public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
From: "Ni, Ray" <ray.ni@intel.com>
To: Ard Biesheuvel <ardb@kernel.org>,
	"devel@edk2.groups.io" <devel@edk2.groups.io>
Cc: "Yao, Jiewen" <jiewen.yao@intel.com>,
	"Xu, Wei6" <wei6.xu@intel.com>, "Ni, Ray" <ray.ni@intel.com>,
	"Wu, Jiaxin" <jiaxin.wu@intel.com>
Subject: Re: [edk2-devel] Regarding MOR Secure feature
Date: Mon, 24 Jun 2024 08:49:52 +0000	[thread overview]
Message-ID: <MN6PR11MB82444638E6B2C19FEAA14D7E8CD42@MN6PR11MB8244.namprd11.prod.outlook.com> (raw)
In-Reply-To: <CAMj1kXEro+bdLNXk44opR6ON2aCCsxSW2ckb+TfjXfZZE874Ng@mail.gmail.com>

[-- Attachment #1: Type: text/plain, Size: 3171 bytes --]

Ard,
Thank you very much for your willingness to think about this topic.

Yes. we found the TCG MOR secure feature does not work in standalone MM env and want to fix it.
That leads the review of the code change history.

If you can confirm my understanding (F24/F25 are EOL today and Laszlo's fix is not needed), I can create a PR to remove that change.

Thanks,
Ray

________________________________
From: Ard Biesheuvel <ardb@kernel.org>
Sent: Friday, June 21, 2024 16:35
To: devel@edk2.groups.io <devel@edk2.groups.io>; Ni, Ray <ray.ni@intel.com>
Cc: Yao, Jiewen <jiewen.yao@intel.com>; Xu, Wei6 <wei6.xu@intel.com>
Subject: Re: [edk2-devel] Regarding MOR Secure feature

Hi Ray,


On Fri, 21 Jun 2024 at 10:03, Ni, Ray <ray.ni@intel.com> wrote:
>
> Ard,
>
> 7 years ago, Laszlo added this commit (https://github.com/tianocore/edk2/commit/fda8f631edbbf3823760542a06f12bd60fd39181) to support some OS kernels that incorrectly "create" the MOR variable.
> The OS kernel bug is captured in this bugzilla (bugzilla.redhat.com/show_bug.cgi?id=1498159). It seems to me the OS kernel bugs only exist in Fedora 24 and 25 which are all EOL today. Fedora 26 has the correct implementation that does NOT "create" the MOR variable. The implementation is done by you here (https://lore.kernel.org/all/20170825155019.6740-2-ard.biesheuvel@linaro.org/T/#u).
>
> 5 years ago, you added StandaloneMm variable driver and VariableHaveTcgProtocols() returns FALSE always in the standalone MM version. (Commit: https://github.com/tianocore/edk2/commit/a855f63e2fdd990837391b0e61e78b3f06b56916)
> As a result, MorLock variable is not created. It causes a bug that the BIOS does not report the MOR Secure feature to OS.
>
> My questions are:
>
> can we revert Laszlo's commit? As the bug that commit fixes only exists in Fedora 24/25 which are all EOL today.

Yes, I think we can revert it, although it is not clear from the
commit log what the erroneous behavior is.

> why is the MOR secure bug not found in ARM platform?
>

This is definitely a bug on ARM (and likely other users of standalone MM).

The problem is, of course, that standalone MM is standalone, and
cannot know for certain which EFI protocols are exposed by the DXE
core, nor invoke them directly.

>
> I think you are the best person to answer the questions because you not only fixed the kernel, but also know details on the ARM standalone MM.
> I am so happy with that:)
>

:-)

To be honest, I need some time to page this all back into my brain,
but I am happy to help out.

MOR does not really rely on the TCG protocols, right? If standalone MM
can implement it without its ability to invoke those protocols, we
should just separate those. I guess that is what you are doing at the
moment?


-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#119683): https://edk2.groups.io/g/devel/message/119683
Mute This Topic: https://groups.io/mt/106795434/7686176
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io]
-=-=-=-=-=-=-=-=-=-=-=-



[-- Attachment #2: Type: text/html, Size: 7078 bytes --]

  reply	other threads:[~2024-06-24  8:50 UTC|newest]

Thread overview: 5+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-06-21  8:03 [edk2-devel] Regarding MOR Secure feature Ni, Ray
2024-06-21  8:35 ` Ard Biesheuvel
2024-06-24  8:49   ` Ni, Ray [this message]
2024-06-24 11:17     ` Gerd Hoffmann
2024-08-16 10:49     ` Xu, Wei6

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-list from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=MN6PR11MB82444638E6B2C19FEAA14D7E8CD42@MN6PR11MB8244.namprd11.prod.outlook.com \
    --to=devel@edk2.groups.io \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox