Re: [EXTERNAL] [edk2-devel] [PATCH v5 01/14] MdeModulePkg: Define the VariablePolicy protocol interface

["Bret Barkelew" <bret.barkelew@microsoft.com>]

[-- Attachment #1: Type: text/plain, Size: 12402 bytes --]

Bump. This specific patch needs Reviews.


- Bret

________________________________
From: devel@edk2.groups.io <devel@edk2.groups.io> on behalf of Bret Barkelew via groups.io <bret=corthon.com@groups.io>
Sent: Tuesday, June 2, 2020 11:57 PM
To: devel@edk2.groups.io <devel@edk2.groups.io>
Cc: Jian J Wang <jian.j.wang@intel.com>; Hao A Wu <hao.a.wu@intel.com>; liming.gao <liming.gao@intel.com>
Subject: [EXTERNAL] [edk2-devel] [PATCH v5 01/14] MdeModulePkg: Define the VariablePolicy protocol interface

https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzilla.tianocore.org%2Fshow_bug.cgi%3Fid%3D2522&amp;data=02%7C01%7CBret.Barkelew%40microsoft.com%7Ccaae5a1fbb05498c984f08d807a3dae0%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637267747624441639&amp;sdata=zb9OOX6YpaObdlezhQmsj5zCSd1JS6ay6DVhGkiJRdU%3D&amp;reserved=0

VariablePolicy is an updated interface to
replace VarLock and VarCheckProtocol.

Add the VariablePolicy protocol interface
header and add to the MdeModulePkg.dec file.

Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Hao A Wu <hao.a.wu@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Bret Barkelew <brbarkel@microsoft.com>
Signed-off-by: Bret Barkelew <brbarkel@microsoft.com>
---
 MdeModulePkg/Include/Protocol/VariablePolicy.h | 157 ++++++++++++++++++++
 MdeModulePkg/MdeModulePkg.dec                  |  14 +-
 MdeModulePkg/MdeModulePkg.uni                  |   7 +
 3 files changed, 177 insertions(+), 1 deletion(-)

diff --git a/MdeModulePkg/Include/Protocol/VariablePolicy.h b/MdeModulePkg/Include/Protocol/VariablePolicy.h
new file mode 100644
index 000000000000..8226c187a77b
--- /dev/null
+++ b/MdeModulePkg/Include/Protocol/VariablePolicy.h
@@ -0,0 +1,157 @@
+/** @file -- VariablePolicy.h

+

+This protocol allows communication with Variable Policy Engine.

+

+Copyright (c) Microsoft Corporation.

+SPDX-License-Identifier: BSD-2-Clause-Patent

+**/

+

+#ifndef __EDKII_VARIABLE_POLICY_PROTOCOL__

+#define __EDKII_VARIABLE_POLICY_PROTOCOL__

+

+#define EDKII_VARIABLE_POLICY_PROTOCOL_REVISION   0x0000000000010000

+

+#define EDKII_VARIABLE_POLICY_PROTOCOL_GUID \

+  { \

+    0x81D1675C, 0x86F6, 0x48DF, { 0xBD, 0x95, 0x9A, 0x6E, 0x4F, 0x09, 0x25, 0xC3 } \

+  }

+

+#define VARIABLE_POLICY_ENTRY_REVISION      0x00010000

+

+#pragma pack(push, 1)

+typedef struct {

+  UINT32   Version;

+  UINT16   Size;

+  UINT16   OffsetToName;

+  EFI_GUID Namespace;

+  UINT32   MinSize;

+  UINT32   MaxSize;

+  UINT32   AttributesMustHave;

+  UINT32   AttributesCantHave;

+  UINT8    LockPolicyType;

+  UINT8    Padding[3];

+  // UINT8    LockPolicy[];     // Variable Length Field

+  // CHAR16   Name[]            // Variable Length Field

+} VARIABLE_POLICY_ENTRY;

+

+#define     VARIABLE_POLICY_NO_MIN_SIZE             0

+#define     VARIABLE_POLICY_NO_MAX_SIZE             MAX_UINT32

+#define     VARIABLE_POLICY_NO_MUST_ATTR            0

+#define     VARIABLE_POLICY_NO_CANT_ATTR            0

+

+#define     VARIABLE_POLICY_TYPE_NO_LOCK            0

+#define     VARIABLE_POLICY_TYPE_LOCK_NOW           1

+#define     VARIABLE_POLICY_TYPE_LOCK_ON_CREATE     2

+#define     VARIABLE_POLICY_TYPE_LOCK_ON_VAR_STATE  3

+

+typedef struct {

+  EFI_GUID Namespace;

+  UINT8    Value;

+  UINT8    Padding;

+  // CHAR16   Name[];           // Variable Length Field

+} VARIABLE_LOCK_ON_VAR_STATE_POLICY;

+#pragma pack(pop)

+

+/**

+  This API function disables the variable policy enforcement. If it's

+  already been called once, will return EFI_ALREADY_STARTED.

+

+  @retval     EFI_SUCCESS

+  @retval     EFI_ALREADY_STARTED   Has already been called once this boot.

+  @retval     EFI_WRITE_PROTECTED   Interface has been locked until reboot.

+  @retval     EFI_WRITE_PROTECTED   Interface option is disabled by platform PCD.

+

+**/

+typedef

+EFI_STATUS

+(EFIAPI *DISABLE_VARIABLE_POLICY)(

+  VOID

+  );

+

+/**

+  This API function returns whether or not the policy engine is

+  currently being enforced.

+

+  @param[out]   State       Pointer to a return value for whether the policy enforcement

+                            is currently enabled.

+

+  @retval     EFI_SUCCESS

+  @retval     Others        An error has prevented this command from completing.

+

+**/

+typedef

+EFI_STATUS

+(EFIAPI *IS_VARIABLE_POLICY_ENABLED)(

+  OUT BOOLEAN *State

+  );

+

+/**

+  This API function validates and registers a new policy with

+  the policy enforcement engine.

+

+  @param[in]  NewPolicy     Pointer to the incoming policy structure.

+

+  @retval     EFI_SUCCESS

+  @retval     EFI_INVALID_PARAMETER   NewPolicy is NULL or is internally inconsistent.

+  @retval     EFI_ALREADY_STARTED     An identical matching policy already exists.

+  @retval     EFI_WRITE_PROTECTED     The interface has been locked until the next reboot.

+  @retval     EFI_ABORTED             A calculation error has prevented this function from completing.

+  @retval     EFI_OUT_OF_RESOURCES    Cannot grow the table to hold any more policies.

+

+**/

+typedef

+EFI_STATUS

+(EFIAPI *REGISTER_VARIABLE_POLICY)(

+  IN CONST VARIABLE_POLICY_ENTRY  *PolicyEntry

+  );

+

+/**

+  This API function will dump the entire contents of the variable policy table.

+

+  Similar to GetVariable, the first call can be made with a 0 size and it will return

+  the size of the buffer required to hold the entire table.

+

+  @param[out]     Policy  Pointer to the policy buffer. Can be NULL if Size is 0.

+  @param[in,out]  Size    On input, the size of the output buffer. On output, the size

+                          of the data returned.

+

+  @retval     EFI_SUCCESS             Policy data is in the output buffer and Size has been updated.

+  @retval     EFI_INVALID_PARAMETER   Size is NULL, or Size is non-zero and Policy is NULL.

+  @retval     EFI_BUFFER_TOO_SMALL    Size is insufficient to hold policy. Size updated with required size.

+

+**/

+typedef

+EFI_STATUS

+(EFIAPI *DUMP_VARIABLE_POLICY)(

+  IN OUT UINT8  *Policy,

+  IN OUT UINT32 *Size

+  );

+

+/**

+  This API function locks the interface so that no more policy updates

+  can be performed or changes made to the enforcement until the next boot.

+

+  @retval     EFI_SUCCESS

+  @retval     Others        An error has prevented this command from completing.

+

+**/

+typedef

+EFI_STATUS

+(EFIAPI *LOCK_VARIABLE_POLICY)(

+  VOID

+  );

+

+typedef struct {

+  UINT64                     Revision;

+  DISABLE_VARIABLE_POLICY    DisableVariablePolicy;

+  IS_VARIABLE_POLICY_ENABLED IsVariablePolicyEnabled;

+  REGISTER_VARIABLE_POLICY   RegisterVariablePolicy;

+  DUMP_VARIABLE_POLICY       DumpVariablePolicy;

+  LOCK_VARIABLE_POLICY       LockVariablePolicy;

+} _EDKII_VARIABLE_POLICY_PROTOCOL;

+

+typedef _EDKII_VARIABLE_POLICY_PROTOCOL EDKII_VARIABLE_POLICY_PROTOCOL;

+

+extern EFI_GUID gEdkiiVariablePolicyProtocolGuid;

+

+#endif

diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec
index 4f44af694862..2e0461b87c32 100644
--- a/MdeModulePkg/MdeModulePkg.dec
+++ b/MdeModulePkg/MdeModulePkg.dec
@@ -8,7 +8,7 @@
 # Copyright (c) 2016, Linaro Ltd. All rights reserved.<BR>

 # (C) Copyright 2016 - 2019 Hewlett Packard Enterprise Development LP<BR>

 # Copyright (c) 2017, AMD Incorporated. All rights reserved.<BR>

-# Copyright (c) 2016, Microsoft Corporation<BR>

+# Copyright (c) Microsoft Corporation.<BR>

 # SPDX-License-Identifier: BSD-2-Clause-Patent

 #

 ##

@@ -624,6 +624,9 @@ [Protocols]
 #   0x80000006 | Incorrect error code provided.

 #



+  ## Include/Protocol/VariablePolicy.h

+  gEdkiiVariablePolicyProtocolGuid = { 0x81D1675C, 0x86F6, 0x48DF, { 0xBD, 0x95, 0x9A, 0x6E, 0x4F, 0x09, 0x25, 0xC3 } }

+

 [PcdsFeatureFlag]

   ## Indicates if the platform can support update capsule across a system reset.<BR><BR>

   #   TRUE  - Supports update capsule across a system reset.<BR>

@@ -1129,6 +1132,15 @@ [PcdsFixedAtBuild, PcdsPatchableInModule]
   # @Prompt Variable storage size.

   gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0x10000|UINT32|0x30000005



+  ## Toggle for whether the VariablePolicy engine should allow disabling.

+  # The engine is enabled at power-on, but the interface allows the platform to

+  # disable enforcement for servicing flexibility. If this PCD is disabled, it will block the ability to

+  # disable the enforcement and VariablePolicy enforcement will always be ON.

+  #   TRUE - VariablePolicy can be disabled by request through the interface (until interface is locked)

+  #   FALSE - VariablePolicy interface will not accept requests to disable and is ALWAYS ON

+  # @Prompt Allow VariablePolicy enforcement to be disabled.

+  gEfiMdeModulePkgTokenSpaceGuid.PcdAllowVariablePolicyEnforcementDisable|FALSE|BOOLEAN|0x30000020

+

   ## FFS filename to find the ACPI tables.

   # @Prompt FFS name of ACPI tables storage.

   gEfiMdeModulePkgTokenSpaceGuid.PcdAcpiTableStorageFile|{ 0x25, 0x4e, 0x37, 0x7e, 0x01, 0x8e, 0xee, 0x4f, 0x87, 0xf2, 0x39, 0xc, 0x23, 0xc6, 0x6, 0xcd }|VOID*|0x30000016

diff --git a/MdeModulePkg/MdeModulePkg.uni b/MdeModulePkg/MdeModulePkg.uni
index 2007e0596c4f..b64e7f351cda 100644
--- a/MdeModulePkg/MdeModulePkg.uni
+++ b/MdeModulePkg/MdeModulePkg.uni
@@ -129,6 +129,13 @@


 #string STR_gEfiMdeModulePkgTokenSpaceGuid_PcdVariableStoreSize_HELP  #language en-US "The size of volatile buffer. This buffer is used to store VOLATILE attribute variables."



+#string STR_gEfiMdeModulePkgTokenSpaceGuid_PcdAllowVariablePolicyEnforcementDisable_PROMPT  #language en-US "Allow VariablePolicy enforcement to be disabled."

+

+#string STR_gEfiMdeModulePkgTokenSpaceGuid_PcdAllowVariablePolicyEnforcementDisable_HELP  #language en-US "If this PCD is disabled, it will block the ability to<BR>\n"

+                                                                                                          "disable the enforcement and VariablePolicy enforcement will always be ON.<BR>\n"

+                                                                                                          "TRUE - VariablePolicy can be disabled by request through the interface (until interface is locked)<BR>\n"

+                                                                                                          "FALSE - VariablePolicy interface will not accept requests to disable and is ALWAYS ON<BR>\n"

+

 #string STR_gEfiMdeModulePkgTokenSpaceGuid_PcdAcpiTableStorageFile_PROMPT  #language en-US "FFS name of ACPI tables storage"



 #string STR_gEfiMdeModulePkgTokenSpaceGuid_PcdAcpiTableStorageFile_HELP  #language en-US "FFS filename to find the ACPI tables."

--
2.26.2.windows.1.8.g01c50adf56.20200515075929


-=-=-=-=-=-=
Groups.io Links: You receive all messages sent to this group.

View/Reply Online (#60644): https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fedk2.groups.io%2Fg%2Fdevel%2Fmessage%2F60644&amp;data=02%7C01%7CBret.Barkelew%40microsoft.com%7Ccaae5a1fbb05498c984f08d807a3dae0%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637267747624441639&amp;sdata=ZQFJQe8PJmptFsKmkJCFozLPOxTS47DpJFUnScb0B3M%3D&amp;reserved=0
Mute This Topic: https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgroups.io%2Fmt%2F74646433%2F1822150&amp;data=02%7C01%7CBret.Barkelew%40microsoft.com%7Ccaae5a1fbb05498c984f08d807a3dae0%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637267747624441639&amp;sdata=xQG6kqTp47BHoWZnM%2BZ0RkY3Wzvxnf1E0YL2YCr8vJc%3D&amp;reserved=0
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fedk2.groups.io%2Fg%2Fdevel%2Funsub&amp;data=02%7C01%7CBret.Barkelew%40microsoft.com%7Ccaae5a1fbb05498c984f08d807a3dae0%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637267747624441639&amp;sdata=Z7rwTjYt934NJzkClQX32dISKzS%2FA7SrSaFL%2FKwDPOM%3D&amp;reserved=0  [brbarkel@microsoft.com]
-=-=-=-=-=-=


[-- Attachment #2: Type: text/html, Size: 22316 bytes --]