public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
From: Ming Huang <ming.huang@linaro.org>
To: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Leif Lindholm <leif.lindholm@linaro.org>,
	linaro-uefi <linaro-uefi@lists.linaro.org>,
	"edk2-devel@lists.01.org" <edk2-devel@lists.01.org>,
	Graeme Gregory <graeme.gregory@linaro.org>,
	"Kinney, Michael D" <michael.d.kinney@intel.com>,
	Laszlo Ersek <lersek@redhat.com>,
	wanghuiqiang <wanghuiqiang@huawei.com>,
	huangming <huangming23@huawei.com>,
	Jason Zhang <zhangjinsong2@huawei.com>,
	huangdaode@hisilicon.com, John Garry <john.garry@huawei.com>,
	Xinliang Liu <xinliang.liu@linaro.org>,
	zhangfeng56@huawei.com
Subject: Re: [PATCH edk2-platforms v2 07/15] Hisilicon/D0x: Fix secure boot bug in FlashFvbDxe
Date: Tue, 20 Nov 2018 14:44:39 +0800	[thread overview]
Message-ID: <b3fe9e0d-294e-60bc-bff4-e0a64466f08d@linaro.org> (raw)
In-Reply-To: <CAKv+Gu9FT-_4LVFUOro9GDafXKSrAVj1JRUT4R59p=sn5i0-0Q@mail.gmail.com>



On 11/20/2018 2:19 AM, Ard Biesheuvel wrote:
> On Thu, 15 Nov 2018 at 22:57, Ming Huang <ming.huang@linaro.org> wrote:
>>
>> When SECURE_BOOT_ENABLE is TRUE, FlashFvbDxe should use
>> gEfiAuthenticatedVariableGuid, When SECURE_BOOT_ENABLE
>> is FALSE, gEfiVariableGuid should be used.
>>
> 
> Can we fix the driver instead so we don't need to make this distinction?

Yes, modify it as below patch.
Thank you.

