From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail.byosoft.com.cn (mail.byosoft.com.cn [58.240.74.243]) by mx.groups.io with SMTP id smtpd.web12.10828.1599527417124273328 for ; Mon, 07 Sep 2020 18:10:18 -0700 Authentication-Results: mx.groups.io; dkim=missing; spf=none, err=permanent DNS error (domain: byosoft.com.cn, ip: 58.240.74.243, mailfrom: gaoliming@byosoft.com.cn) Received: from DESKTOPS6D0PVI ([58.246.60.130]) (envelope-sender ) by 192.168.6.13 with ESMTP for ; Tue, 08 Sep 2020 09:09:41 +0800 X-WM-Sender: gaoliming@byosoft.com.cn X-WM-AuthFlag: YES X-WM-AuthUser: gaoliming@byosoft.com.cn From: "gaoliming" To: , Cc: "'Jiewen Yao'" , "'Chao Zhang'" , "'Jian J Wang'" , "'Hao A Wu'" , "'Liming Gao'" , "'Jordan Justen'" , "'Laszlo Ersek'" , "'Ard Biesheuvel'" , "'Andrew Fish'" , "'Ray Ni'" References: <20200828055127.1610-1-brbarkel@microsoft.com> In-Reply-To: <20200828055127.1610-1-brbarkel@microsoft.com> Subject: =?UTF-8?B?5Zue5aSNOiBbZWRrMi1kZXZlbF0gW1BBVENIIHY3IDAwLzE0XSBBZGQgdGhlIFZhcmlhYmxlUG9saWN5IGZlYXR1cmU=?= Date: Tue, 8 Sep 2020 09:09:41 +0800 Message-ID: <002a01d6857c$bb309310$3191b930$@byosoft.com.cn> MIME-Version: 1.0 X-Mailer: Microsoft Outlook 16.0 Thread-Index: AQJtpTQneMckW2v3zLtykF+rYxPDfKgvrsaQ Content-Type: text/plain; charset="gb2312" Content-Transfer-Encoding: quoted-printable Content-Language: zh-cn Bret: Thanks for your update. This version is good to me. Reviewed-by: Liming Gao for the changes in MdeModulePkg. Thanks Liming > -----=D3=CA=BC=FE=D4=AD=BC=FE----- > =B7=A2=BC=FE=C8=CB: bounce+27952+64712+4905953+8761045@groups.io > =B4=FA=B1=ED Bret > Barkelew > =B7=A2=CB=CD=CA=B1=BC=E4: 2020=C4=EA8=D4=C228=C8=D5 13:51 > =CA=D5=BC=FE=C8=CB: devel@edk2.groups.io > =B3=AD=CB=CD: Jiewen Yao ; Chao Zhang > ; Jian J Wang ; Hao A Wu > ; Liming Gao ; Jordan Justen > ; Laszlo Ersek ; Ard > Biesheuvel ; Andrew Fish ; > Ray Ni > =D6=F7=CC=E2: [edk2-devel] [PATCH v7 00/14] Add the VariablePolicy featu= re >=20 > The 14 patches in this series add the VariablePolicy feature to the core= , > deprecate Edk2VarLock (while adding a compatibility layer to reduce code > churn), and integrate the VariablePolicy libraries and protocols into > Variable Services. >=20 > Since the integration requires multiple changes, including adding libraries, > a protocol, an SMI communication handler, and VariableServices integration, > the patches are broken up by individual library additions and then a fin= al > integration. Security-sensitive changes like bypassing Authenticated > Variable enforcement are also broken out into individual patches so that > attention can be called directly to them. >=20 > Platform porting instructions are described in this wiki entry: > https://github.com/tianocore/tianocore.github.io/wiki/VariablePolicy-Proto= co > l---Enhanced-Method-for-Managing-Variables#platform-porting >=20 > Discussion of the feature can be found in multiple places throughout > the last year on the RFC channel, staging branches, and in devel. >=20 > Most recently, this subject was discussed in this thread: > https://edk2.groups.io/g/devel/message/53712 > (the code branches shared in that discussion are now out of date, but th= e > whitepapers and discussion are relevant). >=20 > Cc: Jiewen Yao > Cc: Chao Zhang > Cc: Jian J Wang > Cc: Hao A Wu > Cc: Liming Gao > Cc: Jordan Justen > Cc: Laszlo Ersek > Cc: Ard Biesheuvel > Cc: Andrew Fish > Cc: Ray Ni > Cc: Bret Barkelew > Signed-off-by: Bret Barkelew >=20 > v7 changes: > * Address comments from Dandan about security of the MM handler > * Add readme > * Fix bug around hex characters in BOOT####, etc > * Add additional testing for hex characters > * Add additional testing for authenticated variables >=20 > v6 changes: > * Fix an issue with uninitialized Status in InitVariablePolicyLib() and > DeinitVariablePolicyLib() > * Fix GCC building in shell-based functional test > * Rebase on latest origin/master >=20 > v5 changes: > * Fix the CONST mismatch in VariablePolicy.h and VariablePolicySmmDxe.c > * Fix EFIAPI mismatches in the functional unittest > * Rebase on latest origin/master >=20 > v4 changes: > * Remove Optional PcdAllowVariablePolicyEnforcementDisable PCD from > platforms > * Rebase on master > * Migrate to new MmCommunicate2 protocol > * Fix an oversight in the default return value for InitMmCommonCommBuffe= r > * Fix in VariablePolicyLib to allow ExtraInitRuntimeDxe to consume variables >=20 > V3 changes: > * Address all non-unittest issues with ECC > * Make additional style changes > * Include section name in hunk headers in "ini-style" files > * Remove requirement for the EdkiiPiSmmCommunicationsRegionTable driver > (now allocates its own buffer) > * Change names from VARIABLE_POLICY_PROTOCOL and > gVariablePolicyProtocolGuid > to EDKII_VARIABLE_POLICY_PROTOCOL and > gEdkiiVariablePolicyProtocolGuid > * Fix GCC warning about initializing externs > * Add UNI strings for new PCD > * Add patches for ArmVirtPkg, OvmfXen, and UefiPayloadPkg > * Reorder patches according to Liming's feedback about adding to platfor= ms > before changing variable driver >=20 > V2 changes: > * Fixed implementation for RuntimeDxe > * Add PCD to block DisableVariablePolicy > * Fix the DumpVariablePolicy pagination in SMM >=20 >=20 > Bret Barkelew (14): > MdeModulePkg: Define the VariablePolicy protocol interface > MdeModulePkg: Define the VariablePolicyLib > MdeModulePkg: Define the VariablePolicyHelperLib > MdeModulePkg: Define the VarCheckPolicyLib and SMM interface > OvmfPkg: Add VariablePolicy engine to OvmfPkg platform > EmulatorPkg: Add VariablePolicy engine to EmulatorPkg platform > ArmVirtPkg: Add VariablePolicy engine to ArmVirtPkg platform > UefiPayloadPkg: Add VariablePolicy engine to UefiPayloadPkg platform > MdeModulePkg: Connect VariablePolicy business logic to > VariableServices > MdeModulePkg: Allow VariablePolicy state to delete protected variables > SecurityPkg: Allow VariablePolicy state to delete authenticated > variables > MdeModulePkg: Change TCG MOR variables to use VariablePolicy > MdeModulePkg: Drop VarLock from RuntimeDxe variable driver > MdeModulePkg: Add a shell-based functional test for VariablePolicy >=20 > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c > | 345 +++ > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c > | 396 ++++ > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c > | 46 + >=20 > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDxe > .c | 85 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c > | 830 +++++++ >=20 > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePo= li > cyUnitTest.c | 2452 ++++++++++++++++++++ >=20 > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFunc > TestApp.c | 2226 ++++++++++++++++++ > MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c > | 52 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c > | 60 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/VarCheck.c > | 49 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c > | 53 + >=20 > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock.c > | 71 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c > | 642 +++++ >=20 > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c > | 14 + > SecurityPkg/Library/AuthVariableLib/AuthService.c > | 22 +- > ArmVirtPkg/ArmVirt.dsc.inc > | 4 + > EmulatorPkg/EmulatorPkg.dsc > | 3 + > MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h > | 54 + > MdeModulePkg/Include/Library/VariablePolicyHelperLib.h > | 164 ++ > MdeModulePkg/Include/Library/VariablePolicyLib.h > | 207 ++ > MdeModulePkg/Include/Protocol/VariablePolicy.h > | 157 ++ > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf > | 42 + > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni > | 12 + > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.in= f > | 35 + > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.un= i > | 12 + > MdeModulePkg/Library/VariablePolicyLib/ReadMe.md > | 410 ++++ > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf > | 49 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni > | 12 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf > | 51 + >=20 > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePo= li > cyUnitTest.inf | 45 + > MdeModulePkg/MdeModulePkg.ci.yaml > | 8 +- > MdeModulePkg/MdeModulePkg.dec > | 26 +- > MdeModulePkg/MdeModulePkg.dsc > | 9 + > MdeModulePkg/MdeModulePkg.uni > | 7 + > MdeModulePkg/Test/MdeModulePkgHostTest.dsc > | 11 + > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md > | 55 + >=20 > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFunc > TestApp.inf | 47 + >=20 > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyTest > AuthVar.h | 128 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf > | 5 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf > | 4 + >=20 > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.in > f | 11 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf > | 4 + > OvmfPkg/OvmfPkgIa32.dsc > | 5 + > OvmfPkg/OvmfPkgIa32X64.dsc > | 5 + > OvmfPkg/OvmfPkgX64.dsc > | 5 + > OvmfPkg/OvmfXen.dsc > | 4 + > SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf > | 2 + > UefiPayloadPkg/UefiPayloadPkgIa32.dsc > | 4 + > UefiPayloadPkg/UefiPayloadPkgIa32X64.dsc > | 4 + > 49 files changed, 8865 insertions(+), 79 deletions(-) > create mode 100644 > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c > create mode 100644 > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c > create mode 100644 > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c > create mode 100644 > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDxe > .c > create mode 100644 > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c > create mode 100644 > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePo= li > cyUnitTest.c > create mode 100644 > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFunc > TestApp.c > create mode 100644 > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock.c > create mode 100644 > MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c > create mode 100644 MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h > create mode 100644 > MdeModulePkg/Include/Library/VariablePolicyHelperLib.h > create mode 100644 MdeModulePkg/Include/Library/VariablePolicyLib.h > create mode 100644 MdeModulePkg/Include/Protocol/VariablePolicy.h > create mode 100644 > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf > create mode 100644 > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni > create mode 100644 > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf > create mode 100644 > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.uni > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/ReadMe.md > create mode 100644 > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf > create mode 100644 > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni > create mode 100644 > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf > create mode 100644 > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePo= li > cyUnitTest.inf > create mode 100644 > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md > create mode 100644 > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFunc > TestApp.inf > create mode 100644 > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyTest > AuthVar.h >=20 > -- > 2.28.0.windows.1 >=20 >=20 >=20