WIP: Dasharo UEFI Secure Boot support in QEMU Q35 #106
Conversation
Extedn OvmfPkgX64 DSC and FDF to support adding externally build ipxe.efi file in similar way as other Dasharo supported platforms do. This patch requires improvements in PlatformBootmanagerLib to register bootable iPXE option. Despite it does not have that yet it is first step to enable iPXE support in Dasharo EDK II for QEMU Q35. In long run it should allow enabling other Dasharo System Features like enabling/disabling network stack. Signed-off-by: Piotr Król <[email protected]>
OvmfPkg implementation of PlatformBootManagerLib was different than UefiPayloadPkg implementation, becuase of that there were problems in porting one to one code that register and unregister iPXE file as boot option. PlatformBootManagerLib PlatformRegisterFvBootOption gined BootNow parameter and PlatformUnregisterFvBootOption function. Signed-off-by: Piotr Król <[email protected]>
* Add ipxe.efi to the firmware volume. * Based on NetBootEnable UEFI variable register or unregister iPXE as boot option. Signed-off-by: Piotr Król <[email protected]>
Add support to build ipxe.efi and use it in Dasharo (UEFI) build for QEMU Q35. Signed-off-by: Piotr Król <[email protected]>
Signed-off-by: Piotr Król <[email protected]>
Provide gUefiPayloadPkgTokenSpaceGuid.PcdiPXEOptionName PCD as build time option in ./github/scripts/build-qemu.sh Signed-off-by: Piotr Król <[email protected]>
Signed-off-by: Piotr Król <[email protected]>
Remove iPXE option name as built time paramater to keep Dasharo (UEFI) build for QEMU Q35 as close to UefiPayloadPkg as possible. Signed-off-by: Piotr Król <[email protected]>
|
@pietrushnic Was anything missing in this MR? |
pietrushnic
changed the title
|
@pietrushnic So I guess we do not need this anymore? SB works for me from the main branch (except the keys are reset by default, which is different than on real HW). |
@macpijan most likely yes. So far I have not introduced any EDK II modifications related to secure boot, but we didn't test it comprehensively.
I don't understand that part. From what I see I can't enable secure boot if I do not reset keys which equals to provisioning default PK, db, dbx and KEK: https://docs.dasharo.com/dasharo-menu-docs/device-manager/#custom-mode-and-key-management) |
On the QEMU you cannot, on the hardware you can. The initial behavior is different, that the default keys on the HW are already provisioned after flashing. |
|
I could pass SB tests without these changes: Dasharo/open-source-firmware-validation#118 (comment) |
Fixes Dasharo/dasharo-issues#550
Closes #104