From patchwork Mon Oct 29 03:32:44 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ming Huang X-Patchwork-Id: 149622 Delivered-To: patch@linaro.org Received: by 2002:a2e:299d:0:0:0:0:0 with SMTP id p29-v6csp3598163ljp; Sun, 28 Oct 2018 20:33:26 -0700 (PDT) X-Google-Smtp-Source: AJdET5fSskveAa0i9YLEuENFojRKGhiNWTxQejQhgvY9XvPg/aPNbNRQ37Psqfv66o4QEniDf7lx X-Received: by 2002:ac8:474e:: with SMTP id k14mr2057131qtp.117.1540784006637; Sun, 28 Oct 2018 20:33:26 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1540784006; cv=none; d=google.com; s=arc-20160816; b=kPH/otPnp156Mdzx1RTukocRgGRp8We5Cc7B5OPXswwTRRfUVTvjnkUaW9MKyq0RZo 87wNuSHF+YfFWupn3xHVhvX9r5rfnNEnxKi60iDW2SOzx22Io4BR+91Siy6W3ASabg/X /Do6U4YfxMq1CHoLS9eGjSbHfLyu949UBCaI3VOmlKR/1uQt2hxAGrDCo6bCbTYTTBMp 0grOmyCs8vIXDZg7w3hJGXbqhKzO0X+6pN7YUytjkFkPHQCu+ws/D9CGUZ3OR6wHXZ8Z CF7l+YU5s/Ur0ECegPt6toCsD+YweW2BVOF95oalzb7fDNbVl50tUMT9khubctKQnRIH RHww== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:mime-version:cc :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:references:in-reply-to:message-id:date :to:from:dkim-signature:delivered-to; bh=Ne9CM7PlDy06QUmaYv01n6+rMPziV9mHEllMBskoF0Q=; b=KIAO+HkamuERaIgTW2d0ZaZVr663mnSTNSsuQgq1gRSscYKntgm5vI2B2XWh6Hr30G +PYY1+70Nk7qLF0ZwNomRLs3Da1biUt3MjoSbdYbXq1ZXQQWW3dcK6ZNvKT5CLHh6eSz 1/4B401sLx3j9Fh2mvGodffmUygYCJwvSIN2518pC9m7oGSbIA9Jm/lpSZZM8ETHDPGI sbpzH+oChFccl3Fw3tu9NzgVEXalfnBhmhGH5RqKaadx4fPY3gccL7myVezj4qwRkYal HyVjy9XnenduCSMyCC+myyXjJzA11oINNA90auwjaTAe1b0QUshM8aYL7qyawCyeIpND QWFw== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@linaro.org header.s=google header.b=KtQBvHtW; spf=pass (google.com: best guess record for domain of edk2-devel-bounces@lists.01.org designates 198.145.21.10 as permitted sender) smtp.mailfrom=edk2-devel-bounces@lists.01.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from ml01.01.org (ml01.01.org. [198.145.21.10]) by mx.google.com with ESMTPS id k63si1553148qkk.82.2018.10.28.20.33.26 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sun, 28 Oct 2018 20:33:26 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of edk2-devel-bounces@lists.01.org designates 198.145.21.10 as permitted sender) client-ip=198.145.21.10; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@linaro.org header.s=google header.b=KtQBvHtW; spf=pass (google.com: best guess record for domain of edk2-devel-bounces@lists.01.org designates 198.145.21.10 as permitted sender) smtp.mailfrom=edk2-devel-bounces@lists.01.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: from [127.0.0.1] (localhost [IPv6:::1]) by ml01.01.org (Postfix) with ESMTP id D246121184ACE; Sun, 28 Oct 2018 20:33:22 -0700 (PDT) X-Original-To: edk2-devel@lists.01.org Delivered-To: edk2-devel@lists.01.org Received-SPF: Pass (sender SPF authorized) identity=mailfrom; client-ip=2607:f8b0:4864:20::444; helo=mail-pf1-x444.google.com; envelope-from=ming.huang@linaro.org; receiver=edk2-devel@lists.01.org Received: from mail-pf1-x444.google.com (mail-pf1-x444.google.com [IPv6:2607:f8b0:4864:20::444]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ml01.01.org (Postfix) with ESMTPS id 9168F21184ABA for ; Sun, 28 Oct 2018 20:33:21 -0700 (PDT) Received: by mail-pf1-x444.google.com with SMTP id b11-v6so3299585pfi.5 for ; Sun, 28 Oct 2018 20:33:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=nUMtG2nFzRNzku5cr6RzOih/+ZsRA/8b9rCBBkL/WTE=; b=KtQBvHtW86Em9QqFGTps4PQ+RFm50WP06jO9rGPEUEuEhrfWBzUvj+ESR7pkpU/GJb 507qv7sqF2s/OD7022kpshD9ES9a9LclCn0RnrTLH7K830Kmn9xOzzW34PtsjJG0NPPh bt6fKPVIHMhvSSv8SfPPtctYAfiDlP9x8QlqQ= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=nUMtG2nFzRNzku5cr6RzOih/+ZsRA/8b9rCBBkL/WTE=; b=a0oXZY4x4UAmQLWn1sCUiHlqz6Un8hw/foECMcD+tWcjbBNtkE53PxwJAsAeyXU3RP 3l93qQTCv3f6UTIEAwbGyjSJS3DO7wbzjFis8eMKE+ZhPTJKWVqCLoPxJwelTzLiFMF9 pcPx6Xqdwht9HEew9ceUQoB/MjP8PDDLbPewjy9esdxUueqbar5AEpHaGdu9uc7EDt38 suRMRnMaGurbXDbql1BKkEsB4V/Wm+HB6Lc1CGXPvPzFhamyzgT07BRn6f6JGvMCjI27 /ync6UbQ0pQfLj1g6iPGi+bMSNRlWejyzYFmi5ZFg4LOwzc7glC5S3KmO9PMyf7E/+mX lVRA== X-Gm-Message-State: AGRZ1gJYAp4wPnyyzKlhdzE0MZ5K9oEZYja7tjS/YCO7EzFkaUXvj1eb Q435KAyB1ZP+mqDVwQ+dReD4YA== X-Received: by 2002:a62:670f:: with SMTP id b15-v6mr13393269pfc.243.1540784001173; Sun, 28 Oct 2018 20:33:21 -0700 (PDT) Received: from localhost.localdomain ([120.31.149.194]) by smtp.gmail.com with ESMTPSA id j5-v6sm22318872pgm.79.2018.10.28.20.33.17 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sun, 28 Oct 2018 20:33:20 -0700 (PDT) From: Ming Huang To: leif.lindholm@linaro.org, linaro-uefi@lists.linaro.org, edk2-devel@lists.01.org, graeme.gregory@linaro.org Date: Mon, 29 Oct 2018 11:32:44 +0800 Message-Id: <20181029033249.45363-8-ming.huang@linaro.org> X-Mailer: git-send-email 2.18.0 In-Reply-To: <20181029033249.45363-1-ming.huang@linaro.org> References: <20181029033249.45363-1-ming.huang@linaro.org> Subject: [edk2] [PATCH edk2-platforms v1 07/12] Hisilicon/D0x: Fix secure boot bug in FlashFvbDxe X-BeenThere: edk2-devel@lists.01.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: EDK II Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: huangming23@huawei.com, xinliang.liu@linaro.org, john.garry@huawei.com, zhangjinsong2@huawei.com, huangdaode@hisilicon.com, zhangfeng56@huawei.com, michael.d.kinney@intel.com, lersek@redhat.com, wanghuiqiang@huawei.com MIME-Version: 1.0 Errors-To: edk2-devel-bounces@lists.01.org Sender: "edk2-devel" When SECURE_BOOT_ENABLE is TRUE, FlashFvbDxe should use gEfiAuthenticatedVariableGuid, When SECURE_BOOT_ENABLE is FALSE, gEfiVariableGuid should be used. Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Ming Huang --- Silicon/Hisilicon/HisiPkg.dec | 1 + Platform/Hisilicon/D03/D03.dsc | 5 +++++ Platform/Hisilicon/D05/D05.dsc | 5 +++++ Platform/Hisilicon/D06/D06.dsc | 5 +++++ Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf | 2 ++ Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c | 14 ++++++++++++-- 6 files changed, 30 insertions(+), 2 deletions(-) -- 2.18.0 _______________________________________________ edk2-devel mailing list edk2-devel@lists.01.org https://lists.01.org/mailman/listinfo/edk2-devel diff --git a/Silicon/Hisilicon/HisiPkg.dec b/Silicon/Hisilicon/HisiPkg.dec index 404a3ae4af..8c197fa3c1 100644 --- a/Silicon/Hisilicon/HisiPkg.dec +++ b/Silicon/Hisilicon/HisiPkg.dec @@ -278,6 +278,7 @@ gHisiTokenSpaceGuid.Pcdsoctype|0|UINT32|0x00000061 gHisiTokenSpaceGuid.PcdSerDesFlowCtrlFlag|0|UINT32|0x40000056 + gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE|BOOLEAN|0x50000013 [PcdsFeatureFlag] gHisiTokenSpaceGuid.PcdIsItsSupported|FALSE|BOOLEAN|0x00000065 diff --git a/Platform/Hisilicon/D03/D03.dsc b/Platform/Hisilicon/D03/D03.dsc index aa1da5d61f..ba3096672d 100644 --- a/Platform/Hisilicon/D03/D03.dsc +++ b/Platform/Hisilicon/D03/D03.dsc @@ -281,6 +281,11 @@ gHisiTokenSpaceGuid.PcdHb0Rb2IoSize|0xffff #64K gHisiTokenSpaceGuid.Pcdsoctype|0x1610 + !if $(SECURE_BOOT_ENABLE) == TRUE + gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE + !else + gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE + !endif ################################################################################ # diff --git a/Platform/Hisilicon/D05/D05.dsc b/Platform/Hisilicon/D05/D05.dsc index 1040466633..b8500cef87 100644 --- a/Platform/Hisilicon/D05/D05.dsc +++ b/Platform/Hisilicon/D05/D05.dsc @@ -422,6 +422,11 @@ gHisiTokenSpaceGuid.PcdHb1Rb7IoSize|0x10000 #64K gHisiTokenSpaceGuid.Pcdsoctype|0x1610 + !if $(SECURE_BOOT_ENABLE) == TRUE + gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE + !else + gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE + !endif ################################################################################ # diff --git a/Platform/Hisilicon/D06/D06.dsc b/Platform/Hisilicon/D06/D06.dsc index 1a479c160e..b6ef9fedf0 100644 --- a/Platform/Hisilicon/D06/D06.dsc +++ b/Platform/Hisilicon/D06/D06.dsc @@ -243,6 +243,11 @@ gEfiMdeModulePkgTokenSpaceGuid.PcdSrIovSupport|FALSE gArmTokenSpaceGuid.PcdPciIoTranslation|0x0 + !if $(SECURE_BOOT_ENABLE) == TRUE + gHisiTokenSpaceGuid.PcdIsSecureBoot|TRUE + !else + gHisiTokenSpaceGuid.PcdIsSecureBoot|FALSE + !endif ################################################################################ # diff --git a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf index f8be4741ef..934c86c79b 100644 --- a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf +++ b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.inf @@ -46,6 +46,7 @@ [Guids] gEfiSystemNvDataFvGuid gEfiVariableGuid + gEfiAuthenticatedVariableGuid [Protocols] gEfiBlockIoProtocolGuid @@ -62,6 +63,7 @@ gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageFtwSpareSize gArmPlatformTokenSpaceGuid.PcdNorFlashCheckBlockLocked + gHisiTokenSpaceGuid.PcdIsSecureBoot gHisiTokenSpaceGuid.PcdSFCMEM0BaseAddress [Depex] diff --git a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c index e18cc9e06e..309941d6fe 100644 --- a/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c +++ b/Silicon/Hisilicon/Drivers/FlashFvbDxe/FlashFvbDxe.c @@ -189,7 +189,11 @@ InitializeFvAndVariableStoreHeaders ( // VARIABLE_STORE_HEADER // VariableStoreHeader = (VARIABLE_STORE_HEADER*)((UINTN)Headers + (UINTN)FirmwareVolumeHeader->HeaderLength); - CopyGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid); + if (PcdGetBool (PcdIsSecureBoot)) { + CopyGuid (&VariableStoreHeader->Signature, &gEfiAuthenticatedVariableGuid); + } else { + CopyGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid); + } VariableStoreHeader->Size = PcdGet32(PcdFlashNvStorageVariableSize) - FirmwareVolumeHeader->HeaderLength; VariableStoreHeader->Format = VARIABLE_STORE_FORMATTED; VariableStoreHeader->State = VARIABLE_STORE_HEALTHY; @@ -220,6 +224,7 @@ ValidateFvHeader ( VARIABLE_STORE_HEADER* VariableStoreHeader; UINTN VariableStoreLength; UINTN FvLength; + EFI_GUID *Guid; FwVolHeader = (EFI_FIRMWARE_VOLUME_HEADER*)Instance->RegionBaseAddress; @@ -258,7 +263,12 @@ ValidateFvHeader ( VariableStoreHeader = (VARIABLE_STORE_HEADER*)((UINTN)FwVolHeader + (UINTN)FwVolHeader->HeaderLength); // Check the Variable Store Guid - if ( CompareGuid (&VariableStoreHeader->Signature, &gEfiVariableGuid) == FALSE ) + if (PcdGetBool (PcdIsSecureBoot)) { + Guid = &gEfiAuthenticatedVariableGuid; + } else { + Guid = &gEfiVariableGuid; + } + if (CompareGuid (&VariableStoreHeader->Signature, Guid) == FALSE) { DEBUG ((EFI_D_ERROR, "ValidateFvHeader: Variable Store Guid non-compatible\n")); return EFI_NOT_FOUND;