public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
From: Leif Lindholm <leif.lindholm@linaro.org>
To: Ming Huang <ming.huang@linaro.org>
Cc: linaro-uefi@lists.linaro.org, edk2-devel@lists.01.org,
	graeme.gregory@linaro.org, ard.biesheuvel@linaro.org,
	michael.d.kinney@intel.com, lersek@redhat.com,
	wanghuiqiang@huawei.com, huangming23@huawei.com,
	zhangjinsong2@huawei.com, huangdaode@hisilicon.com,
	john.garry@huawei.com, xinliang.liu@linaro.org,
	zhangfeng56@huawei.com
Subject: Re: [PATCH edk2-platforms v1 07/12] Hisilicon/D0x: Fix secure boot bug in FlashFvbDxe
Date: Tue, 13 Nov 2018 23:57:11 +0000	[thread overview]
Message-ID: <20181113235711.72e2yv3o7xcztnqc@bivouac.eciton.net> (raw)
In-Reply-To: <20181029033249.45363-8-ming.huang@linaro.org>

On Mon, Oct 29, 2018 at 11:32:44AM +0800, Ming Huang wrote:
> When SECURE_BOOT_ENABLE is TRUE, FlashFvbDxe should use
> gEfiAuthenticatedVariableGuid, When SECURE_BOOT_ENABLE
> is FALSE, gEfiVariableGuid should be used.
> 
> Contributed-under: TianoCore Contribution Agreement 1.1
> Signed-off-by: Ming Huang <ming.huang@linaro.org>
> ---
>  Silicon/Hisilicon/HisiPkg.dec                         |  1 +
>  Platform/Hisilicon/D03/D03.dsc                        |  5 +++++
>  Platform/Hisilicon/D05/D05.dsc                        |  5 +++++
>  Platform/Hisilicon/D06/D06.dsc                        |  5 +++++
>  Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf |  2 ++
>  Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c   | 14 ++++++++++++--
>  6 files changed, 30 insertions(+), 2 deletions(-)
> 
> diff --git a/Silicon/Hisilicon/HisiPkg.dec b/Silicon/Hisilicon/HisiPkg.dec
> index 404a3ae4af..8c197fa3c1 100644
> --- a/Silicon/Hisilicon/HisiPkg.dec
> +++ b/Silicon/Hisilicon/HisiPkg.dec
> @@ -278,6 +278,7 @@
>  
>    gHisiTokenSpaceGuid.Pcdsoctype|0|UINT32|0x00000061
>    gHisiTokenSpaceGuid.PcdSerDesFlowCtrlFlag|0|UINT32|0x40000056
> +  gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE|BOOLEAN|0x50000013

Why a token ID completely separate from the surrounding ones?

>  
>  [PcdsFeatureFlag]
>    gHisiTokenSpaceGuid.PcdIsItsSupported|FALSE|BOOLEAN|0x00000065
> diff --git a/Platform/Hisilicon/D03/D03.dsc b/Platform/Hisilicon/D03/D03.dsc
> index aa1da5d61f..ba3096672d 100644
> --- a/Platform/Hisilicon/D03/D03.dsc
> +++ b/Platform/Hisilicon/D03/D03.dsc
> @@ -281,6 +281,11 @@
>    gHisiTokenSpaceGuid.PcdHb0Rb2IoSize|0xffff #64K
>  
>    gHisiTokenSpaceGuid.Pcdsoctype|0x1610
> +  !if $(SECURE_BOOT_ENABLE) == TRUE
> +    gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE
> +  !else
> +    gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE
> +  !endif
>  
>  ################################################################################
>  #
> diff --git a/Platform/Hisilicon/D05/D05.dsc b/Platform/Hisilicon/D05/D05.dsc
> index 1040466633..b8500cef87 100644
> --- a/Platform/Hisilicon/D05/D05.dsc
> +++ b/Platform/Hisilicon/D05/D05.dsc
> @@ -422,6 +422,11 @@
>    gHisiTokenSpaceGuid.PcdHb1Rb7IoSize|0x10000 #64K
>  
>    gHisiTokenSpaceGuid.Pcdsoctype|0x1610
> +  !if $(SECURE_BOOT_ENABLE) == TRUE
> +    gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE
> +  !else
> +    gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE
> +  !endif
>  
>  ################################################################################
>  #
> diff --git a/Platform/Hisilicon/D06/D06.dsc b/Platform/Hisilicon/D06/D06.dsc
> index 1a479c160e..b6ef9fedf0 100644
> --- a/Platform/Hisilicon/D06/D06.dsc
> +++ b/Platform/Hisilicon/D06/D06.dsc
> @@ -243,6 +243,11 @@
>  
>    gEfiMdeModulePkgTokenSpaceGuid.PcdSrIovSupport|FALSE
>    gArmTokenSpaceGuid.PcdPciIoTranslation|0x0
> +  !if $(SECURE_BOOT_ENABLE) == TRUE
> +    gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE
> +  !else
> +    gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE
> +  !endif
>  
>  ################################################################################
>  #
> diff --git a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf
> index f8be4741ef..934c86c79b 100644
> --- a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf
> +++ b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf
> @@ -46,6 +46,7 @@
>  [Guids]
>    gEfiSystemNvDataFvGuid
>    gEfiVariableGuid
> +  gEfiAuthenticatedVariableGuid

Please move up two lines to insert sorted.

/
    Leif

>  
>  [Protocols]
>    gEfiBlockIoProtocolGuid
> @@ -62,6 +63,7 @@
>    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareSize
>  
>    gArmPlatformTokenSpaceGuid.PcdNorFlashCheckBlockLocked
> +  gHisiTokenSpaceGuid.PcdIsSecureBoot
>    gHisiTokenSpaceGuid.PcdSFCMEM0BaseAddress
>  
>  [Depex]
> diff --git a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c
> index e18cc9e06e..309941d6fe 100644
> --- a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c
> +++ b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c
> @@ -189,7 +189,11 @@ InitializeFvAndVariableStoreHeaders (
>      // VARIABLE_STORE_HEADER
>      //
>      VariableStoreHeader = (VARIABLE_STORE_HEADER*)((UINTN)Headers + (UINTN)FirmwareVolumeHeader->HeaderLength);
> -    CopyGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid);
> +    if (PcdGetBool (PcdIsSecureBoot)) {
> +      CopyGuid (&VariableStoreHeader->Signature, &gEfiAuthenticatedVariableGuid);
> +    } else {
> +      CopyGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid);
> +    }
>      VariableStoreHeader->Size = PcdGet32(PcdFlashNvStorageVariableSize) - FirmwareVolumeHeader->HeaderLength;
>      VariableStoreHeader->Format            = VARIABLE_STORE_FORMATTED;
>      VariableStoreHeader->State             = VARIABLE_STORE_HEALTHY;
> @@ -220,6 +224,7 @@ ValidateFvHeader (
>      VARIABLE_STORE_HEADER*      VariableStoreHeader;
>      UINTN                       VariableStoreLength;
>      UINTN                       FvLength;
> +    EFI_GUID                    *Guid;
>  
>      FwVolHeader = (EFI_FIRMWARE_VOLUME_HEADER*)Instance->RegionBaseAddress;
>  
> @@ -258,7 +263,12 @@ ValidateFvHeader (
>      VariableStoreHeader = (VARIABLE_STORE_HEADER*)((UINTN)FwVolHeader + (UINTN)FwVolHeader->HeaderLength);
>  
>      // Check the Variable Store Guid
> -    if ( CompareGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid) == FALSE )
> +    if (PcdGetBool (PcdIsSecureBoot)) {
> +      Guid = &gEfiAuthenticatedVariableGuid;
> +    } else {
> +      Guid = &gEfiVariableGuid;
> +    }
> +    if (CompareGuid (&VariableStoreHeader->Signature, Guid) == FALSE)
>      {
>          DEBUG ((EFI_D_ERROR, "ValidateFvHeader: Variable Store Guid non-compatible\n"));
>          return EFI_NOT_FOUND;
> -- 
> 2.18.0
> 


  reply	other threads:[~2018-11-13 23:57 UTC|newest]

Thread overview: 35+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-10-29  3:32 [PATCH edk2-platforms v1 00/12] Fix D06 SBSA/SBBR issue and improve Ming Huang
2018-10-29  3:32 ` [PATCH edk2-platforms v1 01/12] Silicon/Hisilicon/D06: Add watchdog to GTDT Ming Huang
2018-11-14  0:39   ` Leif Lindholm
2018-10-29  3:32 ` [PATCH edk2-platforms v1 02/12] Silicon/Hisilicon/D06: Drop _CID for fwts issue Ming Huang
2018-11-14  0:48   ` Leif Lindholm
2018-10-29  3:32 ` [PATCH edk2-platforms v1 03/12] Silicon/Hisilicon/D06: Fix fwts issue in Dbg2 Ming Huang
2018-11-14  0:50   ` Leif Lindholm
2018-10-29  3:32 ` [PATCH edk2-platforms v1 04/12] Silicon/Hisilicon/D06: Fix fwts issue in FADT Ming Huang
2018-11-14  0:50   ` Leif Lindholm
2018-10-29  3:32 ` [PATCH edk2-platforms v1 05/12] Hisilicon/D06: Move some functions to OemMiscLib Ming Huang
2018-11-14  0:04   ` Leif Lindholm
2018-11-14 14:30     ` Ming Huang
2018-10-29  3:32 ` [PATCH edk2-platforms v1 06/12] Silicon/Hisilicon: Modify for SBBR fwts SetTime_Func test case Ming Huang
     [not found]   ` <20181113235222.amykmhqlh5gltg7p@bivouac.eciton.net>
2018-11-14 14:31     ` Ming Huang
2018-11-14 17:20       ` Leif Lindholm
2018-10-29  3:32 ` [PATCH edk2-platforms v1 07/12] Hisilicon/D0x: Fix secure boot bug in FlashFvbDxe Ming Huang
2018-11-13 23:57   ` Leif Lindholm [this message]
2018-11-15  7:09     ` Ming Huang
2018-10-29  3:32 ` [PATCH edk2-platforms v1 08/12] Hisilicon/D06: Fix SBBR-SCT AuthVar issue Ming Huang
2018-11-14  0:18   ` Leif Lindholm
2018-11-14 14:31     ` Ming Huang
2018-10-29  3:32 ` [PATCH edk2-platforms v1 09/12] Silicon/Hisilicon/D06: Reserve ECAM resource in DSDT Ming Huang
2018-11-14  0:23   ` Leif Lindholm
2018-10-29  3:32 ` [PATCH edk2-platforms v1 10/12] Silicon/Hisilicon/D06: Modify GTDT timer flag Ming Huang
2018-11-14  0:24   ` Leif Lindholm
2018-10-29  3:32 ` [PATCH edk2-platforms v1 11/12] Hisilicon/D06: Modify Gic base Ming Huang
2018-11-14  0:29   ` Leif Lindholm
2018-11-14 14:31     ` Ming Huang
2018-10-29  3:32 ` [PATCH edk2-platforms v1 12/12] Silicon/Hisilicon/D06: Set TA as Node 0 for TA boot Ming Huang
2018-11-14  0:36   ` Leif Lindholm
2018-11-14 14:32     ` Ming Huang
2018-10-29 11:43 ` [PATCH edk2-platforms v1 00/12] Fix D06 SBSA/SBBR issue and improve Leif Lindholm
2018-10-29 15:01   ` Ming Huang
2018-10-29 16:14     ` Leif Lindholm
     [not found]       ` <5eaaf9d7-e76b-2e98-f4c8-bb0a27007cfc@huawei.com>
2018-10-30  9:37         ` Leif Lindholm

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-list from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20181113235711.72e2yv3o7xcztnqc@bivouac.eciton.net \
    --to=devel@edk2.groups.io \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox