[edk2,edk2-platforms,6/7] Platform/DeveloperBox: add .DSC/.FDF description of MM components

Message ID 20190104144336.8941-7-ard.biesheuvel@linaro.org
State New
Headers show
Series
  • Silicon/SynQuacer: implement SMM based secure boot
Related show

Commit Message

Ard Biesheuvel Jan. 4, 2019, 2:43 p.m.
Create a pair of .DSC/.FDF files that describe the components and
the firmware volumes and flash device that will be dispatched into
a secure partition in the secure world to control the UEFI secure
variable store.

Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>

---
 Platform/Socionext/DeveloperBox/DeveloperBox.dsc     |   5 +-
 Platform/Socionext/DeveloperBox/DeveloperBox.dsc.inc |   7 +-
 Platform/Socionext/DeveloperBox/DeveloperBoxMm.dsc   | 103 +++++++++++++
 Platform/Socionext/DeveloperBox/DeveloperBoxMm.fdf   | 161 ++++++++++++++++++++
 4 files changed, 270 insertions(+), 6 deletions(-)

-- 
2.17.1

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel

Comments

Leif Lindholm Jan. 17, 2019, 11:04 a.m. | #1
On Fri, Jan 04, 2019 at 03:43:35PM +0100, Ard Biesheuvel wrote:
> Create a pair of .DSC/.FDF files that describe the components and

> the firmware volumes and flash device that will be dispatched into

> a secure partition in the secure world to control the UEFI secure

> variable store.

> 

> Contributed-under: TianoCore Contribution Agreement 1.1

> Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>

> ---

>  Platform/Socionext/DeveloperBox/DeveloperBox.dsc     |   5 +-

>  Platform/Socionext/DeveloperBox/DeveloperBox.dsc.inc |   7 +-

>  Platform/Socionext/DeveloperBox/DeveloperBoxMm.dsc   | 103 +++++++++++++

>  Platform/Socionext/DeveloperBox/DeveloperBoxMm.fdf   | 161 ++++++++++++++++++++

>  4 files changed, 270 insertions(+), 6 deletions(-)

> 

> diff --git a/Platform/Socionext/DeveloperBox/DeveloperBox.dsc b/Platform/Socionext/DeveloperBox/DeveloperBox.dsc

> index 56787a744157..666bd2716336 100644

> --- a/Platform/Socionext/DeveloperBox/DeveloperBox.dsc

> +++ b/Platform/Socionext/DeveloperBox/DeveloperBox.dsc

> @@ -250,10 +250,7 @@ [Components.common]

>    #

>    # Variable services

>    #

> -  Silicon/Socionext/SynQuacer/Drivers/Fip006Dxe/Fip006Dxe.inf {

> -    <LibraryClasses>

> -      NorFlashPlatformLib|Silicon/Socionext/SynQuacer/Library/NorFlashSynQuacerLib/NorFlashSynQuacerLib.inf

> -  }

> +  Silicon/Socionext/SynQuacer/Drivers/Fip006Dxe/Fip006Dxe.inf

>    MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf

>    MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf {

>      <LibraryClasses>

> diff --git a/Platform/Socionext/DeveloperBox/DeveloperBox.dsc.inc b/Platform/Socionext/DeveloperBox/DeveloperBox.dsc.inc

> index 56adc21d5caf..87b2094cb356 100644

> --- a/Platform/Socionext/DeveloperBox/DeveloperBox.dsc.inc

> +++ b/Platform/Socionext/DeveloperBox/DeveloperBox.dsc.inc

> @@ -125,6 +125,7 @@ [LibraryClasses.common]

>    PlatformSecureLib|SecurityPkg/Library/PlatformSecureLibNull/PlatformSecureLibNull.inf

>  

>    NorFlashInfoLib|EmbeddedPkg/Library/NorFlashInfoLib/NorFlashInfoLib.inf

> +  NorFlashPlatformLib|Silicon/Socionext/SynQuacer/Library/NorFlashSynQuacerLib/NorFlashSynQuacerLib.inf

>  

>  ################################################################################

>  #

> @@ -294,8 +295,10 @@ [PcdsFixedAtBuild.common]

>  !endif

>    gEfiMdeModulePkgTokenSpaceGuid.PcdFirmwareRevision|$(BUILD_NUMBER)

>  

> -  gArmTokenSpaceGuid.PcdMmBufferBase|0xFFC00000

> -  gArmTokenSpaceGuid.PcdMmBufferSize|0x00200000

> +  gEfiSecurityPkgTokenSpaceGuid.PcdUserPhysicalPresence|TRUE


So, I can see why you add this hard-wired for the purpose of testing.
But please, add a *very* conspicuous, and strongly worded, comment
statement preceding it.

> +

> +  gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x2000

> +  gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x2800

>  

>  [PcdsPatchableInModule]

>    gEfiMdeModulePkgTokenSpaceGuid.PcdVideoHorizontalResolution|0

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
Ard Biesheuvel Jan. 17, 2019, 11:10 a.m. | #2
On Thu, 17 Jan 2019 at 12:04, Leif Lindholm <leif.lindholm@linaro.org> wrote:
>

> On Fri, Jan 04, 2019 at 03:43:35PM +0100, Ard Biesheuvel wrote:

> > Create a pair of .DSC/.FDF files that describe the components and

> > the firmware volumes and flash device that will be dispatched into

> > a secure partition in the secure world to control the UEFI secure

> > variable store.

> >

> > Contributed-under: TianoCore Contribution Agreement 1.1

> > Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>

> > ---

> >  Platform/Socionext/DeveloperBox/DeveloperBox.dsc     |   5 +-

> >  Platform/Socionext/DeveloperBox/DeveloperBox.dsc.inc |   7 +-

> >  Platform/Socionext/DeveloperBox/DeveloperBoxMm.dsc   | 103 +++++++++++++

> >  Platform/Socionext/DeveloperBox/DeveloperBoxMm.fdf   | 161 ++++++++++++++++++++

> >  4 files changed, 270 insertions(+), 6 deletions(-)

> >

> > diff --git a/Platform/Socionext/DeveloperBox/DeveloperBox.dsc b/Platform/Socionext/DeveloperBox/DeveloperBox.dsc

> > index 56787a744157..666bd2716336 100644

> > --- a/Platform/Socionext/DeveloperBox/DeveloperBox.dsc

> > +++ b/Platform/Socionext/DeveloperBox/DeveloperBox.dsc

> > @@ -250,10 +250,7 @@ [Components.common]

> >    #

> >    # Variable services

> >    #

> > -  Silicon/Socionext/SynQuacer/Drivers/Fip006Dxe/Fip006Dxe.inf {

> > -    <LibraryClasses>

> > -      NorFlashPlatformLib|Silicon/Socionext/SynQuacer/Library/NorFlashSynQuacerLib/NorFlashSynQuacerLib.inf

> > -  }

> > +  Silicon/Socionext/SynQuacer/Drivers/Fip006Dxe/Fip006Dxe.inf

> >    MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf

> >    MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf {

> >      <LibraryClasses>

> > diff --git a/Platform/Socionext/DeveloperBox/DeveloperBox.dsc.inc b/Platform/Socionext/DeveloperBox/DeveloperBox.dsc.inc

> > index 56adc21d5caf..87b2094cb356 100644

> > --- a/Platform/Socionext/DeveloperBox/DeveloperBox.dsc.inc

> > +++ b/Platform/Socionext/DeveloperBox/DeveloperBox.dsc.inc

> > @@ -125,6 +125,7 @@ [LibraryClasses.common]

> >    PlatformSecureLib|SecurityPkg/Library/PlatformSecureLibNull/PlatformSecureLibNull.inf

> >

> >    NorFlashInfoLib|EmbeddedPkg/Library/NorFlashInfoLib/NorFlashInfoLib.inf

> > +  NorFlashPlatformLib|Silicon/Socionext/SynQuacer/Library/NorFlashSynQuacerLib/NorFlashSynQuacerLib.inf

> >

> >  ################################################################################

> >  #

> > @@ -294,8 +295,10 @@ [PcdsFixedAtBuild.common]

> >  !endif

> >    gEfiMdeModulePkgTokenSpaceGuid.PcdFirmwareRevision|$(BUILD_NUMBER)

> >

> > -  gArmTokenSpaceGuid.PcdMmBufferBase|0xFFC00000

> > -  gArmTokenSpaceGuid.PcdMmBufferSize|0x00200000

> > +  gEfiSecurityPkgTokenSpaceGuid.PcdUserPhysicalPresence|TRUE

>

> So, I can see why you add this hard-wired for the purpose of testing.

> But please, add a *very* conspicuous, and strongly worded, comment

> statement preceding it.

>


Well, I was talking to Peter about this the other day: according to
the spec, this setting should only matter before exit boot services,
and since this platform only supports serial and GOP consoles, one
could argue that only a physically present user could interact with it
before that time.

The obvious way of implementing this non-trivially on this platform is
to use a DIP switch, but that requires you to open the case to
enroll/delete the platform key. Perhaps that does not matter, and it
would in fact produce a less dangerous reference implementation.
_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
Leif Lindholm Jan. 17, 2019, 12:08 p.m. | #3
On Thu, Jan 17, 2019 at 12:10:01PM +0100, Ard Biesheuvel wrote:
> > >  ################################################################################

> > >  #

> > > @@ -294,8 +295,10 @@ [PcdsFixedAtBuild.common]

> > >  !endif

> > >    gEfiMdeModulePkgTokenSpaceGuid.PcdFirmwareRevision|$(BUILD_NUMBER)

> > >

> > > -  gArmTokenSpaceGuid.PcdMmBufferBase|0xFFC00000

> > > -  gArmTokenSpaceGuid.PcdMmBufferSize|0x00200000

> > > +  gEfiSecurityPkgTokenSpaceGuid.PcdUserPhysicalPresence|TRUE

> >

> > So, I can see why you add this hard-wired for the purpose of testing.

> > But please, add a *very* conspicuous, and strongly worded, comment

> > statement preceding it.

> 

> Well, I was talking to Peter about this the other day: according to

> the spec, this setting should only matter before exit boot services,

> and since this platform only supports serial and GOP consoles, one

> could argue that only a physically present user could interact with it

> before that time.


But that also makes the Pcd pointless.

> The obvious way of implementing this non-trivially on this platform is

> to use a DIP switch, but that requires you to open the case to

> enroll/delete the platform key. Perhaps that does not matter, and it

> would in fact produce a less dangerous reference implementation.


I would be totally OK with that.
I would also be totally OK with a DynamicPcd settable through the UI
(which is what most machines I come across have).

But I would also be cool with a sufficiently evil "here be dragons"
statement, pointing out that we don't care that much
*on*this*specific*system* because the NOR isn't actually hw protected
anyway, and this implementation is all about exercising the software
stack..

/
    Leif
_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
Ard Biesheuvel Jan. 17, 2019, 12:18 p.m. | #4
On Thu, 17 Jan 2019 at 13:08, Leif Lindholm <leif.lindholm@linaro.org> wrote:
>

> On Thu, Jan 17, 2019 at 12:10:01PM +0100, Ard Biesheuvel wrote:

> > > >  ################################################################################

> > > >  #

> > > > @@ -294,8 +295,10 @@ [PcdsFixedAtBuild.common]

> > > >  !endif

> > > >    gEfiMdeModulePkgTokenSpaceGuid.PcdFirmwareRevision|$(BUILD_NUMBER)

> > > >

> > > > -  gArmTokenSpaceGuid.PcdMmBufferBase|0xFFC00000

> > > > -  gArmTokenSpaceGuid.PcdMmBufferSize|0x00200000

> > > > +  gEfiSecurityPkgTokenSpaceGuid.PcdUserPhysicalPresence|TRUE

> > >

> > > So, I can see why you add this hard-wired for the purpose of testing.

> > > But please, add a *very* conspicuous, and strongly worded, comment

> > > statement preceding it.

> >

> > Well, I was talking to Peter about this the other day: according to

> > the spec, this setting should only matter before exit boot services,

> > and since this platform only supports serial and GOP consoles, one

> > could argue that only a physically present user could interact with it

> > before that time.

>

> But that also makes the Pcd pointless.

>

> > The obvious way of implementing this non-trivially on this platform is

> > to use a DIP switch, but that requires you to open the case to

> > enroll/delete the platform key. Perhaps that does not matter, and it

> > would in fact produce a less dangerous reference implementation.

>

> I would be totally OK with that.

> I would also be totally OK with a DynamicPcd settable through the UI

> (which is what most machines I come across have).

>


That won't work for this implementation: the state of dynamic PCDs
does not propagate into the MM world (nor should it), and so no MM
driver implementing the dynamic PCD protocol exists.

> But I would also be cool with a sufficiently evil "here be dragons"

> statement, pointing out that we don't care that much

> *on*this*specific*system* because the NOR isn't actually hw protected

> anyway, and this implementation is all about exercising the software

> stack..

>


I'll go with that for the time being.
_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
Ard Biesheuvel Jan. 21, 2019, 4:57 p.m. | #5
On Thu, 17 Jan 2019 at 13:18, Ard Biesheuvel <ard.biesheuvel@linaro.org> wrote:
>

> On Thu, 17 Jan 2019 at 13:08, Leif Lindholm <leif.lindholm@linaro.org> wrote:

> >

> > On Thu, Jan 17, 2019 at 12:10:01PM +0100, Ard Biesheuvel wrote:

> > > > >  ################################################################################

> > > > >  #

> > > > > @@ -294,8 +295,10 @@ [PcdsFixedAtBuild.common]

> > > > >  !endif

> > > > >    gEfiMdeModulePkgTokenSpaceGuid.PcdFirmwareRevision|$(BUILD_NUMBER)

> > > > >

> > > > > -  gArmTokenSpaceGuid.PcdMmBufferBase|0xFFC00000

> > > > > -  gArmTokenSpaceGuid.PcdMmBufferSize|0x00200000

> > > > > +  gEfiSecurityPkgTokenSpaceGuid.PcdUserPhysicalPresence|TRUE

> > > >

> > > > So, I can see why you add this hard-wired for the purpose of testing.

