From: Leif Lindholm <leif.lindholm@linaro.org>
To: Ming Huang <ming.huang@linaro.org>
Cc: linaro-uefi@lists.linaro.org, edk2-devel@lists.01.org,
graeme.gregory@linaro.org, ard.biesheuvel@linaro.org,
michael.d.kinney@intel.com, lersek@redhat.com,
wanghuiqiang@huawei.com, huangming23@huawei.com,
zhangjinsong2@huawei.com, huangdaode@hisilicon.com,
john.garry@huawei.com, xinliang.liu@linaro.org,
zhangfeng56@huawei.com
Subject: Re: [PATCH edk2-platforms v2 07/15] Hisilicon/D0x: Fix secure boot bug in FlashFvbDxe
Date: Mon, 19 Nov 2018 18:13:16 +0000 [thread overview]
Message-ID: <20181119181316.4bj5f6ynl7hq4s24@bivouac.eciton.net> (raw)
In-Reply-To: <20181116065702.30559-8-ming.huang@linaro.org>
On Fri, Nov 16, 2018 at 02:56:54PM +0800, Ming Huang wrote:
> When SECURE_BOOT_ENABLE is TRUE, FlashFvbDxe should use
> gEfiAuthenticatedVariableGuid, When SECURE_BOOT_ENABLE
> is FALSE, gEfiVariableGuid should be used.
>
Other platforms seem to resolve this by doing something like:
!if $(SECURE_BOOT_ENABLE)
...
AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
!else
AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
!endif
Can the same mechanism be used here instead?
I _really_ don't like the idea of adding vendor-specific Pcds to
determine whether Secure Boot is enabled.
/
Leif
> Contributed-under: TianoCore Contribution Agreement 1.1
> Signed-off-by: Ming Huang <ming.huang@linaro.org>
> ---
> Silicon/Hisilicon/HisiPkg.dec | 1 +
> Platform/Hisilicon/D03/D03.dsc | 5 +++++
> Platform/Hisilicon/D05/D05.dsc | 5 +++++
> Platform/Hisilicon/D06/D06.dsc | 5 +++++
> Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf | 2 ++
> Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c | 14 ++++++++++++--
> 6 files changed, 30 insertions(+), 2 deletions(-)
>
> diff --git a/Silicon/Hisilicon/HisiPkg.dec b/Silicon/Hisilicon/HisiPkg.dec
> index 404a3ae4af9d..af9359e4d0e0 100644
> --- a/Silicon/Hisilicon/HisiPkg.dec
> +++ b/Silicon/Hisilicon/HisiPkg.dec
> @@ -278,6 +278,7 @@ [PcdsFixedAtBuild]
>
> gHisiTokenSpaceGuid.Pcdsoctype|0|UINT32|0x00000061
> gHisiTokenSpaceGuid.PcdSerDesFlowCtrlFlag|0|UINT32|0x40000056
> + gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE|BOOLEAN|0x40000058
>
> [PcdsFeatureFlag]
> gHisiTokenSpaceGuid.PcdIsItsSupported|FALSE|BOOLEAN|0x00000065
> diff --git a/Platform/Hisilicon/D03/D03.dsc b/Platform/Hisilicon/D03/D03.dsc
> index aa1da5d61f83..ba3096672db0 100644
> --- a/Platform/Hisilicon/D03/D03.dsc
> +++ b/Platform/Hisilicon/D03/D03.dsc
> @@ -281,6 +281,11 @@ [PcdsFixedAtBuild.common]
> gHisiTokenSpaceGuid.PcdHb0Rb2IoSize|0xffff #64K
>
> gHisiTokenSpaceGuid.Pcdsoctype|0x1610
> + !if $(SECURE_BOOT_ENABLE) == TRUE
> + gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE
> + !else
> + gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE
> + !endif
>
> ################################################################################
> #
> diff --git a/Platform/Hisilicon/D05/D05.dsc b/Platform/Hisilicon/D05/D05.dsc
