https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzilla.tianocore.org%2Fshow_bug.cgi%3Fid%3D2522&data=02%7C01%7CBret.Barkelew%40microsoft.com%7Ccaae5a1fbb05498c984f08d807a3dae0%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637267747624441639&sdata=zb9OOX6YpaObdlezhQmsj5zCSd1JS6ay6DVhGkiJRdU%3D&reserved=0
VariablePolicy is an updated interface to
replace VarLock and VarCheckProtocol.
Add the VariablePolicy protocol interface
header and add to the MdeModulePkg.dec file.
Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Hao A Wu <hao.a.wu@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Bret Barkelew <brbarkel@microsoft.com>
Signed-off-by: Bret Barkelew <brbarkel@microsoft.com>
---
MdeModulePkg/Include/Protocol/VariablePolicy.h | 157 ++++++++++++++++++++
MdeModulePkg/MdeModulePkg.dec | 14 +-
MdeModulePkg/MdeModulePkg.uni | 7 +
3 files changed, 177 insertions(+), 1 deletion(-)
diff --git a/MdeModulePkg/Include/Protocol/VariablePolicy.h b/MdeModulePkg/Include/Protocol/VariablePolicy.h
new file mode 100644
index 000000000000..8226c187a77b
--- /dev/null
+++ b/MdeModulePkg/Include/Protocol/VariablePolicy.h
@@ -0,0 +1,157 @@
+/** @file -- VariablePolicy.h
+
+This protocol allows communication with Variable Policy Engine.
+
+Copyright (c) Microsoft Corporation.
+SPDX-License-Identifier: BSD-2-Clause-Patent
+**/
+
+#ifndef __EDKII_VARIABLE_POLICY_PROTOCOL__
+#define __EDKII_VARIABLE_POLICY_PROTOCOL__
+
+#define EDKII_VARIABLE_POLICY_PROTOCOL_REVISION 0x0000000000010000
+
+#define EDKII_VARIABLE_POLICY_PROTOCOL_GUID \
+ { \
+ 0x81D1675C, 0x86F6, 0x48DF, { 0xBD, 0x95, 0x9A, 0x6E, 0x4F, 0x09, 0x25, 0xC3 } \
+ }
+
+#define VARIABLE_POLICY_ENTRY_REVISION 0x00010000
+
+#pragma pack(push, 1)
+typedef struct {
+ UINT32 Version;
+ UINT16 Size;
+ UINT16 OffsetToName;
+ EFI_GUID Namespace;
+ UINT32 MinSize;
+ UINT32 MaxSize;
+ UINT32 AttributesMustHave;
+ UINT32 AttributesCantHave;
+ UINT8 LockPolicyType;
+ UINT8 Padding[3];
+ // UINT8 LockPolicy[]; // Variable Length Field
+ // CHAR16 Name[] // Variable Length Field
+} VARIABLE_POLICY_ENTRY;
+
+#define VARIABLE_POLICY_NO_MIN_SIZE 0
+#define VARIABLE_POLICY_NO_MAX_SIZE MAX_UINT32
+#define VARIABLE_POLICY_NO_MUST_ATTR 0
+#define VARIABLE_POLICY_NO_CANT_ATTR 0
+
+#define VARIABLE_POLICY_TYPE_NO_LOCK 0
+#define VARIABLE_POLICY_TYPE_LOCK_NOW 1
+#define VARIABLE_POLICY_TYPE_LOCK_ON_CREATE 2
+#define VARIABLE_POLICY_TYPE_LOCK_ON_VAR_STATE 3
+
+typedef struct {
+ EFI_GUID Namespace;
+ UINT8 Value;
+ UINT8 Padding;
+ // CHAR16 Name[]; // Variable Length Field
+} VARIABLE_LOCK_ON_VAR_STATE_POLICY;
+#pragma pack(pop)
+
+/**
+ This API function disables the variable policy enforcement. If it's
+ already been called once, will return EFI_ALREADY_STARTED.
+
+ @retval EFI_SUCCESS
+ @retval EFI_ALREADY_STARTED Has already been called once this boot.
+ @retval EFI_WRITE_PROTECTED Interface has been locked until reboot.
+ @retval EFI_WRITE_PROTECTED Interface option is disabled by platform PCD.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *DISABLE_VARIABLE_POLICY)(
+ VOID
+ );
+
+/**
+ This API function returns whether or not the policy engine is
+ currently being enforced.
+
+ @param[out] State Pointer to a return value for whether the policy enforcement
+ is currently enabled.
+
+ @retval EFI_SUCCESS
+ @retval Others An error has prevented this command from completing.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *IS_VARIABLE_POLICY_ENABLED)(
+ OUT BOOLEAN *State
+ );
+
+/**
+ This API function validates and registers a new policy with
+ the policy enforcement engine.
+
+ @param[in] NewPolicy Pointer to the incoming policy structure.
+
+ @retval EFI_SUCCESS
+ @retval EFI_INVALID_PARAMETER NewPolicy is NULL or is internally inconsistent.
+ @retval EFI_ALREADY_STARTED An identical matching policy already exists.
+ @retval EFI_WRITE_PROTECTED The interface has been locked until the next reboot.
+ @retval EFI_ABORTED A calculation error has prevented this function from completing.
+ @retval EFI_OUT_OF_RESOURCES Cannot grow the table to hold any more policies.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *REGISTER_VARIABLE_POLICY)(
+ IN CONST VARIABLE_POLICY_ENTRY *PolicyEntry
+ );
+
+/**
+ This API function will dump the entire contents of the variable policy table.
+
+ Similar to GetVariable, the first call can be made with a 0 size and it will return
+ the size of the buffer required to hold the entire table.
+
+ @param[out] Policy Pointer to the policy buffer. Can be NULL if Size is 0.
+ @param[in,out] Size On input, the size of the output buffer. On output, the size
+ of the data returned.
+
+ @retval EFI_SUCCESS Policy data is in the output buffer and Size has been updated.
+ @retval EFI_INVALID_PARAMETER Size is NULL, or Size is non-zero and Policy is NULL.
+ @retval EFI_BUFFER_TOO_SMALL Size is insufficient to hold policy. Size updated with required size.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *DUMP_VARIABLE_POLICY)(
+ IN OUT UINT8 *Policy,
+ IN OUT UINT32 *Size
+ );
+
+/**
+ This API function locks the interface so that no more policy updates
+ can be performed or changes made to the enforcement until the next boot.
+
+ @retval EFI_SUCCESS
+ @retval Others An error has prevented this command from completing.
+
+**/
+typedef
+EFI_STATUS
+(EFIAPI *LOCK_VARIABLE_POLICY)(
+ VOID
+ );
+
+typedef struct {
+ UINT64 Revision;
+ DISABLE_VARIABLE_POLICY DisableVariablePolicy;
+ IS_VARIABLE_POLICY_ENABLED IsVariablePolicyEnabled;
+ REGISTER_VARIABLE_POLICY RegisterVariablePolicy;
+ DUMP_VARIABLE_POLICY DumpVariablePolicy;
+ LOCK_VARIABLE_POLICY LockVariablePolicy;
+} _EDKII_VARIABLE_POLICY_PROTOCOL;
+
+typedef _EDKII_VARIABLE_POLICY_PROTOCOL EDKII_VARIABLE_POLICY_PROTOCOL;
+
+extern EFI_GUID gEdkiiVariablePolicyProtocolGuid;
+
+#endif
diff --git a/MdeModulePkg/MdeModulePkg.dec b/MdeModulePkg/MdeModulePkg.dec
index 4f44af694862..2e0461b87c32 100644
--- a/MdeModulePkg/MdeModulePkg.dec
+++ b/MdeModulePkg/MdeModulePkg.dec
@@ -8,7 +8,7 @@
# Copyright (c) 2016, Linaro Ltd. All rights reserved.<BR>
# (C) Copyright 2016 - 2019 Hewlett Packard Enterprise Development LP<BR>
# Copyright (c) 2017, AMD Incorporated. All rights reserved.<BR>
-# Copyright (c) 2016, Microsoft Corporation<BR>
+# Copyright (c) Microsoft Corporation.<BR>
# SPDX-License-Identifier: BSD-2-Clause-Patent
#
##
@@ -624,6 +624,9 @@ [Protocols]
# 0x80000006 | Incorrect error code provided.
#
+ ## Include/Protocol/VariablePolicy.h
+ gEdkiiVariablePolicyProtocolGuid = { 0x81D1675C, 0x86F6, 0x48DF, { 0xBD, 0x95, 0x9A, 0x6E, 0x4F, 0x09, 0x25, 0xC3 } }
+
[PcdsFeatureFlag]
## Indicates if the platform can support update capsule across a system reset.<BR><BR>
# TRUE - Supports update capsule across a system reset.<BR>
@@ -1129,6 +1132,15 @@ [PcdsFixedAtBuild, PcdsPatchableInModule]
# @Prompt Variable storage size.
gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize|0x10000|UINT32|0x30000005
+ ## Toggle for whether the VariablePolicy engine should allow disabling.
+ # The engine is enabled at power-on, but the interface allows the platform to
+ # disable enforcement for servicing flexibility. If this PCD is disabled, it will block the ability to
+ # disable the enforcement and VariablePolicy enforcement will always be ON.
+ # TRUE - VariablePolicy can be disabled by request through the interface (until interface is locked)
+ # FALSE - VariablePolicy interface will not accept requests to disable and is ALWAYS ON
+ # @Prompt Allow VariablePolicy enforcement to be disabled.
+ gEfiMdeModulePkgTokenSpaceGuid.PcdAllowVariablePolicyEnforcementDisable|FALSE|BOOLEAN|0x30000020
+
## FFS filename to find the ACPI tables.
# @Prompt FFS name of ACPI tables storage.
gEfiMdeModulePkgTokenSpaceGuid.PcdAcpiTableStorageFile|{ 0x25, 0x4e, 0x37, 0x7e, 0x01, 0x8e, 0xee, 0x4f, 0x87, 0xf2, 0x39, 0xc, 0x23, 0xc6, 0x6, 0xcd }|VOID*|0x30000016
diff --git a/MdeModulePkg/MdeModulePkg.uni b/MdeModulePkg/MdeModulePkg.uni
index 2007e0596c4f..b64e7f351cda 100644
--- a/MdeModulePkg/MdeModulePkg.uni
+++ b/MdeModulePkg/MdeModulePkg.uni
@@ -129,6 +129,13 @@
#string STR_gEfiMdeModulePkgTokenSpaceGuid_PcdVariableStoreSize_HELP #language en-US "The size of volatile buffer. This buffer is used to store VOLATILE attribute variables."
+#string STR_gEfiMdeModulePkgTokenSpaceGuid_PcdAllowVariablePolicyEnforcementDisable_PROMPT #language en-US "Allow VariablePolicy enforcement to be disabled."
+
+#string STR_gEfiMdeModulePkgTokenSpaceGuid_PcdAllowVariablePolicyEnforcementDisable_HELP #language en-US "If this PCD is disabled, it will block the ability to<BR>\n"
+ "disable the enforcement and VariablePolicy enforcement will always be ON.<BR>\n"
+ "TRUE - VariablePolicy can be disabled by request through the interface (until interface is locked)<BR>\n"
+ "FALSE - VariablePolicy interface will not accept requests to disable and is ALWAYS ON<BR>\n"
+
#string STR_gEfiMdeModulePkgTokenSpaceGuid_PcdAcpiTableStorageFile_PROMPT #language en-US "FFS name of ACPI tables storage"
#string STR_gEfiMdeModulePkgTokenSpaceGuid_PcdAcpiTableStorageFile_HELP #language en-US "FFS filename to find the ACPI tables."
--
2.26.2.windows.1.8.g01c50adf56.20200515075929
-=-=-=-=-=-=
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#60644):
https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fedk2.groups.io%2Fg%2Fdevel%2Fmessage%2F60644&data=02%7C01%7CBret.Barkelew%40microsoft.com%7Ccaae5a1fbb05498c984f08d807a3dae0%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637267747624441639&sdata=ZQFJQe8PJmptFsKmkJCFozLPOxTS47DpJFUnScb0B3M%3D&reserved=0
Mute This Topic:
https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgroups.io%2Fmt%2F74646433%2F1822150&data=02%7C01%7CBret.Barkelew%40microsoft.com%7Ccaae5a1fbb05498c984f08d807a3dae0%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637267747624441639&sdata=xQG6kqTp47BHoWZnM%2BZ0RkY3Wzvxnf1E0YL2YCr8vJc%3D&reserved=0
Group Owner: devel+owner@edk2.groups.io
Unsubscribe:
https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fedk2.groups.io%2Fg%2Fdevel%2Funsub&data=02%7C01%7CBret.Barkelew%40microsoft.com%7Ccaae5a1fbb05498c984f08d807a3dae0%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637267747624441639&sdata=Z7rwTjYt934NJzkClQX32dISKzS%2FA7SrSaFL%2FKwDPOM%3D&reserved=0
[brbarkel@microsoft.com]
-=-=-=-=-=-=