[edk2-devel] [PATCH v1 3/4] ArmVirtPkg: require self-signed PK when secure boot is enabled

[Yao, Jiewen]

Could ArmVirtPkg maintainer(s) review this patch?

> -----Original Message-----
> From: Jan Bobek <jbobek at nvidia.com>
> Sent: Saturday, January 21, 2023 6:59 AM
> To: devel at edk2.groups.io
> Cc: Jan Bobek <jbobek at nvidia.com>; Laszlo Ersek <lersek at redhat.com>; Yao,
> Jiewen <jiewen.yao at intel.com>; Ard Biesheuvel <ardb+tianocore at kernel.org>;
> Leif Lindholm <quic_llindhol at quicinc.com>; Sami Mujawar
> <sami.mujawar at arm.com>; Gerd Hoffmann <kraxel at redhat.com>
> Subject: [PATCH v1 3/4] ArmVirtPkg: require self-signed PK when secure boot is
> enabled
> 
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2506
> 
> In all DSC files that define SECURE_BOOT_ENABLE, opt-in into requiring
> self-signed PK when SECURE_BOOT_ENABLE is TRUE.
> 
> Cc: Ard Biesheuvel <ardb+tianocore at kernel.org>
> Cc: Leif Lindholm <quic_llindhol at quicinc.com>
> Cc: Sami Mujawar <sami.mujawar at arm.com>
> Cc: Gerd Hoffmann <kraxel at redhat.com>
> Signed-off-by: Jan Bobek <jbobek at nvidia.com>
> ---
>  ArmVirtPkg/ArmVirtCloudHv.dsc    | 4 ++++
>  ArmVirtPkg/ArmVirtQemu.dsc       | 4 ++++
>  ArmVirtPkg/ArmVirtQemuKernel.dsc | 4 ++++
>  3 files changed, 12 insertions(+)
> 
> diff --git a/ArmVirtPkg/ArmVirtCloudHv.dsc b/ArmVirtPkg/ArmVirtCloudHv.dsc
> index 7ca7a391d9cf..dc33936d6f03 100644
> --- a/ArmVirtPkg/ArmVirtCloudHv.dsc
> +++ b/ArmVirtPkg/ArmVirtCloudHv.dsc
> @@ -85,6 +85,10 @@ [PcdsFeatureFlag.common]
> 
>    gEfiMdeModulePkgTokenSpaceGuid.PcdTurnOffUsbLegacySupport|TRUE
> 
> +!if $(SECURE_BOOT_ENABLE) == TRUE
> +  gEfiMdeModulePkgTokenSpaceGuid.PcdRequireSelfSignedPk|TRUE
> +!endif
> +
>  [PcdsFixedAtBuild.common]
>  !if $(ARCH) == AARCH64
>    gArmTokenSpaceGuid.PcdVFPEnabled|1
> diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc
> index 0f1c6395488a..31fd0e5279ab 100644
> --- a/ArmVirtPkg/ArmVirtQemu.dsc
> +++ b/ArmVirtPkg/ArmVirtQemu.dsc
> @@ -145,6 +145,10 @@ [PcdsFeatureFlag.common]
> 
>    gArmVirtTokenSpaceGuid.PcdTpm2SupportEnabled|$(TPM2_ENABLE)
> 
> +!if $(SECURE_BOOT_ENABLE) == TRUE
> +  gEfiMdeModulePkgTokenSpaceGuid.PcdRequireSelfSignedPk|TRUE
> +!endif
> +
>  [PcdsFixedAtBuild.common]
>  !if $(ARCH) == AARCH64
>    gArmTokenSpaceGuid.PcdVFPEnabled|1
> diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc
> b/ArmVirtPkg/ArmVirtQemuKernel.dsc
> index 807c85d48285..1e0f06c91137 100644
> --- a/ArmVirtPkg/ArmVirtQemuKernel.dsc
> +++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc
> @@ -114,6 +114,10 @@ [PcdsFeatureFlag.common]
> 
>    gEfiMdeModulePkgTokenSpaceGuid.PcdTurnOffUsbLegacySupport|TRUE
> 
> +!if $(SECURE_BOOT_ENABLE) == TRUE
> +  gEfiMdeModulePkgTokenSpaceGuid.PcdRequireSelfSignedPk|TRUE
> +!endif
> +
>  [PcdsFixedAtBuild.common]
>  !if $(ARCH) == AARCH64
>    gArmTokenSpaceGuid.PcdVFPEnabled|1
> --
> 2.30.2



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#99512): https://edk2.groups.io/g/devel/message/99512
Mute This Topic: https://groups.io/mt/96412384/1813853
Group Owner: devel+owner at edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [edk2-devel-archive at redhat.com]
-=-=-=-=-=-=-=-=-=-=-=-