[edk2-devel] [PATCH v4 00/28] UEFI variable protection

Judah Vang posted 28 patches 1 month, 2 weeks ago
Failed in applying to current master (apply log)
MdeModulePkg/MdeModulePkg.dec                                               |   13 +-
SecurityPkg/SecurityPkg.dec                                                 |   43 +-
ArmVirtPkg/ArmVirtQemu.dsc                                                  |    3 +-
EmulatorPkg/EmulatorPkg.dsc                                                 |    3 +-
MdeModulePkg/MdeModulePkg.dsc                                               |    4 +-
OvmfPkg/AmdSev/AmdSevX64.dsc                                                |    3 +-
OvmfPkg/Bhyve/BhyveX64.dsc                                                  |    3 +-
OvmfPkg/CloudHv/CloudHvX64.dsc                                              |    1 +
OvmfPkg/IntelTdx/IntelTdxX64.dsc                                            |    1 +
OvmfPkg/Microvm/MicrovmX64.dsc                                              |    3 +-
OvmfPkg/OvmfPkgIa32.dsc                                                     |    1 +
OvmfPkg/OvmfPkgIa32X64.dsc                                                  |    1 +
OvmfPkg/OvmfPkgX64.dsc                                                      |    1 +
OvmfPkg/OvmfXen.dsc                                                         |    3 +-
SecurityPkg/SecurityPkg.dsc                                                 |   13 +-
UefiPayloadPkg/UefiPayloadPkg.dsc                                           |    2 +
MdeModulePkg/Library/ProtectedVariableLibNull/ProtectedVariableLibNull.inf  |   34 +
MdeModulePkg/Universal/Variable/Pei/VariablePei.inf                         |   10 +-
MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf           |    3 +-
MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf                  |    3 +-
MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf        |    3 +-
MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf         |    3 +-
SecurityPkg/Library/EncryptionVariableLib/EncryptionVariableLib.inf         |   43 +
SecurityPkg/Library/EncryptionVariableLibNull/EncryptionVariableLibNull.inf |   34 +
SecurityPkg/Library/ProtectedVariableLib/DxeProtectedVariableLib.inf        |   64 +
SecurityPkg/Library/ProtectedVariableLib/PeiProtectedVariableLib.inf        |   68 +
SecurityPkg/Library/ProtectedVariableLib/SmmProtectedVariableLib.inf        |   67 +
SecurityPkg/Library/ProtectedVariableLib/SmmRuntimeProtectedVariableLib.inf |   62 +
SecurityPkg/Library/VariableKeyLib/VariableKeyLib.inf                       |   36 +
MdeModulePkg/Include/Guid/ProtectedVariable.h                               |   22 +
MdeModulePkg/Include/Library/AuthVariableLib.h                              |    4 +-
MdeModulePkg/Include/Library/EncryptionVariableLib.h                        |  165 ++
MdeModulePkg/Include/Library/ProtectedVariableLib.h                         |  607 ++++++
MdeModulePkg/Universal/Variable/Pei/Variable.h                              |   80 +-
MdeModulePkg/Universal/Variable/Pei/VariableParsing.h                       |  304 +++
MdeModulePkg/Universal/Variable/Pei/VariableStore.h                         |  116 ++
MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.h                       |  127 +-
MdeModulePkg/Universal/Variable/RuntimeDxe/VariableParsing.h                |   81 +-
MdePkg/Include/Ppi/ReadOnlyVariable2.h                                      |    4 +-
SecurityPkg/Include/Library/RpmcLib.h                                       |   15 +-
SecurityPkg/Include/Library/VariableKeyLib.h                                |   37 +-
SecurityPkg/Include/Ppi/KeyServicePpi.h                                     |   57 +
SecurityPkg/Library/EncryptionVariableLib/EncryptionVariable.h              |   49 +
SecurityPkg/Library/ProtectedVariableLib/ProtectedVariableInternal.h        |  611 ++++++
MdeModulePkg/Library/ProtectedVariableLibNull/ProtectedVariable.c           |  336 +++
MdeModulePkg/Universal/Variable/Pei/Variable.c                              |  890 ++------
MdeModulePkg/Universal/Variable/Pei/VariableParsing.c                       |  935 +++++++++
MdeModulePkg/Universal/Variable/Pei/VariableStore.c                         |  307 +++
MdeModulePkg/Universal/Variable/RuntimeDxe/Reclaim.c                        |  349 +++-
MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c                       | 2142 +++++++++++---------
MdeModulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c                    |   26 +-
MdeModulePkg/Universal/Variable/RuntimeDxe/VariableExLib.c                  |  167 +-
MdeModulePkg/Universal/Variable/RuntimeDxe/VariableNonVolatile.c            |  194 +-
MdeModulePkg/Universal/Variable/RuntimeDxe/VariableParsing.c                |  314 ++-
MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.c                    |   39 +-
MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c          |   66 +-
SecurityPkg/Library/EncryptionVariableLib/EncryptionVariable.c              |  734 +++++++
SecurityPkg/Library/EncryptionVariableLibNull/EncryptionVariable.c          |   92 +
SecurityPkg/Library/ProtectedVariableLib/ProtectedVariableCommon.c          | 2103 +++++++++++++++++++
SecurityPkg/Library/ProtectedVariableLib/ProtectedVariableDxe.c             |  163 ++
SecurityPkg/Library/ProtectedVariableLib/ProtectedVariablePei.c             | 1327 ++++++++++++
SecurityPkg/Library/ProtectedVariableLib/ProtectedVariableSmm.c             |  209 ++
SecurityPkg/Library/ProtectedVariableLib/ProtectedVariableSmmDxeCommon.c    |  967 +++++++++
SecurityPkg/Library/ProtectedVariableLib/ProtectedVariableSmmRuntime.c      |  233 +++
SecurityPkg/Library/RpmcLibNull/RpmcLibNull.c                               |    8 +-
SecurityPkg/Library/VariableKeyLib/VariableKeyLib.c                         |   59 +
SecurityPkg/Library/VariableKeyLibNull/VariableKeyLibNull.c                 |    8 +-
67 files changed, 12609 insertions(+), 1866 deletions(-)
create mode 100644 MdeModulePkg/Library/ProtectedVariableLibNull/ProtectedVariableLibNull.inf
create mode 100644 SecurityPkg/Library/EncryptionVariableLib/EncryptionVariableLib.inf
create mode 100644 SecurityPkg/Library/EncryptionVariableLibNull/EncryptionVariableLibNull.inf
create mode 100644 SecurityPkg/Library/ProtectedVariableLib/DxeProtectedVariableLib.inf
create mode 100644 SecurityPkg/Library/ProtectedVariableLib/PeiProtectedVariableLib.inf
create mode 100644 SecurityPkg/Library/ProtectedVariableLib/SmmProtectedVariableLib.inf
create mode 100644 SecurityPkg/Library/ProtectedVariableLib/SmmRuntimeProtectedVariableLib.inf
create mode 100644 SecurityPkg/Library/VariableKeyLib/VariableKeyLib.inf
create mode 100644 MdeModulePkg/Include/Guid/ProtectedVariable.h
create mode 100644 MdeModulePkg/Include/Library/EncryptionVariableLib.h
create mode 100644 MdeModulePkg/Include/Library/ProtectedVariableLib.h
create mode 100644 MdeModulePkg/Universal/Variable/Pei/VariableParsing.h
create mode 100644 MdeModulePkg/Universal/Variable/Pei/VariableStore.h
create mode 100644 SecurityPkg/Include/Ppi/KeyServicePpi.h
create mode 100644 SecurityPkg/Library/EncryptionVariableLib/EncryptionVariable.h
create mode 100644 SecurityPkg/Library/ProtectedVariableLib/ProtectedVariableInternal.h
create mode 100644 MdeModulePkg/Library/ProtectedVariableLibNull/ProtectedVariable.c
create mode 100644 MdeModulePkg/Universal/Variable/Pei/VariableParsing.c
create mode 100644 MdeModulePkg/Universal/Variable/Pei/VariableStore.c
create mode 100644 SecurityPkg/Library/EncryptionVariableLib/EncryptionVariable.c
create mode 100644 SecurityPkg/Library/EncryptionVariableLibNull/EncryptionVariable.c
create mode 100644 SecurityPkg/Library/ProtectedVariableLib/ProtectedVariableCommon.c
create mode 100644 SecurityPkg/Library/ProtectedVariableLib/ProtectedVariableDxe.c
create mode 100644 SecurityPkg/Library/ProtectedVariableLib/ProtectedVariablePei.c
create mode 100644 SecurityPkg/Library/ProtectedVariableLib/ProtectedVariableSmm.c
create mode 100644 SecurityPkg/Library/ProtectedVariableLib/ProtectedVariableSmmDxeCommon.c
create mode 100644 SecurityPkg/Library/ProtectedVariableLib/ProtectedVariableSmmRuntime.c
create mode 100644 SecurityPkg/Library/VariableKeyLib/VariableKeyLib.c
[edk2-devel] [PATCH v4 00/28] UEFI variable protection
Posted by Judah Vang 1 month, 2 weeks ago
Patch 04 - Updated with code review for misspellings, mismatch
function prototype, missing function header comments, incorrect
function description.

Patch 06 - Applied code review - removed APIs that are not being
used.

Patch 08 - Applied code review - remove unreferenced library from *.inf.
Updated some function description and parameters.

Patch 11 - revert copyright date change.

Patch 13 - Applied code review - function comments need to match
function prototype.

Patch 15 - Applied code review - Remove empty Guids section
from .inf file. Update description in *.c. Remove *.uni file
and reference to it.

Notes:
Some patches are reordered as suggested by code review due to
dependencies and some reordered to be next to its package.

Old Patch 01 "MdeModulePkg: Add new GUID for Variable Store Info"
needs to go after Old Patch 06 "MdeModulePkg: Add new include files"

Old Patch 02 "SecurityPkg: Add new GUIDs for" is moved to the
beginning of the SecurityPkg patches.

Old Patch 11 "SecurityPkg: Update RPMC APIs with index" needs to go
after old Patch 12 "SecurityPkg: Add new variable types and functions".

Old Patch 18 "MdeModulePkg: Reference Null ProtectedVariableLib" is moved
to the end of the MdeModulePkg patches.

Old Patch 28 - CryptoPkg: Enable cypto HMAC KDF and AES library is removed
from here and is being tracked separately.

New Patch 28 - OvmfPkg/IntelTdx requires NULL ProtectedVariableLib reference

Patch 01 --> 05
Patch 02 --> 10
Patch 03 --> 01
Patch 04 --> 02
Patch 05 --> 03
Patch 06 --> 04
Patch 07 --> 06
Patch 08 --> 07
Patch 09 --> 08
Patch 10 --> 11
Patch 11 --> 12
Patch 12 --> 13
Patch 13 --> 14
Patch 14 --> 15
Patch 15 --> 16
Patch 16 --> 17
Patch 17 --> 18
Patch 18 --> 09
The rest stayed with the same patch #

Judah Vang (28):
  MdeModulePkg: Update AUTH_VARIABLE_INFO struct
  MdeModulePkg: Add reference to new Ppi Guid
  MdeModulePkg: Add new ProtectedVariable GUIDs
  MdeModulePkg: Add new include files
  MdeModulePkg: Add new GUID for Variable Store Info
  MdeModulePkg: Add Null ProtectedVariable Library
  MdeModulePkg: Add new Variable functionality
  MdeModulePkg: Add support for Protected Variables
  MdeModulePkg: Reference Null ProtectedVariableLib
  SecurityPkg: Add new GUIDs for
  SecurityPkg: Add new KeyService types and defines
  SecurityPkg: Add new variable types and functions
  SecurityPkg: Update RPMC APIs with index
  SecurityPkg: Fix GetVariableKey API
  SecurityPkg: Add null encryption variable libs
  SecurityPkg: Add VariableKey library function
  SecurityPkg: Add EncryptionVariable lib with AES
  SecurityPkg: Add Protected Variable Services
  SecurityPkg: Add references to new *.inf files
  ArmVirtPkg: Add reference to ProtectedVariableNull
  UefiPayloadPkg: Add ProtectedVariable reference
  EmulatorPkg: Add ProtectedVariable reference
  OvmfPkg: Add ProtectedVariable reference
  OvmfPkg: Add ProtectedVariableLib reference
  OvmfPkg: Add ProtectedVariableLib reference
  OvmfPkg: Add ProtectedVariableLib reference
  OvmfPkg: Add ProtectedVariable reference
  IntelTdx: Add ProtectedVariable reference

 MdeModulePkg/MdeModulePkg.dec                                               |   13 +-
 SecurityPkg/SecurityPkg.dec                                                 |   43 +-
 ArmVirtPkg/ArmVirtQemu.dsc                                                  |    3 +-
 EmulatorPkg/EmulatorPkg.dsc                                                 |    3 +-
 MdeModulePkg/MdeModulePkg.dsc                                               |    4 +-
 OvmfPkg/AmdSev/AmdSevX64.dsc                                                |    3 +-
 OvmfPkg/Bhyve/BhyveX64.dsc                                                  |    3 +-
 OvmfPkg/CloudHv/CloudHvX64.dsc                                              |    1 +
 OvmfPkg/IntelTdx/IntelTdxX64.dsc                                            |    1 +
 OvmfPkg/Microvm/MicrovmX64.dsc                                              |    3 +-
 OvmfPkg/OvmfPkgIa32.dsc                                                     |    1 +
 OvmfPkg/OvmfPkgIa32X64.dsc                                                  |    1 +
 OvmfPkg/OvmfPkgX64.dsc                                                      |    1 +
 OvmfPkg/OvmfXen.dsc                                                         |    3 +-
 SecurityPkg/SecurityPkg.dsc                                                 |   13 +-
 UefiPayloadPkg/UefiPayloadPkg.dsc                                           |    2 +
 MdeModulePkg/Library/ProtectedVariableLibNull/ProtectedVariableLibNull.inf  |   34 +
 MdeModulePkg/Universal/Variable/Pei/VariablePei.inf                         |   10 +-
 MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf           |    3 +-
 MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf                  |    3 +-
 MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf        |    3 +-
 MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf         |    3 +-
 SecurityPkg/Library/EncryptionVariableLib/EncryptionVariableLib.inf         |   43 +
 SecurityPkg/Library/EncryptionVariableLibNull/EncryptionVariableLibNull.inf |   34 +
 SecurityPkg/Library/ProtectedVariableLib/DxeProtectedVariableLib.inf        |   64 +
 SecurityPkg/Library/ProtectedVariableLib/PeiProtectedVariableLib.inf        |   68 +
 SecurityPkg/Library/ProtectedVariableLib/SmmProtectedVariableLib.inf        |   67 +
 SecurityPkg/Library/ProtectedVariableLib/SmmRuntimeProtectedVariableLib.inf |   62 +
 SecurityPkg/Library/VariableKeyLib/VariableKeyLib.inf                       |   36 +
 MdeModulePkg/Include/Guid/ProtectedVariable.h                               |   22 +
 MdeModulePkg/Include/Library/AuthVariableLib.h                              |    4 +-
 MdeModulePkg/Include/Library/EncryptionVariableLib.h                        |  165 ++
 MdeModulePkg/Include/Library/ProtectedVariableLib.h                         |  607 ++++++
 MdeModulePkg/Universal/Variable/Pei/Variable.h                              |   80 +-
 MdeModulePkg/Universal/Variable/Pei/VariableParsing.h                       |  304 +++
 MdeModulePkg/Universal/Variable/Pei/VariableStore.h                         |  116 ++
 MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.h                       |  127 +-
 MdeModulePkg/Universal/Variable/RuntimeDxe/VariableParsing.h                |   81 +-
 MdePkg/Include/Ppi/ReadOnlyVariable2.h                                      |    4 +-
 SecurityPkg/Include/Library/RpmcLib.h                                       |   15 +-
 SecurityPkg/Include/Library/VariableKeyLib.h                                |   37 +-
 SecurityPkg/Include/Ppi/KeyServicePpi.h                                     |   57 +
 SecurityPkg/Library/EncryptionVariableLib/EncryptionVariable.h              |   49 +
 SecurityPkg/Library/ProtectedVariableLib/ProtectedVariableInternal.h        |  611 ++++++
 MdeModulePkg/Library/ProtectedVariableLibNull/ProtectedVariable.c           |  336 +++
 MdeModulePkg/Universal/Variable/Pei/Variable.c                              |  890 ++------
 MdeModulePkg/Universal/Variable/Pei/VariableParsing.c                       |  935 +++++++++
 MdeModulePkg/Universal/Variable/Pei/VariableStore.c                         |  307 +++
 MdeModulePkg/Universal/Variable/RuntimeDxe/Reclaim.c                        |  349 +++-
 MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c                       | 2142 +++++++++++---------
 MdeModulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c                    |   26 +-
 MdeModulePkg/Universal/Variable/RuntimeDxe/VariableExLib.c                  |  167 +-
 MdeModulePkg/Universal/Variable/RuntimeDxe/VariableNonVolatile.c            |  194 +-
 MdeModulePkg/Universal/Variable/RuntimeDxe/VariableParsing.c                |  314 ++-
 MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.c                    |   39 +-
 MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c          |   66 +-
 SecurityPkg/Library/EncryptionVariableLib/EncryptionVariable.c              |  734 +++++++
 SecurityPkg/Library/EncryptionVariableLibNull/EncryptionVariable.c          |   92 +
 SecurityPkg/Library/ProtectedVariableLib/ProtectedVariableCommon.c          | 2103 +++++++++++++++++++
 SecurityPkg/Library/ProtectedVariableLib/ProtectedVariableDxe.c             |  163 ++
 SecurityPkg/Library/ProtectedVariableLib/ProtectedVariablePei.c             | 1327 ++++++++++++
 SecurityPkg/Library/ProtectedVariableLib/ProtectedVariableSmm.c             |  209 ++
 SecurityPkg/Library/ProtectedVariableLib/ProtectedVariableSmmDxeCommon.c    |  967 +++++++++
 SecurityPkg/Library/ProtectedVariableLib/ProtectedVariableSmmRuntime.c      |  233 +++
 SecurityPkg/Library/RpmcLibNull/RpmcLibNull.c                               |    8 +-
 SecurityPkg/Library/VariableKeyLib/VariableKeyLib.c                         |   59 +
 SecurityPkg/Library/VariableKeyLibNull/VariableKeyLibNull.c                 |    8 +-
 67 files changed, 12609 insertions(+), 1866 deletions(-)
 create mode 100644 MdeModulePkg/Library/ProtectedVariableLibNull/ProtectedVariableLibNull.inf
 create mode 100644 SecurityPkg/Library/EncryptionVariableLib/EncryptionVariableLib.inf
 create mode 100644 SecurityPkg/Library/EncryptionVariableLibNull/EncryptionVariableLibNull.inf
 create mode 100644 SecurityPkg/Library/ProtectedVariableLib/DxeProtectedVariableLib.inf
 create mode 100644 SecurityPkg/Library/ProtectedVariableLib/PeiProtectedVariableLib.inf
 create mode 100644 SecurityPkg/Library/ProtectedVariableLib/SmmProtectedVariableLib.inf
 create mode 100644 SecurityPkg/Library/ProtectedVariableLib/SmmRuntimeProtectedVariableLib.inf
 create mode 100644 SecurityPkg/Library/VariableKeyLib/VariableKeyLib.inf
 create mode 100644 MdeModulePkg/Include/Guid/ProtectedVariable.h
 create mode 100644 MdeModulePkg/Include/Library/EncryptionVariableLib.h
 create mode 100644 MdeModulePkg/Include/Library/ProtectedVariableLib.h
 create mode 100644 MdeModulePkg/Universal/Variable/Pei/VariableParsing.h
 create mode 100644 MdeModulePkg/Universal/Variable/Pei/VariableStore.h
 create mode 100644 SecurityPkg/Include/Ppi/KeyServicePpi.h
 create mode 100644 SecurityPkg/Library/EncryptionVariableLib/EncryptionVariable.h
 create mode 100644 SecurityPkg/Library/ProtectedVariableLib/ProtectedVariableInternal.h
 create mode 100644 MdeModulePkg/Library/ProtectedVariableLibNull/ProtectedVariable.c
 create mode 100644 MdeModulePkg/Universal/Variable/Pei/VariableParsing.c
 create mode 100644 MdeModulePkg/Universal/Variable/Pei/VariableStore.c
 create mode 100644 SecurityPkg/Library/EncryptionVariableLib/EncryptionVariable.c
 create mode 100644 SecurityPkg/Library/EncryptionVariableLibNull/EncryptionVariable.c
 create mode 100644 SecurityPkg/Library/ProtectedVariableLib/ProtectedVariableCommon.c
 create mode 100644 SecurityPkg/Library/ProtectedVariableLib/ProtectedVariableDxe.c
 create mode 100644 SecurityPkg/Library/ProtectedVariableLib/ProtectedVariablePei.c
 create mode 100644 SecurityPkg/Library/ProtectedVariableLib/ProtectedVariableSmm.c
 create mode 100644 SecurityPkg/Library/ProtectedVariableLib/ProtectedVariableSmmDxeCommon.c
 create mode 100644 SecurityPkg/Library/ProtectedVariableLib/ProtectedVariableSmmRuntime.c
 create mode 100644 SecurityPkg/Library/VariableKeyLib/VariableKeyLib.c

-- 
2.35.1.windows.2



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#92344): https://edk2.groups.io/g/devel/message/92344
Mute This Topic: https://groups.io/mt/92953525/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-