[edk2-devel] Buildtools error
Hey all, I got this error when doing a build: build.py... : error C0DE: Unknown fatal error when processing [/edk2/MdePkg/Library/BaseMemoryLibOptPei/BaseMemoryLibOptPei.inf] (Please send email to edk2-de...@lists.01.org for help, attaching following call stack trace!) (Python 2.7.16 on darwin) Traceback (most recent call last): File "/BaseTools/BinWrappers/PosixLike/../../Source/Python/build/build.py", line 2257, in Main MyBuild.Launch() File "/BaseTools/BinWrappers/PosixLike/../../Source/Python/build/build.py", line 2009, in Launch self._MultiThreadBuildPlatform() File "/BaseTools/BinWrappers/PosixLike/../../Source/Python/build/build.py", line 1804, in _MultiThreadBuildPlatform self.Progress File "/BaseTools/Source/Python/AutoGen/AutoGen.py", line 175, in __new__ if not AutoGenObject._Init(Workspace, MetaFile, Target, Toolchain, Arch, *args, **kwargs): File "/BaseTools/Source/Python/AutoGen/AutoGen.py", line 547, in _Init Pkgs = list(PkgSet) + list(PGen.PackageList) File "/BaseTools/Source/Python/AutoGen/AutoGen.py", line 1785, in _GetPackageList for La in self.LibraryAutoGenList: File "/BaseTools/Source/Python/AutoGen/AutoGen.py", line 1895, in _GetLibraryAutoGenList self._GetAutoGenObjectList() File "/BaseTools/Source/Python/AutoGen/AutoGen.py", line 1880, in _GetAutoGenObjectList for La in Ma.LibraryAutoGenList: File "/BaseTools/Source/Python/AutoGen/AutoGen.py", line 3989, in _GetLibraryAutoGenList for Lib in La.CodaTargetList: File "/BaseTools/Source/Python/AutoGen/AutoGen.py", line 3222, in _GetFinalTargetList self._GetTargets() File "/BaseTools/Source/Python/AutoGen/AutoGen.py", line 3208, in _GetTargets if self.SourceFileList: File "/BaseTools/Source/Python/AutoGen/AutoGen.py", line 3042, in _GetSourceFileList self._MatchBuildRuleOrder(self._SourceFileList) File "/BaseTools/Source/Python/AutoGen/AutoGen.py", line 3067, in _MatchBuildRuleOrder FileList.remove(item) ValueError: list.remove(x): x not in list Happy to provide more information but in the meantime, I’ll be trying to figure out what’s going on. Thanks! - Matthew Carlson -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#77992): https://edk2.groups.io/g/devel/message/77992 Mute This Topic: https://groups.io/mt/84344469/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] [PATCH v2 1/1] EmbeddedPkg: fix guid for PrePiHobLib
Currently there is a duplicate GUID shared by two INFs. This rolls the INF for the PrePiHobLib. Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2381 Cc: Leif Lindholm Cc: Ard Biesheuvel Cc: devel@edk2.groups.io Signed-off-by: Matthew Carlson --- EmbeddedPkg/Library/PrePiHobLib/PrePiHobLib.inf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/EmbeddedPkg/Library/PrePiHobLib/PrePiHobLib.inf b/EmbeddedPkg/Library/PrePiHobLib/PrePiHobLib.inf index b2c4c04bfd76..55de4511fc98 100644 --- a/EmbeddedPkg/Library/PrePiHobLib/PrePiHobLib.inf +++ b/EmbeddedPkg/Library/PrePiHobLib/PrePiHobLib.inf @@ -12,7 +12,7 @@ [Defines] INF_VERSION= 0x00010005 BASE_NAME = PrePiHobLib - FILE_GUID = 1F3A3278-82EB-4C0D-86F1-5BCDA5846CB2 + FILE_GUID = AEF7D85A-6A91-4ACD-9A28-193DEFB325FB MODULE_TYPE= BASE VERSION_STRING = 1.0 LIBRARY_CLASS = HobLib -- 2.30.1.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#72936): https://edk2.groups.io/g/devel/message/72936 Mute This Topic: https://groups.io/mt/81385986/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] [PATCH v2 0/1] Fix GUID in PrePiHobLib
Currently there is a duplicate GUID shared by two INFs. This rolls the INF for the PrePiHobLib. Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2381 Cc: Leif Lindholm Cc: Ard Biesheuvel Cc: devel@edk2.groups.io Matthew Carlson (1): EmbeddedPkg: fix guid for PrePiHobLib EmbeddedPkg/Library/PrePiHobLib/PrePiHobLib.inf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) -- 2.30.1.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#72935): https://edk2.groups.io/g/devel/message/72935 Mute This Topic: https://groups.io/mt/81385985/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] [PATCH v2 1/1] CryptoPkg: Added CC flags for ARM on IntrinsicLib
From: Matthew Carlson Signed-off-by: Matthew Carlson This added the compiler flags that were already defined for X64 and IA32. Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2821 Ref: https://github.com/tianocore/edk2/pull/1493 Cc: Jiewen Yao Cc: Jian J Wang Cc: Xiaoyu Lu Cc: Guomin Jiang Cc: devel@edk2.groups.io --- CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf | 2 ++ 1 file changed, 2 insertions(+) diff --git a/CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf b/CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf index fcbb93316cf7..21a0dede77fe 100644 --- a/CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf +++ b/CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf @@ -64,4 +64,6 @@ MSFT:RELEASE_*_IA32_CC_FLAGS == /nologo /c /WX /GS- /W4 /Gs32768 /D UNICODE /O1b2 /FIAutoGen.h /EHs-c- /GR- /GF MSFT:DEBUG_*_X64_CC_FLAGS == /nologo /c /WX /GS- /X /W4 /Gs32768 /D UNICODE /O1b2s /Gy /FIAutoGen.h /EHs-c- /GR- /GF /Zi /Gm MSFT:RELEASE_*_X64_CC_FLAGS== /nologo /c /WX /GS- /X /W4 /Gs32768 /D UNICODE /O1b2s /Gy /FIAutoGen.h /EHs-c- /GR- /GF + MSFT:DEBUG_*_AARCH64_CC_FLAGS == /nologo /c /WX /GS- /X /W4 /Gs32768 /D UNICODE /O1b2s /Gy /FIAutoGen.h /EHs-c- /GR- /GF /Zi /Gm + MSFT:RELEASE_*_AARCH64_CC_FLAGS== /nologo /c /WX /GS- /X /W4 /Gs32768 /D UNICODE /O1b2s /Gy /FIAutoGen.h /EHs-c- /GR- /GF INTEL:*_*_*_CC_FLAGS= /Oi- -- 2.30.1.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#72845): https://edk2.groups.io/g/devel/message/72845 Mute This Topic: https://groups.io/mt/81365455/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] [PATCH v2 0/1] CryptoPkg: Add flags for IntrinsicLib
Small patch series that fixes a bugzilla. V2: Actually added the patch information. Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2821 Cc: Jiewen Yao Cc: Jian J Wang Cc: Xiaoyu Lu Cc: Guomin Jiang Cc: devel@edk2.groups.io Matthew Carlson (1): CryptoPkg: Added CC flags for ARM on IntrinsicLib CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf | 2 ++ 1 file changed, 2 insertions(+) -- 2.30.1.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#72844): https://edk2.groups.io/g/devel/message/72844 Mute This Topic: https://groups.io/mt/81365454/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] [PATCH v1 1/1] CryptoPkg: Added CC flags for ARM on IntrinsicLib
From: Matthew Carlson Signed-off-by: Matthew Carlson This added the compiler flags that were already defined for X64 and IA32. Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2821 Ref: https://github.com/tianocore/edk2/pull/1493 Cc: Jiewen Yao Cc: Jian J Wang Cc: Xiaoyu Lu Cc: Guomin Jiang Cc: devel@edk2.groups.io --- CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf | 2 ++ 1 file changed, 2 insertions(+) -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#72842): https://edk2.groups.io/g/devel/message/72842 Mute This Topic: https://groups.io/mt/81361470/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] [PATCH v1 0/1] CryptoPkg: Add flags for IntrinsicLib
Small patch series that fixes a bugzilla. Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2821 Cc: Jiewen Yao Cc: Jian J Wang Cc: Xiaoyu Lu Cc: Guomin Jiang Cc: devel@edk2.groups.io Matthew Carlson (1): CryptoPkg: Added CC flags for ARM on IntrinsicLib CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf | 2 ++ 1 file changed, 2 insertions(+) -- 2.30.1.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#72841): https://edk2.groups.io/g/devel/message/72841 Mute This Topic: https://groups.io/mt/81361422/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] [PATCH v1 1/1] CryptoPkg: Added CC flags for ARM on IntrinsicLib
From: Matthew Carlson Signed-off-by: Matthew Carlson This added the compiler flags that were already defined for X64 and IA32. Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2821 Ref: https://github.com/tianocore/edk2/pull/1493 Cc: Jiewen Yao Cc: Jian J Wang Cc: Xiaoyu Lu Cc: Guomin Jiang Cc: devel@edk2.groups.io --- CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf | 2 ++ 1 file changed, 2 insertions(+) -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#72840): https://edk2.groups.io/g/devel/message/72840 Mute This Topic: https://groups.io/mt/81361424/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] [PATCH v1 0/1] CryptoPkg: Add flags for IntrinsicLib
Small patch series that fixes a bugzilla. Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=2821 Cc: Jiewen Yao Cc: Jian J Wang Cc: Xiaoyu Lu Cc: Guomin Jiang Cc: devel@edk2.groups.io Matthew Carlson (1): CryptoPkg: Added CC flags for ARM on IntrinsicLib CryptoPkg/Library/IntrinsicLib/IntrinsicLib.inf | 2 ++ 1 file changed, 2 insertions(+) -- 2.30.1.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#72839): https://edk2.groups.io/g/devel/message/72839 Mute This Topic: https://groups.io/mt/81361422/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] [PATCH v5 1/1] BaseTools: Use pip module if available, CI uses it by default
From: Matthew Carlson
Use the new edk2-basetools pip module.
Includes a helpful message in setup to let users know which has been
selected.
Cc: Bob Feng
Cc: Liming Gao
Cc: Yuwei Chen
Reviewed-by: Bob Feng
Signed-off-by: Matthew Carlson
---
.pytool/CISettings.py
| 51 +++-
BaseTools/BinPipWrappers/PosixLike/AmlToC
| 14 ++
BaseTools/BinPipWrappers/PosixLike/BPDG
| 12 +
BaseTools/BinPipWrappers/PosixLike/BrotliCompress
| 34 +
BaseTools/BinPipWrappers/PosixLike/DevicePath
| 29 +++
BaseTools/BinPipWrappers/PosixLike/Ecc
| 13 +
BaseTools/BinPipWrappers/PosixLike/EfiRom
| 29 +++
BaseTools/BinPipWrappers/PosixLike/GenCrc32
| 29 +++
BaseTools/BinPipWrappers/PosixLike/GenDepex
| 12 +
BaseTools/BinPipWrappers/PosixLike/GenFds
| 12 +
BaseTools/BinPipWrappers/PosixLike/GenFfs
| 29 +++
BaseTools/BinPipWrappers/PosixLike/GenFv
| 29 +++
BaseTools/BinPipWrappers/PosixLike/GenFw
| 29 +++
BaseTools/BinPipWrappers/PosixLike/GenPatchPcdTable
| 12 +
BaseTools/BinPipWrappers/PosixLike/GenSec
| 29 +++
BaseTools/BinPipWrappers/PosixLike/GenerateCapsule
| 12 +
BaseTools/BinPipWrappers/PosixLike/LzmaCompress
| 29 +++
BaseTools/BinPipWrappers/PosixLike/LzmaF86Compress
| 19
BaseTools/BinPipWrappers/PosixLike/PatchPcdValue
| 12 +
BaseTools/BinPipWrappers/PosixLike/Pkcs7Sign
| 12 +
BaseTools/BinPipWrappers/PosixLike/Rsa2048Sha256GenerateKeys
| 12 +
BaseTools/BinPipWrappers/PosixLike/Rsa2048Sha256Sign
| 12 +
BaseTools/BinPipWrappers/PosixLike/Split
| 29 +++
BaseTools/BinPipWrappers/PosixLike/TargetTool
| 12 +
BaseTools/BinPipWrappers/PosixLike/TianoCompress
| 29 +++
BaseTools/BinPipWrappers/PosixLike/Trim
| 13 +
BaseTools/BinPipWrappers/PosixLike/UPT
| 12 +
BaseTools/BinPipWrappers/PosixLike/VfrCompile
| 29 +++
BaseTools/BinPipWrappers/PosixLike/VolInfo
| 29 +++
BaseTools/BinPipWrappers/PosixLike/build
| 12 +
BaseTools/{BinWrappers => BinPipWrappers}/PosixLike/posix_path_env.yaml
| 21
BaseTools/BinPipWrappers/WindowsLike/AmlToC.bat
| 3 ++
BaseTools/BinPipWrappers/WindowsLike/BPDG.bat
| 3 ++
BaseTools/BinPipWrappers/WindowsLike/Ecc.bat
| 3 ++
BaseTools/BinPipWrappers/WindowsLike/GenDepex.bat
| 3 ++
BaseTools/BinPipWrappers/WindowsLike/GenFds.bat
| 3 ++
BaseTools/BinPipWrappers/WindowsLike/GenPatchPcdTable.bat
| 3 ++
BaseTools/BinPipWrappers/WindowsLike/GenerateCapsule.bat
| 1 +
BaseTools/BinPipWrappers/WindowsLike/PatchPcdValue.bat
| 3 ++
BaseTools/BinPipWrappers/WindowsLike/Pkcs7Sign.bat
| 3 ++
BaseTools/BinPipWrappers/WindowsLike/Rsa2048Sha256GenerateKeys.bat
| 1 +
BaseTools/BinPipWrappers/WindowsLike/Rsa2048Sha256Sign.bat
| 3 ++
BaseTools/BinPipWrappers/WindowsLike/Split.bat
| 3 ++
BaseTools/BinPipWrappers/WindowsLike/TargetTool.bat
| 3 ++
BaseTools/BinPipWrappers/WindowsLike/Trim.bat
| 3 ++
BaseTools/BinPipWrappers/WindowsLike/UPT.bat
| 3 ++
BaseTools/BinPipWrappers/WindowsLike/build.bat
| 3 ++
BaseTools/{BinWrappers =>
BinPipWrappers}/WindowsLike/win_build_tools_path_env.yaml | 3 +-
BaseTools/BinWrappers/Pos
[edk2-devel] [PATCH v5 0/1] Use Pip version of BaseTools
From: Matthew Carlson
Hello all,
This patch adds the capability to leverage the pip based BaseTools.
The BaseTools master is current with EDK2 master (as of 3pm Nov 2, 2020).
While I could rehash a lot of what has gone out on the mailing list, I think
it might be better just to link the discussion.
In a nutshell, setup will detect if edk2-basetools is installed, and if it
is, use the other verison of BinWrappers (BinPipWrappers). This should
provide an easy and convenient way to transition over. By default, CI
uses the pip version.
The pipeline is setup. Every commit that gets pushed to master on basetools
get published to pypi and tagged. This should offer bisectability and easier
debugging. Additionally, the pip requirements file tracks a specific version.
We'd like to set a date for when PR's no longer go into EDK2 for BaseTools
and instead go exclusively into the new basetools repo.
V5 Changes: Add Split.bat and removed BrotliCompress.bat
V4 Changes: converted files to DOX line ending, added executable chmod to unix
binwrappers, and removed unnecessary binwrappers.
V3 Changes: converted some files to unix line ending
Ref: https://edk2.groups.io/g/devel/topic/76572200#64993
Ref: https://github.com/tianocore/edk2-basetools
Ref: https://github.com/tianocore/edk2/pull/1072
Cc: Bob Feng
Cc: Liming Gao
Cc: Yuwei Chen
Cc: Sean Brogan
Cc: Michael Kinney
Matthew Carlson (1):
BaseTools: Use pip module if available, CI uses it by default
.pytool/CISettings.py
| 51 +++-
BaseTools/BinPipWrappers/PosixLike/AmlToC
| 14 ++
BaseTools/BinPipWrappers/PosixLike/BPDG
| 12 +
BaseTools/BinPipWrappers/PosixLike/BrotliCompress
| 34 +
BaseTools/BinPipWrappers/PosixLike/DevicePath
| 29 +++
BaseTools/BinPipWrappers/PosixLike/Ecc
| 13 +
BaseTools/BinPipWrappers/PosixLike/EfiRom
| 29 +++
BaseTools/BinPipWrappers/PosixLike/GenCrc32
| 29 +++
BaseTools/BinPipWrappers/PosixLike/GenDepex
| 12 +
BaseTools/BinPipWrappers/PosixLike/GenFds
| 12 +
BaseTools/BinPipWrappers/PosixLike/GenFfs
| 29 +++
BaseTools/BinPipWrappers/PosixLike/GenFv
| 29 +++
BaseTools/BinPipWrappers/PosixLike/GenFw
| 29 +++
BaseTools/BinPipWrappers/PosixLike/GenPatchPcdTable
| 12 +
BaseTools/BinPipWrappers/PosixLike/GenSec
| 29 +++
BaseTools/BinPipWrappers/PosixLike/GenerateCapsule
| 12 +
BaseTools/BinPipWrappers/PosixLike/LzmaCompress
| 29 +++
BaseTools/BinPipWrappers/PosixLike/LzmaF86Compress
| 19
BaseTools/BinPipWrappers/PosixLike/PatchPcdValue
| 12 +
BaseTools/BinPipWrappers/PosixLike/Pkcs7Sign
| 12 +
BaseTools/BinPipWrappers/PosixLike/Rsa2048Sha256GenerateKeys
| 12 +
BaseTools/BinPipWrappers/PosixLike/Rsa2048Sha256Sign
| 12 +
BaseTools/BinPipWrappers/PosixLike/Split
| 29 +++
BaseTools/BinPipWrappers/PosixLike/TargetTool
| 12 +
BaseTools/BinPipWrappers/PosixLike/TianoCompress
| 29 +++
BaseTools/BinPipWrappers/PosixLike/Trim
| 13 +
BaseTools/BinPipWrappers/PosixLike/UPT
| 12 +
BaseTools/BinPipWrappers/PosixLike/VfrCompile
| 29 +++
BaseTools/BinPipWrappers/PosixLike/VolInfo
| 29 +++
BaseTools/BinPipWrappers/PosixLike/build
| 12 +
BaseTools/{BinWrappers => BinPipWrappers}/PosixLike/posix_path_env.yaml
| 21
BaseTools/BinPipWrappers/WindowsLike/AmlToC.bat
| 3 ++
BaseTools/BinPipWrappers/WindowsLike/BPDG.bat
| 3 ++
BaseTools/BinPipWrappers/WindowsLike/Ecc.bat
| 3 ++
BaseTools/BinPipWrappers/WindowsLike/GenDepex.bat
| 3 ++
BaseTools/BinPipWrappers/WindowsL
[edk2-devel] [PATCH v4 1/1] BaseTools: Use pip module if available, CI uses it by default
From: Matthew Carlson
Use the new edk2-basetools pip module.
Includes a helpful message in setup to let users know which has been
selected.
Cc: Bob Feng
Cc: Liming Gao
Cc: Yuwei Chen
Reviewed-by: Bob Feng
Signed-off-by: Matthew Carlson
---
.pytool/CISettings.py
| 51 +-
BaseTools/BinPipWrappers/PosixLike/AmlToC
| 14 +
BaseTools/BinPipWrappers/PosixLike/BPDG
| 12 +
BaseTools/BinPipWrappers/PosixLike/BrotliCompress
| 34
BaseTools/BinPipWrappers/PosixLike/DevicePath
| 29 +++
BaseTools/BinPipWrappers/PosixLike/Ecc
| 13 +
BaseTools/BinPipWrappers/PosixLike/EfiRom
| 29 +++
BaseTools/BinPipWrappers/PosixLike/GenCrc32
| 29 +++
BaseTools/BinPipWrappers/PosixLike/GenDepex
| 12 +
BaseTools/BinPipWrappers/PosixLike/GenFds
| 12 +
BaseTools/BinPipWrappers/PosixLike/GenFfs
| 29 +++
BaseTools/BinPipWrappers/PosixLike/GenFv
| 29 +++
BaseTools/BinPipWrappers/PosixLike/GenFw
| 29 +++
BaseTools/BinPipWrappers/PosixLike/GenPatchPcdTable
| 12 +
BaseTools/BinPipWrappers/PosixLike/GenSec
| 29 +++
BaseTools/BinPipWrappers/PosixLike/GenerateCapsule
| 12 +
BaseTools/BinPipWrappers/PosixLike/LzmaCompress
| 29 +++
BaseTools/BinPipWrappers/PosixLike/LzmaF86Compress
| 19 +++
BaseTools/BinPipWrappers/PosixLike/PatchPcdValue
| 12 +
BaseTools/BinPipWrappers/PosixLike/Pkcs7Sign
| 12 +
BaseTools/BinPipWrappers/PosixLike/Rsa2048Sha256GenerateKeys
| 12 +
BaseTools/BinPipWrappers/PosixLike/Rsa2048Sha256Sign
| 12 +
BaseTools/BinPipWrappers/PosixLike/Split
| 29 +++
BaseTools/BinPipWrappers/PosixLike/TargetTool
| 12 +
BaseTools/BinPipWrappers/PosixLike/TianoCompress
| 29 +++
BaseTools/BinPipWrappers/PosixLike/Trim
| 13 +
BaseTools/BinPipWrappers/PosixLike/UPT
| 12 +
BaseTools/BinPipWrappers/PosixLike/VfrCompile
| 29 +++
BaseTools/BinPipWrappers/PosixLike/VolInfo
| 29 +++
BaseTools/BinPipWrappers/PosixLike/build
| 12 +
BaseTools/{BinWrappers => BinPipWrappers}/PosixLike/posix_path_env.yaml
| 21
BaseTools/BinPipWrappers/WindowsLike/AmlToC.bat
| 3 ++
BaseTools/BinPipWrappers/WindowsLike/BPDG.bat
| 3 ++
BaseTools/BinPipWrappers/WindowsLike/BrotliCompress.bat
| 55
BaseTools/BinPipWrappers/WindowsLike/Ecc.bat
| 3 ++
BaseTools/BinPipWrappers/WindowsLike/GenDepex.bat
| 3 ++
BaseTools/BinPipWrappers/WindowsLike/GenFds.bat
| 3 ++
BaseTools/BinPipWrappers/WindowsLike/GenPatchPcdTable.bat
| 3 ++
BaseTools/BinPipWrappers/WindowsLike/GenerateCapsule.bat
| 1 +
BaseTools/BinPipWrappers/WindowsLike/PatchPcdValue.bat
| 3 ++
BaseTools/BinPipWrappers/WindowsLike/Pkcs7Sign.bat
| 3 ++
BaseTools/BinPipWrappers/WindowsLike/Rsa2048Sha256GenerateKeys.bat
| 1 +
BaseTools/BinPipWrappers/WindowsLike/Rsa2048Sha256Sign.bat
| 3 ++
BaseTools/BinPipWrappers/WindowsLike/TargetTool.bat
| 3 ++
BaseTools/BinPipWrappers/WindowsLike/Trim.bat
| 3 ++
BaseTools/BinPipWrappers/WindowsLike/UPT.bat
| 3 ++
BaseTools/BinPipWrappers/WindowsLike/build.bat
| 3 ++
BaseTools/{BinWrappers =>
BinPipWrappers}/WindowsLike/win_build_tools_path_env.yaml | 3 +-
BaseTools/BinWr
[edk2-devel] [PATCH v4 0/1] Use Pip version of BaseTools
From: Matthew Carlson
Hello all,
This patch adds the capability to leverage the pip based BaseTools.
The BaseTools master is current with EDK2 master (as of 3pm Nov 2, 2020).
While I could rehash a lot of what has gone out on the mailing list, I think
it might be better just to link the discussion.
In a nutshell, setup will detect if edk2-basetools is installed, and if it
is, use the other verison of BinWrappers (BinPipWrappers). This should
provide an easy and convenient way to transition over. By default, CI
uses the pip version.
The pipeline is setup. Every commit that gets pushed to master on basetools
get published to pypi and tagged. This should offer bisectability and easier
debugging. Additionally, the pip requirements file tracks a specific version.
We'd like to set a date for when PR's no longer go into EDK2 for BaseTools
and instead go exclusively into the new basetools repo.
V4 Changes: converted files to DOX line ending, added executable chmod to unix
binwrappers, and removed unnecessary binwrappers.
V3 Changes: converted some files to unix line ending
Ref: https://edk2.groups.io/g/devel/topic/76572200#64993
Ref: https://github.com/tianocore/edk2-basetools
Ref: https://github.com/tianocore/edk2/pull/1072
Cc: Bob Feng
Cc: Liming Gao
Cc: Yuwei Chen
Cc: Sean Brogan
Cc: Michael Kinney
Matthew Carlson (1):
BaseTools: Use pip module if available, CI uses it by default
.pytool/CISettings.py
| 51 +-
BaseTools/BinPipWrappers/PosixLike/AmlToC
| 14 +
BaseTools/BinPipWrappers/PosixLike/BPDG
| 12 +
BaseTools/BinPipWrappers/PosixLike/BrotliCompress
| 34
BaseTools/BinPipWrappers/PosixLike/DevicePath
| 29 +++
BaseTools/BinPipWrappers/PosixLike/Ecc
| 13 +
BaseTools/BinPipWrappers/PosixLike/EfiRom
| 29 +++
BaseTools/BinPipWrappers/PosixLike/GenCrc32
| 29 +++
BaseTools/BinPipWrappers/PosixLike/GenDepex
| 12 +
BaseTools/BinPipWrappers/PosixLike/GenFds
| 12 +
BaseTools/BinPipWrappers/PosixLike/GenFfs
| 29 +++
BaseTools/BinPipWrappers/PosixLike/GenFv
| 29 +++
BaseTools/BinPipWrappers/PosixLike/GenFw
| 29 +++
BaseTools/BinPipWrappers/PosixLike/GenPatchPcdTable
| 12 +
BaseTools/BinPipWrappers/PosixLike/GenSec
| 29 +++
BaseTools/BinPipWrappers/PosixLike/GenerateCapsule
| 12 +
BaseTools/BinPipWrappers/PosixLike/LzmaCompress
| 29 +++
BaseTools/BinPipWrappers/PosixLike/LzmaF86Compress
| 19 +++
BaseTools/BinPipWrappers/PosixLike/PatchPcdValue
| 12 +
BaseTools/BinPipWrappers/PosixLike/Pkcs7Sign
| 12 +
BaseTools/BinPipWrappers/PosixLike/Rsa2048Sha256GenerateKeys
| 12 +
BaseTools/BinPipWrappers/PosixLike/Rsa2048Sha256Sign
| 12 +
BaseTools/BinPipWrappers/PosixLike/Split
| 29 +++
BaseTools/BinPipWrappers/PosixLike/TargetTool
| 12 +
BaseTools/BinPipWrappers/PosixLike/TianoCompress
| 29 +++
BaseTools/BinPipWrappers/PosixLike/Trim
| 13 +
BaseTools/BinPipWrappers/PosixLike/UPT
| 12 +
BaseTools/BinPipWrappers/PosixLike/VfrCompile
| 29 +++
BaseTools/BinPipWrappers/PosixLike/VolInfo
| 29 +++
BaseTools/BinPipWrappers/PosixLike/build
| 12 +
BaseTools/{BinWrappers => BinPipWrappers}/PosixLike/posix_path_env.yaml
| 21
BaseTools/BinPipWrappers/WindowsLike/AmlToC.bat
| 3 ++
BaseTools/BinPipWrappers/WindowsLike/BPDG.bat
| 3 ++
BaseTools/BinPipWrappers/WindowsLike/BrotliCompress.bat
| 55
BaseTools/BinPipWrappers/WindowsLike/Ecc.bat
| 3 ++
BaseTools/BinPipWrappers/WindowsLike/GenDepex.
Re: [edk2-devel] [PATCH] EmulatorPkg: Add RngLib to satisfy dependency of OpensslLib
Hi Samer, (I added you, zhiguang, because you had a similar question) There’s some instructions in the patch series about how to enable RngLib to be used by OpenSSL (on the cover letter) Since this changes the dependencies of OpenSSL, this has the potential of beinga breaking change for platforms in edk2-platforms. The easiest solution is justto use the RngLib that uses the TimerLib as this closely mimics the behavior ofOpenSSL prior to this patch series. There is also a null version of RngLib forCI environments that need this change(https://edk2.groups.io/g/devel/message/50432). Though it should be pointed outthat in CI environments, the null version of BaseCryptLib or OpenSSL should beused. If you simply want the behavior that existed prior to this commit, you can just add the TimerLib based RngLib. It is not a good source of randomness but is arguably slightly better than what OpenSSL was using before.You can see that’s what was done for OvmfPkg and ArmVirtualPkg (https://github.com/tianocore/edk2/commit/a09df5d2e1a7126e45198200628e388564f74668#diff-76767f2fe9e8f4acca7cbeb049bc8152).I’d recommend adding a platform specific RngLib that leverages platform capabilities. If your platforms has a driver that published the RngProtocol, you can leverage the new library at MdePkg/Library/DxeRngLib/DxeRngLib.inf (https://github.com/tianocore/edk2/commit/ed0dce7d5466b6b22ff9e0923f3a3e885540bbfc).It will add whatever driver that produces the RngProtocol as a depex on any module that consumes crypto, so you might need to be careful not to introduce a circular depex chain, so this might not be an option for some platforms. On the note of adding Azure Platform CI, OvmfPkg recently added PlatformCI and it could be a good jumping off point. https://github.com/tianocore/edk2/tree/master/OvmfPkg/PlatformCIIn a nutshell, you’ll create a new Python build file that stuart/pytools can leverage (https://github.com/tianocore/edk2-pytool-extensions) (https://github.com/tianocore/edk2-pytool-extensions/blob/master/docs/using.md)Here’s actually an example I wrote where I ported RPi to use Pytools (https://github.com/tianocore/edk2-pytool-extensions/blob/master/docs/usability/porting_a_platform.md) Once you have a platform that’s building, you can use the platform build pipeline (https://github.com/tianocore/edk2/tree/master/OvmfPkg/PlatformCI/.azurepipelines) Of course, it is totally possible use a different tool like edkrepo or uefi-tools to not have to create a build file. You’d just call that from the build pipeline. I personally haven’t used them, but I’m sure there’s some folks on the mailing list that could point you in the right direction.You’re also welcome to use something other azure pipelines, there are plenty of options out there. Azure pipelines is nice since it provides a good number of build agents for free to open source projects. But I’ve used TravisCI and Circle before (though not in EDK2) and liked the experience. You’d likely need to setup a new project in the devops for tianocore (https://dev.azure.com/tianocore/) since the pipelines for edk2-ci should remain in one project. Perhaps edk2-platforms-ci? Matthew Carlson From: Samer El-Haj-MahmoudSent: Wednesday, September 23, 2020 6:43 AMTo: devel@edk2.groups.io; divneil.r.wadha...@intel.com; matthewfcarl...@gmail.comCc: Ni, Ray; gaoliming; Andrew Fish; Justen, Jordan L; Kinney, Michael D; Laszlo Ersek; Yao, Jiewen; Ard BiesheuvelSubject: RE: [PATCH] EmulatorPkg: Add RngLib to satisfy dependency of OpensslLib Divneil, Thanks for this patch. However, it looks like multiple edk2-platforms are broken because of the OpensslLib change. I verified at least the following are broken:- RaspberryPi/RPi3- RaspberryPi/RPi4- Qemu/SbsaQemu- Socionext/DeveloperBox- SolidRun/Armada80x0McBin- Hisilicon/D0*Etc.. Others are probably impacted. A quick search across edk2 and edk2-platform shows openssllib used in 26 DSC files, but RngLib is implicitly used in only 13 of them. Mathew, I think the offending commit (b5701a4c7a0fb185e0c5b9db9525939c78664bfd) needs to be reverted, and re-submitted with a series that fixes the build for all impacted platforms. Also, what would it take to add the Azure pipeline CI that is currently used in edk2 to edk2-platform? I imagine some platform maintainers would appreciate that capability. Or should every platform look for their own CI/CD (possibly outside TianoCore)? Thanks,--Samer From: devel@edk2.groups.io On Behalf Of Wadhawan, Divneil R via groups.ioSent: Saturday, September 19, 2020 1:39 AMTo: devel@edk2.groups.ioCc: Ni, Ray ; gaoliming ; 'Andrew Fish' ; Justen, Jordan L ; Kinney, Michael D ; Wadhawan, Divneil R Subject: [edk2-devel] [PATCH] EmulatorPkg: Add RngLib to satisfy dependency of OpensslLib o Recently, OpensslLib [LibraryClasses] has been changed to include RngLib which causes the SECURE_BOOT_ENABLE build to fail in want of RngLib o This patch adds the RngLib for OpensslLib Signed-off-by: Divneil Rai Wadhawan ---EmulatorPkg
Re: [edk2-devel] [PATCH] EmulatorPkg: Add RngLib to satisfy dependency of OpensslLib
Thanks for catching this! -- - Matthew Carlson -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#65411): https://edk2.groups.io/g/devel/message/65411 Mute This Topic: https://groups.io/mt/76949410/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] 回复: [edk2-devel] [PATCH v10 0/5] Use RngLib instead of TimerLib for OpensslLib
Hey Liming! I added the two reviewed by and pushed to the PR here: https://github.com/tianocore/edk2/pull/933 Feel free to use that PR to merge in -- - Matthew Carlson -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#65342): https://edk2.groups.io/g/devel/message/65342 Mute This Topic: https://groups.io/mt/76879301/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] 回复: edk2-devel] [PATCH v10 0/5] Use RngLib instead of TimerLib for OpensslLib
Looks good to me On Sep 15, 2020, 6:39 PM -0700, gaoliming , wrote: > I normally check Maintainers.txt and make sure each patch get the review from > package maintainer or package reviewer. > > Thanks > Liming > 发件人: Matthew Carlson > 发送时间: 2020年9月16日 9:00 > 收件人: gaoliming ; devel@edk2.groups.io; > mac...@microsoft.com > 主题: RE: [edk2-devel] [PATCH v10 0/5] Use RngLib instead of TimerLib for > OpensslLib > > Thanks Liming! > > Is there an easy way to check if all the patches have reviewed-by from > maintainers? > > I can confirm that each patch (now that you’ve given a reviewed by for Patch > 1 & 2) has a reviewed by and some have a few reviewed by or acked by. > > From: gaoliming > Sent: Tuesday, September 15, 2020 5:57 PM > To: devel@edk2.groups.io; mac...@microsoft.com; Matthew Carlson > Subject: 回复: [edk2-devel] [PATCH v10 0/5] Use RngLib instead of TimerLib for > OpensslLib > > Matthew: > I just check this patch set. All 5 patches have got reviewed-by from the > package maintainer or reviewer. Can you double confirm? If yes, I will help > merge them. > > Thanks > Liming > 发件人: bounce+27952+65285+4905953+8761...@groups.io > 代表 Matthew Carlson via > groups.io > 发送时间: 2020年9月16日 6:48 > 收件人: Matthew Carlson ; devel@edk2.groups.io > 主题: Re: [edk2-devel] [PATCH v10 0/5] Use RngLib instead of TimerLib for > OpensslLib > > Just pinging this thread to see what needs to get done next. Thank you Liming > for the reviewed by on the MdeModulePkg changes. > > -- > - Matthew Carlson > > -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#65309): https://edk2.groups.io/g/devel/message/65309 Mute This Topic: https://groups.io/mt/76880672/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] [PATCH v10 0/5] Use RngLib instead of TimerLib for OpensslLib
Thanks Liming! Is there an easy way to check if all the patches have reviewed-by from maintainers? I can confirm that each patch (now that you’ve given a reviewed by for Patch 1 & 2) has a reviewed by and some have a few reviewed by or acked by. From: gaolimingSent: Tuesday, September 15, 2020 5:57 PMTo: devel@edk2.groups.io; mac...@microsoft.com; Matthew CarlsonSubject: 回复: [edk2-devel] [PATCH v10 0/5] Use RngLib instead of TimerLib for OpensslLib Matthew: I just check this patch set. All 5 patches have got reviewed-by from the package maintainer or reviewer. Can you double confirm? If yes, I will help merge them. ThanksLiming发件人: bounce+27952+65285+4905953+8761...@groups.io 代表 Matthew Carlson via groups.io发送时间: 2020年9月16日 6:48收件人: Matthew Carlson ; devel@edk2.groups.io主题: Re: [edk2-devel] [PATCH v10 0/5] Use RngLib instead of TimerLib for OpensslLib Just pinging this thread to see what needs to get done next. Thank you Liming for the reviewed by on the MdeModulePkg changes.-- - Matthew Carlson _._,_._,_ Groups.io Links: You receive all messages sent to this group. View/Reply Online (#65295) | | Mute This Topic | New Topic Your Subscription | Contact Group Owner | Unsubscribe [arch...@mail-archive.com] _._,_._,_
[edk2-devel] [PATCH v2 0/1] Update IASL extdep for CI
From: Matthew Carlson Currently EDK2 has an external dependency to download the IASL compiler. This updates that nuget stream with a much more current version produced by a pipeline that runs regularly. Feel free to check out the repo here: https://dev.azure.com/projectmu/_git/acpica To reiterate, this only affects CI and should not affect platforms unless they are explictly using the 'cibuild' scope. v2 changes: Added reviewed by from Liming. Ref: https://github.com/tianocore/edk2/pull/927 Matthew Carlson (1): BaseTools: update IASL extdep to more modern version BaseTools/Bin/iasl_ext_dep.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) -- 2.27.0.vfs.1.0 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#65286): https://edk2.groups.io/g/devel/message/65286 Mute This Topic: https://groups.io/mt/76876686/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] [PATCH v2 1/1] BaseTools: update IASL extdep to more modern version
From: Matthew Carlson The IASL extdep is used for CI only and a recent fork of the ACPICA repo was made to make nuget builds more regular and easier to audit. https://dev.azure.com/projectmu/_git/acpica Cc: Bob Feng Cc: Liming Gao Cc: Yuwei Chen Cc: Sean Brogan Reviewed-by: Liming Gao Signed-off-by: Matthew Carlson --- BaseTools/Bin/iasl_ext_dep.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/BaseTools/Bin/iasl_ext_dep.yaml b/BaseTools/Bin/iasl_ext_dep.yaml index 1d81e89cf3a6..ea2bc315d184 100644 --- a/BaseTools/Bin/iasl_ext_dep.yaml +++ b/BaseTools/Bin/iasl_ext_dep.yaml @@ -14,8 +14,8 @@ "id": "iasl-ci-1", "scope": "cibuild", "type": "nuget", - "name": "iasl", - "source": "https://api.nuget.org/v3/index.json;, - "version": "20190215.0.0", + "name": "edk2-acpica-iasl", + "source": "https://pkgs.dev.azure.com/projectmu/acpica/_packaging/mu_iasl/nuget/v3/index.json;, + "version": "20200717.0.0", "flags": ["set_path", "host_specific"] } -- 2.27.0.vfs.1.0 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#65287): https://edk2.groups.io/g/devel/message/65287 Mute This Topic: https://groups.io/mt/76876688/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] [PATCH v10 0/5] Use RngLib instead of TimerLib for OpensslLib
Just pinging this thread to see what needs to get done next. Thank you Liming for the reviewed by on the MdeModulePkg changes. -- - Matthew Carlson -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#65285): https://edk2.groups.io/g/devel/message/65285 Mute This Topic: https://groups.io/mt/76563982/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] [PATCH v1 1/1] BaseTools: update IASL extdep to more modern version
That’s correct. Sent from Mail for Windows 10 From: gaolimingSent: Sunday, September 13, 2020 8:15 PMTo: devel@edk2.groups.io; matthewfcarl...@gmail.comCc: Bob Feng; Yuwei Chen; Sean BroganSubject: 回复: [edk2-devel] [PATCH v1 1/1] BaseTools: update IASL extdep to more modern version Matthew: In future, when update new iasl version again, only this line "version":"20200717.0.0" will be updated, right? ThanksLiming> -邮件原件-> 发件人: bounce+27952+65199+4905953+8761...@groups.io> 代表 Matthew> Carlson> 发送时间: 2020年9月12日 4:45> 收件人: devel@edk2.groups.io> 抄送: Bob Feng ; Liming Gao> ; Yuwei Chen ; Sean> Brogan ; Matthew Carlson> > 主题: [edk2-devel] [PATCH v1 1/1] BaseTools: update IASL extdep to more> modern version> > From: Matthew Carlson > > The IASL extdep is used for CI only and a recent fork of the ACPICA> repo was made to make nuget builds more regular and easier to audit.> https://dev.azure.com/projectmu/_git/acpica> > Cc: Bob Feng > Cc: Liming Gao > Cc: Yuwei Chen > Cc: Sean Brogan > Cc: devel@edk2.groups.io> > Signed-off-by: Matthew Carlson > ---> BaseTools/Bin/iasl_ext_dep.yaml | 6 +++---> 1 file changed, 3 insertions(+), 3 deletions(-)> > diff --git a/BaseTools/Bin/iasl_ext_dep.yaml> b/BaseTools/Bin/iasl_ext_dep.yaml> index 1d81e89cf3a6..ea2bc315d184 100644> --- a/BaseTools/Bin/iasl_ext_dep.yaml> +++ b/BaseTools/Bin/iasl_ext_dep.yaml> @@ -14,8 +14,8 @@> "id": "iasl-ci-1",> > "scope": "cibuild",> > "type": "nuget",> > - "name": "iasl",> > - "source": "https://api.nuget.org/v3/index.json",> > - "version": "20190215.0.0",> > + "name": "edk2-acpica-iasl",> > + "source":> "https://pkgs.dev.azure.com/projectmu/acpica/_packaging/mu_iasl/nuget/v> 3/index.json",> > + "version": "20200717.0.0",> > "flags": ["set_path", "host_specific"]> > }> > --> 2.28.0.windows.1> > > -=-=-=-=-=-=> Groups.io Links: You receive all messages sent to this group.> > View/Reply Online (#65199): https://edk2.groups.io/g/devel/message/65199> Mute This Topic: https://groups.io/mt/76788780/4905953> Group Owner: devel+ow...@edk2.groups.io> Unsubscribe: https://edk2.groups.io/g/devel/unsub> [gaolim...@byosoft.com.cn]> -=-=-=-=-=-= _._,_._,_ Groups.io Links: You receive all messages sent to this group. View/Reply Online (#65214) | | Mute This Topic | New Topic Your Subscription | Contact Group Owner | Unsubscribe [arch...@mail-archive.com] _._,_._,_
[edk2-devel] [PATCH v1 0/1] Update IASL extdep for CI
From: Matthew Carlson Currently EDK2 has an external dependency to download the IASL compiler. This updates that nuget stream with a much more current version produced by a pipeline that runs regularly. Feel free to check out the repo here: https://dev.azure.com/projectmu/_git/acpica To reiterate, this only affects CI and should not affect platforms unless they are explictly using the 'cibuild' scope. Cc: Bob Feng Cc: Liming Gao Cc: Yuwei Chen Cc: Sean Brogan Cc: devel@edk2.groups.io Matthew Carlson (1): BaseTools: update IASL extdep to more modern version BaseTools/Bin/iasl_ext_dep.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) -- 2.28.0.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#65198): https://edk2.groups.io/g/devel/message/65198 Mute This Topic: https://groups.io/mt/76788779/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] [PATCH v1 1/1] BaseTools: update IASL extdep to more modern version
From: Matthew Carlson The IASL extdep is used for CI only and a recent fork of the ACPICA repo was made to make nuget builds more regular and easier to audit. https://dev.azure.com/projectmu/_git/acpica Cc: Bob Feng Cc: Liming Gao Cc: Yuwei Chen Cc: Sean Brogan Cc: devel@edk2.groups.io Signed-off-by: Matthew Carlson --- BaseTools/Bin/iasl_ext_dep.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/BaseTools/Bin/iasl_ext_dep.yaml b/BaseTools/Bin/iasl_ext_dep.yaml index 1d81e89cf3a6..ea2bc315d184 100644 --- a/BaseTools/Bin/iasl_ext_dep.yaml +++ b/BaseTools/Bin/iasl_ext_dep.yaml @@ -14,8 +14,8 @@ "id": "iasl-ci-1", "scope": "cibuild", "type": "nuget", - "name": "iasl", - "source": "https://api.nuget.org/v3/index.json;, - "version": "20190215.0.0", + "name": "edk2-acpica-iasl", + "source": "https://pkgs.dev.azure.com/projectmu/acpica/_packaging/mu_iasl/nuget/v3/index.json;, + "version": "20200717.0.0", "flags": ["set_path", "host_specific"] } -- 2.28.0.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#65199): https://edk2.groups.io/g/devel/message/65199 Mute This Topic: https://groups.io/mt/76788780/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] Basetools as a pip module
Andrew: I think leveraging the existing edksetup is a great idea. Using the existing EDK_TOOL_PATH variable could work but it seems clunky. Since the pip module wouldn't be a path, it seems strange to put a boolean value in a variable meant to hold a path. I definitely think that the scripts could print whether they're using the pip modules or the in-source tools. Since Lazlo suggested that pip will be the default, we could have the in-source modules notify of the fact that you're using the in-source modules. An additional feature for the pip module could be printing the version that they are (since you can use the pip infrastructure to query the version of a given module within a python script). Another option would be simply trying the pip module first and then falling back to the in-source module. There would be a slight speed penalty (likely around 10ms) but since this would only apply to trim and build, it should have relatively low impact. Lazlo: Thank you for the excellent summary of the different pieces of the discussion along with the links. To answer your first point, I think what a developer does with their pip module is largely up to them. They could do a virtual environment, they could just do what the requirements state, or pip install from a checked out basetools.I do think there are some variables that the virtual environment sets up that would be a good signal whether you're in a virtual environment or not. I agree with your approach of basetools development going into the out of edk2 repo and the importance of making sure package maintainers test and validate their areas with the new setup. I would personally try to get this early into the development cycle, (just after this next stable tag this week) to give the community and developers the most amount of time to get used to things. A trial period of one release makes sense. I also agree that the gateway is important in maintaining cohesion between the new and the old. Hopefully that's nearing completion. Hopefully other stewards will weigh in but otherwise we'll move ahead with a proposed solution in patches next week. -Matthew Carlson On Wed, Sep 2, 2020 at 1:49 AM Laszlo Ersek wrote: > On 09/02/20 02:49, Andrew Fish via groups.io wrote: > > > > > >> On Sep 1, 2020, at 4:35 PM, Matthew Carlson > wrote: > >> > >> Hello all, > >> > >> A recent topic on the RFC mailing list went out and the work on moving > Basetools/Sources/Python to a separate repo has started. See the RFC > conversation here: https://edk2.groups.io/g/rfc/topic/74009714#270 < > https://edk2.groups.io/g/rfc/topic/74009714#270> > >> > >> The repo in question is here: > https://github.com/tianocore/edk2-basetools < > https://github.com/tianocore/edk2-basetools> > >> > >> The current plan is shortly after the stable tag is created, a series > of patches will come into edk2 that redirects the build system into the new > python module as well as adds additional documentation. You can see a > sample of this work here: https://github.com/matthewfcarlson/edk2 < > https://github.com/matthewfcarlson/edk2> as this has a branch that has > the work required to use the basetools pip module. The patches won't delete > the Basetools/Sources/Python folder but will allow users to select between > them. After a certain grace period, the python folder will be deleted and > the pip module will be the de facto way of using basetools. > >> > >> Three questions need to be answered: > >> > >> 1. After the patches that enable the pip module land, how long should > the grace period be? > >> 2. During the grace period, should basetools commits land in both > places or just in the edk2-basetools directory? > >> 3. How should the user be able to select which basetools to use (the > one in EDK2 or the pip module)? Currently the approach being considered is > a simple environmental variable? One of the key considerations is > transparency since it won't be apparent what is being used for a particular > build without some sort of mechanism to notify the developer. With two > seperate versions of Basetools, it becomes very easy for the version of > basetools you're using to not be the one you expect. > >> > > > > Matthew, > > > > I’ll throw out some current developer centric ideas. > > > > 1) If you `source edksetup.sh` (edksetup.bat) you get the current > behavior, and you add an argument you get the pip flavor? So maybe > `edksetup.bat pip-basetools`? > > 2) We have similar issues to this with env variables and the build > command dumps them out when it runs. Can we use the current EDK_TOOL_PATH? > Or maybe add an extra print to show that the pip module is being used? > &g
[edk2-devel] Basetools as a pip module
Hello all, A recent topic on the RFC mailing list went out and the work on moving Basetools/Sources/Python to a separate repo has started. See the RFC conversation here: https://edk2.groups.io/g/rfc/topic/74009714#270 The repo in question is here: https://github.com/tianocore/edk2-basetools The current plan is shortly after the stable tag is created, a series of patches will come into edk2 that redirects the build system into the new python module as well as adds additional documentation. You can see a sample of this work here: https://github.com/matthewfcarlson/edk2 as this has a branch that has the work required to use the basetools pip module. The patches won't delete the Basetools/Sources/Python folder but will allow users to select between them. After a certain grace period, the python folder will be deleted and the pip module will be the de facto way of using basetools. Three questions need to be answered: 1. After the patches that enable the pip module land, how long should the grace period be? 2. During the grace period, should basetools commits land in both places or just in the edk2-basetools directory? 3. How should the user be able to select which basetools to use (the one in EDK2 or the pip module)? Currently the approach being considered is a simple environmental variable? One of the key considerations is transparency since it won't be apparent what is being used for a particular build without some sort of mechanism to notify the developer. With two seperate versions of Basetools, it becomes very easy for the version of basetools you're using to not be the one you expect. Thank you. -Matthew Carlson -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#64924): https://edk2.groups.io/g/devel/message/64924 Mute This Topic: https://groups.io/mt/76572200/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] [PATCH v10 0/5] Use RngLib instead of TimerLib for OpensslLib
From: Matthew Carlson Hello all, This patch contains a fix for Bugzilla 1871. There's been a good bit of community discussion around the topic, so below follows a general overview of the discussion and what this patch does. This is the seventh iteration of this patch series, focused on code style and a few functions being renamed to comply with style. Back in Devel message#40590 (https://edk2.groups.io/g/devel/message/40590) around the patch series that updates OpenSSL to 1.1.1b, a comment was made that suggested that platforms be in charge of the entropy/randomness that is provided to OpenSSL as currently the entropry source seems to be a hand-rolled random number generator that uses the PerformanceCounter from TimerLib. This causes OpenSSL to depend on TimerLib, which is often platform specific. In addition to being a potentially weaker source of randomness, this also poses a challenge to compile BaseCryptLibOnProtocol with a platform- agnostic version of TimerLib that works universally. The solution here is to allow platform to specify their source of entropy in addition to providing two new RngLibs: one that uses the TimerLib as well as one that uses RngProtocol to provide randomness. Then the decision to use RDRAND or other entropy sources is up to the platform. Mixing various entropy sources is the onus of the platform. It has been suggested on Devel#40590 and BZ#1871 that there should be mixing of the PerformanceCounter and RDRAND using something similar to the yarrow alogirthm that FreeBSD uses for example. This patch series doesn't offer an RngLib that offers that sort of mixing as the ultimate source of random is defined by the platform. This patch series offers three benefits: 1. Dependency reduction: Removes the need for a platform specific timer library. We publish a single binary used on numerous platforms for crypto and the introduced timer lib dependency caused issues because we could not fulfill our platform needs with one library instance. 2. Code maintenance: Removing this additional code and leveraging an existing library within Edk2 means less code to maintain. 3. Platform defined quality: A platform can choose which instance to use and the implications of that instance. This patch series seeks to address five seperate issues. 1) Use RngLib interface to generate random entropy in rand_pool 2) Remove dependency on TimerLib in OpensslLib 3) Add a new version of RngLib implemented by TimerLib 4) Add a new version of RngLib implemented by EFI_RNG_PROTOCOL 5) Add RngLib to platforms in EDK2 such as ArmVirtPkg and OvmfPkg Since this changes the dependencies of OpenSSL, this has the potential of being a breaking change for platforms in edk2-platforms. The easiest solution is just to use the RngLib that uses the TimerLib as this closely mimics the behavior of OpenSSL prior to this patch series. There is also a null version of RngLib for CI environments that need this change (https://edk2.groups.io/g/devel/message/50432). Though it should be pointed out that in CI environments, the null version of BaseCryptLib or OpenSSL should be used. In addition, it has been suggested that 1) Add AsmRdSeed to BaseLib. 2) Update BaseRngLib to use AsmRdSeed() for the random number, if RdSeed is supported (CPUID BIT18) However, this is largely out of scope for this particular patch series and will likely need to be in a follow-up series later. It is my understanding that the OpenSSL code uses the values provided as a randomness pool rather than a seed or random numbers itself, so the requirements for randomness are not quite as stringent as other applications. For the ArmVirtPkg and OvmfPkg platforms, the patch series here just adds in the TimerLib based RngLib as that is similar to the functionality of before. It is added as a common library so any custom RngLib defined in the DSC should take precedence over the TimerLibRngLib. Ref: https://github.com/tianocore/edk2/pull/845 Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871 Patch Series History: v10 - addressed comments from Liming removing magic numbers and adding DebugLib to TimerRngLib v8 - addressed comments from Ard and Mike around code style for DxeRngLib and BaseRngLibTimerLib v7 - addressed comments from Lazlo and Ard for further fixes around OvmfPkg v6 - addressed comments from Lazlo and Ard for fixes around OvmfPkg v5 - moved additions for OvmfPkg and ArmVirtPkg to correct positions v4 - added more information to various commit messages v3 - addressed comments from Mike K around fixes to BaseRngLibTimer delays v2 - renamed some libraries to fit with naming conventions Cc: Ard Biesheuvel Cc: Anthony Perard Cc: Jiewen Yao Cc: Jian J Wang Cc: Julien Grall Cc: Jordan Justen Cc: Laszlo Ersek Cc: Liming Gao Cc: Leif Lindholm Cc: Michael D Kinney Cc: Xiaoyu Lu Cc: Zhiguang Liu Cc: Sean Brogan Signed-off-by: Matthew Carlson Matthew Carlson (5): MdePkg: TimerRngLib: Added RngLib that uses TimerLib
[edk2-devel] [PATCH v10 5/5] CryptoPkg: OpensslLib: Use RngLib to generate entropy in rand_pool
From: Matthew Carlson
Ref: https://github.com/tianocore/edk2/pull/845
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871
Changes OpenSSL to no longer depend on TimerLib and instead use RngLib.
This allows platforms to decide for themsevles what sort of entropy source
they provide to OpenSSL and TlsLib.
Cc: Ard Biesheuvel
Cc: Jiewen Yao
Cc: Jian J Wang
Cc: Xiaoyu Lu
Acked-by: Ard Biesheuvel
Reviewed-by: Jiewen Yao
Signed-off-by: Matthew Carlson
---
CryptoPkg/Library/OpensslLib/rand_pool.c | 269 +---
CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 ---
CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43
CryptoPkg/CryptoPkg.ci.yaml| 4 +-
CryptoPkg/CryptoPkg.dsc| 1 +
CryptoPkg/Library/OpensslLib/OpensslLib.inf| 15 +-
CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 15 +-
CryptoPkg/Library/OpensslLib/rand_pool_noise.h | 29 ---
8 files changed, 68 insertions(+), 337 deletions(-)
diff --git a/CryptoPkg/Library/OpensslLib/rand_pool.c
b/CryptoPkg/Library/OpensslLib/rand_pool.c
index 9e0179b03490..6218ae0c1cd7 100644
--- a/CryptoPkg/Library/OpensslLib/rand_pool.c
+++ b/CryptoPkg/Library/OpensslLib/rand_pool.c
@@ -2,8 +2,8 @@
OpenSSL_1_1_1b doesn't implement rand_pool_* functions for UEFI.
The file implement these functions.
-Copyright (c) 2019, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
+ Copyright (c) 2019, Intel Corporation. All rights reserved.
+ SPDX-License-Identifier: BSD-2-Clause-Patent
**/
@@ -11,53 +11,18 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include
#include
-#include
-
-#include "rand_pool_noise.h"
-
-/**
- Get some randomness from low-order bits of GetPerformanceCounter results.
- And combine them to the 64-bit value
-
- @param[out] RandBuffer pointer to store the 64-bit random value.
-
- @retval TRUERandom number generated successfully.
- @retval FALSE Failed to generate.
-**/
-STATIC
-BOOLEAN
-EFIAPI
-GetRandNoise64FromPerformanceCounter(
- OUT UINT64 *Rand
- )
-{
- UINT32 Index;
- UINT32 *RandPtr;
-
- if (NULL == Rand) {
-return FALSE;
- }
-
- RandPtr = (UINT32 *) Rand;
-
- for (Index = 0; Index < 2; Index ++) {
-*RandPtr = (UINT32) (GetPerformanceCounter () & 0xFF);
-MicroSecondDelay (10);
-RandPtr++;
- }
-
- return TRUE;
-}
+#include
/**
Calls RandomNumber64 to fill
a buffer of arbitrary size with random bytes.
+ This is a shim layer to RngLib.
@param[in] LengthSize of the buffer, in bytes, to fill with.
@param[out] RandBufferPointer to the buffer to store the random result.
- @retval EFI_SUCCESSRandom bytes generation succeeded.
- @retval EFI_NOT_READY Failed to request random bytes.
+ @retval TRUERandom bytes generation succeeded.
+ @retval FALSE Failed to request random bytes.
**/
STATIC
@@ -65,7 +30,7 @@ BOOLEAN
EFIAPI
RandGetBytes (
IN UINTN Length,
- OUT UINT8*RandBuffer
+ OUT UINT8 *RandBuffer
)
{
BOOLEAN Ret;
@@ -73,17 +38,17 @@ RandGetBytes (
Ret = FALSE;
+ if (RandBuffer == NULL) {
+DEBUG((DEBUG_ERROR, "[OPENSSL_RAND_POOL] NULL RandBuffer. No random
numbers are generated and your system is not secure\n"));
+ASSERT (RandBuffer != NULL); // Since we can't generate random numbers, we
should assert. Otherwise we will just blow up later.
+return Ret;
+ }
+
+
while (Length > 0) {
-//
-// Get random noise from platform.
-// If it failed, fallback to PerformanceCounter
-// If you really care about security, you must override
-// GetRandomNoise64FromPlatform.
-//
-Ret = GetRandomNoise64 ();
-if (Ret == FALSE) {
- Ret = GetRandNoise64FromPerformanceCounter ();
-}
+// Use RngLib to get random number
+Ret = GetRandomNumber64 ();
+
if (!Ret) {
return Ret;
}
@@ -91,7 +56,8 @@ RandGetBytes (
*((UINT64*) RandBuffer) = TempRand;
RandBuffer += sizeof (UINT64);
Length -= sizeof (TempRand);
-} else {
+}
+else {
CopyMem (RandBuffer, , Length);
Length = 0;
}
@@ -100,125 +66,6 @@ RandGetBytes (
return Ret;
}
-/**
- Creates a 128bit random value that is fully forward and backward prediction
resistant,
- suitable for seeding a NIST SP800-90 Compliant.
- This function takes multiple random numbers from PerformanceCounter to
ensure reseeding
- and performs AES-CBC-MAC over the data to compute the seed value.
-
- @param[out] SeedBufferPointer to a 128bit buffer to store the random
seed.
-
- @retval TRUERandom seed generation succeeded.
- @retval FALSE Failed to request random bytes.
-
-**/
-STATIC
-BOOLEAN
-EFIAPI
-RandGetSeed128 (
- OUT UINT8*SeedBuffer
- )
-{
- BOOLEAN Ret;
- UINT8 RandByte[16];
-
[edk2-devel] [PATCH v10 1/5] MdePkg: TimerRngLib: Added RngLib that uses TimerLib
From: Matthew Carlson
Added a new RngLib that provides random numbers from the TimerLib
using the performance counter. This is meant to be used for OpenSSL
to replicate past behavior. This should not be used in production as
a real source of entropy.
Ref: https://github.com/tianocore/edk2/pull/845
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871
Cc: Ard Biesheuvel
Cc: Michael D Kinney
Cc: Liming Gao
Cc: Zhiguang Liu
Signed-off-by: Matthew Carlson
---
MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c | 189
MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf | 36
MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.uni | 15 ++
MdePkg/MdePkg.dsc| 3 +-
4 files changed, 242 insertions(+), 1 deletion(-)
diff --git a/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
b/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
new file mode 100644
index ..54d29d96f3d3
--- /dev/null
+++ b/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
@@ -0,0 +1,189 @@
+/** @file
+ BaseRng Library that uses the TimerLib to provide reasonably random numbers.
+ Do not use this on a production system.
+
+ Copyright (c) Microsoft Corporation.
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#include
+#include
+#include
+#include
+
+#define DEFAULT_DELAY_TIME_IN_MICROSECONDS 10
+
+/**
+ Using the TimerLib GetPerformanceCounterProperties() we delay
+ for enough time for the PerformanceCounter to increment.
+
+ If the return value from GetPerformanceCounterProperties (TimerLib)
+ is zero, this function will return 10 and attempt to assert.
+ **/
+STATIC
+UINT32
+CalculateMinimumDecentDelayInMicroseconds (
+ VOID
+ )
+{
+ UINT64 CounterHz;
+
+ // Get the counter properties
+ CounterHz = GetPerformanceCounterProperties (NULL, NULL);
+ // Make sure we won't divide by zero
+ if (CounterHz == 0) {
+ASSERT(CounterHz != 0); // Assert so the developer knows something is wrong
+return DEFAULT_DELAY_TIME_IN_MICROSECONDS;
+ }
+ // Calculate the minimum delay based on 1.5 microseconds divided by the
hertz.
+ // We calculate the length of a cycle (1/CounterHz) and multiply it by 1.5
microseconds
+ // This ensures that the performance counter has increased by at least one
+ return (UINT32)(MAX (DivU64x64Remainder (150,CounterHz, NULL), 1));
+}
+
+
+/**
+ Generates a 16-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 16-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber16 (
+ OUT UINT16*Rand
+ )
+{
+ UINT32 Index;
+ UINT8 *RandPtr;
+ UINT32 DelayInMicroSeconds;
+
+ ASSERT (Rand != NULL);
+
+ if (Rand == NULL) {
+return FALSE;
+ }
+ DelayInMicroSeconds = CalculateMinimumDecentDelayInMicroseconds ();
+ RandPtr = (UINT8*)Rand;
+ // Get 2 bytes of random ish data
+ for (Index = 0; Index < sizeof(UINT16); Index ++) {
+*RandPtr = (UINT8)(GetPerformanceCounter () & 0xFF);
+// Delay to give the performance counter a chance to change
+MicroSecondDelay (DelayInMicroSeconds);
+RandPtr++;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 32-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 32-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber32 (
+ OUT UINT32*Rand
+ )
+{
+ UINT32 Index;
+ UINT8 *RandPtr;
+ UINT32 DelayInMicroSeconds;
+
+ ASSERT (Rand != NULL);
+
+ if (NULL == Rand) {
+return FALSE;
+ }
+
+ RandPtr = (UINT8 *) Rand;
+ DelayInMicroSeconds = CalculateMinimumDecentDelayInMicroseconds ();
+ // Get 4 bytes of random ish data
+ for (Index = 0; Index < sizeof(UINT32); Index ++) {
+*RandPtr = (UINT8)(GetPerformanceCounter () & 0xFF);
+// Delay to give the performance counter a chance to change
+MicroSecondDelay (DelayInMicroSeconds);
+RandPtr++;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 64-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 64-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber64 (
+ OUT UINT64*Rand
+ )
+{
+ UINT32 Index;
+ UINT8 *RandPtr;
+ UINT32 DelayInMicroSeconds;
+
+ ASSERT (Rand != NULL);
+
+ if (NULL == Rand) {
+return FALSE;
+ }
+
+ RandPtr = (UINT8 *)Rand;
+ DelayInMicroSeconds = CalculateMinimumDecentDelayInMicroseconds ();
+ // Get 8 bytes of random ish data
+ for (Index = 0; Index < sizeof(UINT64); Index ++) {
+
[edk2-devel] [PATCH v10 2/5] MdePkg: BaseRngLibDxe: Add RngLib that uses RngDxe
From: Matthew Carlson
This adds a RngLib that uses the RngProtocol to provide randomness.
This means that the RngLib is meant to be used with DXE_DRIVERS.
Ref: https://github.com/tianocore/edk2/pull/845
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871
Cc: Ard Biesheuvel
Cc: Michael D Kinney
Cc: Liming Gao
Cc: Zhiguang Liu
Signed-off-by: Matthew Carlson
---
MdePkg/Library/DxeRngLib/DxeRngLib.c | 199
MdePkg/Library/DxeRngLib/DxeRngLib.inf | 38
MdePkg/Library/DxeRngLib/DxeRngLib.uni | 15 ++
MdePkg/MdePkg.dsc | 4 +-
4 files changed, 255 insertions(+), 1 deletion(-)
diff --git a/MdePkg/Library/DxeRngLib/DxeRngLib.c
b/MdePkg/Library/DxeRngLib/DxeRngLib.c
new file mode 100644
index ..9c3d67b5a62d
--- /dev/null
+++ b/MdePkg/Library/DxeRngLib/DxeRngLib.c
@@ -0,0 +1,199 @@
+/** @file
+ Provides an implementation of the library class RngLib that uses the Rng
protocol.
+
+ Copyright (c) Microsoft Corporation. All rights reserved.
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+#include
+#include
+#include
+#include
+#include
+
+/**
+ Routine Description:
+
+ Generates a random number via the NIST
+ 800-9A algorithm. Refer to
+ http://csrc.nist.gov/groups/STM/cavp/documents/drbg/DRBGVS.pdf
+ for more information.
+
+ @param[out] Buffer Buffer to receive the random number.
+ @param[in] BufferSize Number of bytes in Buffer.
+
+ @retval EFI_SUCCESS or underlying failure code.
+**/
+STATIC
+EFI_STATUS
+GenerateRandomNumberViaNist800Algorithm (
+ OUT UINT8 *Buffer,
+ IN UINTN BufferSize
+ )
+{
+ EFI_STATUSStatus;
+ EFI_RNG_PROTOCOL *RngProtocol;
+
+ RngProtocol = NULL;
+
+ if (Buffer == NULL) {
+ DEBUG((DEBUG_ERROR, "%a: Buffer == NULL.\n", __FUNCTION__));
+ return EFI_INVALID_PARAMETER;
+ }
+
+ Status = gBS->LocateProtocol (, NULL, (VOID
**));
+ if (EFI_ERROR (Status) || RngProtocol == NULL) {
+ DEBUG((DEBUG_ERROR, "%a: Could not locate RNG prototocol, Status =
%r\n", __FUNCTION__, Status));
+ return Status;
+ }
+
+ Status = RngProtocol->GetRNG (RngProtocol,
, BufferSize, Buffer);
+ DEBUG((DEBUG_INFO, "%a: GetRNG algorithm CTR-256 - Status = %r\n",
__FUNCTION__, Status));
+ if (!EFI_ERROR (Status)) {
+return Status;
+ }
+
+ Status = RngProtocol->GetRNG (RngProtocol,
, BufferSize, Buffer);
+ DEBUG((DEBUG_INFO, "%a: GetRNG algorithm HMAC-256 - Status = %r\n",
__FUNCTION__, Status));
+ if (!EFI_ERROR (Status)) {
+return Status;
+ }
+
+ Status = RngProtocol->GetRNG (RngProtocol,
, BufferSize, Buffer);
+ DEBUG((DEBUG_INFO, "%a: GetRNG algorithm Hash-256 - Status = %r\n",
__FUNCTION__, Status));
+ if (!EFI_ERROR (Status)) {
+return Status;
+ }
+ // If all the other methods have failed, use the default method from the
RngProtocol
+ Status = RngProtocol->GetRNG (RngProtocol, NULL, BufferSize, Buffer);
+ DEBUG((DEBUG_INFO, "%a: GetRNG algorithm Hash-256 - Status = %r\n",
__FUNCTION__, Status));
+ if (!EFI_ERROR (Status)) {
+return Status;
+ }
+ // If we get to this point, we have failed
+ DEBUG((DEBUG_ERROR, "%a: GetRNG() failed, staus = %r\n", __FUNCTION__,
Status));
+
+ return Status;
+}// GenerateRandomNumberViaNist800Algorithm()
+
+
+/**
+ Generates a 16-bit random number.
+
+ if Rand is NULL, return FALSE.
+
+ @param[out] Rand Buffer pointer to store the 16-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber16 (
+ OUT UINT16 *Rand
+ )
+{
+ EFI_STATUS Status;
+
+ if (Rand == NULL)
+ {
+return FALSE;
+ }
+
+ Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand,
sizeof(UINT16));
+ if (EFI_ERROR (Status)) {
+return FALSE;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 32-bit random number.
+
+ if Rand is NULL, return FALSE.
+
+ @param[out] Rand Buffer pointer to store the 32-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber32 (
+ OUT UINT32 *Rand
+ )
+{
+ EFI_STATUS Status;
+
+ if (Rand == NULL) {
+return FALSE;
+ }
+
+ Status = GenerateRandomNumberViaNist800Algorithm ((UINT8*)Rand,
sizeof(UINT32));
+ if (EFI_ERROR (Status)) {
+return FALSE;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 64-bit random number.
+
+ if Rand is NULL, return FALSE.
+
+ @param[out] Rand Buffer pointer to store the 64-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber64 (
+ OUT UINT64 *Rand
+ )
+{
+ EFI_STATUS Status;
+
+ if (Rand == NULL) {
+return FALSE;
+ }
+
+ Status = GenerateRandomNumberViaNist8
[edk2-devel] [PATCH v10 0/5] Use RngLib instead of TimerLib for OpensslLib
From: Matthew Carlson Hello all, This patch contains a fix for Bugzilla 1871. There's been a good bit of community discussion around the topic, so below follows a general overview of the discussion and what this patch does. This is the seventh iteration of this patch series, focused on code style and a few functions being renamed to comply with style. Back in Devel message#40590 (https://edk2.groups.io/g/devel/message/40590) around the patch series that updates OpenSSL to 1.1.1b, a comment was made that suggested that platforms be in charge of the entropy/randomness that is provided to OpenSSL as currently the entropry source seems to be a hand-rolled random number generator that uses the PerformanceCounter from TimerLib. This causes OpenSSL to depend on TimerLib, which is often platform specific. In addition to being a potentially weaker source of randomness, this also poses a challenge to compile BaseCryptLibOnProtocol with a platform- agnostic version of TimerLib that works universally. The solution here is to allow platform to specify their source of entropy in addition to providing two new RngLibs: one that uses the TimerLib as well as one that uses RngProtocol to provide randomness. Then the decision to use RDRAND or other entropy sources is up to the platform. Mixing various entropy sources is the onus of the platform. It has been suggested on Devel#40590 and BZ#1871 that there should be mixing of the PerformanceCounter and RDRAND using something similar to the yarrow alogirthm that FreeBSD uses for example. This patch series doesn't offer an RngLib that offers that sort of mixing as the ultimate source of random is defined by the platform. This patch series offers three benefits: 1. Dependency reduction: Removes the need for a platform specific timer library. We publish a single binary used on numerous platforms for crypto and the introduced timer lib dependency caused issues because we could not fulfill our platform needs with one library instance. 2. Code maintenance: Removing this additional code and leveraging an existing library within Edk2 means less code to maintain. 3. Platform defined quality: A platform can choose which instance to use and the implications of that instance. This patch series seeks to address five seperate issues. 1) Use RngLib interface to generate random entropy in rand_pool 2) Remove dependency on TimerLib in OpensslLib 3) Add a new version of RngLib implemented by TimerLib 4) Add a new version of RngLib implemented by EFI_RNG_PROTOCOL 5) Add RngLib to platforms in EDK2 such as ArmVirtPkg and OvmfPkg Since this changes the dependencies of OpenSSL, this has the potential of being a breaking change for platforms in edk2-platforms. The easiest solution is just to use the RngLib that uses the TimerLib as this closely mimics the behavior of OpenSSL prior to this patch series. There is also a null version of RngLib for CI environments that need this change (https://edk2.groups.io/g/devel/message/50432). Though it should be pointed out that in CI environments, the null version of BaseCryptLib or OpenSSL should be used. In addition, it has been suggested that 1) Add AsmRdSeed to BaseLib. 2) Update BaseRngLib to use AsmRdSeed() for the random number, if RdSeed is supported (CPUID BIT18) However, this is largely out of scope for this particular patch series and will likely need to be in a follow-up series later. It is my understanding that the OpenSSL code uses the values provided as a randomness pool rather than a seed or random numbers itself, so the requirements for randomness are not quite as stringent as other applications. For the ArmVirtPkg and OvmfPkg platforms, the patch series here just adds in the TimerLib based RngLib as that is similar to the functionality of before. It is added as a common library so any custom RngLib defined in the DSC should take precedence over the TimerLibRngLib. Ref: https://github.com/tianocore/edk2/pull/845 Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871 Patch Series History: v10 - addressed comments from Liming removing magic numbers and adding DebugLib to TimerRngLib v8 - addressed comments from Ard and Mike around code style for DxeRngLib and BaseRngLibTimerLib v7 - addressed comments from Lazlo and Ard for further fixes around OvmfPkg v6 - addressed comments from Lazlo and Ard for fixes around OvmfPkg v5 - moved additions for OvmfPkg and ArmVirtPkg to correct positions v4 - added more information to various commit messages v3 - addressed comments from Mike K around fixes to BaseRngLibTimer delays v2 - renamed some libraries to fit with naming conventions Matthew Carlson (5): MdePkg: TimerRngLib: Added RngLib that uses TimerLib MdePkg: BaseRngLibDxe: Add RngLib that uses RngDxe OvmfPkg: Add RngLib based on TimerLib for Crypto ArmVirtPkg: Add RngLib based on TimerLib for CryptoPkg CryptoPkg: OpensslLib: Use RngLib to generate entropy in rand_pool CryptoPkg/Library/OpensslLib/rand_pool.c
[edk2-devel] [PATCH v10 4/5] ArmVirtPkg: Add RngLib based on TimerLib for CryptoPkg
From: Matthew Carlson Updates the DSC for the ArmVirtPkg platform to add a RngLib that uses the TimerLib. This is due to a later change that adds TimerLib as a dependency for OpenSSL. The TimerLib based RngLib mimics the behavior of OpenSSL previously and it is recommended to switch to a better source of entropy than the system's performance counter. Ref: https://github.com/tianocore/edk2/pull/845 Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871 Cc: Laszlo Ersek Cc: Ard Biesheuvel Cc: Leif Lindholm Reviewed-by: Laszlo Ersek Signed-off-by: Matthew Carlson --- ArmVirtPkg/ArmVirt.dsc.inc | 1 + 1 file changed, 1 insertion(+) diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc index cf44fc73890b..cb3845d2bd37 100644 --- a/ArmVirtPkg/ArmVirt.dsc.inc +++ b/ArmVirtPkg/ArmVirt.dsc.inc @@ -160,6 +160,7 @@ OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf # # Secure Boot dependencies -- 2.28.0.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#64914): https://edk2.groups.io/g/devel/message/64914 Mute This Topic: https://groups.io/mt/76563986/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] [PATCH v10 3/5] OvmfPkg: Add RngLib based on TimerLib for Crypto
From: Matthew Carlson Updates the DSC's for Ovmf based platforms to add a RngLib that uses the TimerLib. This is due to a later change that adds TimerLib as a dependency for OpenSSL. The TimerLib based RngLib mimics the behavior of OpenSSL previously and it is recommended to switch to a better source of entropy than the system's performance counter. Ref: https://github.com/tianocore/edk2/pull/845 Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871 Cc: Jordan Justen Cc: Laszlo Ersek Cc: Ard Biesheuvel Cc: Anthony Perard Cc: Julien Grall Reviewed-by: Laszlo Ersek Signed-off-by: Matthew Carlson --- OvmfPkg/Bhyve/BhyveX64.dsc | 1 + OvmfPkg/OvmfPkgIa32.dsc| 1 + OvmfPkg/OvmfPkgIa32X64.dsc | 1 + OvmfPkg/OvmfPkgX64.dsc | 1 + OvmfPkg/OvmfXen.dsc| 1 + 5 files changed, 5 insertions(+) diff --git a/OvmfPkg/Bhyve/BhyveX64.dsc b/OvmfPkg/Bhyve/BhyveX64.dsc index d2e9edfaa6b8..16d2233d7788 100644 --- a/OvmfPkg/Bhyve/BhyveX64.dsc +++ b/OvmfPkg/Bhyve/BhyveX64.dsc @@ -185,6 +185,7 @@ !else OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf !if $(SECURE_BOOT_ENABLE) == TRUE PlatformSecureLib|OvmfPkg/Bhyve/Library/PlatformSecureLib/PlatformSecureLib.inf diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc index 133a9a93c071..fa18adeb5c5a 100644 --- a/OvmfPkg/OvmfPkgIa32.dsc +++ b/OvmfPkg/OvmfPkgIa32.dsc @@ -189,6 +189,7 @@ !else OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf !if $(SECURE_BOOT_ENABLE) == TRUE PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc index 338c38db29b5..7456a154168d 100644 --- a/OvmfPkg/OvmfPkgIa32X64.dsc +++ b/OvmfPkg/OvmfPkgIa32X64.dsc @@ -193,6 +193,7 @@ !else OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf !if $(SECURE_BOOT_ENABLE) == TRUE PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc index b80710fbdca4..5bda143fd14d 100644 --- a/OvmfPkg/OvmfPkgX64.dsc +++ b/OvmfPkg/OvmfPkgX64.dsc @@ -193,6 +193,7 @@ !else OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf !if $(SECURE_BOOT_ENABLE) == TRUE PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf diff --git a/OvmfPkg/OvmfXen.dsc b/OvmfPkg/OvmfXen.dsc index 37b63a874067..e562abd7175d 100644 --- a/OvmfPkg/OvmfXen.dsc +++ b/OvmfPkg/OvmfXen.dsc @@ -179,6 +179,7 @@ !else OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf VarCheckLib|MdeModulePkg/Library/VarCheckLib/VarCheckLib.inf -- 2.28.0.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#64913): https://edk2.groups.io/g/devel/message/64913 Mute This Topic: https://groups.io/mt/76563985/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] [PATCH v9 5/5] CryptoPkg: OpensslLib: Use RngLib to generate entropy in rand_pool
From: Matthew Carlson
Ref: https://github.com/tianocore/edk2/pull/845
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871
Changes OpenSSL to no longer depend on TimerLib and instead use RngLib.
This allows platforms to decide for themsevles what sort of entropy source
they provide to OpenSSL and TlsLib.
Cc: Ard Biesheuvel
Cc: Jiewen Yao
Cc: Jian J Wang
Cc: Xiaoyu Lu
Acked-by: Ard Biesheuvel
Reviewed-by: Jiewen Yao
Signed-off-by: Matthew Carlson
---
CryptoPkg/Library/OpensslLib/rand_pool.c | 265 +---
CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 ---
CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43
CryptoPkg/CryptoPkg.dsc| 1 +
CryptoPkg/Library/OpensslLib/OpensslLib.inf| 15 +-
CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 15 +-
CryptoPkg/Library/OpensslLib/rand_pool_noise.h | 29 ---
7 files changed, 63 insertions(+), 334 deletions(-)
diff --git a/CryptoPkg/Library/OpensslLib/rand_pool.c
b/CryptoPkg/Library/OpensslLib/rand_pool.c
index 9e0179b03490..490b9e2f4692 100644
--- a/CryptoPkg/Library/OpensslLib/rand_pool.c
+++ b/CryptoPkg/Library/OpensslLib/rand_pool.c
@@ -2,8 +2,8 @@
OpenSSL_1_1_1b doesn't implement rand_pool_* functions for UEFI.
The file implement these functions.
-Copyright (c) 2019, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
+ Copyright (c) 2019, Intel Corporation. All rights reserved.
+ SPDX-License-Identifier: BSD-2-Clause-Patent
**/
@@ -11,53 +11,18 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include
#include
-#include
-
-#include "rand_pool_noise.h"
-
-/**
- Get some randomness from low-order bits of GetPerformanceCounter results.
- And combine them to the 64-bit value
-
- @param[out] RandBuffer pointer to store the 64-bit random value.
-
- @retval TRUERandom number generated successfully.
- @retval FALSE Failed to generate.
-**/
-STATIC
-BOOLEAN
-EFIAPI
-GetRandNoise64FromPerformanceCounter(
- OUT UINT64 *Rand
- )
-{
- UINT32 Index;
- UINT32 *RandPtr;
-
- if (NULL == Rand) {
-return FALSE;
- }
-
- RandPtr = (UINT32 *) Rand;
-
- for (Index = 0; Index < 2; Index ++) {
-*RandPtr = (UINT32) (GetPerformanceCounter () & 0xFF);
-MicroSecondDelay (10);
-RandPtr++;
- }
-
- return TRUE;
-}
+#include
/**
Calls RandomNumber64 to fill
a buffer of arbitrary size with random bytes.
+ This is a shim layer to RngLib.
@param[in] LengthSize of the buffer, in bytes, to fill with.
@param[out] RandBufferPointer to the buffer to store the random result.
- @retval EFI_SUCCESSRandom bytes generation succeeded.
- @retval EFI_NOT_READY Failed to request random bytes.
+ @retval TRUERandom bytes generation succeeded.
+ @retval FALSE Failed to request random bytes.
**/
STATIC
@@ -65,7 +30,7 @@ BOOLEAN
EFIAPI
RandGetBytes (
IN UINTN Length,
- OUT UINT8*RandBuffer
+ OUT UINT8 *RandBuffer
)
{
BOOLEAN Ret;
@@ -73,17 +38,17 @@ RandGetBytes (
Ret = FALSE;
+ if (RandBuffer == NULL) {
+DEBUG((DEBUG_ERROR, "[OPENSSL_RAND_POOL] NULL RandBuffer. No random
numbers are generated and your system is not secure\n"));
+ASSERT (RandBuffer != NULL); // Since we can't generate random numbers, we
should assert. Otherwise we will just blow up later.
+return Ret;
+ }
+
+
while (Length > 0) {
-//
-// Get random noise from platform.
-// If it failed, fallback to PerformanceCounter
-// If you really care about security, you must override
-// GetRandomNoise64FromPlatform.
-//
-Ret = GetRandomNoise64 ();
-if (Ret == FALSE) {
- Ret = GetRandNoise64FromPerformanceCounter ();
-}
+// Use RngLib to get random number
+Ret = GetRandomNumber64 ();
+
if (!Ret) {
return Ret;
}
@@ -91,7 +56,8 @@ RandGetBytes (
*((UINT64*) RandBuffer) = TempRand;
RandBuffer += sizeof (UINT64);
Length -= sizeof (TempRand);
-} else {
+}
+else {
CopyMem (RandBuffer, , Length);
Length = 0;
}
@@ -100,125 +66,6 @@ RandGetBytes (
return Ret;
}
-/**
- Creates a 128bit random value that is fully forward and backward prediction
resistant,
- suitable for seeding a NIST SP800-90 Compliant.
- This function takes multiple random numbers from PerformanceCounter to
ensure reseeding
- and performs AES-CBC-MAC over the data to compute the seed value.
-
- @param[out] SeedBufferPointer to a 128bit buffer to store the random
seed.
-
- @retval TRUERandom seed generation succeeded.
- @retval FALSE Failed to request random bytes.
-
-**/
-STATIC
-BOOLEAN
-EFIAPI
-RandGetSeed128 (
- OUT UINT8*SeedBuffer
- )
-{
- BOOLEAN Ret;
- UINT8 RandByte[16];
- UINT8 Key[16];
- UINT8 Ffv[16];
- UINT8 X
[edk2-devel] [PATCH v9 0/5] Use RngLib instead of TimerLib for OpensslLib
From: Matthew Carlson Hello all, This patch contains a fix for Bugzilla 1871. There's been a good bit of community discussion around the topic, so below follows a general overview of the discussion and what this patch does. This is the seventh iteration of this patch series, focused on code style and a few functions being renamed to comply with style. Back in Devel message#40590 (https://edk2.groups.io/g/devel/message/40590) around the patch series that updates OpenSSL to 1.1.1b, a comment was made that suggested that platforms be in charge of the entropy/randomness that is provided to OpenSSL as currently the entropry source seems to be a hand-rolled random number generator that uses the PerformanceCounter from TimerLib. This causes OpenSSL to depend on TimerLib, which is often platform specific. In addition to being a potentially weaker source of randomness, this also poses a challenge to compile BaseCryptLibOnProtocol with a platform- agnostic version of TimerLib that works universally. The solution here is to allow platform to specify their source of entropy in addition to providing two new RngLibs: one that uses the TimerLib as well as one that uses RngProtocol to provide randomness. Then the decision to use RDRAND or other entropy sources is up to the platform. Mixing various entropy sources is the onus of the platform. It has been suggested on Devel#40590 and BZ#1871 that there should be mixing of the PerformanceCounter and RDRAND using something similar to the yarrow alogirthm that FreeBSD uses for example. This patch series doesn't offer an RngLib that offers that sort of mixing as the ultimate source of random is defined by the platform. This patch series offers three benefits: 1. Dependency reduction: Removes the need for a platform specific timer library. We publish a single binary used on numerous platforms for crypto and the introduced timer lib dependency caused issues because we could not fulfill our platform needs with one library instance. 2. Code maintenance: Removing this additional code and leveraging an existing library within Edk2 means less code to maintain. 3. Platform defined quality: A platform can choose which instance to use and the implications of that instance. This patch series seeks to address five seperate issues. 1) Use RngLib interface to generate random entropy in rand_pool 2) Remove dependency on TimerLib in OpensslLib 3) Add a new version of RngLib implemented by TimerLib 4) Add a new version of RngLib implemented by EFI_RNG_PROTOCOL 5) Add RngLib to platforms in EDK2 such as ArmVirtPkg and OvmfPkg Since this changes the dependencies of OpenSSL, this has the potential of being a breaking change for platforms in edk2-platforms. The easiest solution is just to use the RngLib that uses the TimerLib as this closely mimics the behavior of OpenSSL prior to this patch series. There is also a null version of RngLib for CI environments that need this change (https://edk2.groups.io/g/devel/message/50432). Though it should be pointed out that in CI environments, the null version of BaseCryptLib or OpenSSL should be used. In addition, it has been suggested that 1) Add AsmRdSeed to BaseLib. 2) Update BaseRngLib to use AsmRdSeed() for the random number, if RdSeed is supported (CPUID BIT18) However, this is largely out of scope for this particular patch series and will likely need to be in a follow-up series later. It is my understanding that the OpenSSL code uses the values provided as a randomness pool rather than a seed or random numbers itself, so the requirements for randomness are not quite as stringent as other applications. For the ArmVirtPkg and OvmfPkg platforms, the patch series here just adds in the TimerLib based RngLib as that is similar to the functionality of before. It is added as a common library so any custom RngLib defined in the DSC should take precedence over the TimerLibRngLib. Ref: https://github.com/tianocore/edk2/pull/845 Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871 Patch Series History: v8 - addressed comments from Ard and Mike around code style for DxeRngLib and BaseRngLibTimerLib v7 - addressed comments from Lazlo and Ard for further fixes around OvmfPkg v6 - addressed comments from Lazlo and Ard for fixes around OvmfPkg v5 - moved additions for OvmfPkg and ArmVirtPkg to correct positions v4 - added more information to various commit messages v3 - addressed comments from Mike K around fixes to BaseRngLibTimer delays v2 - renamed some libraries to fit with naming conventions Matthew Carlson (5): MdePkg: TimerRngLib: Added RngLib that uses TimerLib MdePkg: BaseRngLibDxe: Add RngLib that uses RngDxe OvmfPkg: Add RngLib based on TimerLib for Crypto ArmVirtPkg: Add RngLib based on TimerLib for CryptoPkg CryptoPkg: OpensslLib: Use RngLib to generate entropy in rand_pool CryptoPkg/Library/OpensslLib/rand_pool.c | 265 +--- CryptoPkg/Library/OpensslLib/rand_pool_noise.c
[edk2-devel] [PATCH v9 1/5] MdePkg: TimerRngLib: Added RngLib that uses TimerLib
From: Matthew Carlson
Added a new RngLib that provides random numbers from the TimerLib
using the performance counter. This is meant to be used for OpenSSL
to replicate past behavior. This should not be used in production as
a real source of entropy.
Ref: https://github.com/tianocore/edk2/pull/845
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871
Cc: Ard Biesheuvel
Cc: Michael D Kinney
Cc: Liming Gao
Cc: Zhiguang Liu
Signed-off-by: Matthew Carlson
---
MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c | 187
MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf | 36
MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.uni | 15 ++
MdePkg/MdePkg.dsc| 3 +-
4 files changed, 240 insertions(+), 1 deletion(-)
diff --git a/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
b/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
new file mode 100644
index ..aecaa427bb3f
--- /dev/null
+++ b/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
@@ -0,0 +1,187 @@
+/** @file
+ BaseRng Library that uses the TimerLib to provide reasonably random numbers.
+ Do not use this on a production system.
+
+ Copyright (c) Microsoft Corporation.
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#include
+#include
+#include
+#include
+
+/**
+ Using the TimerLib GetPerformanceCounterProperties() we delay
+ for enough time for the PerformanceCounter to increment.
+
+ If the return value from GetPerformanceCounterProperties (TimerLib)
+ is zero, this function will return 10 and attempt to assert.
+ **/
+STATIC
+UINT32
+CalculateMinimumDecentDelayInMicroseconds (
+ VOID
+ )
+{
+ UINT64 CounterHz;
+
+ // Get the counter properties
+ CounterHz = GetPerformanceCounterProperties (NULL, NULL);
+ // Make sure we won't divide by zero
+ if (CounterHz == 0) {
+ASSERT(CounterHz != 0); // Assert so the developer knows something is wrong
+return 10; // return 10 microseconds by default
+ }
+ // Calculate the minimum delay based on 1.5 microseconds divided by the
hertz.
+ // We calculate the length of a cycle (1/CounterHz) and multiply it by 1.5
microseconds
+ // This ensures that the performance counter has increased by at least one
+ return (UINT32)(MAX (DivU64x64Remainder (150,CounterHz, NULL), 1));
+}
+
+
+/**
+ Generates a 16-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 16-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber16 (
+ OUT UINT16*Rand
+ )
+{
+ UINT32 Index;
+ UINT8 *RandPtr;
+ UINT32 DelayInMicroSeconds;
+
+ ASSERT (Rand != NULL);
+
+ if (Rand == NULL) {
+return FALSE;
+ }
+ DelayInMicroSeconds = CalculateMinimumDecentDelayInMicroseconds ();
+ RandPtr = (UINT8*)Rand;
+ // Get 2 bytes of random ish data
+ for (Index = 0; Index < 2; Index ++) {
+*RandPtr = (UINT8)(GetPerformanceCounter () & 0xFF);
+// Delay to give the performance counter a chance to change
+MicroSecondDelay (DelayInMicroSeconds);
+RandPtr++;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 32-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 32-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber32 (
+ OUT UINT32*Rand
+ )
+{
+ UINT32 Index;
+ UINT8 *RandPtr;
+ UINT32 DelayInMicroSeconds;
+
+ ASSERT (Rand != NULL);
+
+ if (NULL == Rand) {
+return FALSE;
+ }
+
+ RandPtr = (UINT8 *) Rand;
+ DelayInMicroSeconds = CalculateMinimumDecentDelayInMicroseconds ();
+ // Get 4 bytes of random ish data
+ for (Index = 0; Index < 4; Index ++) {
+*RandPtr = (UINT8)(GetPerformanceCounter () & 0xFF);
+// Delay to give the performance counter a chance to change
+MicroSecondDelay (DelayInMicroSeconds);
+RandPtr++;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 64-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 64-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber64 (
+ OUT UINT64*Rand
+ )
+{
+ UINT32 Index;
+ UINT8 *RandPtr;
+ UINT32 DelayInMicroSeconds;
+
+ ASSERT (Rand != NULL);
+
+ if (NULL == Rand) {
+return FALSE;
+ }
+
+ RandPtr = (UINT8 *)Rand;
+ DelayInMicroSeconds = CalculateMinimumDecentDelayInMicroseconds ();
+ // Get 8 bytes of random ish data
+ for (Index = 0; Index < 8; Index ++) {
+*RandPtr = (UINT8)(GetPerformanceCounter () & 0xFF);
+// Delay to give the performance count
[edk2-devel] [PATCH v9 3/5] OvmfPkg: Add RngLib based on TimerLib for Crypto
From: Matthew Carlson Updates the DSC's for Ovmf based platforms to add a RngLib that uses the TimerLib. This is due to a later change that adds TimerLib as a dependency for OpenSSL. The TimerLib based RngLib mimics the behavior of OpenSSL previously and it is recommended to switch to a better source of entropy than the system's performance counter. Ref: https://github.com/tianocore/edk2/pull/845 Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871 Cc: Jordan Justen Cc: Laszlo Ersek Cc: Ard Biesheuvel Cc: Anthony Perard Cc: Julien Grall Reviewed-by: Laszlo Ersek Signed-off-by: Matthew Carlson --- OvmfPkg/Bhyve/BhyveX64.dsc | 1 + OvmfPkg/OvmfPkgIa32.dsc| 1 + OvmfPkg/OvmfPkgIa32X64.dsc | 1 + OvmfPkg/OvmfPkgX64.dsc | 1 + OvmfPkg/OvmfXen.dsc| 1 + 5 files changed, 5 insertions(+) diff --git a/OvmfPkg/Bhyve/BhyveX64.dsc b/OvmfPkg/Bhyve/BhyveX64.dsc index d2e9edfaa6b8..16d2233d7788 100644 --- a/OvmfPkg/Bhyve/BhyveX64.dsc +++ b/OvmfPkg/Bhyve/BhyveX64.dsc @@ -185,6 +185,7 @@ !else OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf !if $(SECURE_BOOT_ENABLE) == TRUE PlatformSecureLib|OvmfPkg/Bhyve/Library/PlatformSecureLib/PlatformSecureLib.inf diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc index 133a9a93c071..fa18adeb5c5a 100644 --- a/OvmfPkg/OvmfPkgIa32.dsc +++ b/OvmfPkg/OvmfPkgIa32.dsc @@ -189,6 +189,7 @@ !else OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf !if $(SECURE_BOOT_ENABLE) == TRUE PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc index 338c38db29b5..7456a154168d 100644 --- a/OvmfPkg/OvmfPkgIa32X64.dsc +++ b/OvmfPkg/OvmfPkgIa32X64.dsc @@ -193,6 +193,7 @@ !else OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf !if $(SECURE_BOOT_ENABLE) == TRUE PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc index b80710fbdca4..5bda143fd14d 100644 --- a/OvmfPkg/OvmfPkgX64.dsc +++ b/OvmfPkg/OvmfPkgX64.dsc @@ -193,6 +193,7 @@ !else OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf !if $(SECURE_BOOT_ENABLE) == TRUE PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf diff --git a/OvmfPkg/OvmfXen.dsc b/OvmfPkg/OvmfXen.dsc index 37b63a874067..e562abd7175d 100644 --- a/OvmfPkg/OvmfXen.dsc +++ b/OvmfPkg/OvmfXen.dsc @@ -179,6 +179,7 @@ !else OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf VarCheckLib|MdeModulePkg/Library/VarCheckLib/VarCheckLib.inf -- 2.28.0.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#64655): https://edk2.groups.io/g/devel/message/64655 Mute This Topic: https://groups.io/mt/76437903/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] [PATCH v9 4/5] ArmVirtPkg: Add RngLib based on TimerLib for CryptoPkg
From: Matthew Carlson Updates the DSC for the ArmVirtPkg platform to add a RngLib that uses the TimerLib. This is due to a later change that adds TimerLib as a dependency for OpenSSL. The TimerLib based RngLib mimics the behavior of OpenSSL previously and it is recommended to switch to a better source of entropy than the system's performance counter. Ref: https://github.com/tianocore/edk2/pull/845 Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871 Cc: Laszlo Ersek Cc: Ard Biesheuvel Cc: Leif Lindholm Reviewed-by: Laszlo Ersek Signed-off-by: Matthew Carlson --- ArmVirtPkg/ArmVirt.dsc.inc | 1 + 1 file changed, 1 insertion(+) diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc index cf44fc73890b..cb3845d2bd37 100644 --- a/ArmVirtPkg/ArmVirt.dsc.inc +++ b/ArmVirtPkg/ArmVirt.dsc.inc @@ -160,6 +160,7 @@ OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf # # Secure Boot dependencies -- 2.28.0.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#64656): https://edk2.groups.io/g/devel/message/64656 Mute This Topic: https://groups.io/mt/76437904/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] [PATCH v9 2/5] MdePkg: BaseRngLibDxe: Add RngLib that uses RngDxe
From: Matthew Carlson
This adds a RngLib that uses the RngProtocol to provide randomness.
This means that the RngLib is meant to be used with DXE_DRIVERS.
Ref: https://github.com/tianocore/edk2/pull/845
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871
Cc: Ard Biesheuvel
Cc: Michael D Kinney
Cc: Liming Gao
Cc: Zhiguang Liu
Signed-off-by: Matthew Carlson
---
MdePkg/Library/DxeRngLib/DxeRngLib.c | 199
MdePkg/Library/DxeRngLib/DxeRngLib.inf | 38
MdePkg/Library/DxeRngLib/DxeRngLib.uni | 15 ++
MdePkg/MdePkg.dsc | 4 +-
4 files changed, 255 insertions(+), 1 deletion(-)
diff --git a/MdePkg/Library/DxeRngLib/DxeRngLib.c
b/MdePkg/Library/DxeRngLib/DxeRngLib.c
new file mode 100644
index ..8d4e05e52d57
--- /dev/null
+++ b/MdePkg/Library/DxeRngLib/DxeRngLib.c
@@ -0,0 +1,199 @@
+/** @file
+ Provides an implementation of the library class RngLib that uses the Rng
protocol.
+
+ Copyright (c) Microsoft Corporation. All rights reserved.
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+#include
+#include
+#include
+#include
+#include
+
+/**
+ Routine Description:
+
+ Generates a random number via the NIST
+ 800-9A algorithm. Refer to
+ http://csrc.nist.gov/groups/STM/cavp/documents/drbg/DRBGVS.pdf
+ for more information.
+
+ @param[out] Buffer Buffer to receive the random number.
+ @param[in] BufferSize Number of bytes in Buffer.
+
+ @retval EFI_SUCCESS or underlying failure code.
+**/
+STATIC
+EFI_STATUS
+GenerateRandomNumberViaNist800Algorithm (
+ OUT UINT8 *Buffer,
+ IN UINTN BufferSize
+ )
+{
+ EFI_STATUSStatus;
+ EFI_RNG_PROTOCOL *RngProtocol;
+
+ RngProtocol = NULL;
+
+ if (Buffer == NULL) {
+ DEBUG((DEBUG_ERROR, "%a: Buffer == NULL.\n", __FUNCTION__));
+ return EFI_INVALID_PARAMETER;
+ }
+
+ Status = gBS->LocateProtocol (, NULL, (VOID
**));
+ if (EFI_ERROR (Status) || RngProtocol == NULL) {
+ DEBUG((DEBUG_ERROR, "%a: Could not locate RNG prototocol, Status =
%r\n", __FUNCTION__, Status));
+ return Status;
+ }
+
+ Status = RngProtocol->GetRNG (RngProtocol,
, BufferSize, Buffer);
+ DEBUG((DEBUG_INFO, "%a: GetRNG algorithm CTR-256 - Status = %r\n",
__FUNCTION__, Status));
+ if (!EFI_ERROR (Status)) {
+return Status;
+ }
+
+ Status = RngProtocol->GetRNG (RngProtocol,
, BufferSize, Buffer);
+ DEBUG((DEBUG_INFO, "%a: GetRNG algorithm HMAC-256 - Status = %r\n",
__FUNCTION__, Status));
+ if (!EFI_ERROR (Status)) {
+return Status;
+ }
+
+ Status = RngProtocol->GetRNG (RngProtocol,
, BufferSize, Buffer);
+ DEBUG((DEBUG_INFO, "%a: GetRNG algorithm Hash-256 - Status = %r\n",
__FUNCTION__, Status));
+ if (!EFI_ERROR (Status)) {
+return Status;
+ }
+ // If all the other methods have failed, use the default method from the
RngProtocol
+ Status = RngProtocol->GetRNG (RngProtocol, NULL, BufferSize, Buffer);
+ DEBUG((DEBUG_INFO, "%a: GetRNG algorithm Hash-256 - Status = %r\n",
__FUNCTION__, Status));
+ if (!EFI_ERROR (Status)) {
+return Status;
+ }
+ // If we get to this point, we have failed
+ DEBUG((DEBUG_ERROR, "%a: GetRNG() failed, staus = %r\n", __FUNCTION__,
Status));
+
+ return Status;
+}// GenerateRandomNumberViaNist800Algorithm()
+
+
+/**
+ Generates a 16-bit random number.
+
+ if Rand is NULL, return FALSE.
+
+ @param[out] Rand Buffer pointer to store the 16-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber16 (
+ OUT UINT16 *Rand
+ )
+{
+ EFI_STATUS Status;
+
+ if (Rand == NULL)
+ {
+return FALSE;
+ }
+
+ Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 2);
+ if (EFI_ERROR (Status)) {
+return FALSE;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 32-bit random number.
+
+ if Rand is NULL, return FALSE.
+
+ @param[out] Rand Buffer pointer to store the 32-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber32 (
+ OUT UINT32 *Rand
+ )
+{
+ EFI_STATUS Status;
+
+ if (Rand == NULL) {
+return FALSE;
+ }
+
+ Status = GenerateRandomNumberViaNist800Algorithm ((UINT8*)Rand, 4);
+ if (EFI_ERROR (Status)) {
+return FALSE;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 64-bit random number.
+
+ if Rand is NULL, return FALSE.
+
+ @param[out] Rand Buffer pointer to store the 64-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber64 (
+ OUT UINT64 *Rand
+ )
+{
+ EFI_STATUS Status;
+
+ if (Rand == NULL) {
+return FALSE;
+ }
+
+ Status = GenerateRandomNumberViaNist800Algorithm (
Re: [edk2-devel] [PATCH v8 1/5] MdePkg: TimerRngLib: Added RngLib that uses TimerLib
Thank you Mike and Ard, I'll definitely run ECC and resolve the code nits as well as the other suggestions. So the previous RNG code in OpenSSL just had a 10-microsecond delay in between every 2 bytes. We could go back to that and match the behavior of before but as Mike pointed out, this approach suffers on systems with slow timer libs. I know this particular Rng library isn't meant to be a good source of randomness and it is meant to offer a solution to those who don't want to make the switch over to a good RngLib specifically for OpenSSL. That said, I don't see any reason why we can't make this a better source of random. I don't think it would be quite N, 2N, 3N, ... because of the variability in the delay mechanism but I do agree that it would be quite close to that. I'll throw out some options: 1. Implement a seeding mechanism that we mix in values with what we've previously generated. So that it's no longer N, 2N, 3N but rather some sort of hashing of the two numbers or other PRNG type system. 2. Use only 8 bits from the performance counter rather than 16. The idea here is that it would roll over more frequently and you'd be more subject to randomness. The downside is that this would take twice as long, which means to generate 64 bits of random data, it would take at least 12 performance timer ticks, which on systems where their performance counters run in KHz rather than MHz or GHz, means you could be looking at a delay of milliseconds rather than microseconds. I'd argue in that case that the platform should use a real RngLib rather than use this one if their timer is so slow, but that's beside the point. 3. Have some way of specifying the delay that is less deterministic? There are a few ways I can think of doing this but none are very good.I'm open to suggestions. -Matthew Carlson On Thu, Aug 20, 2020 at 8:21 AM Kinney, Michael D < michael.d.kin...@intel.com> wrote: > Hi Matt, > > Some comments inline below. > > I also see come comments from Ard on this series about code style. > I did not provide feedback on the code style issues here (except for > a function header comment block style). > > There is a tool called ECC (EFI Code Checker) that is now enabled in > EDK II CI. Please run this checker locally and resolve all issues in > your patch series. > > Thanks, > > Mike > > > > -Original Message- > > From: matthewfcarl...@gmail.com > > Sent: Wednesday, August 19, 2020 12:37 PM > > To: devel@edk2.groups.io > > Cc: Ard Biesheuvel ; Kinney, Michael D < > michael.d.kin...@intel.com>; Gao, Liming ; > > Liu, Zhiguang ; Matthew Carlson < > matthewfcarl...@gmail.com> > > Subject: [PATCH v8 1/5] MdePkg: TimerRngLib: Added RngLib that uses > TimerLib > > > > From: Matthew Carlson > > > > Added a new RngLib that provides random numbers from the TimerLib > > using the performance counter. This is meant to be used for OpenSSL > > to replicate past behavior. This should not be used in production as > > a real source of entropy. > > > > Ref: https://github.com/tianocore/edk2/pull/845 > > Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871 > > > > Cc: Ard Biesheuvel > > Cc: Michael D Kinney > > Cc: Liming Gao > > Cc: Zhiguang Liu > > Signed-off-by: Matthew Carlson > > --- > > MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c | 191 > > > MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf | 36 > > MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.uni | 15 ++ > > MdePkg/MdePkg.dsc| 3 +- > > 4 files changed, 244 insertions(+), 1 deletion(-) > > > > diff --git a/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c > b/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c > > new file mode 100644 > > index ..c72aa335823d > > --- /dev/null > > +++ b/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c > > @@ -0,0 +1,191 @@ > > +/** @file > > > > + BaseRng Library that uses the TimerLib to provide reasonably random > numbers. > > > > + Do not use this on a production system. > > > > + > > > > + Copyright (c) Microsoft Corporation. > > > > + SPDX-License-Identifier: BSD-2-Clause-Patent > > > > +**/ > > > > + > > > > +#include > > > > +#include > > > > +#include > > > > +#include > > > > + > > > > +/** > > > > + * Using the TimerLib GetPerformanceCounterProperties() we delay > > > > + * for enough time for the PerformanceCounter to increment. > > > > + * Depending on your system > > > Please update t
[edk2-devel] [PATCH v8 1/5] MdePkg: TimerRngLib: Added RngLib that uses TimerLib
From: Matthew Carlson
Added a new RngLib that provides random numbers from the TimerLib
using the performance counter. This is meant to be used for OpenSSL
to replicate past behavior. This should not be used in production as
a real source of entropy.
Ref: https://github.com/tianocore/edk2/pull/845
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871
Cc: Ard Biesheuvel
Cc: Michael D Kinney
Cc: Liming Gao
Cc: Zhiguang Liu
Signed-off-by: Matthew Carlson
---
MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c | 191
MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf | 36
MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.uni | 15 ++
MdePkg/MdePkg.dsc| 3 +-
4 files changed, 244 insertions(+), 1 deletion(-)
diff --git a/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
b/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
new file mode 100644
index ..c72aa335823d
--- /dev/null
+++ b/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
@@ -0,0 +1,191 @@
+/** @file
+ BaseRng Library that uses the TimerLib to provide reasonably random numbers.
+ Do not use this on a production system.
+
+ Copyright (c) Microsoft Corporation.
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#include
+#include
+#include
+#include
+
+/**
+ * Using the TimerLib GetPerformanceCounterProperties() we delay
+ * for enough time for the PerformanceCounter to increment.
+ * Depending on your system
+ *
+ * If the return value from GetPerformanceCounterProperties (TimerLib)
+ * is zero, this function will not delay and attempt to assert.
+ */
+STATIC
+UINT32
+CalculateMinimumDecentDelayInMicroseconds (
+ VOID
+ )
+{
+ UINT64 StartValue;
+ UINT64 EndValue;
+ UINT64 CounterHz;
+ UINT64 MinumumDelayInMicroSeconds;
+
+ // Get the counter properties
+ CounterHz = GetPerformanceCounterProperties (, );
+ // Make sure we won't divide by zero
+ if (CounterHz == 0) {
+ASSERT(CounterHz != 0); // Assert so the developer knows something is wrong
+return;
+ }
+ // Calculate the minimum delay based on 1.5 microseconds divided by the
hertz.
+ // We calculate the length of a cycle (1/CounterHz) and multiply it by 1.5
microseconds
+ // This ensures that the performance counter has increased by at least one
+ return (UINT32)(MAX(DivU64x64Remainder(150 / CounterHz, NULL), 1));
+}
+
+
+/**
+ Generates a 16-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 16-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber16 (
+ OUT UINT16*Rand
+ )
+{
+ UINT32 Index;
+ UINT8 *RandPtr;
+ UINT32 DelayInMicroSeconds;
+
+ ASSERT (Rand != NULL);
+
+ if (Rand == NULL) {
+return FALSE;
+ }
+ DelayInMicroSeconds = CalculateMinimumDecentDelayInMicroseconds ();
+ RandPtr = (UINT8*)Rand;
+ // Get 2 bytes of random ish data
+ for (Index = 0; Index < 2; Index ++) {
+*RandPtr = (UINT8)(GetPerformanceCounter () & 0xFF);
+// Delay to give the performance counter a chance to change
+MicroSecondDelay (DelayInMicroSeconds);
+RandPtr++;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 32-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 32-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber32 (
+ OUT UINT32*Rand
+ )
+{
+ UINT32 Index;
+ UINT8 *RandPtr;
+ UINT32 DelayInMicroSeconds;
+
+ ASSERT (Rand != NULL);
+
+ if (NULL == Rand) {
+return FALSE;
+ }
+
+ RandPtr = (UINT8 *) Rand;
+ DelayInMicroSeconds = CalculateMinimumDecentDelayInMicroseconds ();
+ // Get 4 bytes of random ish data
+ for (Index = 0; Index < 4; Index ++) {
+*RandPtr = (UINT8) (GetPerformanceCounter () & 0xFF);
+// Delay to give the performance counter a chance to change
+MicroSecondDelay (DelayInMicroSeconds);
+RandPtr++;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 64-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 64-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber64 (
+ OUT UINT64*Rand
+ )
+{
+ UINT32 Index;
+ UINT8 *RandPtr;
+ UINT32 DelayInMicroSeconds;
+
+ ASSERT (Rand != NULL);
+
+ if (NULL == Rand) {
+return FALSE;
+ }
+
+ RandPtr = (UINT8 *) Rand;
+ DelayInMicroSeconds = CalculateMinimumDecentDelayInMicroseconds ();
+ // Get 8 bytes of random ish data
+ for (Index = 0; Index < 8; Index ++) {
+*RandPtr = (UINT8)(GetPerformance
[edk2-devel] [PATCH v8 2/5] MdePkg: BaseRngLibDxe: Add RngLib that uses RngDxe
From: Matthew Carlson
This adds a RngLib that uses the RngProtocol to provide randomness.
This means that the RngLib is meant to be used with DXE_DRIVERS.
Ref: https://github.com/tianocore/edk2/pull/845
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871
Cc: Ard Biesheuvel
Cc: Michael D Kinney
Cc: Liming Gao
Cc: Zhiguang Liu
Signed-off-by: Matthew Carlson
---
MdePkg/Library/DxeRngLib/DxeRngLib.c | 206
MdePkg/Library/DxeRngLib/DxeRngLib.inf | 38
MdePkg/Library/DxeRngLib/DxeRngLib.uni | 15 ++
MdePkg/MdePkg.dsc | 4 +-
4 files changed, 262 insertions(+), 1 deletion(-)
diff --git a/MdePkg/Library/DxeRngLib/DxeRngLib.c
b/MdePkg/Library/DxeRngLib/DxeRngLib.c
new file mode 100644
index ..0bd6585357b5
--- /dev/null
+++ b/MdePkg/Library/DxeRngLib/DxeRngLib.c
@@ -0,0 +1,206 @@
+/** @file
+ Provides an implementation of the library class RngLib that uses the Rng
protocol.
+
+ Copyright (c) Microsoft Corporation. All rights reserved.
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+#include
+#include
+#include
+#include
+#include
+
+/**
+Routine Description:
+
+Generates a random number via the NIST
+800-9A algorithm. Refer to
+http://csrc.nist.gov/groups/STM/cavp/documents/drbg/DRBGVS.pdf
+for more information.
+
+Arguments:
+
+Buffer -- Buffer to receive the random number.
+BufferSize -- Number of bytes in Buffer.
+
+Return Value:
+
+EFI_SUCCESS or underlying failure code.
+
+**/
+STATIC
+EFI_STATUS
+GenerateRandomNumberViaNist800Algorithm (
+ OUT UINT8 *Buffer,
+ IN UINTN BufferSize
+ )
+{
+ EFI_STATUSStatus;
+ EFI_RNG_PROTOCOL *RngProtocol;
+
+ RngProtocol = NULL;
+
+ if (Buffer == NULL) {
+ DEBUG((DEBUG_ERROR, "[%a] Buffer == NULL.\n", __FUNCTION__));
+ return EFI_INVALID_PARAMETER;
+ }
+
+ Status = gBS->LocateProtocol (, NULL, (VOID
**));
+ if (EFI_ERROR (Status) || RngProtocol == NULL) {
+ DEBUG((DEBUG_ERROR, "%a: Could not locate RNG prototocol, Status =
%r\n", __FUNCTION__, Status));
+ return Status;
+ }
+
+ Status = RngProtocol->GetRNG (RngProtocol,
, BufferSize, Buffer);
+ DEBUG((DEBUG_INFO, "%a: GetRNG algorithm CTR-256 - Status = %r\n",
__FUNCTION__, Status));
+ if(!EFI_ERROR(Status)) {
+return Status;
+ }
+
+ Status = RngProtocol->GetRNG (RngProtocol,
, BufferSize, Buffer);
+ DEBUG((DEBUG_INFO, "%a: GetRNG algorithm HMAC-256 - Status = %r\n",
__FUNCTION__, Status));
+ if(!EFI_ERROR(Status)) {
+return Status;
+ }
+
+ Status = RngProtocol->GetRNG (RngProtocol,
, BufferSize, Buffer);
+ DEBUG((DEBUG_INFO, "%a: GetRNG algorithm Hash-256 - Status = %r\n",
__FUNCTION__, Status));
+ if (!EFI_ERROR(Status)) {
+return Status;
+ }
+ // If all the other methods have failed, use the default method from the
RngProtocol
+ Status = RngProtocol->GetRNG (RngProtocol, NULL, BufferSize, Buffer);
+ DEBUG((DEBUG_INFO, "%a: GetRNG algorithm Hash-256 - Status = %r\n",
__FUNCTION__, Status));
+ if (!EFI_ERROR(Status)) {
+return Status;
+ }
+ // If we get to this point, we have failed
+ DEBUG((DEBUG_ERROR, "%a: GetRNG() failed, staus = %r\n", __FUNCTION__,
Status));
+
+ return Status;
+}// GenerateRandomNumberViaNist800Algorithm()
+
+
+/**
+ Generates a 16-bit random number.
+
+ if Rand is NULL, return FALSE.
+
+ @param[out] Rand Buffer pointer to store the 16-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber16 (
+ OUT UINT16*Rand
+ )
+{
+ EFI_STATUS Status;
+
+ if (Rand == NULL)
+ {
+return FALSE;
+ }
+
+ Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 2);
+ if (EFI_ERROR (Status))
+ {
+return FALSE;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 32-bit random number.
+
+ if Rand is NULL, return FALSE.
+
+ @param[out] Rand Buffer pointer to store the 32-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber32 (
+ OUT UINT32*Rand
+ )
+{
+ EFI_STATUS Status;
+
+ if (Rand == NULL) {
+return FALSE;
+ }
+
+ Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 4);
+ if (EFI_ERROR (Status)) {
+return FALSE;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 64-bit random number.
+
+ if Rand is NULL, return FALSE.
+
+ @param[out] Rand Buffer pointer to store the 64-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber64 (
+ OUT UINT64*Rand
+ )
+{
+ EFI_STATUS Status;
+
+ if (Rand == NULL)
+ {
[edk2-devel] [PATCH v8 5/5] CryptoPkg: OpensslLib: Use RngLib to generate entropy in rand_pool
From: Matthew Carlson
Ref: https://github.com/tianocore/edk2/pull/845
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871
Changes OpenSSL to no longer depend on TimerLib and instead use RngLib.
This allows platforms to decide for themsevles what sort of entropy source
they provide to OpenSSL and TlsLib.
Cc: Ard Biesheuvel
Cc: Jiewen Yao
Cc: Jian J Wang
Cc: Xiaoyu Lu
Acked-by: Ard Biesheuvel
Reviewed-by: Jiewen Yao
Signed-off-by: Matthew Carlson
---
CryptoPkg/Library/OpensslLib/rand_pool.c | 265 +---
CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 ---
CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43
CryptoPkg/CryptoPkg.dsc| 1 +
CryptoPkg/Library/OpensslLib/OpensslLib.inf| 15 +-
CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 15 +-
CryptoPkg/Library/OpensslLib/rand_pool_noise.h | 29 ---
7 files changed, 63 insertions(+), 334 deletions(-)
diff --git a/CryptoPkg/Library/OpensslLib/rand_pool.c
b/CryptoPkg/Library/OpensslLib/rand_pool.c
index 9e0179b03490..490b9e2f4692 100644
--- a/CryptoPkg/Library/OpensslLib/rand_pool.c
+++ b/CryptoPkg/Library/OpensslLib/rand_pool.c
@@ -2,8 +2,8 @@
OpenSSL_1_1_1b doesn't implement rand_pool_* functions for UEFI.
The file implement these functions.
-Copyright (c) 2019, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
+ Copyright (c) 2019, Intel Corporation. All rights reserved.
+ SPDX-License-Identifier: BSD-2-Clause-Patent
**/
@@ -11,53 +11,18 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include
#include
-#include
-
-#include "rand_pool_noise.h"
-
-/**
- Get some randomness from low-order bits of GetPerformanceCounter results.
- And combine them to the 64-bit value
-
- @param[out] RandBuffer pointer to store the 64-bit random value.
-
- @retval TRUERandom number generated successfully.
- @retval FALSE Failed to generate.
-**/
-STATIC
-BOOLEAN
-EFIAPI
-GetRandNoise64FromPerformanceCounter(
- OUT UINT64 *Rand
- )
-{
- UINT32 Index;
- UINT32 *RandPtr;
-
- if (NULL == Rand) {
-return FALSE;
- }
-
- RandPtr = (UINT32 *) Rand;
-
- for (Index = 0; Index < 2; Index ++) {
-*RandPtr = (UINT32) (GetPerformanceCounter () & 0xFF);
-MicroSecondDelay (10);
-RandPtr++;
- }
-
- return TRUE;
-}
+#include
/**
Calls RandomNumber64 to fill
a buffer of arbitrary size with random bytes.
+ This is a shim layer to RngLib.
@param[in] LengthSize of the buffer, in bytes, to fill with.
@param[out] RandBufferPointer to the buffer to store the random result.
- @retval EFI_SUCCESSRandom bytes generation succeeded.
- @retval EFI_NOT_READY Failed to request random bytes.
+ @retval TRUERandom bytes generation succeeded.
+ @retval FALSE Failed to request random bytes.
**/
STATIC
@@ -65,7 +30,7 @@ BOOLEAN
EFIAPI
RandGetBytes (
IN UINTN Length,
- OUT UINT8*RandBuffer
+ OUT UINT8 *RandBuffer
)
{
BOOLEAN Ret;
@@ -73,17 +38,17 @@ RandGetBytes (
Ret = FALSE;
+ if (RandBuffer == NULL) {
+DEBUG((DEBUG_ERROR, "[OPENSSL_RAND_POOL] NULL RandBuffer. No random
numbers are generated and your system is not secure\n"));
+ASSERT (RandBuffer != NULL); // Since we can't generate random numbers, we
should assert. Otherwise we will just blow up later.
+return Ret;
+ }
+
+
while (Length > 0) {
-//
-// Get random noise from platform.
-// If it failed, fallback to PerformanceCounter
-// If you really care about security, you must override
-// GetRandomNoise64FromPlatform.
-//
-Ret = GetRandomNoise64 ();
-if (Ret == FALSE) {
- Ret = GetRandNoise64FromPerformanceCounter ();
-}
+// Use RngLib to get random number
+Ret = GetRandomNumber64 ();
+
if (!Ret) {
return Ret;
}
@@ -91,7 +56,8 @@ RandGetBytes (
*((UINT64*) RandBuffer) = TempRand;
RandBuffer += sizeof (UINT64);
Length -= sizeof (TempRand);
-} else {
+}
+else {
CopyMem (RandBuffer, , Length);
Length = 0;
}
@@ -100,125 +66,6 @@ RandGetBytes (
return Ret;
}
-/**
- Creates a 128bit random value that is fully forward and backward prediction
resistant,
- suitable for seeding a NIST SP800-90 Compliant.
- This function takes multiple random numbers from PerformanceCounter to
ensure reseeding
- and performs AES-CBC-MAC over the data to compute the seed value.
-
- @param[out] SeedBufferPointer to a 128bit buffer to store the random
seed.
-
- @retval TRUERandom seed generation succeeded.
- @retval FALSE Failed to request random bytes.
-
-**/
-STATIC
-BOOLEAN
-EFIAPI
-RandGetSeed128 (
- OUT UINT8*SeedBuffer
- )
-{
- BOOLEAN Ret;
- UINT8 RandByte[16];
- UINT8 Key[16];
- UINT8 Ffv[16];
- UINT8 X
[edk2-devel] [PATCH v8 4/5] ArmVirtPkg: Add RngLib based on TimerLib for CryptoPkg
From: Matthew Carlson Updates the DSC for the ArmVirtPkg platform to add a RngLib that uses the TimerLib. This is due to a later change that adds TimerLib as a dependency for OpenSSL. The TimerLib based RngLib mimics the behavior of OpenSSL previously and it is recommended to switch to a better source of entropy than the system's performance counter. Ref: https://github.com/tianocore/edk2/pull/845 Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871 Cc: Laszlo Ersek Cc: Ard Biesheuvel Cc: Leif Lindholm Reviewed-by: Laszlo Ersek Signed-off-by: Matthew Carlson --- ArmVirtPkg/ArmVirt.dsc.inc | 1 + 1 file changed, 1 insertion(+) diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc index cf44fc73890b..cb3845d2bd37 100644 --- a/ArmVirtPkg/ArmVirt.dsc.inc +++ b/ArmVirtPkg/ArmVirt.dsc.inc @@ -160,6 +160,7 @@ OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf # # Secure Boot dependencies -- 2.28.0.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#64469): https://edk2.groups.io/g/devel/message/64469 Mute This Topic: https://groups.io/mt/76294217/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] [PATCH v8 3/5] OvmfPkg: Add RngLib based on TimerLib for Crypto
From: Matthew Carlson Updates the DSC's for Ovmf based platforms to add a RngLib that uses the TimerLib. This is due to a later change that adds TimerLib as a dependency for OpenSSL. The TimerLib based RngLib mimics the behavior of OpenSSL previously and it is recommended to switch to a better source of entropy than the system's performance counter. Ref: https://github.com/tianocore/edk2/pull/845 Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871 Cc: Jordan Justen Cc: Laszlo Ersek Cc: Ard Biesheuvel Cc: Anthony Perard Cc: Julien Grall Reviewed-by: Laszlo Ersek Signed-off-by: Matthew Carlson --- OvmfPkg/Bhyve/BhyvePkgX64.dsc | 1 + OvmfPkg/OvmfPkgIa32.dsc | 1 + OvmfPkg/OvmfPkgIa32X64.dsc| 1 + OvmfPkg/OvmfPkgX64.dsc| 1 + OvmfPkg/OvmfXen.dsc | 1 + 5 files changed, 5 insertions(+) diff --git a/OvmfPkg/Bhyve/BhyvePkgX64.dsc b/OvmfPkg/Bhyve/BhyvePkgX64.dsc index 99e214619be0..0bf1acbc8dc8 100644 --- a/OvmfPkg/Bhyve/BhyvePkgX64.dsc +++ b/OvmfPkg/Bhyve/BhyvePkgX64.dsc @@ -185,6 +185,7 @@ !else OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf !if $(SECURE_BOOT_ENABLE) == TRUE PlatformSecureLib|OvmfPkg/Bhyve/Library/PlatformSecureLib/PlatformSecureLib.inf diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc index 133a9a93c071..fa18adeb5c5a 100644 --- a/OvmfPkg/OvmfPkgIa32.dsc +++ b/OvmfPkg/OvmfPkgIa32.dsc @@ -189,6 +189,7 @@ !else OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf !if $(SECURE_BOOT_ENABLE) == TRUE PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc index 338c38db29b5..7456a154168d 100644 --- a/OvmfPkg/OvmfPkgIa32X64.dsc +++ b/OvmfPkg/OvmfPkgIa32X64.dsc @@ -193,6 +193,7 @@ !else OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf !if $(SECURE_BOOT_ENABLE) == TRUE PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc index b80710fbdca4..5bda143fd14d 100644 --- a/OvmfPkg/OvmfPkgX64.dsc +++ b/OvmfPkg/OvmfPkgX64.dsc @@ -193,6 +193,7 @@ !else OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf !if $(SECURE_BOOT_ENABLE) == TRUE PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf diff --git a/OvmfPkg/OvmfXen.dsc b/OvmfPkg/OvmfXen.dsc index 37b63a874067..e562abd7175d 100644 --- a/OvmfPkg/OvmfXen.dsc +++ b/OvmfPkg/OvmfXen.dsc @@ -179,6 +179,7 @@ !else OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf VarCheckLib|MdeModulePkg/Library/VarCheckLib/VarCheckLib.inf -- 2.28.0.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#64468): https://edk2.groups.io/g/devel/message/64468 Mute This Topic: https://groups.io/mt/76294215/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] [PATCH v8 0/5] Use RngLib instead of TimerLib for OpensslLib
From: Matthew Carlson Hello all, This patch contains a fix for Bugzilla 1871. There's been a good bit of community discussion around the topic, so below follows a general overview of the discussion and what this patch does. This is the seventh iteration of this patch series, focused on code style and a few functions being renamed to comply with style. Back in Devel message#40590 (https://edk2.groups.io/g/devel/message/40590) around the patch series that updates OpenSSL to 1.1.1b, a comment was made that suggested that platforms be in charge of the entropy/randomness that is provided to OpenSSL as currently the entropry source seems to be a hand-rolled random number generator that uses the PerformanceCounter from TimerLib. This causes OpenSSL to depend on TimerLib, which is often platform specific. In addition to being a potentially weaker source of randomness, this also poses a challenge to compile BaseCryptLibOnProtocol with a platform- agnostic version of TimerLib that works universally. The solution here is to allow platform to specify their source of entropy in addition to providing two new RngLibs: one that uses the TimerLib as well as one that uses RngProtocol to provide randomness. Then the decision to use RDRAND or other entropy sources is up to the platform. Mixing various entropy sources is the onus of the platform. It has been suggested on Devel#40590 and BZ#1871 that there should be mixing of the PerformanceCounter and RDRAND using something similar to the yarrow alogirthm that FreeBSD uses for example. This patch series doesn't offer an RngLib that offers that sort of mixing as the ultimate source of random is defined by the platform. This patch series offers three benefits: 1. Dependency reduction: Removes the need for a platform specific timer library. We publish a single binary used on numerous platforms for crypto and the introduced timer lib dependency caused issues because we could not fulfill our platform needs with one library instance. 2. Code maintenance: Removing this additional code and leveraging an existing library within Edk2 means less code to maintain. 3. Platform defined quality: A platform can choose which instance to use and the implications of that instance. This patch series seeks to address five seperate issues. 1) Use RngLib interface to generate random entropy in rand_pool 2) Remove dependency on TimerLib in OpensslLib 3) Add a new version of RngLib implemented by TimerLib 4) Add a new version of RngLib implemented by EFI_RNG_PROTOCOL 5) Add RngLib to platforms in EDK2 such as ArmVirtPkg and OvmfPkg Since this changes the dependencies of OpenSSL, this has the potential of being a breaking change for platforms in edk2-platforms. The easiest solution is just to use the RngLib that uses the TimerLib as this closely mimics the behavior of OpenSSL prior to this patch series. There is also a null version of RngLib for CI environments that need this change (https://edk2.groups.io/g/devel/message/50432). Though it should be pointed out that in CI environments, the null version of BaseCryptLib or OpenSSL should be used. In addition, it has been suggested that 1) Add AsmRdSeed to BaseLib. 2) Update BaseRngLib to use AsmRdSeed() for the random number, if RdSeed is supported (CPUID BIT18) However, this is largely out of scope for this particular patch series and will likely need to be in a follow-up series later. It is my understanding that the OpenSSL code uses the values provided as a randomness pool rather than a seed or random numbers itself, so the requirements for randomness are not quite as stringent as other applications. For the ArmVirtPkg and OvmfPkg platforms, the patch series here just adds in the TimerLib based RngLib as that is similar to the functionality of before. It is added as a common library so any custom RngLib defined in the DSC should take precedence over the TimerLibRngLib. Ref: https://github.com/tianocore/edk2/pull/845 Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871 Cc: Ard Biesheuvel Cc: Anthony Perard Cc: Jiewen Yao Cc: Jian J Wang Cc: Julien Grall Cc: Jordan Justen Cc: Laszlo Ersek Cc: Liming Gao Cc: Leif Lindholm Cc: Michael D Kinney Cc: Xiaoyu Lu Cc: Zhiguang Liu Cc: Sean Brogan Signed-off-by: Matthew Carlson Matthew Carlson (5): MdePkg: TimerRngLib: Added RngLib that uses TimerLib MdePkg: BaseRngLibDxe: Add RngLib that uses RngDxe OvmfPkg: Add RngLib based on TimerLib for Crypto ArmVirtPkg: Add RngLib based on TimerLib for CryptoPkg CryptoPkg: OpensslLib: Use RngLib to generate entropy in rand_pool CryptoPkg/Library/OpensslLib/rand_pool.c | 265 +--- CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 --- CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43 MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c | 191 ++ MdePkg/Library/DxeRngLib/DxeRngLib.c | 206 +++ ArmVirtPkg
Re: [edk2-devel] [PATCH v7 0/5] Use RngLib instead of TimerLib for OpensslLib
Thanks Mike, I've addressed all your comments. I'll wait for a few more people to weigh in before I send out v8. -Matthew Carlson On Thu, Aug 13, 2020 at 6:12 PM Kinney, Michael D < michael.d.kin...@intel.com> wrote: > Hi Matt, > > BaseRngLibTimerLib > === > Thank you for updating BaseRngLibTimerLib to use > GetPerformanceCounterProperties(). > StartValue and EndValue are OPTIONAL, so the function DecentDelay() can be > simplified > to remove the StartValue and EndValue local variables and get the rate of > the counter > using the following: > > // Get the counter properties > CounterHz = GetPerformanceCounterProperties (NULL, NULL); > > When you compute the min delay, I see the formula will generate a value of > 0 when > the rate of the performance counter is greater than 1.5MHz. > MicroSecondDelay() > may return immediately if MicroSeconds is 0. Is this your intended > behavior? > Or did you want to make sure the min value is 1 such as: > > MinumumDelayInMicroSeconds = MAX (150 / CounterHz, 1); > > CounterHz is also type UINT64 so this is a 64-bit divide operation that > must > use the BaseLib function DivU64x64Remainder() for 32-bit builds. > > MinumumDelayInMicroSeconds = MAX (DivU64x64Remainder (150, > CounterHz, NULL), 1); > > The function DecentDelay() may interact with HW to get the performance > counter > rate and then do the divide operation. For the RngLib APIs that need the > delay, > I recommend you call DecentDelay() to get the MinumumDelayInMicroSeconds > into > a local variable and then use that value for calls to MicroSecondDelay() > in the > RngLib APIs. > > The comments in the RngLib APIs that describe the length of the delays in > uS/mS > need to be updated because the length of the delay is computed. Update > with > a more generic comment to perform a minimum delay to guarantee a different > performance counter value. > > The UNI file header and strings need to be updated to match INF/C files. > > > DxeRngLib > == > 1) Please add a UNI file for this lib. > > Best regards, > > Mike > > > -Original Message- > > From: devel@edk2.groups.io On Behalf Of Matthew > Carlson > > Sent: Thursday, August 13, 2020 12:45 PM > > To: devel@edk2.groups.io > > Cc: Ard Biesheuvel ; Anthony Perard < > anthony.per...@citrix.com>; Yao, Jiewen > > ; Wang, Jian J ; Julien > Grall ; Justen, Jordan L > > ; Laszlo Ersek ; Gao, > Liming ; Leif Lindholm > > ; Kinney, Michael D ; > Lu, XiaoyuX ; Liu, Zhiguang > > ; Sean Brogan ; > Matthew Carlson > > Subject: [edk2-devel] [PATCH v7 0/5] Use RngLib instead of TimerLib for > OpensslLib > > > > From: Matthew Carlson > > > > Hello all, > > > > This patch contains a fix for Bugzilla 1871. > > There's been a good bit of community discussion around the topic, > > so below follows a general overview of the discussion and what this > patch does. > > > > This is the seventh iteration of this patch series, focused on code > style and a > > few functions being renamed to comply with style. > > > > Back in Devel message#40590 ( > https://edk2.groups.io/g/devel/message/40590) > > around the patch series that updates OpenSSL to 1.1.1b, a comment was > made > > that suggested that platforms be in charge of the entropy/randomness that > > is provided to OpenSSL as currently the entropry source seems to be a > > hand-rolled random number generator that uses the PerformanceCounter from > > TimerLib. This causes OpenSSL to depend on TimerLib, which is often > platform > > specific. In addition to being a potentially weaker source of randomness, > > this also poses a challenge to compile BaseCryptLibOnProtocol with a > platform- > > agnostic version of TimerLib that works universally. > > > > The solution here is to allow platform to specify their source of > entropy in > > addition to providing two new RngLibs: one that uses the TimerLib as > well as > > one that uses RngProtocol to provide randomness. Then the decision to use > > RDRAND or other entropy sources is up to the platform. Mixing various > entropy > > sources is the onus of the platform. It has been suggested on > Devel#40590 and > > BZ#1871 that there should be mixing of the PerformanceCounter and RDRAND > using > > something similar to the yarrow alogirthm that FreeBSD uses for example. > This > > patch series doesn't offer an RngLib that offers that sort of mixing as > the > > ultimate source of random is defined by the platform. > > > > This patch series offe
[edk2-devel] [PATCH v7 2/5] MdePkg: BaseRngLibDxe: Add RngLib that uses RngDxe
From: Matthew Carlson
This adds a RngLib that uses the RngProtocol to provide randomness.
This means that the RngLib is meant to be used with DXE_DRIVERS.
Ref: https://github.com/tianocore/edk2/pull/845
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871
Cc: Ard Biesheuvel
Cc: Michael D Kinney
Cc: Liming Gao
Cc: Zhiguang Liu
Signed-off-by: Matthew Carlson
---
MdePkg/Library/DxeRngLib/DxeRngLib.c | 206
MdePkg/Library/DxeRngLib/DxeRngLib.inf | 37
MdePkg/MdePkg.dsc | 4 +-
3 files changed, 246 insertions(+), 1 deletion(-)
diff --git a/MdePkg/Library/DxeRngLib/DxeRngLib.c
b/MdePkg/Library/DxeRngLib/DxeRngLib.c
new file mode 100644
index ..0bd6585357b5
--- /dev/null
+++ b/MdePkg/Library/DxeRngLib/DxeRngLib.c
@@ -0,0 +1,206 @@
+/** @file
+ Provides an implementation of the library class RngLib that uses the Rng
protocol.
+
+ Copyright (c) Microsoft Corporation. All rights reserved.
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+#include
+#include
+#include
+#include
+#include
+
+/**
+Routine Description:
+
+Generates a random number via the NIST
+800-9A algorithm. Refer to
+http://csrc.nist.gov/groups/STM/cavp/documents/drbg/DRBGVS.pdf
+for more information.
+
+Arguments:
+
+Buffer -- Buffer to receive the random number.
+BufferSize -- Number of bytes in Buffer.
+
+Return Value:
+
+EFI_SUCCESS or underlying failure code.
+
+**/
+STATIC
+EFI_STATUS
+GenerateRandomNumberViaNist800Algorithm (
+ OUT UINT8 *Buffer,
+ IN UINTN BufferSize
+ )
+{
+ EFI_STATUSStatus;
+ EFI_RNG_PROTOCOL *RngProtocol;
+
+ RngProtocol = NULL;
+
+ if (Buffer == NULL) {
+ DEBUG((DEBUG_ERROR, "[%a] Buffer == NULL.\n", __FUNCTION__));
+ return EFI_INVALID_PARAMETER;
+ }
+
+ Status = gBS->LocateProtocol (, NULL, (VOID
**));
+ if (EFI_ERROR (Status) || RngProtocol == NULL) {
+ DEBUG((DEBUG_ERROR, "%a: Could not locate RNG prototocol, Status =
%r\n", __FUNCTION__, Status));
+ return Status;
+ }
+
+ Status = RngProtocol->GetRNG (RngProtocol,
, BufferSize, Buffer);
+ DEBUG((DEBUG_INFO, "%a: GetRNG algorithm CTR-256 - Status = %r\n",
__FUNCTION__, Status));
+ if(!EFI_ERROR(Status)) {
+return Status;
+ }
+
+ Status = RngProtocol->GetRNG (RngProtocol,
, BufferSize, Buffer);
+ DEBUG((DEBUG_INFO, "%a: GetRNG algorithm HMAC-256 - Status = %r\n",
__FUNCTION__, Status));
+ if(!EFI_ERROR(Status)) {
+return Status;
+ }
+
+ Status = RngProtocol->GetRNG (RngProtocol,
, BufferSize, Buffer);
+ DEBUG((DEBUG_INFO, "%a: GetRNG algorithm Hash-256 - Status = %r\n",
__FUNCTION__, Status));
+ if (!EFI_ERROR(Status)) {
+return Status;
+ }
+ // If all the other methods have failed, use the default method from the
RngProtocol
+ Status = RngProtocol->GetRNG (RngProtocol, NULL, BufferSize, Buffer);
+ DEBUG((DEBUG_INFO, "%a: GetRNG algorithm Hash-256 - Status = %r\n",
__FUNCTION__, Status));
+ if (!EFI_ERROR(Status)) {
+return Status;
+ }
+ // If we get to this point, we have failed
+ DEBUG((DEBUG_ERROR, "%a: GetRNG() failed, staus = %r\n", __FUNCTION__,
Status));
+
+ return Status;
+}// GenerateRandomNumberViaNist800Algorithm()
+
+
+/**
+ Generates a 16-bit random number.
+
+ if Rand is NULL, return FALSE.
+
+ @param[out] Rand Buffer pointer to store the 16-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber16 (
+ OUT UINT16*Rand
+ )
+{
+ EFI_STATUS Status;
+
+ if (Rand == NULL)
+ {
+return FALSE;
+ }
+
+ Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 2);
+ if (EFI_ERROR (Status))
+ {
+return FALSE;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 32-bit random number.
+
+ if Rand is NULL, return FALSE.
+
+ @param[out] Rand Buffer pointer to store the 32-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber32 (
+ OUT UINT32*Rand
+ )
+{
+ EFI_STATUS Status;
+
+ if (Rand == NULL) {
+return FALSE;
+ }
+
+ Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 4);
+ if (EFI_ERROR (Status)) {
+return FALSE;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 64-bit random number.
+
+ if Rand is NULL, return FALSE.
+
+ @param[out] Rand Buffer pointer to store the 64-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber64 (
+ OUT UINT64*Rand
+ )
+{
+ EFI_STATUS Status;
+
+ if (Rand == NULL)
+ {
+return FALSE;
+ }
+
+ Status =
[edk2-devel] [PATCH v7 0/5] Use RngLib instead of TimerLib for OpensslLib
From: Matthew Carlson Hello all, This patch contains a fix for Bugzilla 1871. There's been a good bit of community discussion around the topic, so below follows a general overview of the discussion and what this patch does. This is the seventh iteration of this patch series, focused on code style and a few functions being renamed to comply with style. Back in Devel message#40590 (https://edk2.groups.io/g/devel/message/40590) around the patch series that updates OpenSSL to 1.1.1b, a comment was made that suggested that platforms be in charge of the entropy/randomness that is provided to OpenSSL as currently the entropry source seems to be a hand-rolled random number generator that uses the PerformanceCounter from TimerLib. This causes OpenSSL to depend on TimerLib, which is often platform specific. In addition to being a potentially weaker source of randomness, this also poses a challenge to compile BaseCryptLibOnProtocol with a platform- agnostic version of TimerLib that works universally. The solution here is to allow platform to specify their source of entropy in addition to providing two new RngLibs: one that uses the TimerLib as well as one that uses RngProtocol to provide randomness. Then the decision to use RDRAND or other entropy sources is up to the platform. Mixing various entropy sources is the onus of the platform. It has been suggested on Devel#40590 and BZ#1871 that there should be mixing of the PerformanceCounter and RDRAND using something similar to the yarrow alogirthm that FreeBSD uses for example. This patch series doesn't offer an RngLib that offers that sort of mixing as the ultimate source of random is defined by the platform. This patch series offers three benefits: 1. Dependency reduction: Removes the need for a platform specific timer library. We publish a single binary used on numerous platforms for crypto and the introduced timer lib dependency caused issues because we could not fulfill our platform needs with one library instance. 2. Code maintenance: Removing this additional code and leveraging an existing library within Edk2 means less code to maintain. 3. Platform defined quality: A platform can choose which instance to use and the implications of that instance. This patch series seeks to address five seperate issues. 1) Use RngLib interface to generate random entropy in rand_pool 2) Remove dependency on TimerLib in OpensslLib 3) Add a new version of RngLib implemented by TimerLib 4) Add a new version of RngLib implemented by EFI_RNG_PROTOCOL 5) Add RngLib to platforms in EDK2 such as ArmVirtPkg and OvmfPkg Since this changes the dependencies of OpenSSL, this has the potential of being a breaking change for platforms in edk2-platforms. The easiest solution is just to use the RngLib that uses the TimerLib as this closely mimics the behavior of OpenSSL prior to this patch series. There is also a null version of RngLib for CI environments that need this change (https://edk2.groups.io/g/devel/message/50432). Though it should be pointed out that in CI environments, the null version of BaseCryptLib or OpenSSL should be used. In addition, it has been suggested that 1) Add AsmRdSeed to BaseLib. 2) Update BaseRngLib to use AsmRdSeed() for the random number, if RdSeed is supported (CPUID BIT18) However, this is largely out of scope for this particular patch series and will likely need to be in a follow-up series later. It is my understanding that the OpenSSL code uses the values provided as a randomness pool rather than a seed or random numbers itself, so the requirements for randomness are not quite as stringent as other applications. For the ArmVirtPkg and OvmfPkg platforms, the patch series here just adds in the TimerLib based RngLib as that is similar to the functionality of before. It is added as a common library so any custom RngLib defined in the DSC should take precedence over the TimerLibRngLib. Ref: https://github.com/tianocore/edk2/pull/845 Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871 Cc: Ard Biesheuvel Cc: Anthony Perard Cc: Jiewen Yao Cc: Jian J Wang Cc: Julien Grall Cc: Jordan Justen Cc: Laszlo Ersek Cc: Liming Gao Cc: Leif Lindholm Cc: Michael D Kinney Cc: Xiaoyu Lu Cc: Zhiguang Liu Cc: Sean Brogan Signed-off-by: Matthew Carlson Matthew Carlson (5): MdePkg: TimerRngLib: Added RngLib that uses TimerLib MdePkg: BaseRngLibDxe: Add RngLib that uses RngDxe OvmfPkg: Add RngLib based on TimerLib for Crypto ArmVirtPkg: Add RngLib based on TimerLib for CryptoPkg CryptoPkg: OpensslLib: Use RngLib to generate entropy in rand_pool CryptoPkg/Library/OpensslLib/rand_pool.c | 265 +--- CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 --- CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43 MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c | 188 ++ MdePkg/Library/DxeRngLib/DxeRngLib.c | 206
[edk2-devel] [PATCH v7 4/5] ArmVirtPkg: Add RngLib based on TimerLib for CryptoPkg
From: Matthew Carlson Updates the DSC for the ArmVirtPkg platform to add a RngLib that uses the TimerLib. This is due to a later change that adds TimerLib as a dependency for OpenSSL. The TimerLib based RngLib mimics the behavior of OpenSSL previously and it is recommended to switch to a better source of entropy than the system's performance counter. Ref: https://github.com/tianocore/edk2/pull/845 Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871 Cc: Laszlo Ersek Cc: Ard Biesheuvel Cc: Leif Lindholm Reviewed-by: Laszlo Ersek Signed-off-by: Matthew Carlson --- ArmVirtPkg/ArmVirt.dsc.inc | 1 + 1 file changed, 1 insertion(+) diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc index cf44fc73890b..cb3845d2bd37 100644 --- a/ArmVirtPkg/ArmVirt.dsc.inc +++ b/ArmVirtPkg/ArmVirt.dsc.inc @@ -160,6 +160,7 @@ OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf # # Secure Boot dependencies -- 2.27.0.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#64252): https://edk2.groups.io/g/devel/message/64252 Mute This Topic: https://groups.io/mt/76174752/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] [PATCH v7 3/5] OvmfPkg: Add RngLib based on TimerLib for Crypto
From: Matthew Carlson Updates the DSC's for Ovmf based platforms to add a RngLib that uses the TimerLib. This is due to a later change that adds TimerLib as a dependency for OpenSSL. The TimerLib based RngLib mimics the behavior of OpenSSL previously and it is recommended to switch to a better source of entropy than the system's performance counter. Ref: https://github.com/tianocore/edk2/pull/845 Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871 Cc: Jordan Justen Cc: Laszlo Ersek Cc: Ard Biesheuvel Cc: Anthony Perard Cc: Julien Grall Reviewed-by: Laszlo Ersek Signed-off-by: Matthew Carlson --- OvmfPkg/Bhyve/BhyvePkgX64.dsc | 1 + OvmfPkg/OvmfPkgIa32.dsc | 1 + OvmfPkg/OvmfPkgIa32X64.dsc| 1 + OvmfPkg/OvmfPkgX64.dsc| 1 + OvmfPkg/OvmfXen.dsc | 1 + 5 files changed, 5 insertions(+) diff --git a/OvmfPkg/Bhyve/BhyvePkgX64.dsc b/OvmfPkg/Bhyve/BhyvePkgX64.dsc index 8eba48d109a3..4b1fbb361b28 100644 --- a/OvmfPkg/Bhyve/BhyvePkgX64.dsc +++ b/OvmfPkg/Bhyve/BhyvePkgX64.dsc @@ -185,6 +185,7 @@ !else OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf !if $(SECURE_BOOT_ENABLE) == TRUE PlatformSecureLib|OvmfPkg/Bhyve/Library/PlatformSecureLib/PlatformSecureLib.inf diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc index 9178ffeb71cb..fc1c8014eba1 100644 --- a/OvmfPkg/OvmfPkgIa32.dsc +++ b/OvmfPkg/OvmfPkgIa32.dsc @@ -189,6 +189,7 @@ !else OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf !if $(SECURE_BOOT_ENABLE) == TRUE PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc index a665f78f0dc7..2365dc2fa98d 100644 --- a/OvmfPkg/OvmfPkgIa32X64.dsc +++ b/OvmfPkg/OvmfPkgIa32X64.dsc @@ -193,6 +193,7 @@ !else OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf !if $(SECURE_BOOT_ENABLE) == TRUE PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc index 17f345acf4ee..6992cfd98b70 100644 --- a/OvmfPkg/OvmfPkgX64.dsc +++ b/OvmfPkg/OvmfPkgX64.dsc @@ -193,6 +193,7 @@ !else OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf !if $(SECURE_BOOT_ENABLE) == TRUE PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf diff --git a/OvmfPkg/OvmfXen.dsc b/OvmfPkg/OvmfXen.dsc index 782803cb2787..416f81f06a04 100644 --- a/OvmfPkg/OvmfXen.dsc +++ b/OvmfPkg/OvmfXen.dsc @@ -179,6 +179,7 @@ !else OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf VarCheckLib|MdeModulePkg/Library/VarCheckLib/VarCheckLib.inf -- 2.27.0.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#64251): https://edk2.groups.io/g/devel/message/64251 Mute This Topic: https://groups.io/mt/76174750/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] [PATCH v7 5/5] CryptoPkg: OpensslLib: Use RngLib to generate entropy in rand_pool
From: Matthew Carlson
Ref: https://github.com/tianocore/edk2/pull/845
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871
Changes OpenSSL to no longer depend on TimerLib and instead use RngLib.
This allows platforms to decide for themsevles what sort of entropy source
they provide to OpenSSL and TlsLib.
Cc: Ard Biesheuvel
Cc: Jiewen Yao
Cc: Jian J Wang
Cc: Xiaoyu Lu
Acked-by: Ard Biesheuvel
Signed-off-by: Matthew Carlson
---
CryptoPkg/Library/OpensslLib/rand_pool.c | 265 +---
CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 ---
CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43
CryptoPkg/CryptoPkg.dsc| 1 +
CryptoPkg/Library/OpensslLib/OpensslLib.inf| 15 +-
CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 15 +-
CryptoPkg/Library/OpensslLib/rand_pool_noise.h | 29 ---
7 files changed, 63 insertions(+), 334 deletions(-)
diff --git a/CryptoPkg/Library/OpensslLib/rand_pool.c
b/CryptoPkg/Library/OpensslLib/rand_pool.c
index 9e0179b03490..806549af81c1 100644
--- a/CryptoPkg/Library/OpensslLib/rand_pool.c
+++ b/CryptoPkg/Library/OpensslLib/rand_pool.c
@@ -2,8 +2,8 @@
OpenSSL_1_1_1b doesn't implement rand_pool_* functions for UEFI.
The file implement these functions.
-Copyright (c) 2019, Intel Corporation. All rights reserved.
-SPDX-License-Identifier: BSD-2-Clause-Patent
+ Copyright (c) 2019, Intel Corporation. All rights reserved.
+ SPDX-License-Identifier: BSD-2-Clause-Patent
**/
@@ -11,53 +11,18 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include
#include
-#include
-
-#include "rand_pool_noise.h"
-
-/**
- Get some randomness from low-order bits of GetPerformanceCounter results.
- And combine them to the 64-bit value
-
- @param[out] RandBuffer pointer to store the 64-bit random value.
-
- @retval TRUERandom number generated successfully.
- @retval FALSE Failed to generate.
-**/
-STATIC
-BOOLEAN
-EFIAPI
-GetRandNoise64FromPerformanceCounter(
- OUT UINT64 *Rand
- )
-{
- UINT32 Index;
- UINT32 *RandPtr;
-
- if (NULL == Rand) {
-return FALSE;
- }
-
- RandPtr = (UINT32 *) Rand;
-
- for (Index = 0; Index < 2; Index ++) {
-*RandPtr = (UINT32) (GetPerformanceCounter () & 0xFF);
-MicroSecondDelay (10);
-RandPtr++;
- }
-
- return TRUE;
-}
+#include
/**
Calls RandomNumber64 to fill
a buffer of arbitrary size with random bytes.
+ This is a shim layer to RngLib.
@param[in] LengthSize of the buffer, in bytes, to fill with.
@param[out] RandBufferPointer to the buffer to store the random result.
- @retval EFI_SUCCESSRandom bytes generation succeeded.
- @retval EFI_NOT_READY Failed to request random bytes.
+ @retval TRUERandom bytes generation succeeded.
+ @retval FALSE Failed to request random bytes.
**/
STATIC
@@ -65,7 +30,7 @@ BOOLEAN
EFIAPI
RandGetBytes (
IN UINTN Length,
- OUT UINT8*RandBuffer
+ OUT UINT8 *RandBuffer
)
{
BOOLEAN Ret;
@@ -73,17 +38,17 @@ RandGetBytes (
Ret = FALSE;
+ if (RandBuffer == NULL) {
+DEBUG((DEBUG_ERROR, "[OPENSSL_RAND_POOL] NULL RandBuffer. No random
numbers are generated and your system is not secure\n"));
+ASSERT (RandBuffer != NULL); // Since we can't generate random numbers, we
should assert. Otherwise we will just blow up later.
+return Ret;
+ }
+
+
while (Length > 0) {
-//
-// Get random noise from platform.
-// If it failed, fallback to PerformanceCounter
-// If you really care about security, you must override
-// GetRandomNoise64FromPlatform.
-//
-Ret = GetRandomNoise64 ();
-if (Ret == FALSE) {
- Ret = GetRandNoise64FromPerformanceCounter ();
-}
+// Use RngLib to get random number
+Ret = GetRandomNumber64 ();
+
if (!Ret) {
return Ret;
}
@@ -91,7 +56,8 @@ RandGetBytes (
*((UINT64*) RandBuffer) = TempRand;
RandBuffer += sizeof (UINT64);
Length -= sizeof (TempRand);
-} else {
+}
+else {
CopyMem (RandBuffer, , Length);
Length = 0;
}
@@ -100,125 +66,6 @@ RandGetBytes (
return Ret;
}
-/**
- Creates a 128bit random value that is fully forward and backward prediction
resistant,
- suitable for seeding a NIST SP800-90 Compliant.
- This function takes multiple random numbers from PerformanceCounter to
ensure reseeding
- and performs AES-CBC-MAC over the data to compute the seed value.
-
- @param[out] SeedBufferPointer to a 128bit buffer to store the random
seed.
-
- @retval TRUERandom seed generation succeeded.
- @retval FALSE Failed to request random bytes.
-
-**/
-STATIC
-BOOLEAN
-EFIAPI
-RandGetSeed128 (
- OUT UINT8*SeedBuffer
- )
-{
- BOOLEAN Ret;
- UINT8 RandByte[16];
- UINT8 Key[16];
- UINT8 Ffv[16];
- UINT8 Xored[16];
- UINT32
[edk2-devel] [PATCH v7 1/5] MdePkg: TimerRngLib: Added RngLib that uses TimerLib
From: Matthew Carlson
Added a new RngLib that provides random numbers from the TimerLib
using the performance counter. This is meant to be used for OpenSSL
to replicate past behavior. This should not be used in production as
a real source of entropy.
Ref: https://github.com/tianocore/edk2/pull/845
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871
Cc: Ard Biesheuvel
Cc: Michael D Kinney
Cc: Liming Gao
Cc: Zhiguang Liu
Signed-off-by: Matthew Carlson
---
MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c | 188
MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf | 36
MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.uni | 15 ++
MdePkg/MdePkg.dsc| 3 +-
4 files changed, 241 insertions(+), 1 deletion(-)
diff --git a/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
b/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
new file mode 100644
index ..405bdf1dcec1
--- /dev/null
+++ b/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
@@ -0,0 +1,188 @@
+/** @file
+ BaseRng Library that uses the TimerLib to provide reasonably random numbers.
+ Do not use this on a production system.
+
+ Copyright (c) Microsoft Corporation.
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#include
+#include
+#include
+#include
+
+/**
+ * Using the TimerLib GetPerformanceCounterProperties() we delay
+ * for enough time for the PerformanceCounter to increment.
+ * Depending on your system
+ *
+ * If the return value from GetPerformanceCounterProperties (TimerLib)
+ * is zero, this function will not delay and attempt to assert.
+ */
+STATIC
+VOID
+DecentDelay (
+ VOID
+ )
+{
+ UINT64 StartValue;
+ UINT64 EndValue;
+ UINT64 CounterHz;
+ UINT64 MinumumDelayInMicroSeconds;
+
+ // Get the counter properties
+ CounterHz = GetPerformanceCounterProperties (, );
+ // Make sure we won't divide by zero
+ if (CounterHz == 0) {
+ASSERT(CounterHz != 0); // Assert so the developer knows something is wrong
+return;
+ }
+ // Calculate the minimum delay based on 1.5 microseconds divided by the
hertz.
+ // We calculate the length of a cycle (1/CounterHz) and multiply it by 1.5
microseconds
+ // This ensures that the performance counter has increased by at least one
+ MinumumDelayInMicroSeconds = 150 / CounterHz;
+
+ MicroSecondDelay (MinumumDelayInMicroSeconds);
+}
+
+
+/**
+ Generates a 16-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 16-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber16 (
+ OUT UINT16*Rand
+ )
+{
+ UINT32 Index;
+ UINT8 *RandPtr;
+
+ ASSERT (Rand != NULL);
+
+ if (Rand == NULL) {
+return FALSE;
+ }
+
+ RandPtr = (UINT8*)Rand;
+ // Get 2 bytes of random ish data
+ // This should take around 10us
+ for (Index = 0; Index < 2; Index ++) {
+*RandPtr = (UINT8)(GetPerformanceCounter () & 0xFF);
+DecentDelay (); // delay to give chance for performance counter to catch up
+RandPtr++;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 32-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 32-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber32 (
+ OUT UINT32*Rand
+ )
+{
+ UINT32 Index;
+ UINT8* RandPtr;
+
+ ASSERT (Rand != NULL);
+
+ if (NULL == Rand) {
+return FALSE;
+ }
+
+ RandPtr = (UINT8 *) Rand;
+ // Get 4 bytes of random ish data
+ // This should take around 20ms
+ for (Index = 0; Index < 4; Index ++) {
+*RandPtr = (UINT8) (GetPerformanceCounter () & 0xFF);
+DecentDelay (); // delay to give chance for performance counter to catch up
+RandPtr++;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 64-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 64-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber64 (
+ OUT UINT64*Rand
+ )
+{
+ UINT32 Index;
+ UINT8* RandPtr;
+
+ ASSERT (Rand != NULL);
+
+ if (NULL == Rand) {
+return FALSE;
+ }
+
+ RandPtr = (UINT8 *) Rand;
+ // Get 8 bytes of random ish data
+ // This should take around 40ms
+ for (Index = 0; Index < 8; Index ++) {
+*RandPtr = (UINT8) (GetPerformanceCounter () & 0xFF);
+DecentDelay (); // delay to give chance for performance counter to catch up
+RandPtr++;
+ }
+
+ return TRUE;
+}
+
+/**
+ Generates a 128-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Bu
Re: [edk2-devel] [PATCH v6 0/5] Use RngLib instead of TimerLib for OpensslLib
I'll file a new bugzilla. https://bugzilla.tianocore.org/show_bug.cgi?id=2897 -Matthew Carlson On Thu, Aug 13, 2020 at 8:15 AM Yao, Jiewen wrote: > Thanks Matthew. > > I am OK, if you want to address the RDSEED in follow-up patch series. > > Would you please file a new Bugzilla to record this, so we won't lose the > information ? > > > > > -Original Message- > > From: matthewfcarl...@gmail.com > > Sent: Thursday, August 13, 2020 6:44 AM > > To: devel@edk2.groups.io > > Cc: Ard Biesheuvel ; Anthony Perard > > ; Yao, Jiewen ; Wang, > > Jian J ; Julien Grall ; Justen, > Jordan L > > ; Laszlo Ersek ; Gao, > Liming > > ; Leif Lindholm ; Kinney, > Michael D > > ; Lu, XiaoyuX ; Liu, > > Zhiguang ; Sean Brogan > > ; Matthew Carlson > > > > Subject: [PATCH v6 0/5] Use RngLib instead of TimerLib for OpensslLib > > > > From: Matthew Carlson > > > > Hello all, > > > > This patch contains a fix for Bugzilla 1871. > > There's been a good bit of community discussion around the topic, > > so below follows a general overview of the discussion and what this > patch does. > > > > Back in Devel message#40590 ( > https://edk2.groups.io/g/devel/message/40590) > > around the patch series that updates OpenSSL to 1.1.1b, a comment was > made > > that suggested that platforms be in charge of the entropy/randomness that > > is provided to OpenSSL as currently the entropry source seems to be a > > hand-rolled random number generator that uses the PerformanceCounter from > > TimerLib. This causes OpenSSL to depend on TimerLib, which is often > platform > > specific. In addition to being a potentially weaker source of randomness, > > this also poses a challenge to compile BaseCryptLibOnProtocol with a > platform- > > agnostic version of TimerLib that works universally. > > > > The solution here is to allow platform to specify their source of > entropy in > > addition to providing two new RngLibs: one that uses the TimerLib as > well as > > one that uses RngProtocol to provide randomness. Then the decision to use > > RDRAND or other entropy sources is up to the platform. Mixing various > entropy > > sources is the onus of the platform. It has been suggested on > Devel#40590 and > > BZ#1871 that there should be mixing of the PerformanceCounter and RDRAND > > using > > something similar to the yarrow alogirthm that FreeBSD uses for example. > This > > patch series doesn't offer an RngLib that offers that sort of mixing as > the > > ultimate source of random is defined by the platform. > > > > This patch series offers three benefits: > > 1. Dependency reduction: Removes the need for a platform specific timer > > library. We publish a single binary used on numerous platforms for > > crypto and the introduced timer lib dependency caused issues because we > > could not fulfill our platform needs with one library instance. > > > > 2. Code maintenance: Removing this additional code and leveraging an > existing > > library within Edk2 means less code to maintain. > > > > 3. Platform defined quality: A platform can choose which instance to use > and > > the implications of that instance. > > > > This patch series seeks to address five seperate issues. > > 1) Use RngLib interface to generate random entropy in rand_pool > > 2) Remove dependency on TimerLib in OpensslLib > > 3) Add a new version of RngLib implemented by TimerLib > > 4) Add a new version of RngLib implemented by EFI_RNG_PROTOCOL > > 5) Add RngLib to platforms in EDK2 such as ArmVirtPkg and OvmfPkg > > > > Since this changes the dependencies of OpenSSL, this has the potential > of being > > a breaking change for platforms in edk2-platforms. The easiest solution > is just > > to use the RngLib that uses the TimerLib as this closely mimics the > behavior of > > OpenSSL prior to this patch series. There is also a null version of > RngLib for > > CI environments that need this change > > (https://edk2.groups.io/g/devel/message/50432). Though it should be > pointed > > out > > that in CI environments, the null version of BaseCryptLib or OpenSSL > should be > > used. > > > > In addition, it has been suggested that > > 1) Add AsmRdSeed to BaseLib. > > 2) Update BaseRngLib to use AsmRdSeed() for the random number, > > if RdSeed is supported (CPUID BIT18) > > > > However, this is largely out of scope for this particular patch series > and > > will likely need to be in a follow-up series later. >
Re: [edk2-devel] [PATCH v6 2/5] MdePkg: BaseRngLibDxe: Add RngLib that uses RngDxe
Thanks for the feedback.
I've addressed all the comments except the one about the success handling
pattern. I think the algorithms it requests are made in a specific order so
that it can make some promising regarding the validity of its random number
generation. That said, this is code that another coworker at Microsoft
wrote, so I'm not 100% sure why it does that this particular way.
Do you have a suggestion about what sort of algorithm should be selected?
Perhaps just using the default every time? Keep the pattern as it stands
now but add a final check to use the default if the previous ones fail?
I kept in the check for NULL since any inputs should be
sanitized regardless of where they're coming from. I'm open to adding an
assert there as well to help debugability.
-Matthew Carlson
On Thu, Aug 13, 2020 at 5:19 AM Ard Biesheuvel
wrote:
> On 8/13/20 12:43 AM, matthewfcarl...@gmail.com wrote:
> > From: Matthew Carlson
> >
> > This adds a RngLib that uses the RngProtocol to provide randomness.
> > This means that the RngLib is meant to be used with DXE_DRIVERS.
> >
> > Ref: https://github.com/tianocore/edk2/pull/845
> > Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871
> >
> > Cc: Ard Biesheuvel
> > Cc: Michael D Kinney
> > Cc: Liming Gao
> > Cc: Zhiguang Liu
> > Signed-off-by: Matthew Carlson
> > ---
> > MdePkg/Library/BaseRngLibDxe/RngDxeLib.c | 200
>
> > MdePkg/Library/BaseRngLibDxe/BaseRngLibDxe.inf | 38
> > MdePkg/MdePkg.dsc | 4 +-
> > 3 files changed, 241 insertions(+), 1 deletion(-)
> >
> > diff --git a/MdePkg/Library/BaseRngLibDxe/RngDxeLib.c
> b/MdePkg/Library/BaseRngLibDxe/RngDxeLib.c
> > new file mode 100644
> > index ..8ee29329de13
> > --- /dev/null
> > +++ b/MdePkg/Library/BaseRngLibDxe/RngDxeLib.c
> > @@ -0,0 +1,200 @@
> > +/** @file
> > + Provides an implementation of the library class RngLib that uses the
> Rng protocol.
> > +
> > +Copyright (c) Microsoft Corporation. All rights reserved.
> > +SPDX-License-Identifier: BSD-2-Clause-Patent
>
> Please use matching indentation
>
> > +
> > +**/
> > +#include
> > +#include
> > +#include
> > +#include
> > +#include
> > +
> > +/**
> > +Routine Description:
> > +
> > +Generates a random number via the NIST
> > +800-9A algorithm. Refer to
> > +http://csrc.nist.gov/groups/STM/cavp/documents/drbg/DRBGVS.pdf
> > +for more information.
> > +
> > +Arguments:
> > +
> > +Buffer -- Buffer to receive the random number.
> > +BufferSize -- Number of bytes in Buffer.
> > +
> > +Return Value:
> > +
> > +EFI_SUCCESS or underlying failure code.
> > +
> > +**/
>
> STATIC ?
>
> > +EFI_STATUS
> > +EFIAPI
> > +GenerateRandomNumberViaNist800Algorithm(
>
> space before (
>
> > + OUT UINT8* Buffer,
>
> put * on the rhs
>
> > + IN UINTN BufferSize
> > + )
> > +{
> > + EFI_STATUSStatus;
> > + EFI_RNG_PROTOCOL* RngProtocol;
>
> likewise
>
> > +
> > + RngProtocol = NULL;
> > +
> > + if (Buffer == NULL) {
> > + DEBUG((DEBUG_ERROR, "[%a] Buffer == NULL.\n", __FUNCTION__));
>
> Could you drop the [] around the function name? This is rather
> unidiomatic for EDK2
>
> > + return EFI_INVALID_PARAMETER;
> > + }
> > +
> > + Status = gBS->LocateProtocol(, NULL, (VOID
> **));
>
> Space before (
>
> > + if (EFI_ERROR(Status) || RngProtocol == NULL) {
>
> Space before (. Also, I think the second condition could be an ASSERT()
>
> > + DEBUG((DEBUG_ERROR, "[%a] Could not locate RNG prototocol, Status
> = %r\n", __FUNCTION__, Status));
> > + return Status;
> > + }
> > +
> > + Status = RngProtocol->GetRNG(RngProtocol,
> , BufferSize, Buffer);
> > + DEBUG((DEBUG_INFO, "[%a] GetRNG algorithm CTR-256 - Status = %r\n",
> __FUNCTION__, Status)); > + if(!EFI_ERROR(Status)) {
>
> Space after 'if' and before (.
>
> Please do a pass over all the patches, I will stop pointing out the
> spacing around ( from this point.
>
>
> > +return Status;
> > + }
> > +
> > + Status = RngProtocol->GetRNG(RngProtocol,
> , BufferSize, Buffer);
> > + DEBUG((DEBUG_INFO, "[%a] GetRNG algorithm HMAC-256 - Status = %r\n",
> __FUNCTION__, Status));
> > + if(!EFI_ERROR(Status)) {
> > +return Status;
> > + }
> >
Re: [edk2-devel] [PATCH v6 1/5] MdePkg: TimerRngLib: Added RngLib that uses TimerLib
Good things to point out. Should be fixed.
The original code in CryptoPkg simply just delayed 10 microseconds and
hoped the performance counter had incremented in that time frame.
https://github.com/tianocore/edk2/blob/313d2ec991039abe24727eced80d8ece1befbc93/CryptoPkg/Library/OpensslLib/rand_pool.c#L45
This new code ensures that we are delaying for at least 1.5 performance
counter ticks, so we're guaranteed to get a different performance counter
value with some hope for randomness. As Mike K pointed out if a system has
a slow performance counter you just get the same number repeated a few
times.
Copyright (c) Microsoft Corporation is the preferred way for the Microsoft
copyright
-Matthew Carlson
On Thu, Aug 13, 2020 at 5:09 AM Ard Biesheuvel
wrote:
> On 8/13/20 12:43 AM, matthewfcarl...@gmail.com wrote:
> > From: Matthew Carlson
> >
> > Added a new RngLib that provides random numbers from the TimerLib
> > using the performance counter. This is meant to be used for OpenSSL
> > to replicate past behavior. This should not be used in production as
> > a real source of entropy.
> >
> > Ref: https://github.com/tianocore/edk2/pull/845
> > Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871
> >
> > Cc: Ard Biesheuvel
> > Cc: Michael D Kinney
> > Cc: Liming Gao
> > Cc: Zhiguang Liu
> > Signed-off-by: Matthew Carlson
> > ---
> > MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c | 187
>
> > MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf | 40 +
> > MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.uni | 17 ++
> > MdePkg/MdePkg.dsc| 3 +-
> > 4 files changed, 246 insertions(+), 1 deletion(-)
> >
> > diff --git a/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
> b/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
> > new file mode 100644
> > index ..915382fb9278
> > --- /dev/null
> > +++ b/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
> > @@ -0,0 +1,187 @@
> > +/** @file
> > + BaseRng Library that uses the TimerLib to provide reasonably random
> numbers.
> > + Do not use this on a production system.
> > +
> > + Copyright (c) Microsoft Corporation.
> > + SPDX-License-Identifier: BSD-2-Clause-Patent
> > +**/
> > +
> > +#include
> > +#include
> > +#include
> > +#include
> > +
> > +/**
> > + * Using the TimerLib GetPerformanceCounterProperties() we delay
> > + * for enough time for the PerformanceCounter to increment.
> > + * Depending on your system
> > + *
> > + * If the return value from GetPerformanceCounterProperties (TimerLib)
> > + * is zero, this function will not delay and attempt to assert.
> > + */
>
> Make this STATIC please
>
> > +VOID
> > +EFIAPI
> > +DecentDelay(
>
> space before (
>
> > + VOID
> > + )
> > +{
> > + UINT64 StartValue;
> > + UINT64 EndValue;
> > + UINT64 CounterHz;
> > + UINT64 MinumumDelayInMicroSeconds;
>
> newline here
>
> > + // Get the counter properties
> > + CounterHz = GetPerformanceCounterProperties(, );
>
> space before (
>
> > + // Make sure we won't divide by zero
> > + if (CounterHz == 0) {
> > +ASSERT(FALSE); // Assert so the developer knows something is wrong
>
> This will print
>
> ASSERT (FALSE)
>
> into the DEBUG log, whereas
>
> ASSERT (CounterHz != 0)
>
> will appear if you assert on the actual value, which is much more useful.
>
> > +return;
> > + }
> > + // Calculate the minimum delay based on 1.5 microseconds divided by
> the hertz.
> > + // We calculate the length of a cycle (1/CounterHz) and multiply it
> by 1.5 microseconds
> > + // This ensures that the performance counter has increased by at
> least one
> > + MinumumDelayInMicroSeconds = 150 / CounterHz;
> > +
> > + MicroSecondDelay(MinumumDelayInMicroSeconds);
>
> Space before (
>
> > +}
> > +
> > +
> > +/**
> > + Generates a 16-bit random number.
> > +
> > + if Rand is NULL, then ASSERT().
> > +
> > + @param[out] Rand Buffer pointer to store the 16-bit random value.
> > +
> > + @retval TRUE Random number generated successfully.
> > + @retval FALSEFailed to generate the random number.
> > +
> > +**/
> > +BOOLEAN
> > +EFIAPI
> > +GetRandomNumber16 (
> > + OUT UINT16*Rand
> > + )
> > +{
> > + UINT32 Index;
> > + UINT8* RandPtr;
>
> Please ali
[edk2-devel] [PATCH v6 3/5] OvmfPkg: Add RngLib based on TimerLib for Crypto
From: Matthew Carlson Updates the DSC's for Ovmf based platforms to add a RngLib that uses the TimerLib. This is due to a later change that adds TimerLib as a dependency for OpenSSL. The TimerLib based RngLib mimics the behavior of OpenSSL previously and it is recommended to switch to a better source of entropy than the system's performance counter. Ref: https://github.com/tianocore/edk2/pull/845 Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871 Cc: Jordan Justen Cc: Laszlo Ersek Cc: Ard Biesheuvel Cc: Anthony Perard Cc: Julien Grall Signed-off-by: Matthew Carlson Reviewed-by: Laszlo Ersek --- OvmfPkg/Bhyve/BhyvePkgX64.dsc | 1 + OvmfPkg/OvmfPkgIa32.dsc | 1 + OvmfPkg/OvmfPkgIa32X64.dsc| 1 + OvmfPkg/OvmfPkgX64.dsc| 1 + OvmfPkg/OvmfXen.dsc | 1 + 5 files changed, 5 insertions(+) diff --git a/OvmfPkg/Bhyve/BhyvePkgX64.dsc b/OvmfPkg/Bhyve/BhyvePkgX64.dsc index 8eba48d109a3..4b1fbb361b28 100644 --- a/OvmfPkg/Bhyve/BhyvePkgX64.dsc +++ b/OvmfPkg/Bhyve/BhyvePkgX64.dsc @@ -185,6 +185,7 @@ !else OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf !if $(SECURE_BOOT_ENABLE) == TRUE PlatformSecureLib|OvmfPkg/Bhyve/Library/PlatformSecureLib/PlatformSecureLib.inf diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc index 9178ffeb71cb..fc1c8014eba1 100644 --- a/OvmfPkg/OvmfPkgIa32.dsc +++ b/OvmfPkg/OvmfPkgIa32.dsc @@ -189,6 +189,7 @@ !else OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf !if $(SECURE_BOOT_ENABLE) == TRUE PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc index a665f78f0dc7..2365dc2fa98d 100644 --- a/OvmfPkg/OvmfPkgIa32X64.dsc +++ b/OvmfPkg/OvmfPkgIa32X64.dsc @@ -193,6 +193,7 @@ !else OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf !if $(SECURE_BOOT_ENABLE) == TRUE PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc index 17f345acf4ee..6992cfd98b70 100644 --- a/OvmfPkg/OvmfPkgX64.dsc +++ b/OvmfPkg/OvmfPkgX64.dsc @@ -193,6 +193,7 @@ !else OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf !if $(SECURE_BOOT_ENABLE) == TRUE PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf diff --git a/OvmfPkg/OvmfXen.dsc b/OvmfPkg/OvmfXen.dsc index 782803cb2787..416f81f06a04 100644 --- a/OvmfPkg/OvmfXen.dsc +++ b/OvmfPkg/OvmfXen.dsc @@ -179,6 +179,7 @@ !else OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf VarCheckLib|MdeModulePkg/Library/VarCheckLib/VarCheckLib.inf -- 2.27.0.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#64128): https://edk2.groups.io/g/devel/message/64128 Mute This Topic: https://groups.io/mt/76157321/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] [PATCH v6 2/5] MdePkg: BaseRngLibDxe: Add RngLib that uses RngDxe
From: Matthew Carlson
This adds a RngLib that uses the RngProtocol to provide randomness.
This means that the RngLib is meant to be used with DXE_DRIVERS.
Ref: https://github.com/tianocore/edk2/pull/845
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871
Cc: Ard Biesheuvel
Cc: Michael D Kinney
Cc: Liming Gao
Cc: Zhiguang Liu
Signed-off-by: Matthew Carlson
---
MdePkg/Library/BaseRngLibDxe/RngDxeLib.c | 200
MdePkg/Library/BaseRngLibDxe/BaseRngLibDxe.inf | 38
MdePkg/MdePkg.dsc | 4 +-
3 files changed, 241 insertions(+), 1 deletion(-)
diff --git a/MdePkg/Library/BaseRngLibDxe/RngDxeLib.c
b/MdePkg/Library/BaseRngLibDxe/RngDxeLib.c
new file mode 100644
index ..8ee29329de13
--- /dev/null
+++ b/MdePkg/Library/BaseRngLibDxe/RngDxeLib.c
@@ -0,0 +1,200 @@
+/** @file
+ Provides an implementation of the library class RngLib that uses the Rng
protocol.
+
+Copyright (c) Microsoft Corporation. All rights reserved.
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+#include
+#include
+#include
+#include
+#include
+
+/**
+Routine Description:
+
+Generates a random number via the NIST
+800-9A algorithm. Refer to
+http://csrc.nist.gov/groups/STM/cavp/documents/drbg/DRBGVS.pdf
+for more information.
+
+Arguments:
+
+Buffer -- Buffer to receive the random number.
+BufferSize -- Number of bytes in Buffer.
+
+Return Value:
+
+EFI_SUCCESS or underlying failure code.
+
+**/
+EFI_STATUS
+EFIAPI
+GenerateRandomNumberViaNist800Algorithm(
+ OUT UINT8* Buffer,
+ IN UINTN BufferSize
+ )
+{
+ EFI_STATUSStatus;
+ EFI_RNG_PROTOCOL* RngProtocol;
+
+ RngProtocol = NULL;
+
+ if (Buffer == NULL) {
+ DEBUG((DEBUG_ERROR, "[%a] Buffer == NULL.\n", __FUNCTION__));
+ return EFI_INVALID_PARAMETER;
+ }
+
+ Status = gBS->LocateProtocol(, NULL, (VOID
**));
+ if (EFI_ERROR(Status) || RngProtocol == NULL) {
+ DEBUG((DEBUG_ERROR, "[%a] Could not locate RNG prototocol, Status =
%r\n", __FUNCTION__, Status));
+ return Status;
+ }
+
+ Status = RngProtocol->GetRNG(RngProtocol,
, BufferSize, Buffer);
+ DEBUG((DEBUG_INFO, "[%a] GetRNG algorithm CTR-256 - Status = %r\n",
__FUNCTION__, Status));
+ if(!EFI_ERROR(Status)) {
+return Status;
+ }
+
+ Status = RngProtocol->GetRNG(RngProtocol,
, BufferSize, Buffer);
+ DEBUG((DEBUG_INFO, "[%a] GetRNG algorithm HMAC-256 - Status = %r\n",
__FUNCTION__, Status));
+ if(!EFI_ERROR(Status)) {
+return Status;
+ }
+
+ Status = RngProtocol->GetRNG(RngProtocol,
, BufferSize, Buffer);
+ DEBUG((DEBUG_INFO, "[%a] GetRNG algorithm Hash-256 - Status = %r\n",
__FUNCTION__, Status));
+ if(!EFI_ERROR(Status)) {
+return Status;
+ }
+ // If we get to this point, we have failed
+ DEBUG((DEBUG_ERROR, "[%a] GetRNG() failed, staus = %r\n", __FUNCTION__,
Status));
+
+ return Status;
+}// GenerateRandomNumberViaNist800Algorithm()
+
+
+/**
+ Generates a 16-bit random number.
+
+ if Rand is NULL, return FALSE.
+
+ @param[out] Rand Buffer pointer to store the 16-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber16 (
+ OUT UINT16*Rand
+ )
+{
+ EFI_STATUS Status;
+
+ if (Rand == NULL)
+ {
+return FALSE;
+ }
+
+ Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 2);
+ if (EFI_ERROR(Status))
+ {
+return FALSE;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 32-bit random number.
+
+ if Rand is NULL, return FALSE.
+
+ @param[out] Rand Buffer pointer to store the 32-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber32 (
+ OUT UINT32*Rand
+ )
+{
+ EFI_STATUS Status;
+
+ if (Rand == NULL) {
+return FALSE;
+ }
+
+ Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 4);
+ if (EFI_ERROR(Status)) {
+return FALSE;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 64-bit random number.
+
+ if Rand is NULL, return FALSE.
+
+ @param[out] Rand Buffer pointer to store the 64-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber64 (
+ OUT UINT64*Rand
+ )
+{
+ EFI_STATUS Status;
+
+ if (Rand == NULL)
+ {
+return FALSE;
+ }
+
+ Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 8);
+ if (EFI_ERROR(Status)) {
+return FALSE;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 128-bit random number.
+
+ if Rand is NULL, return FALSE.
+
+ @param[out] Rand Buffer pointer to store the 128-bit random value.
+
+ @re
[edk2-devel] [PATCH v6 1/5] MdePkg: TimerRngLib: Added RngLib that uses TimerLib
From: Matthew Carlson
Added a new RngLib that provides random numbers from the TimerLib
using the performance counter. This is meant to be used for OpenSSL
to replicate past behavior. This should not be used in production as
a real source of entropy.
Ref: https://github.com/tianocore/edk2/pull/845
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871
Cc: Ard Biesheuvel
Cc: Michael D Kinney
Cc: Liming Gao
Cc: Zhiguang Liu
Signed-off-by: Matthew Carlson
---
MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c | 187
MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf | 40 +
MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.uni | 17 ++
MdePkg/MdePkg.dsc| 3 +-
4 files changed, 246 insertions(+), 1 deletion(-)
diff --git a/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
b/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
new file mode 100644
index ..915382fb9278
--- /dev/null
+++ b/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
@@ -0,0 +1,187 @@
+/** @file
+ BaseRng Library that uses the TimerLib to provide reasonably random numbers.
+ Do not use this on a production system.
+
+ Copyright (c) Microsoft Corporation.
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#include
+#include
+#include
+#include
+
+/**
+ * Using the TimerLib GetPerformanceCounterProperties() we delay
+ * for enough time for the PerformanceCounter to increment.
+ * Depending on your system
+ *
+ * If the return value from GetPerformanceCounterProperties (TimerLib)
+ * is zero, this function will not delay and attempt to assert.
+ */
+VOID
+EFIAPI
+DecentDelay(
+ VOID
+ )
+{
+ UINT64 StartValue;
+ UINT64 EndValue;
+ UINT64 CounterHz;
+ UINT64 MinumumDelayInMicroSeconds;
+ // Get the counter properties
+ CounterHz = GetPerformanceCounterProperties(, );
+ // Make sure we won't divide by zero
+ if (CounterHz == 0) {
+ASSERT(FALSE); // Assert so the developer knows something is wrong
+return;
+ }
+ // Calculate the minimum delay based on 1.5 microseconds divided by the
hertz.
+ // We calculate the length of a cycle (1/CounterHz) and multiply it by 1.5
microseconds
+ // This ensures that the performance counter has increased by at least one
+ MinumumDelayInMicroSeconds = 150 / CounterHz;
+
+ MicroSecondDelay(MinumumDelayInMicroSeconds);
+}
+
+
+/**
+ Generates a 16-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 16-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber16 (
+ OUT UINT16*Rand
+ )
+{
+ UINT32 Index;
+ UINT8* RandPtr;
+
+ ASSERT (Rand != NULL);
+
+ if (NULL == Rand) {
+return FALSE;
+ }
+
+ RandPtr = (UINT8 *) Rand;
+ // Get 2 bytes of random ish data
+ // This should take around 10us
+ for (Index = 0; Index < 2; Index ++) {
+*RandPtr = (UINT8) (GetPerformanceCounter () & 0xFF);
+DecentDelay (); // delay to give chance for performance counter to catch up
+RandPtr++;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 32-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 32-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber32 (
+ OUT UINT32*Rand
+ )
+{
+ UINT32 Index;
+ UINT8* RandPtr;
+
+ ASSERT (Rand != NULL);
+
+ if (NULL == Rand) {
+return FALSE;
+ }
+
+ RandPtr = (UINT8 *) Rand;
+ // Get 4 bytes of random ish data
+ // This should take around 20ms
+ for (Index = 0; Index < 4; Index ++) {
+*RandPtr = (UINT8) (GetPerformanceCounter () & 0xFF);
+DecentDelay (); // delay to give chance for performance counter to catch up
+RandPtr++;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 64-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 64-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber64 (
+ OUT UINT64*Rand
+ )
+{
+ UINT32 Index;
+ UINT8* RandPtr;
+
+ ASSERT (Rand != NULL);
+
+ if (NULL == Rand) {
+return FALSE;
+ }
+
+ RandPtr = (UINT8 *) Rand;
+ // Get 8 bytes of random ish data
+ // This should take around 40ms
+ for (Index = 0; Index < 8; Index ++) {
+*RandPtr = (UINT8) (GetPerformanceCounter () & 0xFF);
+DecentDelay (); // delay to give chance for performance counter to catch up
+RandPtr++;
+ }
+
+ return TRUE;
+}
+
+/**
+ Generates a 128-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer
[edk2-devel] [PATCH v6 4/5] ArmVirtPkg: Add RngLib based on TimerLib for CryptoPkg
From: Matthew Carlson Updates the DSC for the ArmVirtPkg platform to add a RngLib that uses the TimerLib. This is due to a later change that adds TimerLib as a dependency for OpenSSL. The TimerLib based RngLib mimics the behavior of OpenSSL previously and it is recommended to switch to a better source of entropy than the system's performance counter. Ref: https://github.com/tianocore/edk2/pull/845 Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871 Cc: Laszlo Ersek Cc: Ard Biesheuvel Cc: Leif Lindholm Signed-off-by: Matthew Carlson --- ArmVirtPkg/ArmVirt.dsc.inc | 1 + 1 file changed, 1 insertion(+) diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc index cf44fc73890b..cb3845d2bd37 100644 --- a/ArmVirtPkg/ArmVirt.dsc.inc +++ b/ArmVirtPkg/ArmVirt.dsc.inc @@ -160,6 +160,7 @@ OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif BaseCryptLib|CryptoPkg/Library/BaseCryptLib/BaseCryptLib.inf + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf # # Secure Boot dependencies -- 2.27.0.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#64129): https://edk2.groups.io/g/devel/message/64129 Mute This Topic: https://groups.io/mt/76157322/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] [PATCH v6 0/5] Use RngLib instead of TimerLib for OpensslLib
From: Matthew Carlson Hello all, This patch contains a fix for Bugzilla 1871. There's been a good bit of community discussion around the topic, so below follows a general overview of the discussion and what this patch does. Back in Devel message#40590 (https://edk2.groups.io/g/devel/message/40590) around the patch series that updates OpenSSL to 1.1.1b, a comment was made that suggested that platforms be in charge of the entropy/randomness that is provided to OpenSSL as currently the entropry source seems to be a hand-rolled random number generator that uses the PerformanceCounter from TimerLib. This causes OpenSSL to depend on TimerLib, which is often platform specific. In addition to being a potentially weaker source of randomness, this also poses a challenge to compile BaseCryptLibOnProtocol with a platform- agnostic version of TimerLib that works universally. The solution here is to allow platform to specify their source of entropy in addition to providing two new RngLibs: one that uses the TimerLib as well as one that uses RngProtocol to provide randomness. Then the decision to use RDRAND or other entropy sources is up to the platform. Mixing various entropy sources is the onus of the platform. It has been suggested on Devel#40590 and BZ#1871 that there should be mixing of the PerformanceCounter and RDRAND using something similar to the yarrow alogirthm that FreeBSD uses for example. This patch series doesn't offer an RngLib that offers that sort of mixing as the ultimate source of random is defined by the platform. This patch series offers three benefits: 1. Dependency reduction: Removes the need for a platform specific timer library. We publish a single binary used on numerous platforms for crypto and the introduced timer lib dependency caused issues because we could not fulfill our platform needs with one library instance. 2. Code maintenance: Removing this additional code and leveraging an existing library within Edk2 means less code to maintain. 3. Platform defined quality: A platform can choose which instance to use and the implications of that instance. This patch series seeks to address five seperate issues. 1) Use RngLib interface to generate random entropy in rand_pool 2) Remove dependency on TimerLib in OpensslLib 3) Add a new version of RngLib implemented by TimerLib 4) Add a new version of RngLib implemented by EFI_RNG_PROTOCOL 5) Add RngLib to platforms in EDK2 such as ArmVirtPkg and OvmfPkg Since this changes the dependencies of OpenSSL, this has the potential of being a breaking change for platforms in edk2-platforms. The easiest solution is just to use the RngLib that uses the TimerLib as this closely mimics the behavior of OpenSSL prior to this patch series. There is also a null version of RngLib for CI environments that need this change (https://edk2.groups.io/g/devel/message/50432). Though it should be pointed out that in CI environments, the null version of BaseCryptLib or OpenSSL should be used. In addition, it has been suggested that 1) Add AsmRdSeed to BaseLib. 2) Update BaseRngLib to use AsmRdSeed() for the random number, if RdSeed is supported (CPUID BIT18) However, this is largely out of scope for this particular patch series and will likely need to be in a follow-up series later. It is my understanding that the OpenSSL code uses the values provided as a randomness pool rather than a seed or random numbers itself, so the requirements for randomness are not quite as stringent as other applications. For the ArmVirtPkg and OvmfPkg platforms, the patch series here just adds in the TimerLib based RngLib as that is similar to the functionality of before. It is added as a common library so any custom RngLib defined in the DSC should take precedence over the TimerLibRngLib. Ref: https://github.com/tianocore/edk2/pull/845 Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871 Cc: Ard Biesheuvel Cc: Anthony Perard Cc: Jiewen Yao Cc: Jian J Wang Cc: Julien Grall Cc: Jordan Justen Cc: Laszlo Ersek Cc: Liming Gao Cc: Leif Lindholm Cc: Michael D Kinney Cc: Xiaoyu Lu Cc: Zhiguang Liu Cc: Sean Brogan Signed-off-by: Matthew Carlson Matthew Carlson (5): MdePkg: TimerRngLib: Added RngLib that uses TimerLib MdePkg: BaseRngLibDxe: Add RngLib that uses RngDxe OvmfPkg: Add RngLib based on TimerLib for Crypto ArmVirtPkg: Add RngLib based on TimerLib for CryptoPkg CryptoPkg: OpensslLib: Use RngLib to generate entropy in rand_pool CryptoPkg/Library/OpensslLib/rand_pool.c | 203 ++-- CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 --- CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43 - MdePkg/Library/BaseRngLibDxe/RngDxeLib.c | 200 +++ MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c | 187 ++ ArmVirtPkg/ArmVirt.dsc.inc | 1 + CryptoPkg/CryptoPkg.dsc | 1
[edk2-devel] [PATCH v6 5/5] CryptoPkg: OpensslLib: Use RngLib to generate entropy in rand_pool
From: Matthew Carlson
Ref: https://github.com/tianocore/edk2/pull/845
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871
Changes OpenSSL to no longer depend on TimerLib and instead use RngLib.
This allows platforms to decide for themsevles what sort of entropy source
they provide to OpenSSL and TlsLib.
Cc: Ard Biesheuvel
Cc: Jiewen Yao
Cc: Jian J Wang
Cc: Xiaoyu Lu
Signed-off-by: Matthew Carlson
---
CryptoPkg/Library/OpensslLib/rand_pool.c | 203 ++--
CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 ---
CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43 -
CryptoPkg/CryptoPkg.dsc| 1 +
CryptoPkg/Library/OpensslLib/OpensslLib.inf| 15 +-
CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 15 +-
CryptoPkg/Library/OpensslLib/rand_pool_noise.h | 29 ---
7 files changed, 22 insertions(+), 313 deletions(-)
diff --git a/CryptoPkg/Library/OpensslLib/rand_pool.c
b/CryptoPkg/Library/OpensslLib/rand_pool.c
index 9e0179b03490..3da92699fef6 100644
--- a/CryptoPkg/Library/OpensslLib/rand_pool.c
+++ b/CryptoPkg/Library/OpensslLib/rand_pool.c
@@ -11,53 +11,18 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include
#include
-#include
-
-#include "rand_pool_noise.h"
-
-/**
- Get some randomness from low-order bits of GetPerformanceCounter results.
- And combine them to the 64-bit value
-
- @param[out] RandBuffer pointer to store the 64-bit random value.
-
- @retval TRUERandom number generated successfully.
- @retval FALSE Failed to generate.
-**/
-STATIC
-BOOLEAN
-EFIAPI
-GetRandNoise64FromPerformanceCounter(
- OUT UINT64 *Rand
- )
-{
- UINT32 Index;
- UINT32 *RandPtr;
-
- if (NULL == Rand) {
-return FALSE;
- }
-
- RandPtr = (UINT32 *) Rand;
-
- for (Index = 0; Index < 2; Index ++) {
-*RandPtr = (UINT32) (GetPerformanceCounter () & 0xFF);
-MicroSecondDelay (10);
-RandPtr++;
- }
-
- return TRUE;
-}
+#include
/**
Calls RandomNumber64 to fill
a buffer of arbitrary size with random bytes.
+ This is a shim layer to RngLib.
@param[in] LengthSize of the buffer, in bytes, to fill with.
@param[out] RandBufferPointer to the buffer to store the random result.
- @retval EFI_SUCCESSRandom bytes generation succeeded.
- @retval EFI_NOT_READY Failed to request random bytes.
+ @retval TRUERandom bytes generation succeeded.
+ @retval FALSE Failed to request random bytes.
**/
STATIC
@@ -73,17 +38,17 @@ RandGetBytes (
Ret = FALSE;
+ if (RandBuffer == NULL) {
+DEBUG((DEBUG_ERROR, "[OPENSSL_RAND_POOL] NULL RandBuffer. No random
numbers are generated and your system is not secure\n"));
+ASSERT(FALSE); // Since we can't generate random numbers, we should
assert. Otherwise we will just blow up later.
+return Ret;
+ }
+
+
while (Length > 0) {
-//
-// Get random noise from platform.
-// If it failed, fallback to PerformanceCounter
-// If you really care about security, you must override
-// GetRandomNoise64FromPlatform.
-//
-Ret = GetRandomNoise64 ();
-if (Ret == FALSE) {
- Ret = GetRandNoise64FromPerformanceCounter ();
-}
+// Use RngLib to get random number
+Ret = GetRandomNumber64();
+
if (!Ret) {
return Ret;
}
@@ -100,125 +65,6 @@ RandGetBytes (
return Ret;
}
-/**
- Creates a 128bit random value that is fully forward and backward prediction
resistant,
- suitable for seeding a NIST SP800-90 Compliant.
- This function takes multiple random numbers from PerformanceCounter to
ensure reseeding
- and performs AES-CBC-MAC over the data to compute the seed value.
-
- @param[out] SeedBufferPointer to a 128bit buffer to store the random
seed.
-
- @retval TRUERandom seed generation succeeded.
- @retval FALSE Failed to request random bytes.
-
-**/
-STATIC
-BOOLEAN
-EFIAPI
-RandGetSeed128 (
- OUT UINT8*SeedBuffer
- )
-{
- BOOLEAN Ret;
- UINT8 RandByte[16];
- UINT8 Key[16];
- UINT8 Ffv[16];
- UINT8 Xored[16];
- UINT32 Index;
- UINT32 Index2;
- AES_KEY AESKey;
-
- //
- // Chose an arbitrary key and zero the feed_forward_value (FFV)
- //
- for (Index = 0; Index < 16; Index++) {
-Key[Index] = (UINT8) Index;
-Ffv[Index] = 0;
- }
-
- AES_set_encrypt_key (Key, 16 * 8, );
-
- //
- // Perform CBC_MAC over 32 * 128 bit values, with 10us gaps between 128 bit
value
- // The 10us gaps will ensure multiple reseeds within the system time with a
large
- // design margin.
- //
- for (Index = 0; Index < 32; Index++) {
-MicroSecondDelay (10);
-Ret = RandGetBytes (16, RandByte);
-if (!Ret) {
- return Ret;
-}
-
-//
-// Perform XOR operations on two 128-bit value.
-//
-for (Index2 = 0; Index2 < 16; Index2++) {
- Xored[Index2] = RandByte[Index2] ^ Ffv[Index2]
Re: [edk2-devel] [PATCH v5 0/5] Use RngLib instead of TimerLib for OpensslLib
Will do. -- - Matthew Carlson -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#64123): https://edk2.groups.io/g/devel/message/64123 Mute This Topic: https://groups.io/mt/76140302/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] [PATCH v5 4/5] ArmVirtPkg: Add RngLib based on TimerLib for CryptoPkg
You are correct, I'll fix it in v6 -- - Matthew Carlson -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#64122): https://edk2.groups.io/g/devel/message/64122 Mute This Topic: https://groups.io/mt/76140306/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] [PATCH v5 3/5] OvmfPkg: Add RngLib based on TimerLib for Crypto
I'll fix this for v6. Good spot. -- - Matthew Carlson -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#64121): https://edk2.groups.io/g/devel/message/64121 Mute This Topic: https://groups.io/mt/76140305/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] [PATCH v4 3/5] OvmfPkg: Add RngLib based on TimerLib for Crypto
Thank you for the helpful comments Lazlo! I sent out an updated series (v5) that fixes the things you mentioned. I added more description, so hopefully that helps. Sorry I didn't notice BhyvePkg, I thought you couldn't have packages under other packages, so I didn't think to check for other DSC's. It should be fixed up like the other Ovmf DSC's. I've been following your excellent guide for sending mailing list patches (Lazlo's Guide). ( https://github.com/tianocore/tianocore.github.io/wiki/Laszlo's-unkempt-git-guide-for-edk2-contributors-and-maintainers ) Is there a better way to get all the CC's from all the patches other than just copy and pasting them all? Perhaps the GetMaintainers.py where you specify multiple commits? Specifying a range didn't produce the desired behavior. -- - Matthew Carlson -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#64041): https://edk2.groups.io/g/devel/message/64041 Mute This Topic: https://groups.io/mt/76119014/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] [PATCH v4 0/5] Use RngLib instead of TimerLib for OpensslLib
Thanks Guomin! I sent out a version 5 of this series. -- - Matthew Carlson -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#64040): https://edk2.groups.io/g/devel/message/64040 Mute This Topic: https://groups.io/mt/76119011/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] [PATCH v5 1/5] MdePkg: TimerRngLib: Added RngLib that uses TimerLib
From: Matthew Carlson
Added a new RngLib that provides random numbers from the TimerLib
using the performance counter. This is meant to be used for OpenSSL
to replicate past behavior. This should not be used in production as
a real source of entropy.
Ref: https://github.com/tianocore/edk2/pull/845
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871
Cc: Michael D Kinney
Cc: Liming Gao
Cc: Zhiguang Liu
Signed-off-by: Matthew Carlson
---
MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c | 187
MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf | 40 +
MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.uni | 17 ++
MdePkg/MdePkg.dsc| 3 +-
4 files changed, 246 insertions(+), 1 deletion(-)
diff --git a/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
b/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
new file mode 100644
index ..915382fb9278
--- /dev/null
+++ b/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
@@ -0,0 +1,187 @@
+/** @file
+ BaseRng Library that uses the TimerLib to provide reasonably random numbers.
+ Do not use this on a production system.
+
+ Copyright (c) Microsoft Corporation.
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#include
+#include
+#include
+#include
+
+/**
+ * Using the TimerLib GetPerformanceCounterProperties() we delay
+ * for enough time for the PerformanceCounter to increment.
+ * Depending on your system
+ *
+ * If the return value from GetPerformanceCounterProperties (TimerLib)
+ * is zero, this function will not delay and attempt to assert.
+ */
+VOID
+EFIAPI
+DecentDelay(
+ VOID
+ )
+{
+ UINT64 StartValue;
+ UINT64 EndValue;
+ UINT64 CounterHz;
+ UINT64 MinumumDelayInMicroSeconds;
+ // Get the counter properties
+ CounterHz = GetPerformanceCounterProperties(, );
+ // Make sure we won't divide by zero
+ if (CounterHz == 0) {
+ASSERT(FALSE); // Assert so the developer knows something is wrong
+return;
+ }
+ // Calculate the minimum delay based on 1.5 microseconds divided by the
hertz.
+ // We calculate the length of a cycle (1/CounterHz) and multiply it by 1.5
microseconds
+ // This ensures that the performance counter has increased by at least one
+ MinumumDelayInMicroSeconds = 150 / CounterHz;
+
+ MicroSecondDelay(MinumumDelayInMicroSeconds);
+}
+
+
+/**
+ Generates a 16-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 16-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber16 (
+ OUT UINT16*Rand
+ )
+{
+ UINT32 Index;
+ UINT8* RandPtr;
+
+ ASSERT (Rand != NULL);
+
+ if (NULL == Rand) {
+return FALSE;
+ }
+
+ RandPtr = (UINT8 *) Rand;
+ // Get 2 bytes of random ish data
+ // This should take around 10us
+ for (Index = 0; Index < 2; Index ++) {
+*RandPtr = (UINT8) (GetPerformanceCounter () & 0xFF);
+DecentDelay (); // delay to give chance for performance counter to catch up
+RandPtr++;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 32-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 32-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber32 (
+ OUT UINT32*Rand
+ )
+{
+ UINT32 Index;
+ UINT8* RandPtr;
+
+ ASSERT (Rand != NULL);
+
+ if (NULL == Rand) {
+return FALSE;
+ }
+
+ RandPtr = (UINT8 *) Rand;
+ // Get 4 bytes of random ish data
+ // This should take around 20ms
+ for (Index = 0; Index < 4; Index ++) {
+*RandPtr = (UINT8) (GetPerformanceCounter () & 0xFF);
+DecentDelay (); // delay to give chance for performance counter to catch up
+RandPtr++;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 64-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 64-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber64 (
+ OUT UINT64*Rand
+ )
+{
+ UINT32 Index;
+ UINT8* RandPtr;
+
+ ASSERT (Rand != NULL);
+
+ if (NULL == Rand) {
+return FALSE;
+ }
+
+ RandPtr = (UINT8 *) Rand;
+ // Get 8 bytes of random ish data
+ // This should take around 40ms
+ for (Index = 0; Index < 8; Index ++) {
+*RandPtr = (UINT8) (GetPerformanceCounter () & 0xFF);
+DecentDelay (); // delay to give chance for performance counter to catch up
+RandPtr++;
+ }
+
+ return TRUE;
+}
+
+/**
+ Generates a 128-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the
[edk2-devel] [PATCH v5 4/5] ArmVirtPkg: Add RngLib based on TimerLib for CryptoPkg
From: Matthew Carlson Updates the DSC for the ArmVirtPkg platform to add a RngLib that uses the TimerLib. This is due to a later change that adds TimerLib as a dependency for OpenSSL. The TimerLib based RngLib mimics the behavior of OpenSSL previously and it is recommended to switch to a better source of entropy than the system's performance counter. Ref: https://github.com/tianocore/edk2/pull/845 Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871 Cc: Laszlo Ersek Cc: Ard Biesheuvel Cc: Leif Lindholm Signed-off-by: Matthew Carlson --- ArmVirtPkg/ArmVirt.dsc.inc | 1 + 1 file changed, 1 insertion(+) diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc index cf44fc73890b..ddfcd0cf9eee 100644 --- a/ArmVirtPkg/ArmVirt.dsc.inc +++ b/ArmVirtPkg/ArmVirt.dsc.inc @@ -42,6 +42,7 @@ DebugPrintErrorLevelLib|MdePkg/Library/BaseDebugPrintErrorLevelLib/BaseDebugPrintErrorLevelLib.inf BaseLib|MdePkg/Library/BaseLib/BaseLib.inf + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf SafeIntLib|MdePkg/Library/BaseSafeIntLib/BaseSafeIntLib.inf BmpSupportLib|MdeModulePkg/Library/BaseBmpSupportLib/BaseBmpSupportLib.inf SynchronizationLib|MdePkg/Library/BaseSynchronizationLib/BaseSynchronizationLib.inf -- 2.27.0.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#64038): https://edk2.groups.io/g/devel/message/64038 Mute This Topic: https://groups.io/mt/76140306/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] [PATCH v5 3/5] OvmfPkg: Add RngLib based on TimerLib for Crypto
From: Matthew Carlson Updates the DSC's for Ovmf based platforms to add a RngLib that uses the TimerLib. This is due to a later change that adds TimerLib as a dependency for OpenSSL. The TimerLib based RngLib mimics the behavior of OpenSSL previously and it is recommended to switch to a better source of entropy than the system's performance counter. Ref: https://github.com/tianocore/edk2/pull/845 Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871 Cc: Jordan Justen Cc: Laszlo Ersek Cc: Ard Biesheuvel Cc: Anthony Perard Cc: Julien Grall Signed-off-by: Matthew Carlson --- OvmfPkg/Bhyve/BhyvePkgX64.dsc | 1 + OvmfPkg/OvmfPkgIa32.dsc | 1 + OvmfPkg/OvmfPkgIa32X64.dsc| 2 ++ OvmfPkg/OvmfPkgX64.dsc| 1 + OvmfPkg/OvmfXen.dsc | 1 + 5 files changed, 6 insertions(+) diff --git a/OvmfPkg/Bhyve/BhyvePkgX64.dsc b/OvmfPkg/Bhyve/BhyvePkgX64.dsc index 8eba48d109a3..4b1fbb361b28 100644 --- a/OvmfPkg/Bhyve/BhyvePkgX64.dsc +++ b/OvmfPkg/Bhyve/BhyvePkgX64.dsc @@ -185,6 +185,7 @@ !else OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf !if $(SECURE_BOOT_ENABLE) == TRUE PlatformSecureLib|OvmfPkg/Bhyve/Library/PlatformSecureLib/PlatformSecureLib.inf diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc index 9178ffeb71cb..fc1c8014eba1 100644 --- a/OvmfPkg/OvmfPkgIa32.dsc +++ b/OvmfPkg/OvmfPkgIa32.dsc @@ -189,6 +189,7 @@ !else OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf !if $(SECURE_BOOT_ENABLE) == TRUE PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc index a665f78f0dc7..c76765723e2e 100644 --- a/OvmfPkg/OvmfPkgIa32X64.dsc +++ b/OvmfPkg/OvmfPkgIa32X64.dsc @@ -194,6 +194,8 @@ OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf + !if $(SECURE_BOOT_ENABLE) == TRUE PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf AuthVariableLib|SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc index 17f345acf4ee..6992cfd98b70 100644 --- a/OvmfPkg/OvmfPkgX64.dsc +++ b/OvmfPkg/OvmfPkgX64.dsc @@ -193,6 +193,7 @@ !else OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf !if $(SECURE_BOOT_ENABLE) == TRUE PlatformSecureLib|OvmfPkg/Library/PlatformSecureLib/PlatformSecureLib.inf diff --git a/OvmfPkg/OvmfXen.dsc b/OvmfPkg/OvmfXen.dsc index 782803cb2787..416f81f06a04 100644 --- a/OvmfPkg/OvmfXen.dsc +++ b/OvmfPkg/OvmfXen.dsc @@ -179,6 +179,7 @@ !else OpensslLib|CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf !endif + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf AuthVariableLib|MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.inf VarCheckLib|MdeModulePkg/Library/VarCheckLib/VarCheckLib.inf -- 2.27.0.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#64037): https://edk2.groups.io/g/devel/message/64037 Mute This Topic: https://groups.io/mt/76140305/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] [PATCH v5 5/5] CryptoPkg: OpensslLib: Use RngLib to generate entropy in rand_pool
From: Matthew Carlson
Ref: https://github.com/tianocore/edk2/pull/845
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871
Changes OpenSSL to no longer depend on TimerLib and instead use RngLib.
This allows platforms to decide for themsevles what sort of entropy source
they provide to OpenSSL and TlsLib.
Cc: Jiewen Yao
Cc: Jian J Wang
Cc: Xiaoyu Lu
Signed-off-by: Matthew Carlson
---
CryptoPkg/Library/OpensslLib/rand_pool.c | 203 ++--
CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 ---
CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43 -
CryptoPkg/CryptoPkg.dsc| 1 +
CryptoPkg/Library/OpensslLib/OpensslLib.inf| 15 +-
CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 15 +-
CryptoPkg/Library/OpensslLib/rand_pool_noise.h | 29 ---
7 files changed, 22 insertions(+), 313 deletions(-)
diff --git a/CryptoPkg/Library/OpensslLib/rand_pool.c
b/CryptoPkg/Library/OpensslLib/rand_pool.c
index 9e0179b03490..3da92699fef6 100644
--- a/CryptoPkg/Library/OpensslLib/rand_pool.c
+++ b/CryptoPkg/Library/OpensslLib/rand_pool.c
@@ -11,53 +11,18 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include
#include
-#include
-
-#include "rand_pool_noise.h"
-
-/**
- Get some randomness from low-order bits of GetPerformanceCounter results.
- And combine them to the 64-bit value
-
- @param[out] RandBuffer pointer to store the 64-bit random value.
-
- @retval TRUERandom number generated successfully.
- @retval FALSE Failed to generate.
-**/
-STATIC
-BOOLEAN
-EFIAPI
-GetRandNoise64FromPerformanceCounter(
- OUT UINT64 *Rand
- )
-{
- UINT32 Index;
- UINT32 *RandPtr;
-
- if (NULL == Rand) {
-return FALSE;
- }
-
- RandPtr = (UINT32 *) Rand;
-
- for (Index = 0; Index < 2; Index ++) {
-*RandPtr = (UINT32) (GetPerformanceCounter () & 0xFF);
-MicroSecondDelay (10);
-RandPtr++;
- }
-
- return TRUE;
-}
+#include
/**
Calls RandomNumber64 to fill
a buffer of arbitrary size with random bytes.
+ This is a shim layer to RngLib.
@param[in] LengthSize of the buffer, in bytes, to fill with.
@param[out] RandBufferPointer to the buffer to store the random result.
- @retval EFI_SUCCESSRandom bytes generation succeeded.
- @retval EFI_NOT_READY Failed to request random bytes.
+ @retval TRUERandom bytes generation succeeded.
+ @retval FALSE Failed to request random bytes.
**/
STATIC
@@ -73,17 +38,17 @@ RandGetBytes (
Ret = FALSE;
+ if (RandBuffer == NULL) {
+DEBUG((DEBUG_ERROR, "[OPENSSL_RAND_POOL] NULL RandBuffer. No random
numbers are generated and your system is not secure\n"));
+ASSERT(FALSE); // Since we can't generate random numbers, we should
assert. Otherwise we will just blow up later.
+return Ret;
+ }
+
+
while (Length > 0) {
-//
-// Get random noise from platform.
-// If it failed, fallback to PerformanceCounter
-// If you really care about security, you must override
-// GetRandomNoise64FromPlatform.
-//
-Ret = GetRandomNoise64 ();
-if (Ret == FALSE) {
- Ret = GetRandNoise64FromPerformanceCounter ();
-}
+// Use RngLib to get random number
+Ret = GetRandomNumber64();
+
if (!Ret) {
return Ret;
}
@@ -100,125 +65,6 @@ RandGetBytes (
return Ret;
}
-/**
- Creates a 128bit random value that is fully forward and backward prediction
resistant,
- suitable for seeding a NIST SP800-90 Compliant.
- This function takes multiple random numbers from PerformanceCounter to
ensure reseeding
- and performs AES-CBC-MAC over the data to compute the seed value.
-
- @param[out] SeedBufferPointer to a 128bit buffer to store the random
seed.
-
- @retval TRUERandom seed generation succeeded.
- @retval FALSE Failed to request random bytes.
-
-**/
-STATIC
-BOOLEAN
-EFIAPI
-RandGetSeed128 (
- OUT UINT8*SeedBuffer
- )
-{
- BOOLEAN Ret;
- UINT8 RandByte[16];
- UINT8 Key[16];
- UINT8 Ffv[16];
- UINT8 Xored[16];
- UINT32 Index;
- UINT32 Index2;
- AES_KEY AESKey;
-
- //
- // Chose an arbitrary key and zero the feed_forward_value (FFV)
- //
- for (Index = 0; Index < 16; Index++) {
-Key[Index] = (UINT8) Index;
-Ffv[Index] = 0;
- }
-
- AES_set_encrypt_key (Key, 16 * 8, );
-
- //
- // Perform CBC_MAC over 32 * 128 bit values, with 10us gaps between 128 bit
value
- // The 10us gaps will ensure multiple reseeds within the system time with a
large
- // design margin.
- //
- for (Index = 0; Index < 32; Index++) {
-MicroSecondDelay (10);
-Ret = RandGetBytes (16, RandByte);
-if (!Ret) {
- return Ret;
-}
-
-//
-// Perform XOR operations on two 128-bit value.
-//
-for (Index2 = 0; Index2 < 16; Index2++) {
- Xored[Index2] = RandByte[Index2] ^ Ffv[Index2]
[edk2-devel] [PATCH v5 2/5] MdePkg: BaseRngLibDxe: Add RngLib that uses RngDxe
From: Matthew Carlson
This adds a RngLib that uses the RngProtocol to provide randomness.
This means that the RngLib is meant to be used with DXE_DRIVERS.
Ref: https://github.com/tianocore/edk2/pull/845
Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871
Cc: Michael D Kinney
Cc: Liming Gao
Cc: Zhiguang Liu
Signed-off-by: Matthew Carlson
---
MdePkg/Library/BaseRngLibDxe/RngDxeLib.c | 200
MdePkg/Library/BaseRngLibDxe/BaseRngLibDxe.inf | 38
MdePkg/MdePkg.dsc | 4 +-
3 files changed, 241 insertions(+), 1 deletion(-)
diff --git a/MdePkg/Library/BaseRngLibDxe/RngDxeLib.c
b/MdePkg/Library/BaseRngLibDxe/RngDxeLib.c
new file mode 100644
index ..8ee29329de13
--- /dev/null
+++ b/MdePkg/Library/BaseRngLibDxe/RngDxeLib.c
@@ -0,0 +1,200 @@
+/** @file
+ Provides an implementation of the library class RngLib that uses the Rng
protocol.
+
+Copyright (c) Microsoft Corporation. All rights reserved.
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+#include
+#include
+#include
+#include
+#include
+
+/**
+Routine Description:
+
+Generates a random number via the NIST
+800-9A algorithm. Refer to
+http://csrc.nist.gov/groups/STM/cavp/documents/drbg/DRBGVS.pdf
+for more information.
+
+Arguments:
+
+Buffer -- Buffer to receive the random number.
+BufferSize -- Number of bytes in Buffer.
+
+Return Value:
+
+EFI_SUCCESS or underlying failure code.
+
+**/
+EFI_STATUS
+EFIAPI
+GenerateRandomNumberViaNist800Algorithm(
+ OUT UINT8* Buffer,
+ IN UINTN BufferSize
+ )
+{
+ EFI_STATUSStatus;
+ EFI_RNG_PROTOCOL* RngProtocol;
+
+ RngProtocol = NULL;
+
+ if (Buffer == NULL) {
+ DEBUG((DEBUG_ERROR, "[%a] Buffer == NULL.\n", __FUNCTION__));
+ return EFI_INVALID_PARAMETER;
+ }
+
+ Status = gBS->LocateProtocol(, NULL, (VOID
**));
+ if (EFI_ERROR(Status) || RngProtocol == NULL) {
+ DEBUG((DEBUG_ERROR, "[%a] Could not locate RNG prototocol, Status =
%r\n", __FUNCTION__, Status));
+ return Status;
+ }
+
+ Status = RngProtocol->GetRNG(RngProtocol,
, BufferSize, Buffer);
+ DEBUG((DEBUG_INFO, "[%a] GetRNG algorithm CTR-256 - Status = %r\n",
__FUNCTION__, Status));
+ if(!EFI_ERROR(Status)) {
+return Status;
+ }
+
+ Status = RngProtocol->GetRNG(RngProtocol,
, BufferSize, Buffer);
+ DEBUG((DEBUG_INFO, "[%a] GetRNG algorithm HMAC-256 - Status = %r\n",
__FUNCTION__, Status));
+ if(!EFI_ERROR(Status)) {
+return Status;
+ }
+
+ Status = RngProtocol->GetRNG(RngProtocol,
, BufferSize, Buffer);
+ DEBUG((DEBUG_INFO, "[%a] GetRNG algorithm Hash-256 - Status = %r\n",
__FUNCTION__, Status));
+ if(!EFI_ERROR(Status)) {
+return Status;
+ }
+ // If we get to this point, we have failed
+ DEBUG((DEBUG_ERROR, "[%a] GetRNG() failed, staus = %r\n", __FUNCTION__,
Status));
+
+ return Status;
+}// GenerateRandomNumberViaNist800Algorithm()
+
+
+/**
+ Generates a 16-bit random number.
+
+ if Rand is NULL, return FALSE.
+
+ @param[out] Rand Buffer pointer to store the 16-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber16 (
+ OUT UINT16*Rand
+ )
+{
+ EFI_STATUS Status;
+
+ if (Rand == NULL)
+ {
+return FALSE;
+ }
+
+ Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 2);
+ if (EFI_ERROR(Status))
+ {
+return FALSE;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 32-bit random number.
+
+ if Rand is NULL, return FALSE.
+
+ @param[out] Rand Buffer pointer to store the 32-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber32 (
+ OUT UINT32*Rand
+ )
+{
+ EFI_STATUS Status;
+
+ if (Rand == NULL) {
+return FALSE;
+ }
+
+ Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 4);
+ if (EFI_ERROR(Status)) {
+return FALSE;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 64-bit random number.
+
+ if Rand is NULL, return FALSE.
+
+ @param[out] Rand Buffer pointer to store the 64-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber64 (
+ OUT UINT64*Rand
+ )
+{
+ EFI_STATUS Status;
+
+ if (Rand == NULL)
+ {
+return FALSE;
+ }
+
+ Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 8);
+ if (EFI_ERROR(Status)) {
+return FALSE;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 128-bit random number.
+
+ if Rand is NULL, return FALSE.
+
+ @param[out] Rand Buffer pointer to store the 128-bit random value.
+
+ @retval TRUE Random n
[edk2-devel] [PATCH v5 0/5] Use RngLib instead of TimerLib for OpensslLib
From: Matthew Carlson Hello all, This patch contains a fix for Bugzilla 1871. There's been a good bit of community discussion around the topic, so below follows a general overview of the discussion and what this patch does. Back in Devel message#40590 (https://edk2.groups.io/g/devel/message/40590) around the patch series that updates OpenSSL to 1.1.1b, a comment was made that suggested that platforms be in charge of the entropy/randomness that is provided to OpenSSL as currently the entropry source seems to be a hand-rolled random number generator that uses the PerformanceCounter from TimerLib. This causes OpenSSL to depend on TimerLib, which is often platform specific. In addition to being a potentially weaker source of randomness, this also poses a challenge to compile BaseCryptLibOnProtocol with a platform- agnostic version of TimerLib that works universally. The solution here is to allow platform to specify their source of entropy in addition to providing two new RngLibs: one that uses the TimerLib as well as one that uses RngProtocol to provide randomness. Then the decision to use RDRAND or other entropy sources is up to the platform. Mixing various entropy sources is the onus of the platform. It has been suggested on Devel#40590 and BZ#1871 that there should be mixing of the PerformanceCounter and RDRAND using something similar to the yarrow alogirthm that FreeBSD uses for example. This patch series doesn't offer an RngLib that offers that sort of mixing as the ultimate source of random is defined by the platform. This patch series offers three benefits: 1. Dependency reduction: Removes the need for a platform specific timer library. We publish a single binary used on numerous platforms for crypto and the introduced timer lib dependency caused issues because we could not fulfill our platform needs with one library instance. 2. Code maintenance: Removing this additional code and leveraging an existing library within Edk2 means less code to maintain. 3. Platform defined quality: A platform can choose which instance to use and the implications of that instance. This patch series seeks to address five seperate issues. 1) Use RngLib interface to generate random entropy in rand_pool 2) Remove dependency on TimerLib in OpensslLib 3) Add a new version of RngLib implemented by TimerLib 4) Add a new version of RngLib implemented by EFI_RNG_PROTOCOL 5) Add RngLib to platforms in EDK2 such as ArmVirtPkg and OvmfPkg Since this changes the dependencies of OpenSSL, this has the potential of being a breaking change for platforms in edk2-platforms. The easiest solution is just to use the RngLib that uses the TimerLib as this closely mimics the behavior of OpenSSL prior to this patch series. There is also a null version of RngLib for CI environments that need this change (https://edk2.groups.io/g/devel/message/50432). Though it should be pointed out that in CI environments, the null version of BaseCryptLib or OpenSSL should be used. In addition, it has been suggested that 1) Add AsmRdSeed to BaseLib. 2) Update BaseRngLib to use AsmRdSeed() for the random number, if RdSeed is supported (CPUID BIT18) However, this is largely out of scope for this particular patch series and will likely need to be in a follow-up series later. It is my understanding that the OpenSSL code uses the values provided as a randomness pool rather than a seed or random numbers itself, so the requirements for randomness are not quite as stringent as other applications. For the ArmVirtPkg and OvmfPkg platforms, the patch series here just adds in the TimerLib based RngLib as that is similar to the functionality of before. It is added as a common library so any custom RngLib defined in the DSC should take precedence over the TimerLibRngLib. Ref: https://github.com/tianocore/edk2/pull/845 Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871 Cc: Ard Biesheuvel Cc: Anthony Perard Cc: Jiewen Yao Cc: Jian J Wang Cc: Julien Grall Cc: Jordan Justen Cc: Laszlo Ersek Cc: Liming Gao Cc: Leif Lindholm Cc: Michael D Kinney Cc: Xiaoyu Lu Cc: Zhiguang Liu Signed-off-by: Matthew Carlson Matthew Carlson (5): MdePkg: TimerRngLib: Added RngLib that uses TimerLib MdePkg: BaseRngLibDxe: Add RngLib that uses RngDxe OvmfPkg: Add RngLib based on TimerLib for Crypto ArmVirtPkg: Add RngLib based on TimerLib for CryptoPkg CryptoPkg: OpensslLib: Use RngLib to generate entropy in rand_pool CryptoPkg/Library/OpensslLib/rand_pool.c | 203 ++-- CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 --- CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43 - MdePkg/Library/BaseRngLibDxe/RngDxeLib.c | 200 +++ MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c | 187 ++ ArmVirtPkg/ArmVirt.dsc.inc | 1 + CryptoPkg/CryptoPkg.dsc | 1 + CryptoPkg
[edk2-devel] [PATCH v4 3/5] OvmfPkg: Add RngLib based on TimerLib for Crypto
From: Matthew Carlson Cc: Jordan Justen Cc: Laszlo Ersek Cc: Ard Biesheuvel Cc: Anthony Perard Cc: Julien Grall Signed-off-by: Matthew Carlson --- OvmfPkg/OvmfPkgIa32.dsc| 1 + OvmfPkg/OvmfPkgIa32X64.dsc | 1 + OvmfPkg/OvmfPkgX64.dsc | 1 + OvmfPkg/OvmfXen.dsc| 1 + 4 files changed, 4 insertions(+) diff --git a/OvmfPkg/OvmfPkgIa32.dsc b/OvmfPkg/OvmfPkgIa32.dsc index 9178ffeb71cb..118fd1aff246 100644 --- a/OvmfPkg/OvmfPkgIa32.dsc +++ b/OvmfPkg/OvmfPkgIa32.dsc @@ -116,6 +116,7 @@ [LibraryClasses] PcdLib|MdePkg/Library/BasePcdLibNull/BasePcdLibNull.inf TimerLib|OvmfPkg/Library/AcpiTimerLib/BaseAcpiTimerLib.inf + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf ResetSystemLib|OvmfPkg/Library/ResetSystemLib/BaseResetSystemLib.inf PrintLib|MdePkg/Library/BasePrintLib/BasePrintLib.inf BaseMemoryLib|MdePkg/Library/BaseMemoryLibRepStr/BaseMemoryLibRepStr.inf diff --git a/OvmfPkg/OvmfPkgIa32X64.dsc b/OvmfPkg/OvmfPkgIa32X64.dsc index a665f78f0dc7..6b9da5b996ff 100644 --- a/OvmfPkg/OvmfPkgIa32X64.dsc +++ b/OvmfPkg/OvmfPkgIa32X64.dsc @@ -120,6 +120,7 @@ [LibraryClasses] PcdLib|MdePkg/Library/BasePcdLibNull/BasePcdLibNull.inf TimerLib|OvmfPkg/Library/AcpiTimerLib/BaseAcpiTimerLib.inf + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf ResetSystemLib|OvmfPkg/Library/ResetSystemLib/BaseResetSystemLib.inf PrintLib|MdePkg/Library/BasePrintLib/BasePrintLib.inf BaseMemoryLib|MdePkg/Library/BaseMemoryLibRepStr/BaseMemoryLibRepStr.inf diff --git a/OvmfPkg/OvmfPkgX64.dsc b/OvmfPkg/OvmfPkgX64.dsc index 17f345acf4ee..3a354eb3a2bd 100644 --- a/OvmfPkg/OvmfPkgX64.dsc +++ b/OvmfPkg/OvmfPkgX64.dsc @@ -120,6 +120,7 @@ [LibraryClasses] PcdLib|MdePkg/Library/BasePcdLibNull/BasePcdLibNull.inf TimerLib|OvmfPkg/Library/AcpiTimerLib/BaseAcpiTimerLib.inf + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf ResetSystemLib|OvmfPkg/Library/ResetSystemLib/BaseResetSystemLib.inf PrintLib|MdePkg/Library/BasePrintLib/BasePrintLib.inf BaseMemoryLib|MdePkg/Library/BaseMemoryLibRepStr/BaseMemoryLibRepStr.inf diff --git a/OvmfPkg/OvmfXen.dsc b/OvmfPkg/OvmfXen.dsc index 782803cb2787..f97e2b7e07d0 100644 --- a/OvmfPkg/OvmfXen.dsc +++ b/OvmfPkg/OvmfXen.dsc @@ -110,6 +110,7 @@ [LibraryClasses] PcdLib|MdePkg/Library/BasePcdLibNull/BasePcdLibNull.inf TimerLib|MdePkg/Library/SecPeiDxeTimerLibCpu/SecPeiDxeTimerLibCpu.inf + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf ResetSystemLib|OvmfPkg/Library/ResetSystemLib/BaseResetSystemLib.inf PrintLib|MdePkg/Library/BasePrintLib/BasePrintLib.inf BaseMemoryLib|MdePkg/Library/BaseMemoryLibRepStr/BaseMemoryLibRepStr.inf -- 2.27.0.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#63947): https://edk2.groups.io/g/devel/message/63947 Mute This Topic: https://groups.io/mt/76119014/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] [PATCH v4 5/5] CryptoPkg: OpensslLib: Use RngLib to generate entropy in rand_pool
From: Matthew Carlson
Changes OpenSSL to no longer depend on TimerLib and instead use RngLib.
This allows platforms to decide for themsevles what sort of entropy source
they provide to OpenSSL and TlsLib.
Cc: Jiewen Yao
Cc: Jian J Wang
Cc: Xiaoyu Lu
Signed-off-by: Matthew Carlson
---
CryptoPkg/Library/OpensslLib/rand_pool.c | 203 ++--
CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 ---
CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43 -
CryptoPkg/CryptoPkg.dsc| 1 +
CryptoPkg/Library/OpensslLib/OpensslLib.inf| 15 +-
CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 15 +-
CryptoPkg/Library/OpensslLib/rand_pool_noise.h | 29 ---
7 files changed, 22 insertions(+), 313 deletions(-)
diff --git a/CryptoPkg/Library/OpensslLib/rand_pool.c
b/CryptoPkg/Library/OpensslLib/rand_pool.c
index 9e0179b03490..3da92699fef6 100644
--- a/CryptoPkg/Library/OpensslLib/rand_pool.c
+++ b/CryptoPkg/Library/OpensslLib/rand_pool.c
@@ -11,53 +11,18 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include
#include
-#include
-
-#include "rand_pool_noise.h"
-
-/**
- Get some randomness from low-order bits of GetPerformanceCounter results.
- And combine them to the 64-bit value
-
- @param[out] RandBuffer pointer to store the 64-bit random value.
-
- @retval TRUERandom number generated successfully.
- @retval FALSE Failed to generate.
-**/
-STATIC
-BOOLEAN
-EFIAPI
-GetRandNoise64FromPerformanceCounter(
- OUT UINT64 *Rand
- )
-{
- UINT32 Index;
- UINT32 *RandPtr;
-
- if (NULL == Rand) {
-return FALSE;
- }
-
- RandPtr = (UINT32 *) Rand;
-
- for (Index = 0; Index < 2; Index ++) {
-*RandPtr = (UINT32) (GetPerformanceCounter () & 0xFF);
-MicroSecondDelay (10);
-RandPtr++;
- }
-
- return TRUE;
-}
+#include
/**
Calls RandomNumber64 to fill
a buffer of arbitrary size with random bytes.
+ This is a shim layer to RngLib.
@param[in] LengthSize of the buffer, in bytes, to fill with.
@param[out] RandBufferPointer to the buffer to store the random result.
- @retval EFI_SUCCESSRandom bytes generation succeeded.
- @retval EFI_NOT_READY Failed to request random bytes.
+ @retval TRUERandom bytes generation succeeded.
+ @retval FALSE Failed to request random bytes.
**/
STATIC
@@ -73,17 +38,17 @@ RandGetBytes (
Ret = FALSE;
+ if (RandBuffer == NULL) {
+DEBUG((DEBUG_ERROR, "[OPENSSL_RAND_POOL] NULL RandBuffer. No random
numbers are generated and your system is not secure\n"));
+ASSERT(FALSE); // Since we can't generate random numbers, we should
assert. Otherwise we will just blow up later.
+return Ret;
+ }
+
+
while (Length > 0) {
-//
-// Get random noise from platform.
-// If it failed, fallback to PerformanceCounter
-// If you really care about security, you must override
-// GetRandomNoise64FromPlatform.
-//
-Ret = GetRandomNoise64 ();
-if (Ret == FALSE) {
- Ret = GetRandNoise64FromPerformanceCounter ();
-}
+// Use RngLib to get random number
+Ret = GetRandomNumber64();
+
if (!Ret) {
return Ret;
}
@@ -100,125 +65,6 @@ RandGetBytes (
return Ret;
}
-/**
- Creates a 128bit random value that is fully forward and backward prediction
resistant,
- suitable for seeding a NIST SP800-90 Compliant.
- This function takes multiple random numbers from PerformanceCounter to
ensure reseeding
- and performs AES-CBC-MAC over the data to compute the seed value.
-
- @param[out] SeedBufferPointer to a 128bit buffer to store the random
seed.
-
- @retval TRUERandom seed generation succeeded.
- @retval FALSE Failed to request random bytes.
-
-**/
-STATIC
-BOOLEAN
-EFIAPI
-RandGetSeed128 (
- OUT UINT8*SeedBuffer
- )
-{
- BOOLEAN Ret;
- UINT8 RandByte[16];
- UINT8 Key[16];
- UINT8 Ffv[16];
- UINT8 Xored[16];
- UINT32 Index;
- UINT32 Index2;
- AES_KEY AESKey;
-
- //
- // Chose an arbitrary key and zero the feed_forward_value (FFV)
- //
- for (Index = 0; Index < 16; Index++) {
-Key[Index] = (UINT8) Index;
-Ffv[Index] = 0;
- }
-
- AES_set_encrypt_key (Key, 16 * 8, );
-
- //
- // Perform CBC_MAC over 32 * 128 bit values, with 10us gaps between 128 bit
value
- // The 10us gaps will ensure multiple reseeds within the system time with a
large
- // design margin.
- //
- for (Index = 0; Index < 32; Index++) {
-MicroSecondDelay (10);
-Ret = RandGetBytes (16, RandByte);
-if (!Ret) {
- return Ret;
-}
-
-//
-// Perform XOR operations on two 128-bit value.
-//
-for (Index2 = 0; Index2 < 16; Index2++) {
- Xored[Index2] = RandByte[Index2] ^ Ffv[Index2];
-}
-
-AES_encrypt (Xored, Ffv, );
- }
-
- for (Index = 0; Index < 16; Index++) {
-SeedBuffer
[edk2-devel] [PATCH v4 4/5] ArmVirtPkg: Add RngLib based on TimerLib for CryptoPkg
From: Matthew Carlson Cc: Laszlo Ersek Cc: Ard Biesheuvel Cc: Leif Lindholm Signed-off-by: Matthew Carlson --- ArmVirtPkg/ArmVirt.dsc.inc | 1 + 1 file changed, 1 insertion(+) diff --git a/ArmVirtPkg/ArmVirt.dsc.inc b/ArmVirtPkg/ArmVirt.dsc.inc index cf44fc73890b..ddfcd0cf9eee 100644 --- a/ArmVirtPkg/ArmVirt.dsc.inc +++ b/ArmVirtPkg/ArmVirt.dsc.inc @@ -42,6 +42,7 @@ DebugPrintErrorLevelLib|MdePkg/Library/BaseDebugPrintErrorLevelLib/BaseDebugPrintErrorLevelLib.inf BaseLib|MdePkg/Library/BaseLib/BaseLib.inf + RngLib|MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf SafeIntLib|MdePkg/Library/BaseSafeIntLib/BaseSafeIntLib.inf BmpSupportLib|MdeModulePkg/Library/BaseBmpSupportLib/BaseBmpSupportLib.inf SynchronizationLib|MdePkg/Library/BaseSynchronizationLib/BaseSynchronizationLib.inf -- 2.27.0.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#63948): https://edk2.groups.io/g/devel/message/63948 Mute This Topic: https://groups.io/mt/76119015/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] [PATCH v4 2/5] MdePkg: BaseRngLibDxe: Add RngLib that uses RngDxe
From: Matthew Carlson
Cc: Michael D Kinney
Cc: Liming Gao
Cc: Zhiguang Liu
Signed-off-by: Matthew Carlson
---
MdePkg/Library/BaseRngLibDxe/RngDxeLib.c | 200
MdePkg/Library/BaseRngLibDxe/BaseRngLibDxe.inf | 38
MdePkg/MdePkg.dsc | 4 +-
3 files changed, 241 insertions(+), 1 deletion(-)
diff --git a/MdePkg/Library/BaseRngLibDxe/RngDxeLib.c
b/MdePkg/Library/BaseRngLibDxe/RngDxeLib.c
new file mode 100644
index ..8ee29329de13
--- /dev/null
+++ b/MdePkg/Library/BaseRngLibDxe/RngDxeLib.c
@@ -0,0 +1,200 @@
+/** @file
+ Provides an implementation of the library class RngLib that uses the Rng
protocol.
+
+Copyright (c) Microsoft Corporation. All rights reserved.
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+#include
+#include
+#include
+#include
+#include
+
+/**
+Routine Description:
+
+Generates a random number via the NIST
+800-9A algorithm. Refer to
+http://csrc.nist.gov/groups/STM/cavp/documents/drbg/DRBGVS.pdf
+for more information.
+
+Arguments:
+
+Buffer -- Buffer to receive the random number.
+BufferSize -- Number of bytes in Buffer.
+
+Return Value:
+
+EFI_SUCCESS or underlying failure code.
+
+**/
+EFI_STATUS
+EFIAPI
+GenerateRandomNumberViaNist800Algorithm(
+ OUT UINT8* Buffer,
+ IN UINTN BufferSize
+ )
+{
+ EFI_STATUSStatus;
+ EFI_RNG_PROTOCOL* RngProtocol;
+
+ RngProtocol = NULL;
+
+ if (Buffer == NULL) {
+ DEBUG((DEBUG_ERROR, "[%a] Buffer == NULL.\n", __FUNCTION__));
+ return EFI_INVALID_PARAMETER;
+ }
+
+ Status = gBS->LocateProtocol(, NULL, (VOID
**));
+ if (EFI_ERROR(Status) || RngProtocol == NULL) {
+ DEBUG((DEBUG_ERROR, "[%a] Could not locate RNG prototocol, Status =
%r\n", __FUNCTION__, Status));
+ return Status;
+ }
+
+ Status = RngProtocol->GetRNG(RngProtocol,
, BufferSize, Buffer);
+ DEBUG((DEBUG_INFO, "[%a] GetRNG algorithm CTR-256 - Status = %r\n",
__FUNCTION__, Status));
+ if(!EFI_ERROR(Status)) {
+return Status;
+ }
+
+ Status = RngProtocol->GetRNG(RngProtocol,
, BufferSize, Buffer);
+ DEBUG((DEBUG_INFO, "[%a] GetRNG algorithm HMAC-256 - Status = %r\n",
__FUNCTION__, Status));
+ if(!EFI_ERROR(Status)) {
+return Status;
+ }
+
+ Status = RngProtocol->GetRNG(RngProtocol,
, BufferSize, Buffer);
+ DEBUG((DEBUG_INFO, "[%a] GetRNG algorithm Hash-256 - Status = %r\n",
__FUNCTION__, Status));
+ if(!EFI_ERROR(Status)) {
+return Status;
+ }
+ // If we get to this point, we have failed
+ DEBUG((DEBUG_ERROR, "[%a] GetRNG() failed, staus = %r\n", __FUNCTION__,
Status));
+
+ return Status;
+}// GenerateRandomNumberViaNist800Algorithm()
+
+
+/**
+ Generates a 16-bit random number.
+
+ if Rand is NULL, return FALSE.
+
+ @param[out] Rand Buffer pointer to store the 16-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber16 (
+ OUT UINT16*Rand
+ )
+{
+ EFI_STATUS Status;
+
+ if (Rand == NULL)
+ {
+return FALSE;
+ }
+
+ Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 2);
+ if (EFI_ERROR(Status))
+ {
+return FALSE;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 32-bit random number.
+
+ if Rand is NULL, return FALSE.
+
+ @param[out] Rand Buffer pointer to store the 32-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber32 (
+ OUT UINT32*Rand
+ )
+{
+ EFI_STATUS Status;
+
+ if (Rand == NULL) {
+return FALSE;
+ }
+
+ Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 4);
+ if (EFI_ERROR(Status)) {
+return FALSE;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 64-bit random number.
+
+ if Rand is NULL, return FALSE.
+
+ @param[out] Rand Buffer pointer to store the 64-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber64 (
+ OUT UINT64*Rand
+ )
+{
+ EFI_STATUS Status;
+
+ if (Rand == NULL)
+ {
+return FALSE;
+ }
+
+ Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 8);
+ if (EFI_ERROR(Status)) {
+return FALSE;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 128-bit random number.
+
+ if Rand is NULL, return FALSE.
+
+ @param[out] Rand Buffer pointer to store the 128-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber128 (
+ OUT UINT64*Rand
+ )
+{
+ EFI_STATUS Status;
+
+ if (Rand == NULL) {
+
[edk2-devel] [PATCH v4 1/5] MdePkg: TimerRngLib: Added RngLib that uses TimerLib
From: Matthew Carlson
Added a new RngLib that provides random numbers from the TimerLib
using the performance counter. This is meant to be used for OpenSSL
to replicate past behavior. This should not be used in production as
a real source of entropy.
Cc: Michael D Kinney
Cc: Liming Gao
Cc: Zhiguang Liu
Signed-off-by: Matthew Carlson
---
MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c | 187
MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf | 40 +
MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.uni | 17 ++
MdePkg/MdePkg.dsc| 3 +-
4 files changed, 246 insertions(+), 1 deletion(-)
diff --git a/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
b/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
new file mode 100644
index ..915382fb9278
--- /dev/null
+++ b/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
@@ -0,0 +1,187 @@
+/** @file
+ BaseRng Library that uses the TimerLib to provide reasonably random numbers.
+ Do not use this on a production system.
+
+ Copyright (c) Microsoft Corporation.
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#include
+#include
+#include
+#include
+
+/**
+ * Using the TimerLib GetPerformanceCounterProperties() we delay
+ * for enough time for the PerformanceCounter to increment.
+ * Depending on your system
+ *
+ * If the return value from GetPerformanceCounterProperties (TimerLib)
+ * is zero, this function will not delay and attempt to assert.
+ */
+VOID
+EFIAPI
+DecentDelay(
+ VOID
+ )
+{
+ UINT64 StartValue;
+ UINT64 EndValue;
+ UINT64 CounterHz;
+ UINT64 MinumumDelayInMicroSeconds;
+ // Get the counter properties
+ CounterHz = GetPerformanceCounterProperties(, );
+ // Make sure we won't divide by zero
+ if (CounterHz == 0) {
+ASSERT(FALSE); // Assert so the developer knows something is wrong
+return;
+ }
+ // Calculate the minimum delay based on 1.5 microseconds divided by the
hertz.
+ // We calculate the length of a cycle (1/CounterHz) and multiply it by 1.5
microseconds
+ // This ensures that the performance counter has increased by at least one
+ MinumumDelayInMicroSeconds = 150 / CounterHz;
+
+ MicroSecondDelay(MinumumDelayInMicroSeconds);
+}
+
+
+/**
+ Generates a 16-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 16-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber16 (
+ OUT UINT16*Rand
+ )
+{
+ UINT32 Index;
+ UINT8* RandPtr;
+
+ ASSERT (Rand != NULL);
+
+ if (NULL == Rand) {
+return FALSE;
+ }
+
+ RandPtr = (UINT8 *) Rand;
+ // Get 2 bytes of random ish data
+ // This should take around 10us
+ for (Index = 0; Index < 2; Index ++) {
+*RandPtr = (UINT8) (GetPerformanceCounter () & 0xFF);
+DecentDelay (); // delay to give chance for performance counter to catch up
+RandPtr++;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 32-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 32-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber32 (
+ OUT UINT32*Rand
+ )
+{
+ UINT32 Index;
+ UINT8* RandPtr;
+
+ ASSERT (Rand != NULL);
+
+ if (NULL == Rand) {
+return FALSE;
+ }
+
+ RandPtr = (UINT8 *) Rand;
+ // Get 4 bytes of random ish data
+ // This should take around 20ms
+ for (Index = 0; Index < 4; Index ++) {
+*RandPtr = (UINT8) (GetPerformanceCounter () & 0xFF);
+DecentDelay (); // delay to give chance for performance counter to catch up
+RandPtr++;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 64-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 64-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber64 (
+ OUT UINT64*Rand
+ )
+{
+ UINT32 Index;
+ UINT8* RandPtr;
+
+ ASSERT (Rand != NULL);
+
+ if (NULL == Rand) {
+return FALSE;
+ }
+
+ RandPtr = (UINT8 *) Rand;
+ // Get 8 bytes of random ish data
+ // This should take around 40ms
+ for (Index = 0; Index < 8; Index ++) {
+*RandPtr = (UINT8) (GetPerformanceCounter () & 0xFF);
+DecentDelay (); // delay to give chance for performance counter to catch up
+RandPtr++;
+ }
+
+ return TRUE;
+}
+
+/**
+ Generates a 128-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 128-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSE
[edk2-devel] [PATCH v4 0/5] Use RngLib instead of TimerLib for OpensslLib
From: Matthew Carlson Ref: https://github.com/tianocore/edk2/pull/845 Ref: https://bugzilla.tianocore.org/show_bug.cgi?id=1871 Matthew Carlson (5): MdePkg: TimerRngLib: Added RngLib that uses TimerLib MdePkg: BaseRngLibDxe: Add RngLib that uses RngDxe OvmfPkg: Add RngLib based on TimerLib for Crypto ArmVirtPkg: Add RngLib based on TimerLib for CryptoPkg CryptoPkg: OpensslLib: Use RngLib to generate entropy in rand_pool CryptoPkg/Library/OpensslLib/rand_pool.c | 203 ++-- CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 --- CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43 - MdePkg/Library/BaseRngLibDxe/RngDxeLib.c | 200 +++ MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c | 187 ++ ArmVirtPkg/ArmVirt.dsc.inc | 1 + CryptoPkg/CryptoPkg.dsc | 1 + CryptoPkg/Library/OpensslLib/OpensslLib.inf | 15 +- CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf| 15 +- CryptoPkg/Library/OpensslLib/rand_pool_noise.h | 29 --- MdePkg/Library/BaseRngLibDxe/BaseRngLibDxe.inf | 38 MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf | 40 MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.uni | 17 ++ MdePkg/MdePkg.dsc| 5 +- OvmfPkg/OvmfPkgIa32.dsc | 1 + OvmfPkg/OvmfPkgIa32X64.dsc | 1 + OvmfPkg/OvmfPkgX64.dsc | 1 + OvmfPkg/OvmfXen.dsc | 1 + 18 files changed, 513 insertions(+), 314 deletions(-) delete mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.c delete mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c create mode 100644 MdePkg/Library/BaseRngLibDxe/RngDxeLib.c create mode 100644 MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c delete mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.h create mode 100644 MdePkg/Library/BaseRngLibDxe/BaseRngLibDxe.inf create mode 100644 MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf create mode 100644 MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.uni -- 2.27.0.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#63944): https://edk2.groups.io/g/devel/message/63944 Mute This Topic: https://groups.io/mt/76119011/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] [Patch v2 0/2] Use RngLib instead of TimerLib for OpensslLib
I included a null lib and I was including the wrong version of Rng anyway. I think that would make sense to split them into two different DSC files. Typo fixed, good spot! -- - Matthew Carlson -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#63601): https://edk2.groups.io/g/devel/message/63601 Mute This Topic: https://groups.io/mt/75890825/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] [PATCH v3 1/3] CryptoPkg: OpensslLib: Use RngLib to generate entropy in rand_pool
From: Matthew Carlson
Changes OpenSSL to no longer depend on TimerLib and instead use RngLib.
This allows platforms to decide for themsevles what sort of entropy source
they provide to OpenSSL and TlsLib.
Cc: Jiewen Yao
Cc: Jian J Wang
Cc: Xiaoyu Lu
Signed-off-by: Matthew Carlson
---
CryptoPkg/Library/OpensslLib/rand_pool.c | 203 ++--
CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 ---
CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43 -
CryptoPkg/CryptoPkg.dsc| 1 +
CryptoPkg/Library/OpensslLib/OpensslLib.inf| 15 +-
CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 15 +-
CryptoPkg/Library/OpensslLib/rand_pool_noise.h | 29 ---
7 files changed, 22 insertions(+), 313 deletions(-)
diff --git a/CryptoPkg/Library/OpensslLib/rand_pool.c
b/CryptoPkg/Library/OpensslLib/rand_pool.c
index 9e0179b03490..b3ff03b2aa13 100644
--- a/CryptoPkg/Library/OpensslLib/rand_pool.c
+++ b/CryptoPkg/Library/OpensslLib/rand_pool.c
@@ -11,53 +11,18 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include
#include
-#include
-
-#include "rand_pool_noise.h"
-
-/**
- Get some randomness from low-order bits of GetPerformanceCounter results.
- And combine them to the 64-bit value
-
- @param[out] RandBuffer pointer to store the 64-bit random value.
-
- @retval TRUERandom number generated successfully.
- @retval FALSE Failed to generate.
-**/
-STATIC
-BOOLEAN
-EFIAPI
-GetRandNoise64FromPerformanceCounter(
- OUT UINT64 *Rand
- )
-{
- UINT32 Index;
- UINT32 *RandPtr;
-
- if (NULL == Rand) {
-return FALSE;
- }
-
- RandPtr = (UINT32 *) Rand;
-
- for (Index = 0; Index < 2; Index ++) {
-*RandPtr = (UINT32) (GetPerformanceCounter () & 0xFF);
-MicroSecondDelay (10);
-RandPtr++;
- }
-
- return TRUE;
-}
+#include
/**
Calls RandomNumber64 to fill
a buffer of arbitrary size with random bytes.
+ This is a shim layer to RngLib.
@param[in] LengthSize of the buffer, in bytes, to fill with.
@param[out] RandBufferPointer to the buffer to store the random result.
- @retval EFI_SUCCESSRandom bytes generation succeeded.
- @retval EFI_NOT_READY Failed to request random bytes.
+ @retval TrueRandom bytes generation succeeded.
+ @retval False Failed to request random bytes.
**/
STATIC
@@ -73,17 +38,17 @@ RandGetBytes (
Ret = FALSE;
+ if (RandBuffer == NULL) {
+DEBUG((DEBUG_ERROR, "[OPENSSL_RAND_POOL] NULL RandBuffer. No random
numbers are generated and your system is not secure\n"));
+ASSERT(FALSE); // Since we can't generate random numbers, we should
assert. Otherwise we will just blow up later.
+return Ret;
+ }
+
+
while (Length > 0) {
-//
-// Get random noise from platform.
-// If it failed, fallback to PerformanceCounter
-// If you really care about security, you must override
-// GetRandomNoise64FromPlatform.
-//
-Ret = GetRandomNoise64 ();
-if (Ret == FALSE) {
- Ret = GetRandNoise64FromPerformanceCounter ();
-}
+// Use RngLib to get random number
+Ret = GetRandomNumber64();
+
if (!Ret) {
return Ret;
}
@@ -100,125 +65,6 @@ RandGetBytes (
return Ret;
}
-/**
- Creates a 128bit random value that is fully forward and backward prediction
resistant,
- suitable for seeding a NIST SP800-90 Compliant.
- This function takes multiple random numbers from PerformanceCounter to
ensure reseeding
- and performs AES-CBC-MAC over the data to compute the seed value.
-
- @param[out] SeedBufferPointer to a 128bit buffer to store the random
seed.
-
- @retval TRUERandom seed generation succeeded.
- @retval FALSE Failed to request random bytes.
-
-**/
-STATIC
-BOOLEAN
-EFIAPI
-RandGetSeed128 (
- OUT UINT8*SeedBuffer
- )
-{
- BOOLEAN Ret;
- UINT8 RandByte[16];
- UINT8 Key[16];
- UINT8 Ffv[16];
- UINT8 Xored[16];
- UINT32 Index;
- UINT32 Index2;
- AES_KEY AESKey;
-
- //
- // Chose an arbitrary key and zero the feed_forward_value (FFV)
- //
- for (Index = 0; Index < 16; Index++) {
-Key[Index] = (UINT8) Index;
-Ffv[Index] = 0;
- }
-
- AES_set_encrypt_key (Key, 16 * 8, );
-
- //
- // Perform CBC_MAC over 32 * 128 bit values, with 10us gaps between 128 bit
value
- // The 10us gaps will ensure multiple reseeds within the system time with a
large
- // design margin.
- //
- for (Index = 0; Index < 32; Index++) {
-MicroSecondDelay (10);
-Ret = RandGetBytes (16, RandByte);
-if (!Ret) {
- return Ret;
-}
-
-//
-// Perform XOR operations on two 128-bit value.
-//
-for (Index2 = 0; Index2 < 16; Index2++) {
- Xored[Index2] = RandByte[Index2] ^ Ffv[Index2];
-}
-
-AES_encrypt (Xored, Ffv, );
- }
-
- for (Index = 0; Index < 16; Index++) {
-SeedBuffer
[edk2-devel] [PATCH v3 3/3] MdePkg: BaseRngLibDxe: Add RngLib that uses RngDxe
From: Matthew Carlson
Cc: Michael D Kinney
Cc: Liming Gao
Cc: Zhiguang Liu
Signed-off-by: Matthew Carlson
---
MdePkg/Library/BaseRngLibDxe/RngDxeLib.c | 216
MdePkg/Library/BaseRngLibDxe/BaseRngLibDxe.inf | 38
MdePkg/MdePkg.dsc | 4 +-
3 files changed, 257 insertions(+), 1 deletion(-)
diff --git a/MdePkg/Library/BaseRngLibDxe/RngDxeLib.c
b/MdePkg/Library/BaseRngLibDxe/RngDxeLib.c
new file mode 100644
index ..45bd6bad8f7a
--- /dev/null
+++ b/MdePkg/Library/BaseRngLibDxe/RngDxeLib.c
@@ -0,0 +1,216 @@
+/** @file
+ Provides an implementation of the library class RngLib that uses the Rng
protocol.
+
+Copyright (c) Microsoft Corporation. All rights reserved.
+SPDX-License-Identifier: BSD-2-Clause-Patent
+
+MU_CHANGE: New file
+
+**/
+#include
+#include
+#include
+#include
+#include
+
+/**
+Routine Description:
+
+Generates a random number via the NIST
+800-9A algorithm. Refer to
+http://csrc.nist.gov/groups/STM/cavp/documents/drbg/DRBGVS.pdf
+for more information.
+
+Arguments:
+
+Buffer -- Buffer to receive the random number.
+BufferSize -- Number of bytes in Buffer.
+
+Return Value:
+
+EFI_SUCCESS or underlying failure code.
+
+**/
+EFI_STATUS
+EFIAPI
+GenerateRandomNumberViaNist800Algorithm(
+ OUT UINT8* Buffer,
+ IN UINTN BufferSize
+ )
+{
+ EFI_STATUSStatus = EFI_SUCCESS;
+ EFI_RNG_PROTOCOL* RngProtocol = NULL;
+
+ if (Buffer == NULL)
+ {
+ DEBUG((DEBUG_ERROR, "[%a] Buffer == NULL.\n", __FUNCTION__));
+ return EFI_INVALID_PARAMETER;
+ }
+
+ if (gBS == NULL)
+ {
+ DEBUG((DEBUG_ERROR, "[%a] GenerateRandomNumber, gBS == NULL. Called too
soon.\n", __FUNCTION__));
+ return EFI_LOAD_ERROR;
+ }
+
+ Status = gBS->LocateProtocol(, NULL, (VOID
**));
+ if (EFI_ERROR(Status) || RngProtocol == NULL)
+ {
+ DEBUG((DEBUG_ERROR, "[%a] Could not locate RNG prototocol, Status =
%r\n", __FUNCTION__, Status));
+ return Status;
+ }
+
+ Status = RngProtocol->GetRNG(RngProtocol,
, BufferSize, Buffer);
+ DEBUG((DEBUG_INFO, "[%a] GetRNG algorithm CTR-256 - Status = %r\n",
__FUNCTION__, Status));
+ if(!EFI_ERROR(Status))
+ {
+return Status;
+ }
+
+ Status = RngProtocol->GetRNG(RngProtocol,
, BufferSize, Buffer);
+ DEBUG((DEBUG_INFO, "[%a] GetRNG algorithm HMAC-256 - Status = %r\n",
__FUNCTION__, Status));
+ if(!EFI_ERROR(Status))
+ {
+return Status;
+ }
+
+ Status = RngProtocol->GetRNG(RngProtocol,
, BufferSize, Buffer);
+ DEBUG((DEBUG_INFO, "[%a] GetRNG algorithm Hash-256 - Status = %r\n",
__FUNCTION__, Status));
+ if(!EFI_ERROR(Status))
+ {
+return Status;
+ }
+ // If we get to this point, we have failed
+ DEBUG((DEBUG_ERROR, "[%a] GetRNG() failed, staus = %r\n", __FUNCTION__,
Status));
+
+ return Status;
+}// GenerateRandomNumberViaNist800Algorithm()
+
+
+/**
+ Generates a 16-bit random number.
+
+ if Rand is NULL, return FALSE.
+
+ @param[out] Rand Buffer pointer to store the 16-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber16 (
+ OUT UINT16*Rand
+ )
+{
+ EFI_STATUS Status;
+
+ if (Rand == NULL)
+ {
+return FALSE;
+ }
+
+ Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 2);
+ if (EFI_ERROR(Status))
+ {
+return FALSE;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 32-bit random number.
+
+ if Rand is NULL, return FALSE.
+
+ @param[out] Rand Buffer pointer to store the 32-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber32 (
+ OUT UINT32*Rand
+ )
+{
+ EFI_STATUS Status;
+
+ if (Rand == NULL)
+ {
+return FALSE;
+ }
+
+ Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 4);
+ if (EFI_ERROR(Status))
+ {
+return FALSE;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 64-bit random number.
+
+ if Rand is NULL, return FALSE.
+
+ @param[out] Rand Buffer pointer to store the 64-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber64 (
+ OUT UINT64*Rand
+ )
+{
+ EFI_STATUS Status;
+
+ if (Rand == NULL)
+ {
+return FALSE;
+ }
+
+ Status = GenerateRandomNumberViaNist800Algorithm ((UINT8 *)Rand, 8);
+ if (EFI_ERROR(Status))
+ {
+return FALSE;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 128-bit random number.
+
+ if Rand is NULL, return FALSE.
+
+ @param[out] Rand Buffer pointer to store the 128-bit random value.
+
+ @retval TRUE Random number ge
[edk2-devel] [PATCH v3 0/3] Use RngLib instead of TimerLib for OpensslLib
From: Matthew Carlson Fixes Bugzilla#1871 https://github.com/tianocore/edk2/pull/845 Matthew Carlson (3): CryptoPkg: OpensslLib: Use RngLib to generate entropy in rand_pool MdePkg: TimerRngLib: Added RngLib that uses TimerLib MdePkg: BaseRngLibDxe: Add RngLib that uses RngDxe CryptoPkg/Library/OpensslLib/rand_pool.c | 203 ++ CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 --- CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43 MdePkg/Library/BaseRngLibDxe/RngDxeLib.c | 216 MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c | 154 ++ CryptoPkg/CryptoPkg.dsc | 1 + CryptoPkg/Library/OpensslLib/OpensslLib.inf | 15 +- CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf| 15 +- CryptoPkg/Library/OpensslLib/rand_pool_noise.h | 29 --- MdePkg/Library/BaseRngLibDxe/BaseRngLibDxe.inf | 38 MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf | 38 MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.uni | 17 ++ MdePkg/MdePkg.dsc| 5 +- 13 files changed, 489 insertions(+), 314 deletions(-) delete mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.c delete mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c create mode 100644 MdePkg/Library/BaseRngLibDxe/RngDxeLib.c create mode 100644 MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c delete mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.h create mode 100644 MdePkg/Library/BaseRngLibDxe/BaseRngLibDxe.inf create mode 100644 MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf create mode 100644 MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.uni -- 2.27.0.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#63592): https://edk2.groups.io/g/devel/message/63592 Mute This Topic: https://groups.io/mt/75915445/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] [PATCH v3 2/3] MdePkg: TimerRngLib: Added RngLib that uses TimerLib
From: Matthew Carlson
Added a new RngLib that provides random numbers from the TimerLib
using the performance counter. This is meant to be used for OpenSSL
to replicate past behavior. This should not be used in production as
a real source of entropy.
Cc: Michael D Kinney
Cc: Liming Gao
Cc: Zhiguang Liu
Signed-off-by: Matthew Carlson
---
MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c | 154
MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf | 38 +
MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.uni | 17 +++
MdePkg/MdePkg.dsc| 3 +-
4 files changed, 211 insertions(+), 1 deletion(-)
diff --git a/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
b/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
new file mode 100644
index ..8244a740555c
--- /dev/null
+++ b/MdePkg/Library/BaseRngLibTimerLib/RngLibTimer.c
@@ -0,0 +1,154 @@
+/** @file
+ BaseRng Library that uses the TimerLib to provide reasonably random numbers.
+ Do not use this on a production system.
+
+ Copyright (c) Microsoft Corporation.
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#include
+#include
+#include
+#include
+
+
+/**
+ Generates a 16-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 16-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber16 (
+ OUT UINT16*Rand
+ )
+{
+ UINT32 Index;
+ UINT8* RandPtr;
+
+ ASSERT (Rand != NULL);
+
+ if (NULL == Rand) {
+return FALSE;
+ }
+
+ RandPtr = (UINT8 *) Rand;
+ // Get 2 bytes of random ish data
+ // This should take around 10ms
+ for (Index = 0; Index < 2; Index ++) {
+*RandPtr = (UINT8) (GetPerformanceCounter () & 0xFF);
+MicroSecondDelay (5); // delay to give chance for performance counter to
catch up
+RandPtr++;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 32-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 32-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber32 (
+ OUT UINT32*Rand
+ )
+{
+ UINT32 Index;
+ UINT8* RandPtr;
+
+ ASSERT (Rand != NULL);
+
+ if (NULL == Rand) {
+return FALSE;
+ }
+
+ RandPtr = (UINT8 *) Rand;
+ // Get 4 bytes of random ish data
+ // This should take around 20ms
+ for (Index = 0; Index < 4; Index ++) {
+*RandPtr = (UINT8) (GetPerformanceCounter () & 0xFF);
+MicroSecondDelay (5); // delay to give chance for performance counter to
catch up
+RandPtr++;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 64-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 64-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber64 (
+ OUT UINT64*Rand
+ )
+{
+ UINT32 Index;
+ UINT8* RandPtr;
+
+ ASSERT (Rand != NULL);
+
+ if (NULL == Rand) {
+return FALSE;
+ }
+
+ RandPtr = (UINT8 *) Rand;
+ // Get 8 bytes of random ish data
+ // This should take around 40ms
+ for (Index = 0; Index < 8; Index ++) {
+*RandPtr = (UINT8) (GetPerformanceCounter () & 0xFF);
+MicroSecondDelay (5); // delay to give chance for performance counter to
catch up
+RandPtr++;
+ }
+
+ return TRUE;
+}
+
+/**
+ Generates a 128-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 128-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber128 (
+ OUT UINT64*Rand
+ )
+{
+ ASSERT (Rand != NULL);
+ // This should take around 80ms
+
+ // Read first 64 bits
+ if (!GetRandomNumber64 (Rand)) {
+return FALSE;
+ }
+
+ // Read second 64 bits
+ return GetRandomNumber64 (++Rand);
+}
diff --git a/MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf
b/MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf
new file mode 100644
index ..0d20fd13c1da
--- /dev/null
+++ b/MdePkg/Library/BaseRngLibTimerLib/BaseRngLibTimerLib.inf
@@ -0,0 +1,38 @@
+## @file
+# Instance of RNG (Random Number Generator) Library.
+#
+# BaseRng Library that uses the TimerLib to provide reasonably random numbers.
+# Do not use this on a production system as this uses the system performance
+# counter rather than a true source of random in addition to have a weak
random
+# algorithm.
+#
+# Copyright (c) Microsoft Corporation. All rights reserved.
+#
+# SPDX-Lice
Re: [edk2-devel] [Patch v2 0/2] Use RngLib instead of TimerLib for OpensslLib
Hey Mike! Thanks for the comments. I've addressed the feedback below. 1. All good comments. I think I've addressed them all. New patch series should be coming soon. 2. This is a problem for BaseCryptLibOnProtocol. We can't use a null lib for RngLib since it explodes when it tries to seed OpenSSL with entropy. I think for now, let's stick with established dependencies and figure this out at a later date. I added an RngLib that uses the DXE RNG Protocol. 3. I don't see a typo? Calls RandomNumber64 to fill a buffer of arbitrary size with random bytes. @param [in] LengthSize of the buffer, in bytes, to fill with. @param [out] RandBufferPointer to the buffer to store the random result. @retval TrueRandom bytes generation succeeded. @retval False Failed to request random bytes. -- - Matthew Carlson -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#63591): https://edk2.groups.io/g/devel/message/63591 Mute This Topic: https://groups.io/mt/75890825/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] [Patch v2 2/2] MdePkg: TimerRngLib: Added RngLib that uses TimerLib
From: Matthew Carlson
Added a new RngLib that provides random numbers from the TimerLib
using the performance counter. This is meant to be used for OpenSSL
to replicate past behavior. This should not be used in production as
a real source of entropy.
Cc: Michael D Kinney
Cc: Liming Gao
Cc: Zhiguang Liu
Signed-off-by: Matthew Carlson
---
MdePkg/Library/BaseRngLibTimer/RngLibTimer.c | 153
MdePkg/Library/BaseRngLibTimer/BaseRngLibTimer.inf | 37 +
MdePkg/Library/BaseRngLibTimer/BaseRngLibTimer.uni | 17 +++
MdePkg/MdePkg.dsc | 1 +
4 files changed, 208 insertions(+)
diff --git a/MdePkg/Library/BaseRngLibTimer/RngLibTimer.c
b/MdePkg/Library/BaseRngLibTimer/RngLibTimer.c
new file mode 100644
index ..1b0f7f04c01d
--- /dev/null
+++ b/MdePkg/Library/BaseRngLibTimer/RngLibTimer.c
@@ -0,0 +1,153 @@
+/** @file
+ BaseRng Library that uses the TimerLib to provide reasonably random numbers.
+ Do not use this on a production system.
+
+ Copyright (c) Microsoft Corporation.
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#include
+#include
+#include
+#include
+
+/**
+ Generates a 16-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 16-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber16 (
+ OUT UINT16*Rand
+ )
+{
+ UINT32 Index;
+ UINT8* RandPtr;
+
+ ASSERT (Rand != NULL);
+
+ if (NULL == Rand) {
+return FALSE;
+ }
+
+ RandPtr = (UINT8 *) Rand;
+ // Get 2 bytes of random ish data
+ for (Index = 0; Index < 2; Index ++) {
+*RandPtr = (UINT8) (GetPerformanceCounter () & 0xFF);
+MicroSecondDelay (4);
+RandPtr++;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 32-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 32-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber32 (
+ OUT UINT32*Rand
+ )
+{
+ UINT32 Index;
+ UINT8* RandPtr;
+
+ ASSERT (Rand != NULL);
+
+ if (NULL == Rand) {
+return FALSE;
+ }
+
+ RandPtr = (UINT8 *) Rand;
+ // Get 4 bytes of random ish data
+ for (Index = 0; Index < 4; Index ++) {
+*RandPtr = (UINT8) (GetPerformanceCounter () & 0xFF);
+MicroSecondDelay (2);
+RandPtr++;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 64-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 64-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber64 (
+ OUT UINT64*Rand
+ )
+{
+ UINT32 Index;
+ UINT8* RandPtr;
+
+ ASSERT (Rand != NULL);
+
+ if (NULL == Rand) {
+return FALSE;
+ }
+
+ RandPtr = (UINT8 *) Rand;
+ // Get 8 bytes of random ish data
+ for (Index = 0; Index < 8; Index ++) {
+*RandPtr = (UINT8) (GetPerformanceCounter () & 0xFF);
+MicroSecondDelay (1);
+RandPtr++;
+ }
+
+ return TRUE;
+}
+
+/**
+ Generates a 128-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 128-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber128 (
+ OUT UINT64*Rand
+ )
+{
+ ASSERT (Rand != NULL);
+
+ //
+ // Read first 64 bits
+ //
+ if (!GetRandomNumber64 (Rand)) {
+return FALSE;
+ }
+
+ //
+ // Read second 64 bits
+ //
+ return GetRandomNumber64 (++Rand);
+}
diff --git a/MdePkg/Library/BaseRngLibTimer/BaseRngLibTimer.inf
b/MdePkg/Library/BaseRngLibTimer/BaseRngLibTimer.inf
new file mode 100644
index ..c5561fe04c53
--- /dev/null
+++ b/MdePkg/Library/BaseRngLibTimer/BaseRngLibTimer.inf
@@ -0,0 +1,37 @@
+## @file
+# Instance of RNG (Random Number Generator) Library.
+#
+# BaseRng Library that uses the TimerLib to provide reasonably random numbers.
+# Do not use this on a production system.
+#
+# Copyright (c) Microsoft Corporation. All rights reserved.
+#
+# SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+#
+##
+
+[Defines]
+ INF_VERSION= 0x00010005
+ BASE_NAME = BaseRngLibTimer
+ MODULE_UNI_FILE= BaseRngLibTimer.uni
+ FILE_GUID = 74950C45-10FC-4AB5-B114-49C87C17409B
+ MODULE_TYPE= BASE
+ VERSION_STRING = 1.0
+ LIBRARY_CLASS = RngLib
+ CONSTRUCTOR= BaseRngLibConstructor
+
+#
+# VALID_ARCHITECTURES
[edk2-devel] [Patch v2 0/2] Use RngLib instead of TimerLib for OpensslLib
From: Matthew Carlson This fixes bugzilla 1871. See PR here: https://github.com/tianocore/edk2/pull/831 Matthew Carlson (2): CryptoPkg: OpensslLib: Use RngLib to generate entropy in rand_pool MdePkg: TimerRngLib: Added RngLib that uses TimerLib CryptoPkg/Library/OpensslLib/rand_pool.c | 202 ++-- CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 --- CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43 - MdePkg/Library/BaseRngLibTimer/RngLibTimer.c | 153 +++ CryptoPkg/CryptoPkg.dsc| 2 + CryptoPkg/Library/OpensslLib/OpensslLib.inf| 15 +- CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 15 +- CryptoPkg/Library/OpensslLib/rand_pool_noise.h | 29 --- MdePkg/Library/BaseRngLibTimer/BaseRngLibTimer.inf | 37 MdePkg/Library/BaseRngLibTimer/BaseRngLibTimer.uni | 17 ++ MdePkg/MdePkg.dsc | 1 + 11 files changed, 230 insertions(+), 313 deletions(-) delete mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.c delete mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c create mode 100644 MdePkg/Library/BaseRngLibTimer/RngLibTimer.c delete mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.h create mode 100644 MdePkg/Library/BaseRngLibTimer/BaseRngLibTimer.inf create mode 100644 MdePkg/Library/BaseRngLibTimer/BaseRngLibTimer.uni -- 2.27.0.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#63474): https://edk2.groups.io/g/devel/message/63474 Mute This Topic: https://groups.io/mt/75890825/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] [Patch v2 1/2] CryptoPkg: OpensslLib: Use RngLib to generate entropy in rand_pool
From: Matthew Carlson
Changes OpenSSL to no longer depend on TimerLib and instead use RngLib.
This allows platforms to decide for themsevles what sort of entropy source
they provide to OpenSSL and TlsLib.
Cc: Jiewen Yao
Cc: Jian J Wang
Cc: Xiaoyu Lu
Signed-off-by: Matthew Carlson
---
CryptoPkg/Library/OpensslLib/rand_pool.c | 202 ++--
CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 ---
CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43 -
CryptoPkg/CryptoPkg.dsc| 2 +
CryptoPkg/Library/OpensslLib/OpensslLib.inf| 15 +-
CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 15 +-
CryptoPkg/Library/OpensslLib/rand_pool_noise.h | 29 ---
7 files changed, 22 insertions(+), 313 deletions(-)
diff --git a/CryptoPkg/Library/OpensslLib/rand_pool.c
b/CryptoPkg/Library/OpensslLib/rand_pool.c
index 9e0179b03490..b3ce71543bab 100644
--- a/CryptoPkg/Library/OpensslLib/rand_pool.c
+++ b/CryptoPkg/Library/OpensslLib/rand_pool.c
@@ -11,43 +11,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include
#include
-#include
-
-#include "rand_pool_noise.h"
-
-/**
- Get some randomness from low-order bits of GetPerformanceCounter results.
- And combine them to the 64-bit value
-
- @param[out] RandBuffer pointer to store the 64-bit random value.
-
- @retval TRUERandom number generated successfully.
- @retval FALSE Failed to generate.
-**/
-STATIC
-BOOLEAN
-EFIAPI
-GetRandNoise64FromPerformanceCounter(
- OUT UINT64 *Rand
- )
-{
- UINT32 Index;
- UINT32 *RandPtr;
-
- if (NULL == Rand) {
-return FALSE;
- }
-
- RandPtr = (UINT32 *) Rand;
-
- for (Index = 0; Index < 2; Index ++) {
-*RandPtr = (UINT32) (GetPerformanceCounter () & 0xFF);
-MicroSecondDelay (10);
-RandPtr++;
- }
-
- return TRUE;
-}
+#include
/**
Calls RandomNumber64 to fill
@@ -56,8 +20,8 @@ GetRandNoise64FromPerformanceCounter(
@param[in] LengthSize of the buffer, in bytes, to fill with.
@param[out] RandBufferPointer to the buffer to store the random result.
- @retval EFI_SUCCESSRandom bytes generation succeeded.
- @retval EFI_NOT_READY Failed to request random bytes.
+ @retval TrueRandom bytes generation succeeded.
+ @retval False Failed to request random bytes.
**/
STATIC
@@ -73,17 +37,17 @@ RandGetBytes (
Ret = FALSE;
+ if (RandBuffer == NULL) {
+DEBUG((DEBUG_ERROR, "[OPENSSL_RAND_POOL] NULL RandBuffer. No random
numbers are generated and your system is not secure\n"));
+ASSERT(FALSE); // Since we can't generate random numbers, we should
assert. Otherwise we will just blow up later.
+return Ret;
+ }
+
+
while (Length > 0) {
-//
-// Get random noise from platform.
-// If it failed, fallback to PerformanceCounter
-// If you really care about security, you must override
-// GetRandomNoise64FromPlatform.
-//
-Ret = GetRandomNoise64 ();
-if (Ret == FALSE) {
- Ret = GetRandNoise64FromPerformanceCounter ();
-}
+// Use RngLib to get random number
+Ret = GetRandomNumber64();
+
if (!Ret) {
return Ret;
}
@@ -100,125 +64,6 @@ RandGetBytes (
return Ret;
}
-/**
- Creates a 128bit random value that is fully forward and backward prediction
resistant,
- suitable for seeding a NIST SP800-90 Compliant.
- This function takes multiple random numbers from PerformanceCounter to
ensure reseeding
- and performs AES-CBC-MAC over the data to compute the seed value.
-
- @param[out] SeedBufferPointer to a 128bit buffer to store the random
seed.
-
- @retval TRUERandom seed generation succeeded.
- @retval FALSE Failed to request random bytes.
-
-**/
-STATIC
-BOOLEAN
-EFIAPI
-RandGetSeed128 (
- OUT UINT8*SeedBuffer
- )
-{
- BOOLEAN Ret;
- UINT8 RandByte[16];
- UINT8 Key[16];
- UINT8 Ffv[16];
- UINT8 Xored[16];
- UINT32 Index;
- UINT32 Index2;
- AES_KEY AESKey;
-
- //
- // Chose an arbitrary key and zero the feed_forward_value (FFV)
- //
- for (Index = 0; Index < 16; Index++) {
-Key[Index] = (UINT8) Index;
-Ffv[Index] = 0;
- }
-
- AES_set_encrypt_key (Key, 16 * 8, );
-
- //
- // Perform CBC_MAC over 32 * 128 bit values, with 10us gaps between 128 bit
value
- // The 10us gaps will ensure multiple reseeds within the system time with a
large
- // design margin.
- //
- for (Index = 0; Index < 32; Index++) {
-MicroSecondDelay (10);
-Ret = RandGetBytes (16, RandByte);
-if (!Ret) {
- return Ret;
-}
-
-//
-// Perform XOR operations on two 128-bit value.
-//
-for (Index2 = 0; Index2 < 16; Index2++) {
- Xored[Index2] = RandByte[Index2] ^ Ffv[Index2];
-}
-
-AES_encrypt (Xored, Ffv, );
- }
-
- for (Index = 0; Index < 16; Index++) {
-SeedBuffer[Index] = Ffv[Index];
- }
-
- return Ret;
[edk2-devel] [PATCH v1 1/2] CryptoPkg: OpensslLib: Use RngLib to generate entropy in rand_pool
From: Matthew Carlson
Changes OpenSSL to no longer depend on TimerLib and instead use RngLib.
This allows platforms to decide for themsevles what sort of entropy source
they provide to OpenSSL and TlsLib.
Cc: Jiewen Yao
Cc: Jian J Wang
Cc: Xiaoyu Lu
Signed-off-by: Matthew Carlson
---
CryptoPkg/Library/OpensslLib/rand_pool.c | 200 ++--
CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 ---
CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43 -
CryptoPkg/Library/OpensslLib/OpensslLib.inf| 15 +-
CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 15 +-
CryptoPkg/Library/OpensslLib/rand_pool_noise.h | 29 ---
6 files changed, 20 insertions(+), 311 deletions(-)
diff --git a/CryptoPkg/Library/OpensslLib/rand_pool.c
b/CryptoPkg/Library/OpensslLib/rand_pool.c
index 9e0179b03490..55bf6c9c6950 100644
--- a/CryptoPkg/Library/OpensslLib/rand_pool.c
+++ b/CryptoPkg/Library/OpensslLib/rand_pool.c
@@ -11,44 +11,10 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
#include
#include
-#include
+#include
#include "rand_pool_noise.h"
-/**
- Get some randomness from low-order bits of GetPerformanceCounter results.
- And combine them to the 64-bit value
-
- @param[out] RandBuffer pointer to store the 64-bit random value.
-
- @retval TRUERandom number generated successfully.
- @retval FALSE Failed to generate.
-**/
-STATIC
-BOOLEAN
-EFIAPI
-GetRandNoise64FromPerformanceCounter(
- OUT UINT64 *Rand
- )
-{
- UINT32 Index;
- UINT32 *RandPtr;
-
- if (NULL == Rand) {
-return FALSE;
- }
-
- RandPtr = (UINT32 *) Rand;
-
- for (Index = 0; Index < 2; Index ++) {
-*RandPtr = (UINT32) (GetPerformanceCounter () & 0xFF);
-MicroSecondDelay (10);
-RandPtr++;
- }
-
- return TRUE;
-}
-
/**
Calls RandomNumber64 to fill
a buffer of arbitrary size with random bytes.
@@ -56,8 +22,8 @@ GetRandNoise64FromPerformanceCounter(
@param[in] LengthSize of the buffer, in bytes, to fill with.
@param[out] RandBufferPointer to the buffer to store the random result.
- @retval EFI_SUCCESSRandom bytes generation succeeded.
- @retval EFI_NOT_READY Failed to request random bytes.
+ @retval TrueRandom bytes generation succeeded.
+ @retval False Failed to request random bytes.
**/
STATIC
@@ -73,17 +39,17 @@ RandGetBytes (
Ret = FALSE;
+ if (RandBuffer == NULL) {
+DEBUG((DEBUG_ERROR, "[OPENSSL_RAND_POOL] NULL RandBuffer. No random
numbers are generated and your system is not secure\n"));
+ASSERT(FALSE); // Since we can't generate random numbers, we should
assert. Otherwise we will just blow up later.
+return Ret;
+ }
+
+
while (Length > 0) {
-//
-// Get random noise from platform.
-// If it failed, fallback to PerformanceCounter
-// If you really care about security, you must override
-// GetRandomNoise64FromPlatform.
-//
-Ret = GetRandomNoise64 ();
-if (Ret == FALSE) {
- Ret = GetRandNoise64FromPerformanceCounter ();
-}
+// Use RngLib to get random number
+Ret = GetRandomNumber64();
+
if (!Ret) {
return Ret;
}
@@ -100,125 +66,6 @@ RandGetBytes (
return Ret;
}
-/**
- Creates a 128bit random value that is fully forward and backward prediction
resistant,
- suitable for seeding a NIST SP800-90 Compliant.
- This function takes multiple random numbers from PerformanceCounter to
ensure reseeding
- and performs AES-CBC-MAC over the data to compute the seed value.
-
- @param[out] SeedBufferPointer to a 128bit buffer to store the random
seed.
-
- @retval TRUERandom seed generation succeeded.
- @retval FALSE Failed to request random bytes.
-
-**/
-STATIC
-BOOLEAN
-EFIAPI
-RandGetSeed128 (
- OUT UINT8*SeedBuffer
- )
-{
- BOOLEAN Ret;
- UINT8 RandByte[16];
- UINT8 Key[16];
- UINT8 Ffv[16];
- UINT8 Xored[16];
- UINT32 Index;
- UINT32 Index2;
- AES_KEY AESKey;
-
- //
- // Chose an arbitrary key and zero the feed_forward_value (FFV)
- //
- for (Index = 0; Index < 16; Index++) {
-Key[Index] = (UINT8) Index;
-Ffv[Index] = 0;
- }
-
- AES_set_encrypt_key (Key, 16 * 8, );
-
- //
- // Perform CBC_MAC over 32 * 128 bit values, with 10us gaps between 128 bit
value
- // The 10us gaps will ensure multiple reseeds within the system time with a
large
- // design margin.
- //
- for (Index = 0; Index < 32; Index++) {
-MicroSecondDelay (10);
-Ret = RandGetBytes (16, RandByte);
-if (!Ret) {
- return Ret;
-}
-
-//
-// Perform XOR operations on two 128-bit value.
-//
-for (Index2 = 0; Index2 < 16; Index2++) {
- Xored[Index2] = RandByte[Index2] ^ Ffv[Index2];
-}
-
-AES_encrypt (Xored, Ffv, );
- }
-
- for (Index = 0; Index < 16; Index++) {
-SeedBuffer[Index] = Ffv[Index];
- }
-
- return Ret;
-}
-
-/
[edk2-devel] [PATCH v1 2/2] MdePkg: TimerRngLib: Added RngLib that uses TimerLib
From: Matthew Carlson
Added a new RngLib that provides random numbers from the TimerLib
using the performance counter. This is meant to be used for OpenSSL
to replicate past behavior. This should not be used in production as
a real source of entropy.
Cc: Michael D Kinney
Cc: Liming Gao
Cc: Zhiguang Liu
Signed-off-by: Matthew Carlson
---
MdePkg/Library/TimerRngLib/TimerRng.c | 153
MdePkg/Library/TimerRngLib/TimerRngLib.inf | 37 +
MdePkg/MdePkg.dsc | 2 +
3 files changed, 192 insertions(+)
diff --git a/MdePkg/Library/TimerRngLib/TimerRng.c
b/MdePkg/Library/TimerRngLib/TimerRng.c
new file mode 100644
index ..1b0f7f04c01d
--- /dev/null
+++ b/MdePkg/Library/TimerRngLib/TimerRng.c
@@ -0,0 +1,153 @@
+/** @file
+ BaseRng Library that uses the TimerLib to provide reasonably random numbers.
+ Do not use this on a production system.
+
+ Copyright (c) Microsoft Corporation.
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#include
+#include
+#include
+#include
+
+/**
+ Generates a 16-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 16-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber16 (
+ OUT UINT16*Rand
+ )
+{
+ UINT32 Index;
+ UINT8* RandPtr;
+
+ ASSERT (Rand != NULL);
+
+ if (NULL == Rand) {
+return FALSE;
+ }
+
+ RandPtr = (UINT8 *) Rand;
+ // Get 2 bytes of random ish data
+ for (Index = 0; Index < 2; Index ++) {
+*RandPtr = (UINT8) (GetPerformanceCounter () & 0xFF);
+MicroSecondDelay (4);
+RandPtr++;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 32-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 32-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber32 (
+ OUT UINT32*Rand
+ )
+{
+ UINT32 Index;
+ UINT8* RandPtr;
+
+ ASSERT (Rand != NULL);
+
+ if (NULL == Rand) {
+return FALSE;
+ }
+
+ RandPtr = (UINT8 *) Rand;
+ // Get 4 bytes of random ish data
+ for (Index = 0; Index < 4; Index ++) {
+*RandPtr = (UINT8) (GetPerformanceCounter () & 0xFF);
+MicroSecondDelay (2);
+RandPtr++;
+ }
+ return TRUE;
+}
+
+/**
+ Generates a 64-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 64-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber64 (
+ OUT UINT64*Rand
+ )
+{
+ UINT32 Index;
+ UINT8* RandPtr;
+
+ ASSERT (Rand != NULL);
+
+ if (NULL == Rand) {
+return FALSE;
+ }
+
+ RandPtr = (UINT8 *) Rand;
+ // Get 8 bytes of random ish data
+ for (Index = 0; Index < 8; Index ++) {
+*RandPtr = (UINT8) (GetPerformanceCounter () & 0xFF);
+MicroSecondDelay (1);
+RandPtr++;
+ }
+
+ return TRUE;
+}
+
+/**
+ Generates a 128-bit random number.
+
+ if Rand is NULL, then ASSERT().
+
+ @param[out] Rand Buffer pointer to store the 128-bit random value.
+
+ @retval TRUE Random number generated successfully.
+ @retval FALSEFailed to generate the random number.
+
+**/
+BOOLEAN
+EFIAPI
+GetRandomNumber128 (
+ OUT UINT64*Rand
+ )
+{
+ ASSERT (Rand != NULL);
+
+ //
+ // Read first 64 bits
+ //
+ if (!GetRandomNumber64 (Rand)) {
+return FALSE;
+ }
+
+ //
+ // Read second 64 bits
+ //
+ return GetRandomNumber64 (++Rand);
+}
diff --git a/MdePkg/Library/TimerRngLib/TimerRngLib.inf
b/MdePkg/Library/TimerRngLib/TimerRngLib.inf
new file mode 100644
index ..a80a89b77e72
--- /dev/null
+++ b/MdePkg/Library/TimerRngLib/TimerRngLib.inf
@@ -0,0 +1,37 @@
+## @file
+# Instance of RNG (Random Number Generator) Library.
+#
+# BaseRng Library that uses the TimerLib to provide reasonably random numbers.
+# Do not use this on a production system.
+#
+# Copyright (c) Microsoft Corporation. All rights reserved.
+#
+# SPDX-License-Identifier: BSD-2-Clause-Patent
+#
+#
+##
+
+[Defines]
+ INF_VERSION= 0x00010005
+ BASE_NAME = BaseRngLib
+ MODULE_UNI_FILE= BaseRngLib.uni
+ FILE_GUID = 74950C45-10FC-4AB5-B114-49C87C17409B
+ MODULE_TYPE= BASE
+ VERSION_STRING = 1.0
+ LIBRARY_CLASS = RngLib
+ CONSTRUCTOR= BaseRngLibConstructor
+
+#
+# VALID_ARCHITECTURES = IA32 X64
+#
+
+[Sources]
+ TimerRng.c
+
+[Packages]
+ MdePkg/MdePkg.dec
+
+[LibraryClasses]
+ BaseLib
+ DebugLib
+ TimerLi
[edk2-devel] [PATCH v1 0/2] Use RngLib instead of TimerLib for OpensslLib
From: Matthew Carlson This fixes bugzilla 1871. Matthew Carlson (2): CryptoPkg: OpensslLib: Use RngLib to generate entropy in rand_pool MdePkg: TimerRngLib: Added RngLib that uses TimerLib CryptoPkg/Library/OpensslLib/rand_pool.c | 200 ++-- CryptoPkg/Library/OpensslLib/rand_pool_noise.c | 29 --- CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c | 43 - MdePkg/Library/TimerRngLib/TimerRng.c | 153 +++ CryptoPkg/Library/OpensslLib/OpensslLib.inf| 15 +- CryptoPkg/Library/OpensslLib/OpensslLibCrypto.inf | 15 +- CryptoPkg/Library/OpensslLib/rand_pool_noise.h | 29 --- MdePkg/Library/TimerRngLib/TimerRngLib.inf | 37 MdePkg/MdePkg.dsc | 2 + 9 files changed, 212 insertions(+), 311 deletions(-) delete mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.c delete mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise_tsc.c create mode 100644 MdePkg/Library/TimerRngLib/TimerRng.c delete mode 100644 CryptoPkg/Library/OpensslLib/rand_pool_noise.h create mode 100644 MdePkg/Library/TimerRngLib/TimerRngLib.inf -- 2.27.0.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#63371): https://edk2.groups.io/g/devel/message/63371 Mute This Topic: https://groups.io/mt/75836596/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] [PATCH v3 2/3] CryptoPkg: BaseCryptLib: Add unit tests (Host and Shell based)
You hit the nail on the head. I think it's a reasonable limitation to not test the CrtWrapper functions. Our goal is to test the crypto functions and I think the current tests do a decent job of that. The idea of adding some of these limitations to the inf and header files could be useful, I'll do a v5 and add it in. -Matthew Carlson On Wed, Jul 15, 2020 at 12:03 PM Kinney, Michael D < michael.d.kin...@intel.com> wrote: > Matt, > > > > For (4) and (5) I think I see the issue. Host based unit tests always > link against the standard C lib for the host OS env and > > those are in conflict with some if the wrappers that are provided to make > OpenSSL work in an EDK II FW build env. > > > > So the approach to unit testing BaseCryptLib is not to test the actually > lib instances used in FW, but to instead test the > > source code of the BaseCryptLib that is used by the FW specific instances. > There is a small chance of some differences > > that may not be caught, but we can get really good unit test coverage for > the source code that is identical in both host > > and FW instances. If this is a correct assessment, you may want to add > some of this information to the INF file header of > > and source file headers for the unit tests. > > > > Thanks, > > > > Mike > > > > *From:* Matthew Carlson > *Sent:* Wednesday, July 15, 2020 11:16 AM > *To:* Kinney, Michael D > *Cc:* devel@edk2.groups.io; Wang, Jian J ; Lu, > XiaoyuX > *Subject:* Re: [edk2-devel] [PATCH v3 2/3] CryptoPkg: BaseCryptLib: Add > unit tests (Host and Shell based) > > > > Hey Mike, > > > > 1. I'll move it for v4. > > 2. I'll remove that, thanks! > > 3. I'll fix that as well, good spot. > > 4. It's mostly the same except for the different CrtWrappers > > 5. We need a host-specific CrtWrapper since the regular one has a bunch of > conflicts with regular C98, but there are a few functions that since we're > building no std mode of OpenSSL we still need to provide. > > 6. That would be my guess- this is largely based on the edk2-staging HBFA > branch and I've had to reverse engineer some of the steps for > generating the test data. I fixed the instructions. > > > -Matthew Carlson > > > > > > On Tue, Jul 14, 2020 at 7:53 PM Kinney, Michael D < > michael.d.kin...@intel.com> wrote: > > Hi Matt, > > I think the BaseCryptLib unit tests may need some more work. > > 1) The DSC file for host based tests is in the wrong directory. >It should be in CryptoPkg/Test to match the MdePkg, MdeModulePkg >and UnitTestFrameworkPkg location. > > 2) CryptoPkg/CryptoPkg.dsc includes a reference to the host based >library UnitTestHostBaseCryptLib.inf. This should only be >listed in the host based DSC file. > > 3) CryptoPkg\Library\BaseCryptLib\UnitTestHostBaseCryptLib.inf >This file appears to only be for host based tests, but it >lists compatibility with DXE_DRIVER DXE_CORE UEFI_APPLICATION > UEFI_DRIVER >and does not list HOST_APPLICATION as expected. > > 4) Why do we need a new lib instance of the BaseCryptLib for >host based unit testing. I would think we would want to perform >unit tests on the BaseCryptLib instances that would actually be >used in FW components. Can we update the unit tests to test >the services provided in the Base, Pei, Runtime, and Smm >instances of the BaseCryptLib? > > 5) Why do we need a host based specific version of the CrtWrapper, >UnitTestHostCrtWrapper.c? > > 6) The file CryptoPkg/Test/UnitTest/Librray/BaseCryptLib/TestEKUCerts/ >ChainCreationInstructions.txt makes reference to a bintohex tool >and putting the results in a file called AllTestSignatures.h. >But I do not see this file in the patch. Are these instructions >out of date? > > Thanks, > > Mike > > -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#62645): https://edk2.groups.io/g/devel/message/62645 Mute This Topic: https://groups.io/mt/75505002/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] [PATCH v4 0/3] Add Unit Tests for BaseCryptLib to CryptoPkg
From: Matthew Carlson This turns on Host Based Unit Tests for CryptoPkg, adds the unit test itself, and adds a POSIX BaseTimerLib for unit tests. Matthew Carlson (3): UnitTestFrameworkPkg : BaseTimerLibPosix: Adds a host-based timer Lib CryptoPkg: BaseCryptLib: Add unit tests (Host and Shell based) AzurePipelines : Pr Gate: Turn on HBUT for CryptoPkg CryptoPkg/Library/BaseCryptLib/SysCall/UnitTestHostCrtWrapper.c | 93 ++ CryptoPkg/Test/UnitTest/Library/BaseCryptLib/AuthenticodeTests.c | 1002 CryptoPkg/Test/UnitTest/Library/BaseCryptLib/BaseCryptLibUnitTests.c | 66 ++ CryptoPkg/Test/UnitTest/Library/BaseCryptLib/BlockCipherTests.c | 293 ++ CryptoPkg/Test/UnitTest/Library/BaseCryptLib/DhTests.c | 106 +++ CryptoPkg/Test/UnitTest/Library/BaseCryptLib/HashTests.c | 197 CryptoPkg/Test/UnitTest/Library/BaseCryptLib/HmacTests.c | 184 CryptoPkg/Test/UnitTest/Library/BaseCryptLib/OaepEncryptTests.c | 308 ++ CryptoPkg/Test/UnitTest/Library/BaseCryptLib/Pkcs5Pbkdf2Tests.c | 71 ++ CryptoPkg/Test/UnitTest/Library/BaseCryptLib/Pkcs7EkuTests.c | 524 ++ CryptoPkg/Test/UnitTest/Library/BaseCryptLib/RandTests.c | 51 + CryptoPkg/Test/UnitTest/Library/BaseCryptLib/RsaPkcs7Tests.c | 415 CryptoPkg/Test/UnitTest/Library/BaseCryptLib/RsaTests.c | 310 ++ CryptoPkg/Test/UnitTest/Library/BaseCryptLib/TSTests.c | 335 +++ CryptoPkg/Test/UnitTest/Library/BaseCryptLib/UnitTestMain.c | 81 ++ CryptoPkg/Test/UnitTest/Library/BaseCryptLib/UnitTestMainBCOP.c | 58 ++ UnitTestFrameworkPkg/Library/Posix/BaseTimerLibPosix/TimerLibPosix.c | 132 +++ .azurepipelines/templates/pr-gate-build-job.yml |2 +- CryptoPkg/CryptoPkg.ci.yaml |4 + CryptoPkg/CryptoPkg.dsc | 25 + CryptoPkg/Library/BaseCryptLib/UnitTestHostBaseCryptLib.inf | 90 ++ CryptoPkg/Test/CryptoPkgHostUnitTest.dsc | 35 + CryptoPkg/Test/UnitTest/Library/BaseCryptLib/Pkcs7EkuTestSignatures.h | 789 +++ CryptoPkg/Test/UnitTest/Library/BaseCryptLib/TestBaseCryptLib.h | 121 +++ CryptoPkg/Test/UnitTest/Library/BaseCryptLib/TestBaseCryptLibHost.inf | 46 + CryptoPkg/Test/UnitTest/Library/BaseCryptLib/TestBaseCryptLibUefiShell.inf | 49 + CryptoPkg/Test/UnitTest/Library/BaseCryptLib/TestEKUCerts/ChainCreationInstructions.txt | 92 ++ CryptoPkg/Test/UnitTest/Library/BaseCryptLib/TestEKUCerts/CreateTestCerts.cmd | 11 + CryptoPkg/Test/UnitTest/Library/BaseCryptLib/TestEKUCerts/SignFirmwareWithEKUs.cmd | 76 ++ CryptoPkg/Test/UnitTest/Library/BaseCryptLib/TestEKUCerts/TestEKUParsingIssuingCA.ini | 45 + CryptoPkg/Test/UnitTest/Library/BaseCryptLib/TestEKUCerts/TestEKUParsingLeafSigner.ini | 25 + CryptoPkg/Test/UnitTest/Library/BaseCryptLib/TestEKUCerts/TestEKUParsingLeafSignerPid1.ini | 24 + CryptoPkg/Test/UnitTest/Library/BaseCryptLib/TestEKUCerts/TestEKUParsingLeafSignerPid12345.ini | 27 + CryptoPkg/Test/UnitTest/Library/BaseCryptLib/TestEKUCerts/TestEKUParsingNoEKUsInSigner.ini | 16 + CryptoPkg/Test/UnitTest/Library/BaseCryptLib/TestEKUCerts/TestEKUParsingPolicyCA.ini | 28 + CryptoPkg/Test/UnitTest/Library/BaseCryptLib/TestEKUCerts/TestEKUParsingRoot.ini | 28 + UnitTestFrameworkPkg/Library/Posix/BaseTimerLibPosix/BaseTimerLibPosix.inf | 33 + UnitTestFrameworkPkg/Library/Posix/BaseTimerLibPosix/BaseTimerLibPosix.uni | 14 + UnitTestFrameworkPkg/Test/UnitTestFrameworkPkgHostTest.dsc |1 + UnitTestFrameworkPkg/UnitTestFrameworkPkgHost.dsc.inc |1 + 40 files changed, 5807 insertions(+), 1 deletion(-) create mode 100644 CryptoPkg/Library/BaseCryptLib/SysCall/UnitTestHostCrtWrapper.c create mode 100644 CryptoPkg/Test/UnitTest/Library/BaseCryptLib/AuthenticodeTests.c create mode 100644 CryptoPkg/Test/UnitTest/Library/BaseCryptLib
[edk2-devel] [PATCH v4 3/3] AzurePipelines : Pr Gate: Turn on HBUT for CryptoPkg
From: Matthew Carlson Turns on Host Based Unit Tests for CryptoPkg by enabling the target NOOPT in the CI pipeline. Cc: Sean Brogan Cc: Bret Barkelew Cc: Michael D Kinney Cc: Liming Gao Reviewed-by: Michael D Kinney Signed-off-by: Matthew Carlson --- .azurepipelines/templates/pr-gate-build-job.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.azurepipelines/templates/pr-gate-build-job.yml b/.azurepipelines/templates/pr-gate-build-job.yml index a9f89aa68451..e84ba80030b1 100644 --- a/.azurepipelines/templates/pr-gate-build-job.yml +++ b/.azurepipelines/templates/pr-gate-build-job.yml @@ -40,7 +40,7 @@ jobs: Build.Targets: 'DEBUG,RELEASE,NO-TARGET,NOOPT' TARGET_CRYPTO: Build.Pkgs: 'CryptoPkg' -Build.Targets: 'DEBUG,RELEASE,NO-TARGET' +Build.Targets: 'DEBUG,RELEASE,NO-TARGET,NOOPT' TARGET_SECURITY: Build.Pkgs: 'SecurityPkg' Build.Targets: 'DEBUG,RELEASE,NO-TARGET' -- 2.27.0.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#62642): https://edk2.groups.io/g/devel/message/62642 Mute This Topic: https://groups.io/mt/75529779/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] [PATCH v4 1/3] UnitTestFrameworkPkg : BaseTimerLibPosix: Adds a host-based timer Lib
From: Matthew Carlson
This adds a host based BaseTimerLib that won't assert.
Cc: Michael D Kinney
Cc: Sean Brogan
Cc: Bret Barkelew
Reviewed-by: Michael D Kinney
Signed-off-by: Matthew Carlson
---
UnitTestFrameworkPkg/Library/Posix/BaseTimerLibPosix/TimerLibPosix.c |
132
UnitTestFrameworkPkg/Library/Posix/BaseTimerLibPosix/BaseTimerLibPosix.inf |
33 +
UnitTestFrameworkPkg/Library/Posix/BaseTimerLibPosix/BaseTimerLibPosix.uni |
14 +++
UnitTestFrameworkPkg/Test/UnitTestFrameworkPkgHostTest.dsc |
1 +
UnitTestFrameworkPkg/UnitTestFrameworkPkgHost.dsc.inc |
1 +
5 files changed, 181 insertions(+)
diff --git
a/UnitTestFrameworkPkg/Library/Posix/BaseTimerLibPosix/TimerLibPosix.c
b/UnitTestFrameworkPkg/Library/Posix/BaseTimerLibPosix/TimerLibPosix.c
new file mode 100644
index ..3c1394e3b21b
--- /dev/null
+++ b/UnitTestFrameworkPkg/Library/Posix/BaseTimerLibPosix/TimerLibPosix.c
@@ -0,0 +1,132 @@
+/** @file
+ A semi-functional instance of the Timer Library.
+
+ Copyright (c) Microsoft Corporation.
+
+ SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+
+#include
+#include
+#include
+#include
+#include
+#include
+
+/**
+ Stalls the CPU for at least the given number of microseconds.
+
+ @param MicroSeconds The minimum number of microseconds to delay.
+ @return The value of MicroSeconds inputted.
+
+**/
+UINTN
+EFIAPI
+MicroSecondDelay (
+ IN UINTN MicroSeconds
+ )
+{
+ // Since this is a host based test, we don't actually want to stall
+ return MicroSeconds;
+}
+
+/**
+ Stalls the CPU for at least the given number of nanoseconds.
+
+ @param NanoSeconds The minimum number of nanoseconds to delay.
+ @return The value of NanoSeconds inputted.
+
+**/
+UINTN
+EFIAPI
+NanoSecondDelay (
+ IN UINTN NanoSeconds
+ )
+{
+ // Since this is a host based test, we don't actually want to stall
+ return NanoSeconds;
+}
+
+/**
+ Retrieves the current value of a 64-bit free running performance counter.
+
+ The counter can either count up by 1 or count down by 1. If the physical
+ performance counter counts by a larger increment, then the counter values
+ must be translated. The properties of the counter can be retrieved from
+ GetPerformanceCounterProperties().
+
+ @return The current value of the free running performance counter.
+
+**/
+UINT64
+EFIAPI
+GetPerformanceCounter (
+ VOID
+ )
+{
+ struct timespec ts;
+ timespec_get(, TIME_UTC);
+ // Return the current number of nanoseconds on the clock
+ return ts.tv_nsec;
+}
+
+/**
+ Retrieves the 64-bit frequency in Hz and the range of performance counter
+ values.
+
+ If StartValue is not NULL, then the value that the performance counter starts
+ with immediately after is it rolls over is returned in StartValue. If
+ EndValue is not NULL, then the value that the performance counter end with
+ immediately before it rolls over is returned in EndValue. The 64-bit
+ frequency of the performance counter in Hz is always returned. If StartValue
+ is less than EndValue, then the performance counter counts up. If StartValue
+ is greater than EndValue, then the performance counter counts down. For
+ example, a 64-bit free running counter that counts up would have a StartValue
+ of 0 and an EndValue of 0x. A 24-bit free running counter
+ that counts down would have a StartValue of 0xFF and an EndValue of 0.
+
+ @param StartValue The value the performance counter starts with when it
+ rolls over.
+ @param EndValueThe value that the performance counter ends with before
+ it rolls over.
+
+ @return The frequency in Hz.
+
+**/
+UINT64
+EFIAPI
+GetPerformanceCounterProperties (
+ OUT UINT64*StartValue, OPTIONAL
+ OUT UINT64*EndValue OPTIONAL
+ )
+{
+ if ( EndValue != NULL ) {
+*EndValue = MAX_UINT64;
+ }
+ if ( StartValue != NULL ) {
+*StartValue = 0;
+ }
+ // Return the number of nanoseconds in a second
+ return 10;
+}
+
+/**
+ Converts elapsed ticks of performance counter to time in nanoseconds.
+
+ This function converts the elapsed ticks of running performance counter to
+ time value in unit of nanoseconds.
+
+ @param Ticks The number of elapsed ticks of running performance counter.
+
+ @return The elapsed time in nanoseconds.
+
+**/
+UINT64
+EFIAPI
+GetTimeInNanoSecond (
+ IN UINT64 Ticks
+ )
+{
+ return Ticks;
+}
diff --git
a/UnitTestFrameworkPkg/Library/Posix/BaseTimerLibPosix/BaseTimerLibPosix.inf
b/UnitTestFrameworkPkg/Library/Posix/BaseTimerLibPosix/BaseTimerLibPosix.inf
new file mode 100644
index ..797f04bb125b
--- /dev/null
+++ b/UnitTestFrameworkPkg/Library/Posix/BaseTimerLibPosix/BaseTimerLibPosix.inf
@@ -0,0 +1,33 @@
+## @file
+# An instance of Timer Library for posix compliant
Re: [edk2-devel] [PATCH v3 2/3] CryptoPkg: BaseCryptLib: Add unit tests (Host and Shell based)
Hey Mike, 1. I'll move it for v4. 2. I'll remove that, thanks! 3. I'll fix that as well, good spot. 4. It's mostly the same except for the different CrtWrappers 5. We need a host-specific CrtWrapper since the regular one has a bunch of conflicts with regular C98, but there are a few functions that since we're building no std mode of OpenSSL we still need to provide. 6. That would be my guess- this is largely based on the edk2-staging HBFA branch and I've had to reverse engineer some of the steps for generating the test data. I fixed the instructions. -Matthew Carlson On Tue, Jul 14, 2020 at 7:53 PM Kinney, Michael D < michael.d.kin...@intel.com> wrote: > Hi Matt, > > I think the BaseCryptLib unit tests may need some more work. > > 1) The DSC file for host based tests is in the wrong directory. >It should be in CryptoPkg/Test to match the MdePkg, MdeModulePkg >and UnitTestFrameworkPkg location. > > 2) CryptoPkg/CryptoPkg.dsc includes a reference to the host based >library UnitTestHostBaseCryptLib.inf. This should only be >listed in the host based DSC file. > > 3) CryptoPkg\Library\BaseCryptLib\UnitTestHostBaseCryptLib.inf >This file appears to only be for host based tests, but it >lists compatibility with DXE_DRIVER DXE_CORE UEFI_APPLICATION > UEFI_DRIVER >and does not list HOST_APPLICATION as expected. > > 4) Why do we need a new lib instance of the BaseCryptLib for >host based unit testing. I would think we would want to perform >unit tests on the BaseCryptLib instances that would actually be >used in FW components. Can we update the unit tests to test >the services provided in the Base, Pei, Runtime, and Smm >instances of the BaseCryptLib? > > 5) Why do we need a host based specific version of the CrtWrapper, >UnitTestHostCrtWrapper.c? > > 6) The file CryptoPkg/Test/UnitTest/Librray/BaseCryptLib/TestEKUCerts/ >ChainCreationInstructions.txt makes reference to a bintohex tool >and putting the results in a file called AllTestSignatures.h. >But I do not see this file in the patch. Are these instructions >out of date? > > Thanks, > > Mike -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#62637): https://edk2.groups.io/g/devel/message/62637 Mute This Topic: https://groups.io/mt/75505002/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] [PATCH v1 1/3] UnitTestFrameworkPkg : BaseTimerLib: Adds a host-based timer Lib
I sent out a new patch series. Not sure, it might be waiting in the -- - Matthew Carlson -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#62316): https://edk2.groups.io/g/devel/message/62316 Mute This Topic: https://groups.io/mt/75379678/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] [PATCH v1 1/3] UnitTestFrameworkPkg : BaseTimerLib: Adds a host-based timer Lib
Great point. I'll fix this. -- - Matthew Carlson -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#62257): https://edk2.groups.io/g/devel/message/62257 Mute This Topic: https://groups.io/mt/75379678/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
Re: [edk2-devel] Creating a edk2-pytool-base repo under tianocore
Thanks Mike! -- - Matthew Carlson -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#61756): https://edk2.groups.io/g/devel/message/61756 Mute This Topic: https://groups.io/mt/75109251/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
[edk2-devel] Creating a edk2-pytool-base repo under tianocore
Based on this RFC: https://edk2.groups.io/g/rfc/topic/rfc_basetools_source_python/74009714?p=,,,20,0,0,0::recentpostdate%2Fsticky,,,20,2,0,74009714 We'd like to request a repository be made under tianocore with similar permissions to edk2-pytool-library or edk2-pytool-extensions We'd prefer it to be called edk2-pytool-base or edk2-basetools This will help us start the next stage. -- - Matthew Carlson -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#61731): https://edk2.groups.io/g/devel/message/61731 Mute This Topic: https://groups.io/mt/75109251/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
