4M_FLAGS} -a X64 -p OvmfPkg/OvmfPkgX64.dsc"
-  build ${OVMF_4M_FLAGS} -a X64 -p OvmfPkg/OvmfPkgX64.dsc
+  build ${OVMF_4M_FLAGS} \
+    -a X64 -p OvmfPkg/OvmfPkgX64.dsc \
+    -DCC_MEASUREMENT_ENABLE=TRUE \
+    --pcd PcdFirmwareVendor=L"DVP distribution of EDK II\\0" \
+    --pcd PcdFirmwareVersionString=L"2025.02-1\\0" \
+    --pcd PcdFirmwareReleaseDateString=L"03/02/2025\\0"
+  
   cp -p Build/OvmfX64/*/FV/OVMF_CODE.fd $FIRMWARE/OVMF_CODE.fd
   cp -p Build/OvmfX64/*/FV/OVMF_VARS.fd $FIRMWARE/OVMF_VARS.fd
 }
 
 # Build with SB and SMM with secure boot; exclude UEFI shell.
 build_ovmf_secboot() {
   echo_dbg "build ${OVMF_4M_FLAGS} ${OVMF_SB_FLAGS} -a X64 -p OvmfPkg/OvmfPkgX64.dsc"
-  build ${OVMF_4M_FLAGS} ${OVMF_SB_FLAGS} -a X64 -p OvmfPkg/OvmfPkgX64.dsc
-  cp -p Build/OvmfX64/*/FV/OVMF_CODE.fd $FIRMWARE/OVMF_CODE.secboot.fd
+  build ${OVMF_4M_FLAGS} ${OVMF_SB_FLAGS} \
+    -a X64 -p OvmfPkg/OvmfPkgX64.dsc \
+    --pcd PcdFirmwareVendor=L"DVP distribution of EDK II\\0" \
+    --pcd PcdFirmwareVersionString=L"2025.02-1\\0" \
+    --pcd PcdFirmwareReleaseDateString=L"03/02/2025\\0"
+    
+  cp -p Build/OvmfX64/*/FV/OVMF_CODE.fd           $FIRMWARE/OVMF_CODE.secboot.fd
+  cp -p Build/OvmfX64/*/FV/OVMF_VARS.fd           $FIRMWARE/OVMF_VARS.secboot.fd
+  cp -p Build/OvmfX64/*/X64/EnrollDefaultKeys.efi $FIRMWARE/
+  cp -p Build/OvmfX64/*/X64/Shell.efi             $FIRMWARE/
 }
 
 # Build AmdSev and IntelTdx variants
 build_ovmf_amdsev() {
   touch OvmfPkg/AmdSev/Grub/grub.efi
 
-  echo_dbg "build ${OVMF_4M_FLAGS} -a X64 -p OvmfPkg/AmdSev/AmdSevX64.dsc"
-  build ${OVMF_4M_FLAGS} -a X64 -p OvmfPkg/AmdSev/AmdSevX64.dsc
+  
+  build ${OVMF_4M_FLAGS} -a X64 -p OvmfPkg/AmdSev/AmdSevX64.dsc \
+    --pcd PcdFirmwareVendor=L"DVP distribution of EDK II\\0" \
+    --pcd PcdFirmwareVersionString=L"2025.02-1\\0" \
+    --pcd PcdFirmwareReleaseDateString=L"03/02/2025\\0"
+
   cp -p Build/AmdSev/*/FV/OVMF.fd $FIRMWARE/OVMF.amdsev.fd
+}
 
-  echo_dbg "build ${OVMF_4M_FLAGS} -a X64 -p OvmfPkg/IntelTdx/IntelTdxX64.dsc"
-  build ${OVMF_4M_FLAGS} -a X64 -p OvmfPkg/IntelTdx/IntelTdxX64.dsc
+build_ovmf_inteltdx() {
+  build ${OVMF_4M_FLAGS} -a X64 -p OvmfPkg/IntelTdx/IntelTdxX64.dsc \
+    --pcd PcdFirmwareVendor=L"DVP distribution of EDK II\\0" \
+    --pcd PcdFirmwareVersionString=L"2025.02-1\\0" \
+    --pcd PcdFirmwareReleaseDateString=L"03/02/2025\\0"
   cp -p Build/IntelTdx/*/FV/OVMF.fd $FIRMWARE/OVMF.inteltdx.fd
 }
 
@@ -199,23 +226,34 @@ enroll() {
   virt-fw-vars --input  $FIRMWARE/OVMF_VARS.fd \
               --output  $FIRMWARE/OVMF_VARS.secboot.fd \
               --set-dbx $FIRMWARE/DBXUpdate-20230509.x64.bin \
-              --secure-boot 
+              --secure-boot --enroll-generate dvp.deckhouse.io
 
   virt-fw-vars --input  $FIRMWARE/OVMF.inteltdx.fd \
               --output  $FIRMWARE/OVMF.inteltdx.secboot.fd \
               --set-dbx $FIRMWARE/DBXUpdate-20230509.x64.bin \
-              --secure-boot 
+              --secure-boot --enroll-generate dvp.deckhouse.io
 }
 
 no_enroll() {
   cp -p $FIRMWARE/OVMF_VARS.fd $FIRMWARE/OVMF_VARS.secboot.fd
   cp -p $FIRMWARE/OVMF.inteltdx.fd $FIRMWARE/OVMF.inteltdx.secboot.fd  
 }
 
+
+echo_dbg "prep"
+prep 2>&1 > /dev/null
+
+echo_dbg "build_ovmf"
 build_ovmf 2>&1 > /dev/null
+
+echo_dbg "build_ovmf_secboot"
 build_ovmf_secboot 2>&1 > /dev/null
+
+echo "build_ovmf_amdsev"
 build_ovmf_amdsev 2>&1 > /dev/null
-build_shell 2>&1 > /dev/null
+
+echo "build_ovmf_inteltdx"
+build_ovmf_inteltdx 2>&1 > /dev/null
 
 build_iso $FIRMWARE
-no_enroll
+# enroll

images/edk2/json/30-edk2-ovmf-x64-sb-enrolled.json

@@ -0,0 +1,36 @@
+{
+    "description": "OVMF with SB+SMM, SB enabled, MS certs enrolled",
+    "interface-types": [
+        "uefi"
+    ],
+    "mapping": {
+        "device": "flash",
+        "mode": "split",
+        "executable": {
+            "filename": "/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd",
+            "format": "raw"
+        },
+        "nvram-template": {
+            "filename": "/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd",
+            "format": "raw"
+        }
+    },
+    "targets": [
+        {
+            "architecture": "x86_64",
+            "machines": [
+                "pc-q35-*"
+            ]
+        }
+    ],
+    "features": [
+        "acpi-s3",
+        "enrolled-keys",
+        "requires-smm",
+        "secure-boot",
+        "verbose-dynamic"
+    ],
+    "tags": [
+
+    ]
+}

images/edk2/werf.inc.yaml

@@ -68,15 +68,16 @@ shell:
     cd {{ $gitRepoName }}-{{ $version }}
     git submodule update --init --recursive
 
+  setup:
+  - |
     # Set env edk
+    cd {{ $gitRepoName }}-{{ $version }}
     export EDK_TOOLS_PATH=$(pwd)/BaseTools
     export PACKAGES_PATH=$(pwd)/BaseTools:/edk2-platforms
 
     echo "Building BaseTools..."
     ln /usr/bin/python3 /usr/bin/python
     make -C BaseTools -j$(nproc) 2>&1 > /dev/null
 
-  setup:
-  - |
     /build.sh --repo-name {{ $gitRepoName }} --branch {{ $version }}