From: "Laszlo Ersek" <lersek@redhat.com>
To: Ard Biesheuvel <ard.biesheuvel@linaro.org>,
edk2-devel-groups-io <devel@edk2.groups.io>
Cc: Anthony Perard <anthony.perard@citrix.com>,
Jordan Justen <jordan.l.justen@intel.com>,
Julien Grall <julien.grall@arm.com>, Gary Lin <glin@suse.com>
Subject: Re: [edk2-devel] [PATCH 00/16] OvmfPkg, ArmVirtPkg: upstream the EnrollDefaultKeys app
Date: Tue, 30 Apr 2019 22:04:51 +0200 [thread overview]
Message-ID: <1db9cbd8-c5ba-e793-9bef-d63942ee20eb@redhat.com> (raw)
In-Reply-To: <CAKv+Gu_0u9WrSw4aTcAwp1CBip=zpop8xdr-sPbb8JsWy+ohgg@mail.gmail.com>
On 04/30/19 21:42, Ard Biesheuvel wrote:
> On Tue, 30 Apr 2019 at 14:32, Laszlo Ersek <lersek@redhat.com> wrote:
>>
>> On 04/27/19 02:53, Laszlo Ersek wrote:
>>> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747
>>> Repo: https://github.com/lersek/edk2.git
>>> Branch: enroll_bz_1747
>>>
>>> Please see the goal / use case in the BZ.
>>>
>>> Anatomy of the series:
>>>
>>> - Patch 01 adds the application as-is from RHEL, as the starting point
>>> for upstreaming (preserves continuity).
>>>
>>> - Patches 02 through 13 clean up various coding style warts, and add
>>> documentation, without functional changes.
>>>
>>> - Patches 14 through 16 replace the hard-coded Red Hat certificate
>>> (enrolled as PK and 1st KEK) with a certificate read dynamically from
>>> SMBIOS (enrolled the same way), originating from the VMM.
>>>
>>> I've successfully re-run the Secure Boot Logo Test in Windows HCK, after
>>> enabling SB in the VM-under-test with this application. I'll attach the
>>> test log in a separate email (sent in response to this one).
>>>
>>> Cc: Anthony Perard <anthony.perard@citrix.com>
>>> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
>>> Cc: Jordan Justen <jordan.l.justen@intel.com>
>>> Cc: Julien Grall <julien.grall@arm.com>
>>>
>>> Thanks,
>>> Laszlo
>>>
>>> Laszlo Ersek (16):
>>> OvmfPkg: introduce EnrollDefaultKeys application
>>> OvmfPkg/EnrollDefaultKeys: update @file comment blocks
>>> OvmfPkg/EnrollDefaultKeys: refresh INF file
>>> ArmVirtPkg: build EnrollDefaultKeys.efi
>>> OvmfPkg/EnrollDefaultKeys: clean up minor whitespace wart
>>> OvmfPkg/EnrollDefaultKeys: clean up global variable name prefixes
>>> OvmfPkg/EnrollDefaultKeys: clean up acronym capitalization in
>>> identifiers
>>> OvmfPkg/EnrollDefaultKeys: remove unneeded EFIAPI call. conv.
>>> specifiers
>>> OvmfPkg/EnrollDefaultKeys: extract typedefs to a header file
>>> OvmfPkg/EnrollDefaultKeys: split out certificate and signature
>>> constants
>>> OvmfPkg/EnrollDefaultKeys: extract MICROSOFT_VENDOR_GUID
>>> OvmfPkg/EnrollDefaultKeys: describe functions with leading comment
>>> blocks
>>> OvmfPkg/EnrollDefaultKeys: document the steps of the entry point
>>> function
>>> OvmfPkg: introduce OVMF_PK_KEK1_APP_PREFIX_GUID
>>> OvmfPkg/EnrollDefaultKeys: enroll PK/KEK1 from the Type 11 SMBIOS
>>> table
>>> OvmfPkg/EnrollDefaultKeys: remove Red Hat's hard-coded PK/KEK1
>>>
>>> ArmVirtPkg/ArmVirt.dsc.inc | 1 +
>>> ArmVirtPkg/ArmVirtQemu.dsc | 1 +
>>> ArmVirtPkg/ArmVirtQemuKernel.dsc | 1 +
>>> OvmfPkg/EnrollDefaultKeys/AuthData.c | 440 ++++++++++++
>>> OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c | 706 ++++++++++++++++++++
>>> OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.h | 138 ++++
>>> OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.inf | 52 ++
>>> OvmfPkg/Include/Guid/MicrosoftVendor.h | 55 ++
>>> OvmfPkg/Include/Guid/OvmfPkKek1AppPrefix.h | 45 ++
>>> OvmfPkg/OvmfPkg.dec | 2 +
>>> OvmfPkg/OvmfPkgIa32.dsc | 2 +
>>> OvmfPkg/OvmfPkgIa32X64.dsc | 2 +
>>> OvmfPkg/OvmfPkgX64.dsc | 2 +
>>> 13 files changed, 1447 insertions(+)
>>> create mode 100644 OvmfPkg/EnrollDefaultKeys/AuthData.c
>>> create mode 100644 OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c
>>> create mode 100644 OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.h
>>> create mode 100644 OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.inf
>>> create mode 100644 OvmfPkg/Include/Guid/MicrosoftVendor.h
>>> create mode 100644 OvmfPkg/Include/Guid/OvmfPkKek1AppPrefix.h
>>>
>>
>> Thank you all for the quick reviews; the series has been pushed as
>> commit range 137cbff041fc..9fb2ce2f465d.
>>
>
> Unfortunately, it seems we are hitting another potential false
> positive with GCC48:
yep, false positive :/
> OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c: In function ‘ShellAppMain’:
> OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c:631:10: error:
> ‘SizeOfPkKek1’ may be used uninitialized in this function
> [-Werror=maybe-uninitialized]
> Status = EnrollListOfCerts (
> ^
> OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c:703:12: error: ‘PkKek1’
> may be used uninitialized in this function
> [-Werror=maybe-uninitialized]
> FreePool (PkKek1);
>
> Given the history, I wouldn't mind disabling this warning for GCC48
> altogether (assuming it doesn't trigger on other compilers - my CI job
> tries GCC48 first IIRC)
>
Suppressing this warning just for GCC48, without introducing partial
overlap between BaseTools and the following three INF files:
- CryptoPkg/Library/OpensslLib/OpensslLib.inf
- CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf
- MdeModulePkg/Universal/RegularExpressionDxe/RegularExpressionDxe.inf
doesn't look like an attractive task.
On the flipside, we have a dedicated kludge at least in
"ArmVirtPkg/Library/FdtPciHostBridgeLib/FdtPciHostBridgeLib.c".
I guess I'll try to send a patch soon, for "EnrollDefaultKeys.c". Sorry
about the breakage. :(
Thanks,
Laszlo
prev parent reply other threads:[~2019-04-30 20:05 UTC|newest]
Thread overview: 39+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-04-27 0:53 [PATCH 00/16] OvmfPkg, ArmVirtPkg: upstream the EnrollDefaultKeys app Laszlo Ersek
2019-04-27 0:53 ` [PATCH 01/16] OvmfPkg: introduce EnrollDefaultKeys application Laszlo Ersek
2019-04-30 5:21 ` [edk2-devel] " Philippe Mathieu-Daudé
2019-04-27 0:53 ` [PATCH 02/16] OvmfPkg/EnrollDefaultKeys: update @file comment blocks Laszlo Ersek
2019-04-30 5:13 ` [edk2-devel] " Philippe Mathieu-Daudé
2019-04-27 0:53 ` [PATCH 03/16] OvmfPkg/EnrollDefaultKeys: refresh INF file Laszlo Ersek
2019-04-29 12:25 ` [edk2-devel] " Philippe Mathieu-Daudé
2019-04-27 0:53 ` [PATCH 04/16] ArmVirtPkg: build EnrollDefaultKeys.efi Laszlo Ersek
2019-04-29 12:26 ` [edk2-devel] " Philippe Mathieu-Daudé
2019-04-27 0:53 ` [PATCH 05/16] OvmfPkg/EnrollDefaultKeys: clean up minor whitespace wart Laszlo Ersek
2019-04-29 12:26 ` [edk2-devel] " Philippe Mathieu-Daudé
2019-04-27 0:53 ` [PATCH 06/16] OvmfPkg/EnrollDefaultKeys: clean up global variable name prefixes Laszlo Ersek
2019-04-29 12:27 ` [edk2-devel] " Philippe Mathieu-Daudé
2019-04-27 0:53 ` [PATCH 07/16] OvmfPkg/EnrollDefaultKeys: clean up acronym capitalization in identifiers Laszlo Ersek
2019-04-30 5:10 ` [edk2-devel] " Philippe Mathieu-Daudé
2019-04-27 0:53 ` [PATCH 08/16] OvmfPkg/EnrollDefaultKeys: remove unneeded EFIAPI call. conv. specifiers Laszlo Ersek
2019-04-29 12:28 ` [edk2-devel] " Philippe Mathieu-Daudé
2019-04-27 0:53 ` [PATCH 09/16] OvmfPkg/EnrollDefaultKeys: extract typedefs to a header file Laszlo Ersek
2019-04-29 12:30 ` [edk2-devel] " Philippe Mathieu-Daudé
2019-04-27 0:53 ` [PATCH 10/16] OvmfPkg/EnrollDefaultKeys: split out certificate and signature constants Laszlo Ersek
2019-04-29 12:33 ` [edk2-devel] " Philippe Mathieu-Daudé
2019-04-27 0:53 ` [PATCH 11/16] OvmfPkg/EnrollDefaultKeys: extract MICROSOFT_VENDOR_GUID Laszlo Ersek
2019-04-30 5:11 ` [edk2-devel] " Philippe Mathieu-Daudé
2019-04-27 0:53 ` [PATCH 12/16] OvmfPkg/EnrollDefaultKeys: describe functions with leading comment blocks Laszlo Ersek
2019-04-30 5:12 ` [edk2-devel] " Philippe Mathieu-Daudé
2019-04-27 0:53 ` [PATCH 13/16] OvmfPkg/EnrollDefaultKeys: document the steps of the entry point function Laszlo Ersek
2019-04-29 12:36 ` [edk2-devel] " Philippe Mathieu-Daudé
2019-04-27 0:53 ` [PATCH 14/16] OvmfPkg: introduce OVMF_PK_KEK1_APP_PREFIX_GUID Laszlo Ersek
2019-04-30 5:24 ` [edk2-devel] " Philippe Mathieu-Daudé
2019-04-27 0:53 ` [PATCH 15/16] OvmfPkg/EnrollDefaultKeys: enroll PK/KEK1 from the Type 11 SMBIOS table Laszlo Ersek
2019-04-30 5:34 ` [edk2-devel] " Philippe Mathieu-Daudé
2019-04-27 0:53 ` [PATCH 16/16] OvmfPkg/EnrollDefaultKeys: remove Red Hat's hard-coded PK/KEK1 Laszlo Ersek
2019-04-30 5:35 ` [edk2-devel] " Philippe Mathieu-Daudé
2019-04-27 1:07 ` [edk2-devel] [PATCH 00/16] OvmfPkg, ArmVirtPkg: upstream the EnrollDefaultKeys app Laszlo Ersek
2019-04-27 8:14 ` Ard Biesheuvel
2019-04-30 7:51 ` [edk2-devel] " Gary Lin
2019-04-30 12:32 ` Laszlo Ersek
2019-04-30 19:42 ` Ard Biesheuvel
2019-04-30 20:04 ` Laszlo Ersek [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1db9cbd8-c5ba-e793-9bef-d63942ee20eb@redhat.com \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox