Re: [edk2-devel] Regarding MOR Secure feature

["Ard Biesheuvel" <ardb@kernel.org>]

Hi Ray,


On Fri, 21 Jun 2024 at 10:03, Ni, Ray <ray.ni@intel.com> wrote:
>
> Ard,
>
> 7 years ago, Laszlo added this commit (https://github.com/tianocore/edk2/commit/fda8f631edbbf3823760542a06f12bd60fd39181) to support some OS kernels that incorrectly "create" the MOR variable.
> The OS kernel bug is captured in this bugzilla (bugzilla.redhat.com/show_bug.cgi?id=1498159). It seems to me the OS kernel bugs only exist in Fedora 24 and 25 which are all EOL today. Fedora 26 has the correct implementation that does NOT "create" the MOR variable. The implementation is done by you here (https://lore.kernel.org/all/20170825155019.6740-2-ard.biesheuvel@linaro.org/T/#u).
>
> 5 years ago, you added StandaloneMm variable driver and VariableHaveTcgProtocols() returns FALSE always in the standalone MM version. (Commit: https://github.com/tianocore/edk2/commit/a855f63e2fdd990837391b0e61e78b3f06b56916)
> As a result, MorLock variable is not created. It causes a bug that the BIOS does not report the MOR Secure feature to OS.
>
> My questions are:
>
> can we revert Laszlo's commit? As the bug that commit fixes only exists in Fedora 24/25 which are all EOL today.

Yes, I think we can revert it, although it is not clear from the
commit log what the erroneous behavior is.

> why is the MOR secure bug not found in ARM platform?
>

This is definitely a bug on ARM (and likely other users of standalone MM).

The problem is, of course, that standalone MM is standalone, and
cannot know for certain which EFI protocols are exposed by the DXE
core, nor invoke them directly.

>
> I think you are the best person to answer the questions because you not only fixed the kernel, but also know details on the ARM standalone MM.
> I am so happy with that:)
>

:-)

To be honest, I need some time to page this all back into my brain,
but I am happy to help out.

MOR does not really rely on the TCG protocols, right? If standalone MM
can implement it without its ability to invoke those protocols, we
should just separate those. I guess that is what you are doing at the
moment?


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#119669): https://edk2.groups.io/g/devel/message/119669
Mute This Topic: https://groups.io/mt/106795434/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-