From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga17.intel.com (mga17.intel.com [192.55.52.151]) by mx.groups.io with SMTP id smtpd.web12.7397.1584498402806174587 for ; Tue, 17 Mar 2020 19:26:42 -0700 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 192.55.52.151, mailfrom: jiewen.yao@intel.com) IronPort-SDR: MCc/x+8an9isZUGJwF3852irZPWtcul8vvzyQ6A6B1x6OIBdVzTXdhax6wWsW4PAQmSoRhpZNa SIJp/tV3N6nw== X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from fmsmga008.fm.intel.com ([10.253.24.58]) by fmsmga107.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Mar 2020 19:26:42 -0700 IronPort-SDR: s3W0Imkb0VqFMSc1Ovkk91kMKOT/XJSpf1k+QhdTHQgeOh+VEmaI+EzadXvpXB+cYN++/r5+U2 sV7X8cOQyIfw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.70,565,1574150400"; d="scan'208";a="238071827" Received: from fmsmsx103.amr.corp.intel.com ([10.18.124.201]) by fmsmga008.fm.intel.com with ESMTP; 17 Mar 2020 19:26:42 -0700 Received: from fmsmsx124.amr.corp.intel.com (10.18.125.39) by FMSMSX103.amr.corp.intel.com (10.18.124.201) with Microsoft SMTP Server (TLS) id 14.3.439.0; Tue, 17 Mar 2020 19:26:41 -0700 Received: from shsmsx106.ccr.corp.intel.com (10.239.4.159) by fmsmsx124.amr.corp.intel.com (10.18.125.39) with Microsoft SMTP Server (TLS) id 14.3.439.0; Tue, 17 Mar 2020 19:26:42 -0700 Received: from shsmsx102.ccr.corp.intel.com ([169.254.2.50]) by SHSMSX106.ccr.corp.intel.com ([169.254.10.86]) with mapi id 14.03.0439.000; Wed, 18 Mar 2020 10:26:38 +0800 From: "Yao, Jiewen" To: "Wang, Jian J" , "devel@edk2.groups.io" CC: "Zhang, Chao B" , "Mistry, Nishant C" Subject: Re: [PATCH v3 1/3] SecurityPkg: add RpmcLib and VariableKeyLib public headers Thread-Topic: [PATCH v3 1/3] SecurityPkg: add RpmcLib and VariableKeyLib public headers Thread-Index: AQHV/MrKKotOXIYAHUqOcGwuxjlpIqhNndwQ Date: Wed, 18 Mar 2020 02:26:37 +0000 Message-ID: <74D8A39837DF1E4DA445A8C0B3885C503F98828A@shsmsx102.ccr.corp.intel.com> References: <20200318021304.2014-1-jian.j.wang@intel.com> <20200318021304.2014-2-jian.j.wang@intel.com> In-Reply-To: <20200318021304.2014-2-jian.j.wang@intel.com> Accept-Language: zh-CN, en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: dlp-product: dlpe-windows dlp-version: 11.2.0.6 dlp-reaction: no-action x-originating-ip: [10.239.127.40] MIME-Version: 1.0 Return-Path: jiewen.yao@intel.com Content-Language: en-US Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Thanks Jian. Some comments and thought. 1) RPMC spec uses CounterAddress as the indicator. Can we use the same name= instead of CounterId in the API definition? 2) How the caller known which CounterAddress it need to fill? Do we need an API such as GetValidCounterAddress() ? 3) What is the value to add CounterAddress? Do can we guarantee that 2 driv= ers use 2 different counter address? Or If 2 drivers may use same counter address, why not remove the counter ad= dress parameter at all ? Thank you Yao Jiewen > -----Original Message----- > From: Wang, Jian J > Sent: Wednesday, March 18, 2020 10:13 AM > To: devel@edk2.groups.io > Cc: Yao, Jiewen ; Zhang, Chao B > ; Mistry, Nishant C > Subject: [PATCH v3 1/3] SecurityPkg: add RpmcLib and VariableKeyLib publi= c > headers >=20 > > v3: update retval description in RpmcLib.h >=20 > REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D2594 >=20 > RpmcLib.h and VariableKeyLib.h are header files required to access RPMC > device and Key generator from platform. They will be used to ensure the > integrity and confidentiality of NV variables. >=20 > Cc: Jiewen Yao > Cc: Chao Zhang > Cc: Nishant C Mistry > Signed-off-by: Jian J Wang > --- > SecurityPkg/Include/Library/RpmcLib.h | 46 +++++++++++++++ > SecurityPkg/Include/Library/VariableKeyLib.h | 59 ++++++++++++++++++++ > SecurityPkg/SecurityPkg.dec | 8 +++ > 3 files changed, 113 insertions(+) > create mode 100644 SecurityPkg/Include/Library/RpmcLib.h > create mode 100644 SecurityPkg/Include/Library/VariableKeyLib.h >=20 > diff --git a/SecurityPkg/Include/Library/RpmcLib.h > b/SecurityPkg/Include/Library/RpmcLib.h > new file mode 100644 > index 0000000000..f548ad2c9f > --- /dev/null > +++ b/SecurityPkg/Include/Library/RpmcLib.h > @@ -0,0 +1,46 @@ > +/** @file >=20 > + Public definitions for the Replay Protected Monotonic Counter (RPMC) L= ibrary. >=20 > + >=20 > +Copyright (c) 2020, Intel Corporation. All rights reserved.
>=20 > +SPDX-License-Identifier: BSD-2-Clause-Patent >=20 > + >=20 > +**/ >=20 > + >=20 > +#ifndef _RPMC_LIB_H_ >=20 > +#define _RPMC_LIB_H_ >=20 > + >=20 > +#include >=20 > + >=20 > +/** >=20 > + Requests the current monotonic counter from the designated RPMC counte= r. >=20 > + >=20 > + @param[in] CounterId Monotonic Counter Id. >=20 > + @param[out] CounterValue A pointer to a buffer to store t= he RPMC > value. >=20 > + >=20 > + @retval EFI_SUCCESS The operation completed successf= ully. >=20 > + @retval EFI_DEVICE_ERROR A device error occurred while at= tempting > to update the counter. >=20 > + @retval EFI_UNSUPPORTED The operation is un-supported. >=20 > +**/ >=20 > +EFI_STATUS >=20 > +EFIAPI >=20 > +RequestMonotonicCounter ( >=20 > + IN UINT8 CounterId, >=20 > + OUT UINT32 *CounterValue >=20 > + ); >=20 > + >=20 > +/** >=20 > + Increments the designated monotonic counter in the SPI flash device by= 1. >=20 > + >=20 > + @param[in] CounterId Monotonic Counter Id. >=20 > + >=20 > + @retval EFI_SUCCESS The operation completed successf= ully. >=20 > + @retval EFI_DEVICE_ERROR A device error occurred while at= tempting > to update the counter. >=20 > + @retval EFI_UNSUPPORTED The operation is un-supported. >=20 > +**/ >=20 > +EFI_STATUS >=20 > +EFIAPI >=20 > +IncrementMonotonicCounter ( >=20 > + IN UINT8 CounterId >=20 > + ); >=20 > + >=20 > +#endif > \ No newline at end of file > diff --git a/SecurityPkg/Include/Library/VariableKeyLib.h > b/SecurityPkg/Include/Library/VariableKeyLib.h > new file mode 100644 > index 0000000000..fe642b3d66 > --- /dev/null > +++ b/SecurityPkg/Include/Library/VariableKeyLib.h > @@ -0,0 +1,59 @@ > +/** @file >=20 > + Public definitions for Variable Key Library. >=20 > + >=20 > +Copyright (c) 2020, Intel Corporation. All rights reserved.
>=20 > +SPDX-License-Identifier: BSD-2-Clause-Patent >=20 > + >=20 > +**/ >=20 > + >=20 > +#ifndef _VARIABLE_KEY_LIB_H_ >=20 > +#define _VARIABLE_KEY_LIB_H_ >=20 > + >=20 > +#include >=20 > + >=20 > +/** >=20 > + Retrieves the variable root key. >=20 > + >=20 > + @param[out] VariableRootKey A pointer to pointer for the v= ariable > root key buffer. >=20 > + @param[in,out] VariableRootKeySize The size in bytes of the varia= ble root > key. >=20 > + >=20 > + @retval EFI_SUCCESS The variable root key was return= ed. >=20 > + @retval EFI_DEVICE_ERROR An error occurred while attempti= ng to get > the variable root key. >=20 > + @retval EFI_ACCESS_DENIED The function was invoked after l= ocking > the key interface. >=20 > + @retval EFI_UNSUPPORTED The variable root key is not sup= ported in > the current boot configuration. >=20 > +**/ >=20 > +EFI_STATUS >=20 > +EFIAPI >=20 > +GetVariableRootKey ( >=20 > + OUT VOID **VariableRootKey, >=20 > + IN OUT UINTN *VariableRootKeySize >=20 > + ); >=20 > + >=20 > +/** >=20 > + Regenerates the variable root key. >=20 > + >=20 > + @retval EFI_SUCCESS The variable root key was regene= rated > successfully. >=20 > + @retval EFI_DEVICE_ERROR An error occurred while attempti= ng to > regenerate the root key. >=20 > + @retval EFI_ACCESS_DENIED The function was invoked after l= ocking > the key interface. >=20 > + @retval EFI_UNSUPPORTED Key regeneration is not supporte= d in the > current boot configuration. >=20 > +**/ >=20 > +EFI_STATUS >=20 > +EFIAPI >=20 > +RegenerateKey ( >=20 > + VOID >=20 > + ); >=20 > + >=20 > +/** >=20 > + Locks the regenerate key interface. >=20 > + >=20 > + @retval EFI_SUCCESS The key interface was locked suc= cessfully. >=20 > + @retval EFI_UNSUPPORTED Locking the key interface is not= supported > in the current boot configuration. >=20 > + @retval Others An error occurred while attempti= ng to lock the > key interface. >=20 > +**/ >=20 > +EFI_STATUS >=20 > +EFIAPI >=20 > +LockKeyInterface ( >=20 > + VOID >=20 > + ); >=20 > + >=20 > +#endif > \ No newline at end of file > diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec > index 5335cc5397..2cdfb02cc5 100644 > --- a/SecurityPkg/SecurityPkg.dec > +++ b/SecurityPkg/SecurityPkg.dec > @@ -76,6 +76,14 @@ > # >=20 > TcgStorageOpalLib|Include/Library/TcgStorageOpalLib.h >=20 >=20 >=20 > + ## @libraryclass Provides interfaces to access RPMC device. >=20 > + # >=20 > + RpmcLib|Include/Library/RpmcLib.h >=20 > + >=20 > + ## @libraryclass Provides interfaces to access variable root key. >=20 > + # >=20 > + VariableKeyLib|Include/Library/VariableKeyLib.h >=20 > + >=20 > [Guids] >=20 > ## Security package token space guid. >=20 > # Include/Guid/SecurityPkgTokenSpace.h >=20 > -- > 2.24.0.windows.2