From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=2a00:1450:4864:20::444; helo=mail-wr1-x444.google.com; envelope-from=leif.lindholm@linaro.org; receiver=edk2-devel@lists.01.org Received: from mail-wr1-x444.google.com (mail-wr1-x444.google.com [IPv6:2a00:1450:4864:20::444]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 18D4A2194D3AE for ; Tue, 13 Nov 2018 15:57:16 -0800 (PST) Received: by mail-wr1-x444.google.com with SMTP id u5-v6so9993503wrn.9 for ; Tue, 13 Nov 2018 15:57:15 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to:user-agent; bh=NZZwbLc11fBOhtI4eybSrg91gKO3BIsKdBK2p6GqcfY=; b=eejv78VVEG7ZTt6qqVRkWHx0stzUvv/K1sbWjO5jqQnI7nHYBNzie+6QwiLpOtGL+A NbFBYGAUXFldaS7K7D0t+L/u6kdoxuO50DyX5hIzZTlONLzhX8SKUvUffj7l7iqbr6sm SdjVXVrSje1zrOj9VFV+lVYwIgB/nfXa7ytNg= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to:user-agent; bh=NZZwbLc11fBOhtI4eybSrg91gKO3BIsKdBK2p6GqcfY=; b=dJWb5A57Gr+soCXvft8v7+RMK/NO/4IJzQOtio+bqFInU9Ut6QYbMfKBOC0i0cVCAZ Higif3RMjFQXva8OrN53GEqH+Yrp0G2lS7e2nITImwhyy9gEWD+mlxrsgHivL9dCtec1 UmD9+8ylIczdQjMrOCo3Ctu9OPL4pNa2xtuDws5oMV9xtDrbnRqxiH6HViP5zockW0q1 s5rMr2kuM/wDI8uaz/AnciQ/LTStzOjNi46DxwhYVc0xdD38m2l8rwc+jxqGRH57gRKr 7R4ZA8m4gDLoCaRON3Ynuq2i2uaZ/LRit1Wn9fsZRPR6Ze38ttU8xIcDOGGIORviszpb Jz2Q== X-Gm-Message-State: AGRZ1gLbxUrZXiU2UkS8VHPeXTi4NI08KPE+rLI4gTfqd9hqWQSOAZ49 YXy5+9zuZG4C+JnDYIT8pzyeSQ== X-Google-Smtp-Source: AJdET5eT3GLoEYvL8Hka7T681FMEgBcI42QLEHhWPxvVkVBQN8dfdRNnMADdE+yuUtpi0M9TIlkrHg== X-Received: by 2002:adf:e983:: with SMTP id h3-v6mr6753902wrm.58.1542153434486; Tue, 13 Nov 2018 15:57:14 -0800 (PST) Received: from bivouac.eciton.net (bivouac.eciton.net. [2a00:1098:0:86:1000:23:0:2]) by smtp.gmail.com with ESMTPSA id t13-v6sm13147899wrn.22.2018.11.13.15.57.13 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Tue, 13 Nov 2018 15:57:13 -0800 (PST) Date: Tue, 13 Nov 2018 23:57:11 +0000 From: Leif Lindholm To: Ming Huang Cc: linaro-uefi@lists.linaro.org, edk2-devel@lists.01.org, graeme.gregory@linaro.org, ard.biesheuvel@linaro.org, michael.d.kinney@intel.com, lersek@redhat.com, wanghuiqiang@huawei.com, huangming23@huawei.com, zhangjinsong2@huawei.com, huangdaode@hisilicon.com, john.garry@huawei.com, xinliang.liu@linaro.org, zhangfeng56@huawei.com Message-ID: <20181113235711.72e2yv3o7xcztnqc@bivouac.eciton.net> References: <20181029033249.45363-1-ming.huang@linaro.org> <20181029033249.45363-8-ming.huang@linaro.org> MIME-Version: 1.0 In-Reply-To: <20181029033249.45363-8-ming.huang@linaro.org> User-Agent: NeoMutt/20170113 (1.7.2) Subject: Re: [PATCH edk2-platforms v1 07/12] Hisilicon/D0x: Fix secure boot bug in FlashFvbDxe X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Nov 2018 23:57:16 -0000 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline On Mon, Oct 29, 2018 at 11:32:44AM +0800, Ming Huang wrote: > When SECURE_BOOT_ENABLE is TRUE, FlashFvbDxe should use > gEfiAuthenticatedVariableGuid, When SECURE_BOOT_ENABLE > is FALSE, gEfiVariableGuid should be used. > > Contributed-under: TianoCore Contribution Agreement 1.1 > Signed-off-by: Ming Huang > --- > Silicon/Hisilicon/HisiPkg.dec | 1 + > Platform/Hisilicon/D03/D03.dsc | 5 +++++ > Platform/Hisilicon/D05/D05.dsc | 5 +++++ > Platform/Hisilicon/D06/D06.dsc | 5 +++++ > Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf | 2 ++ > Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c | 14 ++++++++++++-- > 6 files changed, 30 insertions(+), 2 deletions(-) > > diff --git a/Silicon/Hisilicon/HisiPkg.dec b/Silicon/Hisilicon/HisiPkg.dec > index 404a3ae4af..8c197fa3c1 100644 > --- a/Silicon/Hisilicon/HisiPkg.dec > +++ b/Silicon/Hisilicon/HisiPkg.dec > @@ -278,6 +278,7 @@ > > gHisiTokenSpaceGuid.Pcdsoctype|0|UINT32|0x00000061 > gHisiTokenSpaceGuid.PcdSerDesFlowCtrlFlag|0|UINT32|0x40000056 > + gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE|BOOLEAN|0x50000013 Why a token ID completely separate from the surrounding ones? > > [PcdsFeatureFlag] > gHisiTokenSpaceGuid.PcdIsItsSupported|FALSE|BOOLEAN|0x00000065 > diff --git a/Platform/Hisilicon/D03/D03.dsc b/Platform/Hisilicon/D03/D03.dsc > index