[edk2-devel] [PATCH] EmulatorPkg: Enable support for Authenticated Variables
Ni, Ray
ray.ni at intel.com
Wed Sep 16 08:15:00 UTC 2020
I assume you did the test.
Reviewed-by: Ray Ni <ray.ni at intel.com>
> -----Original Message-----
> From: devel at edk2.groups.io <devel at edk2.groups.io> On Behalf Of Wadhawan,
> Divneil R
> Sent: Thursday, September 3, 2020 1:44 AM
> To: devel at edk2.groups.io
> Cc: Kinney, Michael D <michael.d.kinney at intel.com>; Wadhawan, Divneil R
> <divneil.r.wadhawan at intel.com>
> Subject: [edk2-devel] [PATCH] EmulatorPkg: Enable support for Authenticated
> Variables
>
> SECURE_BOOT_ENABLE feature flag is introduced to enable Authenticated
> variable support by:
> o Enabling storage space
> o Enabling AuthLib support
>
> Signed-off-by: Divneil Rai Wadhawan <divneil.r.wadhawan at intel.com>
> ---
> EmulatorPkg/EmulatorPkg.dsc | 17 ++++++++++++++++-
> EmulatorPkg/EmulatorPkg.fdf | 14 ++++++++++----
> 2 files changed, 26 insertions(+), 5 deletions(-)
>
> diff --git a/EmulatorPkg/EmulatorPkg.dsc b/EmulatorPkg/EmulatorPkg.dsc
> index 86a6271735..06cd8a9b4c 100644
> --- a/EmulatorPkg/EmulatorPkg.dsc
> +++ b/EmulatorPkg/EmulatorPkg.dsc
> @@ -32,6 +32,7 @@
> DEFINE NETWORK_TLS_ENABLE = FALSE
> DEFINE NETWORK_HTTP_BOOT_ENABLE = FALSE
> DEFINE NETWORK_ISCSI_ENABLE = FALSE
> + DEFINE SECURE_BOOT_ENABLE = TRUE
>
> [SkuIds]
> 0|DEFAULT
> @@ -89,6 +90,7 @@
>
> TimerLib|MdePkg/Library/BaseTimerLibNullTemplate/BaseTimerLibNullTempl
> ate.inf
>
> SerialPortLib|MdePkg/Library/BaseSerialPortLibNull/BaseSerialPortLibNull.inf
> CapsuleLib|MdeModulePkg/Library/DxeCapsuleLibNull/DxeCapsuleLibNull.inf
> +
> #
> # Platform
> #
> @@ -106,12 +108,21 @@
> LockBoxLib|MdeModulePkg/Library/LockBoxNullLib/LockBoxNullLib.inf
>
> CpuExceptionHandlerLib|MdeModulePkg/Library/CpuExceptionHandlerLibNull/
> CpuExceptionHandlerLibNull.inf
>
> TpmMeasurementLib|MdeModulePkg/Library/TpmMeasurementLibNull/Tpm
> MeasurementLibNull.inf
> -
> AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLib
> Null.inf
> VarCheckLib|MdeModulePkg/Library/VarCheckLib/VarCheckLib.inf
> SortLib|MdeModulePkg/Library/BaseSortLib/BaseSortLib.inf
> ShellLib|ShellPkg/Library/UefiShellLib/UefiShellLib.inf
> FileHandleLib|MdePkg/Library/UefiFileHandleLib/UefiFileHandleLib.inf
>
> + !if $(SECURE_BOOT_ENABLE) == TRUE
> + IntrinsicLib|CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf
> + OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
> +
> PlatformSecureLib|SecurityPkg/Library/PlatformSecureLibNull/PlatformSecure
> LibNull.inf
> + BaseCryptLib|CryptoPkg/Library/BaseCryptLib/RuntimeCryptLib.inf
> + AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
> + !else
> +
> AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLib
> Null.inf
> + !endif
> +
> [LibraryClasses.common.SEC]
> PeiServicesLib|EmulatorPkg/Library/SecPeiServicesLib/SecPeiServicesLib.inf
> PcdLib|MdePkg/Library/BasePcdLibNull/BasePcdLibNull.inf
> @@ -190,6 +201,10 @@
> gEmulatorPkgTokenSpaceGuid.PcdEmuFirmwareFdSize|0x002a0000
> gEmulatorPkgTokenSpaceGuid.PcdEmuFirmwareBlockSize|0x10000
>
> gEmulatorPkgTokenSpaceGuid.PcdEmuFirmwareVolume|L"../FV/FV_RECOVERY
> .fd"
> + !if $(SECURE_BOOT_ENABLE) == TRUE
> + gEfiMdeModulePkgTokenSpaceGuid.PcdMaxAuthVariableSize|0x2800
> + gEfiSecurityPkgTokenSpaceGuid.PcdUserPhysicalPresence|TRUE
> + !endif
>
> gEmulatorPkgTokenSpaceGuid.PcdEmuMemorySize|L"64!64"
>
> diff --git a/EmulatorPkg/EmulatorPkg.fdf b/EmulatorPkg/EmulatorPkg.fdf
> index 295f6f1db8..93552baf8b 100644
> --- a/EmulatorPkg/EmulatorPkg.fdf
> +++ b/EmulatorPkg/EmulatorPkg.fdf
> @@ -46,10 +46,16 @@ DATA = {
> # Blockmap[1]: End
> 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
> ## This is the VARIABLE_STORE_HEADER
> - #Signature: gEfiVariableGuid =
> - # { 0xddcf3616, 0x3275, 0x4164, { 0x98, 0xb6, 0xfe, 0x85, 0x70, 0x7f, 0xfe,
> 0x7d }}
> - 0x16, 0x36, 0xcf, 0xdd, 0x75, 0x32, 0x64, 0x41,
> - 0x98, 0xb6, 0xfe, 0x85, 0x70, 0x7f, 0xfe, 0x7d,
> + !if $(SECURE_BOOT_ENABLE) == FALSE
> + #Signature: gEfiVariableGuid =
> + # { 0xddcf3616, 0x3275, 0x4164, { 0x98, 0xb6, 0xfe, 0x85, 0x70, 0x7f, 0xfe,
> 0x7d }}
> + 0x16, 0x36, 0xcf, 0xdd, 0x75, 0x32, 0x64, 0x41,
> + 0x98, 0xb6, 0xfe, 0x85, 0x70, 0x7f, 0xfe, 0x7d,
> + !else
> + # Signature: gEfiAuthenticatedVariableGuid = { 0xaaf32c78, 0x947b, 0x439a,
> { 0xa1, 0x80, 0x2e, 0x14, 0x4e, 0xc3, 0x77, 0x92 } }
> + 0x78, 0x2c, 0xf3, 0xaa, 0x7b, 0x94, 0x9a, 0x43,
> + 0xa1, 0x80, 0x2e, 0x14, 0x4e, 0xc3, 0x77, 0x92,
> + !endif
> #Size: 0xc000
> (gEfiMdeModulePkgTokenSpaceGuid.PcdFlashNvStorageVariableSize) - 0x48
> (size of EFI_FIRMWARE_VOLUME_HEADER) = 0xBFB8
> # This can speed up the Variable Dispatch a bit.
> 0xB8, 0xBF, 0x00, 0x00,
> --
> 2.24.1.windows.2
>
>
>
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#65311): https://edk2.groups.io/g/devel/message/65311
Mute This Topic: https://groups.io/mt/76591630/1813853
Group Owner: devel+owner at edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [edk2-devel-archive at redhat.com]
-=-=-=-=-=-=-=-=-=-=-=-
More information about the edk2-devel-archive
mailing list