From: Thomas Abraham <thomas.abraham@arm.com>
To: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: "edk2-devel@lists.01.org" <edk2-devel@lists.01.org>
Subject: Re: [PATCH edk2-platforms v2 3/3] Platform/ARM/SgiPkg: add MM based UEFI secure boot support
Date: Fri, 15 Mar 2019 18:17:33 +0530 [thread overview]
Message-ID: <CAJuA9aiqLaVX1sFrDf5ogjhKEo+C0VYLM5Faiu_8_LWWMA8Obg@mail.gmail.com> (raw)
In-Reply-To: <CAKv+Gu9PQjU3oM_qo=b4E+Mi+J3ZBwJM1UoLnz5ATd36b6CTQw@mail.gmail.com>
On Fri, Mar 15, 2019 at 6:12 PM Ard Biesheuvel
<ard.biesheuvel@linaro.org> wrote:
>
> On Fri, 15 Mar 2019 at 13:30, Thomas Abraham <thomas.abraham@arm.com> wrote:
> >
> > On Fri, Mar 15, 2019 at 5:51 PM Ard Biesheuvel
> > <ard.biesheuvel@linaro.org> wrote:
> > >
> > > On Tue, 12 Mar 2019 at 17:06, Jagadeesh Ujja <jagadeesh.ujja@arm.com> wrote:
> > > >
> > > > This implements support for UEFI secure boot on SGI platforms using
> > > > the standalone MM framework. This moves all of the software handling
> > > > of the UEFI authenticated variable store into the standalone MM
> > > > context residing in a secure partition.
> > > >
> > > > Contributed-under: TianoCore Contribution Agreement 1.1
> > > > Signed-off-by: Jagadeesh Ujja <jagadeesh.ujja@arm.com>
> > > > ---
> > > > Platform/ARM/SgiPkg/PlatformStandaloneMm.dsc | 34 +++++++++++++++++++-
> > > > Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf | 5 +++
> > > > Platform/ARM/SgiPkg/SgiPlatform.dsc | 18 ++++++++++-
> > > > Platform/ARM/SgiPkg/SgiPlatform.fdf | 7 +++-
> > > > 4 files changed, 61 insertions(+), 3 deletions(-)
> > > >
> > > > diff --git a/Platform/ARM/SgiPkg/PlatformStandaloneMm.dsc b/Platform/ARM/SgiPkg/PlatformStandaloneMm.dsc
> > > > index 49fc919..b6aa90b 100644
> > > > --- a/Platform/ARM/SgiPkg/PlatformStandaloneMm.dsc
> > > > +++ b/Platform/ARM/SgiPkg/PlatformStandaloneMm.dsc
> > > > @@ -26,6 +26,7 @@
> > > > SKUID_IDENTIFIER = DEFAULT
> > > > FLASH_DEFINITION = Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf
> > > > DEFINE DEBUG_MESSAGE = TRUE
> > > > + DEFINE SECURE_BOOT_ENABLE = FALSE
> > > >
> > >
> > > Maybe I wasn't clear before, but I don't see the point of building the
> > > MM component without secure boot enabled. So can we drop this from
> > > this side?
> >
> > Hi Ard,
> >
> > On the SGI platforms, the MM component is used for platform RAS error
> > handling as well and secure boot is not mandatory in such a build. So
> > the build of MM component is being kept independent of secure boot.
> >
>
> Hi Thomas,
>
> When building the MM side of the platform without secure boot, the
> only MM modules that are included are
>
> > > > INF StandaloneMmPkg/Core/StandaloneMmCore.inf
> > > > INF StandaloneMmPkg/Drivers/StandaloneMmCpu/AArch64/StandaloneMmCpu.inf
>
> neither of which implement RAS handling. So are you saying this is
> functionality that runs in MM context, but it has not been upstreamed
> yet?
Hi Ard,
Yes, this functionality is yet to be upstreamed and there is work
happening in that direction. So the MM build is being kept independent
of secure boot feature.
Thanks,
Thomas.
>
>
>
> >
> > >
> > > For the non-secure side, it is a different matter, obviously.
> > >
> > > > # LzmaF86
> > > > DEFINE COMPRESSION_TOOL_GUID = D42AE6BD-1352-4bfb-909A-CA72A6EAE889
> > > > @@ -83,7 +84,17 @@
> > > > HobLib|StandaloneMmPkg/Library/StandaloneMmHobLib/StandaloneMmHobLib.inf
> > > > MmServicesTableLib|MdePkg/Library/StandaloneMmServicesTableLib/StandaloneMmServicesTableLib.inf
> > > > MemoryAllocationLib|StandaloneMmPkg/Library/StandaloneMmMemoryAllocationLib/StandaloneMmMemoryAllocationLib.inf
> > > > -
> > > > +!if $(SECURE_BOOT_ENABLE) == TRUE
> > > > + AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
> > > > + BaseCryptLib|CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf
> > > > + IntrinsicLib|CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf
> > > > + NorFlashPlatformLib|Platform/ARM/SgiPkg/Library/NorFlashLib/StandaloneMmNorFlashLib.inf
> > > > + OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf
> > > > + PlatformSecureLib|SecurityPkg/Library/PlatformSecureLibNull/PlatformSecureLibNull.inf
> > > > + SynchronizationLib|MdePkg/Library/BaseSynchronizationLib/BaseSynchronizationLib.inf
> > > > + TimerLib|MdePkg/Library/BaseTimerLibNullTemplate/BaseTimerLibNullTemplate.inf
> > > > + VarCheckLib|MdeModulePkg/Library/VarCheckLib/VarCheckLib.inf
> > > > +!endif
> > > > ################################################################################
> > > > #
> > > > # Pcd Section - list of all EDK II PCD Entries defined by this Platform
> > > > @@ -100,6 +111,21 @@
> > > >
> > > > gEfiMdePkgTokenSpaceGuid.PcdMaximumGuidedExtractHandler|0x2
> > > >
> > > > +!if $(SECURE_BOOT_ENABLE) == TRUE
> > > > + #Secure Storage
> > > > + gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x2000
> > > > + gEfiSecurityPkgTokenSpaceGuid.PcdUserPhysicalPresence|TRUE
> > > > + gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x2800
> > > > +
> > > > + ## NV Storage - 1MB*3 in NOR2 Flash
> > > > + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase|0x10400000
> > > > + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableSize|0x00100000
> > > > + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase|0x10500000
> > > > + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingSize|0x00100000
> > > > + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase|0x10600000
> > > > + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareSize|0x00100000
> > > > +!endif
> > > > +
> > > > ###################################################################################################
> > > > #
> > > > # Components Section - list of the modules and components that will be processed by compilation
> > > > @@ -125,6 +151,12 @@
> > > > StandaloneMmPkg/Core/StandaloneMmCore.inf
> > > >
> > > > [Components.AARCH64]
> > > > +!if $(SECURE_BOOT_ENABLE) == TRUE
> > > > + ArmPlatformPkg/Drivers/NorFlashDxe/NorFlashStandaloneMm.inf
> > > > + MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteStandaloneMm.inf
> > > > + MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf
> > > > +!endif
> > > > +
> > > > StandaloneMmPkg/Drivers/StandaloneMmCpu/AArch64/StandaloneMmCpu.inf
> > > >
> > > > ###################################################################################################
> > > > diff --git a/Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf b/Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf
> > > > index 810460c..8c05a03 100644
> > > > --- a/Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf
> > > > +++ b/Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf
> > > > @@ -55,6 +55,11 @@ READ_LOCK_CAP = TRUE
> > > > READ_LOCK_STATUS = TRUE
> > > >
> > > > INF StandaloneMmPkg/Core/StandaloneMmCore.inf
> > > > +!if $(SECURE_BOOT_ENABLE) == TRUE
> > > > + INF ArmPlatformPkg/Drivers/NorFlashDxe/NorFlashStandaloneMm.inf
> > > > + INF MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteStandaloneMm.inf
> > > > + INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf
> > > > +!endif
> > > > INF StandaloneMmPkg/Drivers/StandaloneMmCpu/AArch64/StandaloneMmCpu.inf
> > > >
> > > > ################################################################################
> > > > diff --git a/Platform/ARM/SgiPkg/SgiPlatform.dsc b/Platform/ARM/SgiPkg/SgiPlatform.dsc
> > > > index bdb4ecb..4ddeb65 100644
> > > > --- a/Platform/ARM/SgiPkg/SgiPlatform.dsc
> > > > +++ b/Platform/ARM/SgiPkg/SgiPlatform.dsc
> > > > @@ -26,6 +26,7 @@
> > > > SKUID_IDENTIFIER = DEFAULT
> > > > FLASH_DEFINITION = Platform/ARM/SgiPkg/SgiPlatform.fdf
> > > > BUILD_NUMBER = 1
> > > > + DEFINE SECURE_BOOT_ENABLE = FALSE
> > > >
> > > > !include Platform/ARM/VExpressPkg/ArmVExpress.dsc.inc
> > > >
> > > > @@ -260,7 +261,15 @@
> > > > MdeModulePkg/Core/RuntimeDxe/RuntimeDxe.inf
> > > > MdeModulePkg/Universal/CapsuleRuntimeDxe/CapsuleRuntimeDxe.inf
> > > > MdeModulePkg/Universal/MonotonicCounterRuntimeDxe/MonotonicCounterRuntimeDxe.inf
> > > > +!if $(SECURE_BOOT_ENABLE) == TRUE
> > > > + MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf {
> > > > + <LibraryClasses>
> > > > + NULL|SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf
> > > > + }
> > > > + SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
> > > > +!else
> > > > MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf
> > > > +!endif
> > > > OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
> > > >
> > > > MdeModulePkg/Universal/Console/ConPlatformDxe/ConPlatformDxe.inf
> > > > @@ -268,6 +277,9 @@
> > > > MdeModulePkg/Universal/Console/GraphicsConsoleDxe/GraphicsConsoleDxe.inf
> > > > MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf
> > > > MdeModulePkg/Universal/SerialDxe/SerialDxe.inf
> > > > +!if $(SECURE_BOOT_ENABLE) == TRUE
> > > > + MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf
> > > > +!else
> > > > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf {
> > > > <LibraryClasses>
> > > > NULL|MdeModulePkg/Library/VarCheckUefiLib/VarCheckUefiLib.inf
> > > > @@ -275,6 +287,7 @@
> > > > BaseMemoryLib|MdePkg/Library/BaseMemoryLib/BaseMemoryLib.inf
> > > > }
> > > > MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf
> > > > +!endif
> > > >
> > > > #
> > > > # ACPI Support
> > > > @@ -344,4 +357,7 @@
> > > > #
> > > > MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
> > > >
> > > > - ArmPkg/Drivers/MmCommunicationDxe/MmCommunication.inf
> > > > + ArmPkg/Drivers/MmCommunicationDxe/MmCommunication.inf {
> > > > + <LibraryClasses>
> > > > + NULL|StandaloneMmPkg/Library/VariableMmDependency/VariableMmDependency.inf
> > > > + }
> > > > diff --git a/Platform/ARM/SgiPkg/SgiPlatform.fdf b/Platform/ARM/SgiPkg/SgiPlatform.fdf
> > > > index 7916a52..aff0be5 100644
> > > > --- a/Platform/ARM/SgiPkg/SgiPlatform.fdf
> > > > +++ b/Platform/ARM/SgiPkg/SgiPlatform.fdf
> > > > @@ -96,10 +96,15 @@ READ_LOCK_STATUS = TRUE
> > > > INF EmbeddedPkg/ResetRuntimeDxe/ResetRuntimeDxe.inf
> > > > INF MdeModulePkg/Core/RuntimeDxe/RuntimeDxe.inf
> > > > INF MdeModulePkg/Universal/CapsuleRuntimeDxe/CapsuleRuntimeDxe.inf
> > > > - INF MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf
> > > > INF MdeModulePkg/Universal/MonotonicCounterRuntimeDxe/MonotonicCounterRuntimeDxe.inf
> > > > INF MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf
> > > > +!if $(SECURE_BOOT_ENABLE) == TRUE
> > > > + INF SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
> > > > + INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf
> > > > +!else
> > > > + INF MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf
> > > > INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
> > > > +!endif
> > > >
> > > > #
> > > > # ACPI Support
> > > > --
> > > > 2.7.4
> > > >
> > > _______________________________________________
> > > edk2-devel mailing list
> > > edk2-devel@lists.01.org
> > > https://lists.01.org/mailman/listinfo/edk2-devel
> _______________________________________________
> edk2-devel mailing list
> edk2-devel@lists.01.org
> https://lists.01.org/mailman/listinfo/edk2-devel
next prev parent reply other threads:[~2019-03-15 12:47 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-03-12 16:06 [PATCH edk2-platforms v2 0/3] Platform/ARM/SgiPkg: Implement StandaloneMm based secure boot Jagadeesh Ujja
2019-03-12 16:06 ` [PATCH edk2-platforms v2 1/3] Platform/ARM/Sgi: define nor2 flash controller memory map Jagadeesh Ujja
2019-03-12 16:06 ` [PATCH edk2-platforms v2 2/3] Platform/ARM/Sgi: allow MM_STANDALONE modules to use NorFlashPlatformLib Jagadeesh Ujja
2019-03-12 16:06 ` [PATCH edk2-platforms v2 3/3] Platform/ARM/SgiPkg: add MM based UEFI secure boot support Jagadeesh Ujja
2019-03-15 12:21 ` Ard Biesheuvel
2019-03-15 12:30 ` Thomas Abraham
2019-03-15 12:34 ` Ard Biesheuvel
2019-03-15 12:47 ` Thomas Abraham [this message]
2019-03-15 12:51 ` Ard Biesheuvel
2019-03-15 8:19 ` [PATCH edk2-platforms v2 0/3] Platform/ARM/SgiPkg: Implement StandaloneMm based secure boot Jagadeesh Ujja
2019-03-15 11:36 ` Ard Biesheuvel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAJuA9aiqLaVX1sFrDf5ogjhKEo+C0VYLM5Faiu_8_LWWMA8Obg@mail.gmail.com \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox