From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail05.groups.io (mail05.groups.io [45.79.224.7]) by spool.mail.gandi.net (Postfix) with ESMTPS id 0B3CA740055 for ; Mon, 24 Jun 2024 08:50:27 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=d/DEGprrcmruar8uILSj6E+YCZXpjCBXQGME2isNK1M=; c=relaxed/simple; d=groups.io; h=From:To:CC:Subject:Thread-Topic:Thread-Index:Date:Message-ID:References:In-Reply-To:Accept-Language:msip_labels:undefined:drawingcanvaselements:composetype:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Resent-Date:Resent-From:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Language:Content-Type; s=20240206; t=1719219027; v=1; b=n1H2i/x2PMS/ABnsuKlkCBtxWFfXPDmtU/hq5vO9CJfM3jPowYmUvOk8Nymwu31DTIdKwILp MEglcyzNRudkFIir8hBqdZFh0oo4tzr+GZTgnTeSrpUtqMZUIGuLQJPOy11HLN3xea1EHqVYyb1 Fhiw+ZvbP8fLBlZBTEPfjLzDbRBUsV3azwIkJPxbKaDVOmLXBp5ltNMLOOwd4g8PRbPM+OHPywH I4K8BAzLiAO9Hv2nY2a1s/k+13vhaqEOWRJVEGVivqX0EafsjuJ2MDEDE0BEYGyTdr3iWiEwnS6 r7GM1sRdn74rAgXv0GYnomlXpZ60yTqtyEGCnM5X4f2Sg== X-Received: by 127.0.0.2 with SMTP id Z2jYYY7687511x8AkRueMS11; Mon, 24 Jun 2024 01:50:26 -0700 X-Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.15]) by mx.groups.io with SMTP id smtpd.web11.135961.1719219020188505288 for ; Mon, 24 Jun 2024 01:50:20 -0700 X-CSE-ConnectionGUID: coMTRHGASsOG4c3Ag8NOmA== X-CSE-MsgGUID: IS5yevQxSbqODYQmt2XdKQ== X-IronPort-AV: E=McAfee;i="6700,10204,11112"; a="16322321" X-IronPort-AV: E=Sophos;i="6.08,261,1712646000"; d="scan'208,217";a="16322321" X-Received: from fmviesa007.fm.intel.com ([10.60.135.147]) by fmvoesa109.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 Jun 2024 01:49:56 -0700 X-CSE-ConnectionGUID: E9HeSjL5Sby4DiZsEvtz3g== X-CSE-MsgGUID: lfwAKnEVRJeFFVMsNXfgrA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.08,261,1712646000"; d="scan'208,217";a="43105842" X-Received: from orsmsx603.amr.corp.intel.com ([10.22.229.16]) by fmviesa007.fm.intel.com with ESMTP/TLS/AES256-GCM-SHA384; 24 Jun 2024 01:49:55 -0700 X-Received: from orsmsx611.amr.corp.intel.com (10.22.229.24) by ORSMSX603.amr.corp.intel.com (10.22.229.16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.39; Mon, 24 Jun 2024 01:49:54 -0700 X-Received: from orsmsx610.amr.corp.intel.com (10.22.229.23) by ORSMSX611.amr.corp.intel.com (10.22.229.24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.39; Mon, 24 Jun 2024 01:49:54 -0700 X-Received: from ORSEDG602.ED.cps.intel.com (10.7.248.7) by orsmsx610.amr.corp.intel.com (10.22.229.23) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2507.39 via Frontend Transport; Mon, 24 Jun 2024 01:49:54 -0700 X-Received: from NAM02-SN1-obe.outbound.protection.outlook.com (104.47.57.40) by edgegateway.intel.com (134.134.137.103) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.1.2507.39; Mon, 24 Jun 2024 01:49:54 -0700 X-Received: from MN6PR11MB8244.namprd11.prod.outlook.com (2603:10b6:208:470::14) by DM4PR11MB6528.namprd11.prod.outlook.com (2603:10b6:8:8f::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.7698.30; Mon, 24 Jun 2024 08:49:52 +0000 X-Received: from MN6PR11MB8244.namprd11.prod.outlook.com ([fe80::41a4:c775:32e6:76a8]) by MN6PR11MB8244.namprd11.prod.outlook.com ([fe80::41a4:c775:32e6:76a8%5]) with mapi id 15.20.7698.025; Mon, 24 Jun 2024 08:49:52 +0000 From: "Ni, Ray" To: Ard Biesheuvel , "devel@edk2.groups.io" CC: "Yao, Jiewen" , "Xu, Wei6" , "Ni, Ray" , "Wu, Jiaxin" Subject: Re: [edk2-devel] Regarding MOR Secure feature Thread-Topic: [edk2-devel] Regarding MOR Secure feature Thread-Index: AQHaw62EtpleLzvEK0K+Pih0pELKf7HR5H0AgARI9wo= Date: Mon, 24 Jun 2024 08:49:52 +0000 Message-ID: References: In-Reply-To: Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: undefined: 10165216 drawingcanvaselements: [] composetype: reply x-ms-publictraffictype: Email x-ms-traffictypediagnostic: MN6PR11MB8244:EE_|DM4PR11MB6528:EE_ x-ms-office365-filtering-correlation-id: 6f7be029-228c-4167-b253-08dc942a9d04 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam-message-info: =?iso-8859-1?Q?RPpapRx04PkQUwg/I6YFeUTwu8DDWTsqMjdWOjBWYBFn+qvwuY5U9pF8OQ?= =?iso-8859-1?Q?LcbAWdbDW5wR4FBkb1loFjjTEPj/DAeZWxYTLdptnHJjbmbEqNlOpBZ7XV?= =?iso-8859-1?Q?HD7Lo0NFxKWFzVqs1YTMg7ALoatI40byB1Ywx486Bygo/BceLiWgcicsD1?= =?iso-8859-1?Q?HbjNEnHjtL9GoFetpYViTfRdzYdo9RIGN9caDLR3ja5RUbcJLZWe42vmLo?= =?iso-8859-1?Q?+Q9ZlRhfNVm5X86/zxhBRPKwrOwb5PpqJ2hxP0uOudWJ+jciTyuDhIuJCC?= =?iso-8859-1?Q?iN3cPRDFCu/669kHUL0HGdu8LkFvG8MhRk7g9QFxWMxaDxanP8iHrnjJzH?= =?iso-8859-1?Q?A1mX6uLuw0rX6Y89oZSif+rze2eP8W+ED0pgvWx6r62WhYX2IuTJxFwKNd?= =?iso-8859-1?Q?velwqV8qrjozJGjwy3SOF6cr8JU+XieWXi8IumrpVLgSzUsv2Ql0aFHb4K?= =?iso-8859-1?Q?4BDv4B06FBTIR400LlfE+yrkzLH8CFFgjXlPSRXGaqPbRTH3V1yhWjFYbe?= =?iso-8859-1?Q?NwplWmosTudAYAUodDd5vgeH6SOJN08UFRHOSQxNzBA9k4IL8tVk5axL2N?= =?iso-8859-1?Q?brj5C2YyqFqWwuI2DDalq/SmDQP+74xWNizIhIHBKuGLFhYGc3MKV31Vm5?= =?iso-8859-1?Q?TsYWwz7mnM4/edWA2QLB1zYm8FcLJdZOJiZM487Wi/DmhihJgJt0jeRVRR?= =?iso-8859-1?Q?vQD2DAaJOjNJLP35v7hUb6asz2TSh2ys7GCKGAiLMowT/y3WiATZAXQat2?= =?iso-8859-1?Q?3s7weMGqZnoS7Jvc0hcK0WVUCZtWzC05IQ+5bSFagfpPrG+VEmHumDHobD?= =?iso-8859-1?Q?BTNVCX45j9X8EL3rP7YmHNoHAuKQTsu1zwWzgwzacaSv/a8OxzsxxnbKKS?= =?iso-8859-1?Q?PUV0s5pNGuel3Eoac7539m0Zra8PqZXBgp8/s14DIWexq0SZpw0KMCAT6c?= =?iso-8859-1?Q?k53J0379HbQ2m+6HUo4WkP0E/nsqfJdNg/Md2DPr9gbKpwIdcrzBQ4Uwin?= =?iso-8859-1?Q?eVMyu8a2HrmSJndoqK4TPUqrPu8MWDtWf+2TUXXTm8uSzKyi+rVSFwvsK2?= =?iso-8859-1?Q?cSkFMO5TSXs4Tbu+7/JE/Bi3BiusF1VI5kfUTsE8UEGy48i7qZRelD4skG?= =?iso-8859-1?Q?Iy8tw0ERCkb6hj15pbw09QK9fRAwr/9IM6CwLgkGjHH5SqZ+nixC8x7EpO?= =?iso-8859-1?Q?oIl7wMmXJsDwW98CFiAIq12L9vUf8Wlw7qV7uAOzHyXSMcqMqZxSTve6Ny?= =?iso-8859-1?Q?I01feLLVCsA6ieKQihjuhW4XrBvZm9bcyTWzvWcpcasDbAdBljYXDE/cSG?= =?iso-8859-1?Q?RyAY2ixngLn8DUPwXJrTo2LWXy9xLgr1Fj9HmRctGESzC1wD5nocnCmJSO?= =?iso-8859-1?Q?pd7k7f+QO8?= x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?UVf8MGzBKsr8kk5rItglCSS1Lh9lQNC3kWHSbcgTD5fDihYoPx3WNSZG64?= =?iso-8859-1?Q?J74m7PqeLOsvsM2HPTzPbZIVwwoP57SaKaRwKG6m9mSZCaFg6hAJAH8Tf4?= =?iso-8859-1?Q?ItXukQklPuYbKrebLRHtAnU6SVXE8r/iBaaIma/vO2+cy4J4Wa5nd2H47+?= =?iso-8859-1?Q?yeL3GDo3MFsBduSfK/bk/loSiHfRww0ReF/xI1HksQ7K9ImxbhI9NvWGzG?= =?iso-8859-1?Q?KxmuofMZZgewqoo4Ho0cARJdRzzj9QC6exVmORsKIg5S+Y41xFCYk1t52W?= =?iso-8859-1?Q?72W72kIx7iq0MTGWGghKywctEwQ6crSG2xGVPXdpCiJoXxnQj/e7JuTbUz?= =?iso-8859-1?Q?/6kEir2efSb51KRqq3kF0ySwECe1T6wv3y2DcI5CnxRMw4tKVORicKiF0+?= =?iso-8859-1?Q?Lhv+AGPoKNsRqR14LJ28sKcMYPX3HWaVj/gpVQ8g1LuVYHwIXbV5jf+rtQ?= =?iso-8859-1?Q?nsEIgdVM15s1YnQqrucVy6f/bvfTFNSxKszNg/bHvfx21zmXWbl+ART3HV?= =?iso-8859-1?Q?FW2tdrYcl1rsslXMdmz3gNmVTsosMjABVqtFPAB+e6SOFriZaxtSih0T1Z?= =?iso-8859-1?Q?OzPkmU+XQl+MLpFUlhq9y61yse9PsGudscnN3A4FlUqzZVHe31G/XWFoZy?= =?iso-8859-1?Q?dY6PHnhNjxpHKKuBzuPGOg5R9j7skpl21Ff1NzH8WJ6Nx0XA+3SPjE2HkT?= =?iso-8859-1?Q?2kIfWHY6VN863I4zb2kXOf/DSTUzfbSQ+8E7hvePk0eYjuw0YB4JGfg3du?= =?iso-8859-1?Q?3+ignknT1WHA6u4PvhlFZ4G1w7fcMJcnM1T29a1apVl1dmG4NMl1KtAswM?= =?iso-8859-1?Q?/VoyEmOsL72LgOikvzB24IRegimb1zxGEaj5Jmi4wmTcUezRLpyaembUB6?= =?iso-8859-1?Q?qxof8OIL9okd0oaygy85ybGwiXqfevys901dBDO5xW13ZGjl6WtDjOatuy?= =?iso-8859-1?Q?AKX1MuhvQ79VWPmy5YyQnjF18uUlBccOND+vQ9Y76IjV5ukzkCUEW2xGJv?= =?iso-8859-1?Q?fTbmVZenUt/1l1ndO/rkn7407GKqLSI7R/ydqKIaKeCmRUkPSWZ8mAeVNr?= =?iso-8859-1?Q?yk5UAgmpA4p8so7JBNSL3BsDrM8+xZ6hqCiCbRt7RxSefm/1ulHk7FsQAb?= =?iso-8859-1?Q?30nFQwHgwwvpgMc5DQCfgATiOtMbR1tg3V5isMDF7AFMKYsrSPwy01l9u2?= =?iso-8859-1?Q?ljLzISXGG7V9EfvuFOtP0KCjcmycbsAFDnm68GghcpsS9cBKHbhJynNYOL?= =?iso-8859-1?Q?Xu4nsod3wD5H+sop5HLXSzVc3XTJaV9FTsH8ElZ+L7LYUaI4d0H5Gh7OPp?= =?iso-8859-1?Q?qIPfAg3NP/ITfNCZ4vH1DmG9Tu1iyw3/JuelrjIZ6j3g/n5f6E7K/78PAc?= =?iso-8859-1?Q?/Gkr6GD8m4aRds7s9JVI304yZfCds/o7+X9LrDxW0Y4nS7xoFpkU/z2AuC?= =?iso-8859-1?Q?QS9mcWCnqL+iz1Fvq2oJqUzAn1KMJTlGf/VnpInZnE8pv31AjfZVZW76D2?= =?iso-8859-1?Q?BtTjfOMYBy1GmgT7jaeuaQmjsUyg8YIcjyRnPAQKiiKQNwIAkDt3ht7P/d?= =?iso-8859-1?Q?0TMqUlaf6oXBX0w8RxGp+GgpMTg1nHSTclwCKn7SJDenuJRWkrgX+swKKm?= =?iso-8859-1?Q?9D8VLuTauMPE0=3D?= MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: MN6PR11MB8244.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 6f7be029-228c-4167-b253-08dc942a9d04 X-MS-Exchange-CrossTenant-originalarrivaltime: 24 Jun 2024 08:49:52.3071 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 46c98d88-e344-4ed4-8496-4ed7712e255d X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: zliiek/rB2qtZPFSIEnbvzf5vU/137FImadVLHxIWNQZflQljb944/HyoOB/MEWtdZxkQr5JGjkSrIDycwAypA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM4PR11MB6528 X-OriginatorOrg: intel.com Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Resent-Date: Mon, 24 Jun 2024 01:50:20 -0700 Resent-From: ray.ni@intel.com Reply-To: devel@edk2.groups.io,ray.ni@intel.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: i3phBUWLft3uuh1f3wq0Da2mx7686176AA= Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_MN6PR11MB82444638E6B2C19FEAA14D7E8CD42MN6PR11MB8244namp_" X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20240206 header.b="n1H2i/x2"; dmarc=fail reason="SPF not aligned (relaxed), DKIM not aligned (relaxed)" header.from=intel.com (policy=none); spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 45.79.224.7 as permitted sender) smtp.mailfrom=bounce@groups.io --_000_MN6PR11MB82444638E6B2C19FEAA14D7E8CD42MN6PR11MB8244namp_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Ard, Thank you very much for your willingness to think about this topic. Yes. we found the TCG MOR secure feature does not work in standalone MM env= and want to fix it. That leads the review of the code change history. If you can confirm my understanding (F24/F25 are EOL today and Laszlo's fix= is not needed), I can create a PR to remove that change. Thanks, Ray ________________________________ From: Ard Biesheuvel Sent: Friday, June 21, 2024 16:35 To: devel@edk2.groups.io ; Ni, Ray Cc: Yao, Jiewen ; Xu, Wei6 Subject: Re: [edk2-devel] Regarding MOR Secure feature Hi Ray, On Fri, 21 Jun 2024 at 10:03, Ni, Ray wrote: > > Ard, > > 7 years ago, Laszlo added this commit (https://github.com/tianocore/edk2/= commit/fda8f631edbbf3823760542a06f12bd60fd39181) to support some OS kernels= that incorrectly "create" the MOR variable. > The OS kernel bug is captured in this bugzilla (bugzilla.redhat.com/show_= bug.cgi?id=3D1498159). It seems to me the OS kernel bugs only exist in Fedo= ra 24 and 25 which are all EOL today. Fedora 26 has the correct implementat= ion that does NOT "create" the MOR variable. The implementation is done by = you here (https://lore.kernel.org/all/20170825155019.6740-2-ard.biesheuvel@= linaro.org/T/#u). > > 5 years ago, you added StandaloneMm variable driver and VariableHaveTcgPr= otocols() returns FALSE always in the standalone MM version. (Commit: https= ://github.com/tianocore/edk2/commit/a855f63e2fdd990837391b0e61e78b3f06b5691= 6) > As a result, MorLock variable is not created. It causes a bug that the BI= OS does not report the MOR Secure feature to OS. > > My questions are: > > can we revert Laszlo's commit? As the bug that commit fixes only exists i= n Fedora 24/25 which are all EOL today. Yes, I think we can revert it, although it is not clear from the commit log what the erroneous behavior is. > why is the MOR secure bug not found in ARM platform? > This is definitely a bug on ARM (and likely other users of standalone MM). The problem is, of course, that standalone MM is standalone, and cannot know for certain which EFI protocols are exposed by the DXE core, nor invoke them directly. > > I think you are the best person to answer the questions because you not o= nly fixed the kernel, but also know details on the ARM standalone MM. > I am so happy with that:) > :-) To be honest, I need some time to page this all back into my brain, but I am happy to help out. MOR does not really rely on the TCG protocols, right? If standalone MM can implement it without its ability to invoke those protocols, we should just separate those. I guess that is what you are doing at the moment? -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#119683): https://edk2.groups.io/g/devel/message/119683 Mute This Topic: https://groups.io/mt/106795434/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- --_000_MN6PR11MB82444638E6B2C19FEAA14D7E8CD42MN6PR11MB8244namp_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Ard,
Thank you very much for your willingness to think about this topic.

Yes. we found the TCG MOR secure feature does not work in standalone MM env= and want to fix it.
That leads the review of the code change history.

If you can confirm my understanding (F24/F25 are EOL today and Laszlo's fix= is not needed), I can create a PR to remove that change.

Thanks,
Ray

From: Ar= d Biesheuvel <ardb@kernel.org>
Sent: Friday, June 21, 2024 16:35
To: devel@edk2.groups.io <devel@edk2.groups.io>; Ni, Ray = <ray.ni@intel.com>
Cc: Yao, Jiewen <jiewen.yao@intel.com>; Xu, Wei6 <wei6= .xu@intel.com>
Subject: Re: [edk2-devel] Regarding MOR Secure feature
 
Hi Ray,


On Fri, 21 Jun 2024 at 10:03, Ni, Ray <ray.ni@intel.com> wrote:
>
> Ard,
>
> 7 years ago, Laszlo ad= ded this commit (https://githu= b.com/tianocore/edk2/commit/fda8f631edbbf3823760542a06f12bd60fd39181) to support some OS kernels that incorrectly "create" the MOR var= iable.
> The OS kernel bug is c= aptured in this bugzilla (bugzilla.redhat.com/show_bug.cgi?id=3D1498159). I= t seems to me the OS kernel bugs only exist in Fedora 24 and 25 which are a= ll EOL today. Fedora 26 has the correct implementation that does NOT "create" the MOR variable. The impl= ementation is done by you here (https://lore.kernel.org/all/20170825155019.6740-2-ard.biesheuvel@linaro.or= g/T/#u).
>
> 5 years ago, you added StandaloneMm variable driver and VariableHaveTc= gProtocols() returns FALSE always in the standalone MM version. (Commit: https://github.com/tianocore/edk2/commit/a855f63e2fdd990837391b0e61e78b3f06= b56916)
> As a result, MorLock variable is not created. It causes a bug that the= BIOS does not report the MOR Secure feature to OS.
>
> My questions are:
>
> can we revert Laszlo's commit? As the bug that commit fixes only exist= s in Fedora 24/25 which are all EOL today.

Yes, I think we can revert it, although it is not clear from the
commit log what the erroneous behavior is.

> why is the MOR secure bug not found in ARM platform?
>

This is definitely a bug on ARM (and likely other users of standalone MM).<= br>
The problem is, of course, that standalone MM is standalone, and
cannot know for certain which EFI protocols are exposed by the DXE
core, nor invoke them directly.

>
> I think you are the best person to answer the questions because you no= t only fixed the kernel, but also know details on the ARM standalone MM. > I am so happy with that:)
>

:-)

To be honest, I need some time to page this all back into my brain,
but I am happy to help out.

MOR does not really rely on the TCG protocols, right? If standalone MM
can implement it without its ability to invoke those protocols, we
should just separate those. I guess that is what you are doing at the
moment?
_._,_._,_
Groups.io Links:

=20 You receive all messages sent to this group. =20 =20

View/Reply Online (#119683) | =20 | Mute= This Topic | New Topic
Your Subscriptio= n | Contact Group Owner | Unsubscribe [rebecca@openfw.io]

_._,_._,_
--_000_MN6PR11MB82444638E6B2C19FEAA14D7E8CD42MN6PR11MB8244namp_--