From nobody Mon Feb 9 18:43:26 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) client-ip=66.175.222.108; envelope-from=bounce+27952+90493+1787277+3901457@groups.io; helo=mail02.groups.io; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+90493+1787277+3901457@groups.io; dmarc=fail(p=none dis=none) header.from=gmail.com ARC-Seal: i=1; a=rsa-sha256; t=1655152803; cv=none; d=zohomail.com; s=zohoarc; b=AM5ED2Iee42n/EI5sW5X+NDXVyFRH052ucbmVRRQfli3fkRuT04gs5FdX50BRXZq/OAvCy9TcLoJi/dX5JvbU/5+nEt92enXClHerPeJ8hfUymWdliIwARkSBIOoGoWT0C4kSfQdU8dMcXuiwH71z8r0Bla2NZy++524p4vSxrc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1655152803; h=Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:References:Sender:Subject:To; bh=jEssivv8oM6Go6HC9lFBY4GHqw1WqjbLdCY9ykoCJp0=; b=DI2WrlBMOxd9v+dea/AWARgrYuRKjTgVp9K1bQgUNU/jqaUlBq3RatNw+sf/6NXD8UPPUvbAqdMfuEdTSqnREBWiTZx4UU2iNxk/vqNwdxwwnINeLVRGa0efMH7xoM3tu8ps+e0VDofqIjrfcxPU5J7Qcv3Lleu9ynTLA1PuYVk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce+27952+90493+1787277+3901457@groups.io; dmarc=fail header.from= (p=none dis=none) Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by mx.zohomail.com with SMTPS id 1655152803639173.45684662853216; Mon, 13 Jun 2022 13:40:03 -0700 (PDT) Return-Path: X-Received: by 127.0.0.2 with SMTP id sGRaYY1788612x6VCLXJyjfP; Mon, 13 Jun 2022 13:40:00 -0700 X-Received: from mail-pl1-f180.google.com (mail-pl1-f180.google.com [209.85.214.180]) by mx.groups.io with SMTP id smtpd.web08.11156.1655152799464249408 for ; Mon, 13 Jun 2022 13:39:59 -0700 X-Received: by mail-pl1-f180.google.com with SMTP id d13so6026622plh.13 for ; Mon, 13 Jun 2022 13:39:59 -0700 (PDT) X-Gm-Message-State: dMU5ZrXkX1zXnjxE1m7B1UbAx1787277AA= X-Google-Smtp-Source: AGRyM1uKxdIuTHPwK3TMok49w75Y2IFDVgJflYTP9rs8+ckwsBRoXS6CKs06J8g+5lLIi6W9Xo6oWg== X-Received: by 2002:a17:90a:cc7:b0:1ea:3993:78f9 with SMTP id 7-20020a17090a0cc700b001ea399378f9mr542708pjt.179.1655152798744; Mon, 13 Jun 2022 13:39:58 -0700 (PDT) X-Received: from localhost.localdomain ([50.35.66.9]) by smtp.gmail.com with ESMTPSA id g14-20020a17090a578e00b001ea90dada74sm5603239pji.12.2022.06.13.13.39.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 13 Jun 2022 13:39:58 -0700 (PDT) From: "Kun Qin" To: devel@edk2.groups.io Cc: Jiewen Yao , Jian J Wang , Min Xu Subject: [edk2-devel] [PATCH v2 02/11] SecurityPkg: PlatformPKProtectionLib: Added PK protection interface Date: Mon, 13 Jun 2022 13:39:33 -0700 Message-Id: <20220613203943.704-3-kuqin12@gmail.com> In-Reply-To: <20220613203943.704-1-kuqin12@gmail.com> References: <20220613203943.704-1-kuqin12@gmail.com> MIME-Version: 1.0 Precedence: Bulk List-Unsubscribe: List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,kuqin12@gmail.com Content-Transfer-Encoding: quoted-printable DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=groups.io; q=dns/txt; s=20140610; t=1655152800; bh=/XganY96JQ4ZHEWHO/hEuyPis9LIunPl8FPkpcBKU9o=; h=Cc:Date:From:Reply-To:Subject:To; b=p3k1U05a/PG3WJBSZzesVpIAnsUWzb2231MwMYX9wVBDVTFbCFoYZqSbS00BhicoFBT 77dFcbbrmanrLQrT8+Ivhk91I5ArWLjjbaBlbZnJh8DeB2MQaF4Ov+q0HcuNZfO22Kq+0 8oO9R1xao15079Fdobl5m0lmL1mhAHf6JBY= X-ZohoMail-DKIM: pass (identity @groups.io) X-ZM-MESSAGEID: 1655152804693100003 Content-Type: text/plain; charset="utf-8" From: Kun Qin REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3911 This patch provides an abstracted interface for platform to implement PK variable related protection interface, which is designed to be used when PK variable is about to be changed by UEFI firmware. This change also provided a variable policy based library implementation to accomodate platforms that supports variable policy for variable protections. Cc: Jiewen Yao Cc: Jian J Wang Cc: Min Xu Signed-off-by: Kun Qin --- SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionL= ibVarPolicy.c | 51 ++++++++++++++++++++ SecurityPkg/Include/Library/PlatformPKProtectionLib.h = | 31 ++++++++++++ SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionL= ibVarPolicy.inf | 36 ++++++++++++++ SecurityPkg/SecurityPkg.dec = | 5 ++ SecurityPkg/SecurityPkg.dsc = | 2 + 5 files changed, 125 insertions(+) diff --git a/SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformP= KProtectionLibVarPolicy.c b/SecurityPkg/Library/PlatformPKProtectionLibVarP= olicy/PlatformPKProtectionLibVarPolicy.c new file mode 100644 index 000000000000..a2649242246f --- /dev/null +++ b/SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtec= tionLibVarPolicy.c @@ -0,0 +1,51 @@ +/** @file + Provides an abstracted interface for configuring PK related variable pro= tection. + + Copyright (c) Microsoft Corporation. + SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ +#include +#include + +#include +#include + +/** + Disable any applicable protection against variable 'PK'. The implementat= ion + of this interface is platform specific, depending on the protection tech= niques + used per platform. + + Note: It is the platform's responsibility to conduct cautious operation = after + disabling this protection. + + @retval EFI_SUCCESS State has been successfully updated. + @retval Others Error returned from implementation s= pecific + underying APIs. + +**/ +EFI_STATUS +EFIAPI +DisablePKProtection ( + VOID + ) +{ + EFI_STATUS Status; + EDKII_VARIABLE_POLICY_PROTOCOL *VariablePolicy; + + DEBUG ((DEBUG_INFO, "%a() Entry...\n", __FUNCTION__)); + + // IMPORTANT NOTE: This operation is sticky and leaves variable protecti= ons disabled. + // The system *MUST* be reset after performing this ope= ration. + Status =3D gBS->LocateProtocol (&gEdkiiVariablePolicyProtocolGuid, NULL,= (VOID **)&VariablePolicy); + if (!EFI_ERROR (Status)) { + Status =3D VariablePolicy->DisableVariablePolicy (); + // EFI_ALREADY_STARTED means that everything is currently disabled. + // This should be considered SUCCESS. + if (Status =3D=3D EFI_ALREADY_STARTED) { + Status =3D EFI_SUCCESS; + } + } + + return Status; +} diff --git a/SecurityPkg/Include/Library/PlatformPKProtectionLib.h b/Securi= tyPkg/Include/Library/PlatformPKProtectionLib.h new file mode 100644 index 000000000000..3586a47b77c2 --- /dev/null +++ b/SecurityPkg/Include/Library/PlatformPKProtectionLib.h @@ -0,0 +1,31 @@ +/** @file + Provides an abstracted interface for configuring PK related variable pro= tection. + + Copyright (c) Microsoft Corporation. + SPDX-License-Identifier: BSD-2-Clause-Patent + +**/ + +#ifndef PLATFORM_PK_PROTECTION_LIB_H_ +#define PLATFORM_PK_PROTECTION_LIB_H_ + +/** + Disable any applicable protection against variable 'PK'. The implementat= ion + of this interface is platform specific, depending on the protection tech= niques + used per platform. + + Note: It is the platform's responsibility to conduct cautious operation = after + disabling this protection. + + @retval EFI_SUCCESS State has been successfully updated. + @retval Others Error returned from implementation s= pecific + underying APIs. + +**/ +EFI_STATUS +EFIAPI +DisablePKProtection ( + VOID + ); + +#endif diff --git a/SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformP= KProtectionLibVarPolicy.inf b/SecurityPkg/Library/PlatformPKProtectionLibVa= rPolicy/PlatformPKProtectionLibVarPolicy.inf new file mode 100644 index 000000000000..df42ce06c019 --- /dev/null +++ b/SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtec= tionLibVarPolicy.inf @@ -0,0 +1,36 @@ +## @file +# Provides an abstracted interface for configuring PK related variable pr= otection. +# +# Copyright (c) Microsoft Corporation. +# SPDX-License-Identifier: BSD-2-Clause-Patent +# +## + +[Defines] + INF_VERSION =3D 0x00010005 + BASE_NAME =3D PlatformPKProtectionLibVarPolicy + FILE_GUID =3D AE0C5992-526C-4518-93BA-3C2611B801E0 + MODULE_TYPE =3D DXE_DRIVER + VERSION_STRING =3D 1.0 + LIBRARY_CLASS =3D PlatformPKProtectionLib|DXE_DRIVER DX= E_RUNTIME_DRIVER UEFI_APPLICATION + +# +# The following information is for reference only and not required by the = build tools. +# +# VALID_ARCHITECTURES =3D IA32 X64 AARCH64 +# + +[Sources] + PlatformPKProtectionLibVarPolicy.c + +[Packages] + MdePkg/MdePkg.dec + MdeModulePkg/MdeModulePkg.dec + SecurityPkg/SecurityPkg.dec + +[LibraryClasses] + DebugLib + UefiBootServicesTableLib + +[Protocols] + gEdkiiVariablePolicyProtocolGuid diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec index 0ee75efc1a97..7ecf9565d98c 100644 --- a/SecurityPkg/SecurityPkg.dec +++ b/SecurityPkg/SecurityPkg.dec @@ -99,6 +99,11 @@ [LibraryClasses] ## @libraryclass Provides support to enroll Secure Boot keys. # SecureBootVariableProvisionLib|Include/Library/SecureBootVariableProvisi= onLib.h + + ## @libraryclass Provides support to manage variable 'PK' related prote= ctions. + # + PlatformPKProtectionLib|Include/Library/PlatformPKProtectionLib.h + [Guids] ## Security package token space guid. # Include/Guid/SecurityPkgTokenSpace.h diff --git a/SecurityPkg/SecurityPkg.dsc b/SecurityPkg/SecurityPkg.dsc index d883747474e4..f48187650f2f 100644 --- a/SecurityPkg/SecurityPkg.dsc +++ b/SecurityPkg/SecurityPkg.dsc @@ -71,6 +71,7 @@ [LibraryClasses] TcgEventLogRecordLib|SecurityPkg/Library/TcgEventLogRecordLib/TcgEventLo= gRecordLib.inf MmUnblockMemoryLib|MdePkg/Library/MmUnblockMemoryLib/MmUnblockMemoryLibN= ull.inf SecureBootVariableLib|SecurityPkg/Library/SecureBootVariableLib/SecureBo= otVariableLib.inf + PlatformPKProtectionLib|SecurityPkg/Library/PlatformPKProtectionLibVarPo= licy/PlatformPKProtectionLibVarPolicy.inf SecureBootVariableProvisionLib|SecurityPkg/Library/SecureBootVariablePro= visionLib/SecureBootVariableProvisionLib.inf TdxLib|MdePkg/Library/TdxLib/TdxLib.inf =20 @@ -261,6 +262,7 @@ [Components] # SecurityPkg/Library/VariableKeyLibNull/VariableKeyLibNull.inf SecurityPkg/Library/RpmcLibNull/RpmcLibNull.inf + SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectio= nLibVarPolicy.inf =20 # # Other --=20 2.35.1.windows.2 -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#90493): https://edk2.groups.io/g/devel/message/90493 Mute This Topic: https://groups.io/mt/91735870/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-