> > > > But please, add a *very* conspicuous, and strongly worded, comment

> > > > statement preceding it.

> > >

> > > Well, I was talking to Peter about this the other day: according to

> > > the spec, this setting should only matter before exit boot services,

> > > and since this platform only supports serial and GOP consoles, one

> > > could argue that only a physically present user could interact with it

> > > before that time.

> >

> > But that also makes the Pcd pointless.

> >

> > > The obvious way of implementing this non-trivially on this platform is

> > > to use a DIP switch, but that requires you to open the case to

> > > enroll/delete the platform key. Perhaps that does not matter, and it

> > > would in fact produce a less dangerous reference implementation.

> >

> > I would be totally OK with that.

> > I would also be totally OK with a DynamicPcd settable through the UI

> > (which is what most machines I come across have).

> >

>

> That won't work for this implementation: the state of dynamic PCDs

> does not propagate into the MM world (nor should it), and so no MM

> driver implementing the dynamic PCD protocol exists.

>

> > But I would also be cool with a sufficiently evil "here be dragons"

> > statement, pointing out that we don't care that much

> > *on*this*specific*system* because the NOR isn't actually hw protected

> > anyway, and this implementation is all about exercising the software

> > stack..

> >

>

> I'll go with that for the time being.


I'll add the following:

diff --git a/Platform/Socionext/DeveloperBox/DeveloperBox.dsc.inc
b/Platform/Socionext/DeveloperBox/DeveloperBox.dsc.inc
index f191edcb78dd..1ac8c8f95722 100644
--- a/Platform/Socionext/DeveloperBox/DeveloperBox.dsc.inc
+++ b/Platform/Socionext/DeveloperBox/DeveloperBox.dsc.inc
@@ -301,6 +301,13 @@
 !endif
   gEfiMdeModulePkgTokenSpaceGuid.PcdFirmwareRevision|$(BUILD_NUMBER)

+  #
+  # NOTE: this platform is not fully secure (the NOR flash is mapped
non-secure)
+  # and so the MM based secure boot implementation it provides should
be treated
+  # as a reference only. For this reason, it does not make a lot of sense to
+  # implement an elaborate PlatformSecureLib implementation that can assert
+  # physical presence, and instead, we'll stick with the default PCD based one.
+  #
   gEfiSecurityPkgTokenSpaceGuid.PcdUserPhysicalPresence|TRUE

   gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x2000
_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
Leif Lindholm Jan. 21, 2019, 5:03 p.m. | #6
On Mon, Jan 21, 2019 at 05:57:20PM +0100, Ard Biesheuvel wrote:
> On Thu, 17 Jan 2019 at 13:18, Ard Biesheuvel <ard.biesheuvel@linaro.org> wrote:

> >

> > On Thu, 17 Jan 2019 at 13:08, Leif Lindholm <leif.lindholm@linaro.org> wrote:

> > >

> > > On Thu, Jan 17, 2019 at 12:10:01PM +0100, Ard Biesheuvel wrote:

> > > > > >  ################################################################################

> > > > > >  #

> > > > > > @@ -294,8 +295,10 @@ [PcdsFixedAtBuild.common]

> > > > > >  !endif

> > > > > >    gEfiMdeModulePkgTokenSpaceGuid.PcdFirmwareRevision|$(BUILD_NUMBER)

> > > > > >

> > > > > > -  gArmTokenSpaceGuid.PcdMmBufferBase|0xFFC00000

> > > > > > -  gArmTokenSpaceGuid.PcdMmBufferSize|0x00200000

> > > > > > +  gEfiSecurityPkgTokenSpaceGuid.PcdUserPhysicalPresence|TRUE

> > > > >

> > > > > So, I can see why you add this hard-wired for the purpose of testing.

> > > > > But please, add a *very* conspicuous, and strongly worded, comment

> > > > > statement preceding it.

> > > >

> > > > Well, I was talking to Peter about this the other day: according to

> > > > the spec, this setting should only matter before exit boot services,

> > > > and since this platform only supports serial and GOP consoles, one

> > > > could argue that only a physically present user could interact with it

> > > > before that time.

> > >

> > > But that also makes the Pcd pointless.

> > >

> > > > The obvious way of implementing this non-trivially on this platform is

> > > > to use a DIP switch, but that requires you to open the case to

> > > > enroll/delete the platform key. Perhaps that does not matter, and it

> > > > would in fact produce a less dangerous reference implementation.

