mbox series

[edk2,edk2-platforms,0/7] Silicon/SynQuacer: implement SMM based secure boot

Message ID 20190104144336.8941-1-ard.biesheuvel@linaro.org
Headers show
Series Silicon/SynQuacer: implement SMM based secure boot | expand

Message

Ard Biesheuvel Jan. 4, 2019, 2:43 p.m. UTC 
Wire up the various pieces so that the authenticated variable store
runs entirely in standalone MM context residing in a secure partition.

This primarily involves refactoring the platform's NOR flash driver so
we can build a version that can work in the standalone MM context.
Beyond that, it is just a matter of enabling all the boilerplate in
the .DSC and .FDF files.

Note that the resulting standalone MM firmware volume needs to be
wrapped in a FIP, which is not part of the build sequence.

Cc: Leif Lindholm <leif.lindholm@linaro.org>
Cc: Masahisa Kojima <masahisa.kojima@linaro.org>

Ard Biesheuvel (7):
  Silicon/SynQuacer/Fip006Dxe: drop block I/O and disk I/O routines
  Silicon/SynQuacer/Fip006Dxe: factor out DXE specific pieces
  Silicon/SynQuacer/Fip006Dxe: implement standalone MM variant
  Silicon/SynQuacer/Fip006Dxe: use proper accessor for unaligned access
  Platform/DeveloperBox: create shared .DSC include file
  Platform/DeveloperBox: add .DSC/.FDF description of MM components
  Platform/DeveloperBox: add MM based UEFI secure boot support

 .../Socionext/DeveloperBox/DeveloperBox.dsc   |  304 +---
 .../DeveloperBox/DeveloperBox.dsc.inc         |  315 ++++
 .../Socionext/DeveloperBox/DeveloperBox.fdf   |   13 +
 .../Socionext/DeveloperBox/DeveloperBoxMm.dsc |  103 ++
 .../Socionext/DeveloperBox/DeveloperBoxMm.fdf |  161 ++
 .../SynQuacer/Drivers/Fip006Dxe/Fip006Dxe.inf |    9 +-
 .../Drivers/Fip006Dxe/Fip006StandaloneMm.inf  |   71 +
 .../SynQuacer/Drivers/Fip006Dxe/NorFlash.c    | 1006 +++++++++++++
 .../Fip006Dxe/{NorFlashDxe.h => NorFlash.h}   |   93 +-
 .../Drivers/Fip006Dxe/NorFlashBlockIoDxe.c    |  138 --
 .../SynQuacer/Drivers/Fip006Dxe/NorFlashDxe.c | 1341 ++---------------
 .../{NorFlashFvbDxe.c => NorFlashFvb.c}       |  197 +--
 .../SynQuacer/Drivers/Fip006Dxe/NorFlashSmm.c |  182 +++
 13 files changed, 2076 insertions(+), 1857 deletions(-)
 create mode 100644 Platform/Socionext/DeveloperBox/DeveloperBox.dsc.inc
 create mode 100644 Platform/Socionext/DeveloperBox/DeveloperBoxMm.dsc
 create mode 100644 Platform/Socionext/DeveloperBox/DeveloperBoxMm.fdf
 create mode 100644 Silicon/Socionext/SynQuacer/Drivers/Fip006Dxe/Fip006StandaloneMm.inf
 create mode 100644 Silicon/Socionext/SynQuacer/Drivers/Fip006Dxe/NorFlash.c
 rename Silicon/Socionext/SynQuacer/Drivers/Fip006Dxe/{NorFlashDxe.h => NorFlash.h} (85%)
 delete mode 100644 Silicon/Socionext/SynQuacer/Drivers/Fip006Dxe/NorFlashBlockIoDxe.c
 rename Silicon/Socionext/SynQuacer/Drivers/Fip006Dxe/{NorFlashFvbDxe.c => NorFlashFvb.c} (76%)
 create mode 100644 Silicon/Socionext/SynQuacer/Drivers/Fip006Dxe/NorFlashSmm.c

-- 
2.17.1

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel

Comments

Leif Lindholm Jan. 17, 2019, 11:14 a.m. UTC | #1 
On Fri, Jan 04, 2019 at 03:43:29PM +0100, Ard Biesheuvel wrote:
> Wire up the various pieces so that the authenticated variable store

> runs entirely in standalone MM context residing in a secure partition.

> 

> This primarily involves refactoring the platform's NOR flash driver so

> we can build a version that can work in the standalone MM context.

> Beyond that, it is just a matter of enabling all the boilerplate in

> the .DSC and .FDF files.

> 

> Note that the resulting standalone MM firmware volume needs to be

> wrapped in a FIP, which is not part of the build sequence.

> 

> Cc: Leif Lindholm <leif.lindholm@linaro.org>

> Cc: Masahisa Kojima <masahisa.kojima@linaro.org>

> 

> Ard Biesheuvel (7):

>   Silicon/SynQuacer/Fip006Dxe: drop block I/O and disk I/O routines

>   Silicon/SynQuacer/Fip006Dxe: factor out DXE specific pieces

>   Silicon/SynQuacer/Fip006Dxe: implement standalone MM variant

>   Silicon/SynQuacer/Fip006Dxe: use proper accessor for unaligned access

>   Platform/DeveloperBox: create shared .DSC include file

>   Platform/DeveloperBox: add .DSC/.FDF description of MM components

>   Platform/DeveloperBox: add MM based UEFI secure boot support


For the patches I haven't commented on individually:
Reviewed-by: Leif Lindholm <leif.lindholm@linaro.org>


>  .../Socionext/DeveloperBox/DeveloperBox.dsc   |  304 +---

>  .../DeveloperBox/DeveloperBox.dsc.inc         |  315 ++++

>  .../Socionext/DeveloperBox/DeveloperBox.fdf   |   13 +

>  .../Socionext/DeveloperBox/DeveloperBoxMm.dsc |  103 ++

>  .../Socionext/DeveloperBox/DeveloperBoxMm.fdf |  161 ++

>  .../SynQuacer/Drivers/Fip006Dxe/Fip006Dxe.inf |    9 +-

>  .../Drivers/Fip006Dxe/Fip006StandaloneMm.inf  |   71 +

>  .../SynQuacer/Drivers/Fip006Dxe/NorFlash.c    | 1006 +++++++++++++

>  .../Fip006Dxe/{NorFlashDxe.h => NorFlash.h}   |   93 +-

>  .../Drivers/Fip006Dxe/NorFlashBlockIoDxe.c    |  138 --

>  .../SynQuacer/Drivers/Fip006Dxe/NorFlashDxe.c | 1341 ++---------------

>  .../{NorFlashFvbDxe.c => NorFlashFvb.c}       |  197 +--

>  .../SynQuacer/Drivers/Fip006Dxe/NorFlashSmm.c |  182 +++

>  13 files changed, 2076 insertions(+), 1857 deletions(-)

>  create mode 100644 Platform/Socionext/DeveloperBox/DeveloperBox.dsc.inc

>  create mode 100644 Platform/Socionext/DeveloperBox/DeveloperBoxMm.dsc

>  create mode 100644 Platform/Socionext/DeveloperBox/DeveloperBoxMm.fdf

>  create mode 100644 Silicon/Socionext/SynQuacer/Drivers/Fip006Dxe/Fip006StandaloneMm.inf

>  create mode 100644 Silicon/Socionext/SynQuacer/Drivers/Fip006Dxe/NorFlash.c

>  rename Silicon/Socionext/SynQuacer/Drivers/Fip006Dxe/{NorFlashDxe.h => NorFlash.h} (85%)

>  delete mode 100644 Silicon/Socionext/SynQuacer/Drivers/Fip006Dxe/NorFlashBlockIoDxe.c

>  rename Silicon/Socionext/SynQuacer/Drivers/Fip006Dxe/{NorFlashFvbDxe.c => NorFlashFvb.c} (76%)

>  create mode 100644 Silicon/Socionext/SynQuacer/Drivers/Fip006Dxe/NorFlashSmm.c

> 

> -- 

> 2.17.1

> 

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel
Ard Biesheuvel Jan. 21, 2019, 5:40 p.m. UTC | #2 
On Thu, 17 Jan 2019 at 12:14, Leif Lindholm <leif.lindholm@linaro.org> wrote:
>

> On Fri, Jan 04, 2019 at 03:43:29PM +0100, Ard Biesheuvel wrote:

> > Wire up the various pieces so that the authenticated variable store

> > runs entirely in standalone MM context residing in a secure partition.

> >

> > This primarily involves refactoring the platform's NOR flash driver so

> > we can build a version that can work in the standalone MM context.

> > Beyond that, it is just a matter of enabling all the boilerplate in

> > the .DSC and .FDF files.

> >

> > Note that the resulting standalone MM firmware volume needs to be

> > wrapped in a FIP, which is not part of the build sequence.

> >

> > Cc: Leif Lindholm <leif.lindholm@linaro.org>

> > Cc: Masahisa Kojima <masahisa.kojima@linaro.org>

> >

> > Ard Biesheuvel (7):

> >   Silicon/SynQuacer/Fip006Dxe: drop block I/O and disk I/O routines

> >   Silicon/SynQuacer/Fip006Dxe: factor out DXE specific pieces

> >   Silicon/SynQuacer/Fip006Dxe: implement standalone MM variant

> >   Silicon/SynQuacer/Fip006Dxe: use proper accessor for unaligned access

> >   Platform/DeveloperBox: create shared .DSC include file

> >   Platform/DeveloperBox: add .DSC/.FDF description of MM components

> >   Platform/DeveloperBox: add MM based UEFI secure boot support

>

> For the patches I haven't commented on individually:

> Reviewed-by: Leif Lindholm <leif.lindholm@linaro.org>

>


Thanks

Series pushed as 9b725b6ebb39..d571b43f8741

> >  .../Socionext/DeveloperBox/DeveloperBox.dsc   |  304 +---

> >  .../DeveloperBox/DeveloperBox.dsc.inc         |  315 ++++

> >  .../Socionext/DeveloperBox/DeveloperBox.fdf   |   13 +

> >  .../Socionext/DeveloperBox/DeveloperBoxMm.dsc |  103 ++

> >  .../Socionext/DeveloperBox/DeveloperBoxMm.fdf |  161 ++

> >  .../SynQuacer/Drivers/Fip006Dxe/Fip006Dxe.inf |    9 +-

> >  .../Drivers/Fip006Dxe/Fip006StandaloneMm.inf  |   71 +

> >  .../SynQuacer/Drivers/Fip006Dxe/NorFlash.c    | 1006 +++++++++++++

> >  .../Fip006Dxe/{NorFlashDxe.h => NorFlash.h}   |   93 +-

> >  .../Drivers/Fip006Dxe/NorFlashBlockIoDxe.c    |  138 --

> >  .../SynQuacer/Drivers/Fip006Dxe/NorFlashDxe.c | 1341 ++---------------

> >  .../{NorFlashFvbDxe.c => NorFlashFvb.c}       |  197 +--

> >  .../SynQuacer/Drivers/Fip006Dxe/NorFlashSmm.c |  182 +++

> >  13 files changed, 2076 insertions(+), 1857 deletions(-)

> >  create mode 100644 Platform/Socionext/DeveloperBox/DeveloperBox.dsc.inc

> >  create mode 100644 Platform/Socionext/DeveloperBox/DeveloperBoxMm.dsc

> >  create mode 100644 Platform/Socionext/DeveloperBox/DeveloperBoxMm.fdf

> >  create mode 100644 Silicon/Socionext/SynQuacer/Drivers/Fip006Dxe/Fip006StandaloneMm.inf

> >  create mode 100644 Silicon/Socionext/SynQuacer/Drivers/Fip006Dxe/NorFlash.c

> >  rename Silicon/Socionext/SynQuacer/Drivers/Fip006Dxe/{NorFlashDxe.h => NorFlash.h} (85%)

> >  delete mode 100644 Silicon/Socionext/SynQuacer/Drivers/Fip006Dxe/NorFlashBlockIoDxe.c

> >  rename Silicon/Socionext/SynQuacer/Drivers/Fip006Dxe/{NorFlashFvbDxe.c => NorFlashFvb.c} (76%)

> >  create mode 100644 Silicon/Socionext/SynQuacer/Drivers/Fip006Dxe/NorFlashSmm.c

> >

> > --

> > 2.17.1

> >

_______________________________________________
edk2-devel mailing list
edk2-devel@lists.01.org
https://lists.01.org/mailman/listinfo/edk2-devel