> 
> Please refer to commit 8753858f84768fa6fa17191b86c97538457723ce in the
> EDK2 for some background.
> 
>> Contributed-under: TianoCore Contribution Agreement 1.1
>> Signed-off-by: Ming Huang <ming.huang@linaro.org>
>> ---
>>  Silicon/Hisilicon/HisiPkg.dec                         |  1 +
>>  Platform/Hisilicon/D03/D03.dsc                        |  5 +++++
>>  Platform/Hisilicon/D05/D05.dsc                        |  5 +++++
>>  Platform/Hisilicon/D06/D06.dsc                        |  5 +++++
>>  Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf |  2 ++
>>  Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c   | 14 ++++++++++++--
>>  6 files changed, 30 insertions(+), 2 deletions(-)
>>
>> diff --git a/Silicon/Hisilicon/HisiPkg.dec b/Silicon/Hisilicon/HisiPkg.dec
>> index 404a3ae4af9d..af9359e4d0e0 100644
>> --- a/Silicon/Hisilicon/HisiPkg.dec
>> +++ b/Silicon/Hisilicon/HisiPkg.dec
>> @@ -278,6 +278,7 @@ [PcdsFixedAtBuild]
>>
>>    gHisiTokenSpaceGuid.Pcdsoctype|0|UINT32|0x00000061
>>    gHisiTokenSpaceGuid.PcdSerDesFlowCtrlFlag|0|UINT32|0x40000056
>> +  gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE|BOOLEAN|0x40000058
>>
>>  [PcdsFeatureFlag]
>>    gHisiTokenSpaceGuid.PcdIsItsSupported|FALSE|BOOLEAN|0x00000065
>> diff --git a/Platform/Hisilicon/D03/D03.dsc b/Platform/Hisilicon/D03/D03.dsc
>> index aa1da5d61f83..ba3096672db0 100644
>> --- a/Platform/Hisilicon/D03/D03.dsc
>> +++ b/Platform/Hisilicon/D03/D03.dsc
>> @@ -281,6 +281,11 @@ [PcdsFixedAtBuild.common]
>>    gHisiTokenSpaceGuid.PcdHb0Rb2IoSize|0xffff #64K
>>
>>    gHisiTokenSpaceGuid.Pcdsoctype|0x1610
>> +  !if $(SECURE_BOOT_ENABLE) == TRUE
>> +    gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE
>> +  !else
>> +    gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE
>> +  !endif
>>
>>  ################################################################################
>>  #
>> diff --git a/Platform/Hisilicon/D05/D05.dsc b/Platform/Hisilicon/D05/D05.dsc
>> index 1040466633ef..b8500cef8742 100644
>> --- a/Platform/Hisilicon/D05/D05.dsc
>> +++ b/Platform/Hisilicon/D05/D05.dsc
>> @@ -422,6 +422,11 @@ [PcdsFixedAtBuild.common]
>>    gHisiTokenSpaceGuid.PcdHb1Rb7IoSize|0x10000 #64K
>>
>>    gHisiTokenSpaceGuid.Pcdsoctype|0x1610
>> +  !if $(SECURE_BOOT_ENABLE) == TRUE
>> +    gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE
>> +  !else
>> +    gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE
>> +  !endif
>>
>>  ################################################################################
>>  #
>> diff --git a/Platform/Hisilicon/D06/D06.dsc b/Platform/Hisilicon/D06/D06.dsc
>> index 1a479c160e80..b6ef9fedf0a7 100644
>> --- a/Platform/Hisilicon/D06/D06.dsc
>> +++ b/Platform/Hisilicon/D06/D06.dsc
>> @@ -243,6 +243,11 @@ [PcdsFixedAtBuild.common]
>>
>>    gEfiMdeModulePkgTokenSpaceGuid.PcdSrIovSupport|FALSE
>>    gArmTokenSpaceGuid.PcdPciIoTranslation|0x0
>> +  !if $(SECURE_BOOT_ENABLE) == TRUE
>> +    gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE
>> +  !else
>> +    gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE
>> +  !endif
>>
>>  ################################################################################
>>  #
>> diff --git a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf
>> index f8be4741ef7c..47965a707032 100644
>> --- a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf
>> +++ b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf
>> @@ -44,6 +44,7 @@ [LibraryClasses]
>>    UefiRuntimeLib
>>
>>  [Guids]
>> +  gEfiAuthenticatedVariableGuid
>>    gEfiSystemNvDataFvGuid
>>    gEfiVariableGuid
>>
>> @@ -62,6 +63,7 @@ [Pcd.common]
>>    gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareSize
>>
>>    gArmPlatformTokenSpaceGuid.PcdNorFlashCheckBlockLocked
>> +  gHisiTokenSpaceGuid.PcdIsSecureBoot
>>    gHisiTokenSpaceGuid.PcdSFCMEM0BaseAddress
>>
>>  [Depex]
>> diff --git a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c
>> index e18cc9e06ec2..309941d6fe4d 100644
>> --- a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c
>> +++ b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c
>> @@ -189,7 +189,11 @@ InitializeFvAndVariableStoreHeaders (
>>      // VARIABLE_STORE_HEADER
>>      //
>>      VariableStoreHeader = (VARIABLE_STORE_HEADER*)((UINTN)Headers + (UINTN)FirmwareVolumeHeader->HeaderLength);
>> -    CopyGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid);
>> +    if (PcdGetBool (PcdIsSecureBoot)) {
>> +      CopyGuid (&VariableStoreHeader->Signature, &gEfiAuthenticatedVariableGuid);
>> +    } else {
>> +      CopyGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid);
>> +    }
>>      VariableStoreHeader->Size = PcdGet32(PcdFlashNvStorageVariableSize) - FirmwareVolumeHeader->HeaderLength;
>>      VariableStoreHeader->Format            = VARIABLE_STORE_FORMATTED;
>>      VariableStoreHeader->State             = VARIABLE_STORE_HEALTHY;
>> @@ -220,6 +224,7 @@ ValidateFvHeader (
>>      VARIABLE_STORE_HEADER*      VariableStoreHeader;
>>      UINTN                       VariableStoreLength;
>>      UINTN                       FvLength;
>> +    EFI_GUID                    *Guid;
>>
>>      FwVolHeader = (EFI_FIRMWARE_VOLUME_HEADER*)Instance->RegionBaseAddress;
>>
>> @@ -258,7 +263,12 @@ ValidateFvHeader (
>>      VariableStoreHeader = (VARIABLE_STORE_HEADER*)((UINTN)FwVolHeader + (UINTN)FwVolHeader->HeaderLength);
>>
>>      // Check the Variable Store Guid
>> -    if ( CompareGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid) == FALSE )
>> +    if (PcdGetBool (PcdIsSecureBoot)) {
>> +      Guid = &gEfiAuthenticatedVariableGuid;
>> +    } else {
>> +      Guid = &gEfiVariableGuid;
>> +    }
>> +    if (CompareGuid (&VariableStoreHeader->Signature, Guid) == FALSE)
>>      {
>>          DEBUG ((EFI_D_ERROR, "ValidateFvHeader: Variable Store Guid non-compatible\n"));
>>          return EFI_NOT_FOUND;
>> --
>> 2.9.5
>>