> > >

> > > I would be totally OK with that.

> > > I would also be totally OK with a DynamicPcd settable through the UI

> > > (which is what most machines I come across have).

> > >

> >

> > That won't work for this implementation: the state of dynamic PCDs

> > does not propagate into the MM world (nor should it), and so no MM

> > driver implementing the dynamic PCD protocol exists.

> >

> > > But I would also be cool with a sufficiently evil "here be dragons"

> > > statement, pointing out that we don't care that much

> > > *on*this*specific*system* because the NOR isn't actually hw protected

> > > anyway, and this implementation is all about exercising the software

> > > stack..

> > >

> >

> > I'll go with that for the time being.

> 

> I'll add the following:

> 

> diff --git a/Platform/Socionext/DeveloperBox/DeveloperBox.dsc.inc

> b/Platform/Socionext/DeveloperBox/DeveloperBox.dsc.inc

> index f191edcb78dd..1ac8c8f95722 100644

> --- a/Platform/Socionext/DeveloperBox/DeveloperBox.dsc.inc

> +++ b/Platform/Socionext/DeveloperBox/DeveloperBox.dsc.inc

> @@ -301,6 +301,13 @@

>  !endif

>    gEfiMdeModulePkgTokenSpaceGuid.PcdFirmwareRevision|$(BUILD_NUMBER)

> 

> +  #

> +  # NOTE: this platform is not fully secure (the NOR flash is mapped

> non-secure)

> +  # and so the MM based secure boot implementation it provides should

> be treated

> +  # as a reference only. For this reason, it does not make a lot of sense to

> +  # implement an elaborate PlatformSecureLib implementation that can assert

> +  # physical presence, and instead, we'll stick with the default PCD based one.

> +  #

>    gEfiSecurityPkgTokenSpaceGuid.PcdUserPhysicalPresence|TRUE

> 

>    gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x2000


Totally happy with that.
Reviewed-by: Leif Lindholm <leif.lindholm@linaro.org>

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel

Patch

diff --git a/Platform/Socionext/DeveloperBox/DeveloperBox.dsc b/Platform/Socionext/DeveloperBox/DeveloperBox.dsc
index 56787a744157..666bd2716336 100644
--- a/Platform/Socionext/DeveloperBox/DeveloperBox.dsc
+++ b/Platform/Socionext/DeveloperBox/DeveloperBox.dsc
@@ -250,10 +250,7 @@  [Components.common]
   #
   # Variable services
   #
-  Silicon/Socionext/SynQuacer/Drivers/Fip006Dxe/Fip006Dxe.inf {
-    <LibraryClasses>
-      NorFlashPlatformLib|Silicon/Socionext/SynQuacer/Library/NorFlashSynQuacerLib/NorFlashSynQuacerLib.inf
-  }
+  Silicon/Socionext/SynQuacer/Drivers/Fip006Dxe/Fip006Dxe.inf
   MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf
   MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf {
     <LibraryClasses>
diff --git a/Platform/Socionext/DeveloperBox/DeveloperBox.dsc.inc b/Platform/Socionext/DeveloperBox/DeveloperBox.dsc.inc
index 56adc21d5caf..87b2094cb356 100644
--- a/Platform/Socionext/DeveloperBox/DeveloperBox.dsc.inc
+++ b/Platform/Socionext/DeveloperBox/DeveloperBox.dsc.inc
@@ -125,6 +125,7 @@  [LibraryClasses.common]
   PlatformSecureLib|SecurityPkg/Library/PlatformSecureLibNull/PlatformSecureLibNull.inf
 
   NorFlashInfoLib|EmbeddedPkg/Library/NorFlashInfoLib/NorFlashInfoLib.inf
+  NorFlashPlatformLib|Silicon/Socionext/SynQuacer/Library/NorFlashSynQuacerLib/NorFlashSynQuacerLib.inf
 
 ################################################################################
 #
@@ -294,8 +295,10 @@  [PcdsFixedAtBuild.common]
 !endif
   gEfiMdeModulePkgTokenSpaceGuid.PcdFirmwareRevision|$(BUILD_NUMBER)
 
-  gArmTokenSpaceGuid.PcdMmBufferBase|0xFFC00000
-  gArmTokenSpaceGuid.PcdMmBufferSize|0x00200000
+  gEfiSecurityPkgTokenSpaceGuid.PcdUserPhysicalPresence|TRUE
+
+  gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVariableSize|0x2000
+  gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x2800
 
