Yes, I'm working on a more sustainable solution for the test cases and have opened this bug to track it. 3073 – Provide test cases/apps for VarPol (tianocore.org) I just didn't want that to hold up the rest of the code that's already been signed off on. On Thu, Nov 12, 2020 at 6:25 AM gaoliming wrote: > Bret: > > V9 version change is mainly for MdeModule Variable driver. The change is > good to me. Reviewed-by: Liming Gao > > > > Besides, I find V9 doesn’t include the patch > 0014-MdeModulePkg-Add-a-shell-based-functional-test-for-VariablePolicy. > Because this patch doesn’t pass ECC, will you plan to add it later? > > > > Thanks > > Liming > > *发件人:* bounce+27952+67296+4905953+8761045@groups.io < > bounce+27952+67296+4905953+8761045@groups.io> *代表 *Bret Barkelew > *发送时间:* 2020年11月12日 2:44 > *收件人:* edk2-devel-groups-io > *主题:* Re: [edk2-devel] [PATCH v9 00/13] Add the VariablePolicy feature > > > > To clarify: > > > > The current solution to the MorLock EndOfDxe issue is to expressly call > LockVariablePolicy() in the same locations that mEndOfDxe is set (which was > the mechanism that previously locked the VariableLock interface). This > solution maintains parity with the old design, which is keeping with the > ethos of minimal changes and similar functionality to VariableLock. It does > not introduce any new dependencies. > > > > The only drawback to this approach is that it preserves the strict > ordering that was also previously required by MorLock, which I will attempt > to address in later updates. > > > > On Sun, Nov 8, 2020 at 10:45 PM Bret Barkelew wrote: > > The 14 patches in this series add the VariablePolicy feature to the core, > deprecate Edk2VarLock (while adding a compatibility layer to reduce code > churn), and integrate the VariablePolicy libraries and protocols into > Variable Services. > > Since the integration requires multiple changes, including adding > libraries, > a protocol, an SMI communication handler, and VariableServices integration, > the patches are broken up by individual library additions and then a final > integration. Security-sensitive changes like bypassing Authenticated > Variable enforcement are also broken out into individual patches so that > attention can be called directly to them. > > Platform porting instructions are described in this wiki entry: > > https://github.com/tianocore/tianocore.github.io/wiki/VariablePolicy-Protocol---Enhanced-Method-for-Managing-Variables#platform-porting > > Discussion of the feature can be found in multiple places throughout > the last year on the RFC channel, staging branches, and in devel. > > Most recently, this subject was discussed in this thread: > https://edk2.groups.io/g/devel/message/53712 > (the code branches shared in that discussion are now out of date, but the > whitepapers and discussion are relevant). > > Cc: Jiewen Yao > Cc: Dandan Bi > Cc: Chao Zhang > Cc: Jian J Wang > Cc: Hao A Wu > Cc: Liming Gao > Cc: Jordan Justen > Cc: Laszlo Ersek > Cc: Ard Biesheuvel > Cc: Andrew Fish > Cc: Ray Ni > Cc: Bret Barkelew > Signed-off-by: Bret Barkelew > > v9 changes: > * Rebase > * Address the event ordering issues around MorLock at EndOfDxe > * Drop problematic tests > * Address ECC issues > > v8 changes: > * Rebase > * Small tweaks from final PRs > * Drank a lot > * Enrolled several members and a steward in CatFacts > > v7 changes: > * Address comments from Dandan about security of the MM handler > * Add readme > * Fix bug around hex characters in BOOT####, etc > * Add additional testing for hex characters > * Add additional testing for authenticated variables > > v6 changes: > * Fix an issue with uninitialized Status in InitVariablePolicyLib() and > DeinitVariablePolicyLib() > * Fix GCC building in shell-based functional test > * Rebase on latest origin/master > > v5 changes: > * Fix the CONST mismatch in VariablePolicy.h and VariablePolicySmmDxe.c > * Fix EFIAPI mismatches in the functional unittest > * Rebase on latest origin/master > > v4 changes: > * Remove Optional PcdAllowVariablePolicyEnforcementDisable PCD from > platforms > * Rebase on master > * Migrate to new MmCommunicate2 protocol > * Fix an oversight in the default return value for InitMmCommonCommBuffer > * Fix in VariablePolicyLib to allow ExtraInitRuntimeDxe to consume > variables > > V3 changes: > * Address all non-unittest issues with ECC > * Make additional style changes > * Include section name in hunk headers in "ini-style" files > * Remove requirement for the EdkiiPiSmmCommunicationsRegionTable driver > (now allocates its own buffer) > * Change names from VARIABLE_POLICY_PROTOCOL and > gVariablePolicyProtocolGuid > to EDKII_VARIABLE_POLICY_PROTOCOL and gEdkiiVariablePolicyProtocolGuid > * Fix GCC warning about initializing externs > * Add UNI strings for new PCD > * Add patches for ArmVirtPkg, OvmfXen, and UefiPayloadPkg > * Reorder patches according to Liming's feedback about adding to platforms > before changing variable driver > > V2 changes: > * Fixed implementation for RuntimeDxe > * Add PCD to block DisableVariablePolicy > * Fix the DumpVariablePolicy pagination in SMM > > Bret Barkelew (13): > MdeModulePkg: Define the VariablePolicy protocol interface > MdeModulePkg: Define the VariablePolicyLib > MdeModulePkg: Define the VariablePolicyHelperLib > MdeModulePkg: Define the VarCheckPolicyLib and SMM interface > OvmfPkg: Add VariablePolicy engine to OvmfPkg platform > EmulatorPkg: Add VariablePolicy engine to EmulatorPkg platform > ArmVirtPkg: Add VariablePolicy engine to ArmVirtPkg platform > UefiPayloadPkg: Add VariablePolicy engine to UefiPayloadPkg platform > MdeModulePkg: Connect VariablePolicy business logic to > VariableServices > MdeModulePkg: Allow VariablePolicy state to delete protected variables > SecurityPkg: Allow VariablePolicy state to delete authenticated > variables > MdeModulePkg: Change TCG MOR variables to use VariablePolicy > MdeModulePkg: Drop VarLock from RuntimeDxe variable driver > > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c > | 346 ++++++++ > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c > | 396 ++++++++++ > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c > | 46 ++ > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDxe.c > | 85 ++ > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c > | 830 ++++++++++++++++++++ > MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c > | 52 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c > | 60 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/VarCheck.c > | 49 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c > | 60 ++ > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequestToLock.c > | 71 ++ > MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c > | 573 ++++++++++++++ > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.c > | 7 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c > | 14 + > SecurityPkg/Library/AuthVariableLib/AuthService.c > | 30 +- > ArmVirtPkg/ArmVirt.dsc.inc > | 4 + > EmulatorPkg/EmulatorPkg.dsc > | 3 + > MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h > | 54 ++ > MdeModulePkg/Include/Library/VariablePolicyHelperLib.h > | 164 ++++ > MdeModulePkg/Include/Library/VariablePolicyLib.h > | 207 +++++ > MdeModulePkg/Include/Protocol/VariablePolicy.h > | 157 ++++ > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf > | 42 + > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni > | 12 + > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf > | 35 + > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.uni > | 12 + > MdeModulePkg/Library/VariablePolicyLib/ReadMe.md > | 406 ++++++++++ > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf > | 48 ++ > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni > | 12 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf > | 51 ++ > MdeModulePkg/MdeModulePkg.ci.yaml > | 4 +- > MdeModulePkg/MdeModulePkg.dec > | 26 +- > MdeModulePkg/MdeModulePkg.dsc > | 9 + > MdeModulePkg/MdeModulePkg.uni > | 7 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf > | 5 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf > | 4 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf > | 11 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf > | 4 + > OvmfPkg/OvmfPkgIa32.dsc > | 5 + > OvmfPkg/OvmfPkgIa32X64.dsc > | 5 + > OvmfPkg/OvmfPkgX64.dsc > | 5 + > OvmfPkg/OvmfXen.dsc > | 4 + > SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf > | 2 + > UefiPayloadPkg/UefiPayloadPkgIa32.dsc > | 4 + > UefiPayloadPkg/UefiPayloadPkgIa32X64.dsc > | 4 + > 43 files changed, 3845 insertions(+), 80 deletions(-) > create mode 100644 > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c > create mode 100644 > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c > create mode 100644 > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c > create mode 100644 > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDxe.c > create mode 100644 > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c > create mode 100644 > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequestToLock.c > create mode 100644 > MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c > create mode 100644 MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h > create mode 100644 MdeModulePkg/Include/Library/VariablePolicyHelperLib.h > create mode 100644 MdeModulePkg/Include/Library/VariablePolicyLib.h > create mode 100644 MdeModulePkg/Include/Protocol/VariablePolicy.h > create mode 100644 > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf > create mode 100644 > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni > create mode 100644 > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf > create mode 100644 > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.uni > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/ReadMe.md > create mode 100644 > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf > create mode 100644 > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni > create mode 100644 > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf > > -- > 2.28.0.windows.1 > > >