On Fri, Mar 15, 2019 at 5:51 PM Ard Biesheuvel
<ard.biesheu...@linaro.org> wrote:
>
> On Tue, 12 Mar 2019 at 17:06, Jagadeesh Ujja <jagadeesh.u...@arm.com> wrote:
> >
> > This implements support for UEFI secure boot on SGI platforms using
> > the standalone MM framework. This moves all of the software handling
> > of the UEFI authenticated variable store into the standalone MM
> > context residing in a secure partition.
> >
> > Contributed-under: TianoCore Contribution Agreement 1.1
> > Signed-off-by: Jagadeesh Ujja <jagadeesh.u...@arm.com>
> > ---
> > Platform/ARM/SgiPkg/PlatformStandaloneMm.dsc | 34 +++++++++++++++++++-
> > Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf | 5 +++
> > Platform/ARM/SgiPkg/SgiPlatform.dsc | 18 ++++++++++-
> > Platform/ARM/SgiPkg/SgiPlatform.fdf | 7 +++-
> > 4 files changed, 61 insertions(+), 3 deletions(-)
> >
> > diff --git a/Platform/ARM/SgiPkg/PlatformStandaloneMm.dsc
> > b/Platform/ARM/SgiPkg/PlatformStandaloneMm.dsc
> > index 49fc919..b6aa90b 100644
> > --- a/Platform/ARM/SgiPkg/PlatformStandaloneMm.dsc
> > +++ b/Platform/ARM/SgiPkg/PlatformStandaloneMm.dsc
> > @@ -26,6 +26,7 @@
> > SKUID_IDENTIFIER = DEFAULT
> > FLASH_DEFINITION =
> > Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf
> > DEFINE DEBUG_MESSAGE = TRUE
> > + DEFINE SECURE_BOOT_ENABLE = FALSE
> >
>
> Maybe I wasn't clear before, but I don't see the point of building the
> MM component without secure boot enabled. So can we drop this from
> this side?
Hi Ard,
On the SGI platforms, the MM component is used for platform RAS error
handling as well and secure boot is not mandatory in such a build. So
the build of MM component is being kept independent of secure boot.
Thanks,
Thomas.
>
> For the non-secure side, it is a different matter, obviously.
>
> > # LzmaF86
> > DEFINE COMPRESSION_TOOL_GUID = D42AE6BD-1352-4bfb-909A-CA72A6EAE889
> > @@ -83,7 +84,17 @@
> > HobLib|StandaloneMmPkg/Library/StandaloneMmHobLib/StandaloneMmHobLib.inf
> >
> > MmServicesTableLib|MdePkg/Library/StandaloneMmServicesTableLib/StandaloneMmServicesTableLib.inf
> >
> > MemoryAllocationLib|StandaloneMmPkg/Library/StandaloneMmMemoryAllocationLib/StandaloneMmMemoryAllocationLib.inf
> > -
> > +!if $(SECURE_BOOT_ENABLE) == TRUE
> > + AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
> > + BaseCryptLib|CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf
> > + IntrinsicLib|CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf
> > +
> > NorFlashPlatformLib|Platform/ARM/SgiPkg/Library/NorFlashLib/StandaloneMmNorFlashLib.inf
> > + OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf
> > +
> > PlatformSecureLib|SecurityPkg/Library/PlatformSecureLibNull/PlatformSecureLibNull.inf
> > +
> > SynchronizationLib|MdePkg/Library/BaseSynchronizationLib/BaseSynchronizationLib.inf
> > +
> > TimerLib|MdePkg/Library/BaseTimerLibNullTemplate/BaseTimerLibNullTemplate.inf
> > + VarCheckLib|MdeModulePkg/Library/VarCheckLib/VarCheckLib.inf
> > +!endif
> >
> > ################################################################################
> > #
> > # Pcd Section - list of all EDK II PCD Entries defined by this Platform
> > @@ -100,6 +111,21 @@
> >
> > gEfiMdePkgTokenSpaceGuid.PcdMaximumGuidedExtractHandler|0x2
> >
> > +!if $(SECURE_BOOT_ENABLE) == TRUE
> > + #Secure Storage
> > + gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x2000
> > + gEfiSecurityPkgTokenSpaceGuid.PcdUserPhysicalPresence|TRUE
> > + gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x2800
> > +
> > + ## NV Storage - 1MB*3 in NOR2 Flash
> > + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase|0x10400000
> > + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableSize|0x00100000
> > + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase|0x10500000
> > + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingSize|0x00100000
> > + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase|0x10600000
> > + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareSize|0x00100000
> > +!endif
> > +
> >
> > ###################################################################################################
> > #
> > # Components Section - list of the modules and components that will be
> > processed by compilation
> > @@ -125,6 +151,12 @@
> > StandaloneMmPkg/Core/StandaloneMmCore.inf
> >
> > [Components.AARCH64]
> > +!if $(SECURE_BOOT_ENABLE) == TRUE
> > + ArmPlatformPkg/Drivers/NorFlashDxe/NorFlashStandaloneMm.inf
> > +
> > MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteStandaloneMm.inf
> > + MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf
> > +!endif
> > +
> > StandaloneMmPkg/Drivers/StandaloneMmCpu/AArch64/StandaloneMmCpu.inf
> >
> >
> > ###################################################################################################
> > diff --git a/Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf
> > b/Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf
> > index 810460c..8c05a03 100644
> > --- a/Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf
> > +++ b/Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf
> > @@ -55,6 +55,11 @@ READ_LOCK_CAP = TRUE
> > READ_LOCK_STATUS = TRUE
> >
> > INF StandaloneMmPkg/Core/StandaloneMmCore.inf
> > +!if $(SECURE_BOOT_ENABLE) == TRUE
> > + INF ArmPlatformPkg/Drivers/NorFlashDxe/NorFlashStandaloneMm.inf
> > + INF
> > MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteStandaloneMm.inf
> > + INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf
> > +!endif
> > INF StandaloneMmPkg/Drivers/StandaloneMmCpu/AArch64/StandaloneMmCpu.inf
> >
> >
> > ################################################################################
> > diff --git a/Platform/ARM/SgiPkg/SgiPlatform.dsc
> > b/Platform/ARM/SgiPkg/SgiPlatform.dsc
> > index bdb4ecb..4ddeb65 100644
> > --- a/Platform/ARM/SgiPkg/SgiPlatform.dsc
> > +++ b/Platform/ARM/SgiPkg/SgiPlatform.dsc
> > @@ -26,6 +26,7 @@
> > SKUID_IDENTIFIER = DEFAULT
> > FLASH_DEFINITION = Platform/ARM/SgiPkg/SgiPlatform.fdf
> > BUILD_NUMBER = 1
> > + DEFINE SECURE_BOOT_ENABLE = FALSE
> >
> > !include Platform/ARM/VExpressPkg/ArmVExpress.dsc.inc
> >
> > @@ -260,7 +261,15 @@
> > MdeModulePkg/Core/RuntimeDxe/RuntimeDxe.inf
> > MdeModulePkg/Universal/CapsuleRuntimeDxe/CapsuleRuntimeDxe.inf
> >
> > MdeModulePkg/Universal/MonotonicCounterRuntimeDxe/MonotonicCounterRuntimeDxe.inf
> > +!if $(SECURE_BOOT_ENABLE) == TRUE
> > + MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf {
> > + <LibraryClasses>
> > +
> > NULL|SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf
> > + }
> > +
> > SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
> > +!else
> > MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf
> > +!endif
> > OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
> >
> > MdeModulePkg/Universal/Console/ConPlatformDxe/ConPlatformDxe.inf
> > @@ -268,6 +277,9 @@
> > MdeModulePkg/Universal/Console/GraphicsConsoleDxe/GraphicsConsoleDxe.inf
> > MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf
> > MdeModulePkg/Universal/SerialDxe/SerialDxe.inf
> > +!if $(SECURE_BOOT_ENABLE) == TRUE
> > + MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf
> > +!else
> > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf {
> > <LibraryClasses>
> > NULL|MdeModulePkg/Library/VarCheckUefiLib/VarCheckUefiLib.inf
> > @@ -275,6 +287,7 @@
> > BaseMemoryLib|MdePkg/Library/BaseMemoryLib/BaseMemoryLib.inf
> > }
> > MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf
> > +!endif
> >
> > #
> > # ACPI Support
> > @@ -344,4 +357,7 @@
> > #
> > MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
> >
> > - ArmPkg/Drivers/MmCommunicationDxe/MmCommunication.inf
> > + ArmPkg/Drivers/MmCommunicationDxe/MmCommunication.inf {
> > + <LibraryClasses>
> > +
> > NULL|StandaloneMmPkg/Library/VariableMmDependency/VariableMmDependency.inf
> > + }
> > diff --git a/Platform/ARM/SgiPkg/SgiPlatform.fdf
> > b/Platform/ARM/SgiPkg/SgiPlatform.fdf
> > index 7916a52..aff0be5 100644
> > --- a/Platform/ARM/SgiPkg/SgiPlatform.fdf
> > +++ b/Platform/ARM/SgiPkg/SgiPlatform.fdf
> > @@ -96,10 +96,15 @@ READ_LOCK_STATUS = TRUE
> > INF EmbeddedPkg/ResetRuntimeDxe/ResetRuntimeDxe.inf
> > INF MdeModulePkg/Core/RuntimeDxe/RuntimeDxe.inf
> > INF MdeModulePkg/Universal/CapsuleRuntimeDxe/CapsuleRuntimeDxe.inf
> > - INF
> > MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf
> > INF
> > MdeModulePkg/Universal/MonotonicCounterRuntimeDxe/MonotonicCounterRuntimeDxe.inf
> > INF MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf
> > +!if $(SECURE_BOOT_ENABLE) == TRUE
> > + INF
> > SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
> > + INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf
> > +!else
> > + INF
> > MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf
> > INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
> > +!endif
> >
> > #
> > # ACPI Support
> > --
> > 2.7.4
> >
> _______________________________________________
> edk2-devel mailing list
> edk2-devel@lists.01.org
> https://lists.01.org/mailman/listinfo/edk2-devel
_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
