From: Ming Huang <ming.huang@linaro.org>
To: leif.lindholm@linaro.org, linaro-uefi@lists.linaro.org,
edk2-devel@lists.01.org, graeme.gregory@linaro.org
Cc: ard.biesheuvel@linaro.org, michael.d.kinney@intel.com,
lersek@redhat.com, wanghuiqiang@huawei.com,
huangming23@huawei.com, zhangjinsong2@huawei.com,
huangdaode@hisilicon.com, john.garry@huawei.com,
xinliang.liu@linaro.org, zhangfeng56@huawei.com,
Ming Huang <ming.huang@linaro.org>
Subject: [PATCH edk2-platforms v1 07/12] Hisilicon/D0x: Fix secure boot bug in FlashFvbDxe
Date: Mon, 29 Oct 2018 11:32:44 +0800 [thread overview]
Message-ID: <20181029033249.45363-8-ming.huang@linaro.org> (raw)
In-Reply-To: <20181029033249.45363-1-ming.huang@linaro.org>
When SECURE_BOOT_ENABLE is TRUE, FlashFvbDxe should use
gEfiAuthenticatedVariableGuid, When SECURE_BOOT_ENABLE
is FALSE, gEfiVariableGuid should be used.
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Ming Huang <ming.huang@linaro.org>
---
Silicon/Hisilicon/HisiPkg.dec | 1 +
Platform/Hisilicon/D03/D03.dsc | 5 +++++
Platform/Hisilicon/D05/D05.dsc | 5 +++++
Platform/Hisilicon/D06/D06.dsc | 5 +++++
Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf | 2 ++
Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c | 14 ++++++++++++--
6 files changed, 30 insertions(+), 2 deletions(-)
diff --git a/Silicon/Hisilicon/HisiPkg.dec b/Silicon/Hisilicon/HisiPkg.dec
index 404a3ae4af..8c197fa3c1 100644
--- a/Silicon/Hisilicon/HisiPkg.dec
+++ b/Silicon/Hisilicon/HisiPkg.dec
@@ -278,6 +278,7 @@
gHisiTokenSpaceGuid.Pcdsoctype|0|UINT32|0x00000061
gHisiTokenSpaceGuid.PcdSerDesFlowCtrlFlag|0|UINT32|0x40000056
+ gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE|BOOLEAN|0x50000013
[PcdsFeatureFlag]
gHisiTokenSpaceGuid.PcdIsItsSupported|FALSE|BOOLEAN|0x00000065
diff --git a/Platform/Hisilicon/D03/D03.dsc b/Platform/Hisilicon/D03/D03.dsc
index aa1da5d61f..ba3096672d 100644
--- a/Platform/Hisilicon/D03/D03.dsc
+++ b/Platform/Hisilicon/D03/D03.dsc
@@ -281,6 +281,11 @@
gHisiTokenSpaceGuid.PcdHb0Rb2IoSize|0xffff #64K
gHisiTokenSpaceGuid.Pcdsoctype|0x1610
+ !if $(SECURE_BOOT_ENABLE) == TRUE
+ gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE
+ !else
+ gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE
+ !endif
################################################################################
#
diff --git a/Platform/Hisilicon/D05/D05.dsc b/Platform/Hisilicon/D05/D05.dsc
index 1040466633..b8500cef87 100644
--- a/Platform/Hisilicon/D05/D05.dsc
+++ b/Platform/Hisilicon/D05/D05.dsc
@@ -422,6 +422,11 @@
gHisiTokenSpaceGuid.PcdHb1Rb7IoSize|0x10000 #64K
gHisiTokenSpaceGuid.Pcdsoctype|0x1610
+ !if $(SECURE_BOOT_ENABLE) == TRUE
+ gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE
+ !else
+ gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE
+ !endif
################################################################################
#
diff --git a/Platform/Hisilicon/D06/D06.dsc b/Platform/Hisilicon/D06/D06.dsc
index 1a479c160e..b6ef9fedf0 100644
--- a/Platform/Hisilicon/D06/D06.dsc
+++ b/Platform/Hisilicon/D06/D06.dsc
@@ -243,6 +243,11 @@
gEfiMdeModulePkgTokenSpaceGuid.PcdSrIovSupport|FALSE
gArmTokenSpaceGuid.PcdPciIoTranslation|0x0
+ !if $(SECURE_BOOT_ENABLE) == TRUE
+ gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE
+ !else
+ gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE
+ !endif
################################################################################
#
diff --git a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf
index f8be4741ef..934c86c79b 100644
--- a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf
+++ b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf
@@ -46,6 +46,7 @@
[Guids]
gEfiSystemNvDataFvGuid
gEfiVariableGuid
+ gEfiAuthenticatedVariableGuid
[Protocols]
gEfiBlockIoProtocolGuid
@@ -62,6 +63,7 @@
gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareSize
gArmPlatformTokenSpaceGuid.PcdNorFlashCheckBlockLocked
+ gHisiTokenSpaceGuid.PcdIsSecureBoot
gHisiTokenSpaceGuid.PcdSFCMEM0BaseAddress
[Depex]
diff --git a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c
index e18cc9e06e..309941d6fe 100644
--- a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c
+++ b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c
@@ -189,7 +189,11 @@ InitializeFvAndVariableStoreHeaders (
// VARIABLE_STORE_HEADER
//
VariableStoreHeader = (VARIABLE_STORE_HEADER*)((UINTN)Headers + (UINTN)FirmwareVolumeHeader->HeaderLength);
- CopyGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid);
+ if (PcdGetBool (PcdIsSecureBoot)) {
+ CopyGuid (&VariableStoreHeader->Signature, &gEfiAuthenticatedVariableGuid);
+ } else {
+ CopyGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid);
+ }
VariableStoreHeader->Size = PcdGet32(PcdFlashNvStorageVariableSize) - FirmwareVolumeHeader->HeaderLength;
VariableStoreHeader->Format = VARIABLE_STORE_FORMATTED;
VariableStoreHeader->State = VARIABLE_STORE_HEALTHY;
@@ -220,6 +224,7 @@ ValidateFvHeader (
VARIABLE_STORE_HEADER* VariableStoreHeader;
UINTN VariableStoreLength;
UINTN FvLength;
+ EFI_GUID *Guid;
FwVolHeader = (EFI_FIRMWARE_VOLUME_HEADER*)Instance->RegionBaseAddress;
@@ -258,7 +263,12 @@ ValidateFvHeader (
VariableStoreHeader = (VARIABLE_STORE_HEADER*)((UINTN)FwVolHeader + (UINTN)FwVolHeader->HeaderLength);
// Check the Variable Store Guid
- if ( CompareGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid) == FALSE )
+ if (PcdGetBool (PcdIsSecureBoot)) {
+ Guid = &gEfiAuthenticatedVariableGuid;
+ } else {
+ Guid = &gEfiVariableGuid;
+ }
+ if (CompareGuid (&VariableStoreHeader->Signature, Guid) == FALSE)
{
DEBUG ((EFI_D_ERROR, "ValidateFvHeader: Variable Store Guid non-compatible\n"));
return EFI_NOT_FOUND;
--
2.18.0
next prev parent reply other threads:[~2018-10-29 3:33 UTC|newest]
Thread overview: 35+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-10-29 3:32 [PATCH edk2-platforms v1 00/12] Fix D06 SBSA/SBBR issue and improve Ming Huang
2018-10-29 3:32 ` [PATCH edk2-platforms v1 01/12] Silicon/Hisilicon/D06: Add watchdog to GTDT Ming Huang
2018-11-14 0:39 ` Leif Lindholm
2018-10-29 3:32 ` [PATCH edk2-platforms v1 02/12] Silicon/Hisilicon/D06: Drop _CID for fwts issue Ming Huang
2018-11-14 0:48 ` Leif Lindholm
2018-10-29 3:32 ` [PATCH edk2-platforms v1 03/12] Silicon/Hisilicon/D06: Fix fwts issue in Dbg2 Ming Huang
2018-11-14 0:50 ` Leif Lindholm
2018-10-29 3:32 ` [PATCH edk2-platforms v1 04/12] Silicon/Hisilicon/D06: Fix fwts issue in FADT Ming Huang
2018-11-14 0:50 ` Leif Lindholm
2018-10-29 3:32 ` [PATCH edk2-platforms v1 05/12] Hisilicon/D06: Move some functions to OemMiscLib Ming Huang
2018-11-14 0:04 ` Leif Lindholm
2018-11-14 14:30 ` Ming Huang
2018-10-29 3:32 ` [PATCH edk2-platforms v1 06/12] Silicon/Hisilicon: Modify for SBBR fwts SetTime_Func test case Ming Huang
[not found] ` <20181113235222.amykmhqlh5gltg7p@bivouac.eciton.net>
2018-11-14 14:31 ` Ming Huang
2018-11-14 17:20 ` Leif Lindholm
2018-10-29 3:32 ` Ming Huang [this message]
2018-11-13 23:57 ` [PATCH edk2-platforms v1 07/12] Hisilicon/D0x: Fix secure boot bug in FlashFvbDxe Leif Lindholm
2018-11-15 7:09 ` Ming Huang
2018-10-29 3:32 ` [PATCH edk2-platforms v1 08/12] Hisilicon/D06: Fix SBBR-SCT AuthVar issue Ming Huang
2018-11-14 0:18 ` Leif Lindholm
2018-11-14 14:31 ` Ming Huang
2018-10-29 3:32 ` [PATCH edk2-platforms v1 09/12] Silicon/Hisilicon/D06: Reserve ECAM resource in DSDT Ming Huang
2018-11-14 0:23 ` Leif Lindholm
2018-10-29 3:32 ` [PATCH edk2-platforms v1 10/12] Silicon/Hisilicon/D06: Modify GTDT timer flag Ming Huang
2018-11-14 0:24 ` Leif Lindholm
2018-10-29 3:32 ` [PATCH edk2-platforms v1 11/12] Hisilicon/D06: Modify Gic base Ming Huang
2018-11-14 0:29 ` Leif Lindholm
2018-11-14 14:31 ` Ming Huang
2018-10-29 3:32 ` [PATCH edk2-platforms v1 12/12] Silicon/Hisilicon/D06: Set TA as Node 0 for TA boot Ming Huang
2018-11-14 0:36 ` Leif Lindholm
2018-11-14 14:32 ` Ming Huang
2018-10-29 11:43 ` [PATCH edk2-platforms v1 00/12] Fix D06 SBSA/SBBR issue and improve Leif Lindholm
2018-10-29 15:01 ` Ming Huang
2018-10-29 16:14 ` Leif Lindholm
[not found] ` <5eaaf9d7-e76b-2e98-f4c8-bb0a27007cfc@huawei.com>
2018-10-30 9:37 ` Leif Lindholm
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181029033249.45363-8-ming.huang@linaro.org \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox