From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=217.140.101.70; helo=foss.arm.com; envelope-from=jagadeesh.ujja@arm.com; receiver=edk2-devel@lists.01.org Received: from foss.arm.com (foss.arm.com [217.140.101.70]) by ml01.01.org (Postfix) with ESMTP id C4F0E211D6171 for ; Tue, 12 Mar 2019 09:06:54 -0700 (PDT) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id A0360165C; Tue, 12 Mar 2019 09:06:54 -0700 (PDT) Received: from usa.arm.com (a075556-lin.blr.arm.com [10.162.2.22]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPA id 4B4AC3F71D; Tue, 12 Mar 2019 09:06:53 -0700 (PDT) From: Jagadeesh Ujja To: edk2-devel@lists.01.org, leif.lindholm@linaro.org, ard.biesheuvel@linaro.org Date: Tue, 12 Mar 2019 21:36:35 +0530 Message-Id: <1552406795-16588-4-git-send-email-jagadeesh.ujja@arm.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1552406795-16588-1-git-send-email-jagadeesh.ujja@arm.com> References: <1552406795-16588-1-git-send-email-jagadeesh.ujja@arm.com> Subject: [PATCH edk2-platforms v2 3/3] Platform/ARM/SgiPkg: add MM based UEFI secure boot support X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Mar 2019 16:06:55 -0000 This implements support for UEFI secure boot on SGI platforms using the standalone MM framework. This moves all of the software handling of the UEFI authenticated variable store into the standalone MM context residing in a secure partition. Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Jagadeesh Ujja --- Platform/ARM/SgiPkg/PlatformStandaloneMm.dsc | 34 +++++++++++++++++++- Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf | 5 +++ Platform/ARM/SgiPkg/SgiPlatform.dsc | 18 ++++++++++- Platform/ARM/SgiPkg/SgiPlatform.fdf | 7 +++- 4 files changed, 61 insertions(+), 3 deletions(-) diff --git a/Platform/ARM/SgiPkg/PlatformStandaloneMm.dsc b/Platform/ARM/SgiPkg/PlatformStandaloneMm.dsc index 49fc919..b6aa90b 100644 --- a/Platform/ARM/SgiPkg/PlatformStandaloneMm.dsc +++ b/Platform/ARM/SgiPkg/PlatformStandaloneMm.dsc @@ -26,6 +26,7 @@ SKUID_IDENTIFIER = DEFAULT FLASH_DEFINITION = Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf DEFINE DEBUG_MESSAGE = TRUE + DEFINE SECURE_BOOT_ENABLE = FALSE # LzmaF86 DEFINE COMPRESSION_TOOL_GUID = D42AE6BD-1352-4bfb-909A-CA72A6EAE889 @@ -83,7 +84,17 @@ HobLib|StandaloneMmPkg/Library/StandaloneMmHobLib/StandaloneMmHobLib.inf MmServicesTableLib|MdePkg/Library/StandaloneMmServicesTableLib/StandaloneMmServicesTableLib.inf MemoryAllocationLib|StandaloneMmPkg/Library/StandaloneMmMemoryAllocationLib/StandaloneMmMemoryAllocationLib.inf - +!if $(SECURE_BOOT_ENABLE) == TRUE + AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf + BaseCryptLib|CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf + IntrinsicLib|CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf + NorFlashPlatformLib|Platform/ARM/SgiPkg/Library/NorFlashLib/StandaloneMmNorFlashLib.inf + OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf + PlatformSecureLib|SecurityPkg/Library/PlatformSecureLibNull/PlatformSecureLibNull.inf + SynchronizationLib|MdePkg/Library/BaseSynchronizationLib/BaseSynchronizationLib.inf + TimerLib|MdePkg/Library/BaseTimerLibNullTemplate/BaseTimerLibNullTemplate.inf + VarCheckLib|MdeModulePkg/Library/VarCheckLib/VarCheckLib.inf +!endif ################################################################################ # # Pcd Section - list of all EDK II PCD Entries defined by this Platform @@ -100,6 +111,21 @@ gEfiMdePkgTokenSpaceGuid.PcdMaximumGuidedExtractHandler|0x2 +!if $(SECURE_BOOT_ENABLE) == TRUE + #Secure Storage + gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x2000 + gEfiSecurityPkgTokenSpaceGuid.PcdUserPhysicalPresence|TRUE + gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x2800 + + ## NV Storage - 1MB*3 in NOR2 Flash + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase|0x10400000 + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableSize|0x00100000 + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase|0x10500000 + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingSize|0x00100000 + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase|0x10600000 + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareSize|0x00100000 +!endif + ################################################################################################### # # Components Section - list of the modules and components that will be processed by compilation @@ -125,6 +151,12 @@ StandaloneMmPkg/Core/StandaloneMmCore.inf [Components.AARCH64] +!if $(SECURE_BOOT_ENABLE) == TRUE + ArmPlatformPkg/Drivers/NorFlashDxe/NorFlashStandaloneMm.inf + MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteStandaloneMm.inf + MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf +!endif + StandaloneMmPkg/Drivers/StandaloneMmCpu/AArch64/StandaloneMmCpu.inf ################################################################################################### diff --git a/Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf b/Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf index 810460c..8c05a03 100644 --- a/Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf +++ b/Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf @@ -55,6 +55,11 @@ READ_LOCK_CAP = TRUE READ_LOCK_STATUS = TRUE INF StandaloneMmPkg/Core/StandaloneMmCore.inf +!if $(SECURE_BOOT_ENABLE) == TRUE + INF ArmPlatformPkg/Drivers/NorFlashDxe/NorFlashStandaloneMm.inf + INF MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteStandaloneMm.inf + INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf +!endif INF StandaloneMmPkg/Drivers/StandaloneMmCpu/AArch64/StandaloneMmCpu.inf ################################################################################ diff --git a/Platform/ARM/SgiPkg/SgiPlatform.dsc b/Platform/ARM/SgiPkg/SgiPlatform.dsc index bdb4ecb..4ddeb65 100644 --- a/Platform/ARM/SgiPkg/SgiPlatform.dsc +++ b/Platform/ARM/SgiPkg/SgiPlatform.dsc @@ -26,6 +26,7 @@ SKUID_IDENTIFIER = DEFAULT FLASH_DEFINITION = Platform/ARM/SgiPkg/SgiPlatform.fdf BUILD_NUMBER = 1 + DEFINE SECURE_BOOT_ENABLE = FALSE !include Platform/ARM/VExpressPkg/ArmVExpress.dsc.inc @@ -260,7 +261,15 @@ MdeModulePkg/Core/RuntimeDxe/RuntimeDxe.inf MdeModulePkg/Universal/CapsuleRuntimeDxe/CapsuleRuntimeDxe.inf MdeModulePkg/Universal/MonotonicCounterRuntimeDxe/MonotonicCounterRuntimeDxe.inf +!if $(SECURE_BOOT_ENABLE) == TRUE + MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf { + + NULL|SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf + } + SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf +!else MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf +!endif OvmfPkg/VirtioBlkDxe/VirtioBlk.inf MdeModulePkg/Universal/Console/ConPlatformDxe/ConPlatformDxe.inf @@ -268,6 +277,9 @@ MdeModulePkg/Universal/Console/GraphicsConsoleDxe/GraphicsConsoleDxe.inf MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf MdeModulePkg/Universal/SerialDxe/SerialDxe.inf +!if $(SECURE_BOOT_ENABLE) == TRUE + MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf +!else MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf { NULL|MdeModulePkg/Library/VarCheckUefiLib/VarCheckUefiLib.inf @@ -275,6 +287,7 @@ BaseMemoryLib|MdePkg/Library/BaseMemoryLib/BaseMemoryLib.inf } MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf +!endif # # ACPI Support @@ -344,4 +357,7 @@ # MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf - ArmPkg/Drivers/MmCommunicationDxe/MmCommunication.inf + ArmPkg/Drivers/MmCommunicationDxe/MmCommunication.inf { + + NULL|StandaloneMmPkg/Library/VariableMmDependency/VariableMmDependency.inf + } diff --git a/Platform/ARM/SgiPkg/SgiPlatform.fdf b/Platform/ARM/SgiPkg/SgiPlatform.fdf index 7916a52..aff0be5 100644 --- a/Platform/ARM/SgiPkg/SgiPlatform.fdf +++ b/Platform/ARM/SgiPkg/SgiPlatform.fdf @@ -96,10 +96,15 @@ READ_LOCK_STATUS = TRUE INF EmbeddedPkg/ResetRuntimeDxe/ResetRuntimeDxe.inf INF MdeModulePkg/Core/RuntimeDxe/RuntimeDxe.inf INF MdeModulePkg/Universal/CapsuleRuntimeDxe/CapsuleRuntimeDxe.inf - INF MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf INF MdeModulePkg/Universal/MonotonicCounterRuntimeDxe/MonotonicCounterRuntimeDxe.inf INF MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf +!if $(SECURE_BOOT_ENABLE) == TRUE + INF SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf + INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf +!else + INF MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf +!endif # # ACPI Support -- 2.7.4