From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f46.google.com (mail-pj1-f46.google.com [209.85.216.46]) by mx.groups.io with SMTP id smtpd.web08.207.1657129452075331098 for ; Wed, 06 Jul 2022 10:44:12 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@gmail.com header.s=20210112 header.b=PyK5vaEc; spf=pass (domain: gmail.com, ip: 209.85.216.46, mailfrom: kuqin12@gmail.com) Received: by mail-pj1-f46.google.com with SMTP id i8-20020a17090a4b8800b001ef8a65bfbdso8920489pjh.1 for ; Wed, 06 Jul 2022 10:44:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=message-id:date:mime-version:user-agent:subject:content-language:to :cc:references:from:in-reply-to; bh=IJeeLJyg+mRRSvOZVOTQ3rtHxlTeW7ajb2wpseZJ3y0=; b=PyK5vaEcik7SWvQG8Xus7qOZ4DbiZPageBcBYxTHunBfxmuF8qcJThxriNkaVaOAIS GlWwvhePCqg34OkNn1wucC730naeyKi1EnuZ8U5KxZJkuSt2f3Bj0Xuq8zw/H7FfWLM4 8Od9d+TGv4vJce0BnuVVt9lN6enjgxqpFcNUgbvUNh9YhK3NCArtzh3ykfU72H0lhOQJ 5k0ZyFjs4EI14VzgOsF6NSQpiP5KRvnZsN4qwAfZUN83JA61sEH+U567viWg0o5UOnKV fCOIIjxyWVzgQFCkILo5cYf8itRVlMcAWdSDrAo4wLuVJXeOElrE3i7O1QVW1eQN+8HR HKog== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:message-id:date:mime-version:user-agent:subject :content-language:to:cc:references:from:in-reply-to; bh=IJeeLJyg+mRRSvOZVOTQ3rtHxlTeW7ajb2wpseZJ3y0=; b=y2jtjz8IhX72CVTGIzS4UbT7aUohlL+a+WVS/3iOyJ2dezi1mGiCMWsaaAZDYUyqkl bd1H2QWPOjuP7gyqvMtQEzC5g/d1Jx4bpE0n7y+ujpZhZq+9PGR9jIwcgr7TS8zqajT9 ned6+dYe0TGEW/cCMaN6TA2mlz24Dz3WhemWZZwaPlksFu3xJm42nNgUK+SWyL92QE/u rqpEFvQONKkM/aTfjptEeMn3UOyUmQ3nBHmaWWZ1lJfkkfD+LW9TajEiRWeXSOWV4mgP AXBUMJPH2XM3gt+HfBIqPSKwqiV/X6RcHWDl8ysUbDxB7RlKX9Q87SSFOQaUIX/vgGSY +W+Q== X-Gm-Message-State: AJIora89ucaF25RqCl8/NgcezkftM8knJcegkMGvnuAtC3DCsdQPuLgS wQt+vllpIxjTlSfmRCC29v/W/BLaaes= X-Google-Smtp-Source: AGRyM1tZdRySA/8roPCAFXLlQfEa4hDiwYNCGgfk8ElJn5AmSqiOQvfyiycQMVjz+9f+Hxdjzaglpw== X-Received: by 2002:a17:902:d142:b0:16b:f014:9e6a with SMTP id t2-20020a170902d14200b0016bf0149e6amr11475519plt.64.1657129447294; Wed, 06 Jul 2022 10:44:07 -0700 (PDT) Return-Path: Received: from ?IPV6:2001:4898:d8:33:60eb:d662:ee8f:5777? ([2001:4898:80e8:2:e10b:d662:ee8f:5777]) by smtp.gmail.com with ESMTPSA id w1-20020a170902e88100b0016bfff199a6sm2090654plg.256.2022.07.06.10.44.06 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 06 Jul 2022 10:44:06 -0700 (PDT) Message-ID: <6769a533-64a8-e920-cce7-b228dbac2f92@gmail.com> Date: Wed, 6 Jul 2022 10:44:05 -0700 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Thunderbird/91.11.0 Subject: Re: [edk2-devel] [PATCH v3 00/11] Enhance Secure Boot Variable Libraries To: devel@edk2.groups.io, jiewen.yao@intel.com Cc: "Wang, Jian J" , "Xu, Min M" , Sean Brogan , Ard Biesheuvel , "Justen, Jordan L" , Gerd Hoffmann , Rebecca Cran , Peter Grehan , "Boeuf, Sebastien" , Andrew Fish , "Ni, Ray" References: <20220630235341.1746-1-kuqin12@gmail.com> From: "Kun Qin" In-Reply-To: Content-Type: multipart/alternative; boundary="------------FAU1fTWLLN5qSQbnYS8LQmcX" Content-Language: en-US --------------FAU1fTWLLN5qSQbnYS8LQmcX Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit Hi Jiewen, Yes, the "https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3" is the branch I generate these patch series. And they have not been changed after sending v3 patches. I confirm that: 1. the latest update 256220d82191effae32d91897ab0f65a4fa0641b is identical to the one I submitted to mailing list; 2. the branch passed EDKII CI when I prepared this branch and the PR is Secure boot enhance v3 by kuqin12 · Pull Request #3035 · tianocore/edk2 (github.com) . Thanks a lot for the help! Please let me know if you encounter any issues when merging these patches. Regards, Kun On 7/5/2022 10:19 PM, Yao, Jiewen wrote: > Hi > I am going to merge this. However, I realize that my mailbox filtered patch 6/11 and 10/11. > So I am going to merge the one inhttps://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3 > > Please double confirm: > 1) the latest one 256220d82191effae32d91897ab0f65a4fa0641b is identical to the one you submitted to EDKII mailing list. > 2) the latest one passed the EDKII CI. > > Once you confirm above, I will start merging process. > > Thank you > Yao Jiewen > >> -----Original Message----- >> From:devel@edk2.groups.io On Behalf Of Kun Qin >> Sent: Friday, July 1, 2022 7:54 AM >> To:devel@edk2.groups.io >> Cc: Yao, Jiewen; Wang, Jian J; >> Xu, Min M; Sean Brogan; >> Ard Biesheuvel; Justen, Jordan L >> ; Gerd Hoffmann; Rebecca >> Cran; Peter Grehan; Boeuf, >> Sebastien; Andrew Fish; Ni, >> Ray >> Subject: [edk2-devel] [PATCH v3 00/11] Enhance Secure Boot Variable Libraries >> >> REF:https://bugzilla.tianocore.org/show_bug.cgi?id=3909 >> REF:https://bugzilla.tianocore.org/show_bug.cgi?id=3910 >> REF:https://bugzilla.tianocore.org/show_bug.cgi?id=3911 >> >> This is a follow-up of a previously submitted patch series based on top >> of master branch:https://edk2.groups.io/g/devel/message/90491. >> >> The main changes between v2 and v3 patches are: >> - Added reviewed-by and acked-by tags collected from previous iteration >> - Updated default timestamp for default secure boot variable enrollment >> >> The updated changes are verified on QEMU based Q35 virtual platform as >> well as proprietary physical platforms. >> >> Patch v3 branch: >> https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3 >> >> Cc: Jiewen Yao >> Cc: Jian J Wang >> Cc: Min Xu >> Cc: Sean Brogan >> Cc: Ard Biesheuvel >> Cc: Jordan Justen >> Cc: Gerd Hoffmann >> Cc: Rebecca Cran >> Cc: Peter Grehan >> Cc: Sebastien Boeuf >> Cc: Andrew Fish >> Cc: Ray Ni >> >> Kun Qin (8): >> SecurityPkg: UefiSecureBoot: Definitions of cert and payload >> structures >> SecurityPkg: PlatformPKProtectionLib: Added PK protection interface >> SecurityPkg: SecureBootVariableLib: Updated time based payload creator >> SecurityPkg: SecureBootVariableProvisionLib: Updated implementation >> SecurityPkg: Secure Boot Drivers: Added common header files >> SecurityPkg: SecureBootConfigDxe: Updated invocation pattern >> OvmfPkg: Pipeline: Resolve SecureBootVariableLib dependency >> EmulatorPkg: Pipeline: Resolve SecureBootVariableLib dependency >> >> kuqin (3): >> SecurityPkg: SecureBootVariableLib: Updated signature list creator >> SecurityPkg: SecureBootVariableLib: Added newly supported interfaces >> SecurityPkg: SecureBootVariableLib: Added unit tests >> >> SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c >> | 1 + >> >> SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib >> VarPolicy.c | 51 + >> SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c >> | 485 ++++- >> >> SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio >> nLib.c | 36 + >> SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c >> | 201 ++ >> >> SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices >> TableLib.c | 13 + >> >> SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit >> Test.c | 2037 ++++++++++++++++++++ >> >> SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvisi >> onLib.c | 145 +- >> >> SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigIm >> pl.c | 128 +- >> >> SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefa >> ultKeysDxe.c | 1 + >> EmulatorPkg/EmulatorPkg.dsc | 1 + >> OvmfPkg/Bhyve/BhyveX64.dsc | 1 + >> OvmfPkg/CloudHv/CloudHvX64.dsc | 1 + >> OvmfPkg/IntelTdx/IntelTdxX64.dsc | 1 + >> OvmfPkg/OvmfPkgIa32.dsc | 1 + >> OvmfPkg/OvmfPkgIa32X64.dsc | 1 + >> OvmfPkg/OvmfPkgX64.dsc | 1 + >> SecurityPkg/Include/Library/PlatformPKProtectionLib.h | >> 31 + >> SecurityPkg/Include/Library/SecureBootVariableLib.h | >> 103 +- >> SecurityPkg/Include/UefiSecureBoot.h | 94 + >> >> SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib >> VarPolicy.inf | 36 + >> SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf >> | 14 +- >> >> SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio >> nLib.inf | 33 + >> SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf >> | 45 + >> >> SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices >> TableLib.inf | 25 + >> >> SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit >> Test.inf | 36 + >> SecurityPkg/SecurityPkg.ci.yaml | 11 + >> SecurityPkg/SecurityPkg.dec | 5 + >> SecurityPkg/SecurityPkg.dsc | 2 + >> SecurityPkg/Test/SecurityPkgHostTest.dsc | 38 + >> >> SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDx >> e.inf | 1 + >> 31 files changed, 3467 insertions(+), 112 deletions(-) >> create mode 100644 >> SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib >> VarPolicy.c >> create mode 100644 >> SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio >> nLib.c >> create mode 100644 >> SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c >> create mode 100644 >> SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices >> TableLib.c >> create mode 100644 >> SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit >> Test.c >> create mode 100644 SecurityPkg/Include/Library/PlatformPKProtectionLib.h >> create mode 100644 SecurityPkg/Include/UefiSecureBoot.h >> create mode 100644 >> SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib >> VarPolicy.inf >> create mode 100644 >> SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio >> nLib.inf >> create mode 100644 >> SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf >> create mode 100644 >> SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices >> TableLib.inf >> create mode 100644 >> SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit >> Test.inf >> create mode 100644 SecurityPkg/Test/SecurityPkgHostTest.dsc >> >> -- >> 2.36.0.windows.1 >> >> >> >> >> > > > > > --------------FAU1fTWLLN5qSQbnYS8LQmcX Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 8bit

Hi Jiewen,

Yes, the "https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3" is the branch I generate these patch series. And they have not been changed after sending v3 patches.

I confirm that:
1. the latest update 256220d82191effae32d91897ab0f65a4fa0641b is identical to the one I submitted to mailing list;
2. the branch passed EDKII CI when I prepared this branch and the PR is Secure boot enhance v3 by kuqin12 · Pull Request #3035 · tianocore/edk2 (github.com).

Thanks a lot for the help! Please let me know if you encounter any issues when merging these patches.

Regards,
Kun

On 7/5/2022 10:19 PM, Yao, Jiewen wrote:
Hi
I am going to merge this. However, I realize that my mailbox filtered patch 6/11 and 10/11.
So I am going to merge the one in https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3 

Please double confirm:
1) the latest one 256220d82191effae32d91897ab0f65a4fa0641b is identical to the one you submitted to EDKII mailing list.
2) the latest one passed the EDKII CI.

Once you confirm above, I will start merging process.

Thank you
Yao Jiewen


-----Original Message-----
From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Kun Qin
Sent: Friday, July 1, 2022 7:54 AM
To: devel@edk2.groups.io
Cc: Yao, Jiewen <jiewen.yao@intel.com>; Wang, Jian J <jian.j.wang@intel.com>;
Xu, Min M <min.m.xu@intel.com>; Sean Brogan <sean.brogan@microsoft.com>;
Ard Biesheuvel <ardb+tianocore@kernel.org>; Justen, Jordan L
<jordan.l.justen@intel.com>; Gerd Hoffmann <kraxel@redhat.com>; Rebecca
Cran <rebecca@bsdio.com>; Peter Grehan <grehan@freebsd.org>; Boeuf,
Sebastien <sebastien.boeuf@intel.com>; Andrew Fish <afish@apple.com>; Ni,
Ray <ray.ni@intel.com>
Subject: [edk2-devel] [PATCH v3 00/11] Enhance Secure Boot Variable Libraries

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3909
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3910
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3911

This is a follow-up of a previously submitted patch series based on top
of master branch: https://edk2.groups.io/g/devel/message/90491.

The main changes between v2 and v3 patches are:
  - Added reviewed-by and acked-by tags collected from previous iteration
  - Updated default timestamp for default secure boot variable enrollment

The updated changes are verified on QEMU based Q35 virtual platform as
well as proprietary physical platforms.

Patch v3 branch:
https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3

Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Min Xu <min.m.xu@intel.com>
Cc: Sean Brogan <sean.brogan@microsoft.com>
Cc: Ard Biesheuvel <ardb+tianocore@kernel.org>
Cc: Jordan Justen <jordan.l.justen@intel.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Rebecca Cran <rebecca@bsdio.com>
Cc: Peter Grehan <grehan@freebsd.org>
Cc: Sebastien Boeuf <sebastien.boeuf@intel.com>
Cc: Andrew Fish <afish@apple.com>
Cc: Ray Ni <ray.ni@intel.com>

Kun Qin (8):
  SecurityPkg: UefiSecureBoot: Definitions of cert and payload
    structures
  SecurityPkg: PlatformPKProtectionLib: Added PK protection interface
  SecurityPkg: SecureBootVariableLib: Updated time based payload creator
  SecurityPkg: SecureBootVariableProvisionLib: Updated implementation
  SecurityPkg: Secure Boot Drivers: Added common header files
  SecurityPkg: SecureBootConfigDxe: Updated invocation pattern
  OvmfPkg: Pipeline: Resolve SecureBootVariableLib dependency
  EmulatorPkg: Pipeline: Resolve SecureBootVariableLib dependency

kuqin (3):
  SecurityPkg: SecureBootVariableLib: Updated signature list creator
  SecurityPkg: SecureBootVariableLib: Added newly supported interfaces
  SecurityPkg: SecureBootVariableLib: Added unit tests

 SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c
|    1 +

SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib
VarPolicy.c   |   51 +
 SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c
|  485 ++++-

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio
nLib.c          |   36 +
 SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c
|  201 ++

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices
TableLib.c      |   13 +

SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit
Test.c        | 2037 ++++++++++++++++++++

SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvisi
onLib.c       |  145 +-

SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigIm
pl.c              |  128 +-

SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefa
ultKeysDxe.c     |    1 +
 EmulatorPkg/EmulatorPkg.dsc                                                               |    1 +
 OvmfPkg/Bhyve/BhyveX64.dsc                                                                |    1 +
 OvmfPkg/CloudHv/CloudHvX64.dsc                                                            |    1 +
 OvmfPkg/IntelTdx/IntelTdxX64.dsc                                                          |    1 +
 OvmfPkg/OvmfPkgIa32.dsc                                                                   |    1 +
 OvmfPkg/OvmfPkgIa32X64.dsc                                                                |    1 +
 OvmfPkg/OvmfPkgX64.dsc                                                                    |    1 +
 SecurityPkg/Include/Library/PlatformPKProtectionLib.h                                     |
31 +
 SecurityPkg/Include/Library/SecureBootVariableLib.h                                       |
103 +-
 SecurityPkg/Include/UefiSecureBoot.h                                                      |   94 +

SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib
VarPolicy.inf |   36 +
 SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
|   14 +-

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio
nLib.inf        |   33 +
 SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf
|   45 +

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices
TableLib.inf    |   25 +

SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit
Test.inf      |   36 +
 SecurityPkg/SecurityPkg.ci.yaml                                                           |   11 +
 SecurityPkg/SecurityPkg.dec                                                               |    5 +
 SecurityPkg/SecurityPkg.dsc                                                               |    2 +
 SecurityPkg/Test/SecurityPkgHostTest.dsc                                                  |   38 +

SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDx
e.inf             |    1 +
 31 files changed, 3467 insertions(+), 112 deletions(-)
 create mode 100644
SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib
VarPolicy.c
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio
nLib.c
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices
TableLib.c
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit
Test.c
 create mode 100644 SecurityPkg/Include/Library/PlatformPKProtectionLib.h
 create mode 100644 SecurityPkg/Include/UefiSecureBoot.h
 create mode 100644
SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib
VarPolicy.inf
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio
nLib.inf
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices
TableLib.inf
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit
Test.inf
 create mode 100644 SecurityPkg/Test/SecurityPkgHostTest.dsc

--
2.36.0.windows.1
--------------FAU1fTWLLN5qSQbnYS8LQmcX--