On Fri, 15 Mar 2019 at 13:30, Thomas Abraham <thomas.abra...@arm.com> wrote:
>
> On Fri, Mar 15, 2019 at 5:51 PM Ard Biesheuvel
> <ard.biesheu...@linaro.org> wrote:
> >
> > On Tue, 12 Mar 2019 at 17:06, Jagadeesh Ujja <jagadeesh.u...@arm.com> wrote:
> > >
> > > This implements support for UEFI secure boot on SGI platforms using
> > > the standalone MM framework. This moves all of the software handling
> > > of the UEFI authenticated variable store into the standalone MM
> > > context residing in a secure partition.
> > >
> > > Contributed-under: TianoCore Contribution Agreement 1.1
> > > Signed-off-by: Jagadeesh Ujja <jagadeesh.u...@arm.com>
> > > ---
> > > Platform/ARM/SgiPkg/PlatformStandaloneMm.dsc | 34 +++++++++++++++++++-
> > > Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf | 5 +++
> > > Platform/ARM/SgiPkg/SgiPlatform.dsc | 18 ++++++++++-
> > > Platform/ARM/SgiPkg/SgiPlatform.fdf | 7 +++-
> > > 4 files changed, 61 insertions(+), 3 deletions(-)
> > >
> > > diff --git a/Platform/ARM/SgiPkg/PlatformStandaloneMm.dsc
> > > b/Platform/ARM/SgiPkg/PlatformStandaloneMm.dsc
> > > index 49fc919..b6aa90b 100644
> > > --- a/Platform/ARM/SgiPkg/PlatformStandaloneMm.dsc
> > > +++ b/Platform/ARM/SgiPkg/PlatformStandaloneMm.dsc
> > > @@ -26,6 +26,7 @@
> > > SKUID_IDENTIFIER = DEFAULT
> > > FLASH_DEFINITION =
> > > Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf
> > > DEFINE DEBUG_MESSAGE = TRUE
> > > + DEFINE SECURE_BOOT_ENABLE = FALSE
> > >
> >
> > Maybe I wasn't clear before, but I don't see the point of building the
> > MM component without secure boot enabled. So can we drop this from
> > this side?
>
> Hi Ard,
>
> On the SGI platforms, the MM component is used for platform RAS error
> handling as well and secure boot is not mandatory in such a build. So
> the build of MM component is being kept independent of secure boot.
>
Hi Thomas,
When building the MM side of the platform without secure boot, the
only MM modules that are included are
> > > INF StandaloneMmPkg/Core/StandaloneMmCore.inf
> > > INF StandaloneMmPkg/Drivers/StandaloneMmCpu/AArch64/StandaloneMmCpu.inf
neither of which implement RAS handling. So are you saying this is
functionality that runs in MM context, but it has not been upstreamed
yet?
>
> >
> > For the non-secure side, it is a different matter, obviously.
> >
> > > # LzmaF86
> > > DEFINE COMPRESSION_TOOL_GUID = D42AE6BD-1352-4bfb-909A-CA72A6EAE889
> > > @@ -83,7 +84,17 @@
> > >
> > > HobLib|StandaloneMmPkg/Library/StandaloneMmHobLib/StandaloneMmHobLib.inf
> > >
> > > MmServicesTableLib|MdePkg/Library/StandaloneMmServicesTableLib/StandaloneMmServicesTableLib.inf
> > >
> > > MemoryAllocationLib|StandaloneMmPkg/Library/StandaloneMmMemoryAllocationLib/StandaloneMmMemoryAllocationLib.inf
> > > -
> > > +!if $(SECURE_BOOT_ENABLE) == TRUE
> > > + AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
> > > + BaseCryptLib|CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf
> > > + IntrinsicLib|CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf
> > > +
> > > NorFlashPlatformLib|Platform/ARM/SgiPkg/Library/NorFlashLib/StandaloneMmNorFlashLib.inf
> > > + OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLib.inf
> > > +
> > > PlatformSecureLib|SecurityPkg/Library/PlatformSecureLibNull/PlatformSecureLibNull.inf
> > > +
> > > SynchronizationLib|MdePkg/Library/BaseSynchronizationLib/BaseSynchronizationLib.inf
> > > +
> > > TimerLib|MdePkg/Library/BaseTimerLibNullTemplate/BaseTimerLibNullTemplate.inf
> > > + VarCheckLib|MdeModulePkg/Library/VarCheckLib/VarCheckLib.inf
> > > +!endif
> > >
> > > ################################################################################
> > > #
> > > # Pcd Section - list of all EDK II PCD Entries defined by this Platform
> > > @@ -100,6 +111,21 @@
> > >
> > > gEfiMdePkgTokenSpaceGuid.PcdMaximumGuidedExtractHandler|0x2
> > >
> > > +!if $(SECURE_BOOT_ENABLE) == TRUE
> > > + #Secure Storage
> > > + gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x2000
> > > + gEfiSecurityPkgTokenSpaceGuid.PcdUserPhysicalPresence|TRUE
> > > + gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x2800
> > > +
> > > + ## NV Storage - 1MB*3 in NOR2 Flash
> > > + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableBase|0x10400000
> > > + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableSize|0x00100000
> > > +
> > > gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingBase|0x10500000
> > > +
> > > gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwWorkingSize|0x00100000
> > > + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareBase|0x10600000
> > > + gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareSize|0x00100000
> > > +!endif
> > > +
> > >
> > > ###################################################################################################
> > > #
> > > # Components Section - list of the modules and components that will be
> > > processed by compilation
> > > @@ -125,6 +151,12 @@
> > > StandaloneMmPkg/Core/StandaloneMmCore.inf
> > >
> > > [Components.AARCH64]
> > > +!if $(SECURE_BOOT_ENABLE) == TRUE
> > > + ArmPlatformPkg/Drivers/NorFlashDxe/NorFlashStandaloneMm.inf
> > > +
> > > MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteStandaloneMm.inf
> > > + MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf
> > > +!endif
> > > +
> > > StandaloneMmPkg/Drivers/StandaloneMmCpu/AArch64/StandaloneMmCpu.inf
> > >
> > >
> > > ###################################################################################################
> > > diff --git a/Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf
> > > b/Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf
> > > index 810460c..8c05a03 100644
> > > --- a/Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf
> > > +++ b/Platform/ARM/SgiPkg/PlatformStandaloneMm.fdf
> > > @@ -55,6 +55,11 @@ READ_LOCK_CAP = TRUE
> > > READ_LOCK_STATUS = TRUE
> > >
> > > INF StandaloneMmPkg/Core/StandaloneMmCore.inf
> > > +!if $(SECURE_BOOT_ENABLE) == TRUE
> > > + INF ArmPlatformPkg/Drivers/NorFlashDxe/NorFlashStandaloneMm.inf
> > > + INF
> > > MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteStandaloneMm.inf
> > > + INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf
> > > +!endif
> > > INF StandaloneMmPkg/Drivers/StandaloneMmCpu/AArch64/StandaloneMmCpu.inf
> > >
> > >
> > > ################################################################################
> > > diff --git a/Platform/ARM/SgiPkg/SgiPlatform.dsc
> > > b/Platform/ARM/SgiPkg/SgiPlatform.dsc
> > > index bdb4ecb..4ddeb65 100644
> > > --- a/Platform/ARM/SgiPkg/SgiPlatform.dsc
> > > +++ b/Platform/ARM/SgiPkg/SgiPlatform.dsc
> > > @@ -26,6 +26,7 @@
> > > SKUID_IDENTIFIER = DEFAULT
> > > FLASH_DEFINITION = Platform/ARM/SgiPkg/SgiPlatform.fdf
> > > BUILD_NUMBER = 1
> > > + DEFINE SECURE_BOOT_ENABLE = FALSE
> > >
> > > !include Platform/ARM/VExpressPkg/ArmVExpress.dsc.inc
> > >
> > > @@ -260,7 +261,15 @@
> > > MdeModulePkg/Core/RuntimeDxe/RuntimeDxe.inf
> > > MdeModulePkg/Universal/CapsuleRuntimeDxe/CapsuleRuntimeDxe.inf
> > >
> > > MdeModulePkg/Universal/MonotonicCounterRuntimeDxe/MonotonicCounterRuntimeDxe.inf
> > > +!if $(SECURE_BOOT_ENABLE) == TRUE
> > > + MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf {
> > > + <LibraryClasses>
> > > +
> > > NULL|SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf
> > > + }
> > > +
> > > SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
> > > +!else
> > > MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf
> > > +!endif
> > > OvmfPkg/VirtioBlkDxe/VirtioBlk.inf
> > >
> > > MdeModulePkg/Universal/Console/ConPlatformDxe/ConPlatformDxe.inf
> > > @@ -268,6 +277,9 @@
> > >
> > > MdeModulePkg/Universal/Console/GraphicsConsoleDxe/GraphicsConsoleDxe.inf
> > > MdeModulePkg/Universal/Console/TerminalDxe/TerminalDxe.inf
> > > MdeModulePkg/Universal/SerialDxe/SerialDxe.inf
> > > +!if $(SECURE_BOOT_ENABLE) == TRUE
> > > + MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf
> > > +!else
> > > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf {
> > > <LibraryClasses>
> > > NULL|MdeModulePkg/Library/VarCheckUefiLib/VarCheckUefiLib.inf
> > > @@ -275,6 +287,7 @@
> > > BaseMemoryLib|MdePkg/Library/BaseMemoryLib/BaseMemoryLib.inf
> > > }
> > > MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf
> > > +!endif
> > >
> > > #
> > > # ACPI Support
> > > @@ -344,4 +357,7 @@
> > > #
> > > MdeModulePkg/Bus/Pci/SataControllerDxe/SataControllerDxe.inf
> > >
> > > - ArmPkg/Drivers/MmCommunicationDxe/MmCommunication.inf
> > > + ArmPkg/Drivers/MmCommunicationDxe/MmCommunication.inf {
> > > + <LibraryClasses>
> > > +
> > > NULL|StandaloneMmPkg/Library/VariableMmDependency/VariableMmDependency.inf
> > > + }
> > > diff --git a/Platform/ARM/SgiPkg/SgiPlatform.fdf
> > > b/Platform/ARM/SgiPkg/SgiPlatform.fdf
> > > index 7916a52..aff0be5 100644
> > > --- a/Platform/ARM/SgiPkg/SgiPlatform.fdf
> > > +++ b/Platform/ARM/SgiPkg/SgiPlatform.fdf
> > > @@ -96,10 +96,15 @@ READ_LOCK_STATUS = TRUE
> > > INF EmbeddedPkg/ResetRuntimeDxe/ResetRuntimeDxe.inf
> > > INF MdeModulePkg/Core/RuntimeDxe/RuntimeDxe.inf
> > > INF MdeModulePkg/Universal/CapsuleRuntimeDxe/CapsuleRuntimeDxe.inf
> > > - INF
> > > MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf
> > > INF
> > > MdeModulePkg/Universal/MonotonicCounterRuntimeDxe/MonotonicCounterRuntimeDxe.inf
> > > INF MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf
> > > +!if $(SECURE_BOOT_ENABLE) == TRUE
> > > + INF
> > > SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
> > > + INF
> > > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf
> > > +!else
> > > + INF
> > > MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf
> > > INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
> > > +!endif
> > >
> > > #
> > > # ACPI Support
> > > --
> > > 2.7.4
> > >
> > _______________________________________________
> > edk2-devel mailing list
> > edk2-devel@lists.01.org
> > https://lists.01.org/mailman/listinfo/edk2-devel
_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
