From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=2607:f8b0:4864:20::144; helo=mail-it1-x144.google.com; envelope-from=ard.biesheuvel@linaro.org; receiver=edk2-devel@lists.01.org Received: from mail-it1-x144.google.com (mail-it1-x144.google.com [IPv6:2607:f8b0:4864:20::144]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 5DB6F21191F46 for ; Mon, 19 Nov 2018 10:20:06 -0800 (PST) Received: by mail-it1-x144.google.com with SMTP id i7so3554171iti.2 for ; Mon, 19 Nov 2018 10:20:06 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=SyPBkKSiVo3nHQC4rvKnhJa+DAnDgDR1lHfJccciHk8=; b=J0ofse8WzRX/P/ZL2UswWK/0avoKZq0PqACuFSLnatbQGgKJ+c/zPrsJPePYbN2NRE T+/jGDoLoJsCAQqwzFpq1OPpbQ2j/9bCjEUj1vw5ZEeBQQRkq2inQlrd5FzIVri8xUqN AULI/UToohBzh1wTjVdd6IF2xm9I8HyiEQhXY= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=SyPBkKSiVo3nHQC4rvKnhJa+DAnDgDR1lHfJccciHk8=; b=IZfeBPoUc2nIiLqAa4lj8rzZfPE8GXP3o6lblFd/JuKWkxgefel4xOzDCXC6EXhSSE LGUCwwUjCPq3DLY3wJjdiDvJBHsSioJ4qkfSFb7Iw2M2uGomfo8HpkeEUefo60vJhQW4 zOwUS+msgBsGsyCLDIS1FX2zzKa4Vnc8WCj2P3nobPrB66VvVyr+RQnztH1xTRhF5s01 4HX6GC9pcmateTVepsOwDXjl6yXJpZeZE0hd8yWMa5Z7OhbxItwXhVoADGAHnmaY+cvy xTNlTREdBrZGcqPS70zD2JdaJSgWlP1JnRbq7g+s6X4c25sodbd4fWjTOAs5ZM09TR5I B/iA== X-Gm-Message-State: AGRZ1gIzxOiQ7o9r9P/PkNRNEItGzRJn8qG4hqne/oZRhSvg8StjeXPL 3piiZxBgnIDOKGduGE5boMAW5imBCbKRVXN370bEww== X-Google-Smtp-Source: AFSGD/WdeOyWdmvIv8awzkrFXV0DbQNZP4sUm4YQkEQZn9bt9v7PWtHwKniJEFnLUfIS3G/y3OEKHm78x4AZ7fpGdms= X-Received: by 2002:a05:660c:4b:: with SMTP id p11mr2214326itk.71.1542651604137; Mon, 19 Nov 2018 10:20:04 -0800 (PST) MIME-Version: 1.0 References: <20181116065702.30559-1-ming.huang@linaro.org> <20181116065702.30559-8-ming.huang@linaro.org> In-Reply-To: <20181116065702.30559-8-ming.huang@linaro.org> From: Ard Biesheuvel Date: Mon, 19 Nov 2018 10:19:52 -0800 Message-ID: To: Ming Huang Cc: Leif Lindholm , linaro-uefi , "edk2-devel@lists.01.org" , Graeme Gregory , "Kinney, Michael D" , Laszlo Ersek , wanghuiqiang , huangming , Jason Zhang , huangdaode@hisilicon.com, John Garry , Xinliang Liu , zhangfeng56@huawei.com Subject: Re: [PATCH edk2-platforms v2 07/15] Hisilicon/D0x: Fix secure boot bug in FlashFvbDxe X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 19 Nov 2018 18:20:06 -0000 Content-Type: text/plain; charset="UTF-8" On Thu, 15 Nov 2018 at 22:57, Ming Huang wrote: > > When SECURE_BOOT_ENABLE is TRUE, FlashFvbDxe should use > gEfiAuthenticatedVariableGuid, When SECURE_BOOT_ENABLE > is FALSE, gEfiVariableGuid should be used. > Can we fix the driver instead so we don't need to make this distinction? Please refer to commit 8753858f84768fa6fa17191b86c97538457723ce in the EDK2 for some background. > Contributed-under: TianoCore Contribution Agreement 1.1 > Signed-off-by: Ming Huang > --- > Silicon/Hisilicon/HisiPkg.dec | 1 + > Platform/Hisilicon/D03/D03.dsc | 5 +++++ > Platform/Hisilicon/D05/D05.dsc | 5 +++++ > Platform/Hisilicon/D06/D06.dsc | 5 +++++ > Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf | 2 ++ > Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c | 14 ++++++++++++-- > 6 files changed, 30 insertions(+), 2 deletions(-) > > diff --git a/Silicon/Hisilicon/HisiPkg.dec b/Silicon/Hisilicon/HisiPkg.dec > index 404a3ae4af9d..af9359e4d0e0 100644 > --- a/Silicon/Hisilicon/HisiPkg.dec > +++ b/Silicon/Hisilicon/HisiPkg.dec > @@ -278,6 +278,7 @@ [PcdsFixedAtBuild] > > gHisiTokenSpaceGuid.Pcdsoctype|0|UINT32|0x00000061 > gHisiTokenSpaceGuid.PcdSerDesFlowCtrlFlag|0|UINT32|0x40000056 > + gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE|BOOLEAN|0x40000058 > > [PcdsFeatureFlag] > gHisiTokenSpaceGuid.PcdIsItsSupported|FALSE|BOOLEAN|0x00000065 > diff --git a/Platform/Hisilicon/D03/D03.dsc b/Platform/Hisilicon/D03/D03.dsc > index aa1da5d61f83..ba3096672db0 100644 > --- a/Platform/Hisilicon/D03/D03.dsc > +++ b/Platform/Hisilicon/D03/D03.dsc > @@ -281,6 +281,11 @@ [PcdsFixedAtBuild.common] > gHisiTokenSpaceGuid.PcdHb0Rb2IoSize|0xffff #64K > > gHisiTokenSpaceGuid.Pcdsoctype|0x1610 > + !if $(SECURE_BOOT_ENABLE) == TRUE > + gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE > + !else > + gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE > + !endif > > ################################################################################ > # > diff --git a/Platform/Hisilicon/D05/D05.dsc b/Platform/Hisilicon/D05/D05.dsc > index 1040466633ef..b8500cef8742 100644 > --- a/Platform/Hisilicon/D05/D05.dsc > +++ b/Platform/Hisilicon/D05/D05.dsc > @@ -422,6 +422,11 @@ [PcdsFixedAtBuild.common] > gHisiTokenSpaceGuid.PcdHb1Rb7IoSize|0x10000 #64K > > gHisiTokenSpaceGuid.Pcdsoctype|0x1610 > + !if $(SECURE_BOOT_ENABLE) == TRUE > + gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE > + !else > + gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE > + !endif > > ################################################################################ > # > diff --git a/Platform/Hisilicon/D06/D06.dsc b/Platform/Hisilicon/D06/D06.dsc > index 1a479c160e80..b6ef9fedf0a7 100644 > --- a/Platform/Hisilicon/D06/D06.dsc > +++ b/Platform/Hisilicon/D06/D06.dsc > @@ -243,6 +243,11 @@ [PcdsFixedAtBuild.common] > > gEfiMdeModulePkgTokenSpaceGuid.PcdSrIovSupport|FALSE > gArmTokenSpaceGuid.PcdPciIoTranslation|0x0 > + !if $(SECURE_BOOT_ENABLE) == TRUE > + gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE > + !else > + gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE > + !endif > > ################################################################################ > # > diff --git a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf > index f8be4741ef7c..47965a707032 100644 > --- a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf > +++ b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf > @@ -44,6 +44,7 @@ [LibraryClasses] > UefiRuntimeLib > > [Guids] > + gEfiAuthenticatedVariableGuid > gEfiSystemNvDataFvGuid > gEfiVariableGuid > > @@ -62,6 +63,7 @@ [Pcd.common] > gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareSize > > gArmPlatformTokenSpaceGuid.PcdNorFlashCheckBlockLocked > + gHisiTokenSpaceGuid.PcdIsSecureBoot > gHisiTokenSpaceGuid.PcdSFCMEM0BaseAddress > > [Depex] > diff --git a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c > index e18cc9e06ec2..309941d6fe4d 100644 > --- a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c > +++ b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c > @@ -189,7 +189,11 @@ InitializeFvAndVariableStoreHeaders ( > // VARIABLE_STORE_HEADER > // > VariableStoreHeader = (VARIABLE_STORE_HEADER*)((UINTN)Headers + (UINTN)FirmwareVolumeHeader->HeaderLength); > - CopyGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid); > + if (PcdGetBool (PcdIsSecureBoot)) { > + CopyGuid (&VariableStoreHeader->Signature, &gEfiAuthenticatedVariableGuid); > + } else { > + CopyGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid); > + } > VariableStoreHeader->Size = PcdGet32(PcdFlashNvStorageVariableSize) - FirmwareVolumeHeader->HeaderLength; > VariableStoreHeader->Format = VARIABLE_STORE_FORMATTED; > VariableStoreHeader->State = VARIABLE_STORE_HEALTHY; > @@ -220,6 +224,7 @@ ValidateFvHeader ( > VARIABLE_STORE_HEADER* VariableStoreHeader; > UINTN VariableStoreLength; > UINTN FvLength; > + EFI_GUID *Guid; > > FwVolHeader = (EFI_FIRMWARE_VOLUME_HEADER*)Instance->RegionBaseAddress; > > @@ -258,7 +263,12 @@ ValidateFvHeader ( > VariableStoreHeader = (VARIABLE_STORE_HEADER*)((UINTN)FwVolHeader + (UINTN)FwVolHeader->HeaderLength); > > // Check the Variable Store Guid > - if ( CompareGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid) == FALSE ) > + if (PcdGetBool (PcdIsSecureBoot)) { > + Guid = &gEfiAuthenticatedVariableGuid; > + } else { > + Guid = &gEfiVariableGuid; > + } > + if (CompareGuid (&VariableStoreHeader->Signature, Guid) == FALSE) > { > DEBUG ((EFI_D_ERROR, "ValidateFvHeader: Variable Store Guid non-compatible\n")); > return EFI_NOT_FOUND; > -- > 2.9.5 >