On Fri, 3 Feb 2023 at 12:15, Yao, Jiewen <jiewen....@intel.com> wrote: > > That is fine. This patch is just to maintain the compatibility. > > Feel free to drop it, if you think it is not needed for this platform. > > I can merge rest patches at first. >
OK, please go ahead. > > -----Original Message----- > > From: Ard Biesheuvel <a...@kernel.org> > > Sent: Friday, February 3, 2023 6:49 PM > > To: Jan Bobek <jbo...@nvidia.com> > > Cc: devel@edk2.groups.io; Laszlo Ersek <ler...@redhat.com>; Yao, Jiewen > > <jiewen....@intel.com>; Ard Biesheuvel <ardb+tianoc...@kernel.org>; Leif > > Lindholm <quic_llind...@quicinc.com>; Sami Mujawar > > <sami.muja...@arm.com>; Gerd Hoffmann <kra...@redhat.com> > > Subject: Re: [PATCH v1 3/4] ArmVirtPkg: require self-signed PK when secure > > boot > > is enabled > > > > On Fri, 20 Jan 2023 at 23:59, Jan Bobek <jbo...@nvidia.com> wrote: > > > > > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2506 > > > > > > In all DSC files that define SECURE_BOOT_ENABLE, opt-in into requiring > > > self-signed PK when SECURE_BOOT_ENABLE is TRUE. > > > > > > Cc: Ard Biesheuvel <ardb+tianoc...@kernel.org> > > > Cc: Leif Lindholm <quic_llind...@quicinc.com> > > > Cc: Sami Mujawar <sami.muja...@arm.com> > > > Cc: Gerd Hoffmann <kra...@redhat.com> > > > Signed-off-by: Jan Bobek <jbo...@nvidia.com> > > > > I have no problems with this patch, but I wonder if we need it. I > > suppose this is intended to retain the previous behavior, but i don't > > think that makes sense at all. Secure boot support in ArmVirtPkg is > > not production quality in any case, and self-signed PKs are rather > > pointless too, so I think we should just go with the new default > > behavior of allowing unsigned PKs. > > > > > > > --- > > > ArmVirtPkg/ArmVirtCloudHv.dsc | 4 ++++ > > > ArmVirtPkg/ArmVirtQemu.dsc | 4 ++++ > > > ArmVirtPkg/ArmVirtQemuKernel.dsc | 4 ++++ > > > 3 files changed, 12 insertions(+) > > > > > > diff --git a/ArmVirtPkg/ArmVirtCloudHv.dsc b/ArmVirtPkg/ArmVirtCloudHv.dsc > > > index 7ca7a391d9cf..dc33936d6f03 100644 > > > --- a/ArmVirtPkg/ArmVirtCloudHv.dsc > > > +++ b/ArmVirtPkg/ArmVirtCloudHv.dsc > > > @@ -85,6 +85,10 @@ [PcdsFeatureFlag.common] > > > > > > gEfiMdeModulePkgTokenSpaceGuid.PcdTurnOffUsbLegacySupport|TRUE > > > > > > +!if $(SECURE_BOOT_ENABLE) == TRUE > > > + gEfiMdeModulePkgTokenSpaceGuid.PcdRequireSelfSignedPk|TRUE > > > +!endif > > > + > > > [PcdsFixedAtBuild.common] > > > !if $(ARCH) == AARCH64 > > > gArmTokenSpaceGuid.PcdVFPEnabled|1 > > > diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc > > > index 0f1c6395488a..31fd0e5279ab 100644 > > > --- a/ArmVirtPkg/ArmVirtQemu.dsc > > > +++ b/ArmVirtPkg/ArmVirtQemu.dsc > > > @@ -145,6 +145,10 @@ [PcdsFeatureFlag.common] > > > > > > gArmVirtTokenSpaceGuid.PcdTpm2SupportEnabled|$(TPM2_ENABLE) > > > > > > +!if $(SECURE_BOOT_ENABLE) == TRUE > > > + gEfiMdeModulePkgTokenSpaceGuid.PcdRequireSelfSignedPk|TRUE > > > +!endif > > > + > > > [PcdsFixedAtBuild.common] > > > !if $(ARCH) == AARCH64 > > > gArmTokenSpaceGuid.PcdVFPEnabled|1 > > > diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc > > b/ArmVirtPkg/ArmVirtQemuKernel.dsc > > > index 807c85d48285..1e0f06c91137 100644 > > > --- a/ArmVirtPkg/ArmVirtQemuKernel.dsc > > > +++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc > > > @@ -114,6 +114,10 @@ [PcdsFeatureFlag.common] > > > > > > gEfiMdeModulePkgTokenSpaceGuid.PcdTurnOffUsbLegacySupport|TRUE > > > > > > +!if $(SECURE_BOOT_ENABLE) == TRUE > > > + gEfiMdeModulePkgTokenSpaceGuid.PcdRequireSelfSignedPk|TRUE > > > +!endif > > > + > > > [PcdsFixedAtBuild.common] > > > !if $(ARCH) == AARCH64 > > > gArmTokenSpaceGuid.PcdVFPEnabled|1 > > > -- > > > 2.30.2 > > > -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#99561): https://edk2.groups.io/g/devel/message/99561 Mute This Topic: https://groups.io/mt/96412384/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
