[PATCH v3 00/11] Enhance Secure Boot Variable Libraries


Kun Qin
 

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3909
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3910
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3911

This is a follow-up of a previously submitted patch series based on top
of master branch: https://edk2.groups.io/g/devel/message/90491.

The main changes between v2 and v3 patches are:
- Added reviewed-by and acked-by tags collected from previous iteration
- Updated default timestamp for default secure boot variable enrollment

The updated changes are verified on QEMU based Q35 virtual platform as
well as proprietary physical platforms.

Patch v3 branch: https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3

Cc: Jiewen Yao <jiewen.yao@...>
Cc: Jian J Wang <jian.j.wang@...>
Cc: Min Xu <min.m.xu@...>
Cc: Sean Brogan <sean.brogan@...>
Cc: Ard Biesheuvel <ardb+tianocore@...>
Cc: Jordan Justen <jordan.l.justen@...>
Cc: Gerd Hoffmann <kraxel@...>
Cc: Rebecca Cran <rebecca@...>
Cc: Peter Grehan <grehan@...>
Cc: Sebastien Boeuf <sebastien.boeuf@...>
Cc: Andrew Fish <afish@...>
Cc: Ray Ni <ray.ni@...>

Kun Qin (8):
SecurityPkg: UefiSecureBoot: Definitions of cert and payload
structures
SecurityPkg: PlatformPKProtectionLib: Added PK protection interface
SecurityPkg: SecureBootVariableLib: Updated time based payload creator
SecurityPkg: SecureBootVariableProvisionLib: Updated implementation
SecurityPkg: Secure Boot Drivers: Added common header files
SecurityPkg: SecureBootConfigDxe: Updated invocation pattern
OvmfPkg: Pipeline: Resolve SecureBootVariableLib dependency
EmulatorPkg: Pipeline: Resolve SecureBootVariableLib dependency

kuqin (3):
SecurityPkg: SecureBootVariableLib: Updated signature list creator
SecurityPkg: SecureBootVariableLib: Added newly supported interfaces
SecurityPkg: SecureBootVariableLib: Added unit tests

SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c | 1 +
SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLibVarPolicy.c | 51 +
SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c | 485 ++++-
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectionLib.c | 36 +
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c | 201 ++
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServicesTableLib.c | 13 +
SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnitTest.c | 2037 ++++++++++++++++++++
SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvisionLib.c | 145 +-
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c | 128 +-
SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.c | 1 +
EmulatorPkg/EmulatorPkg.dsc | 1 +
OvmfPkg/Bhyve/BhyveX64.dsc | 1 +
OvmfPkg/CloudHv/CloudHvX64.dsc | 1 +
OvmfPkg/IntelTdx/IntelTdxX64.dsc | 1 +
OvmfPkg/OvmfPkgIa32.dsc | 1 +
OvmfPkg/OvmfPkgIa32X64.dsc | 1 +
OvmfPkg/OvmfPkgX64.dsc | 1 +
SecurityPkg/Include/Library/PlatformPKProtectionLib.h | 31 +
SecurityPkg/Include/Library/SecureBootVariableLib.h | 103 +-
SecurityPkg/Include/UefiSecureBoot.h | 94 +
SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLibVarPolicy.inf | 36 +
SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf | 14 +-
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectionLib.inf | 33 +
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf | 45 +
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServicesTableLib.inf | 25 +
SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnitTest.inf | 36 +
SecurityPkg/SecurityPkg.ci.yaml | 11 +
SecurityPkg/SecurityPkg.dec | 5 +
SecurityPkg/SecurityPkg.dsc | 2 +
SecurityPkg/Test/SecurityPkgHostTest.dsc | 38 +
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf | 1 +
31 files changed, 3467 insertions(+), 112 deletions(-)
create mode 100644 SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLibVarPolicy.c
create mode 100644 SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectionLib.c
create mode 100644 SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c
create mode 100644 SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServicesTableLib.c
create mode 100644 SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnitTest.c
create mode 100644 SecurityPkg/Include/Library/PlatformPKProtectionLib.h
create mode 100644 SecurityPkg/Include/UefiSecureBoot.h
create mode 100644 SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLibVarPolicy.inf
create mode 100644 SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectionLib.inf
create mode 100644 SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf
create mode 100644 SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServicesTableLib.inf
create mode 100644 SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnitTest.inf
create mode 100644 SecurityPkg/Test/SecurityPkgHostTest.dsc

--
2.36.0.windows.1


Yao, Jiewen
 

Hi
I am going to merge this. However, I realize that my mailbox filtered patch 6/11 and 10/11.
So I am going to merge the one in https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3

Please double confirm:
1) the latest one 256220d82191effae32d91897ab0f65a4fa0641b is identical to the one you submitted to EDKII mailing list.
2) the latest one passed the EDKII CI.

Once you confirm above, I will start merging process.

Thank you
Yao Jiewen

-----Original Message-----
From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Kun Qin
Sent: Friday, July 1, 2022 7:54 AM
To: devel@edk2.groups.io
Cc: Yao, Jiewen <jiewen.yao@...>; Wang, Jian J <jian.j.wang@...>;
Xu, Min M <min.m.xu@...>; Sean Brogan <sean.brogan@...>;
Ard Biesheuvel <ardb+tianocore@...>; Justen, Jordan L
<jordan.l.justen@...>; Gerd Hoffmann <kraxel@...>; Rebecca
Cran <rebecca@...>; Peter Grehan <grehan@...>; Boeuf,
Sebastien <sebastien.boeuf@...>; Andrew Fish <afish@...>; Ni,
Ray <ray.ni@...>
Subject: [edk2-devel] [PATCH v3 00/11] Enhance Secure Boot Variable Libraries

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3909
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3910
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3911

This is a follow-up of a previously submitted patch series based on top
of master branch: https://edk2.groups.io/g/devel/message/90491.

The main changes between v2 and v3 patches are:
- Added reviewed-by and acked-by tags collected from previous iteration
- Updated default timestamp for default secure boot variable enrollment

The updated changes are verified on QEMU based Q35 virtual platform as
well as proprietary physical platforms.

Patch v3 branch:
https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3

Cc: Jiewen Yao <jiewen.yao@...>
Cc: Jian J Wang <jian.j.wang@...>
Cc: Min Xu <min.m.xu@...>
Cc: Sean Brogan <sean.brogan@...>
Cc: Ard Biesheuvel <ardb+tianocore@...>
Cc: Jordan Justen <jordan.l.justen@...>
Cc: Gerd Hoffmann <kraxel@...>
Cc: Rebecca Cran <rebecca@...>
Cc: Peter Grehan <grehan@...>
Cc: Sebastien Boeuf <sebastien.boeuf@...>
Cc: Andrew Fish <afish@...>
Cc: Ray Ni <ray.ni@...>

Kun Qin (8):
SecurityPkg: UefiSecureBoot: Definitions of cert and payload
structures
SecurityPkg: PlatformPKProtectionLib: Added PK protection interface
SecurityPkg: SecureBootVariableLib: Updated time based payload creator
SecurityPkg: SecureBootVariableProvisionLib: Updated implementation
SecurityPkg: Secure Boot Drivers: Added common header files
SecurityPkg: SecureBootConfigDxe: Updated invocation pattern
OvmfPkg: Pipeline: Resolve SecureBootVariableLib dependency
EmulatorPkg: Pipeline: Resolve SecureBootVariableLib dependency

kuqin (3):
SecurityPkg: SecureBootVariableLib: Updated signature list creator
SecurityPkg: SecureBootVariableLib: Added newly supported interfaces
SecurityPkg: SecureBootVariableLib: Added unit tests

SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c
| 1 +

SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib
VarPolicy.c | 51 +
SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c
| 485 ++++-

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio
nLib.c | 36 +
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c
| 201 ++

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices
TableLib.c | 13 +

SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit
Test.c | 2037 ++++++++++++++++++++

SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvisi
onLib.c | 145 +-

SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigIm
pl.c | 128 +-

SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefa
ultKeysDxe.c | 1 +
EmulatorPkg/EmulatorPkg.dsc | 1 +
OvmfPkg/Bhyve/BhyveX64.dsc | 1 +
OvmfPkg/CloudHv/CloudHvX64.dsc | 1 +
OvmfPkg/IntelTdx/IntelTdxX64.dsc | 1 +
OvmfPkg/OvmfPkgIa32.dsc | 1 +
OvmfPkg/OvmfPkgIa32X64.dsc | 1 +
OvmfPkg/OvmfPkgX64.dsc | 1 +
SecurityPkg/Include/Library/PlatformPKProtectionLib.h |
31 +
SecurityPkg/Include/Library/SecureBootVariableLib.h |
103 +-
SecurityPkg/Include/UefiSecureBoot.h | 94 +

SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib
VarPolicy.inf | 36 +
SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
| 14 +-

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio
nLib.inf | 33 +
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf
| 45 +

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices
TableLib.inf | 25 +

SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit
Test.inf | 36 +
SecurityPkg/SecurityPkg.ci.yaml | 11 +
SecurityPkg/SecurityPkg.dec | 5 +
SecurityPkg/SecurityPkg.dsc | 2 +
SecurityPkg/Test/SecurityPkgHostTest.dsc | 38 +

SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDx
e.inf | 1 +
31 files changed, 3467 insertions(+), 112 deletions(-)
create mode 100644
SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib
VarPolicy.c
create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio
nLib.c
create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c
create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices
TableLib.c
create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit
Test.c
create mode 100644 SecurityPkg/Include/Library/PlatformPKProtectionLib.h
create mode 100644 SecurityPkg/Include/UefiSecureBoot.h
create mode 100644
SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib
VarPolicy.inf
create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio
nLib.inf
create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf
create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices
TableLib.inf
create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit
Test.inf
create mode 100644 SecurityPkg/Test/SecurityPkgHostTest.dsc

--
2.36.0.windows.1





Kun Qin
 

Hi Jiewen,

Yes, the "https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3" is the branch I generate these patch series. And they have not been changed after sending v3 patches.

I confirm that:
1. the latest update 256220d82191effae32d91897ab0f65a4fa0641b is identical to the one I submitted to mailing list;
2. the branch passed EDKII CI when I prepared this branch and the PR is Secure boot enhance v3 by kuqin12 · Pull Request #3035 · tianocore/edk2 (github.com).

Thanks a lot for the help! Please let me know if you encounter any issues when merging these patches.

Regards,
Kun

On 7/5/2022 10:19 PM, Yao, Jiewen wrote:
Hi
I am going to merge this. However, I realize that my mailbox filtered patch 6/11 and 10/11.
So I am going to merge the one in https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3 

Please double confirm:
1) the latest one 256220d82191effae32d91897ab0f65a4fa0641b is identical to the one you submitted to EDKII mailing list.
2) the latest one passed the EDKII CI.

Once you confirm above, I will start merging process.

Thank you
Yao Jiewen

-----Original Message-----
From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Kun Qin
Sent: Friday, July 1, 2022 7:54 AM
To: devel@edk2.groups.io
Cc: Yao, Jiewen <jiewen.yao@...>; Wang, Jian J <jian.j.wang@...>;
Xu, Min M <min.m.xu@...>; Sean Brogan <sean.brogan@...>;
Ard Biesheuvel <ardb+tianocore@...>; Justen, Jordan L
<jordan.l.justen@...>; Gerd Hoffmann <kraxel@...>; Rebecca
Cran <rebecca@...>; Peter Grehan <grehan@...>; Boeuf,
Sebastien <sebastien.boeuf@...>; Andrew Fish <afish@...>; Ni,
Ray <ray.ni@...>
Subject: [edk2-devel] [PATCH v3 00/11] Enhance Secure Boot Variable Libraries

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3909
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3910
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3911

This is a follow-up of a previously submitted patch series based on top
of master branch: https://edk2.groups.io/g/devel/message/90491.

The main changes between v2 and v3 patches are:
  - Added reviewed-by and acked-by tags collected from previous iteration
  - Updated default timestamp for default secure boot variable enrollment

The updated changes are verified on QEMU based Q35 virtual platform as
well as proprietary physical platforms.

Patch v3 branch:
https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3

Cc: Jiewen Yao <jiewen.yao@...>
Cc: Jian J Wang <jian.j.wang@...>
Cc: Min Xu <min.m.xu@...>
Cc: Sean Brogan <sean.brogan@...>
Cc: Ard Biesheuvel <ardb+tianocore@...>
Cc: Jordan Justen <jordan.l.justen@...>
Cc: Gerd Hoffmann <kraxel@...>
Cc: Rebecca Cran <rebecca@...>
Cc: Peter Grehan <grehan@...>
Cc: Sebastien Boeuf <sebastien.boeuf@...>
Cc: Andrew Fish <afish@...>
Cc: Ray Ni <ray.ni@...>

Kun Qin (8):
  SecurityPkg: UefiSecureBoot: Definitions of cert and payload
    structures
  SecurityPkg: PlatformPKProtectionLib: Added PK protection interface
  SecurityPkg: SecureBootVariableLib: Updated time based payload creator
  SecurityPkg: SecureBootVariableProvisionLib: Updated implementation
  SecurityPkg: Secure Boot Drivers: Added common header files
  SecurityPkg: SecureBootConfigDxe: Updated invocation pattern
  OvmfPkg: Pipeline: Resolve SecureBootVariableLib dependency
  EmulatorPkg: Pipeline: Resolve SecureBootVariableLib dependency

kuqin (3):
  SecurityPkg: SecureBootVariableLib: Updated signature list creator
  SecurityPkg: SecureBootVariableLib: Added newly supported interfaces
  SecurityPkg: SecureBootVariableLib: Added unit tests

 SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c
|    1 +

SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib
VarPolicy.c   |   51 +
 SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c
|  485 ++++-

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio
nLib.c          |   36 +
 SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c
|  201 ++

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices
TableLib.c      |   13 +

SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit
Test.c        | 2037 ++++++++++++++++++++

SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvisi
onLib.c       |  145 +-

SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigIm
pl.c              |  128 +-

SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefa
ultKeysDxe.c     |    1 +
 EmulatorPkg/EmulatorPkg.dsc                                                               |    1 +
 OvmfPkg/Bhyve/BhyveX64.dsc                                                                |    1 +
 OvmfPkg/CloudHv/CloudHvX64.dsc                                                            |    1 +
 OvmfPkg/IntelTdx/IntelTdxX64.dsc                                                          |    1 +
 OvmfPkg/OvmfPkgIa32.dsc                                                                   |    1 +
 OvmfPkg/OvmfPkgIa32X64.dsc                                                                |    1 +
 OvmfPkg/OvmfPkgX64.dsc                                                                    |    1 +
 SecurityPkg/Include/Library/PlatformPKProtectionLib.h                                     |
31 +
 SecurityPkg/Include/Library/SecureBootVariableLib.h                                       |
103 +-
 SecurityPkg/Include/UefiSecureBoot.h                                                      |   94 +

SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib
VarPolicy.inf |   36 +
 SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
|   14 +-

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio
nLib.inf        |   33 +
 SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf
|   45 +

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices
TableLib.inf    |   25 +

SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit
Test.inf      |   36 +
 SecurityPkg/SecurityPkg.ci.yaml                                                           |   11 +
 SecurityPkg/SecurityPkg.dec                                                               |    5 +
 SecurityPkg/SecurityPkg.dsc                                                               |    2 +
 SecurityPkg/Test/SecurityPkgHostTest.dsc                                                  |   38 +

SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDx
e.inf             |    1 +
 31 files changed, 3467 insertions(+), 112 deletions(-)
 create mode 100644
SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib
VarPolicy.c
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio
nLib.c
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices
TableLib.c
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit
Test.c
 create mode 100644 SecurityPkg/Include/Library/PlatformPKProtectionLib.h
 create mode 100644 SecurityPkg/Include/UefiSecureBoot.h
 create mode 100644
SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib
VarPolicy.inf
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio
nLib.inf
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices
TableLib.inf
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit
Test.inf
 create mode 100644 SecurityPkg/Test/SecurityPkgHostTest.dsc

--
2.36.0.windows.1











Yao, Jiewen
 

From: Kun Qin <kuqin12@...>
Sent: Thursday, July 7, 2022 1:44 AM
To: devel@edk2.groups.io; Yao, Jiewen <jiewen.yao@...>
Cc: Wang, Jian J <jian.j.wang@...>; Xu, Min M <min.m.xu@...>; Sean Brogan <sean.brogan@...>; Ard Biesheuvel <ardb+tianocore@...>; Justen, Jordan L <jordan.l.justen@...>; Gerd Hoffmann <kraxel@...>; Rebecca Cran <rebecca@...>; Peter Grehan <grehan@...>; Boeuf, Sebastien <sebastien.boeuf@...>; Andrew Fish <afish@...>; Ni, Ray <ray.ni@...>
Subject: Re: [edk2-devel] [PATCH v3 00/11] Enhance Secure Boot Variable Libraries

 

Hi Jiewen,

Yes, the "https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3" is the branch I generate these patch series. And they have not been changed after sending v3 patches.

I confirm that:
1. the latest update 256220d82191effae32d91897ab0f65a4fa0641b is identical to the one I submitted to mailing list;
2. the branch passed EDKII CI when I prepared this branch and the PR is Secure boot enhance v3 by kuqin12 · Pull Request #3035 · tianocore/edk2 (github.com).

Thanks a lot for the help! Please let me know if you encounter any issues when merging these patches.

Regards,
Kun

On 7/5/2022 10:19 PM, Yao, Jiewen wrote:

Hi
I am going to merge this. However, I realize that my mailbox filtered patch 6/11 and 10/11.
So I am going to merge the one in https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3 
 
Please double confirm:
1) the latest one 256220d82191effae32d91897ab0f65a4fa0641b is identical to the one you submitted to EDKII mailing list.
2) the latest one passed the EDKII CI.
 
Once you confirm above, I will start merging process.
 
Thank you
Yao Jiewen
 
-----Original Message-----
From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Kun Qin
Sent: Friday, July 1, 2022 7:54 AM
To: devel@edk2.groups.io
Cc: Yao, Jiewen <jiewen.yao@...>; Wang, Jian J <jian.j.wang@...>;
Xu, Min M <min.m.xu@...>; Sean Brogan <sean.brogan@...>;
Ard Biesheuvel <ardb+tianocore@...>; Justen, Jordan L
<jordan.l.justen@...>; Gerd Hoffmann <kraxel@...>; Rebecca
Cran <rebecca@...>; Peter Grehan <grehan@...>; Boeuf,
Sebastien <sebastien.boeuf@...>; Andrew Fish <afish@...>; Ni,
Ray <ray.ni@...>
Subject: [edk2-devel] [PATCH v3 00/11] Enhance Secure Boot Variable Libraries
 
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3909
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3910
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3911
 
This is a follow-up of a previously submitted patch series based on top
of master branch: https://edk2.groups.io/g/devel/message/90491.
 
The main changes between v2 and v3 patches are:
  - Added reviewed-by and acked-by tags collected from previous iteration
  - Updated default timestamp for default secure boot variable enrollment
 
The updated changes are verified on QEMU based Q35 virtual platform as
well as proprietary physical platforms.
 
Patch v3 branch:
https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3
 
Cc: Jiewen Yao <jiewen.yao@...>
Cc: Jian J Wang <jian.j.wang@...>
Cc: Min Xu <min.m.xu@...>
Cc: Sean Brogan <sean.brogan@...>
Cc: Ard Biesheuvel <ardb+tianocore@...>
Cc: Jordan Justen <jordan.l.justen@...>
Cc: Gerd Hoffmann <kraxel@...>
Cc: Rebecca Cran <rebecca@...>
Cc: Peter Grehan <grehan@...>
Cc: Sebastien Boeuf <sebastien.boeuf@...>
Cc: Andrew Fish <afish@...>
Cc: Ray Ni <ray.ni@...>
 
Kun Qin (8):
  SecurityPkg: UefiSecureBoot: Definitions of cert and payload
    structures
  SecurityPkg: PlatformPKProtectionLib: Added PK protection interface
  SecurityPkg: SecureBootVariableLib: Updated time based payload creator
  SecurityPkg: SecureBootVariableProvisionLib: Updated implementation
  SecurityPkg: Secure Boot Drivers: Added common header files
  SecurityPkg: SecureBootConfigDxe: Updated invocation pattern
  OvmfPkg: Pipeline: Resolve SecureBootVariableLib dependency
  EmulatorPkg: Pipeline: Resolve SecureBootVariableLib dependency
 
kuqin (3):
  SecurityPkg: SecureBootVariableLib: Updated signature list creator
  SecurityPkg: SecureBootVariableLib: Added newly supported interfaces
  SecurityPkg: SecureBootVariableLib: Added unit tests
 
 SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c
|    1 +
 
SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib
VarPolicy.c   |   51 +
 SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c
|  485 ++++-
 
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio
nLib.c          |   36 +
 SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c
|  201 ++
 
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices
TableLib.c      |   13 +
 
SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit
Test.c        | 2037 ++++++++++++++++++++
 
SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvisi
onLib.c       |  145 +-
 
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigIm
pl.c              |  128 +-
 
SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefa
ultKeysDxe.c     |    1 +
 EmulatorPkg/EmulatorPkg.dsc                                                               |    1 +
 OvmfPkg/Bhyve/BhyveX64.dsc                                                                |    1 +
 OvmfPkg/CloudHv/CloudHvX64.dsc                                                            |    1 +
 OvmfPkg/IntelTdx/IntelTdxX64.dsc                                                          |    1 +
 OvmfPkg/OvmfPkgIa32.dsc                                                                   |    1 +
 OvmfPkg/OvmfPkgIa32X64.dsc                                                                |    1 +
 OvmfPkg/OvmfPkgX64.dsc                                                                    |    1 +
 SecurityPkg/Include/Library/PlatformPKProtectionLib.h                                     |
31 +
 SecurityPkg/Include/Library/SecureBootVariableLib.h                                       |
103 +-
 SecurityPkg/Include/UefiSecureBoot.h                                                      |   94 +
 
SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib
VarPolicy.inf |   36 +
 SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
|   14 +-
 
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio
nLib.inf        |   33 +
 SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf
|   45 +
 
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices
TableLib.inf    |   25 +
 
SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit
Test.inf      |   36 +
 SecurityPkg/SecurityPkg.ci.yaml                                                           |   11 +
 SecurityPkg/SecurityPkg.dec                                                               |    5 +
 SecurityPkg/SecurityPkg.dsc                                                               |    2 +
 SecurityPkg/Test/SecurityPkgHostTest.dsc                                                  |   38 +
 
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDx
e.inf             |    1 +
 31 files changed, 3467 insertions(+), 112 deletions(-)
 create mode 100644
SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib
VarPolicy.c
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio
nLib.c
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices
TableLib.c
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit
Test.c
 create mode 100644 SecurityPkg/Include/Library/PlatformPKProtectionLib.h
 create mode 100644 SecurityPkg/Include/UefiSecureBoot.h
 create mode 100644
SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib
VarPolicy.inf
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio
nLib.inf
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices
TableLib.inf
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit
Test.inf
 create mode 100644 SecurityPkg/Test/SecurityPkgHostTest.dsc
 
--
2.36.0.windows.1
 
 
 
 
 
 
 
 

 
 


Kun Qin
 

Thank you so much for the help, Jiewen!

On 7/6/2022 6:09 PM, Yao, Jiewen wrote:

Merged https://github.com/tianocore/edk2/pull/3050

 

From: Kun Qin <kuqin12@...>
Sent: Thursday, July 7, 2022 1:44 AM
To: devel@edk2.groups.io; Yao, Jiewen <jiewen.yao@...>
Cc: Wang, Jian J <jian.j.wang@...>; Xu, Min M <min.m.xu@...>; Sean Brogan <sean.brogan@...>; Ard Biesheuvel <ardb+tianocore@...>; Justen, Jordan L <jordan.l.justen@...>; Gerd Hoffmann <kraxel@...>; Rebecca Cran <rebecca@...>; Peter Grehan <grehan@...>; Boeuf, Sebastien <sebastien.boeuf@...>; Andrew Fish <afish@...>; Ni, Ray <ray.ni@...>
Subject: Re: [edk2-devel] [PATCH v3 00/11] Enhance Secure Boot Variable Libraries

 

Hi Jiewen,

Yes, the "https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3" is the branch I generate these patch series. And they have not been changed after sending v3 patches.

I confirm that:
1. the latest update 256220d82191effae32d91897ab0f65a4fa0641b is identical to the one I submitted to mailing list;
2. the branch passed EDKII CI when I prepared this branch and the PR is Secure boot enhance v3 by kuqin12 · Pull Request #3035 · tianocore/edk2 (github.com).

Thanks a lot for the help! Please let me know if you encounter any issues when merging these patches.

Regards,
Kun

On 7/5/2022 10:19 PM, Yao, Jiewen wrote:

Hi
I am going to merge this. However, I realize that my mailbox filtered patch 6/11 and 10/11.
So I am going to merge the one in https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3 
 
Please double confirm:
1) the latest one 256220d82191effae32d91897ab0f65a4fa0641b is identical to the one you submitted to EDKII mailing list.
2) the latest one passed the EDKII CI.
 
Once you confirm above, I will start merging process.
 
Thank you
Yao Jiewen
 
-----Original Message-----
From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Kun Qin
Sent: Friday, July 1, 2022 7:54 AM
To: devel@edk2.groups.io
Cc: Yao, Jiewen <jiewen.yao@...>; Wang, Jian J <jian.j.wang@...>;
Xu, Min M <min.m.xu@...>; Sean Brogan <sean.brogan@...>;
Ard Biesheuvel <ardb+tianocore@...>; Justen, Jordan L
<jordan.l.justen@...>; Gerd Hoffmann <kraxel@...>; Rebecca
Cran <rebecca@...>; Peter Grehan <grehan@...>; Boeuf,
Sebastien <sebastien.boeuf@...>; Andrew Fish <afish@...>; Ni,
Ray <ray.ni@...>
Subject: [edk2-devel] [PATCH v3 00/11] Enhance Secure Boot Variable Libraries
 
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3909
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3910
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3911
 
This is a follow-up of a previously submitted patch series based on top
of master branch: https://edk2.groups.io/g/devel/message/90491.
 
The main changes between v2 and v3 patches are:
  - Added reviewed-by and acked-by tags collected from previous iteration
  - Updated default timestamp for default secure boot variable enrollment
 
The updated changes are verified on QEMU based Q35 virtual platform as
well as proprietary physical platforms.
 
Patch v3 branch:
https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3
 
Cc: Jiewen Yao <jiewen.yao@...>
Cc: Jian J Wang <jian.j.wang@...>
Cc: Min Xu <min.m.xu@...>
Cc: Sean Brogan <sean.brogan@...>
Cc: Ard Biesheuvel <ardb+tianocore@...>
Cc: Jordan Justen <jordan.l.justen@...>
Cc: Gerd Hoffmann <kraxel@...>
Cc: Rebecca Cran <rebecca@...>
Cc: Peter Grehan <grehan@...>
Cc: Sebastien Boeuf <sebastien.boeuf@...>
Cc: Andrew Fish <afish@...>
Cc: Ray Ni <ray.ni@...>
 
Kun Qin (8):
  SecurityPkg: UefiSecureBoot: Definitions of cert and payload
    structures
  SecurityPkg: PlatformPKProtectionLib: Added PK protection interface
  SecurityPkg: SecureBootVariableLib: Updated time based payload creator
  SecurityPkg: SecureBootVariableProvisionLib: Updated implementation
  SecurityPkg: Secure Boot Drivers: Added common header files
  SecurityPkg: SecureBootConfigDxe: Updated invocation pattern
  OvmfPkg: Pipeline: Resolve SecureBootVariableLib dependency
  EmulatorPkg: Pipeline: Resolve SecureBootVariableLib dependency
 
kuqin (3):
  SecurityPkg: SecureBootVariableLib: Updated signature list creator
  SecurityPkg: SecureBootVariableLib: Added newly supported interfaces
  SecurityPkg: SecureBootVariableLib: Added unit tests
 
 SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c
|    1 +
 
SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib
VarPolicy.c   |   51 +
 SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c
|  485 ++++-
 
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio
nLib.c          |   36 +
 SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c
|  201 ++
 
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices
TableLib.c      |   13 +
 
SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit
Test.c        | 2037 ++++++++++++++++++++
 
SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvisi
onLib.c       |  145 +-
 
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigIm
pl.c              |  128 +-
 
SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefa
ultKeysDxe.c     |    1 +
 EmulatorPkg/EmulatorPkg.dsc                                                               |    1 +
 OvmfPkg/Bhyve/BhyveX64.dsc                                                                |    1 +
 OvmfPkg/CloudHv/CloudHvX64.dsc                                                            |    1 +
 OvmfPkg/IntelTdx/IntelTdxX64.dsc                                                          |    1 +
 OvmfPkg/OvmfPkgIa32.dsc                                                                   |    1 +
 OvmfPkg/OvmfPkgIa32X64.dsc                                                                |    1 +
 OvmfPkg/OvmfPkgX64.dsc                                                                    |    1 +
 SecurityPkg/Include/Library/PlatformPKProtectionLib.h                                     |
31 +
 SecurityPkg/Include/Library/SecureBootVariableLib.h                                       |
103 +-
 SecurityPkg/Include/UefiSecureBoot.h                                                      |   94 +
 
SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib
VarPolicy.inf |   36 +
 SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
|   14 +-
 
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio
nLib.inf        |   33 +
 SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf
|   45 +
 
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices
TableLib.inf    |   25 +
 
SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit
Test.inf      |   36 +
 SecurityPkg/SecurityPkg.ci.yaml                                                           |   11 +
 SecurityPkg/SecurityPkg.dec                                                               |    5 +
 SecurityPkg/SecurityPkg.dsc                                                               |    2 +
 SecurityPkg/Test/SecurityPkgHostTest.dsc                                                  |   38 +
 
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDx
e.inf             |    1 +
 31 files changed, 3467 insertions(+), 112 deletions(-)
 create mode 100644
SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib
VarPolicy.c
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio
nLib.c
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices
TableLib.c
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit
Test.c
 create mode 100644 SecurityPkg/Include/Library/PlatformPKProtectionLib.h
 create mode 100644 SecurityPkg/Include/UefiSecureBoot.h
 create mode 100644
SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib
VarPolicy.inf
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio
nLib.inf
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices
TableLib.inf
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit
Test.inf
 create mode 100644 SecurityPkg/Test/SecurityPkgHostTest.dsc
 
--
2.36.0.windows.1
 
 
 
 
 
 
 
 

            
 
 


Ard Biesheuvel
 

I think this series has broken some ARM platforms, please double check.

https://ci.linaro.org/job/leg-virt-tianocore-edk2-upstream/4573/console

On Thu, 7 Jul 2022 at 03:09, Yao, Jiewen <jiewen.yao@...> wrote:

Merged https://github.com/tianocore/edk2/pull/3050



From: Kun Qin <kuqin12@...>
Sent: Thursday, July 7, 2022 1:44 AM
To: devel@edk2.groups.io; Yao, Jiewen <jiewen.yao@...>
Cc: Wang, Jian J <jian.j.wang@...>; Xu, Min M <min.m.xu@...>; Sean Brogan <sean.brogan@...>; Ard Biesheuvel <ardb+tianocore@...>; Justen, Jordan L <jordan.l.justen@...>; Gerd Hoffmann <kraxel@...>; Rebecca Cran <rebecca@...>; Peter Grehan <grehan@...>; Boeuf, Sebastien <sebastien.boeuf@...>; Andrew Fish <afish@...>; Ni, Ray <ray.ni@...>
Subject: Re: [edk2-devel] [PATCH v3 00/11] Enhance Secure Boot Variable Libraries



Hi Jiewen,

Yes, the "https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3" is the branch I generate these patch series. And they have not been changed after sending v3 patches.

I confirm that:
1. the latest update 256220d82191effae32d91897ab0f65a4fa0641b is identical to the one I submitted to mailing list;
2. the branch passed EDKII CI when I prepared this branch and the PR is Secure boot enhance v3 by kuqin12 · Pull Request #3035 · tianocore/edk2 (github.com).

Thanks a lot for the help! Please let me know if you encounter any issues when merging these patches.

Regards,
Kun

On 7/5/2022 10:19 PM, Yao, Jiewen wrote:

Hi

I am going to merge this. However, I realize that my mailbox filtered patch 6/11 and 10/11.

So I am going to merge the one in https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3



Please double confirm:

1) the latest one 256220d82191effae32d91897ab0f65a4fa0641b is identical to the one you submitted to EDKII mailing list.

2) the latest one passed the EDKII CI.



Once you confirm above, I will start merging process.



Thank you

Yao Jiewen



-----Original Message-----

From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Kun Qin

Sent: Friday, July 1, 2022 7:54 AM

To: devel@edk2.groups.io

Cc: Yao, Jiewen <jiewen.yao@...>; Wang, Jian J <jian.j.wang@...>;

Xu, Min M <min.m.xu@...>; Sean Brogan <sean.brogan@...>;

Ard Biesheuvel <ardb+tianocore@...>; Justen, Jordan L

<jordan.l.justen@...>; Gerd Hoffmann <kraxel@...>; Rebecca

Cran <rebecca@...>; Peter Grehan <grehan@...>; Boeuf,

Sebastien <sebastien.boeuf@...>; Andrew Fish <afish@...>; Ni,

Ray <ray.ni@...>

Subject: [edk2-devel] [PATCH v3 00/11] Enhance Secure Boot Variable Libraries



REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3909

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3910

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3911



This is a follow-up of a previously submitted patch series based on top

of master branch: https://edk2.groups.io/g/devel/message/90491.



The main changes between v2 and v3 patches are:

- Added reviewed-by and acked-by tags collected from previous iteration

- Updated default timestamp for default secure boot variable enrollment



The updated changes are verified on QEMU based Q35 virtual platform as

well as proprietary physical platforms.



Patch v3 branch:

https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3



Cc: Jiewen Yao <jiewen.yao@...>

Cc: Jian J Wang <jian.j.wang@...>

Cc: Min Xu <min.m.xu@...>

Cc: Sean Brogan <sean.brogan@...>

Cc: Ard Biesheuvel <ardb+tianocore@...>

Cc: Jordan Justen <jordan.l.justen@...>

Cc: Gerd Hoffmann <kraxel@...>

Cc: Rebecca Cran <rebecca@...>

Cc: Peter Grehan <grehan@...>

Cc: Sebastien Boeuf <sebastien.boeuf@...>

Cc: Andrew Fish <afish@...>

Cc: Ray Ni <ray.ni@...>



Kun Qin (8):

SecurityPkg: UefiSecureBoot: Definitions of cert and payload

structures

SecurityPkg: PlatformPKProtectionLib: Added PK protection interface

SecurityPkg: SecureBootVariableLib: Updated time based payload creator

SecurityPkg: SecureBootVariableProvisionLib: Updated implementation

SecurityPkg: Secure Boot Drivers: Added common header files

SecurityPkg: SecureBootConfigDxe: Updated invocation pattern

OvmfPkg: Pipeline: Resolve SecureBootVariableLib dependency

EmulatorPkg: Pipeline: Resolve SecureBootVariableLib dependency



kuqin (3):

SecurityPkg: SecureBootVariableLib: Updated signature list creator

SecurityPkg: SecureBootVariableLib: Added newly supported interfaces

SecurityPkg: SecureBootVariableLib: Added unit tests



SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c

| 1 +



SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib

VarPolicy.c | 51 +

SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c

| 485 ++++-



SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio

nLib.c | 36 +

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c

| 201 ++



SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices

TableLib.c | 13 +



SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit

Test.c | 2037 ++++++++++++++++++++



SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvisi

onLib.c | 145 +-



SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigIm

pl.c | 128 +-



SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefa

ultKeysDxe.c | 1 +

EmulatorPkg/EmulatorPkg.dsc | 1 +

OvmfPkg/Bhyve/BhyveX64.dsc | 1 +

OvmfPkg/CloudHv/CloudHvX64.dsc | 1 +

OvmfPkg/IntelTdx/IntelTdxX64.dsc | 1 +

OvmfPkg/OvmfPkgIa32.dsc | 1 +

OvmfPkg/OvmfPkgIa32X64.dsc | 1 +

OvmfPkg/OvmfPkgX64.dsc | 1 +

SecurityPkg/Include/Library/PlatformPKProtectionLib.h |

31 +

SecurityPkg/Include/Library/SecureBootVariableLib.h |

103 +-

SecurityPkg/Include/UefiSecureBoot.h | 94 +



SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib

VarPolicy.inf | 36 +

SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf

| 14 +-



SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio

nLib.inf | 33 +

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf

| 45 +



SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices

TableLib.inf | 25 +



SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit

Test.inf | 36 +

SecurityPkg/SecurityPkg.ci.yaml | 11 +

SecurityPkg/SecurityPkg.dec | 5 +

SecurityPkg/SecurityPkg.dsc | 2 +

SecurityPkg/Test/SecurityPkgHostTest.dsc | 38 +



SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDx

e.inf | 1 +

31 files changed, 3467 insertions(+), 112 deletions(-)

create mode 100644

SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib

VarPolicy.c

create mode 100644

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio

nLib.c

create mode 100644

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c

create mode 100644

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices

TableLib.c

create mode 100644

SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit

Test.c

create mode 100644 SecurityPkg/Include/Library/PlatformPKProtectionLib.h

create mode 100644 SecurityPkg/Include/UefiSecureBoot.h

create mode 100644

SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib

VarPolicy.inf

create mode 100644

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio

nLib.inf

create mode 100644

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf

create mode 100644

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices

TableLib.inf

create mode 100644

SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit

Test.inf

create mode 100644 SecurityPkg/Test/SecurityPkgHostTest.dsc



--

2.36.0.windows.1






















Kun Qin
 

Hi Ard,

I thought pipeline should have caught this type of errors. Sorry for the inconvenience.

A patch was sent here to fix this issue:
https://edk2.groups.io/g/devel/message/91189

Regards,
Kun

On 7/8/2022 9:38 AM, Ard Biesheuvel wrote:
I think this series has broken some ARM platforms, please double check.

https://ci.linaro.org/job/leg-virt-tianocore-edk2-upstream/4573/console


On Thu, 7 Jul 2022 at 03:09, Yao, Jiewen <jiewen.yao@...> wrote:
Merged https://github.com/tianocore/edk2/pull/3050



From: Kun Qin <kuqin12@...>
Sent: Thursday, July 7, 2022 1:44 AM
To: devel@edk2.groups.io; Yao, Jiewen <jiewen.yao@...>
Cc: Wang, Jian J <jian.j.wang@...>; Xu, Min M <min.m.xu@...>; Sean Brogan <sean.brogan@...>; Ard Biesheuvel <ardb+tianocore@...>; Justen, Jordan L <jordan.l.justen@...>; Gerd Hoffmann <kraxel@...>; Rebecca Cran <rebecca@...>; Peter Grehan <grehan@...>; Boeuf, Sebastien <sebastien.boeuf@...>; Andrew Fish <afish@...>; Ni, Ray <ray.ni@...>
Subject: Re: [edk2-devel] [PATCH v3 00/11] Enhance Secure Boot Variable Libraries



Hi Jiewen,

Yes, the "https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3" is the branch I generate these patch series. And they have not been changed after sending v3 patches.

I confirm that:
1. the latest update 256220d82191effae32d91897ab0f65a4fa0641b is identical to the one I submitted to mailing list;
2. the branch passed EDKII CI when I prepared this branch and the PR is Secure boot enhance v3 by kuqin12 · Pull Request #3035 · tianocore/edk2 (github.com).

Thanks a lot for the help! Please let me know if you encounter any issues when merging these patches.

Regards,
Kun

On 7/5/2022 10:19 PM, Yao, Jiewen wrote:

Hi

I am going to merge this. However, I realize that my mailbox filtered patch 6/11 and 10/11.

So I am going to merge the one in https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3



Please double confirm:

1) the latest one 256220d82191effae32d91897ab0f65a4fa0641b is identical to the one you submitted to EDKII mailing list.

2) the latest one passed the EDKII CI.



Once you confirm above, I will start merging process.



Thank you

Yao Jiewen



-----Original Message-----

From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Kun Qin

Sent: Friday, July 1, 2022 7:54 AM

To: devel@edk2.groups.io

Cc: Yao, Jiewen <jiewen.yao@...>; Wang, Jian J <jian.j.wang@...>;

Xu, Min M <min.m.xu@...>; Sean Brogan <sean.brogan@...>;

Ard Biesheuvel <ardb+tianocore@...>; Justen, Jordan L

<jordan.l.justen@...>; Gerd Hoffmann <kraxel@...>; Rebecca

Cran <rebecca@...>; Peter Grehan <grehan@...>; Boeuf,

Sebastien <sebastien.boeuf@...>; Andrew Fish <afish@...>; Ni,

Ray <ray.ni@...>

Subject: [edk2-devel] [PATCH v3 00/11] Enhance Secure Boot Variable Libraries



REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3909

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3910

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3911



This is a follow-up of a previously submitted patch series based on top

of master branch: https://edk2.groups.io/g/devel/message/90491.



The main changes between v2 and v3 patches are:

- Added reviewed-by and acked-by tags collected from previous iteration

- Updated default timestamp for default secure boot variable enrollment



The updated changes are verified on QEMU based Q35 virtual platform as

well as proprietary physical platforms.



Patch v3 branch:

https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3



Cc: Jiewen Yao <jiewen.yao@...>

Cc: Jian J Wang <jian.j.wang@...>

Cc: Min Xu <min.m.xu@...>

Cc: Sean Brogan <sean.brogan@...>

Cc: Ard Biesheuvel <ardb+tianocore@...>

Cc: Jordan Justen <jordan.l.justen@...>

Cc: Gerd Hoffmann <kraxel@...>

Cc: Rebecca Cran <rebecca@...>

Cc: Peter Grehan <grehan@...>

Cc: Sebastien Boeuf <sebastien.boeuf@...>

Cc: Andrew Fish <afish@...>

Cc: Ray Ni <ray.ni@...>



Kun Qin (8):

SecurityPkg: UefiSecureBoot: Definitions of cert and payload

structures

SecurityPkg: PlatformPKProtectionLib: Added PK protection interface

SecurityPkg: SecureBootVariableLib: Updated time based payload creator

SecurityPkg: SecureBootVariableProvisionLib: Updated implementation

SecurityPkg: Secure Boot Drivers: Added common header files

SecurityPkg: SecureBootConfigDxe: Updated invocation pattern

OvmfPkg: Pipeline: Resolve SecureBootVariableLib dependency

EmulatorPkg: Pipeline: Resolve SecureBootVariableLib dependency



kuqin (3):

SecurityPkg: SecureBootVariableLib: Updated signature list creator

SecurityPkg: SecureBootVariableLib: Added newly supported interfaces

SecurityPkg: SecureBootVariableLib: Added unit tests



SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c

| 1 +



SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib

VarPolicy.c | 51 +

SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c

| 485 ++++-



SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio

nLib.c | 36 +

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c

| 201 ++



SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices

TableLib.c | 13 +



SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit

Test.c | 2037 ++++++++++++++++++++



SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvisi

onLib.c | 145 +-



SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigIm

pl.c | 128 +-



SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefa

ultKeysDxe.c | 1 +

EmulatorPkg/EmulatorPkg.dsc | 1 +

OvmfPkg/Bhyve/BhyveX64.dsc | 1 +

OvmfPkg/CloudHv/CloudHvX64.dsc | 1 +

OvmfPkg/IntelTdx/IntelTdxX64.dsc | 1 +

OvmfPkg/OvmfPkgIa32.dsc | 1 +

OvmfPkg/OvmfPkgIa32X64.dsc | 1 +

OvmfPkg/OvmfPkgX64.dsc | 1 +

SecurityPkg/Include/Library/PlatformPKProtectionLib.h |

31 +

SecurityPkg/Include/Library/SecureBootVariableLib.h |

103 +-

SecurityPkg/Include/UefiSecureBoot.h | 94 +



SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib

VarPolicy.inf | 36 +

SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf

| 14 +-



SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio

nLib.inf | 33 +

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf

| 45 +



SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices

TableLib.inf | 25 +



SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit

Test.inf | 36 +

SecurityPkg/SecurityPkg.ci.yaml | 11 +

SecurityPkg/SecurityPkg.dec | 5 +

SecurityPkg/SecurityPkg.dsc | 2 +

SecurityPkg/Test/SecurityPkgHostTest.dsc | 38 +



SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDx

e.inf | 1 +

31 files changed, 3467 insertions(+), 112 deletions(-)

create mode 100644

SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib

VarPolicy.c

create mode 100644

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio

nLib.c

create mode 100644

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c

create mode 100644

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices

TableLib.c

create mode 100644

SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit

Test.c

create mode 100644 SecurityPkg/Include/Library/PlatformPKProtectionLib.h

create mode 100644 SecurityPkg/Include/UefiSecureBoot.h

create mode 100644

SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib

VarPolicy.inf

create mode 100644

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio

nLib.inf

create mode 100644

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf

create mode 100644

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices

TableLib.inf

create mode 100644

SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit

Test.inf

create mode 100644 SecurityPkg/Test/SecurityPkgHostTest.dsc



--

2.36.0.windows.1