From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by mx.groups.io with SMTP id smtpd.web10.8133.1675422952792913457 for ; Fri, 03 Feb 2023 03:15:53 -0800 Authentication-Results: mx.groups.io; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=tUYBuQOV; spf=pass (domain: kernel.org, ip: 145.40.68.75, mailfrom: ardb@kernel.org) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4091EB82A79 for ; Fri, 3 Feb 2023 11:15:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E4C97C433D2 for ; Fri, 3 Feb 2023 11:15:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1675422949; bh=I7xdFpUKyr4PnUfGfl1Op+QGhZ6SuEMogTy6LeM2q4E=; h=References:In-Reply-To:From:Date:Subject:To:Cc:From; b=tUYBuQOVXMT5Knf/c7oVMfu9LbCa1P6Wl32aqagH0lMQGxEnWWG/JLD9B4BWkAvF7 AU6VfeBinZjiKGWOBrizmAJFqEk+OxLj3kBtAWgrBOB5FzTFK8HgwLpgCIeRniCLAd pzYeT/03OZZaktxDTFL3tfxCjodupM2nDRTN9HOFcQIjKPdECrULHXbz4kp+H1cM0L A0JBGjFd6Qr5hp/S8PbNF+FfQir8hPlx1AcxKYkgsurGtzmFl0LtFMR6Gf5ftEjPfb JupmcF5wA7KIVdmFzfOBgw62R2ld6qSjv14s7JDrZAhCQOqHzY0FxtAjR/yhtA6rjp M5MIou+NDFh5w== Received: by mail-lf1-f49.google.com with SMTP id o20so7299012lfk.5 for ; Fri, 03 Feb 2023 03:15:49 -0800 (PST) X-Gm-Message-State: AO0yUKVzjJHvf/BngBtzt8EYMeMYwu4eNkBK0jNF9bqZHh3K+cPkLndC 6pChGDgbqGeVmZd1TIy6DHVMRPvKM5yrrzAjbH8= X-Google-Smtp-Source: AK7set+jvrk53nyJHNJxjzb8ukSdlvomSUPLB1VwgXZxUrswFSFz7Cqk/g4JFJbVvvl9PX1KgsQG+0DYOFG21Ot7NFQ= X-Received: by 2002:ac2:5fb0:0:b0:4d7:2dc1:b7bc with SMTP id s16-20020ac25fb0000000b004d72dc1b7bcmr1833340lfe.100.1675422947921; Fri, 03 Feb 2023 03:15:47 -0800 (PST) MIME-Version: 1.0 References: <20230120225835.42733-1-jbobek@nvidia.com> <20230120225835.42733-4-jbobek@nvidia.com> In-Reply-To: From: "Ard Biesheuvel" Date: Fri, 3 Feb 2023 12:15:36 +0100 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [PATCH v1 3/4] ArmVirtPkg: require self-signed PK when secure boot is enabled To: "Yao, Jiewen" Cc: Jan Bobek , "devel@edk2.groups.io" , Laszlo Ersek , Ard Biesheuvel , Leif Lindholm , Sami Mujawar , Gerd Hoffmann Content-Type: text/plain; charset="UTF-8" On Fri, 3 Feb 2023 at 12:15, Yao, Jiewen wrote: > > That is fine. This patch is just to maintain the compatibility. > > Feel free to drop it, if you think it is not needed for this platform. > > I can merge rest patches at first. > OK, please go ahead. > > -----Original Message----- > > From: Ard Biesheuvel > > Sent: Friday, February 3, 2023 6:49 PM > > To: Jan Bobek > > Cc: devel@edk2.groups.io; Laszlo Ersek ; Yao, Jiewen > > ; Ard Biesheuvel ; Leif > > Lindholm ; Sami Mujawar > > ; Gerd Hoffmann > > Subject: Re: [PATCH v1 3/4] ArmVirtPkg: require self-signed PK when secure boot > > is enabled > > > > On Fri, 20 Jan 2023 at 23:59, Jan