  reply	other threads:[~2018-11-20  6:44 UTC|newest]

Thread overview: 30+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-11-16  6:56 [PATCH edk2-platforms v2 00/15] Fix D06 SBSA/SBBR issue and improve Ming Huang
2018-11-16  6:56 ` [PATCH edk2-platforms v2 01/15] Hisilicon/D0x: Modify IORT Ming Huang
2018-11-16  6:56 ` [PATCH edk2-platforms v2 02/15] Silicon/Hisilicon/D06: Add watchdog to GTDT Ming Huang
2018-11-16  6:56 ` [PATCH edk2-platforms v2 03/15] Silicon/Hisilicon/D06: Drop _CID for fwts issue Ming Huang
2018-11-16  6:56 ` [PATCH edk2-platforms v2 04/15] Silicon/Hisilicon/D06: Fix fwts issue in Dbg2 Ming Huang
2018-11-16  6:56 ` [PATCH edk2-platforms v2 05/15] Silicon/Hisilicon/D06: Fix fwts issue in FADT Ming Huang
2018-11-16  6:56 ` [PATCH edk2-platforms v2 06/15] Hisilicon/D06: Move some functions to OemMiscLib Ming Huang
2018-11-19 18:30   ` Leif Lindholm
2018-11-20  6:38     ` Ming Huang
2018-11-20 10:38       ` Leif Lindholm
2018-11-16  6:56 ` [PATCH edk2-platforms v2 07/15] Hisilicon/D0x: Fix secure boot bug in FlashFvbDxe Ming Huang
2018-11-19 18:13   ` Leif Lindholm
2018-11-20  6:42     ` Ming Huang
2018-11-19 18:19   ` Ard Biesheuvel
2018-11-20  6:44     ` Ming Huang [this message]
2018-11-16  6:56 ` [PATCH edk2-platforms v2 08/15] Silicon/Hisilicon/D06: Reserve ECAM resource in DSDT Ming Huang
2018-11-16  6:56 ` [PATCH edk2-platforms v2 09/15] Silicon/Hisilicon/D06: Modify GTDT timer flag Ming Huang
2018-11-16  6:56 ` [PATCH edk2-platforms v2 10/15] Hisilicon/D06: Modify Gic base Ming Huang
2018-11-19 18:20   ` Leif Lindholm
2018-11-20  6:55     ` Ming Huang
2018-11-20 10:40       ` Leif Lindholm
2018-11-16  6:56 ` [PATCH edk2-platforms v2 11/15] Silicon/Hisilicon/D06: Set TA as Node 0 for TA boot Ming Huang
2018-11-16  6:56 ` [PATCH edk2-platforms v2 12/15] Silicon/Hisilicon/D03: Drop _CID for fwts issue Ming Huang
2018-11-16  6:57 ` [PATCH edk2-platforms v2 13/15] Silicon/Hisilicon/D05: " Ming Huang
2018-11-16  6:57 ` [PATCH edk2-platforms v2 14/15] Hisilicon: Drop Pv660 source code Ming Huang
2018-11-16  6:57 ` [PATCH edk2-platforms v2 15/15] Hisilicon/D06: Correct HIDs/UIDs of PCI host bridges Ming Huang
2018-11-19 18:42 ` [PATCH edk2-platforms v2 00/15] Fix D06 SBSA/SBBR issue and improve Leif Lindholm
2018-11-20  7:02   ` Ming Huang
2018-11-20 10:32     ` Leif Lindholm
2018-11-20 12:42       ` Ming Huang

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-list from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=b3fe9e0d-294e-60bc-bff4-e0a64466f08d@linaro.org \
    --to=devel@edk2.groups.io \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox