From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=217.140.101.70; helo=foss.arm.com; envelope-from=thomas.abraham@arm.com; receiver=edk2-devel@lists.01.org Received: from foss.arm.com (foss.arm.com [217.140.101.70]) by ml01.01.org (Postfix) with ESMTP id 8B3CA211D9174 for ; Fri, 15 Mar 2019 05:47:45 -0700 (PDT) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.72.51.249]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 6862915BE for ; Fri, 15 Mar 2019 05:47:45 -0700 (PDT) Received: from mail-it1-f180.google.com (usa-sjc-mx-foss1.foss.arm.com [217.140.101.70]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 436843F7BB for ; Fri, 15 Mar 2019 05:47:45 -0700 (PDT) Received: by mail-it1-f180.google.com with SMTP id 188so10604460itb.0 for ; Fri, 15 Mar 2019 05:47:45 -0700 (PDT) X-Gm-Message-State: APjAAAWanQdrr5B9SOowqyAgFUFBzVmiPUTyj1HkFhn5Rpo+EnrXkqPs mDCj3GKkKiCP3foAwYYmfTCPNZmKT/FMORDYXs4= X-Google-Smtp-Source: APXvYqwnP22suCVQCk2v5cD6gFCqGcmty+IJJydeoshMyz4xdgQP8kPFtpA/r4WQsR9OjrthDUSyqE4UWl7/0oom+eg= X-Received: by 2002:a24:7297:: with SMTP id x145mr181540itc.46.1552654064505; Fri, 15 Mar 2019 05:47:44 -0700 (PDT) MIME-Version: 1.0 References: <1552406795-16588-1-git-send-email-jagadeesh.ujja@arm.com> <1552406795-16588-4-git-send-email-jagadeesh.ujja@arm.com> In-Reply-To: From: Thomas Abraham Date: Fri, 15 Mar 2019 18:17:33 +0530 X-Gmail-Original-Message-ID: Message-ID: To: Ard Biesheuvel Cc: "edk2-devel@lists.01.org" Subject: Re: [PATCH edk2-platforms v2 3/3] Platform/ARM/SgiPkg: add MM based UEFI secure boot support X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 15 Mar 2019 12:47:45 -0000 Content-Type: text/plain; charset="UTF-8" On Fri, Mar 15, 2019 at 6:12 PM Ard Biesheuvel wrote: > > On Fri, 15 Mar 2019 at 13:30, Thomas Abraham wrote: > > > > On Fri, Mar 15, 2019 at 5:51 PM Ard Biesheuvel > > wrote: > > > > > > On Tue, 12 Mar 2019 at 17:06, Jagadeesh Ujja wrote: > > > > > > > > This implements support for UEFI secure boot on SGI platforms using > > > > the standalone MM framework. This moves all of the software handling > > > > of the UEFI authenticated variable store into the standalone MM > > > > context residing in a secure partition. > > > > > > > > Contributed-under: TianoCore Contribution Agreement 1.1 > > > > Signed-off-by: Jagadeesh Ujja > > > > --- > > > > Platform/ARM/SgiPkg/PlatformStandaloneMm.dsc | 34 +++++++++++++++++++- > > > > Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf | 5 +++ > > > > Platform/ARM/SgiPkg/SgiPlatform.dsc | 18 ++++++++++- > > > > Platform/ARM/SgiPkg/SgiPlatform.fdf | 7 +++- > > > > 4 files changed, 61 insertions(+), 3 deletions(-) > > > > > > > > diff --git a/Platform/ARM/SgiPkg/PlatformStandaloneMm.dsc b/Platform/ARM/SgiPkg/PlatformStandaloneMm.dsc > > > > index 49fc919..b6aa90b 100644 > > > > --- a/Platform/ARM/SgiPkg/PlatformStandaloneMm.dsc > > > > +++ b/Platform/ARM/SgiPkg/PlatformStandaloneMm.dsc > > > > @@ -26,6 +26,7 @@ > > > > SKUID_IDENTIFIER = DEFAULT > > > > FLASH_DEFINITION = Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf > > > > DEFINE DEBUG_MESSAGE = TRUE > > > > + DEFINE SECURE_BOOT_ENABLE = FALSE > > > > > > > > > > Maybe I wasn't clear before, but I don't see the point of building the > > > MM component without secure boot enabled. So can we drop this from > > > this side? > > > > Hi Ard, > > > > On the SGI platforms, the MM component is used for platform RAS error > > handling as well and secure boot is not mandatory in such a build. So > > the build of MM component is being kept independent of secure boot. > > > > Hi Thomas, > > When building the MM side of the platform without secure boot, the > only MM modules that are included are > > > > > INF StandaloneMmPkg/Core/StandaloneMmCore.inf > > > > INF StandaloneMmPkg/Drivers/StandaloneMmCpu/AArch64/StandaloneMmCpu.inf > > neither of which implement RAS handling. So are you saying this is > functionality that runs in MM context, but it has not been upstreamed > yet? Hi Ard, Yes, this functionality is yet to be upstreamed and there is work happening in that direction. So the MM build is being kept independent of secure boot feature. Thanks, Thomas. > > > > > > > > > > > For the non-secure side, it is a different matter, obviously. > > > > > > > # LzmaF86 > > > > DEFINE COMPRESSION_TOOL_GUID = D42AE6BD-1352-4bfb-909A-CA72A6EAE889 > > > > @@ -83,7 +84,17 @@ > > > > HobLib|StandaloneMmPkg/Library/StandaloneMmHobLib/StandaloneMmHobLib.inf > > > > MmServicesTableLib|MdePkg/Library/StandaloneMmServicesTableLib/StandaloneMmServicesTableLib.inf > > > > MemoryAllocationLib|StandaloneMmPkg/Library/StandaloneMmMemoryAllocationLib/StandaloneMmMemoryAllocationLib.inf > > > > - > > > > +!if $(SECURE_BOOT_ENABLE) == TRUE > > > > + AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf > > > > + BaseCryptLib|CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf > > > > + IntrinsicLib|CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf > > > > + NorFlashPlatformLib|Platform/ARM/SgiPkg/Library/NorFlashLib/StandaloneMmNorFlashLib.inf > > > > + OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf > > > > + PlatformSecureLib|SecurityPkg/Library/PlatformSecureLibNull/PlatformSecureLibNull.inf > > > > + SynchronizationLib|MdePkg/Library/BaseSynchronizationLib/BaseSynchronizationLib.inf > > > > + TimerLib|MdePkg/Library/BaseTimerLibNullTemplate/BaseTimerLibNullTemplate.inf > > > > + VarCheckLib|MdeModulePkg/Library/VarCheckLib/VarCheckLib.inf > > > > +!endif > > > > ################################################################################ > > > > # > > > > # Pcd Section - list of all EDK II PCD Entries defined by this Platform > > > > @@ -100,6 +111,21 @@ > > > > > > > > gEfiMdePkgTokenSpaceGuid.PcdMaximumGuidedExtractHandler|0x2 > > > > > > > > +!if $(SECURE_BOOT_ENABLE) == TRUE > > > > + #Secure Storage > > > > + gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x2000 > > > > + gEfiSecurityPkgTokenSpaceGuid.PcdUserPhysicalPresence|TRUE > > > > + gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x2800 > > > > + > > > > + ## NV Storage - 1MB*3 in NOR2 Flash > > > > + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase|0x10400000 > > > > + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableSize|0x00100000 > > > > + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase|0x10500000 > > > > + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingSize|0x00100000 > > > > + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase|0x10600000 > > > > + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareSize|0x00100000 > > > > +!endif > > > > + > > > > ################################################################################################### > > > > # > > > > # Components Section - list of the modules and components that will be processed by compilation > > > > @@ -125,6 +151,12 @@ > > > > StandaloneMmPkg/Core/StandaloneMmCore.inf > > > > > > > > [Components.AARCH64] > > > > +!if $(SECURE_BOOT_ENABLE) == TRUE > > > > + ArmPlatformPkg/Drivers/NorFlashDxe/NorFlashStandaloneMm.inf > > > > + MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteStandaloneMm.inf > > > > + MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf > > > > +!endif > > > > + > > > > StandaloneMmPkg/Drivers/StandaloneMmCpu/AArch64/StandaloneMmCpu.inf > > > > > > > > ################################################################################################### > > > > diff --git a/Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf b/Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf > > > > index 810460c..8c05a03 100644 > > > > --- a/Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf > > > > +++ b/Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf > > > > @@ -55,6 +55,11 @@ READ_LOCK_CAP = TRUE > > > > READ_LOCK_STATUS = TRUE > > > > > > > > INF StandaloneMmPkg/Core/StandaloneMmCore.inf > > > > +!if $(SECURE_BOOT_ENABLE) == TRUE > > > > + INF ArmPlatformPkg/Drivers/NorFlashDxe/NorFlashStandaloneMm.inf > > > > + INF MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteStandaloneMm.inf > > > > + INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf > > > > +!endif > > > > INF StandaloneMmPkg/Drivers/StandaloneMmCpu/AArch64/StandaloneMmCpu.inf > > > > > > > > ################################################################################ > > > > diff --git a/Platform/ARM/SgiPkg/SgiPlatform.dsc b/Platform/ARM/SgiPkg/SgiPlatform.dsc > > > > index bdb4ecb..4ddeb65 100644 > > > > --- a/Platform/ARM/SgiPkg/SgiPlatform.dsc > > > > +++ b/Platform/ARM/SgiPkg/SgiPlatform.dsc > > > > @@ -26,6 +26,7 @@ > > > > SKUID_IDENTIFIER = DEFAULT > > > > FLASH_DEFINITION = Platform/ARM/SgiPkg/SgiPlatform.fdf > > > > BUILD_NUMBER = 1 > > > > + DEFINE SECURE_BOOT_ENABLE = FALSE > > > > > > > > !include Platform/ARM/VExpressPkg/ArmVExpress.dsc.inc > > > > > > > > @@ -260,7 +261,15 @@ > > > > MdeModulePkg/Core/RuntimeDxe/RuntimeDxe.inf > > > > MdeModulePkg/Universal/CapsuleRuntimeDxe/CapsuleRuntimeDxe.inf > > > > MdeModulePkg/Universal/MonotonicCounterRuntimeDxe/MonotonicCounterRuntimeDxe.inf > > > > +!if $(SECURE_BOOT_ENABLE) == TRUE > > > > + MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf { > > > > + > > > > + NULL|SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf > > > > + } > > > > + SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf > > > > +!else > > > > MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf > > > > +!endif > > > > OvmfPkg/VirtioBlkDxe/VirtioBlk.inf > > > > > > > > MdeModulePkg/Universal/Console/ConPlatformDxe/ConPlatformDxe.inf > > > > @@ -268,6 +277,9 @@ > > > > MdeModulePkg/Universal/Console/GraphicsConsoleDxe/GraphicsConsoleDxe.inf > > > > MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf > > > > MdeModulePkg/Universal/SerialDxe/SerialDxe.inf > > > > +!if $(SECURE_BOOT_ENABLE) == TRUE > > > > + MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf > > > > +!else > > > > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf { > > > > > > > > NULL|MdeModulePkg/Library/VarCheckUefiLib/VarCheckUefiLib.inf > > > > @@ -275,6 +287,7 @@ > > > > BaseMemoryLib|MdePkg/Library/BaseMemoryLib/BaseMemoryLib.inf > > > > } > > > > MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf > > > > +!endif > > > > > > > > # > > > > # ACPI Support > > > > @@ -344,4 +357,7 @@ > > > > # > > > > MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf > > > > > > > > - ArmPkg/Drivers/MmCommunicationDxe/MmCommunication.inf > > > > + ArmPkg/Drivers/MmCommunicationDxe/MmCommunication.inf { > > > > + > > > > + NULL|StandaloneMmPkg/Library/VariableMmDependency/VariableMmDependency.inf > > > > + } > > > > diff --git a/Platform/ARM/SgiPkg/SgiPlatform.fdf b/Platform/ARM/SgiPkg/SgiPlatform.fdf > > > > index 7916a52..aff0be5 100644 > > > > --- a/Platform/ARM/SgiPkg/SgiPlatform.fdf > > > > +++ b/Platform/ARM/SgiPkg/SgiPlatform.fdf > > > > @@ -96,10 +96,15 @@ READ_LOCK_STATUS = TRUE > > > > INF EmbeddedPkg/ResetRuntimeDxe/ResetRuntimeDxe.inf > > > > INF MdeModulePkg/Core/RuntimeDxe/RuntimeDxe.inf > > > > INF MdeModulePkg/Universal/CapsuleRuntimeDxe/CapsuleRuntimeDxe.inf > > > > - INF MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf > > > > INF MdeModulePkg/Universal/MonotonicCounterRuntimeDxe/MonotonicCounterRuntimeDxe.inf > > > > INF MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf > > > > +!if $(SECURE_BOOT_ENABLE) == TRUE > > > > + INF SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf > > > > + INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf > > > > +!else > > > > + INF MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf > > > > INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf > > > > +!endif > > > > > > > > # > > > > # ACPI Support > > > > -- > > > > 2.7.4 > > > > > > > _______________________________________________ > > > edk2-devel mailing list > > > edk2-devel@lists.01.org > > > https://lists.01.org/mailman/listinfo/edk2-devel > _______________________________________________ > edk2-devel mailing list > edk2-devel@lists.01.org > https://lists.01.org/mailman/listinfo/edk2-devel