1. Topics
  2. [PATCH v3 00/11] Enhance Secure Boot Variable Libraries

[PATCH v3 00/11] Enhance Secure Boot Variable Libraries

Kun Qin
 

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3909
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3910
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3911

This is a follow-up of a previously submitted patch series based on top
of master branch: https://edk2.groups.io/g/devel/message/90491.

The main changes between v2 and v3 patches are:
- Added reviewed-by and acked-by tags collected from previous iteration
- Updated default timestamp for default secure boot variable enrollment

The updated changes are verified on QEMU based Q35 virtual platform as
well as proprietary physical platforms.

Patch v3 branch: https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3

Cc: Jiewen Yao <jiewen.yao@...>
Cc: Jian J Wang <jian.j.wang@...>
Cc: Min Xu <min.m.xu@...>
Cc: Sean Brogan <sean.brogan@...>
Cc: Ard Biesheuvel <ardb+tianocore@...>
Cc: Jordan Justen <jordan.l.justen@...>
Cc: Gerd Hoffmann <kraxel@...>
Cc: Rebecca Cran <rebecca@...>
Cc: Peter Grehan <grehan@...>
Cc: Sebastien Boeuf <sebastien.boeuf@...>
Cc: Andrew Fish <afish@...>
Cc: Ray Ni <ray.ni@...>

Kun Qin (8):
SecurityPkg: UefiSecureBoot: Definitions of cert and payload
structures
SecurityPkg: PlatformPKProtectionLib: Added PK protection interface
SecurityPkg: SecureBootVariableLib: Updated time based payload creator
SecurityPkg: SecureBootVariableProvisionLib: Updated implementation
SecurityPkg: Secure Boot Drivers: Added common header files
SecurityPkg: SecureBootConfigDxe: Updated invocation pattern
OvmfPkg: Pipeline: Resolve SecureBootVariableLib dependency
EmulatorPkg: Pipeline: Resolve SecureBootVariableLib dependency

kuqin (3):
SecurityPkg: SecureBootVariableLib: Updated signature list creator
SecurityPkg: SecureBootVariableLib: Added newly supported interfaces
SecurityPkg: SecureBootVariableLib: Added unit tests

SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c | 1 +
SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLibVarPolicy.c | 51 +
SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c | 485 ++++-
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectionLib.c | 36 +
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c | 201 ++
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServicesTableLib.c | 13 +
SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnitTest.c | 2037 ++++++++++++++++++++
SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvisionLib.c | 145 +-
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c | 128 +-
SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefaultKeysDxe.c | 1 +
EmulatorPkg/EmulatorPkg.dsc | 1 +
OvmfPkg/Bhyve/BhyveX64.dsc | 1 +
OvmfPkg/CloudHv/CloudHvX64.dsc | 1 +
OvmfPkg/IntelTdx/IntelTdxX64.dsc | 1 +
OvmfPkg/OvmfPkgIa32.dsc | 1 +
OvmfPkg/OvmfPkgIa32X64.dsc | 1 +
OvmfPkg/OvmfPkgX64.dsc | 1 +
SecurityPkg/Include/Library/PlatformPKProtectionLib.h | 31 +
SecurityPkg/Include/Library/SecureBootVariableLib.h | 103 +-
SecurityPkg/Include/UefiSecureBoot.h | 94 +
SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLibVarPolicy.inf | 36 +
SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf | 14 +-
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectionLib.inf | 33 +
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf | 45 +
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServicesTableLib.inf | 25 +
SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnitTest.inf | 36 +
SecurityPkg/SecurityPkg.ci.yaml | 11 +
SecurityPkg/SecurityPkg.dec | 5 +
SecurityPkg/SecurityPkg.dsc | 2 +
SecurityPkg/Test/SecurityPkgHostTest.dsc | 38 +
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDxe.inf | 1 +
31 files changed, 3467 insertions(+), 112 deletions(-)
create mode 100644 SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLibVarPolicy.c
create mode 100644 SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectionLib.c
create mode 100644 SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c
create mode 100644 SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServicesTableLib.c
create mode 100644 SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnitTest.c
create mode 100644 SecurityPkg/Include/Library/PlatformPKProtectionLib.h
create mode 100644 SecurityPkg/Include/UefiSecureBoot.h
create mode 100644 SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLibVarPolicy.inf
create mode 100644 SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectionLib.inf
create mode 100644 SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf
create mode 100644 SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServicesTableLib.inf
create mode 100644 SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnitTest.inf
create mode 100644 SecurityPkg/Test/SecurityPkgHostTest.dsc

--
2.36.0.windows.1
Yao, Jiewen
 

Hi
I am going to merge this. However, I realize that my mailbox filtered patch 6/11 and 10/11.
So I am going to merge the one in https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3

Please double confirm:
1) the latest one 256220d82191effae32d91897ab0f65a4fa0641b is identical to the one you submitted to EDKII mailing list.
2) the latest one passed the EDKII CI.

Once you confirm above, I will start merging process.

Thank you
Yao Jiewen

-----Original Message-----
From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Kun Qin
Sent: Friday, July 1, 2022 7:54 AM
To: devel@edk2.groups.io
Cc: Yao, Jiewen <jiewen.yao@...>; Wang, Jian J <jian.j.wang@...>;
Xu, Min M <min.m.xu@...>; Sean Brogan <sean.brogan@...>;
Ard Biesheuvel <ardb+tianocore@...>; Justen, Jordan L
<jordan.l.justen@...>; Gerd Hoffmann <kraxel@...>; Rebecca
Cran <rebecca@...>; Peter Grehan <grehan@...>; Boeuf,
Sebastien <sebastien.boeuf@...>; Andrew Fish <afish@...>; Ni,
Ray <ray.ni@...>
Subject: [edk2-devel] [PATCH v3 00/11] Enhance Secure Boot Variable Libraries

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3909
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3910
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3911

This is a follow-up of a previously submitted patch series based on top
of master branch: https://edk2.groups.io/g/devel/message/90491.

The main changes between v2 and v3 patches are:
- Added reviewed-by and acked-by tags collected from previous iteration
- Updated default timestamp for default secure boot variable enrollment

The updated changes are verified on QEMU based Q35 virtual platform as
well as proprietary physical platforms.

Patch v3 branch:
https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3

Cc: Jiewen Yao <jiewen.yao@...>
Cc: Jian J Wang <jian.j.wang@...>
Cc: Min Xu <min.m.xu@...>
Cc: Sean Brogan <sean.brogan@...>
Cc: Ard Biesheuvel <ardb+tianocore@...>
Cc: Jordan Justen <jordan.l.justen@...>
Cc: Gerd Hoffmann <kraxel@...>
Cc: Rebecca Cran <rebecca@...>
Cc: Peter Grehan <grehan@...>
Cc: Sebastien Boeuf <sebastien.boeuf@...>
Cc: Andrew Fish <afish@...>
Cc: Ray Ni <ray.ni@...>

Kun Qin (8):
SecurityPkg: UefiSecureBoot: Definitions of cert and payload
structures
SecurityPkg: PlatformPKProtectionLib: Added PK protection interface
SecurityPkg: SecureBootVariableLib: Updated time based payload creator
SecurityPkg: SecureBootVariableProvisionLib: Updated implementation
SecurityPkg: Secure Boot Drivers: Added common header files
SecurityPkg: SecureBootConfigDxe: Updated invocation pattern
OvmfPkg: Pipeline: Resolve SecureBootVariableLib dependency
EmulatorPkg: Pipeline: Resolve SecureBootVariableLib dependency

kuqin (3):
SecurityPkg: SecureBootVariableLib: Updated signature list creator
SecurityPkg: SecureBootVariableLib: Added newly supported interfaces
SecurityPkg: SecureBootVariableLib: Added unit tests

SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c
| 1 +

SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib
VarPolicy.c | 51 +
SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c
| 485 ++++-

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio
nLib.c | 36 +
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c
| 201 ++

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices
TableLib.c | 13 +

SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit
Test.c | 2037 ++++++++++++++++++++

SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvisi
onLib.c | 145 +-

SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigIm
pl.c | 128 +-

SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefa
ultKeysDxe.c | 1 +
EmulatorPkg/EmulatorPkg.dsc | 1 +
OvmfPkg/Bhyve/BhyveX64.dsc | 1 +
OvmfPkg/CloudHv/CloudHvX64.dsc | 1 +
OvmfPkg/IntelTdx/IntelTdxX64.dsc | 1 +
OvmfPkg/OvmfPkgIa32.dsc | 1 +
OvmfPkg/OvmfPkgIa32X64.dsc | 1 +
OvmfPkg/OvmfPkgX64.dsc | 1 +
SecurityPkg/Include/Library/PlatformPKProtectionLib.h |
31 +
SecurityPkg/Include/Library/SecureBootVariableLib.h |
103 +-
SecurityPkg/Include/UefiSecureBoot.h | 94 +

SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib
VarPolicy.inf | 36 +
SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
| 14 +-

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio
nLib.inf | 33 +
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf
| 45 +

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices
TableLib.inf | 25 +

SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit
Test.inf | 36 +
SecurityPkg/SecurityPkg.ci.yaml | 11 +
SecurityPkg/SecurityPkg.dec | 5 +
SecurityPkg/SecurityPkg.dsc | 2 +
SecurityPkg/Test/SecurityPkgHostTest.dsc | 38 +

SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDx
e.inf | 1 +
31 files changed, 3467 insertions(+), 112 deletions(-)
create mode 100644
SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib
VarPolicy.c
create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio
nLib.c
create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c
create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices
TableLib.c
create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit
Test.c
create mode 100644 SecurityPkg/Include/Library/PlatformPKProtectionLib.h
create mode 100644 SecurityPkg/Include/UefiSecureBoot.h
create mode 100644
SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib
VarPolicy.inf
create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio
nLib.inf
create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf
create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices
TableLib.inf
create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit
Test.inf
create mode 100644 SecurityPkg/Test/SecurityPkgHostTest.dsc

--
2.36.0.windows.1
Kun Qin
 

Hi Jiewen,

Yes, the "https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3" is the branch I generate these patch series. And they have not been changed after sending v3 patches.

I confirm that:
1. the latest update 256220d82191effae32d91897ab0f65a4fa0641b is identical to the one I submitted to mailing list;
2. the branch passed EDKII CI when I prepared this branch and the PR is Secure boot enhance v3 by kuqin12 · Pull Request #3035 · tianocore/edk2 (github.com).

Thanks a lot for the help! Please let me know if you encounter any issues when merging these patches.

Regards,
Kun

On 7/5/2022 10:19 PM, Yao, Jiewen wrote:
Hi
I am going to merge this. However, I realize that my mailbox filtered patch 6/11 and 10/11.
So I am going to merge the one in https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3 

Please double confirm:
1) the latest one 256220d82191effae32d91897ab0f65a4fa0641b is identical to the one you submitted to EDKII mailing list.
2) the latest one passed the EDKII CI.

Once you confirm above, I will start merging process.

Thank you
Yao Jiewen


-----Original Message-----
From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Kun Qin
Sent: Friday, July 1, 2022 7:54 AM
To: devel@edk2.groups.io
Cc: Yao, Jiewen <jiewen.yao@...>; Wang, Jian J <jian.j.wang@...>;
Xu, Min M <min.m.xu@...>; Sean Brogan <sean.brogan@...>;
Ard Biesheuvel <ardb+tianocore@...>; Justen, Jordan L
<jordan.l.justen@...>; Gerd Hoffmann <kraxel@...>; Rebecca
Cran <rebecca@...>; Peter Grehan <grehan@...>; Boeuf,
Sebastien <sebastien.boeuf@...>; Andrew Fish <afish@...>; Ni,
Ray <ray.ni@...>
Subject: [edk2-devel] [PATCH v3 00/11] Enhance Secure Boot Variable Libraries

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3909
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3910
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3911

This is a follow-up of a previously submitted patch series based on top
of master branch: https://edk2.groups.io/g/devel/message/90491.

The main changes between v2 and v3 patches are:
  - Added reviewed-by and acked-by tags collected from previous iteration
  - Updated default timestamp for default secure boot variable enrollment

The updated changes are verified on QEMU based Q35 virtual platform as
well as proprietary physical platforms.

Patch v3 branch:
https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3

Cc: Jiewen Yao <jiewen.yao@...>
Cc: Jian J Wang <jian.j.wang@...>
Cc: Min Xu <min.m.xu@...>
Cc: Sean Brogan <sean.brogan@...>
Cc: Ard Biesheuvel <ardb+tianocore@...>
Cc: Jordan Justen <jordan.l.justen@...>
Cc: Gerd Hoffmann <kraxel@...>
Cc: Rebecca Cran <rebecca@...>
Cc: Peter Grehan <grehan@...>
Cc: Sebastien Boeuf <sebastien.boeuf@...>
Cc: Andrew Fish <afish@...>
Cc: Ray Ni <ray.ni@...>

Kun Qin (8):
  SecurityPkg: UefiSecureBoot: Definitions of cert and payload
    structures
  SecurityPkg: PlatformPKProtectionLib: Added PK protection interface
  SecurityPkg: SecureBootVariableLib: Updated time based payload creator
  SecurityPkg: SecureBootVariableProvisionLib: Updated implementation
  SecurityPkg: Secure Boot Drivers: Added common header files
  SecurityPkg: SecureBootConfigDxe: Updated invocation pattern
  OvmfPkg: Pipeline: Resolve SecureBootVariableLib dependency
  EmulatorPkg: Pipeline: Resolve SecureBootVariableLib dependency

kuqin (3):
  SecurityPkg: SecureBootVariableLib: Updated signature list creator
  SecurityPkg: SecureBootVariableLib: Added newly supported interfaces
  SecurityPkg: SecureBootVariableLib: Added unit tests

 SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c
|    1 +

SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib
VarPolicy.c   |   51 +
 SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c
|  485 ++++-

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio
nLib.c          |   36 +
 SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c
|  201 ++

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices
TableLib.c      |   13 +

SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit
Test.c        | 2037 ++++++++++++++++++++

SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvisi
onLib.c       |  145 +-

SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigIm
pl.c              |  128 +-

SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefa
ultKeysDxe.c     |    1 +
 EmulatorPkg/EmulatorPkg.dsc                                                               |    1 +
 OvmfPkg/Bhyve/BhyveX64.dsc                                                                |    1 +
 OvmfPkg/CloudHv/CloudHvX64.dsc                                                            |    1 +
 OvmfPkg/IntelTdx/IntelTdxX64.dsc                                                          |    1 +
 OvmfPkg/OvmfPkgIa32.dsc                                                                   |    1 +
 OvmfPkg/OvmfPkgIa32X64.dsc                                                                |    1 +
 OvmfPkg/OvmfPkgX64.dsc                                                                    |    1 +
 SecurityPkg/Include/Library/PlatformPKProtectionLib.h                                     |
31 +
 SecurityPkg/Include/Library/SecureBootVariableLib.h                                       |
103 +-
 SecurityPkg/Include/UefiSecureBoot.h                                                      |   94 +

SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib
VarPolicy.inf |   36 +
 SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
|   14 +-

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio
nLib.inf        |   33 +
 SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf
|   45 +

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices
TableLib.inf    |   25 +

SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit
Test.inf      |   36 +
 SecurityPkg/SecurityPkg.ci.yaml                                                           |   11 +
 SecurityPkg/SecurityPkg.dec                                                               |    5 +
 SecurityPkg/SecurityPkg.dsc                                                               |    2 +
 SecurityPkg/Test/SecurityPkgHostTest.dsc                                                  |   38 +

SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDx
e.inf             |    1 +
 31 files changed, 3467 insertions(+), 112 deletions(-)
 create mode 100644
SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib
VarPolicy.c
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio
nLib.c
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices
TableLib.c
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit
Test.c
 create mode 100644 SecurityPkg/Include/Library/PlatformPKProtectionLib.h
 create mode 100644 SecurityPkg/Include/UefiSecureBoot.h
 create mode 100644
SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib
VarPolicy.inf
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio
nLib.inf
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices
TableLib.inf
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit
Test.inf
 create mode 100644 SecurityPkg/Test/SecurityPkgHostTest.dsc

--
2.36.0.windows.1

Yao, Jiewen
 

Merged https://github.com/tianocore/edk2/pull/3050

 

From: Kun Qin <kuqin12@...>
Sent: Thursday, July 7, 2022 1:44 AM
To: devel@edk2.groups.io; Yao, Jiewen <jiewen.yao@...>
Cc: Wang, Jian J <jian.j.wang@...>; Xu, Min M <min.m.xu@...>; Sean Brogan <sean.brogan@...>; Ard Biesheuvel <ardb+tianocore@...>; Justen, Jordan L <jordan.l.justen@...>; Gerd Hoffmann <kraxel@...>; Rebecca Cran <rebecca@...>; Peter Grehan <grehan@...>; Boeuf, Sebastien <sebastien.boeuf@...>; Andrew Fish <afish@...>; Ni, Ray <ray.ni@...>
Subject: Re: [edk2-devel] [PATCH v3 00/11] Enhance Secure Boot Variable Libraries

 

Hi Jiewen,

Yes, the "https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3" is the branch I generate these patch series. And they have not been changed after sending v3 patches.

I confirm that:
1. the latest update 256220d82191effae32d91897ab0f65a4fa0641b is identical to the one I submitted to mailing list;
2. the branch passed EDKII CI when I prepared this branch and the PR is Secure boot enhance v3 by kuqin12 · Pull Request #3035 · tianocore/edk2 (github.com).

Thanks a lot for the help! Please let me know if you encounter any issues when merging these patches.

Regards,
Kun

On 7/5/2022 10:19 PM, Yao, Jiewen wrote:

Hi
I am going to merge this. However, I realize that my mailbox filtered patch 6/11 and 10/11.
So I am going to merge the one in https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3 
 
Please double confirm:
1) the latest one 256220d82191effae32d91897ab0f65a4fa0641b is identical to the one you submitted to EDKII mailing list.
2) the latest one passed the EDKII CI.
 
Once you confirm above, I will start merging process.
 
Thank you
Yao Jiewen
 
-----Original Message-----
From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Kun Qin
Sent: Friday, July 1, 2022 7:54 AM
To: devel@edk2.groups.io
Cc: Yao, Jiewen <jiewen.yao@...>; Wang, Jian J <jian.j.wang@...>;
Xu, Min M <min.m.xu@...>; Sean Brogan <sean.brogan@...>;
Ard Biesheuvel <ardb+tianocore@...>; Justen, Jordan L
<jordan.l.justen@...>; Gerd Hoffmann <kraxel@...>; Rebecca
Cran <rebecca@...>; Peter Grehan <grehan@...>; Boeuf,
Sebastien <sebastien.boeuf@...>; Andrew Fish <afish@...>; Ni,
Ray <ray.ni@...>
Subject: [edk2-devel] [PATCH v3 00/11] Enhance Secure Boot Variable Libraries
 
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3909
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3910
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3911
 
This is a follow-up of a previously submitted patch series based on top
of master branch: https://edk2.groups.io/g/devel/message/90491.
 
The main changes between v2 and v3 patches are:
  - Added reviewed-by and acked-by tags collected from previous iteration
  - Updated default timestamp for default secure boot variable enrollment
 
The updated changes are verified on QEMU based Q35 virtual platform as
well as proprietary physical platforms.
 
Patch v3 branch:
https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3
 
Cc: Jiewen Yao <jiewen.yao@...>
Cc: Jian J Wang <jian.j.wang@...>
Cc: Min Xu <min.m.xu@...>
Cc: Sean Brogan <sean.brogan@...>
Cc: Ard Biesheuvel <ardb+tianocore@...>
Cc: Jordan Justen <jordan.l.justen@...>
Cc: Gerd Hoffmann <kraxel@...>
Cc: Rebecca Cran <rebecca@...>
Cc: Peter Grehan <grehan@...>
Cc: Sebastien Boeuf <sebastien.boeuf@...>
Cc: Andrew Fish <afish@...>
Cc: Ray Ni <ray.ni@...>
 
Kun Qin (8):
  SecurityPkg: UefiSecureBoot: Definitions of cert and payload
    structures
  SecurityPkg: PlatformPKProtectionLib: Added PK protection interface
  SecurityPkg: SecureBootVariableLib: Updated time based payload creator
  SecurityPkg: SecureBootVariableProvisionLib: Updated implementation
  SecurityPkg: Secure Boot Drivers: Added common header files
  SecurityPkg: SecureBootConfigDxe: Updated invocation pattern
  OvmfPkg: Pipeline: Resolve SecureBootVariableLib dependency
  EmulatorPkg: Pipeline: Resolve SecureBootVariableLib dependency
 
kuqin (3):
  SecurityPkg: SecureBootVariableLib: Updated signature list creator
  SecurityPkg: SecureBootVariableLib: Added newly supported interfaces
  SecurityPkg: SecureBootVariableLib: Added unit tests
 
 SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c
|    1 +
 
SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib
VarPolicy.c   |   51 +
 SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c
|  485 ++++-
 
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio
nLib.c          |   36 +
 SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c
|  201 ++
 
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices
TableLib.c      |   13 +
 
SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit
Test.c        | 2037 ++++++++++++++++++++
 
SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvisi
onLib.c       |  145 +-
 
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigIm
pl.c              |  128 +-
 
SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefa
ultKeysDxe.c     |    1 +
 EmulatorPkg/EmulatorPkg.dsc                                                               |    1 +
 OvmfPkg/Bhyve/BhyveX64.dsc                                                                |    1 +
 OvmfPkg/CloudHv/CloudHvX64.dsc                                                            |    1 +
 OvmfPkg/IntelTdx/IntelTdxX64.dsc                                                          |    1 +
 OvmfPkg/OvmfPkgIa32.dsc                                                                   |    1 +
 OvmfPkg/OvmfPkgIa32X64.dsc                                                                |    1 +
 OvmfPkg/OvmfPkgX64.dsc                                                                    |    1 +
 SecurityPkg/Include/Library/PlatformPKProtectionLib.h                                     |
31 +
 SecurityPkg/Include/Library/SecureBootVariableLib.h                                       |
103 +-
 SecurityPkg/Include/UefiSecureBoot.h                                                      |   94 +
 
SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib
VarPolicy.inf |   36 +
 SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf
|   14 +-
 
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio
nLib.inf        |   33 +
 SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf
|   45 +
 
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices
TableLib.inf    |   25 +
 
SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit
Test.inf      |   36 +
 SecurityPkg/SecurityPkg.ci.yaml                                                           |   11 +
 SecurityPkg/SecurityPkg.dec                                                               |    5 +
 SecurityPkg/SecurityPkg.dsc                                                               |    2 +
 SecurityPkg/Test/SecurityPkgHostTest.dsc                                                  |   38 +
 
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDx
e.inf             |    1 +
 31 files changed, 3467 insertions(+), 112 deletions(-)
 create mode 100644
SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib
VarPolicy.c
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio
nLib.c
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices
TableLib.c
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit
Test.c
 create mode 100644 SecurityPkg/Include/Library/PlatformPKProtectionLib.h
 create mode 100644 SecurityPkg/Include/UefiSecureBoot.h
 create mode 100644
SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib
VarPolicy.inf
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio
nLib.inf
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices
TableLib.inf
 create mode 100644
SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit
Test.inf
 create mode 100644 SecurityPkg/Test/SecurityPkgHostTest.dsc
 
--
2.36.0.windows.1
 
 
 
 
 
 
 
 


 


 








          

          
        
        
        
      


      
      


      

    


  
    

      
      

        

        

        
          

            

              
              
            

          

        
        
      
      

        

          

        

      

      
    		
    
    
      
    
    
  




    
  
  
  

    
    
    

    
      


      

        

          

            
            
              
                
  
    
      
    
    
  
	
    Kun Qin
	

  

              
            
          

          

            
              


            
              
            
            
          

        

      

      

      

        

  
  
    
Thank you so much for the help, Jiewen!

    

        
          
          

          

            
On 7/6/2022 6:09 PM, Yao, Jiewen wrote:

    

    

      
      
      
      

        
Merged 
            https://github.com/tianocore/edk2/pull/3050

        
 

        

          

            

              
From: Kun Qin
                <kuqin12@...> 

                Sent: Thursday, July 7, 2022 1:44 AM

                To: devel@edk2.groups.io; Yao, Jiewen
                <jiewen.yao@...>

                Cc: Wang, Jian J <jian.j.wang@...>;
                Xu, Min M <min.m.xu@...>; Sean Brogan
                <sean.brogan@...>; Ard Biesheuvel
                <ardb+tianocore@...>; Justen, Jordan L
                <jordan.l.justen@...>; Gerd Hoffmann
                <kraxel@...>; Rebecca Cran
                <rebecca@...>; Peter Grehan
                <grehan@...>; Boeuf, Sebastien
                <sebastien.boeuf@...>; Andrew Fish
                <afish@...>; Ni, Ray
                <ray.ni@...>

                Subject: Re: [edk2-devel] [PATCH v3 00/11]
                Enhance Secure Boot Variable Libraries

            

          

          
 

          
Hi Jiewen,

            

            Yes, the "https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3"
            is the branch I generate these patch series. And they have
            not been changed after sending v3 patches.

            

            I confirm that:

            1. the latest update
            256220d82191effae32d91897ab0f65a4fa0641b is identical to the
            one I submitted to mailing list;

            2. the branch passed EDKII CI when I prepared this branch
            and the PR is 
              Secure boot enhance v3 by kuqin12 · Pull Request #3035 ·
              tianocore/edk2 (github.com).

            

            Thanks a lot for the help! Please let me know if you
            encounter any issues when merging these patches.

            

            Regards,

            Kun

          

            
On 7/5/2022 10:19 PM, Yao, Jiewen
              wrote:

          

          

            
Hi

            
I am going to merge this. However, I realize that my mailbox filtered patch 6/11 and 10/11.

            
So I am going to merge the one in https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3 

            
 

            
Please double confirm:

            
1) the latest one 256220d82191effae32d91897ab0f65a4fa0641b is identical to the one you submitted to EDKII mailing list.

            
2) the latest one passed the EDKII CI.

            
 

            
Once you confirm above, I will start merging process.

            
 

            
Thank you

            
Yao Jiewen

            
 

            

              
-----Original Message-----

              
From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Kun Qin

              
Sent: Friday, July 1, 2022 7:54 AM

              
To: devel@edk2.groups.io

              
Cc: Yao, Jiewen <jiewen.yao@...>; Wang, Jian J <jian.j.wang@...>;

              
Xu, Min M <min.m.xu@...>; Sean Brogan <sean.brogan@...>;

              
Ard Biesheuvel <ardb+tianocore@...>; Justen, Jordan L

              
<jordan.l.justen@...>; Gerd Hoffmann <kraxel@...>; Rebecca

              
Cran <rebecca@...>; Peter Grehan <grehan@...>; Boeuf,

              
Sebastien <sebastien.boeuf@...>; Andrew Fish <afish@...>; Ni,

              
Ray <ray.ni@...>

              
Subject: [edk2-devel] [PATCH v3 00/11] Enhance Secure Boot Variable Libraries

              
 

              
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3909

              
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3910

              
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3911

              
 

              
This is a follow-up of a previously submitted patch series based on top

              
of master branch: https://edk2.groups.io/g/devel/message/90491.

              
 

              
The main changes between v2 and v3 patches are:

              
  - Added reviewed-by and acked-by tags collected from previous iteration

              
  - Updated default timestamp for default secure boot variable enrollment

              
 

              
The updated changes are verified on QEMU based Q35 virtual platform as

              
well as proprietary physical platforms.

              
 

              
Patch v3 branch:

              
https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3

              
 

              
Cc: Jiewen Yao <jiewen.yao@...>

              
Cc: Jian J Wang <jian.j.wang@...>

              
Cc: Min Xu <min.m.xu@...>

              
Cc: Sean Brogan <sean.brogan@...>

              
Cc: Ard Biesheuvel <ardb+tianocore@...>

              
Cc: Jordan Justen <jordan.l.justen@...>

              
Cc: Gerd Hoffmann <kraxel@...>

              
Cc: Rebecca Cran <rebecca@...>

              
Cc: Peter Grehan <grehan@...>

              
Cc: Sebastien Boeuf <sebastien.boeuf@...>

              
Cc: Andrew Fish <afish@...>

              
Cc: Ray Ni <ray.ni@...>

              
 

              
Kun Qin (8):

              
  SecurityPkg: UefiSecureBoot: Definitions of cert and payload

              
    structures

              
  SecurityPkg: PlatformPKProtectionLib: Added PK protection interface

              
  SecurityPkg: SecureBootVariableLib: Updated time based payload creator

              
  SecurityPkg: SecureBootVariableProvisionLib: Updated implementation

              
  SecurityPkg: Secure Boot Drivers: Added common header files

              
  SecurityPkg: SecureBootConfigDxe: Updated invocation pattern

              
  OvmfPkg: Pipeline: Resolve SecureBootVariableLib dependency

              
  EmulatorPkg: Pipeline: Resolve SecureBootVariableLib dependency

              
 

              
kuqin (3):

              
  SecurityPkg: SecureBootVariableLib: Updated signature list creator

              
  SecurityPkg: SecureBootVariableLib: Added newly supported interfaces

              
  SecurityPkg: SecureBootVariableLib: Added unit tests

              
 

              
 SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c

              
|    1 +

              
 

              
SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib

              
VarPolicy.c   |   51 +

              
 SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c

              
|  485 ++++-

              
 

              
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio

              
nLib.c          |   36 +

              
 SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c

              
|  201 ++

              
 

              
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices

              
TableLib.c      |   13 +

              
 

              
SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit

              
Test.c        | 2037 ++++++++++++++++++++

              
 

              
SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvisi

              
onLib.c       |  145 +-

              
 

              
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigIm

              
pl.c              |  128 +-

              
 

              
SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefa

              
ultKeysDxe.c     |    1 +

              
 EmulatorPkg/EmulatorPkg.dsc                                                               |    1 +

              
 OvmfPkg/Bhyve/BhyveX64.dsc                                                                |    1 +

              
 OvmfPkg/CloudHv/CloudHvX64.dsc                                                            |    1 +

              
 OvmfPkg/IntelTdx/IntelTdxX64.dsc                                                          |    1 +

              
 OvmfPkg/OvmfPkgIa32.dsc                                                                   |    1 +

              
 OvmfPkg/OvmfPkgIa32X64.dsc                                                                |    1 +

              
 OvmfPkg/OvmfPkgX64.dsc                                                                    |    1 +

              
 SecurityPkg/Include/Library/PlatformPKProtectionLib.h                                     |

              
31 +

              
 SecurityPkg/Include/Library/SecureBootVariableLib.h                                       |

              
103 +-

              
 SecurityPkg/Include/UefiSecureBoot.h                                                      |   94 +

              
 

              
SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib

              
VarPolicy.inf |   36 +

              
 SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf

              
|   14 +-

              
 

              
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio

              
nLib.inf        |   33 +

              
 SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf

              
|   45 +

              
 

              
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices

              
TableLib.inf    |   25 +

              
 

              
SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit

              
Test.inf      |   36 +

              
 SecurityPkg/SecurityPkg.ci.yaml                                                           |   11 +

              
 SecurityPkg/SecurityPkg.dec                                                               |    5 +

              
 SecurityPkg/SecurityPkg.dsc                                                               |    2 +

              
 SecurityPkg/Test/SecurityPkgHostTest.dsc                                                  |   38 +

              
 

              
SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDx

              
e.inf             |    1 +

              
 31 files changed, 3467 insertions(+), 112 deletions(-)

              
 create mode 100644

              
SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib

              
VarPolicy.c

              
 create mode 100644

              
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio

              
nLib.c

              
 create mode 100644

              
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c

              
 create mode 100644

              
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices

              
TableLib.c

              
 create mode 100644

              
SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit

              
Test.c

              
 create mode 100644 SecurityPkg/Include/Library/PlatformPKProtectionLib.h

              
 create mode 100644 SecurityPkg/Include/UefiSecureBoot.h

              
 create mode 100644

              
SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib

              
VarPolicy.inf

              
 create mode 100644

              
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio

              
nLib.inf

              
 create mode 100644

              
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf

              
 create mode 100644

              
SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices

              
TableLib.inf

              
 create mode 100644

              
SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit

              
Test.inf

              
 create mode 100644 SecurityPkg/Test/SecurityPkgHostTest.dsc

              
 

              
--

              
2.36.0.windows.1

              
 

              
 

              
 

              
 

              
 

            

            
 

            
 

            
 

            

            
 

            
 

          

        

      

      
    

  


          

          
        
        
        
      


      
      


      

    


  
    

      
      

        

        

        
          

            

              
              
            

          

        
        
      
      

        

          

        

      

      
    		
    
    
      
    
    
  




    
  
  
  

    
    
    

    
      


      

        

          

            
            
              
                
  
    
      
    
    
  
	
    Ard Biesheuvel
	

  

              
            
          

          

            
              


            
              
            
            
          

        

      

      

      

        
I think this series has broken some ARM platforms, please double check.

https://ci.linaro.org/job/leg-virt-tianocore-edk2-upstream/4573/console

        
          
          

          

            
On Thu, 7 Jul 2022 at 03:09, Yao, Jiewen <jiewen.yao@...> wrote:

Merged https://github.com/tianocore/edk2/pull/3050



From: Kun Qin <kuqin12@...>
Sent: Thursday, July 7, 2022 1:44 AM
To: devel@edk2.groups.io; Yao, Jiewen <jiewen.yao@...>
Cc: Wang, Jian J <jian.j.wang@...>; Xu, Min M <min.m.xu@...>; Sean Brogan <sean.brogan@...>; Ard Biesheuvel <ardb+tianocore@...>; Justen, Jordan L <jordan.l.justen@...>; Gerd Hoffmann <kraxel@...>; Rebecca Cran <rebecca@...>; Peter Grehan <grehan@...>; Boeuf, Sebastien <sebastien.boeuf@...>; Andrew Fish <afish@...>; Ni, Ray <ray.ni@...>
Subject: Re: [edk2-devel] [PATCH v3 00/11] Enhance Secure Boot Variable Libraries



Hi Jiewen,

Yes, the "https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3" is the branch I generate these patch series. And they have not been changed after sending v3 patches.

I confirm that:
1. the latest update 256220d82191effae32d91897ab0f65a4fa0641b is identical to the one I submitted to mailing list;
2. the branch passed EDKII CI when I prepared this branch and the PR is Secure boot enhance v3 by kuqin12 · Pull Request #3035 · tianocore/edk2 (github.com).

Thanks a lot for the help! Please let me know if you encounter any issues when merging these patches.

Regards,
Kun

On 7/5/2022 10:19 PM, Yao, Jiewen wrote:

Hi

I am going to merge this. However, I realize that my mailbox filtered patch 6/11 and 10/11.

So I am going to merge the one in https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3



Please double confirm:

1) the latest one 256220d82191effae32d91897ab0f65a4fa0641b is identical to the one you submitted to EDKII mailing list.

2) the latest one passed the EDKII CI.



Once you confirm above, I will start merging process.



Thank you

Yao Jiewen



-----Original Message-----

From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Kun Qin

Sent: Friday, July 1, 2022 7:54 AM

To: devel@edk2.groups.io

Cc: Yao, Jiewen <jiewen.yao@...>; Wang, Jian J <jian.j.wang@...>;

Xu, Min M <min.m.xu@...>; Sean Brogan <sean.brogan@...>;

Ard Biesheuvel <ardb+tianocore@...>; Justen, Jordan L

<jordan.l.justen@...>; Gerd Hoffmann <kraxel@...>; Rebecca

Cran <rebecca@...>; Peter Grehan <grehan@...>; Boeuf,

Sebastien <sebastien.boeuf@...>; Andrew Fish <afish@...>; Ni,

Ray <ray.ni@...>

Subject: [edk2-devel] [PATCH v3 00/11] Enhance Secure Boot Variable Libraries



REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3909

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3910

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3911



This is a follow-up of a previously submitted patch series based on top

of master branch: https://edk2.groups.io/g/devel/message/90491.



The main changes between v2 and v3 patches are:

  - Added reviewed-by and acked-by tags collected from previous iteration

  - Updated default timestamp for default secure boot variable enrollment



The updated changes are verified on QEMU based Q35 virtual platform as

well as proprietary physical platforms.



Patch v3 branch:

https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3



Cc: Jiewen Yao <jiewen.yao@...>

Cc: Jian J Wang <jian.j.wang@...>

Cc: Min Xu <min.m.xu@...>

Cc: Sean Brogan <sean.brogan@...>

Cc: Ard Biesheuvel <ardb+tianocore@...>

Cc: Jordan Justen <jordan.l.justen@...>

Cc: Gerd Hoffmann <kraxel@...>

Cc: Rebecca Cran <rebecca@...>

Cc: Peter Grehan <grehan@...>

Cc: Sebastien Boeuf <sebastien.boeuf@...>

Cc: Andrew Fish <afish@...>

Cc: Ray Ni <ray.ni@...>



Kun Qin (8):

  SecurityPkg: UefiSecureBoot: Definitions of cert and payload

    structures

  SecurityPkg: PlatformPKProtectionLib: Added PK protection interface

  SecurityPkg: SecureBootVariableLib: Updated time based payload creator

  SecurityPkg: SecureBootVariableProvisionLib: Updated implementation

  SecurityPkg: Secure Boot Drivers: Added common header files

  SecurityPkg: SecureBootConfigDxe: Updated invocation pattern

  OvmfPkg: Pipeline: Resolve SecureBootVariableLib dependency

  EmulatorPkg: Pipeline: Resolve SecureBootVariableLib dependency



kuqin (3):

  SecurityPkg: SecureBootVariableLib: Updated signature list creator

  SecurityPkg: SecureBootVariableLib: Added newly supported interfaces

  SecurityPkg: SecureBootVariableLib: Added unit tests



 SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c

|    1 +



SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib

VarPolicy.c   |   51 +

 SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c

|  485 ++++-



SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio

nLib.c          |   36 +

 SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c

|  201 ++



SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices

TableLib.c      |   13 +



SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit

Test.c        | 2037 ++++++++++++++++++++



SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvisi

onLib.c       |  145 +-



SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigIm

pl.c              |  128 +-



SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefa

ultKeysDxe.c     |    1 +

 EmulatorPkg/EmulatorPkg.dsc                                                               |    1 +

 OvmfPkg/Bhyve/BhyveX64.dsc                                                                |    1 +

 OvmfPkg/CloudHv/CloudHvX64.dsc                                                            |    1 +

 OvmfPkg/IntelTdx/IntelTdxX64.dsc                                                          |    1 +

 OvmfPkg/OvmfPkgIa32.dsc                                                                   |    1 +

 OvmfPkg/OvmfPkgIa32X64.dsc                                                                |    1 +

 OvmfPkg/OvmfPkgX64.dsc                                                                    |    1 +

 SecurityPkg/Include/Library/PlatformPKProtectionLib.h                                     |

31 +

 SecurityPkg/Include/Library/SecureBootVariableLib.h                                       |

103 +-

 SecurityPkg/Include/UefiSecureBoot.h                                                      |   94 +



SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib

VarPolicy.inf |   36 +

 SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf

|   14 +-



SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio

nLib.inf        |   33 +

 SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf

|   45 +



SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices

TableLib.inf    |   25 +



SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit

Test.inf      |   36 +

 SecurityPkg/SecurityPkg.ci.yaml                                                           |   11 +

 SecurityPkg/SecurityPkg.dec                                                               |    5 +

 SecurityPkg/SecurityPkg.dsc                                                               |    2 +

 SecurityPkg/Test/SecurityPkgHostTest.dsc                                                  |   38 +



SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDx

e.inf             |    1 +

 31 files changed, 3467 insertions(+), 112 deletions(-)

 create mode 100644

SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib

VarPolicy.c

 create mode 100644

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio

nLib.c

 create mode 100644

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c

 create mode 100644

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices

TableLib.c

 create mode 100644

SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit

Test.c

 create mode 100644 SecurityPkg/Include/Library/PlatformPKProtectionLib.h

 create mode 100644 SecurityPkg/Include/UefiSecureBoot.h

 create mode 100644

SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib

VarPolicy.inf

 create mode 100644

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio

nLib.inf

 create mode 100644

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf

 create mode 100644

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices

TableLib.inf

 create mode 100644

SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit

Test.inf

 create mode 100644 SecurityPkg/Test/SecurityPkgHostTest.dsc



--

2.36.0.windows.1






















          

          
        
        
        
      


      
      


      

    


  
    

      
      

        

        

        
          

            

              
              
            

          

        
        
      
      

        

          

        

      

      
    		
    
    
      
    
    
  




    
  
  
  

    
    
    

    
      


      

        

          

            
            
              
                
  
    
      
    
    
  
	
    Kun Qin
	

  

              
            
          

          

            
              


            
              
            
            
          

        

      

      

      

        
Hi Ard,

I thought pipeline should have caught this type of errors. Sorry for the inconvenience.

A patch was sent here to fix this issue:
https://edk2.groups.io/g/devel/message/91189

Regards,
Kun

        
          
          

          

            
On 7/8/2022 9:38 AM, Ard Biesheuvel wrote:
I think this series has broken some ARM platforms, please double check.

https://ci.linaro.org/job/leg-virt-tianocore-edk2-upstream/4573/console


On Thu, 7 Jul 2022 at 03:09, Yao, Jiewen <jiewen.yao@...> wrote:
Merged https://github.com/tianocore/edk2/pull/3050



From: Kun Qin <kuqin12@...>
Sent: Thursday, July 7, 2022 1:44 AM
To: devel@edk2.groups.io; Yao, Jiewen <jiewen.yao@...>
Cc: Wang, Jian J <jian.j.wang@...>; Xu, Min M <min.m.xu@...>; Sean Brogan <sean.brogan@...>; Ard Biesheuvel <ardb+tianocore@...>; Justen, Jordan L <jordan.l.justen@...>; Gerd Hoffmann <kraxel@...>; Rebecca Cran <rebecca@...>; Peter Grehan <grehan@...>; Boeuf, Sebastien <sebastien.boeuf@...>; Andrew Fish <afish@...>; Ni, Ray <ray.ni@...>
Subject: Re: [edk2-devel] [PATCH v3 00/11] Enhance Secure Boot Variable Libraries



Hi Jiewen,

Yes, the "https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3" is the branch I generate these patch series. And they have not been changed after sending v3 patches.

I confirm that:
1. the latest update 256220d82191effae32d91897ab0f65a4fa0641b is identical to the one I submitted to mailing list;
2. the branch passed EDKII CI when I prepared this branch and the PR is Secure boot enhance v3 by kuqin12 · Pull Request #3035 · tianocore/edk2 (github.com).

Thanks a lot for the help! Please let me know if you encounter any issues when merging these patches.

Regards,
Kun

On 7/5/2022 10:19 PM, Yao, Jiewen wrote:

Hi

I am going to merge this. However, I realize that my mailbox filtered patch 6/11 and 10/11.

So I am going to merge the one in https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3



Please double confirm:

1) the latest one 256220d82191effae32d91897ab0f65a4fa0641b is identical to the one you submitted to EDKII mailing list.

2) the latest one passed the EDKII CI.



Once you confirm above, I will start merging process.



Thank you

Yao Jiewen



-----Original Message-----

From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Kun Qin

Sent: Friday, July 1, 2022 7:54 AM

To: devel@edk2.groups.io

Cc: Yao, Jiewen <jiewen.yao@...>; Wang, Jian J <jian.j.wang@...>;

Xu, Min M <min.m.xu@...>; Sean Brogan <sean.brogan@...>;

Ard Biesheuvel <ardb+tianocore@...>; Justen, Jordan L

<jordan.l.justen@...>; Gerd Hoffmann <kraxel@...>; Rebecca

Cran <rebecca@...>; Peter Grehan <grehan@...>; Boeuf,

Sebastien <sebastien.boeuf@...>; Andrew Fish <afish@...>; Ni,

Ray <ray.ni@...>

Subject: [edk2-devel] [PATCH v3 00/11] Enhance Secure Boot Variable Libraries



REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3909

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3910

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3911



This is a follow-up of a previously submitted patch series based on top

of master branch: https://edk2.groups.io/g/devel/message/90491.



The main changes between v2 and v3 patches are:

   - Added reviewed-by and acked-by tags collected from previous iteration

   - Updated default timestamp for default secure boot variable enrollment



The updated changes are verified on QEMU based Q35 virtual platform as

well as proprietary physical platforms.



Patch v3 branch:

https://github.com/kuqin12/edk2/tree/secure_boot_enhance_v3



Cc: Jiewen Yao <jiewen.yao@...>

Cc: Jian J Wang <jian.j.wang@...>

Cc: Min Xu <min.m.xu@...>

Cc: Sean Brogan <sean.brogan@...>

Cc: Ard Biesheuvel <ardb+tianocore@...>

Cc: Jordan Justen <jordan.l.justen@...>

Cc: Gerd Hoffmann <kraxel@...>

Cc: Rebecca Cran <rebecca@...>

Cc: Peter Grehan <grehan@...>

Cc: Sebastien Boeuf <sebastien.boeuf@...>

Cc: Andrew Fish <afish@...>

Cc: Ray Ni <ray.ni@...>



Kun Qin (8):

   SecurityPkg: UefiSecureBoot: Definitions of cert and payload

     structures

   SecurityPkg: PlatformPKProtectionLib: Added PK protection interface

   SecurityPkg: SecureBootVariableLib: Updated time based payload creator

   SecurityPkg: SecureBootVariableProvisionLib: Updated implementation

   SecurityPkg: Secure Boot Drivers: Added common header files

   SecurityPkg: SecureBootConfigDxe: Updated invocation pattern

   OvmfPkg: Pipeline: Resolve SecureBootVariableLib dependency

   EmulatorPkg: Pipeline: Resolve SecureBootVariableLib dependency



kuqin (3):

   SecurityPkg: SecureBootVariableLib: Updated signature list creator

   SecurityPkg: SecureBootVariableLib: Added newly supported interfaces

   SecurityPkg: SecureBootVariableLib: Added unit tests



  SecurityPkg/EnrollFromDefaultKeysApp/EnrollFromDefaultKeysApp.c

|    1 +



SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib

VarPolicy.c   |   51 +

  SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.c

|  485 ++++-



SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio

nLib.c          |   36 +

  SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c

|  201 ++



SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices

TableLib.c      |   13 +



SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit

Test.c        | 2037 ++++++++++++++++++++



SecurityPkg/Library/SecureBootVariableProvisionLib/SecureBootVariableProvisi

onLib.c       |  145 +-



SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigIm

pl.c              |  128 +-



SecurityPkg/VariableAuthenticated/SecureBootDefaultKeysDxe/SecureBootDefa

ultKeysDxe.c     |    1 +

  EmulatorPkg/EmulatorPkg.dsc                                                               |    1 +

  OvmfPkg/Bhyve/BhyveX64.dsc                                                                |    1 +

  OvmfPkg/CloudHv/CloudHvX64.dsc                                                            |    1 +

  OvmfPkg/IntelTdx/IntelTdxX64.dsc                                                          |    1 +

  OvmfPkg/OvmfPkgIa32.dsc                                                                   |    1 +

  OvmfPkg/OvmfPkgIa32X64.dsc                                                                |    1 +

  OvmfPkg/OvmfPkgX64.dsc                                                                    |    1 +

  SecurityPkg/Include/Library/PlatformPKProtectionLib.h                                     |

31 +

  SecurityPkg/Include/Library/SecureBootVariableLib.h                                       |

103 +-

  SecurityPkg/Include/UefiSecureBoot.h                                                      |   94 +



SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib

VarPolicy.inf |   36 +

  SecurityPkg/Library/SecureBootVariableLib/SecureBootVariableLib.inf

|   14 +-



SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio

nLib.inf        |   33 +

  SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf

|   45 +



SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices

TableLib.inf    |   25 +



SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit

Test.inf      |   36 +

  SecurityPkg/SecurityPkg.ci.yaml                                                           |   11 +

  SecurityPkg/SecurityPkg.dec                                                               |    5 +

  SecurityPkg/SecurityPkg.dsc                                                               |    2 +

  SecurityPkg/Test/SecurityPkgHostTest.dsc                                                  |   38 +



SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigDx

e.inf             |    1 +

  31 files changed, 3467 insertions(+), 112 deletions(-)

  create mode 100644

SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib

VarPolicy.c

  create mode 100644

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio

nLib.c

  create mode 100644

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.c

  create mode 100644

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices

TableLib.c

  create mode 100644

SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit

Test.c

  create mode 100644 SecurityPkg/Include/Library/PlatformPKProtectionLib.h

  create mode 100644 SecurityPkg/Include/UefiSecureBoot.h

  create mode 100644

SecurityPkg/Library/PlatformPKProtectionLibVarPolicy/PlatformPKProtectionLib

VarPolicy.inf

  create mode 100644

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockPlatformPKProtectio

nLib.inf

  create mode 100644

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiLib.inf

  create mode 100644

SecurityPkg/Library/SecureBootVariableLib/UnitTest/MockUefiRuntimeServices

TableLib.inf

  create mode 100644

SecurityPkg/Library/SecureBootVariableLib/UnitTest/SecureBootVariableLibUnit

Test.inf

  create mode 100644 SecurityPkg/Test/SecurityPkgHostTest.dsc



--

2.36.0.windows.1






















          

          
        
        
        
      


      
      


      

    


  
    

      
      

        

        

        
          

            

              
              
            

          

        
        
      
      

        

          

        

      

      
    		
    
    
      
    
    
  









  
  
  

  
  



  

    
    
    

    
    
  



  

    
    

    
    
  


  




  
  
  
  
  
  





  



  
    

      

        

          
						
							1 - 7 of 7