aa1da5d61f..ba3096672d 100644 > --- a/Platform/Hisilicon/D03/D03.dsc > +++ b/Platform/Hisilicon/D03/D03.dsc > @@ -281,6 +281,11 @@ > gHisiTokenSpaceGuid.PcdHb0Rb2IoSize|0xffff #64K > > gHisiTokenSpaceGuid.Pcdsoctype|0x1610 > + !if $(SECURE_BOOT_ENABLE) == TRUE > + gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE > + !else > + gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE > + !endif > > ################################################################################ > # > diff --git a/Platform/Hisilicon/D05/D05.dsc b/Platform/Hisilicon/D05/D05.dsc > index 1040466633..b8500cef87 100644 > --- a/Platform/Hisilicon/D05/D05.dsc > +++ b/Platform/Hisilicon/D05/D05.dsc > @@ -422,6 +422,11 @@ > gHisiTokenSpaceGuid.PcdHb1Rb7IoSize|0x10000 #64K > > gHisiTokenSpaceGuid.Pcdsoctype|0x1610 > + !if $(SECURE_BOOT_ENABLE) == TRUE > + gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE > + !else > + gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE > + !endif > > ################################################################################ > # > diff --git a/Platform/Hisilicon/D06/D06.dsc b/Platform/Hisilicon/D06/D06.dsc > index 1a479c160e..b6ef9fedf0 100644 > --- a/Platform/Hisilicon/D06/D06.dsc > +++ b/Platform/Hisilicon/D06/D06.dsc > @@ -243,6 +243,11 @@ > > gEfiMdeModulePkgTokenSpaceGuid.PcdSrIovSupport|FALSE > gArmTokenSpaceGuid.PcdPciIoTranslation|0x0 > + !if $(SECURE_BOOT_ENABLE) == TRUE > + gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE > + !else > + gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE > + !endif > > ################################################################################ > # > diff --git a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf > index f8be4741ef..934c86c79b 100644 > --- a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf > +++ b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf > @@ -46,6 +46,7 @@ > [Guids] > gEfiSystemNvDataFvGuid > gEfiVariableGuid > + gEfiAuthenticatedVariableGuid Please move up two lines to insert sorted. / Leif > > [Protocols] > gEfiBlockIoProtocolGuid > @@ -62,6 +63,7 @@ > gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareSize > > gArmPlatformTokenSpaceGuid.PcdNorFlashCheckBlockLocked > + gHisiTokenSpaceGuid.PcdIsSecureBoot > gHisiTokenSpaceGuid.PcdSFCMEM0BaseAddress > > [Depex] > diff --git a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c > index e18cc9e06e..309941d6fe 100644 > --- a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c > +++ b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c > @@ -189,7 +189,11 @@ InitializeFvAndVariableStoreHeaders ( > // VARIABLE_STORE_HEADER > // > VariableStoreHeader = (VARIABLE_STORE_HEADER*)((UINTN)Headers + (UINTN)FirmwareVolumeHeader->HeaderLength); > - CopyGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid); > + if (PcdGetBool (PcdIsSecureBoot)) { > + CopyGuid (&VariableStoreHeader->Signature, &gEfiAuthenticatedVariableGuid); > + } else { > + CopyGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid); > + } > VariableStoreHeader->Size = PcdGet32(PcdFlashNvStorageVariableSize) - FirmwareVolumeHeader->HeaderLength; > VariableStoreHeader->Format = VARIABLE_STORE_FORMATTED; > VariableStoreHeader->State = VARIABLE_STORE_HEALTHY; > @@ -220,6 +224,7 @@ ValidateFvHeader ( > VARIABLE_STORE_HEADER* VariableStoreHeader; > UINTN VariableStoreLength; > UINTN FvLength; > + EFI_GUID *Guid; > > FwVolHeader = (EFI_FIRMWARE_VOLUME_HEADER*)Instance->RegionBaseAddress; > > @@ -258,7 +263,12 @@ ValidateFvHeader ( > VariableStoreHeader = (VARIABLE_STORE_HEADER*)((UINTN)FwVolHeader + (UINTN)FwVolHeader->HeaderLength); > > // Check the Variable Store Guid > - if ( CompareGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid) == FALSE ) > + if (PcdGetBool (PcdIsSecureBoot)) { > + Guid = &gEfiAuthenticatedVariableGuid; > + } else { > + Guid = &gEfiVariableGuid; > + } > + if (CompareGuid (&VariableStoreHeader->Signature, Guid) == FALSE) > { > DEBUG ((EFI_D_ERROR, "ValidateFvHeader: Variable Store Guid non-compatible\n")); > return EFI_NOT_FOUND; > -- > 2.18.0 >