Bobek wrote: > > > > > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2506 > > > > > > In all DSC files that define SECURE_BOOT_ENABLE, opt-in into requiring > > > self-signed PK when SECURE_BOOT_ENABLE is TRUE. > > > > > > Cc: Ard Biesheuvel > > > Cc: Leif Lindholm > > > Cc: Sami Mujawar > > > Cc: Gerd Hoffmann > > > Signed-off-by: Jan Bobek > > > > I have no problems with this patch, but I wonder if we need it. I > > suppose this is intended to retain the previous behavior, but i don't > > think that makes sense at all. Secure boot support in ArmVirtPkg is > > not production quality in any case, and self-signed PKs are rather > > pointless too, so I think we should just go with the new default > > behavior of allowing unsigned PKs. > > > > > > > --- > > > ArmVirtPkg/ArmVirtCloudHv.dsc | 4 ++++ > > > ArmVirtPkg/ArmVirtQemu.dsc | 4 ++++ > > > ArmVirtPkg/ArmVirtQemuKernel.dsc | 4 ++++ > > > 3 files changed, 12 insertions(+) > > > > > > diff --git a/ArmVirtPkg/ArmVirtCloudHv.dsc b/ArmVirtPkg/ArmVirtCloudHv.dsc > > > index 7ca7a391d9cf..dc33936d6f03 100644 > > > --- a/ArmVirtPkg/ArmVirtCloudHv.dsc > > > +++ b/ArmVirtPkg/ArmVirtCloudHv.dsc > > > @@ -85,6 +85,10 @@ [PcdsFeatureFlag.common] > > > > > > gEfiMdeModulePkgTokenSpaceGuid.PcdTurnOffUsbLegacySupport|TRUE > > > > > > +!if $(SECURE_BOOT_ENABLE) == TRUE > > > + gEfiMdeModulePkgTokenSpaceGuid.PcdRequireSelfSignedPk|TRUE > > > +!endif > > > + > > > [PcdsFixedAtBuild.common] > > > !if $(ARCH) == AARCH64 > > > gArmTokenSpaceGuid.PcdVFPEnabled|1 > > > diff --git a/ArmVirtPkg/ArmVirtQemu.dsc b/ArmVirtPkg/ArmVirtQemu.dsc > > > index 0f1c6395488a..31fd0e5279ab 100644 > > > --- a/ArmVirtPkg/ArmVirtQemu.dsc > > > +++ b/ArmVirtPkg/ArmVirtQemu.dsc > > > @@ -145,6 +145,10 @@ [PcdsFeatureFlag.common] > > > > > > gArmVirtTokenSpaceGuid.PcdTpm2SupportEnabled|$(TPM2_ENABLE) > > > > > > +!if $(SECURE_BOOT_ENABLE) == TRUE > > > + gEfiMdeModulePkgTokenSpaceGuid.PcdRequireSelfSignedPk|TRUE > > > +!endif > > > + > > > [PcdsFixedAtBuild.common] > > > !if $(ARCH) == AARCH64 > > > gArmTokenSpaceGuid.PcdVFPEnabled|1 > > > diff --git a/ArmVirtPkg/ArmVirtQemuKernel.dsc > > b/ArmVirtPkg/ArmVirtQemuKernel.dsc > > > index 807c85d48285..1e0f06c91137 100644 > > > --- a/ArmVirtPkg/ArmVirtQemuKernel.dsc > > > +++ b/ArmVirtPkg/ArmVirtQemuKernel.dsc > > > @@ -114,6 +114,10 @@ [PcdsFeatureFlag.common] > > > > > > gEfiMdeModulePkgTokenSpaceGuid.PcdTurnOffUsbLegacySupport|TRUE > > > > > > +!if $(SECURE_BOOT_ENABLE) == TRUE > > > + gEfiMdeModulePkgTokenSpaceGuid.PcdRequireSelfSignedPk|TRUE > > > +!endif > > > + > > > [PcdsFixedAtBuild.common] > > > !if $(ARCH) == AARCH64 > > > gArmTokenSpaceGuid.PcdVFPEnabled|1 > > > -- > > > 2.30.2 > > >