Bump. This specific patch needs Reviews. - Bret ________________________________ From: devel@edk2.groups.io on behalf of Bret Barkelew via groups.io Sent: Tuesday, June 2, 2020 11:57 PM To: devel@edk2.groups.io Cc: Jian J Wang ; Hao A Wu ; liming.gao Subject: [EXTERNAL] [edk2-devel] [PATCH v5 01/14] MdeModulePkg: Define the VariablePolicy protocol interface https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzilla.tianocore.org%2Fshow_bug.cgi%3Fid%3D2522&data=02%7C01%7CBret.Barkelew%40microsoft.com%7Ccaae5a1fbb05498c984f08d807a3dae0%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637267747624441639&sdata=zb9OOX6YpaObdlezhQmsj5zCSd1JS6ay6DVhGkiJRdU%3D&reserved=0 VariablePolicy is an updated interface to replace VarLock and VarCheckProtocol. Add the VariablePolicy protocol interface header and add to the MdeModulePkg.dec file. Cc: Jian J Wang Cc: Hao A Wu Cc: Liming Gao Cc: Bret Barkelew Signed-off-by: Bret Barkelew --- MdeModulePkg/Include/Protocol/VariablePolicy.h | 157 ++++++++++++++++++++ MdeModulePkg/MdeModulePkg.dec | 14 +- MdeModulePkg/MdeModulePkg.uni | 7 + 3 files changed, 177 insertions(+), 1 deletion(-) diff --git a/MdeModulePkg/Include/Protocol/VariablePolicy.h b/MdeModulePkg/Include/Protocol/VariablePolicy.h new file mode 100644 index 000000000000..8226c187a77b --- /dev/null +++ b/MdeModulePkg/Include/Protocol/VariablePolicy.h @@ -0,0 +1,157 @@ +/** @file -- VariablePolicy.h + +This protocol allows communication with Variable Policy Engine. + +Copyright (c) Microsoft Corporation. +SPDX-License-Identifier: BSD-2-Clause-Patent +**/ + +#ifndef __EDKII_VARIABLE_POLICY_PROTOCOL__ +#define __EDKII_VARIABLE_POLICY_PROTOCOL__ + +#define EDKII_VARIABLE_POLICY_PROTOCOL_REVISION 0x0000000000010000 + +#define EDKII_VARIABLE_POLICY_PROTOCOL_GUID \ + { \ + 0x81D1675C, 0x86F6, 0x48DF, { 0xBD, 0x95, 0x9A, 0x6E, 0x4F, 0x09, 0x25, 0xC3 } \ + } + +#define VARIABLE_POLICY_ENTRY_REVISION 0x00010000 + +#pragma pack(push, 1) +typedef struct { + UINT32 Version; + UINT16 Size; + UINT16 OffsetToName; + EFI_GUID Namespace; + UINT32 MinSize; + UINT32 MaxSize; + UINT32 AttributesMustHave; + UINT32 AttributesCantHave; + UINT8 LockPolicyType; + UINT8 Padding[3]; + // UINT8 LockPolicy[]; // Variable Length Field + // CHAR16 Name[] // Variable Length Field +} VARIABLE_POLICY_ENTRY; + +#define VARIABLE_POLICY_NO_MIN_SIZE 0 +#define VARIABLE_POLICY_NO_MAX_SIZE MAX_UINT32 +#define VARIABLE_POLICY_NO_MUST_ATTR 0 +#define VARIABLE_POLICY_NO_CANT_ATTR 0 + +#define VARIABLE_POLICY_TYPE_NO_LOCK 0 +#define VARIABLE_POLICY_TYPE_LOCK_NOW 1 +#define VARIABLE_POLICY_TYPE_LOCK_ON_CREATE 2 +#define VARIABLE_POLICY_TYPE_LOCK_ON_VAR_STATE 3 + +typedef struct { + EFI_GUID Namespace; + UINT8 Value; + UINT8 Padding; + // CHAR16 Name[]; // Variable Length Field +} VARIABLE_LOCK_ON_VAR_STATE_POLICY; +#pragma pack(pop) + +/** + This API function disables the variable policy enforcement. If it's + already been called once, will return EFI_ALREADY_STARTED. + + @retval EFI_SUCCESS + @retval EFI_ALREADY_STARTED Has already been called once this boot. + @retval EFI_WRITE_PROTECTED Interface has been locked until reboot. + @retval EFI_WRITE_PROTECTED Interface option is disabled by platform PCD. + +**/ +typedef +EFI_STATUS +(EFIAPI *DISABLE_VARIABLE_POLICY)( + VOID + ); + +/** + This API function returns whether or not the policy engine is + currently being enforced. + + @param[out] State Pointer to a return value for whether the policy enforcement + is currently enabled. + + @retval EFI_SUCCESS + @retval Others An error has prevented this command from completing. + +**/ +typedef +EFI_STATUS +(EFIAPI *IS_VARIABLE_POLICY_ENABLED)( + OUT BOOLEAN *State + ); + +/** + This API function validates and registers a new policy with + the policy enforcement engine. + + @param[in] NewPolicy Pointer to the incoming policy structure. + + @retval EFI_SUCCESS + @retval EFI_INVALID_PARAMETER NewPolicy is NULL or is internally inconsistent. + @retval EFI_ALREADY_STARTED An identical matching policy already exists. + @retval EFI_WRITE_PROTECTED The interface has been locked until the next reboot. + @retval EFI_ABORTED A calculation error has prevented this function from completing. + @retval EFI_OUT_OF_RESOURCES Cannot grow the table to hold any more policies. + +**/ +typedef +EFI_STATUS +(EFIAPI *REGISTER_VARIABLE_POLICY)( + IN CONST VARIABLE_POLICY_ENTRY *PolicyEntry + ); + +/** + This API function will dump the entire contents of the variable policy table. + + Similar to GetVariable, the first call can be made with a 0 size and it will return + the size of the buffer required to hold the entire table. + + @param[out] Policy Pointer to the policy buffer. Can be NULL if Size is 0. + @param[in,out] Size On input, the size of the output buffer. On output, the size + of the data returned. + + @retval EFI_SUCCESS Policy data is in the output buffer and Size has been updated. + @retval EFI_INVALID_PARAMETER Size is NULL, or Size is non-zero and Policy is NULL. + @retval EFI_BUFFER_TOO_SMALL Size is insufficient to hold policy. Size updated with required size. + +**/ +typedef +EFI_STATUS +(EFIAPI *DUMP_VARIABLE_POLICY)( + IN OUT UINT8 *Policy, + IN OUT UINT32 *Size + ); + +/** + This API function locks the interface so that no more policy updates + can be performed or changes made to the enforcement until the next boot. + + @retval EFI_SUCCESS + @retval Others An error has prevented this command from completing. + +**/ +typedef +EFI_STATUS +(EFIAPI *LOCK_VARIABLE_POLICY)( + VOID + ); + +typedef struct { + UINT64 Revision; + DISABLE_VARIABLE_POLICY DisableVariablePolicy; + IS_VARIABLE_POLICY_ENABLED IsVariablePolicyEnabled; + REGISTER_VARIABLE_POLICY RegisterVariablePolicy; + DUMP_VARIABLE_POLICY DumpVariablePolicy; + LOCK_VARIABLE_POLICY LockVariablePolicy; +} _EDKII_VARIABLE_POLICY_PROTOCOL; + +typedef _EDKII_VARIABLE_POLICY_PROTOCOL EDKII_VARIABLE_POLICY_PROTOCOL; + +extern EFI_GUID gEdkiiVariablePolicyProtocolGuid; + +#endif diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec index 4f44af694862..2e0461b87c32 100644 --- a/MdeModulePkg/MdeModulePkg.dec +++ b/MdeModulePkg/MdeModulePkg.dec @@ -8,7 +8,7 @@ # Copyright (c) 2016, Linaro Ltd. All rights reserved.
# (C) Copyright 2016 - 2019 Hewlett Packard Enterprise Development LP
# Copyright (c) 2017, AMD Incorporated. All rights reserved.
-# Copyright (c) 2016, Microsoft Corporation
+# Copyright (c) Microsoft Corporation.
# SPDX-License-Identifier: BSD-2-Clause-Patent # ## @@ -624,6 +624,9 @@ [Protocols] # 0x80000006 | Incorrect error code provided. # + ## Include/Protocol/VariablePolicy.h + gEdkiiVariablePolicyProtocolGuid = { 0x81D1675C, 0x86F6, 0x48DF, { 0xBD, 0x95, 0x9A, 0x6E, 0x4F, 0x09, 0x25, 0xC3 } } + [PcdsFeatureFlag] ## Indicates if the platform can support update capsule across a system reset.

# TRUE - Supports update capsule across a system reset.
@@ -1129,6 +1132,15 @@ [PcdsFixedAtBuild, PcdsPatchableInModule] # @Prompt Variable storage size. gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0x10000|UINT32|0x30000005 + ## Toggle for whether the VariablePolicy engine should allow disabling. + # The engine is enabled at power-on, but the interface allows the platform to + # disable enforcement for servicing flexibility. If this PCD is disabled, it will block the ability to + # disable the enforcement and VariablePolicy enforcement will always be ON. + # TRUE - VariablePolicy can be disabled by request through the interface (until interface is locked) + # FALSE - VariablePolicy interface will not accept requests to disable and is ALWAYS ON + # @Prompt Allow VariablePolicy enforcement to be disabled. + gEfiMdeModulePkgTokenSpaceGuid.PcdAllowVariablePolicyEnforcementDisable|FALSE|BOOLEAN|0x30000020 + ## FFS filename to find the ACPI tables. # @Prompt FFS name of ACPI tables storage. gEfiMdeModulePkgTokenSpaceGuid.PcdAcpiTableStorageFile|{ 0x25, 0x4e, 0x37, 0x7e, 0x01, 0x8e, 0xee, 0x4f, 0x87, 0xf2, 0x39, 0xc, 0x23, 0xc6, 0x6, 0xcd }|VOID*|0x30000016 diff --git a/MdeModulePkg/MdeModulePkg.uni b/MdeModulePkg/MdeModulePkg.uni index 2007e0596c4f..b64e7f351cda 100644 --- a/MdeModulePkg/MdeModulePkg.uni +++ b/MdeModulePkg/MdeModulePkg.uni @@ -129,6 +129,13 @@ #string STR_gEfiMdeModulePkgTokenSpaceGuid_PcdVariableStoreSize_HELP #language en-US "The size of volatile buffer. This buffer is used to store VOLATILE attribute variables." +#string STR_gEfiMdeModulePkgTokenSpaceGuid_PcdAllowVariablePolicyEnforcementDisable_PROMPT #language en-US "Allow VariablePolicy enforcement to be disabled." + +#string STR_gEfiMdeModulePkgTokenSpaceGuid_PcdAllowVariablePolicyEnforcementDisable_HELP #language en-US "If this PCD is disabled, it will block the ability to
\n" + "disable the enforcement and VariablePolicy enforcement will always be ON.
\n" + "TRUE - VariablePolicy can be disabled by request through the interface (until interface is locked)
\n" + "FALSE - VariablePolicy interface will not accept requests to disable and is ALWAYS ON
\n" + #string STR_gEfiMdeModulePkgTokenSpaceGuid_PcdAcpiTableStorageFile_PROMPT #language en-US "FFS name of ACPI tables storage" #string STR_gEfiMdeModulePkgTokenSpaceGuid_PcdAcpiTableStorageFile_HELP #language en-US "FFS filename to find the ACPI tables." -- 2.26.2.windows.1.8.g01c50adf56.20200515075929 -=-=-=-=-=-= Groups.io Links: You receive all messages sent to this group. View/Reply Online (#60644): https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fedk2.groups.io%2Fg%2Fdevel%2Fmessage%2F60644&data=02%7C01%7CBret.Barkelew%40microsoft.com%7Ccaae5a1fbb05498c984f08d807a3dae0%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637267747624441639&sdata=ZQFJQe8PJmptFsKmkJCFozLPOxTS47DpJFUnScb0B3M%3D&reserved=0 Mute This Topic: https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgroups.io%2Fmt%2F74646433%2F1822150&data=02%7C01%7CBret.Barkelew%40microsoft.com%7Ccaae5a1fbb05498c984f08d807a3dae0%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637267747624441639&sdata=xQG6kqTp47BHoWZnM%2BZ0RkY3Wzvxnf1E0YL2YCr8vJc%3D&reserved=0 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fedk2.groups.io%2Fg%2Fdevel%2Funsub&data=02%7C01%7CBret.Barkelew%40microsoft.com%7Ccaae5a1fbb05498c984f08d807a3dae0%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637267747624441639&sdata=Z7rwTjYt934NJzkClQX32dISKzS%2FA7SrSaFL%2FKwDPOM%3D&reserved=0 [brbarkel@microsoft.com] -=-=-=-=-=-=