From 9e7091bc6544008d9f766185b0c95c10c7349348 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Wed, 26 Apr 2023 18:30:32 +0200 Subject: [PATCH 1/3] ovmf: enable IPv6 by default > At its meeting on 21 April 2023, the RIPE NCC Executive Board resolved to suspend the ability of RIPE NCC members to submit new applications to the IPv4 waiting list until further notice. It's time enough to start using IPv6 everywhere, including UEFI. --- pkgs/applications/virtualization/OVMF/default.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pkgs/applications/virtualization/OVMF/default.nix b/pkgs/applications/virtualization/OVMF/default.nix index 5499d7c2fd2a..0d286cd6f366 100644 --- a/pkgs/applications/virtualization/OVMF/default.nix +++ b/pkgs/applications/virtualization/OVMF/default.nix @@ -41,7 +41,9 @@ edk2.mkDerivation projectDscPath (finalAttrs: { hardeningDisable = [ "format" "stackprotector" "pic" "fortify" ]; buildFlags = - lib.optionals secureBoot [ "-D SECURE_BOOT_ENABLE=TRUE" ] + # IPv6 has no reason to be disabled. + [ "-D NETWORK_IP6_ENABLE=TRUE" ] + ++ lib.optionals secureBoot [ "-D SECURE_BOOT_ENABLE=TRUE" ] ++ lib.optionals csmSupport [ "-D CSM_ENABLE" "-D FD_SIZE_2MB" ] ++ lib.optionals httpSupport [ "-D NETWORK_HTTP_ENABLE=TRUE" "-D NETWORK_HTTP_BOOT_ENABLE=TRUE" ] ++ lib.optionals tpmSupport [ "-D TPM_ENABLE" "-D TPM2_ENABLE" "-D TPM2_CONFIG_ENABLE"]; From 70ae9b59433de039312e51b5c9f09468bb83bf6d Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Wed, 26 Apr 2023 18:31:19 +0200 Subject: [PATCH 2/3] ovmf: add TLS support --- pkgs/applications/virtualization/OVMF/default.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/pkgs/applications/virtualization/OVMF/default.nix b/pkgs/applications/virtualization/OVMF/default.nix index 0d286cd6f366..06687c8c977a 100644 --- a/pkgs/applications/virtualization/OVMF/default.nix +++ b/pkgs/applications/virtualization/OVMF/default.nix @@ -3,6 +3,7 @@ , secureBoot ? false , httpSupport ? false , tpmSupport ? false +, tlsSupport ? false }: assert csmSupport -> seabios != null; @@ -46,6 +47,7 @@ edk2.mkDerivation projectDscPath (finalAttrs: { ++ lib.optionals secureBoot [ "-D SECURE_BOOT_ENABLE=TRUE" ] ++ lib.optionals csmSupport [ "-D CSM_ENABLE" "-D FD_SIZE_2MB" ] ++ lib.optionals httpSupport [ "-D NETWORK_HTTP_ENABLE=TRUE" "-D NETWORK_HTTP_BOOT_ENABLE=TRUE" ] + ++ lib.optionals tlsSupport [ "-D NETWORK_TLS_ENABLE=TRUE" ] ++ lib.optionals tpmSupport [ "-D TPM_ENABLE" "-D TPM2_ENABLE" "-D TPM2_CONFIG_ENABLE"]; env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Qunused-arguments"; From c449133f880b756011f59e4f1a3e009510ba7be9 Mon Sep 17 00:00:00 2001 From: Raito Bezarius Date: Wed, 26 Apr 2023 18:31:57 +0200 Subject: [PATCH 3/3] ovmf: support debugging --- pkgs/applications/virtualization/OVMF/default.nix | 5 +++++ pkgs/development/compilers/edk2/default.nix | 2 +- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/pkgs/applications/virtualization/OVMF/default.nix b/pkgs/applications/virtualization/OVMF/default.nix index 06687c8c977a..6e3e9ba0d126 100644 --- a/pkgs/applications/virtualization/OVMF/default.nix +++ b/pkgs/applications/virtualization/OVMF/default.nix @@ -4,6 +4,8 @@ , httpSupport ? false , tpmSupport ? false , tlsSupport ? false +, debug ? false +, sourceDebug ? debug }: assert csmSupport -> seabios != null; @@ -44,12 +46,15 @@ edk2.mkDerivation projectDscPath (finalAttrs: { buildFlags = # IPv6 has no reason to be disabled. [ "-D NETWORK_IP6_ENABLE=TRUE" ] + ++ lib.optionals debug [ "-D DEBUG_ON_SERIAL_PORT=TRUE" ] + ++ lib.optionals sourceDebug [ "-D SOURCE_DEBUG_ENABLE=TRUE" ] ++ lib.optionals secureBoot [ "-D SECURE_BOOT_ENABLE=TRUE" ] ++ lib.optionals csmSupport [ "-D CSM_ENABLE" "-D FD_SIZE_2MB" ] ++ lib.optionals httpSupport [ "-D NETWORK_HTTP_ENABLE=TRUE" "-D NETWORK_HTTP_BOOT_ENABLE=TRUE" ] ++ lib.optionals tlsSupport [ "-D NETWORK_TLS_ENABLE=TRUE" ] ++ lib.optionals tpmSupport [ "-D TPM_ENABLE" "-D TPM2_ENABLE" "-D TPM2_CONFIG_ENABLE"]; + buildConfig = if debug then "DEBUG" else "RELEASE"; env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Qunused-arguments"; env.PYTHON_COMMAND = "python3"; diff --git a/pkgs/development/compilers/edk2/default.nix b/pkgs/development/compilers/edk2/default.nix index 41189be5dbd2..878d3f756838 100644 --- a/pkgs/development/compilers/edk2/default.nix +++ b/pkgs/development/compilers/edk2/default.nix @@ -116,7 +116,7 @@ edk2 = buildStdenv.mkDerivation { buildPhase = '' runHook preBuild - build -a ${targetArch} -b RELEASE -t ${buildType} -p ${projectDscPath} -n $NIX_BUILD_CORES $buildFlags + build -a ${targetArch} -b ${attrs.buildConfig or "RELEASE"} -t ${buildType} -p ${projectDscPath} -n $NIX_BUILD_CORES $buildFlags runHook postBuild '';