From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=2607:f8b0:4864:20::542; helo=mail-pg1-x542.google.com; envelope-from=ming.huang@linaro.org; receiver=edk2-devel@lists.01.org Received: from mail-pg1-x542.google.com (mail-pg1-x542.google.com [IPv6:2607:f8b0:4864:20::542]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 0293F2118EF4D for ; Mon, 19 Nov 2018 22:43:09 -0800 (PST) Received: by mail-pg1-x542.google.com with SMTP id n2so466624pgm.3 for ; Mon, 19 Nov 2018 22:43:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=/OpNDPNPMaDSkFp+5Fo0yDK6czcO0izw7qP+IpnPcXE=; b=RR+T2Mun7yNNdVF4LaOJAL9M6nHYbBxhEHBDepmlPiPOBlOGhBLZ2awi7T5eYZgxJN jYkJ9APopa4zFPzjA5usOGXK+EIKfRjLhhsd0H6Ay6m74bb3PNCyrLqw7VBMrd8RqHmL 2WhUj1ViG6+249GtYk9+7nSGSPpxgu17/uZrA= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=/OpNDPNPMaDSkFp+5Fo0yDK6czcO0izw7qP+IpnPcXE=; b=JKGAFovQRJ2V+uinAYzhLax1nEpc0iub5NRBus054Hm+LLB0nJ0SBC13fEal2I2PE3 DJOZwLJ29NcNxkOS09OuNmIGOf5iUKKtAU2bFYOCKx4lBx5dddbEhvzYO6mX3Rp29agA zH6loQbqLTiv+qoDaZwkbU0xeVwHlDJCA2T+pCT6xJIcJCJ3TtvUiAJEMj7KIg9xTUAW oyGx/TmjOFFu/WAqAtUTdBL2p3L4NXz6DEGiOCvdLfttV6vADp5HDSwdYNlX7+a/bzwa 0tQjhmszr60al8eWfFHGjKiixu+6Y4FZHHwFnPzKN954DKk7FozMW/xXce4XHkiADIcS v4dg== X-Gm-Message-State: AA+aEWaSNpdTTUuQXGkahyDxu0NwcKpaBiqzi6suuO92qR4W1YFCVE67 4rjdbuHDJvcVT9QjoMPgIV8umQ== X-Google-Smtp-Source: AFSGD/V5wfJhYqOIp1oODaEdKvHKul+fjjtH0wDCXE5RIxvNmSe1if/jBjrOzMQU62lb9am6+hmM5Q== X-Received: by 2002:a63:554b:: with SMTP id f11mr833160pgm.37.1542696189484; Mon, 19 Nov 2018 22:43:09 -0800 (PST) Received: from [10.139.0.118] ([64.64.108.162]) by smtp.gmail.com with ESMTPSA id w184sm13329400pgd.34.2018.11.19.22.43.02 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 19 Nov 2018 22:43:08 -0800 (PST) To: Leif Lindholm Cc: linaro-uefi@lists.linaro.org, edk2-devel@lists.01.org, graeme.gregory@linaro.org, ard.biesheuvel@linaro.org, michael.d.kinney@intel.com, lersek@redhat.com, wanghuiqiang@huawei.com, huangming23@huawei.com, zhangjinsong2@huawei.com, huangdaode@hisilicon.com, john.garry@huawei.com, xinliang.liu@linaro.org, zhangfeng56@huawei.com References: <20181116065702.30559-1-ming.huang@linaro.org> <20181116065702.30559-8-ming.huang@linaro.org> <20181119181316.4bj5f6ynl7hq4s24@bivouac.eciton.net> From: Ming Huang Message-ID: <50f963bb-731e-9197-d8b5-60f2071aaeba@linaro.org> Date: Tue, 20 Nov 2018 14:42:58 +0800 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.0 MIME-Version: 1.0 In-Reply-To: <20181119181316.4bj5f6ynl7hq4s24@bivouac.eciton.net> Subject: Re: [PATCH edk2-platforms v2 07/15] Hisilicon/D0x: Fix secure boot bug in FlashFvbDxe X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 20 Nov 2018 06:43:10 -0000 Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit On 11/20/2018 2:13 AM, Leif Lindholm wrote: > On Fri, Nov 16, 2018 at 02:56:54PM +0800, Ming Huang wrote: >> When SECURE_BOOT_ENABLE is TRUE, FlashFvbDxe should use >> gEfiAuthenticatedVariableGuid, When SECURE_BOOT_ENABLE >> is FALSE, gEfiVariableGuid should be used. >> > > Other platforms seem to resolve this by doing something like: > > !if $(SECURE_BOOT_ENABLE) > ... > AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf > !else > AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf > !endif > > Can the same mechanism be used here instead? I see Ard provide a patch which is similar to this patch, so modify this patch like that patch. Thanks. > > I _really_ don't like the idea of adding vendor-specific Pcds to > determine whether Secure Boot is enabled. > > / > Leif > >> Contributed-under: TianoCore Contribution Agreement 1.1 >> Signed-off-by: Ming Huang >> --- >> Silicon/Hisilicon/HisiPkg.dec | 1 + >> Platform/Hisilicon/D03/D03.dsc | 5 +++++ >> Platform/Hisilicon/D05/D05.dsc | 5 +++++ >> Platform/Hisilicon/D06/D06.dsc | 5 +++++ >> Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf | 2 ++ >> Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c | 14 ++++++++++++-- >> 6 files changed, 30 insertions(+), 2 deletions(-) >> >> diff --git a/Silicon/Hisilicon/HisiPkg.dec b/Silicon/Hisilicon/HisiPkg.dec >> index 404a3ae4af9d..af9359e4d0e0 100644 >> --- a/Silicon/Hisilicon/HisiPkg.dec >> +++ b/Silicon/Hisilicon/HisiPkg.dec >> @@ -278,6 +278,7 @@ [PcdsFixedAtBuild] >> >> gHisiTokenSpaceGuid.Pcdsoctype|0|UINT32|0x00000061 >> gHisiTokenSpaceGuid.PcdSerDesFlowCtrlFlag|0|UINT32|0x40000056 >> + gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE|BOOLEAN|0x40000058 >> >> [PcdsFeatureFlag] >> gHisiTokenSpaceGuid.PcdIsItsSupported|FALSE|BOOLEAN|0x00000065 >> diff --git a/Platform/Hisilicon/D03/D03.dsc b/Platform/Hisilicon/D03/D03.dsc >> index aa1da5d61f83..ba3096672db0 100644 >> --- a/Platform/Hisilicon/D03/D03.dsc >> +++ b/Platform/Hisilicon/D03/D03.dsc >> @@ -281,6 +281,11 @@ [PcdsFixedAtBuild.common] >> gHisiTokenSpaceGuid.PcdHb0Rb2IoSize|0xffff #64K >> >> gHisiTokenSpaceGuid.Pcdsoctype|0x1610 >> + !if $(SECURE_BOOT_ENABLE) == TRUE >> + gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE >> + !else >> + gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE >> + !endif >> >> ################################################################################ >> # >> diff --git a/Platform/Hisilicon/D05/D05.dsc b/Platform/Hisilicon/D05/D05.dsc >> index 1040466633ef..b8500cef8742 100644 >> --- a/Platform/Hisilicon/D05/D05.dsc >> +++ b/Platform/Hisilicon/D05/D05.dsc >> @@ -422,6 +422,11 @@ [PcdsFixedAtBuild.common] >> gHisiTokenSpaceGuid.PcdHb1Rb7IoSize|0x10000 #64K >> >> gHisiTokenSpaceGuid.Pcdsoctype|0x1610 >> + !if $(SECURE_BOOT_ENABLE) == TRUE >> + gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE >> + !else >> + gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE >> + !endif >> >> ################################################################################ >> # >> diff --git a/Platform/Hisilicon/D06/D06.dsc b/Platform/Hisilicon/D06/D06.dsc >> index 1a479c160e80..b6ef9fedf0a7 100644 >> --- a/Platform/Hisilicon/D06/D06.dsc >> +++ b/Platform/Hisilicon/D06/D06.dsc >> @@ -243,6 +243,11 @@ [PcdsFixedAtBuild.common] >> >> gEfiMdeModulePkgTokenSpaceGuid.PcdSrIovSupport|FALSE >> gArmTokenSpaceGuid.PcdPciIoTranslation|0x0 >> + !if $(SECURE_BOOT_ENABLE) == TRUE >> + gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE >> + !else >> + gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE >> + !endif >> >> ################################################################################ >> # >> diff --git a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf >> index f8be4741ef7c..47965a707032 100644 >> --- a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf >> +++ b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf >> @@ -44,6 +44,7 @@ [LibraryClasses] >> UefiRuntimeLib >> >> [Guids] >> + gEfiAuthenticatedVariableGuid >> gEfiSystemNvDataFvGuid >> gEfiVariableGuid >> >> @@ -62,6 +63,7 @@ [Pcd.common] >> gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareSize >> >> gArmPlatformTokenSpaceGuid.PcdNorFlashCheckBlockLocked >> + gHisiTokenSpaceGuid.PcdIsSecureBoot >> gHisiTokenSpaceGuid.PcdSFCMEM0BaseAddress >> >> [Depex] >> diff --git a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c >> index e18cc9e06ec2..309941d6fe4d 100644 >> --- a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c >> +++ b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c >> @@ -189,7 +189,11 @@ InitializeFvAndVariableStoreHeaders ( >> // VARIABLE_STORE_HEADER >> // >> VariableStoreHeader = (VARIABLE_STORE_HEADER*)((UINTN)Headers + (UINTN)FirmwareVolumeHeader->HeaderLength); >> - CopyGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid); >> + if (PcdGetBool (PcdIsSecureBoot)) { >> + CopyGuid (&VariableStoreHeader->Signature, &gEfiAuthenticatedVariableGuid); >> + } else { >> + CopyGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid); >> + } >> VariableStoreHeader->Size = PcdGet32(PcdFlashNvStorageVariableSize) - FirmwareVolumeHeader->HeaderLength; >> VariableStoreHeader->Format = VARIABLE_STORE_FORMATTED; >> VariableStoreHeader->State = VARIABLE_STORE_HEALTHY; >> @@ -220,6 +224,7 @@ ValidateFvHeader ( >> VARIABLE_STORE_HEADER* VariableStoreHeader; >> UINTN VariableStoreLength; >> UINTN FvLength; >> + EFI_GUID *Guid; >> >> FwVolHeader = (EFI_FIRMWARE_VOLUME_HEADER*)Instance->RegionBaseAddress; >> >> @@ -258,7 +263,12 @@ ValidateFvHeader ( >> VariableStoreHeader = (VARIABLE_STORE_HEADER*)((UINTN)FwVolHeader + (UINTN)FwVolHeader->HeaderLength); >> >> // Check the Variable Store Guid >> - if ( CompareGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid) == FALSE ) >> + if (PcdGetBool (PcdIsSecureBoot)) { >> + Guid = &gEfiAuthenticatedVariableGuid; >> + } else { >> + Guid = &gEfiVariableGuid; >> + } >> + if (CompareGuid (&VariableStoreHeader->Signature, Guid) == FALSE) >> { >> DEBUG ((EFI_D_ERROR, "ValidateFvHeader: Variable Store Guid non-compatible\n")); >> return EFI_NOT_FOUND; >> -- >> 2.9.5 >>