> index 1040466633ef..b8500cef8742 100644
> --- a/Platform/Hisilicon/D05/D05.dsc
> +++ b/Platform/Hisilicon/D05/D05.dsc
> @@ -422,6 +422,11 @@ [PcdsFixedAtBuild.common]
> gHisiTokenSpaceGuid.PcdHb1Rb7IoSize|0x10000 #64K
>
> gHisiTokenSpaceGuid.Pcdsoctype|0x1610
> + !if $(SECURE_BOOT_ENABLE) == TRUE
> + gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE
> + !else
> + gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE
> + !endif
>
> ################################################################################
> #
> diff --git a/Platform/Hisilicon/D06/D06.dsc b/Platform/Hisilicon/D06/D06.dsc
> index 1a479c160e80..b6ef9fedf0a7 100644
> --- a/Platform/Hisilicon/D06/D06.dsc
> +++ b/Platform/Hisilicon/D06/D06.dsc
> @@ -243,6 +243,11 @@ [PcdsFixedAtBuild.common]
>
> gEfiMdeModulePkgTokenSpaceGuid.PcdSrIovSupport|FALSE
> gArmTokenSpaceGuid.PcdPciIoTranslation|0x0
> + !if $(SECURE_BOOT_ENABLE) == TRUE
> + gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE
> + !else
> + gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE
> + !endif
>
> ################################################################################
> #
> diff --git a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf
> index f8be4741ef7c..47965a707032 100644
> --- a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf
> +++ b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf
> @@ -44,6 +44,7 @@ [LibraryClasses]
> UefiRuntimeLib
>
> [Guids]
> + gEfiAuthenticatedVariableGuid
> gEfiSystemNvDataFvGuid
> gEfiVariableGuid
>
> @@ -62,6 +63,7 @@ [Pcd.common]
> gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareSize
>
> gArmPlatformTokenSpaceGuid.PcdNorFlashCheckBlockLocked
> + gHisiTokenSpaceGuid.PcdIsSecureBoot
> gHisiTokenSpaceGuid.PcdSFCMEM0BaseAddress
>
> [Depex]
> diff --git a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c
> index e18cc9e06ec2..309941d6fe4d 100644
> --- a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c
> +++ b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c
> @@ -189,7 +189,11 @@ InitializeFvAndVariableStoreHeaders (
> // VARIABLE_STORE_HEADER
> //
> VariableStoreHeader = (VARIABLE_STORE_HEADER*)((UINTN)Headers + (UINTN)FirmwareVolumeHeader->HeaderLength);
> - CopyGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid);
> + if (PcdGetBool (PcdIsSecureBoot)) {
> + CopyGuid (&VariableStoreHeader->Signature, &gEfiAuthenticatedVariableGuid);
> + } else {
> + CopyGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid);
> + }
> VariableStoreHeader->Size = PcdGet32(PcdFlashNvStorageVariableSize) - FirmwareVolumeHeader->HeaderLength;
> VariableStoreHeader->Format = VARIABLE_STORE_FORMATTED;
> VariableStoreHeader->State = VARIABLE_STORE_HEALTHY;
> @@ -220,6 +224,7 @@ ValidateFvHeader (
> VARIABLE_STORE_HEADER* VariableStoreHeader;
> UINTN VariableStoreLength;
> UINTN FvLength;
> + EFI_GUID *Guid;
>
> FwVolHeader = (EFI_FIRMWARE_VOLUME_HEADER*)Instance->RegionBaseAddress;
>
> @@ -258,7 +263,12 @@ ValidateFvHeader (
