From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from NAM04-SN1-obe.outbound.protection.outlook.com (NAM04-SN1-obe.outbound.protection.outlook.com [40.107.70.107]) by mx.groups.io with SMTP id smtpd.web11.479.1589347113040841360 for ; Tue, 12 May 2020 22:18:33 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@microsoft.com header.s=selector2 header.b=Kalrgob5; spf=pass (domain: microsoft.com, ip: 40.107.70.107, mailfrom: bret.barkelew@microsoft.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=i2keIx/8+DhWChfjYp3XD0Kp1tBnPAXn3ZFZ5mvQxjR4fvF/WkBEHxwArNTiSvTk23GAnGoYYkKYOlagLjcd8FupunDH0J4pVj9SBJiEMCHxZkHgYjtomkDL1F3CiKvaSzNnWjbag+AvvjnPpEamKHiV6WyF6z6YGXWwDsrqhYS+tSJh0kjG6CjfvVNqHc+2Biyd+n3yMByB8Jq80LWK420Y5VgMj/J+PuraheKiNoGLqBDhd89270dAFXCXdwWYCWrasNjyQVCZe7b2fLkgoT01WinzB//ORxyf3u5np0f4fs+Bdx1mU1JXPltNVub1S2uLMEyrBvLowcqyeV+Hpw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=kSJl6ZQHwzDOt2nyXG18ydGopt3joeJXgOsuM7ZWfoc=; b=OY/E6OhVfzLBG0Dz/OVjVs2+17pURaICEMj0+g/o/4/VQV/aa5tXN/pO+72gqWOZOroAWLBMEjOg+KKIQ2jufyE/A+iHSIBQvw9OUhBfeFbVqrdLBVVZ7QcFrIUpbVEG+vYzBYu7bAz4kGmxXD6ZJZxHjlmgtTOxwG2CH1mxiDqjpL8gf3y8vgHDDHjQTxoIZJqctTkKfDBP+byJK4NAeOKEHzZIt3IQyZg0krDSm63EOfhFN8aKfqCDyVBATbKmWcw1UPx8IlrxgQh7l3XgSheA3tWxyHEQQ4MwEuxmaZlDeoF1ABtRzOCRVID8pwwBb4POP6VGa4w8T7sHjAdPVQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=kSJl6ZQHwzDOt2nyXG18ydGopt3joeJXgOsuM7ZWfoc=; b=Kalrgob5CDM6kB6hDseLIpV14WbLLiDP6ijOmfznMCqw2EQzt89qqiZA29h4akI/eWzQoY3a6wTxruMgkRPuWLMPNO7qkLKhb4XxVZHsYOHFAazUvfYdwrql1bcy3h40N/ak3O/YuoaoQJDqDWNXx4YiVD2NC2VXdfL19wP5MO8= Received: from CY4PR21MB0743.namprd21.prod.outlook.com (2603:10b6:903:b2::9) by CY4PR2101MB0803.namprd21.prod.outlook.com (2603:10b6:910:8f::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3000.7; Wed, 13 May 2020 05:18:31 +0000 Received: from CY4PR21MB0743.namprd21.prod.outlook.com ([fe80::9918:8742:bbe7:84e8]) by CY4PR21MB0743.namprd21.prod.outlook.com ([fe80::9918:8742:bbe7:84e8%14]) with mapi id 15.20.3021.002; Wed, 13 May 2020 05:18:31 +0000 From: "Bret Barkelew" To: "devel@edk2.groups.io" , "lersek@redhat.com" , "michael.kubacki@outlook.com" CC: "Yao, Jiewen" , Chao Zhang , Jian J Wang , Hao A Wu , liming.gao , Jordan Justen , Ard Biesheuvel , Andrew Fish , "Ni, Ray" , Anthony Perard , Julien Grall , Maurice Ma , Guo Dong , Benjamin You Subject: Re: [EXTERNAL] Re: [edk2-devel] [PATCH v2 00/12] Add the VariablePolicy feature Thread-Topic: [EXTERNAL] Re: [edk2-devel] [PATCH v2 00/12] Add the VariablePolicy feature Thread-Index: AQHWKFPnp5FwvW9nLU6cZwHLfduP/qilexji Date: Wed, 13 May 2020 05:18:30 +0000 Message-ID: References: ,<11a89bca-ea96-9ba0-2177-e995b98e6943@redhat.com> In-Reply-To: <11a89bca-ea96-9ba0-2177-e995b98e6943@redhat.com> Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-05-13T05:18:02.4299761Z;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Privileged authentication-results: edk2.groups.io; dkim=none (message not signed) header.d=none;edk2.groups.io; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [71.212.135.200] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: ed818c21-d03a-4319-4ddd-08d7f6fd1378 x-ms-traffictypediagnostic: CY4PR2101MB0803: x-ld-processed: 72f988bf-86f1-41af-91ab-2d7cd011db47,ExtAddr x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8882; x-forefront-prvs: 0402872DA1 x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: y6FJFkgDboG2+w+qh/Jmp28Y5lU5lh2UBUAQ44XoKy9A4aKurqhVcC19p4eetKrso7otyGfdA4y18WEk7GfWgE6OMyWOmgcVGp8lpzUPc7Va7+21VhGQ2AKc/J8nW8i2ga9BKinKTvs29fn2ge3oVgUUFdj1ObzD38iJw8M2EgJVb0LdbiIRW0NgG262IBcTUMdkVh4Fn1ixhLtRZzIBHNbl7H9xI1fYw+lQmVTGPtKUYRJmPCMMitCMwbDbizeodY73W7ihBj82AhZ2YJaMyx0qIyJPQd5jbJNdW8oSYXc+tCP5x1lTisKFk+JMovs1umkqcbrRU1g6EPO5zpUNTBkw7JZf06Ztk6C9gRghxc3JEHqXGLDiYsymZshTC5VA0UgDWwXhI0m5pjHlugBMG0KqKNbe+XNOO6/ql6QTZZikh+G/UHSg+zu5bkqzQJSMAXberDy/qDU8TBFlbZgLJOE+e/qOMNKak3mpnWCVTXNTzObuu6FM9x8cCl92F8D0bQ25JtE6WkIxUhzBzfNdZ2sBLBB3hSyplX3/JcochMh+zcfCgr5o+BD/geR/52mhPB5/g13nn65eDnB8ATVv8vDxdaso2GR+kvl6ZwusPEQ= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CY4PR21MB0743.namprd21.prod.outlook.com;PTR:;CAT:NONE;SFTY:;SFS:(4636009)(346002)(136003)(39860400002)(376002)(396003)(366004)(33430700001)(7416002)(186003)(110136005)(6506007)(9686003)(52536014)(66556008)(82960400001)(55016002)(76116006)(82950400001)(71200400001)(66946007)(33656002)(5660300002)(10290500003)(2906002)(66446008)(30864003)(33440700001)(66476007)(64756008)(478600001)(86362001)(8990500004)(8676002)(4326008)(166002)(966005)(54906003)(7696005)(26005)(316002)(8936002)(53546011);DIR:OUT;SFP:1102; x-ms-exchange-antispam-messagedata: hJNWq4ROM4CqSP338kFw9NPvm+vr2dQD55qTFl2KMM98wL8o7QzENpXEXUMh5+2i5wq4K1SwNH7FFmFkvbNN1Rg1vrREsbgfYIn894EWbaKEaEoApooNzbQNuG0Elfy6HTzHeq4FvDRSD4o0yfy36dgKW8FMrKSKOr/YZGXhojcF2RhS6QukMFdHvGdyySbvSZla2HlJjfKPiVajwwDOFVWnTHlcq5lDfArKtQ14TNxsK/wmjQqnzIzkPlr40mSPGjXPHnKbYizflDdxLvrm8AfBIOEzNfl9lWtv8+IFrGRNS6rD+wjOcfYYhfT9oI5aK8m6SoF5n05Z9UenUYXOu/F3asU7lBfsaxOwhccHwv5w15pfLJ2V4sQN10NDCkzC4jpTZHwMD2IC8nbnuPl+Zvq4icNhYVIBawCGTpTgfKxHIbx3fC2z0Elnk5bSMikhBLXcdso+rvNuTBCJvDEcqus1OuI3J661tf3ZEhq/xn2YV9EniSPw8QCPUo9arwTX x-ms-exchange-transport-forked: True MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: ed818c21-d03a-4319-4ddd-08d7f6fd1378 X-MS-Exchange-CrossTenant-originalarrivaltime: 13 May 2020 05:18:30.8365 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: j7u4YnZgSteDIdiFIzoyAj6lIfNTYC5xflL47abBBK58UHbHR5WeR5TkNVBwlTZ9J6/nZH6GtkBqB+w4st0LiA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR2101MB0803 Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_CY4PR21MB0743A3D89C9BE5668345C254EFBF0CY4PR21MB0743namp_" --_000_CY4PR21MB0743A3D89C9BE5668345C254EFBF0CY4PR21MB0743namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable "Not sure about the UefiPayloadPkg platforms; please ask their maintainers.= " UefiPayloadPkg maintainers: what say you? ? - Bret ________________________________ From: devel@edk2.groups.io on behalf of Laszlo Erse= k via groups.io Sent: Tuesday, May 12, 2020 4:52:52 AM To: devel@edk2.groups.io ; michael.kubacki@outlook.c= om Cc: Yao, Jiewen ; Chao Zhang ; Jian J Wang ; Hao A Wu ; limi= ng.gao ; Jordan Justen ; A= rd Biesheuvel ; Andrew Fish ; Ni, = Ray ; Anthony Perard ; Julien = Grall ; Maurice Ma ; Guo Dong ; Benjamin You Subject: [EXTERNAL] Re: [edk2-devel] [PATCH v2 00/12] Add the VariablePoli= cy feature On 05/12/20 08:46, Michael Kubacki wrote: > From: Michael Kubacki > > REF:https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2F= bugzilla.tianocore.org%2Fshow_bug.cgi%3Fid%3D2522&data=3D02%7C01%7Cbret= .barkelew%40microsoft.com%7C98d423482cea4e143c4308d7f66b0927%7C72f988bf86f1= 41af91ab2d7cd011db47%7C1%7C0%7C637248811886928541&sdata=3DGlpxfE6%2FzZR= 01KXRvOoaXQTQEG%2F3TNuaZxJ6C1fl6LI%3D&reserved=3D0 > > The 12 patches in this series add the VariablePolicy feature to the core= , > deprecate Edk2VarLock (while adding a compatibility layer to reduce code > churn), and integrate the VariablePolicy libraries and protocols into > Variable Services. > > Since the integration requires multiple changes, including adding librar= ies, > a protocol, an SMI communication handler, and VariableServices integrati= on, > the patches are broken up by individual library additions and then a fin= al > integration. Security-sensitive changes like bypassing Authenticated > Variable enforcement are also broken out into individual patches so that > attention can be called directly to them. > > Platform porting instructions are described in this wiki entry: > https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fgith= ub.com%2Ftianocore%2Ftianocore.github.io%2Fwiki%2FVariablePolicy-Protocol--= -Enhanced-Method-for-Managing-Variables%23platform-porting&data=3D02%7C= 01%7Cbret.barkelew%40microsoft.com%7C98d423482cea4e143c4308d7f66b0927%7C72f= 988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637248811886928541&sdata=3Do%2F= raXnHgx4RMreIkSFSONm8He0CzM7ZTXoV8loOrxe0%3D&reserved=3D0 (1) This wiki article is helpful, thanks. I have one remark: there's a heading saying "VarCheckPolicyLib NULL Instance": https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fgithub= .com%2Ftianocore%2Ftianocore.github.io%2Fwiki%2FVariablePolicy-Protocol---E= nhanced-Method-for-Managing-Variables%23varcheckpolicylib-null-instance&= ;data=3D02%7C01%7Cbret.barkelew%40microsoft.com%7C98d423482cea4e143c4308d7f= 66b0927%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637248811886928541&= ;sdata=3D4qTYEB6%2F3uJnLZ9MjRHODQGaaPq6zZEp7bFlCXEP7gI%3D&reserved=3D0 I think what's meant is "NULL class", not "NULL instance". (2) The following platform DSC files in edk2 include the non-SMM variable driver ("MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf"), but they are not modified by this patch series: ArmVirtPkg/ArmVirtQemu.dsc ArmVirtPkg/ArmVirtQemuKernel.dsc ArmVirtPkg/ArmVirtXen.dsc OvmfPkg/OvmfXen.dsc UefiPayloadPkg/UefiPayloadPkgIa32.dsc UefiPayloadPkg/UefiPayloadPkgIa32X64.dsc I'm asking that you please (a) include a patch for ArmVirtPkg, (b) update the OvmfPkg patch to cover "OvmfXen.dsc" too. Not sure about the UefiPayloadPkg platforms; please ask their maintainers. (I've CC'd the OvmfXen and UefiPayloadPkg maintainers/reviewers.) Thanks, Laszlo > > Discussion of the feature can be found in multiple places throughout > the last year on the RFC channel, staging branches, and in devel. > > Most recently, this subject was discussed in this thread: > https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fedk2= .groups.io%2Fg%2Fdevel%2Fmessage%2F53712&data=3D02%7C01%7Cbret.barkelew= %40microsoft.com%7C98d423482cea4e143c4308d7f66b0927%7C72f988bf86f141af91ab2= d7cd011db47%7C1%7C0%7C637248811886938531&sdata=3D%2FFmQMtE%2Ffrl6UxNdY9= 4mvckwrXVUJySJ%2BWFSSQp8nCk%3D&reserved=3D0 > (the code branches shared in that discussion are now out of date, but th= e > whitepapers and discussion are relevant). > > Cc: Jiewen Yao > Cc: Chao Zhang > Cc: Jian J Wang > Cc: Hao A Wu > Cc: Liming Gao > Cc: Jordan Justen > Cc: Laszlo Ersek > Cc: Ard Biesheuvel > Cc: Andrew Fish > Cc: Ray Ni > Signed-off-by: Michael Kubacki > > Changes since v1: > * Fixed implementation for RuntimeDxe > * Add PCD to block DisableVariablePolicy > * Fix the DumpVariablePolicy pagination in SMM > > Bret Barkelew (12): > MdeModulePkg: Define the VariablePolicy protocol interface > MdeModulePkg: Define the VariablePolicyLib > MdeModulePkg: Define the VariablePolicyHelperLib > MdeModulePkg: Define the VarCheckPolicyLib and SMM interface > MdeModulePkg: Connect VariablePolicy business logic to > VariableServices > MdeModulePkg: Allow VariablePolicy state to delete protected variables > SecurityPkg: Allow VariablePolicy state to delete authenticated > variables > MdeModulePkg: Change TCG MOR variables to use VariablePolicy > MdeModulePkg: Drop VarLock from RuntimeDxe variable driver > MdeModulePkg: Add a shell-based functional test for VariablePolicy > OvmfPkg: Add VariablePolicy engine to OvmfPkg platform > EmulatorPkg: Add VariablePolicy engine to EmulatorPkg platform > > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c = | 318 +++ > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c = | 396 ++++ > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c = | 46 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDx= e.c | 85 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c = | 806 +++++++ > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariableP= olicyUnitTest.c | 2285 ++++++++++++++++++++ > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFun= cTestApp.c | 1942 +++++++++++++++++ > MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c = | 52 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c = | 60 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/VarCheck.c = | 49 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c = | 53 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock.c = | 71 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c = | 653 ++++++ > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c = | 14 + > SecurityPkg/Library/AuthVariableLib/AuthService.c = | 22 +- > EmulatorPkg/EmulatorPkg.dsc = | 6 + > MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h = | 54 + > MdeModulePkg/Include/Library/VariablePolicyHelperLib.h = | 164 ++ > MdeModulePkg/Include/Library/VariablePolicyLib.h = | 207 ++ > MdeModulePkg/Include/Protocol/VariablePolicy.h = | 157 ++ > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf = | 44 + > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni = | 12 + > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.in= f | 36 + > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.un= i | 12 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf = | 44 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni = | 12 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf = | 52 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariableP= olicyUnitTest.inf | 41 + > MdeModulePkg/MdeModulePkg.ci.yaml = | 4 +- > MdeModulePkg/MdeModulePkg.dec = | 26 +- > MdeModulePkg/MdeModulePkg.dsc = | 15 + > MdeModulePkg/Test/MdeModulePkgHostTest.dsc = | 11 + > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md = | 55 + > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFun= cTestApp.inf | 42 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf = | 5 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf = | 4 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf = | 12 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf = | 4 + > OvmfPkg/OvmfPkgIa32.dsc = | 8 + > OvmfPkg/OvmfPkgIa32X64.dsc = | 8 + > OvmfPkg/OvmfPkgX64.dsc = | 8 + > SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf = | 2 + > 42 files changed, 7819 insertions(+), 78 deletions(-) > create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolic= yLib.c > create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/Variabl= ePolicyHelperLib.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolic= yExtraInitNull.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolic= yExtraInitRuntimeDxe.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolic= yLib.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolic= yUnitTest/VariablePolicyUnitTest.c > create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestAp= p/VariablePolicyFuncTestApp.c > create mode 100644 MdeModulePkg/Universal/Variable/RuntimeDxe/VariableL= ockRequstToLock.c > create mode 100644 MdeModulePkg/Universal/Variable/RuntimeDxe/VariableP= olicySmmDxe.c > create mode 100644 MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h > create mode 100644 MdeModulePkg/Include/Library/VariablePolicyHelperLib= .h > create mode 100644 MdeModulePkg/Include/Library/VariablePolicyLib.h > create mode 100644 MdeModulePkg/Include/Protocol/VariablePolicy.h > create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolic= yLib.inf > create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolic= yLib.uni > create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/Variabl= ePolicyHelperLib.inf > create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/Variabl= ePolicyHelperLib.uni > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolic= yLib.inf > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolic= yLib.uni > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolic= yLibRuntimeDxe.inf > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolic= yUnitTest/VariablePolicyUnitTest.inf > create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestAp= p/Readme.md > create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestAp= p/VariablePolicyFuncTestApp.inf > --_000_CY4PR21MB0743A3D89C9BE5668345C254EFBF0CY4PR21MB0743namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

“Not sure about the UefiPayloadPkg platforms;= please ask their maintainers.”

 

UefiPayloadPkg maintainers: what say you? 😉

 

- Bret

 

From: devel@edk2.groups.io= <devel@edk2.groups.io> on behalf of Laszlo Ersek via groups.io <l= ersek=3Dredhat.com@groups.io>
Sent: Tuesday, May 12, 2020 4:52:52 AM
To: devel@edk2.groups.io <devel@edk2.groups.io>; michael.kuba= cki@outlook.com <michael.kubacki@outlook.com>
Cc: Yao, Jiewen <jiewen.yao@intel.com>; Chao Zhang <chao.b= .zhang@intel.com>; Jian J Wang <jian.j.wang@intel.com>; Hao A Wu &= lt;hao.a.wu@intel.com>; liming.gao <liming.gao@intel.com>; Jordan = Justen <jordan.l.justen@intel.com>; Ard Biesheuvel <ard.biesheuvel= @arm.com>; Andrew Fish <afish@apple.com>; Ni, Ray <ray.ni@intel.com>; An= thony Perard <anthony.perard@citrix.com>; Julien Grall <julien@xen= .org>; Maurice Ma <maurice.ma@intel.com>; Guo Dong <guo.dong@in= tel.com>; Benjamin You <benjamin.you@intel.com>
Subject: [EXTERNAL] Re: [edk2-devel] [PATCH v2 00/12] Add the Varia= blePolicy feature
 
On 05/12/20 08:46, Michael Kubacki wrote:
> From: Michael Kubacki <michael.kubacki@microsoft.com>
>
> REF:https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F= %2Fbugzilla.tianocore.org%2Fshow_bug.cgi%3Fid%3D2522&amp;data=3D02%7C01= %7Cbret.barkelew%40microsoft.com%7C98d423482cea4e143c4308d7f66b0927%7C72f98= 8bf86f141af91ab2d7cd011db47%7C1%7C0%7C637248811886928541&amp;sdata=3DGl= pxfE6%2FzZR01KXRvOoaXQTQEG%2F3TNuaZxJ6C1fl6LI%3D&amp;reserved=3D0
>
> The 12 patches in this series add the VariablePolicy feature to the c= ore,
> deprecate Edk2VarLock (while adding a compatibility layer to reduce c= ode
> churn), and integrate the VariablePolicy libraries and protocols into=
> Variable Services.
>
> Since the integration requires multiple changes, including adding lib= raries,
> a protocol, an SMI communication handler, and VariableServices integr= ation,
> the patches are broken up by individual library additions and then a = final
> integration. Security-sensitive changes like bypassing Authenticated<= br> > Variable enforcement are also broken out into individual patches so t= hat
> attention can be called directly to them.
>
> Platform porting instructions are described in this wiki entry:
> https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fgithub= .com%2Ftianocore%2Ftianocore.github.io%2Fwiki%2FVariablePolicy-Protocol---E= nhanced-Method-for-Managing-Variables%23platform-porting&amp;data=3D02%= 7C01%7Cbret.barkelew%40microsoft.com%7C98d423482cea4e143c4308d7f66b0927%7C7= 2f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637248811886928541&amp;sdata= =3Do%2FraXnHgx4RMreIkSFSONm8He0CzM7ZTXoV8loOrxe0%3D&amp;reserved=3D0

(1) This wiki article is helpful, thanks.

I have one remark: there's a heading saying "VarCheckPolicyLib NULL Instance":

https://nam06.safelinks.protection.outlook.com/?url= = =3Dhttps%3A%2F%2Fgithub.com%2Ftianocore%2Ftianocore.github.io%2Fwiki%2FVar= iablePolicy-Protocol---Enhanced-Method-for-Managing-Variables%23varcheckpol= icylib-null-instance&amp;data=3D02%7C01%7Cbret.barkelew%40microsoft.com= %7C98d423482cea4e143c4308d7f66b0927%7C72f988bf86f141af91ab2d7cd011db47%7C1%= 7C0%7C637248811886928541&amp;sdata=3D4qTYEB6%2F3uJnLZ9MjRHODQGaaPq6zZEp= 7bFlCXEP7gI%3D&amp;reserved=3D0

I think what's meant is "NULL class", not "NULL instance&qu= ot;.

(2) The following platform DSC files in edk2 include the non-SMM
variable driver
("MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf&q= uot;),
but they are not modified by this patch series:

ArmVirtPkg/ArmVirtQemu.dsc
ArmVirtPkg/ArmVirtQemuKernel.dsc
ArmVirtPkg/ArmVirtXen.dsc
OvmfPkg/OvmfXen.dsc
UefiPayloadPkg/UefiPayloadPkgIa32.dsc
UefiPayloadPkg/UefiPayloadPkgIa32X64.dsc

I'm asking that you please (a) include a patch for ArmVirtPkg, (b)
update the OvmfPkg patch to cover "OvmfXen.dsc" too.

Not sure about the UefiPayloadPkg platforms; please ask their maintainers.=

(I've CC'd the OvmfXen and UefiPayloadPkg maintainers/reviewers.)

Thanks,
Laszlo

>
> Discussion of the feature can be found in multiple places throughout<= br> > the last year on the RFC channel, staging branches, and in devel.
>
> Most recently, this subject was discussed in this thread:
> https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fedk2.g= roups.io%2Fg%2Fdevel%2Fmessage%2F53712&amp;data=3D02%7C01%7Cbret.barkel= ew%40microsoft.com%7C98d423482cea4e143c4308d7f66b0927%7C72f988bf86f141af91a= b2d7cd011db47%7C1%7C0%7C637248811886938531&amp;sdata=3D%2FFmQMtE%2Ffrl6= UxNdY94mvckwrXVUJySJ%2BWFSSQp8nCk%3D&amp;reserved=3D0
> (the code branches shared in that discussion are now out of date, but= the
> whitepapers and discussion are relevant).
>
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> Cc: Chao Zhang <chao.b.zhang@intel.com>
> Cc: Jian J Wang <jian.j.wang@intel.com>
> Cc: Hao A Wu <hao.a.wu@intel.com>
> Cc: Liming Gao <liming.gao@intel.com>
> Cc: Jordan Justen <jordan.l.justen@intel.com>
> Cc: Laszlo Ersek <lersek@redhat.com>
> Cc: Ard Biesheuvel <ard.biesheuvel@arm.com>
> Cc: Andrew Fish <afish@apple.com>
> Cc: Ray Ni <ray.ni@intel.com>
> Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com><= br> >
> Changes since v1:
> * Fixed implementation for RuntimeDxe
> * Add PCD to block DisableVariablePolicy
> * Fix the DumpVariablePolicy pagination in SMM
>
> Bret Barkelew (12):
>   MdeModulePkg: Define the VariablePolicy protocol interfac= e
>   MdeModulePkg: Define the VariablePolicyLib
>   MdeModulePkg: Define the VariablePolicyHelperLib
>   MdeModulePkg: Define the VarCheckPolicyLib and SMM interf= ace
>   MdeModulePkg: Connect VariablePolicy business logic to >     VariableServices
>   MdeModulePkg: Allow VariablePolicy state to delete protec= ted variables
>   SecurityPkg: Allow VariablePolicy state to delete authent= icated
>     variables
>   MdeModulePkg: Change TCG MOR variables to use VariablePol= icy
>   MdeModulePkg: Drop VarLock from RuntimeDxe variable drive= r
>   MdeModulePkg: Add a shell-based functional test for Varia= blePolicy
>   OvmfPkg: Add VariablePolicy engine to OvmfPkg platform >   EmulatorPkg: Add VariablePolicy engine to EmulatorPkg pla= tform
>
>  MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c = ;            &n= bsp;            = ;     |  318 +++
>  MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelp= erLib.c           &n= bsp;       |  396 ++++ >  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitN= ull.c           &nbs= p;         |   46 + >  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitR= untimeDxe.c          &nbs= p;    |   85 +
>  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c = ;            &n= bsp;            = ;     |  806 +++++++ >  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/V= ariablePolicyUnitTest.c   | 2285 ++++++&#= 43;+++++++++++++
>  MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariableP= olicyFuncTestApp.c        | 1942 +&#= 43;++++++++++++++&#= 43;
>  MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c = ;            &n= bsp;            = ;     |   52 +-
>  MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c = ;            &n= bsp;            = ;     |   60 +-
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VarCheck.c &nbs= p;            &= nbsp;           &nbs= p;         |   49 +-<= br> >  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c &= nbsp;           &nbs= p;            &= nbsp;      |   53 +
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstTo= Lock.c           &nb= sp;        |   71 +
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe= .c            &= nbsp;           |  6= 53 ++++++
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDx= e.c            =            |   = 14 +
>  SecurityPkg/Library/AuthVariableLib/AuthService.c  &n= bsp;            = ;            &n= bsp;            |&nb= sp;  22 +-
>  EmulatorPkg/EmulatorPkg.dsc      =             &nb= sp;            =             &nb= sp;            =       |    6 +
>  MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h   =             &nb= sp;            =             &nb= sp;   |   54 +
>  MdeModulePkg/Include/Library/VariablePolicyHelperLib.h &nb= sp;            =             &nb= sp;        |  164 ++
>  MdeModulePkg/Include/Library/VariablePolicyLib.h  &nb= sp;            =             &nb= sp;            = |  207 ++
>  MdeModulePkg/Include/Protocol/VariablePolicy.h   = ;            &n= bsp;            = ;            &n= bsp;  |  157 ++
>  MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf&nb= sp;            =             &nb= sp;   |   44 +
>  MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni&nb= sp;            =             &nb= sp;   |   12 +
>  MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelp= erLib.inf           =       |   36 +
>  MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelp= erLib.uni           =       |   12 +
>  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf&nb= sp;            =             &nb= sp;   |   44 +
>  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni&nb= sp;            =             &nb= sp;   |   12 +
>  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntime= Dxe.inf           &n= bsp;       |   52 +
>  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/V= ariablePolicyUnitTest.inf |   41 +
>  MdeModulePkg/MdeModulePkg.ci.yaml     =             &nb= sp;            =             &nb= sp;            = |    4 +-
>  MdeModulePkg/MdeModulePkg.dec     &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;    |   26 +-
>  MdeModulePkg/MdeModulePkg.dsc     &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;    |   15 +
>  MdeModulePkg/Test/MdeModulePkgHostTest.dsc   &nb= sp;            =             &nb= sp;            =       |   11 +
>  MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md=             &nb= sp;            = |   55 +
>  MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariableP= olicyFuncTestApp.inf      |   42 + >  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.i= nf            &= nbsp;           | &n= bsp;  5 +
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf = ;            &n= bsp;            = ;     |    4 +
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDx= e.inf           &nbs= p;         |   12 + >  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm= .inf            = ;          |   = 4 +
>  OvmfPkg/OvmfPkgIa32.dsc      &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;         |    8 &#= 43;
>  OvmfPkg/OvmfPkgIa32X64.dsc      &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;      |    8 +
>  OvmfPkg/OvmfPkgX64.dsc       = ;            &n= bsp;            = ;            &n= bsp;            = ;          |   = 8 +
>  SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf &n= bsp;            = ;            &n= bsp;       |    2 +
>  42 files changed, 7819 insertions(+), 78 deletions(-)
>  create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCh= eckPolicyLib.c
>  create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib= /VariablePolicyHelperLib.c
>  create mode 100644 MdeModulePkg/Library/VariablePolicyLib/Varia= blePolicyExtraInitNull.c
>  create mode 100644 MdeModulePkg/Library/VariablePolicyLib/Varia= blePolicyExtraInitRuntimeDxe.c
>  create mode 100644 MdeModulePkg/Library/VariablePolicyLib/Varia= blePolicyLib.c
>  create mode 100644 MdeModulePkg/Library/VariablePolicyLib/Varia= blePolicyUnitTest/VariablePolicyUnitTest.c
>  create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFu= ncTestApp/VariablePolicyFuncTestApp.c
>  create mode 100644 MdeModulePkg/Universal/Variable/RuntimeDxe/V= ariableLockRequstToLock.c
>  create mode 100644 MdeModulePkg/Universal/Variable/RuntimeDxe/V= ariablePolicySmmDxe.c
>  create mode 100644 MdeModulePkg/Include/Guid/VarCheckPolicyMmi.= h
>  create mode 100644 MdeModulePkg/Include/Library/VariablePolicyH= elperLib.h
>  create mode 100644 MdeModulePkg/Include/Library/VariablePolicyL= ib.h
>  create mode 100644 MdeModulePkg/Include/Protocol/VariablePolicy= .h
>  create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCh= eckPolicyLib.inf
>  create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCh= eckPolicyLib.uni
>  create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib= /VariablePolicyHelperLib.inf
>  create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib= /VariablePolicyHelperLib.uni
>  create mode 100644 MdeModulePkg/Library/VariablePolicyLib/Varia= blePolicyLib.inf
>  create mode 100644 MdeModulePkg/Library/VariablePolicyLib/Varia= blePolicyLib.uni
>  create mode 100644 MdeModulePkg/Library/VariablePolicyLib/Varia= blePolicyLibRuntimeDxe.inf
>  create mode 100644 MdeModulePkg/Library/VariablePolicyLib/Varia= blePolicyUnitTest/VariablePolicyUnitTest.inf
>  create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFu= ncTestApp/Readme.md
>  create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFu= ncTestApp/VariablePolicyFuncTestApp.inf
>




--_000_CY4PR21MB0743A3D89C9BE5668345C254EFBF0CY4PR21MB0743namp_--