From mboxrd@z Thu Jan  1 00:00:00 1970
Authentication-Results: mx.groups.io;
 dkim=missing; spf=pass (domain: suse.com, ip: 195.135.221.5, mailfrom: glin@suse.com)
Received: from smtp.nue.novell.com (smtp.nue.novell.com [195.135.221.5])
 by groups.io with SMTP; Tue, 30 Apr 2019 00:52:07 -0700
Received: from emea4-mta.ukb.novell.com ([10.120.13.87])
	by smtp.nue.novell.com with ESMTP (TLS encrypted); Tue, 30 Apr 2019 09:52:04 +0200
Received: from GaryWorkstation (nwb-a10-snat.microfocus.com [10.120.13.201])
	by emea4-mta.ukb.novell.com with ESMTP (TLS encrypted); Tue, 30 Apr 2019 08:51:37 +0100
Date: Tue, 30 Apr 2019 15:51:32 +0800
From: "Gary Lin" <glin@suse.com>
To: devel@edk2.groups.io, lersek@redhat.com
Cc: Anthony Perard <anthony.perard@citrix.com>,
	Ard Biesheuvel <ard.biesheuvel@linaro.org>,
	Jordan Justen <jordan.l.justen@intel.com>,
	Julien Grall <julien.grall@arm.com>
Subject: Re: [edk2-devel] [PATCH 00/16] OvmfPkg, ArmVirtPkg: upstream the EnrollDefaultKeys app
Message-ID: <20190430075132.GF12813@GaryWorkstation>
References: <20190427005328.27005-1-lersek@redhat.com>
MIME-Version: 1.0
In-Reply-To: <20190427005328.27005-1-lersek@redhat.com>
User-Agent: Mutt/1.11.3 (2019-02-01)
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

On Sat, Apr 27, 2019 at 02:53:12AM +0200, Laszlo Ersek wrote:
> Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747
> Repo:     https://github.com/lersek/edk2.git
> Branch:   enroll_bz_1747
> 
> Please see the goal / use case in the BZ.
> 
> Anatomy of the series:
> 
> - Patch 01 adds the application as-is from RHEL, as the starting point
>   for upstreaming (preserves continuity).
> 
> - Patches 02 through 13 clean up various coding style warts, and add
>   documentation, without functional changes.
> 
> - Patches 14 through 16 replace the hard-coded Red Hat certificate
>   (enrolled as PK and 1st KEK) with a certificate read dynamically from
>   SMBIOS (enrolled the same way), originating from the VMM.
> 
> I've successfully re-run the Secure Boot Logo Test in Windows HCK, after
> enabling SB in the VM-under-test with this application. I'll attach the
> test log in a separate email (sent in response to this one).
> 
For the series, Reviewed-by: Gary Lin <glin@suse.com>

> Cc: Anthony Perard <anthony.perard@citrix.com>
> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
> Cc: Jordan Justen <jordan.l.justen@intel.com>
> Cc: Julien Grall <julien.grall@arm.com>
> 
> Thanks,
> Laszlo
> 
> Laszlo Ersek (16):
>   OvmfPkg: introduce EnrollDefaultKeys application
>   OvmfPkg/EnrollDefaultKeys: update @file comment blocks
>   OvmfPkg/EnrollDefaultKeys: refresh INF file
>   ArmVirtPkg: build EnrollDefaultKeys.efi
>   OvmfPkg/EnrollDefaultKeys: clean up minor whitespace wart
>   OvmfPkg/EnrollDefaultKeys: clean up global variable name prefixes
>   OvmfPkg/EnrollDefaultKeys: clean up acronym capitalization in
>     identifiers
>   OvmfPkg/EnrollDefaultKeys: remove unneeded EFIAPI call. conv.
>     specifiers
>   OvmfPkg/EnrollDefaultKeys: extract typedefs to a header file
>   OvmfPkg/EnrollDefaultKeys: split out certificate and signature
>     constants
>   OvmfPkg/EnrollDefaultKeys: extract MICROSOFT_VENDOR_GUID
>   OvmfPkg/EnrollDefaultKeys: describe functions with leading comment
>     blocks
>   OvmfPkg/EnrollDefaultKeys: document the steps of the entry point
>     function
>   OvmfPkg: introduce OVMF_PK_KEK1_APP_PREFIX_GUID
>   OvmfPkg/EnrollDefaultKeys: enroll PK/KEK1 from the Type 11 SMBIOS
>     table
>   OvmfPkg/EnrollDefaultKeys: remove Red Hat's hard-coded PK/KEK1
> 
>  ArmVirtPkg/ArmVirt.dsc.inc                      |   1 +
>  ArmVirtPkg/ArmVirtQemu.dsc                      |   1 +
>  ArmVirtPkg/ArmVirtQemuKernel.dsc                |   1 +
>  OvmfPkg/EnrollDefaultKeys/AuthData.c            | 440 ++++++++++++
>  OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c   | 706 ++++++++++++++++++++
>  OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.h   | 138 ++++
>  OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.inf |  52 ++
>  OvmfPkg/Include/Guid/MicrosoftVendor.h          |  55 ++
>  OvmfPkg/Include/Guid/OvmfPkKek1AppPrefix.h      |  45 ++
>  OvmfPkg/OvmfPkg.dec                             |   2 +
>  OvmfPkg/OvmfPkgIa32.dsc                         |   2 +
>  OvmfPkg/OvmfPkgIa32X64.dsc                      |   2 +
>  OvmfPkg/OvmfPkgX64.dsc                          |   2 +
>  13 files changed, 1447 insertions(+)
>  create mode 100644 OvmfPkg/EnrollDefaultKeys/AuthData.c
>  create mode 100644 OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c
>  create mode 100644 OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.h
>  create mode 100644 OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.inf
>  create mode 100644 OvmfPkg/Include/Guid/MicrosoftVendor.h
>  create mode 100644 OvmfPkg/Include/Guid/OvmfPkKek1AppPrefix.h
> 
> -- 
> 2.19.1.3.g30247aa5d201
> 
> 
> 
> 
>