[PATCH v5 16/19] SecurityPkg: Add VariableKey library function

["Judah Vang" <judah.vang@intel.com>]

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2594

V5: Applied code review comments. Add PEIM to library class

V1: Provide function that retrieves the key for protected
variables.

Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Nishant C Mistry <nishant.c.mistry@intel.com>
Signed-off-by: Jian J Wang <jian.j.wang@intel.com>
Signed-off-by: Nishant C Mistry <nishant.c.mistry@intel.com>
Signed-off-by: Judah Vang <judah.vang@intel.com>
---
 SecurityPkg/Library/VariableKeyLib/VariableKeyLib.inf | 36 ++++++++++++
 SecurityPkg/Library/VariableKeyLib/VariableKeyLib.c   | 59 ++++++++++++++++++++
 2 files changed, 95 insertions(+)

diff --git a/SecurityPkg/Library/VariableKeyLib/VariableKeyLib.inf b/SecurityPkg/Library/VariableKeyLib/VariableKeyLib.inf
new file mode 100644
index 000000000000..a9f7bb5afefd
--- /dev/null
+++ b/SecurityPkg/Library/VariableKeyLib/VariableKeyLib.inf
@@ -0,0 +1,36 @@
+## @file
+#  Provides default implementation of VariableKeyLib.
+#
+#  Copyright (c) 2022, Intel Corporation. All rights reserved.<BR>
+#  SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+##
+
+[Defines]
+  INF_VERSION                    = 0x00010029
+  BASE_NAME                      = VariableKeyLib
+  FILE_GUID                      = 7DF5A0BA-1DBB-4E67-A9F7-9FCCB1F9D250
+  MODULE_TYPE                    = BASE
+  VERSION_STRING                 = 1.0
+  LIBRARY_CLASS                  = VariableKeyLib|PEIM
+
+#
+# The following information is for reference only and not required by the build tools.
+#
+#  VALID_ARCHITECTURES           = IA32 X64 Arm AArch64
+#
+
+[Sources]
+  VariableKeyLib.c
+
+[Packages]
+  MdePkg/MdePkg.dec
+  SecurityPkg/SecurityPkg.dec
+
+[LibraryClasses]
+  BaseLib
+  DebugLib
+
+[PpiS]
+  gKeyServicePpiGuid ## CONSUMES
+
diff --git a/SecurityPkg/Library/VariableKeyLib/VariableKeyLib.c b/SecurityPkg/Library/VariableKeyLib/VariableKeyLib.c
new file mode 100644
index 000000000000..31b22782cb0c
--- /dev/null
+++ b/SecurityPkg/Library/VariableKeyLib/VariableKeyLib.c
@@ -0,0 +1,59 @@
+/** @file
+  VariableKeyLib implementation.
+
+Copyright (c) 2022, Intel Corporation. All rights reserved.<BR>
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include <PiPei.h>
+
+#include <Library/PeiServicesLib.h>
+#include <Library/DebugLib.h>
+#include <Library/VariableKeyLib.h>
+
+#include <Ppi/KeyServicePpi.h>
+
+#define VAR_KEY_SALT       L"Key for RPMC Variable"
+#define VAR_KEY_SALT_SIZE  sizeof (VAR_KEY_SALT)
+
+/**
+  Retrieves the key for integrity and/or confidentiality of variables.
+
+  @param[out]     VariableKey         A pointer to pointer for the variable key buffer.
+  @param[in]      VariableKeySize     The size in bytes of the variable key.
+
+  @retval       EFI_SUCCESS             The variable key was returned.
+  @retval       EFI_DEVICE_ERROR        An error occurred while attempting to get the variable key.
+  @retval       EFI_ACCESS_DENIED       The function was invoked after locking the key interface.
+  @retval       EFI_UNSUPPORTED         The variable key is not supported in the current boot configuration.
+**/
+EFI_STATUS
+EFIAPI
+GetVariableKey (
+  OUT VOID   *VariableKey,
+  IN  UINTN  VariableKeySize
+  )
+{
+  EFI_STATUS       Status;
+  KEY_SERVICE_PPI  *KeyService;
+
+  Status = PeiServicesLocatePpi (
+             &gKeyServicePpiGuid,
+             0,
+             NULL,
+             (void **)&KeyService
+             );
+  if (EFI_ERROR (Status)) {
+    ASSERT_EFI_ERROR (Status);
+    return Status;
+  }
+
+  Status = KeyService->GenerateKey (
+                         (UINT8 *)VAR_KEY_SALT,
+                         VAR_KEY_SALT_SIZE,
+                         VariableKey,
+                         VariableKeySize
+                         );
+  return Status;
+}
-- 
2.35.1.windows.2