From: Thomas Abraham <thomas.abraham@arm.com>
To: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Jagadeesh Ujja <jagadeesh.ujja@arm.com>,
"edk2-devel@lists.01.org" <edk2-devel@lists.01.org>
Subject: Re: [PATCH edk2-platforms v2 3/3] Platform/ARM/SgiPkg: add MM based UEFI secure boot support
Date: Fri, 15 Mar 2019 18:00:20 +0530 [thread overview]
Message-ID: <CAJuA9aj2gQtMOWuH8Pyiv6dAu4kzW+6PeR7N4yFj_XmoQbKCjA@mail.gmail.com> (raw)
In-Reply-To: <CAKv+Gu-3Z4rbu6n5rPWaRC1n+Q8FH3196zygp6PLGrL4kQyDKA@mail.gmail.com>
On Fri, Mar 15, 2019 at 5:51 PM Ard Biesheuvel
<ard.biesheuvel@linaro.org> wrote:
>
> On Tue, 12 Mar 2019 at 17:06, Jagadeesh Ujja <jagadeesh.ujja@arm.com> wrote:
> >
> > This implements support for UEFI secure boot on SGI platforms using
> > the standalone MM framework. This moves all of the software handling
> > of the UEFI authenticated variable store into the standalone MM
> > context residing in a secure partition.
> >
> > Contributed-under: TianoCore Contribution Agreement 1.1
> > Signed-off-by: Jagadeesh Ujja <jagadeesh.ujja@arm.com>
> > ---
> > Platform/ARM/SgiPkg/PlatformStandaloneMm.dsc | 34 +++++++++++++++++++-
> > Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf | 5 +++
> > Platform/ARM/SgiPkg/SgiPlatform.dsc | 18 ++++++++++-
> > Platform/ARM/SgiPkg/SgiPlatform.fdf | 7 +++-
> > 4 files changed, 61 insertions(+), 3 deletions(-)
> >
> > diff --git a/Platform/ARM/SgiPkg/PlatformStandaloneMm.dsc b/Platform/ARM/SgiPkg/PlatformStandaloneMm.dsc
> > index 49fc919..b6aa90b 100644
> > --- a/Platform/ARM/SgiPkg/PlatformStandaloneMm.dsc
> > +++ b/Platform/ARM/SgiPkg/PlatformStandaloneMm.dsc
> > @@ -26,6 +26,7 @@
> > SKUID_IDENTIFIER = DEFAULT
> > FLASH_DEFINITION = Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf
> > DEFINE DEBUG_MESSAGE = TRUE
> > + DEFINE SECURE_BOOT_ENABLE = FALSE
> >
>
> Maybe I wasn't clear before, but I don't see the point of building the
> MM component without secure boot enabled. So can we drop this from
> this side?
Hi Ard,
On the SGI platforms, the MM component is used for platform RAS error
handling as well and secure boot is not mandatory in such a build. So
the build of MM component is being kept independent of secure boot.
Thanks,
Thomas.
>
> For the non-secure side, it is a different matter, obviously.
>
> > # LzmaF86
> > DEFINE COMPRESSION_TOOL_GUID = D42AE6BD-1352-4bfb-909A-CA72A6EAE889
> > @@ -83,7 +84,17 @@
> > HobLib|StandaloneMmPkg/Library/StandaloneMmHobLib/StandaloneMmHobLib.inf
> > MmServicesTableLib|MdePkg/Library/StandaloneMmServicesTableLib/StandaloneMmServicesTableLib.inf
> > MemoryAllocationLib|StandaloneMmPkg/Library/StandaloneMmMemoryAllocationLib/StandaloneMmMemoryAllocationLib.inf
> > -
> > +!if $(SECURE_BOOT_ENABLE) == TRUE
> > + AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
> > + BaseCryptLib|CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf
> > + IntrinsicLib|CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf
> > + NorFlashPlatformLib|Platform/ARM/SgiPkg/Library/NorFlashLib/StandaloneMmNorFlashLib.inf
> > + OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf
> > + PlatformSecureLib|SecurityPkg/Library/PlatformSecureLibNull/PlatformSecureLibNull.inf
> > + SynchronizationLib|MdePkg/Library/BaseSynchronizationLib/BaseSynchronizationLib.inf
> > + TimerLib|MdePkg/Library/BaseTimerLibNullTemplate/BaseTimerLibNullTemplate.inf
> > + VarCheckLib|MdeModulePkg/Library/VarCheckLib/VarCheckLib.inf
> > +!endif
> > ################################################################################
> > #
> > # Pcd Section - list of all EDK II PCD Entries defined by this Platform
> > @@ -100,6 +111,21 @@
> >
> > gEfiMdePkgTokenSpaceGuid.PcdMaximumGuidedExtractHandler|0x2
> >
> > +!if $(SECURE_BOOT_ENABLE) == TRUE
> > + #Secure Storage
> > + gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x2000
> > + gEfiSecurityPkgTokenSpaceGuid.PcdUserPhysicalPresence|TRUE
> > + gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x2800
> > +
> > + ## NV Storage - 1MB*3 in NOR2 Flash
> > + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase|0x10400000
> > + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableSize|0x00100000
> > + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase|0x10500000
> > + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingSize|0x00100000
> > + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase|0x10600000
> > + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareSize|0x00100000
> > +!endif
> > +
> > ###################################################################################################
> > #
> > # Components Section - list of the modules and components that will be processed by compilation
> > @@ -125,6 +151,12 @@
> > StandaloneMmPkg/Core/StandaloneMmCore.inf
> >
> > [Components.AARCH64]
> > +!if $(SECURE_BOOT_ENABLE) == TRUE
> > + ArmPlatformPkg/Drivers/NorFlashDxe/NorFlashStandaloneMm.inf
> > + MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteStandaloneMm.inf
> > + MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf
> > +!endif
> > +
> > StandaloneMmPkg/Drivers/StandaloneMmCpu/AArch64/StandaloneMmCpu.inf
> >
> > ###################################################################################################
> > diff --git a/Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf b/Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf
> > index 810460c..8c05a03 100644
> > --- a/Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf
> > +++ b/Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf
> > @@ -55,6 +55,11 @@ READ_LOCK_CAP = TRUE
> > READ_LOCK_STATUS = TRUE
> >
> > INF StandaloneMmPkg/Core/StandaloneMmCore.inf
> > +!if $(SECURE_BOOT_ENABLE) == TRUE
> > + INF ArmPlatformPkg/Drivers/NorFlashDxe/NorFlashStandaloneMm.inf
> > + INF MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteStandaloneMm.inf
> > + INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf
> > +!endif
> > INF StandaloneMmPkg/Drivers/StandaloneMmCpu/AArch64/StandaloneMmCpu.inf
> >
> > ################################################################################
> > diff --git a/Platform/ARM/SgiPkg/SgiPlatform.dsc b/Platform/ARM/SgiPkg/SgiPlatform.dsc
> > index bdb4ecb..4ddeb65 100644
> > --- a/Platform/ARM/SgiPkg/SgiPlatform.dsc
> > +++ b/Platform/ARM/SgiPkg/SgiPlatform.dsc
> > @@ -26,6 +26,7 @@
> > SKUID_IDENTIFIER = DEFAULT
> > FLASH_DEFINITION = Platform/ARM/SgiPkg/SgiPlatform.fdf
> > BUILD_NUMBER = 1
> > + DEFINE SECURE_BOOT_ENABLE = FALSE
> >
> > !include Platform/ARM/VExpressPkg/ArmVExpress.dsc.inc
> >
> > @@ -260,7 +261,15 @@
> > MdeModulePkg/Core/RuntimeDxe/RuntimeDxe.inf
> > MdeModulePkg/Universal/CapsuleRuntimeDxe/CapsuleRuntimeDxe.inf
> > MdeModulePkg/Universal/MonotonicCounterRuntimeDxe/MonotonicCounterRuntimeDxe.inf
> > +!if $(SECURE_BOOT_ENABLE) == TRUE
> > + MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf {
> > + <LibraryClasses>
> > + NULL|SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf
> > + }
> > + SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
> > +!else
> > MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf
> > +!endif
> > OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
> >
> > MdeModulePkg/Universal/Console/ConPlatformDxe/ConPlatformDxe.inf
> > @@ -268,6 +277,9 @@
> > MdeModulePkg/Universal/Console/GraphicsConsoleDxe/GraphicsConsoleDxe.inf
> > MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf
> > MdeModulePkg/Universal/SerialDxe/SerialDxe.inf
> > +!if $(SECURE_BOOT_ENABLE) == TRUE
> > + MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf
> > +!else
> > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf {
> > <LibraryClasses>
> > NULL|MdeModulePkg/Library/VarCheckUefiLib/VarCheckUefiLib.inf
> > @@ -275,6 +287,7 @@
> > BaseMemoryLib|MdePkg/Library/BaseMemoryLib/BaseMemoryLib.inf
> > }
> > MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf
> > +!endif
> >
> > #
> > # ACPI Support
> > @@ -344,4 +357,7 @@
> > #
> > MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
> >
> > - ArmPkg/Drivers/MmCommunicationDxe/MmCommunication.inf
> > + ArmPkg/Drivers/MmCommunicationDxe/MmCommunication.inf {
> > + <LibraryClasses>
> > + NULL|StandaloneMmPkg/Library/VariableMmDependency/VariableMmDependency.inf
> > + }
> > diff --git a/Platform/ARM/SgiPkg/SgiPlatform.fdf b/Platform/ARM/SgiPkg/SgiPlatform.fdf
> > index 7916a52..aff0be5 100644
> > --- a/Platform/ARM/SgiPkg/SgiPlatform.fdf
> > +++ b/Platform/ARM/SgiPkg/SgiPlatform.fdf
> > @@ -96,10 +96,15 @@ READ_LOCK_STATUS = TRUE
> > INF EmbeddedPkg/ResetRuntimeDxe/ResetRuntimeDxe.inf
> > INF MdeModulePkg/Core/RuntimeDxe/RuntimeDxe.inf
> > INF MdeModulePkg/Universal/CapsuleRuntimeDxe/CapsuleRuntimeDxe.inf
> > - INF MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf
> > INF MdeModulePkg/Universal/MonotonicCounterRuntimeDxe/MonotonicCounterRuntimeDxe.inf
> > INF MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf
> > +!if $(SECURE_BOOT_ENABLE) == TRUE
> > + INF SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
> > + INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf
> > +!else
> > + INF MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf
> > INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
> > +!endif
> >
> > #
> > # ACPI Support
> > --
> > 2.7.4
> >
> _______________________________________________
> edk2-devel mailing list
> edk2-devel@lists.01.org
> https://lists.01.org/mailman/listinfo/edk2-devel
next prev parent reply other threads:[~2019-03-15 12:30 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-03-12 16:06 [PATCH edk2-platforms v2 0/3] Platform/ARM/SgiPkg: Implement StandaloneMm based secure boot Jagadeesh Ujja
2019-03-12 16:06 ` [PATCH edk2-platforms v2 1/3] Platform/ARM/Sgi: define nor2 flash controller memory map Jagadeesh Ujja
2019-03-12 16:06 ` [PATCH edk2-platforms v2 2/3] Platform/ARM/Sgi: allow MM_STANDALONE modules to use NorFlashPlatformLib Jagadeesh Ujja
2019-03-12 16:06 ` [PATCH edk2-platforms v2 3/3] Platform/ARM/SgiPkg: add MM based UEFI secure boot support Jagadeesh Ujja
2019-03-15 12:21 ` Ard Biesheuvel
2019-03-15 12:30 ` Thomas Abraham [this message]
2019-03-15 12:34 ` Ard Biesheuvel
2019-03-15 12:47 ` Thomas Abraham
2019-03-15 12:51 ` Ard Biesheuvel
2019-03-15 8:19 ` [PATCH edk2-platforms v2 0/3] Platform/ARM/SgiPkg: Implement StandaloneMm based secure boot Jagadeesh Ujja
2019-03-15 11:36 ` Ard Biesheuvel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAJuA9aj2gQtMOWuH8Pyiv6dAu4kzW+6PeR7N4yFj_XmoQbKCjA@mail.gmail.com \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox