This whole patch series looks fine to me.
I have tested it on Raspberry Pi 4, and I have some changes lined up to
ensure that the next Pi 4 firmware we produce, after this series has
been integrated, can use the new feature.
For the record, since we are using an automated build system (and the Pi
4 can't exactly be considered as a secure platform anyway), my plan is
to discard the PK's private key and include only MS KEK and DBs for the
time being.
Basically, it should go something like this:
openssl req -new -x509 -newkey rsa:2048 -subj "/CN=Raspberry Pi Platform
Key/" -keyout /dev/null -outform DER -out keys/pk.cer -days 7300 -nodes
-sha256
curl -L https://go.microsoft.com/fwlink/?LinkId=321185 -o keys/ms_kek.cer
curl -L https://go.microsoft.com/fwlink/?linkid=321192 -o keys/ms_db1.crt
curl -L https://go.microsoft.com/fwlink/?linkid=321194 -o keys/ms_db2.crt
curl -L
https://uefi.org/sites/default/files/resources/dbxupdate_arm64.bin -o
keys/arm64_dbx.bin
and then use the files above for the DEFAULT_FILE vars.
With this, I was able to get the default keys installed using the new
Secure Boot menu, and validated that something like the Windows
bootloader would load properly, whereas an unsigned bootloader such as
the GRUB one wouldn't.
Please find my formal R-b for this patch below:
On 2021.06.01 14:12, Grzegorz Bernacki wrote:
This commit allows to initialize Secure Boot default key
and databases from data embedded in firmware binary.
Signed-off-by: Grzegorz Bernacki <g...@semihalf.com>
---
Platform/RaspberryPi/RPi4/RPi4.dsc | 5 ++++-
Platform/RaspberryPi/RPi4/RPi4.fdf | 2 ++
2 files changed, 6 insertions(+), 1 deletion(-)
diff --git a/Platform/RaspberryPi/RPi4/RPi4.dsc
b/Platform/RaspberryPi/RPi4/RPi4.dsc
index d8c6fdd4bd..1fb4df0b81 100644
--- a/Platform/RaspberryPi/RPi4/RPi4.dsc
+++ b/Platform/RaspberryPi/RPi4/RPi4.dsc
@@ -164,7 +164,7 @@
!if $(SECURE_BOOT_ENABLE) == TRUE
TpmMeasurementLib|SecurityPkg/Library/DxeTpmMeasurementLib/DxeTpmMeasurementLib.inf
AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
-
+
SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
# re-use the UserPhysicalPresent() dummy implementation from the ovmf tree
PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf
!else
@@ -217,6 +217,7 @@
MemoryAllocationLib|MdePkg/Library/UefiMemoryAllocationLib/UefiMemoryAllocationLib.inf
HiiLib|MdeModulePkg/Library/UefiHiiLib/UefiHiiLib.inf
ShellLib|ShellPkg/Library/UefiShellLib/UefiShellLib.inf
+ ShellCEntryLib|ShellPkg/Library/UefiShellCEntryLib/UefiShellCEntryLib.inf
FileHandleLib|MdePkg/Library/UefiFileHandleLib/UefiFileHandleLib.inf
[LibraryClasses.common.UEFI_DRIVER]
@@ -612,6 +613,8 @@
NULL|SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf
}
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
+ SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.inf
+
SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.inf
!else
MdeModulePkg/Universal/SecurityStubDxe/SecurityStubDxe.inf
!endif
diff --git a/Platform/RaspberryPi/RPi4/RPi4.fdf
b/Platform/RaspberryPi/RPi4/RPi4.fdf
index 1e13909a57..0e43d24c7a 100644
--- a/Platform/RaspberryPi/RPi4/RPi4.fdf
+++ b/Platform/RaspberryPi/RPi4/RPi4.fdf
@@ -189,7 +189,9 @@ READ_LOCK_STATUS = TRUE
INF MdeModulePkg/Universal/FaultTolerantWriteDxe/FaultTolerantWriteDxe.inf
INF MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
!if $(SECURE_BOOT_ENABLE) == TRUE
+!include SecurityPkg/SecureBootDefaultKeys.fdf.inc
INF
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf
+ INF
SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.inf
!endif
INF
MdeModulePkg/Universal/MonotonicCounterRuntimeDxe/MonotonicCounterRuntimeDxe.inf
INF EmbeddedPkg/ResetRuntimeDxe/ResetRuntimeDxe.inf
Reviewed-by: Pete Batard <p...@akeo.ie>
Tested-by: Pete Batard <p...@akeo.ie>
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#75993): https://edk2.groups.io/g/devel/message/75993
Mute This Topic: https://groups.io/mt/83232294/21656
Group Owner: devel+ow...@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com]
-=-=-=-=-=-=-=-=-=-=-=-
