From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: redhat.com, ip: 209.132.183.28, mailfrom: lersek@redhat.com) Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by groups.io with SMTP; Fri, 26 Apr 2019 17:53:37 -0700 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.phx2.redhat.com [10.5.11.15]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 0B9A030BC101; Sat, 27 Apr 2019 00:53:37 +0000 (UTC) Received: from lacos-laptop-7.usersys.redhat.com (ovpn-121-104.rdu2.redhat.com [10.10.121.104]) by smtp.corp.redhat.com (Postfix) with ESMTP id 0F5425D70A; Sat, 27 Apr 2019 00:53:34 +0000 (UTC) From: "Laszlo Ersek" To: edk2-devel-groups-io Cc: Anthony Perard , Ard Biesheuvel , Jordan Justen , Julien Grall Subject: [PATCH 00/16] OvmfPkg, ArmVirtPkg: upstream the EnrollDefaultKeys app Date: Sat, 27 Apr 2019 02:53:12 +0200 Message-Id: <20190427005328.27005-1-lersek@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.15 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.42]); Sat, 27 Apr 2019 00:53:37 +0000 (UTC) Content-Transfer-Encoding: quoted-printable Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=3D1747 Repo: https://github.com/lersek/edk2.git Branch: enroll_bz_1747 Please see the goal / use case in the BZ. Anatomy of the series: - Patch 01 adds the application as-is from RHEL, as the starting point for upstreaming (preserves continuity). - Patches 02 through 13 clean up various coding style warts, and add documentation, without functional changes. - Patches 14 through 16 replace the hard-coded Red Hat certificate (enrolled as PK and 1st KEK) with a certificate read dynamically from SMBIOS (enrolled the same way), originating from the VMM. I've successfully re-run the Secure Boot Logo Test in Windows HCK, after enabling SB in the VM-under-test with this application. I'll attach the test log in a separate email (sent in response to this one). Cc: Anthony Perard Cc: Ard Biesheuvel Cc: Jordan Justen Cc: Julien Grall Thanks, Laszlo Laszlo Ersek (16): OvmfPkg: introduce EnrollDefaultKeys application OvmfPkg/EnrollDefaultKeys: update @file comment blocks OvmfPkg/EnrollDefaultKeys: refresh INF file ArmVirtPkg: build EnrollDefaultKeys.efi OvmfPkg/EnrollDefaultKeys: clean up minor whitespace wart OvmfPkg/EnrollDefaultKeys: clean up global variable name prefixes OvmfPkg/EnrollDefaultKeys: clean up acronym capitalization in identifiers OvmfPkg/EnrollDefaultKeys: remove unneeded EFIAPI call. conv. specifiers OvmfPkg/EnrollDefaultKeys: extract typedefs to a header file OvmfPkg/EnrollDefaultKeys: split out certificate and signature constants OvmfPkg/EnrollDefaultKeys: extract MICROSOFT_VENDOR_GUID OvmfPkg/EnrollDefaultKeys: describe functions with leading comment blocks OvmfPkg/EnrollDefaultKeys: document the steps of the entry point function OvmfPkg: introduce OVMF_PK_KEK1_APP_PREFIX_GUID OvmfPkg/EnrollDefaultKeys: enroll PK/KEK1 from the Type 11 SMBIOS table OvmfPkg/EnrollDefaultKeys: remove Red Hat's hard-coded PK/KEK1 ArmVirtPkg/ArmVirt.dsc.inc | 1 + ArmVirtPkg/ArmVirtQemu.dsc | 1 + ArmVirtPkg/ArmVirtQemuKernel.dsc | 1 + OvmfPkg/EnrollDefaultKeys/AuthData.c | 440 ++++++++++++ OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c | 706 ++++++++++++++++++= ++ OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.h | 138 ++++ OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.inf | 52 ++ OvmfPkg/Include/Guid/MicrosoftVendor.h | 55 ++ OvmfPkg/Include/Guid/OvmfPkKek1AppPrefix.h | 45 ++ OvmfPkg/OvmfPkg.dec | 2 + OvmfPkg/OvmfPkgIa32.dsc | 2 + OvmfPkg/OvmfPkgIa32X64.dsc | 2 + OvmfPkg/OvmfPkgX64.dsc | 2 + 13 files changed, 1447 insertions(+) create mode 100644 OvmfPkg/EnrollDefaultKeys/AuthData.c create mode 100644 OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c create mode 100644 OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.h create mode 100644 OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.inf create mode 100644 OvmfPkg/Include/Guid/MicrosoftVendor.h create mode 100644 OvmfPkg/Include/Guid/OvmfPkKek1AppPrefix.h --=20 2.19.1.3.g30247aa5d201