edk2/OvmfPkg/LoongArchVirt/Feature/SecureBoot/SecureBootKeys at master - uefi-ref/edk2

mirror of https://github.com/tianocore/edk2 synced 2026-08-27 00:23:19 -04:00

History

Dongyan Qian e98e311062 OvmfPkg/LoongArchVirt: Add Secure Boot key layout scaffolding Add the LoongArchVirt Secure Boot key directory layout and build wiring used for local validation and future platform-specific key provisioning. SECURE_BOOT_DEFAULT_KEYS remains disabled by default. Integrators may populate PK/KEK/db artifacts out of tree and enable the switch locally when validating embedded default-key enrollment flows. Default Secure Boot key can be enabled by setting SECURE_BOOT_DEFAULT_KEYS=TRUE during build. Test results: EFI UnSigned: Image is not signed and SHA1 hash of image is not found in DB/DBX. EFI Signed: MeasureVariable (Pcr - 7, EventType - 800000E0, VariableName - db, VendorGuid - xxx), MeasureBootPolicyVariable - Success. Signed-off-by: Dongyan Qian <qiandongyan@loongson.cn> Cc: Chao Li <lichao@loongson.cn> Cc: Bibo Mao <maobibo@loongson.cn> Cc: Xianglai Li <lixianglai@loongson.cn> Cc: Bo Zhu <zhubo@loongson.cn> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Ard Biesheuvel <ardb+tianocore@kernel.org> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Gerd Hoffmann <kraxel@redhat.com> Cc: Mike Beaton <mjsbeaton@gmail.com>	2026-03-20 01:33:21 +00:00
..
README.md	OvmfPkg/LoongArchVirt: Add Secure Boot key layout scaffolding	2026-03-20 01:33:21 +00:00

Dongyan Qian e98e311062 OvmfPkg/LoongArchVirt: Add Secure Boot key layout scaffolding

Add the LoongArchVirt Secure Boot key directory layout and build wiring used
for local validation and future platform-specific key provisioning.

SECURE_BOOT_DEFAULT_KEYS remains disabled by default. Integrators may populate
PK/KEK/db artifacts out of tree and enable the switch locally when validating
embedded default-key enrollment flows.

Default Secure Boot key can be enabled by setting SECURE_BOOT_DEFAULT_KEYS=TRUE during build.

Test results:
EFI UnSigned:
Image is not signed and SHA1 hash of image is not found in DB/DBX.
EFI Signed:
MeasureVariable (Pcr - 7, EventType - 800000E0, VariableName - db, VendorGuid - xxx),
MeasureBootPolicyVariable - Success.

Signed-off-by: Dongyan Qian <qiandongyan@loongson.cn>
Cc: Chao Li <lichao@loongson.cn>
Cc: Bibo Mao <maobibo@loongson.cn>
Cc: Xianglai Li <lixianglai@loongson.cn>
Cc: Bo Zhu <zhubo@loongson.cn>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Mike Beaton <mjsbeaton@gmail.com>

2026-03-20 01:33:21 +00:00

README.md

OvmfPkg/LoongArchVirt: Add Secure Boot key layout scaffolding

2026-03-20 01:33:21 +00:00

README.md

LoongArchVirt Secure Boot key placeholder layout.

This directory is reserved for platform-specific PK, KEK, db, and dbx artifacts when validating Secure Boot flows locally.

No default certificates or private keys are provided by the platform tree. If local testing needs embedded key material, add the files out of tree and wire them into the build explicitly.