> VariableStoreHeader = (VARIABLE_STORE_HEADER*)((UINTN)FwVolHeader + (UINTN)FwVolHeader->HeaderLength);
>
> // Check the Variable Store Guid
> - if ( CompareGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid) == FALSE )
> + if (PcdGetBool (PcdIsSecureBoot)) {
> + Guid = &gEfiAuthenticatedVariableGuid;
> + } else {
> + Guid = &gEfiVariableGuid;
> + }
> + if (CompareGuid (&VariableStoreHeader->Signature, Guid) == FALSE)
> {
> DEBUG ((EFI_D_ERROR, "ValidateFvHeader: Variable Store Guid non-compatible\n"));
> return EFI_NOT_FOUND;
> --
> 2.9.5
>
next prev parent reply other threads:[~2018-11-19 18:13 UTC|newest]
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-11-16 6:56 [PATCH edk2-platforms v2 00/15] Fix D06 SBSA/SBBR issue and improve Ming Huang
2018-11-16 6:56 ` [PATCH edk2-platforms v2 01/15] Hisilicon/D0x: Modify IORT Ming Huang
2018-11-16 6:56 ` [PATCH edk2-platforms v2 02/15] Silicon/Hisilicon/D06: Add watchdog to GTDT Ming Huang
2018-11-16 6:56 ` [PATCH edk2-platforms v2 03/15] Silicon/Hisilicon/D06: Drop _CID for fwts issue Ming Huang
2018-11-16 6:56 ` [PATCH edk2-platforms v2 04/15] Silicon/Hisilicon/D06: Fix fwts issue in Dbg2 Ming Huang
2018-11-16 6:56 ` [PATCH edk2-platforms v2 05/15] Silicon/Hisilicon/D06: Fix fwts issue in FADT Ming Huang
2018-11-16 6:56 ` [PATCH edk2-platforms v2 06/15] Hisilicon/D06: Move some functions to OemMiscLib Ming Huang
2018-11-19 18:30 ` Leif Lindholm
2018-11-20 6:38 ` Ming Huang
2018-11-20 10:38 ` Leif Lindholm
2018-11-16 6:56 ` [PATCH edk2-platforms v2 07/15] Hisilicon/D0x: Fix secure boot bug in FlashFvbDxe Ming Huang
2018-11-19 18:13 ` Leif Lindholm [this message]
2018-11-20 6:42 ` Ming Huang
2018-11-19 18:19 ` Ard Biesheuvel
2018-11-20 6:44 ` Ming Huang
2018-11-16 6:56 ` [PATCH edk2-platforms v2 08/15] Silicon/Hisilicon/D06: Reserve ECAM resource in DSDT Ming Huang
2018-11-16 6:56 ` [PATCH edk2-platforms v2 09/15] Silicon/Hisilicon/D06: Modify GTDT timer flag Ming Huang
2018-11-16 6:56 ` [PATCH edk2-platforms v2 10/15] Hisilicon/D06: Modify Gic base Ming Huang
2018-11-19 18:20 ` Leif Lindholm
2018-11-20 6:55 ` Ming Huang
2018-11-20 10:40 ` Leif Lindholm
2018-11-16 6:56 ` [PATCH edk2-platforms v2 11/15] Silicon/Hisilicon/D06: Set TA as Node 0 for TA boot Ming Huang
2018-11-16 6:56 ` [PATCH edk2-platforms v2 12/15] Silicon/Hisilicon/D03: Drop _CID for fwts issue Ming Huang
2018-11-16 6:57 ` [PATCH edk2-platforms v2 13/15] Silicon/Hisilicon/D05: " Ming Huang
2018-11-16 6:57 ` [PATCH edk2-platforms v2 14/15] Hisilicon: Drop Pv660 source code Ming Huang
2018-11-16 6:57 ` [PATCH edk2-platforms v2 15/15] Hisilicon/D06: Correct HIDs/UIDs of PCI host bridges Ming Huang
2018-11-19 18:42 ` [PATCH edk2-platforms v2 00/15] Fix D06 SBSA/SBBR issue and improve Leif Lindholm
2018-11-20 7:02 ` Ming Huang
2018-11-20 10:32 ` Leif Lindholm
2018-11-20 12:42 ` Ming Huang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181119181316.4bj5f6ynl7hq4s24@bivouac.eciton.net \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox