From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: redhat.com, ip: 209.132.183.28, mailfrom: lersek@redhat.com) Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by groups.io with SMTP; Tue, 30 Apr 2019 05:32:40 -0700 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id D270030B4A5E; Tue, 30 Apr 2019 12:32:39 +0000 (UTC) Received: from lacos-laptop-7.usersys.redhat.com (ovpn-121-42.rdu2.redhat.com [10.10.121.42]) by smtp.corp.redhat.com (Postfix) with ESMTP id 199936D09D; Tue, 30 Apr 2019 12:32:37 +0000 (UTC) Subject: Re: [edk2-devel] [PATCH 00/16] OvmfPkg, ArmVirtPkg: upstream the EnrollDefaultKeys app From: "Laszlo Ersek" To: edk2-devel-groups-io Cc: Anthony Perard , Ard Biesheuvel , Jordan Justen , Julien Grall , Gary Lin Reply-To: devel@edk2.groups.io, lersek@redhat.com References: <20190427005328.27005-1-lersek@redhat.com> Message-ID: <21c64f8b-7b17-31d1-5aa8-a1803ab54e46@redhat.com> Date: Tue, 30 Apr 2019 14:32:36 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <20190427005328.27005-1-lersek@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.49]); Tue, 30 Apr 2019 12:32:39 +0000 (UTC) Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit On 04/27/19 02:53, Laszlo Ersek wrote: > Bugzilla: https://bugzilla.tianocore.org/show_bug.cgi?id=1747 > Repo: https://github.com/lersek/edk2.git > Branch: enroll_bz_1747 > > Please see the goal / use case in the BZ. > > Anatomy of the series: > > - Patch 01 adds the application as-is from RHEL, as the starting point > for upstreaming (preserves continuity). > > - Patches 02 through 13 clean up various coding style warts, and add > documentation, without functional changes. > > - Patches 14 through 16 replace the hard-coded Red Hat certificate > (enrolled as PK and 1st KEK) with a certificate read dynamically from > SMBIOS (enrolled the same way), originating from the VMM. > > I've successfully re-run the Secure Boot Logo Test in Windows HCK, after > enabling SB in the VM-under-test with this application. I'll attach the > test log in a separate email (sent in response to this one). > > Cc: Anthony Perard > Cc: Ard Biesheuvel > Cc: Jordan Justen > Cc: Julien Grall > > Thanks, > Laszlo > > Laszlo Ersek (16): > OvmfPkg: introduce EnrollDefaultKeys application > OvmfPkg/EnrollDefaultKeys: update @file comment blocks > OvmfPkg/EnrollDefaultKeys: refresh INF file > ArmVirtPkg: build EnrollDefaultKeys.efi > OvmfPkg/EnrollDefaultKeys: clean up minor whitespace wart > OvmfPkg/EnrollDefaultKeys: clean up global variable name prefixes > OvmfPkg/EnrollDefaultKeys: clean up acronym capitalization in > identifiers > OvmfPkg/EnrollDefaultKeys: remove unneeded EFIAPI call. conv. > specifiers > OvmfPkg/EnrollDefaultKeys: extract typedefs to a header file > OvmfPkg/EnrollDefaultKeys: split out certificate and signature > constants > OvmfPkg/EnrollDefaultKeys: extract MICROSOFT_VENDOR_GUID > OvmfPkg/EnrollDefaultKeys: describe functions with leading comment > blocks > OvmfPkg/EnrollDefaultKeys: document the steps of the entry point > function > OvmfPkg: introduce OVMF_PK_KEK1_APP_PREFIX_GUID > OvmfPkg/EnrollDefaultKeys: enroll PK/KEK1 from the Type 11 SMBIOS > table > OvmfPkg/EnrollDefaultKeys: remove Red Hat's hard-coded PK/KEK1 > > ArmVirtPkg/ArmVirt.dsc.inc | 1 + > ArmVirtPkg/ArmVirtQemu.dsc | 1 + > ArmVirtPkg/ArmVirtQemuKernel.dsc | 1 + > OvmfPkg/EnrollDefaultKeys/AuthData.c | 440 ++++++++++++ > OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c | 706 ++++++++++++++++++++ > OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.h | 138 ++++ > OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.inf | 52 ++ > OvmfPkg/Include/Guid/MicrosoftVendor.h | 55 ++ > OvmfPkg/Include/Guid/OvmfPkKek1AppPrefix.h | 45 ++ > OvmfPkg/OvmfPkg.dec | 2 + > OvmfPkg/OvmfPkgIa32.dsc | 2 + > OvmfPkg/OvmfPkgIa32X64.dsc | 2 + > OvmfPkg/OvmfPkgX64.dsc | 2 + > 13 files changed, 1447 insertions(+) > create mode 100644 OvmfPkg/EnrollDefaultKeys/AuthData.c > create mode 100644 OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.c > create mode 100644 OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.h > create mode 100644 OvmfPkg/EnrollDefaultKeys/EnrollDefaultKeys.inf > create mode 100644 OvmfPkg/Include/Guid/MicrosoftVendor.h > create mode 100644 OvmfPkg/Include/Guid/OvmfPkKek1AppPrefix.h > Thank you all for the quick reviews; the series has been pushed as commit range 137cbff041fc..9fb2ce2f465d. Cheers! Laszlo