 [PcdsPatchableInModule]
   gEfiMdeModulePkgTokenSpaceGuid.PcdVideoHorizontalResolution|0
diff --git a/Platform/Socionext/DeveloperBox/DeveloperBoxMm.dsc b/Platform/Socionext/DeveloperBox/DeveloperBoxMm.dsc
new file mode 100644
index 000000000000..45cfd5645d9b
--- /dev/null
+++ b/Platform/Socionext/DeveloperBox/DeveloperBoxMm.dsc
@@ -0,0 +1,103 @@ 
+#
+#  Copyright (c) 2013-2014, ARM Limited. All rights reserved.
+#  Copyright (c) 2017-2018, Linaro Limited. All rights reserved.
+#
+#  This program and the accompanying materials
+#  are licensed and made available under the terms and conditions of the BSD License
+#  which accompanies this distribution.  The full text of the license may be found at
+#  http://opensource.org/licenses/bsd-license.php
+#
+#  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+#
+
+################################################################################
+#
+# Defines Section - statements that will be processed to create a Makefile.
+#
+################################################################################
+[Defines]
+  PLATFORM_NAME                  = DeveloperBoxMm
+  PLATFORM_GUID                  = cedcc3f9-fb42-45e6-b134-e7ca97abbffd
+  PLATFORM_VERSION               = 0.1
+  DSC_SPECIFICATION              = 0x0001001B
+  OUTPUT_DIRECTORY               = Build/$(PLATFORM_NAME)
+  SUPPORTED_ARCHITECTURES        = AARCH64
+  BUILD_TARGETS                  = DEBUG|RELEASE|NOOPT
+  SKUID_IDENTIFIER               = DEFAULT
+  FLASH_DEFINITION               = Platform/Socionext/DeveloperBox/$(PLATFORM_NAME).fdf
+  BUILD_NUMBER                   = 1
+
+!include Platform/Socionext/DeveloperBox/DeveloperBox.dsc.inc
+
+[LibraryClasses.common.MM_STANDALONE, LibraryClasses.common.MM_CORE_STANDALONE]
+  ArmSvcLib|ArmPkg/Library/ArmSvcLib/ArmSvcLib.inf
+  BaseMemoryLib|MdePkg/Library/BaseMemoryLib/BaseMemoryLib.inf
+  FvLib|StandaloneMmPkg/Library/FvLib/FvLib.inf
+  MemLib|StandaloneMmPkg/Library/StandaloneMmMemLib/StandaloneMmMemLib.inf
+  PeCoffExtraActionLib|StandaloneMmPkg/Library/StandaloneMmPeCoffExtraActionLib/StandaloneMmPeCoffExtraActionLib.inf
+  StandaloneMmCoreEntryPoint|StandaloneMmPkg/Library/StandaloneMmCoreEntryPoint/StandaloneMmCoreEntryPoint.inf
+  StandaloneMmDriverEntryPoint|StandaloneMmPkg/Library/StandaloneMmDriverEntryPoint/StandaloneMmDriverEntryPoint.inf
+  StandaloneMmMmuLib|ArmPkg/Library/StandaloneMmMmuLib/ArmMmuStandaloneMmLib.inf
+  PcdLib|MdePkg/Library/BasePcdLibNull/BasePcdLibNull.inf
+
+  SerialPortLib|MdeModulePkg/Library/BaseSerialPortLib16550/BaseSerialPortLib16550.inf
+  PlatformHookLib|MdeModulePkg/Library/BasePlatformHookLibNull/BasePlatformHookLibNull.inf
+  PciLib|MdePkg/Library/BasePciLibPciExpress/BasePciLibPciExpress.inf
+  PciExpressLib|MdePkg/Library/BasePciExpressLib/BasePciExpressLib.inf
+
+[LibraryClasses.common.MM_CORE_STANDALONE]
+  HobLib|StandaloneMmPkg/Library/StandaloneMmCoreHobLib/StandaloneMmCoreHobLib.inf
+  MemoryAllocationLib|StandaloneMmPkg/Library/StandaloneMmCoreMemoryAllocationLib/StandaloneMmCoreMemoryAllocationLib.inf
+
+[LibraryClasses.common.MM_STANDALONE]
+  HobLib|StandaloneMmPkg/Library/StandaloneMmHobLib/StandaloneMmHobLib.inf
+  MemoryAllocationLib|StandaloneMmPkg/Library/StandaloneMmMemoryAllocationLib/StandaloneMmMemoryAllocationLib.inf
+  MmServicesTableLib|StandaloneMmPkg/Library/MmServicesTableLib/MmServicesTableLib.inf
+
+[BuildOptions.common.EDKII.MM_STANDALONE, BuildOptions.common.EDKII.MM_CORE_STANDALONE]
+  GCC:*_*_*_CC_FLAGS = -mstrict-align -mgeneral-regs-only
+  GCC:*_*_*_DLINK_FLAGS = -z common-page-size=0x1000
+
+################################################################################
+#
+# Pcd Section - list of all EDK II PCD Entries defined by this Platform
+#
+################################################################################
+
+[PcdsFixedAtBuild]
+  gEfiMdeModulePkgTokenSpaceGuid.PcdSerialRegisterBase|0x51040000
+  gEfiMdeModulePkgTokenSpaceGuid.PcdSerialUseMmio|TRUE
+  gEfiMdeModulePkgTokenSpaceGuid.PcdSerialUseHardwareFlowControl|FALSE
+  gEfiMdeModulePkgTokenSpaceGuid.PcdSerialClockRate|62500000
+  gEfiMdeModulePkgTokenSpaceGuid.PcdSerialRegisterStride|4
+
+[PcdsPatchableInModule]
+  gEfiMdePkgTokenSpaceGuid.PcdGuidedExtractHandlerTableAddress|0x0
+
+################################################################################
+#
+# Components Section - list of all EDK II Modules needed by this Platform
+#
+################################################################################
+[Components.common]
+  #
+  # Standalone MM components
+  #
+  StandaloneMmPkg/Core/StandaloneMmCore.inf {
+    <LibraryClasses>
+      ExtractGuidedSectionLib|MdePkg/Library/BaseExtractGuidedSectionLib/BaseExtractGuidedSectionLib.inf
+      NULL|MdeModulePkg/Library/LzmaCustomDecompressLib/LzmaCustomDecompressLib.inf
+  }
+
+  StandaloneMmPkg/Drivers/StandaloneMmCpu/AArch64/StandaloneMmCpu.inf
+  Silicon/Socionext/SynQuacer/Drivers/Fip006Dxe/Fip006StandaloneMm.inf
+  MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteStandaloneMm.inf
+  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf {
+    <LibraryClasses>
+      AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
+      BaseCryptLib|CryptoPkg/Library/BaseCryptLib/SmmCryptLib.inf
+      DevicePathLib|MdePkg/Library/UefiDevicePathLib/UefiDevicePathLib.inf
+      VarCheckLib|MdeModulePkg/Library/VarCheckLib/VarCheckLib.inf
+      NULL|MdeModulePkg/Library/VarCheckUefiLib/VarCheckUefiLib.inf
+  }
diff --git a/Platform/Socionext/DeveloperBox/DeveloperBoxMm.fdf b/Platform/Socionext/DeveloperBox/DeveloperBoxMm.fdf
new file mode 100644
index 000000000000..790a391080e6
--- /dev/null
+++ b/Platform/Socionext/DeveloperBox/DeveloperBoxMm.fdf
@@ -0,0 +1,161 @@ 
+#
+#  Copyright (c) 2013-2014, ARM Limited. All rights reserved.
+#  Copyright (c) 2017-2018, Linaro Limited. All rights reserved.
+#
+#  This program and the accompanying materials
+#  are licensed and made available under the terms and conditions of the BSD License
+#  which accompanies this distribution.  The full text of the license may be found at
+#  http://opensource.org/licenses/bsd-license.php
+#
+#  THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+#  WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
+#
+
+################################################################################
+#
+# FD Section
+# The [FD] Section is made up of the definition statements and a
+# description of what goes into  the Flash Device Image.  Each FD section
+# defines one flash "device" image.  A flash device image may be one of
+# the following: Removable media bootable image (like a boot floppy
+# image,) an Option ROM image (that would be "flashed" into an add-in
+# card,) a System "Flash"  image (that would be burned into a system's
+# flash) or an Update ("Capsule") image that will be used to update and
+# existing system flash.
+#
+################################################################################
+
+[FD.STANDALONE_MM]
+BaseAddress   = 0xfc000000
+Size          = 0x00040000
+ErasePolarity = 1
+
+# This one is tricky, it must be: BlockSize * NumBlocks = Size
+BlockSize     = 0x00010000
+NumBlocks     = 0x4
+
+################################################################################
+#
+# Following are lists of FD Region layout which correspond to the locations of different
+# images within the flash device.
+#
+# Regions must be defined in ascending order and may not overlap.
+#
+# A Layout Region start with a eight digit hex offset (leading "0x" required) followed by
+# the pipe "|" character, followed by the size of the region, also in hex with the leading
+# "0x" characters. Like:
+# Offset|Size
+# PcdOffsetCName|PcdSizeCName
+# RegionType <FV, DATA, or FILE>
+#
+################################################################################
+
+0x00000000|0x00040000
+FV = FvStandaloneMmCompact
+
+################################################################################
+#
+# FV Section
+#
+# [FV] section is used to define what components or modules are placed within a flash
+# device file.  This section also defines order the components and modules are positioned
+# within the image.  The [FV] section consists of define statements, set statements and
+# module statements.
+#
+################################################################################
+
+[FV.FvStandaloneMmCompact]
+FvNameGuid         = db7dcad2-de57-455d-a385-c297a6536cd8
+BlockSize          = 0x10000
+NumBlocks          = 0
+FvAlignment        = 8
+ERASE_POLARITY     = 1
+MEMORY_MAPPED      = TRUE
+STICKY_WRITE       = TRUE
+LOCK_CAP           = TRUE
+LOCK_STATUS        = TRUE
+WRITE_DISABLED_CAP = TRUE
+WRITE_ENABLED_CAP  = TRUE
+WRITE_STATUS       = TRUE
+WRITE_LOCK_CAP     = TRUE
+WRITE_LOCK_STATUS  = TRUE
+READ_DISABLED_CAP  = TRUE
+READ_ENABLED_CAP   = TRUE
+READ_STATUS        = TRUE
+READ_LOCK_CAP      = TRUE
+READ_LOCK_STATUS   = TRUE
+
+  INF StandaloneMmPkg/Core/StandaloneMmCore.inf
+
+  FILE FV_IMAGE = 9E21FD93-9C72-4c15-8C4B-E77F1DB2D792 {
+    SECTION GUIDED EE4E5898-3914-4259-9D6E-DC7BD79403CF PROCESSING_REQUIRED = TRUE {
+      SECTION FV_IMAGE = FVSTANDALONEMM
+    }
+  }
+
+[FV.FvStandaloneMm]
+FvNameGuid         = 2160589f-77f4-4cae-b9ba-0be99d2e33a4
+BlockSize          = 0x40
+NumBlocks          = 0         # This FV gets compressed so make it just big enough
+FvAlignment        = 8         # FV alignment and FV attributes setting.
+ERASE_POLARITY     = 1
+MEMORY_MAPPED      = TRUE
+STICKY_WRITE       = TRUE
+LOCK_CAP           = TRUE
+LOCK_STATUS        = TRUE
+WRITE_DISABLED_CAP = TRUE
+WRITE_ENABLED_CAP  = TRUE
+WRITE_STATUS       = TRUE
+WRITE_LOCK_CAP     = TRUE
+WRITE_LOCK_STATUS  = TRUE
+READ_DISABLED_CAP  = TRUE
+READ_ENABLED_CAP   = TRUE
+READ_STATUS        = TRUE
+READ_LOCK_CAP      = TRUE
+READ_LOCK_STATUS   = TRUE
+
+  INF Silicon/Socionext/SynQuacer/Drivers/Fip006Dxe/Fip006StandaloneMm.inf
+  INF MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteStandaloneMm.inf
+  INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf
+  INF StandaloneMmPkg/Drivers/StandaloneMmCpu/AArch64/StandaloneMmCpu.inf
+
+################################################################################
+#
+# Rules are use with the [FV] section's module INF type to define
+# how an FFS file is created for a given INF file. The following Rule are the default
+# rules for the different module type. User can add the customized rules to define the
+# content of the FFS file.
+#
+################################################################################
+
+
+############################################################################
+# Example of a DXE_DRIVER FFS file with a Checksum encapsulation section   #
+############################################################################
+#
+#[Rule.Common.DXE_DRIVER]
+#  FILE DRIVER = $(NAMED_GUID) {
+#    DXE_DEPEX    DXE_DEPEX               Optional $(INF_OUTPUT)/$(MODULE_NAME).depex
+#    COMPRESS PI_STD {
+#      GUIDED {
+#        PE32     PE32                    $(INF_OUTPUT)/$(MODULE_NAME).efi
+#        UI       STRING="$(MODULE_NAME)" Optional
+#        VERSION  STRING="$(INF_VERSION)" Optional BUILD_NUM=$(BUILD_NUMBER)
+#      }
+#    }
+#  }
+#
+############################################################################
+
+[Rule.Common.MM_CORE_STANDALONE]
+  FILE SEC = $(NAMED_GUID) RELOCS_STRIPPED FIXED {
+    TE  TE Align = 4K                 $(INF_OUTPUT)/$(MODULE_NAME).efi
+  }
+
+[Rule.Common.MM_STANDALONE]
+  FILE MM_STANDALONE = $(NAMED_GUID) {
+    SMM_DEPEX SMM_DEPEX Optional       $(INF_OUTPUT)/$(MODULE_NAME).depex
+    PE32      PE32                     $(INF_OUTPUT)/$(MODULE_NAME).efi
+    UI        STRING="$(MODULE_NAME)" Optional
+    VERSION   STRING="$(INF_VERSION)" Optional BUILD_NUM=$(BUILD_NUMBER)
+  }