From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-1.mimecast.com (us-smtp-delivery-1.mimecast.com [205.139.110.61]) by mx.groups.io with SMTP id smtpd.web11.14123.1591191551783807487 for ; Wed, 03 Jun 2020 06:39:12 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=bsz67cv4; spf=pass (domain: redhat.com, ip: 205.139.110.61, mailfrom: lersek@redhat.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1591191550; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Q2mKm1cC+FLdPzTckYt5ugHa5Vc7XQvGK3lqIAOX2SI=; b=bsz67cv4xxJaVqo+lerRZ1VLyT5W0U2891ygis12Kg0j3w2hJ5mC9vzyPPFCsE7AJFTXFo 1M1fDh0cY0tVaG3Vkp2QLeJEq2iiN7MUU/gN37Sn0p5aJHguwSlsCrD/O2c5dfxjK98dhW u/pXIUigZz6GcSev7FsikCErtCDcxLg= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-236-TuQzNxswMNigbFvBx86lZQ-1; Wed, 03 Jun 2020 09:38:59 -0400 X-MC-Unique: TuQzNxswMNigbFvBx86lZQ-1 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 272A7107ACF8; Wed, 3 Jun 2020 13:38:58 +0000 (UTC) Received: from lacos-laptop-7.usersys.redhat.com (ovpn-115-50.ams2.redhat.com [10.36.115.50]) by smtp.corp.redhat.com (Postfix) with ESMTP id EA1275D9D3; Wed, 3 Jun 2020 13:38:54 +0000 (UTC) Subject: Re: [PATCH v5 00/14] Add the VariablePolicy feature To: Bret Barkelew , devel@edk2.groups.io Cc: Jiewen Yao , Chao Zhang , Jian J Wang , Hao A Wu , Liming Gao , Jordan Justen , Ard Biesheuvel , Andrew Fish , Ray Ni References: <20200603065810.806-1-brbarkel@microsoft.com> From: "Laszlo Ersek" Message-ID: <191f2fa2-ad00-b4b6-4e0d-a3e5926e2fca@redhat.com> Date: Wed, 3 Jun 2020 15:38:53 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <20200603065810.806-1-brbarkel@microsoft.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Language: en-US Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit meta: On 06/03/20 08:57, Bret Barkelew wrote: > REF:https://bugzilla.tianocore.org/show_bug.cgi?id=2522 > > The 14 patches in this series add the VariablePolicy feature to the core, > deprecate Edk2VarLock (while adding a compatibility layer to reduce code > churn), and integrate the VariablePolicy libraries and protocols into > Variable Services. > > Since the integration requires multiple changes, including adding libraries, > a protocol, an SMI communication handler, and VariableServices integration, > the patches are broken up by individual library additions and then a final > integration. Security-sensitive changes like bypassing Authenticated > Variable enforcement are also broken out into individual patches so that > attention can be called directly to them. > > Platform porting instructions are described in this wiki entry: > https://github.com/tianocore/tianocore.github.io/wiki/VariablePolicy-Protocol---Enhanced-Method-for-Managing-Variables#platform-porting > > Discussion of the feature can be found in multiple places throughout > the last year on the RFC channel, staging branches, and in devel. > > Most recently, this subject was discussed in this thread: > https://edk2.groups.io/g/devel/message/53712 > (the code branches shared in that discussion are now out of date, but the > whitepapers and discussion are relevant). > > Cc: Jiewen Yao > Cc: Chao Zhang > Cc: Jian J Wang > Cc: Hao A Wu > Cc: Liming Gao > Cc: Jordan Justen > Cc: Laszlo Ersek > Cc: Ard Biesheuvel > Cc: Andrew Fish > Cc: Ray Ni > Cc: Bret Barkelew > Signed-off-by: Bret Barkelew > > v5 changes: > * Fix the CONST mismatch in VariablePolicy.h and VariablePolicySmmDxe.c > * Fix EFIAPI mismatches in the functional unittest > * Rebase on latest origin/master Thank you very much for your willingness to learn the mailing list based workflow, even if that workflow is on its way out. I highly appreciate it! Laszlo > v4 changes: > * Remove Optional PcdAllowVariablePolicyEnforcementDisable PCD from platforms > * Rebase on master > * Migrate to new MmCommunicate2 protocol > * Fix an oversight in the default return value for InitMmCommonCommBuffer > * Fix in VariablePolicyLib to allow ExtraInitRuntimeDxe to consume variables > > V3 changes: > * Address all non-unittest issues with ECC > * Make additional style changes > * Include section name in hunk headers in "ini-style" files > * Remove requirement for the EdkiiPiSmmCommunicationsRegionTable driver > (now allocates its own buffer) > * Change names from VARIABLE_POLICY_PROTOCOL and gVariablePolicyProtocolGuid > to EDKII_VARIABLE_POLICY_PROTOCOL and gEdkiiVariablePolicyProtocolGuid > * Fix GCC warning about initializing externs > * Add UNI strings for new PCD > * Add patches for ArmVirtPkg, OvmfXen, and UefiPayloadPkg > * Reorder patches according to Liming's feedback about adding to platforms > before changing variable driver > > V2 changes: > * Fixed implementation for RuntimeDxe > * Add PCD to block DisableVariablePolicy > * Fix the DumpVariablePolicy pagination in SMM > > Bret Barkelew (14): > MdeModulePkg: Define the VariablePolicy protocol interface > MdeModulePkg: Define the VariablePolicyLib > MdeModulePkg: Define the VariablePolicyHelperLib > MdeModulePkg: Define the VarCheckPolicyLib and SMM interface > OvmfPkg: Add VariablePolicy engine to OvmfPkg platform > EmulatorPkg: Add VariablePolicy engine to EmulatorPkg platform > ArmVirtPkg: Add VariablePolicy engine to ArmVirtPkg platform > UefiPayloadPkg: Add VariablePolicy engine to UefiPayloadPkg platform > MdeModulePkg: Connect VariablePolicy business logic to > VariableServices > MdeModulePkg: Allow VariablePolicy state to delete protected variables > SecurityPkg: Allow VariablePolicy state to delete authenticated > variables > MdeModulePkg: Change TCG MOR variables to use VariablePolicy > MdeModulePkg: Drop VarLock from RuntimeDxe variable driver > MdeModulePkg: Add a shell-based functional test for VariablePolicy > > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c | 320 +++ > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c | 396 ++++ > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c | 46 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDxe.c | 85 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c | 813 +++++++ > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.c | 2436 ++++++++++++++++++++ > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.c | 1978 ++++++++++++++++ > MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c | 52 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c | 60 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/VarCheck.c | 49 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c | 53 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock.c | 71 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c | 642 ++++++ > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c | 14 + > SecurityPkg/Library/AuthVariableLib/AuthService.c | 22 +- > ArmVirtPkg/ArmVirt.dsc.inc | 4 + > EmulatorPkg/EmulatorPkg.dsc | 3 + > MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h | 54 + > MdeModulePkg/Include/Library/VariablePolicyHelperLib.h | 164 ++ > MdeModulePkg/Include/Library/VariablePolicyLib.h | 207 ++ > MdeModulePkg/Include/Protocol/VariablePolicy.h | 157 ++ > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf | 42 + > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni | 12 + > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf | 35 + > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.uni | 12 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf | 44 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni | 12 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf | 51 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.inf | 40 + > MdeModulePkg/MdeModulePkg.ci.yaml | 4 +- > MdeModulePkg/MdeModulePkg.dec | 26 +- > MdeModulePkg/MdeModulePkg.dsc | 15 + > MdeModulePkg/MdeModulePkg.uni | 7 + > MdeModulePkg/Test/MdeModulePkgHostTest.dsc | 11 + > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md | 55 + > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.inf | 42 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf | 5 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf | 4 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf | 10 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf | 4 + > OvmfPkg/OvmfPkgIa32.dsc | 5 + > OvmfPkg/OvmfPkgIa32X64.dsc | 5 + > OvmfPkg/OvmfPkgX64.dsc | 5 + > OvmfPkg/OvmfXen.dsc | 4 + > SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf | 2 + > UefiPayloadPkg/UefiPayloadPkgIa32.dsc | 4 + > UefiPayloadPkg/UefiPayloadPkgIa32X64.dsc | 4 + > 47 files changed, 8008 insertions(+), 78 deletions(-) > create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c > create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDxe.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.c > create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.c > create mode 100644 MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock.c > create mode 100644 MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c > create mode 100644 MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h > create mode 100644 MdeModulePkg/Include/Library/VariablePolicyHelperLib.h > create mode 100644 MdeModulePkg/Include/Library/VariablePolicyLib.h > create mode 100644 MdeModulePkg/Include/Protocol/VariablePolicy.h > create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf > create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni > create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf > create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.uni > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.inf > create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md > create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.inf >