Re: [edk2-platforms PATCH v5 0/4] Secure Boot default keys

["Sunny Wang" <Sunny.Wang@arm.com>]

[-- Attachment #1: Type: text/plain, Size: 4355 bytes --]

Reviewed whole series.
Reviewed-by: Sunny Wang <sunny.wang@arm.com>

We still need Intel platforms' maintainers to review the patch below. All other patches (for ARM, RISC-V, and QEMU platforms) were already reviewed by maintainers.
    - [edk2-platforms PATCH v5 1/4] Intel Platforms: add SecureBootVariableLib class resolution

Best Regards,
Sunny Wang

-----Original Message-----
From: Grzegorz Bernacki <gjb@semihalf.com>
Sent: Thursday, July 1, 2021 5:21 PM
To: devel@edk2.groups.io
Cc: leif@nuviainc.com; ardb+tianocore@kernel.org; Samer El-Haj-Mahmoud <Samer.El-Haj-Mahmoud@arm.com>; Sunny Wang <Sunny.Wang@arm.com>; mw@semihalf.com; upstream@semihalf.com; jiewen.yao@intel.com; jian.j.wang@intel.com; min.m.xu@intel.com; lersek@redhat.com; Sami Mujawar <Sami.Mujawar@arm.com>; afish@apple.com; ray.ni@intel.com; jordan.l.justen@intel.com; rebecca@bsdio.com; grehan@freebsd.org; Thomas Abraham <thomas.abraham@arm.com>; chasel.chiu@intel.com; nathaniel.l.desimone@intel.com; gaoliming@byosoft.com.cn; eric.dong@intel.com; michael.d.kinney@intel.com; zailiang.sun@intel.com; yi.qian@intel.com; graeme@nuviainc.com; rad@semihalf.com; pete@akeo.ie; Grzegorz Bernacki <gjb@semihalf.com>
Subject: [edk2-platforms PATCH v5 0/4] Secure Boot default keys

This patchset is a consequence of "Secure Boot default keys"
patchset in edk2. It adds SecureBootVariableLib class resolution
for each platform which uses SecureBootConfigDxe and also
enables Secure Boot variables initialization for RPi4.
Previously these commits were part of edk2 patchset, but since
number of commits increased in v5 version, it is now separate
patchset.

Changes related to both edk2 & edk-platform versions:
Changes since v1:
- change names:
  SecBootVariableLib => SecureBootVariableLib
  SecBootDefaultKeysDxe => SecureBootDefaultKeysDxe
  SecEnrollDefaultKeysApp => EnrollFromDefaultKeysApp
- change name of function CheckSetupMode to GetSetupMode
- remove ShellPkg dependecy from EnrollFromDefaultKeysApp
- rebase to master

Changes since v2:
- fix coding style for functions headers in SecureBootVariableLib.h
- add header to SecureBootDefaultKeys.fdf.inc
- remove empty line spaces in SecureBootDefaultKeysDxe files
- revert FAIL macro in EnrollFromDefaultKeysApp
- remove functions duplicates and  add SecureBootVariableLib
  to platforms which used it

Changes since v3:
- move SecureBootDefaultKeys.fdf.inc to ArmPlatformPkg
- leave duplicate of CreateTimeBasedPayload in PlatformVarCleanupLib
- fix typo in guid description

Changes since v4:
- reorder patches to make it bisectable
- split commits related to more than one platform
- move edk2-platform commits to separate patchset

Grzegorz Bernacki (4):
  Intel Platforms: add SecureBootVariableLib class resolution
  ARM Silicon and Platforms: add SecureBootVariableLib class resolution
  RISC-V Platforms: add SecureBootVariableLib class resolution
  Platform/RaspberryPi: Enable default Secure Boot variables
    initialization

 Platform/ARM/VExpressPkg/ArmVExpress.dsc.inc                         | 1 +
 Platform/Intel/MinPlatformPkg/Include/Dsc/CoreCommonLib.dsc          | 1 +
 Platform/Intel/QuarkPlatformPkg/Quark.dsc                            | 1 +
 Platform/Intel/Vlv2TbltDevicePkg/PlatformPkgIA32.dsc                 | 1 +
 Platform/Intel/Vlv2TbltDevicePkg/PlatformPkgX64.dsc                  | 3 ++-
 Platform/Qemu/SbsaQemu/SbsaQemu.dsc                                  | 1 +
 Platform/RaspberryPi/RPi3/RPi3.dsc                                   | 1 +
 Platform/RaspberryPi/RPi4/RPi4.dsc                                   | 4 ++++
 Platform/SiFive/U5SeriesPkg/FreedomU500VC707Board/U500.dsc           | 1 +
 Platform/SiFive/U5SeriesPkg/FreedomU540HiFiveUnleashedBoard/U540.dsc | 1 +
 Platform/Socionext/DeveloperBox/DeveloperBox.dsc                     | 4 ++++
 Platform/RaspberryPi/RPi4/RPi4.fdf                                   | 2 ++
 12 files changed, 20 insertions(+), 1 deletion(-)

--
2.25.1

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

[-- Attachment #2: Type: message/rfc822, Size: 18686 bytes --]

From: Grzegorz Bernacki <gjb@semihalf.com>
To: "devel@edk2.groups.io" <devel@edk2.groups.io>
Cc: "leif@nuviainc.com" <leif@nuviainc.com>, "ardb+tianocore@kernel.org" <ardb+tianocore@kernel.org>, Samer El-Haj-Mahmoud <Samer.El-Haj-Mahmoud@arm.com>, Sunny Wang <Sunny.Wang@arm.com>, "mw@semihalf.com" <mw@semihalf.com>, "upstream@semihalf.com" <upstream@semihalf.com>, "jiewen.yao@intel.com" <jiewen.yao@intel.com>, "jian.j.wang@intel.com" <jian.j.wang@intel.com>, "min.m.xu@intel.com" <min.m.xu@intel.com>, "lersek@redhat.com" <lersek@redhat.com>, Sami Mujawar <Sami.Mujawar@arm.com>, "afish@apple.com" <afish@apple.com>, "ray.ni@intel.com" <ray.ni@intel.com>, "jordan.l.justen@intel.com" <jordan.l.justen@intel.com>, "rebecca@bsdio.com" <rebecca@bsdio.com>, "grehan@freebsd.org" <grehan@freebsd.org>, Thomas Abraham <thomas.abraham@arm.com>, "chasel.chiu@intel.com" <chasel.chiu@intel.com>, "nathaniel.l.desimone@intel.com" <nathaniel.l.desimone@intel.com>, "gaoliming@byosoft.com.cn" <gaoliming@byosoft.com.cn>, "eric.dong@intel.com" <eric.dong@intel.com>, "michael.d.kinney@intel.com" <michael.d.kinney@intel.com>, "zailiang.sun@intel.com" <zailiang.sun@intel.com>, "yi.qian@intel.com" <yi.qian@intel.com>, "graeme@nuviainc.com" <graeme@nuviainc.com>, "rad@semihalf.com" <rad@semihalf.com>, "pete@akeo.ie" <pete@akeo.ie>, Grzegorz Bernacki <gjb@semihalf.com>
Subject: [edk2-platforms PATCH v5 1/4] Intel Platforms: add SecureBootVariableLib class resolution
Date: Thu, 1 Jul 2021 09:20:48 +0000
Message-ID: <20210701092051.1057606-2-gjb@semihalf.com>

The edk2 patch
  SecurityPkg: Create library for setting Secure Boot variables.

removes generic functions from SecureBootConfigDxe and places
them into SecureBootVariableLib. This patch adds SecureBootVariableLib
mapping for each Intel platform which uses SecureBootConfigDxe.

Signed-off-by: Grzegorz Bernacki <gjb@semihalf.com>
---
 Platform/Intel/MinPlatformPkg/Include/Dsc/CoreCommonLib.dsc | 1 +
 Platform/Intel/QuarkPlatformPkg/Quark.dsc                   | 1 +
 Platform/Intel/Vlv2TbltDevicePkg/PlatformPkgIA32.dsc        | 1 +
 Platform/Intel/Vlv2TbltDevicePkg/PlatformPkgX64.dsc         | 3 ++-
 4 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/Platform/Intel/MinPlatformPkg/Include/Dsc/CoreCommonLib.dsc b/Platform/Intel/MinPlatformPkg/Include/Dsc/CoreCommonLib.dsc
index b154f9615d..5157c87a9a 100644
--- a/Platform/Intel/MinPlatformPkg/Include/Dsc/CoreCommonLib.dsc
+++ b/Platform/Intel/MinPlatformPkg/Include/Dsc/CoreCommonLib.dsc
@@ -139,6 +139,7 @@

 !if gMinPlatformPkgTokenSpaceGuid.PcdUefiSecureBootEnable == TRUE
   AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
+  SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
 !endif

   SafeIntLib|MdePkg/Library/BaseSafeIntLib/BaseSafeIntLib.inf
diff --git a/Platform/Intel/QuarkPlatformPkg/Quark.dsc b/Platform/Intel/QuarkPlatformPkg/Quark.dsc
index cc1eba4df4..35f99429f7 100644
--- a/Platform/Intel/QuarkPlatformPkg/Quark.dsc
+++ b/Platform/Intel/QuarkPlatformPkg/Quark.dsc
@@ -175,6 +175,7 @@
 !if $(SECURE_BOOT_ENABLE)
   PlatformSecureLib|QuarkPlatformPkg/Library/PlatformSecureLib/PlatformSecureLib.inf
   AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
+  SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
 !else
   AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
 !endif
diff --git a/Platform/Intel/Vlv2TbltDevicePkg/PlatformPkgIA32.dsc b/Platform/Intel/Vlv2TbltDevicePkg/PlatformPkgIA32.dsc
index d15da40819..5a0d3e31e1 100644
--- a/Platform/Intel/Vlv2TbltDevicePkg/PlatformPkgIA32.dsc
+++ b/Platform/Intel/Vlv2TbltDevicePkg/PlatformPkgIA32.dsc
@@ -227,6 +227,7 @@
 !if $(SECURE_BOOT_ENABLE) == TRUE
   PlatformSecureLib|SecurityPkg/Library/PlatformSecureLibNull/PlatformSecureLibNull.inf
   AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
+  SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
 !else
   AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
 !endif
diff --git a/Platform/Intel/Vlv2TbltDevicePkg/PlatformPkgX64.dsc b/Platform/Intel/Vlv2TbltDevicePkg/PlatformPkgX64.dsc
index 4a5548b80e..36a5ae333c 100644
--- a/Platform/Intel/Vlv2TbltDevicePkg/PlatformPkgX64.dsc
+++ b/Platform/Intel/Vlv2TbltDevicePkg/PlatformPkgX64.dsc
@@ -1,4 +1,4 @@
-#/** @file
+e
 # Platform description.
 #
 # Copyright (c) 2012  - 2021, Intel Corporation. All rights reserved.<BR>
@@ -229,6 +229,7 @@
 !if $(SECURE_BOOT_ENABLE) == TRUE
   PlatformSecureLib|SecurityPkg/Library/PlatformSecureLibNull/PlatformSecureLibNull.inf
   AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
+  SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
 !else
   AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf
 !endif
--
2.25.1