From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by mx.groups.io with SMTP id smtpd.web12.1375.1657298324723518010 for ; Fri, 08 Jul 2022 09:38:44 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=Oau6FaST; spf=pass (domain: kernel.org, ip: 139.178.84.217, mailfrom: ardb@kernel.org) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1F18B622B8 for ; Fri, 8 Jul 2022 16:38:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 910AFC341C0 for ; Fri, 8 Jul 2022 16:38:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1657298322; bh=CHfeysFdcXFVGB4IF/WVKAF/GmIwlmQa86cfCLxW59w=; h=References:In-Reply-To:From:Date:Subject:To:Cc:From; b=Oau6FaST0/fQrzELAQon9jc83hgHRo/slhQIqiZX0qaGoBeSwe10flb1zTNaxvaVH uOINqfwjvjkLXujcx6BAx6piWRfH7Ztb1oYFGcj5taV4SyWsnQiLH7T0OG/gEEqd+H INdFa8jOXKfVt4ZHycr9GvWpvI9TYbEkkeC8th+xWHGR8nl3JfboOXA1i0QYSRdhTK 969S1uwmVAQyg3AwriFHGdqZSHX+rZuEdxzG2sgCkuMbQt7jdaxY4J0qhaKViLfHro UetBTmfXT0r8vodBe/8Yko6YMl5drGr2LwvXNV4bJZYf/a6Yy4BqgXh8JWIjNqQF8l TklRfzIeZyKNA== Received: by mail-oa1-f52.google.com with SMTP id 586e51a60fabf-10bffc214ffso19193256fac.1 for ; Fri, 08 Jul 2022 09:38:42 -0700 (PDT) X-Gm-Message-State: AJIora8NsBuZnrnEAxwvMV9QSBdBwAy9Uz/rZU+xW3WLj5Qa2ezpX5AA 3/gEbWZqz0qWZ0bBQgAWeTMUUAPmJFdeDidne4w= X-Google-Smtp-Source: AGRyM1shShqCAjxOO3EbwkNC53Wsn7Q0S90YSkLaqiw5Fu6sYEBRt7qIwm922Byko9+WcBoKrC8W+yCI4iGxoDKlev8= X-Received: by 2002:a05:6870:5b91:b0:108:374a:96b0 with SMTP id em17-20020a0568705b9100b00108374a96b0mr440282oab.126.1657298321673; Fri, 08 Jul 2022 09:38:41 -0700 (PDT) MIME-Version: 1.0 References: <20220630235341.1746-1-kuqin12@gmail.com> <6769a533-64a8-e920-cce7-b228dbac2f92@gmail.com> In-Reply-To: From: "Ard Biesheuvel" Date: Fri, 8 Jul 2022 18:38:30 +0200 X-Gmail-Original-Message-ID: Message-ID: Subject: Re: [edk2-devel] [PATCH v3 00/11] Enhance Secure Boot Variable Libraries To: edk2-devel-groups-io , Jiewen Yao Cc: Kun Qin , "Wang, Jian J" , "Xu, Min M" , Sean Brogan , Ard Biesheuvel , "Justen, Jordan L" , Gerd Hoffmann , Rebecca Cran , Peter Grehan , "Boeuf, Sebastien" , Andrew Fish , "Ni, Ray" Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I think this series has broken some ARM platforms, please double check. https://ci.linaro.org/job/leg-virt-tianocore-edk2-upstream/4573/console On Thu, 7 Jul 2022 at 03:09, Yao, Jiewen wrote: > > Merged https://github.com/tianocore/edk2/pull/3050 > > > > From: Kun Qin > Sent: Thursday, July 7, 2022 1:44 AM > To: devel@edk2.groups.io; Yao, Jiewen > Cc: Wang, Jian J ; Xu, Min M ;= Sean Brogan ; Ard Biesheuvel ; Justen, Jordan L ; Gerd Hoffmann ; Rebecca Cran ; Peter Grehan ; Boeuf, Sebastien ; Andrew Fish ; Ni, Ray > Subject: Re: [edk2-devel] [PATCH v3 00/11] Enhance Secure Boot Variable L= ibraries > > > > Hi Jiewen, > > Yes, the "https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3" is= the branch I generate these patch series. And they have not been changed a= fter sending v3 patches. > > I confirm that: > 1. the latest update 256220d82191effae32d91897ab0f65a4fa0641b is identica= l to the one I submitted to mailing list; > 2. the branch passed EDKII CI when I prepared this branch and the PR is S= ecure boot enhance v3 by kuqin12 =C2=B7 Pull Request #3035 =C2=B7 tianocore= /edk2 (github.com). > > Thanks a lot for the help! Please let me know if you encounter any issues= when merging these patches. > > Regards, > Kun > > On 7/5/2022 10:19 PM, Yao, Jiewen wrote: > > Hi > > I am going to merge this. However, I realize that my mailbox filtered pat= ch 6/11 and 10/11. > > So I am going to merge the one in https://github.com/kuqin12/edk2/tree/se= cure_boot_enhance_v3 > > > > Please double confirm: > > 1) the latest one 256220d82191effae32d91897ab0f65a4fa0641b is identical t= o the one you submitted to EDKII mailing list. > > 2) the latest one passed the EDKII CI. > > > > Once you confirm above, I will start merging process. > > > > Thank you > > Yao Jiewen > > > > -----Original Message----- > > From: devel@edk2.groups.io On Behalf Of Kun Qin > > Sent: Friday, July 1, 2022 7:54 AM > > To: devel@edk2.groups.io > > Cc: Yao, Jiewen ; Wang, Jian J ; > > Xu, Min M ; Sean Brogan ; > > Ard Biesheuvel ; Justen, Jordan L > > ; Gerd Hoffmann ; Rebecca > > Cran ; Peter Grehan ; Boeuf, > > Sebastien ; Andrew Fish ; Ni, > > Ray > > Subject: [edk2-devel] [PATCH v3 00/11] Enhance Secure Boot Variable Libra= ries > > > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3909 > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3910 > > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3911 > > > > This is a follow-up of a previously submitted patch series based on top > > of master branch: https://edk2.groups.io/g/devel/message/90491. > > > > The main changes between v2 and v3 patches are: > > - Added reviewed-by and acked-by tags collected from previous iteration > > - Updated default timestamp for default secure boot variable enrollment > > > > The updated changes are verified on QEMU based Q35 virtual platform as > > well as proprietary physical platforms. > > > > Patch v3 branch: > > https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3 > > > > Cc: Jiewen Yao > > Cc: Jian J Wang > > Cc: Min Xu > > Cc: Sean Brogan > > Cc: Ard Biesheuvel > > Cc: Jordan Justen > > Cc: Gerd Hoffmann > > Cc: Rebecca Cran > > Cc: Peter Grehan > > Cc: Sebastien Boeuf > > Cc: Andrew Fish > > Cc: Ray Ni > > > > Kun Qin (8): > > SecurityPkg: UefiSecureBoot: Definitions of cert and payload > > structures > > SecurityPkg: PlatformPKProtectionLib: Added PK protection interface > > SecurityPkg: SecureBootVariableLib: Updated time based payload creator > > SecurityPkg: SecureBootVariableProvisionLib: Updated implementation > > SecurityPkg: Secure Boot Drivers: Added common header files > > SecurityPkg: SecureBootConfigDxe: Updated invocation pattern > > OvmfPkg: Pipeline: Resolve SecureBootVariableLib dependency > > EmulatorPkg: Pipeline: Resolve SecureBootVariableLib dependency > > > > kuqin (3): > > SecurityPkg: SecureBootVariableLib: Updated signature list creator > > SecurityPkg: SecureBootVariableLib: Added newly supported interfaces > > SecurityPkg: SecureBootVariableLib: Added unit tests > > > > SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c > > | 1 + > > > > SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtection= Lib > > VarPolicy.c | 51 + > > SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c > > | 485 ++++- > > > > SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtecti= o > > nLib.c | 36 + > > SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c > > | 201 ++ > > > > SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeService= s > > TableLib.c | 13 + > > > > SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibU= nit > > Test.c | 2037 ++++++++++++++++++++ > > > > SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProv= isi > > onLib.c | 145 +- > > > > SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigIm > > pl.c | 128 +- > > > > SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefa > > ultKeysDxe.c | 1 + > > EmulatorPkg/EmulatorPkg.dsc = | 1 + > > OvmfPkg/Bhyve/BhyveX64.dsc = | 1 + > > OvmfPkg/CloudHv/CloudHvX64.dsc = | 1 + > > OvmfPkg/IntelTdx/IntelTdxX64.dsc = | 1 + > > OvmfPkg/OvmfPkgIa32.dsc = | 1 + > > OvmfPkg/OvmfPkgIa32X64.dsc = | 1 + > > OvmfPkg/OvmfPkgX64.dsc = | 1 + > > SecurityPkg/Include/Library/PlatformPKProtectionLib.h = | > > 31 + > > SecurityPkg/Include/Library/SecureBootVariableLib.h = | > > 103 +- > > SecurityPkg/Include/UefiSecureBoot.h = | 94 + > > > > SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtection= Lib > > VarPolicy.inf | 36 + > > SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf > > | 14 +- > > > > SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtecti= o > > nLib.inf | 33 + > > SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf > > | 45 + > > > > SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeService= s > > TableLib.inf | 25 + > > > > SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibU= nit > > Test.inf | 36 + > > SecurityPkg/SecurityPkg.ci.yaml = | 11 + > > SecurityPkg/SecurityPkg.dec = | 5 + > > SecurityPkg/SecurityPkg.dsc = | 2 + > > SecurityPkg/Test/SecurityPkgHostTest.dsc = | 38 + > > > > SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDx > > e.inf | 1 + > > 31 files changed, 3467 insertions(+), 112 deletions(-) > > create mode 100644 > > SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtection= Lib > > VarPolicy.c > > create mode 100644 > > SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtecti= o > > nLib.c > > create mode 100644 > > SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c > > create mode 100644 > > SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeService= s > > TableLib.c > > create mode 100644 > > SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibU= nit > > Test.c > > create mode 100644 SecurityPkg/Include/Library/PlatformPKProtectionLib.h > > create mode 100644 SecurityPkg/Include/UefiSecureBoot.h > > create mode 100644 > > SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtection= Lib > > VarPolicy.inf > > create mode 100644 > > SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtecti= o > > nLib.inf > > create mode 100644 > > SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf > > create mode 100644 > > SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeService= s > > TableLib.inf > > create mode 100644 > > SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibU= nit > > Test.inf > > create mode 100644 SecurityPkg/Test/SecurityPkgHostTest.dsc > > > > -- > > 2.36.0.windows.1 > > > > > > > > > > > > > > > > > > > > > >=20