From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from NAM12-MW2-obe.outbound.protection.outlook.com (NAM12-MW2-obe.outbound.protection.outlook.com [40.107.244.111]) by mx.groups.io with SMTP id smtpd.web11.8619.1589383546085947234 for ; Wed, 13 May 2020 08:25:46 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@microsoft.com header.s=selector2 header.b=ZSXS6VIl; spf=pass (domain: microsoft.com, ip: 40.107.244.111, mailfrom: bret.barkelew@microsoft.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=ejVo/5L4eUbo32mfkrh+QsSh9/VIBvo0LurKUjTqWCjCJ1OzH2QrcsDds6JI0bH/kiVr1kZLTE3tCMGJ4VP7ZCMUIj0NVBJdr5MZiRfeV8zj6BRMthH43Kad959Bqtf/umFzdvVe9mrDEtITY2Q3LvBR8kywwrxOUK67DE5pPr4bX7aA365zCgAvfpSpWoaXZaeD7VHCGoNY13M2cKzR9m24QZsNLUJFBEh2DUY5dA4yyUhmf3iAQGKDPKvpBTHIvO5eXOq7J7Gv+67XLkZWWxMACkBZDR03hTYRNWolF5LUAuAiZ/3dnJCFvc3q4ZKklT8xSOuNzHe4U12NzHr0Lg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=7EhILGUgNzHn1mFn/hNlJfziE8z91nTQx+xYb5rF2RY=; b=M2SZ2UMI4PNxfpQO6/hzAcLNASaOqJFrElRw+j8SmJnGsxm82XRQdweQ1k4PDZJkBDYz6frqo+Kn6l1DdU+75R0fNyaG556njoPQRIz9yRsGzlZFU/F38XxdKpw9hwL0VlSlMrZ6CoZY2RvJT49kXYq3s6/at9PHsktHwFUXBtEbUe99aye2j2qVkAnJMUOnr48r5ZgbCtbaRsh5qlXjVr3Cw+/NHKYzT0+9PjzacsB3coKHoWboapr6wvD+7xzGCquqS2gbGx0B42eLLPQWDcuARRy4eQUcHYWwHMW21j7qHqedI3WP4RLuFcUMnaWElYTt7mRz2LRs31ZanbsbnA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=7EhILGUgNzHn1mFn/hNlJfziE8z91nTQx+xYb5rF2RY=; b=ZSXS6VIlnJTqy50bG4jSOA5g8Z4SxH+j8PnJ15ao4RHcSd7WdJfyubcaIoFkP+9i3Fj0rUIa9I3fnmJLy4EztaqkodgCzi52gwO7X6hcjbWR96hys9k4ptnYtpNgFLZVQ3zw5byvRnUOWsqVAjWY0t43/Z3JIumNe5BkWAvExRg= Received: from CY4PR21MB0743.namprd21.prod.outlook.com (2603:10b6:903:b2::9) by CY4PR21MB0821.namprd21.prod.outlook.com (2603:10b6:903:b8::7) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3000.4; Wed, 13 May 2020 15:25:44 +0000 Received: from CY4PR21MB0743.namprd21.prod.outlook.com ([fe80::9918:8742:bbe7:84e8]) by CY4PR21MB0743.namprd21.prod.outlook.com ([fe80::9918:8742:bbe7:84e8%14]) with mapi id 15.20.3021.002; Wed, 13 May 2020 15:25:44 +0000 From: "Bret Barkelew" To: "Ma, Maurice" , "devel@edk2.groups.io" CC: "Dong, Guo" , "You, Benjamin" Subject: Re: [EXTERNAL] Re: [edk2-devel] [PATCH v2 00/12] Add the VariablePolicy feature Thread-Topic: [EXTERNAL] Re: [edk2-devel] [PATCH v2 00/12] Add the VariablePolicy feature Thread-Index: AQHWKFPnp5FwvW9nLU6cZwHLfduP/qilexjigACnqgCAAAIOTw== Date: Wed, 13 May 2020 15:25:43 +0000 Message-ID: References: ,<11a89bca-ea96-9ba0-2177-e995b98e6943@redhat.com> , In-Reply-To: Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-05-13T05:18:02.4299761Z;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Privileged authentication-results: intel.com; dkim=none (message not signed) header.d=none;intel.com; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [71.212.135.200] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: cda33dc5-389a-4849-771b-08d7f751e76a x-ms-traffictypediagnostic: CY4PR21MB0821: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:8273; x-forefront-prvs: 0402872DA1 x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: Wxrd9hHq9SPRIu1oidxvQEAk4qJtirA/Vc35hEQi3Jrv+X0iJChcQH40vcrBRsREv1M1S8Ru7/2Q8imk+ckp+pgFdEKcrXrRJEi1V/Gi/nfYPt3z3n38UwGEqlr89hyOH63L2viCldbi5cJfe1oo9gNJSXR3GOZOMnskhfjolM/I8SHj3WM9joKhmUjSGHayGYQqdZSShBuqulQPAWIiOe1HdpjP1cNQHdlbED6KTAHnqK/geKdF8Ju4OL3WjRoX2bTBZqPxAOSsnIO2gLDy47jKZcYokau6vM6XDo770c2GUfOIeSdkJob9hjMkDWtBqA4Oe8LFMuCTuFcUAmx4Er2YwXAe7C1SUgmS1OLrRMdxMP7Xz25NpUTcL6e4PKdqFsqKYCI+KLXtn3B1Mr3KS2fYsGkhgAf8HzbMj2usnfDKSOSInzPtSYNsElyPTB1c6W6mMvODhB9vP3QD0F1PahsYbk4xbc/SkCaBDFQUta7taQ7G2+2u4SB/KU4vRQtthVGubBNnyjp2ysSjvN4mnP8462I0r6fwhCU5wV/nL9trZCjLfeP6489hGzlI8Vs4BwEPuv3Tncc7Zu00u0R1Wv9N1kDzOM23Dyn1vZG5ZGc= x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CY4PR21MB0743.namprd21.prod.outlook.com;PTR:;CAT:NONE;SFTY:;SFS:(4636009)(136003)(346002)(376002)(396003)(39860400002)(366004)(33430700001)(966005)(110136005)(76236002)(76116006)(8990500004)(4326008)(2906002)(316002)(30864003)(66946007)(66476007)(64756008)(166002)(33440700001)(55016002)(66556008)(66446008)(91956017)(8936002)(8676002)(478600001)(6506007)(26005)(82960400001)(186003)(10290500003)(9686003)(71200400001)(86362001)(54906003)(19627235002)(7696005)(52536014)(53546011)(82950400001)(5660300002)(33656002);DIR:OUT;SFP:1102; x-ms-exchange-antispam-messagedata: 2z77loX/RbG4/DAsAUZt/uSI2kkhyOCHs5zxXM9IfH3+mL3psSQocmEHuwWNBUMZuPP9n4D/VUfHBXpG6peWHHHhoCHk65UXb12Z5WYa74vLqlbAFEmuqIYf176CM87RrkYUOE9JbQ2+xH0hh3sgNd89q4BbzA2NxB/r11PsyJP285T3xNwzhatCw9IzCWIpoZGc2gIIVBUSHphf77E3PB8G+TjNGjYFw9dAfBaAAXrIrZqtyZr2IVryaDwzbkHnt1pW6LJuAB12Usvm4K0XAAvjANEB6v22pnp7SF3ya+uB58KVGpqKYDPVjhDdpP2uXyG6XPNP/9mQs4vn1n+ucQLIhluMegyI6I22ru3Sc8wWIDn2OcVfX9fmkdS1MANTP3k9QhoWWqFDgFPqZYbNApUzUa3UziUlWq+qnSxtq3MKGSCYySr6IFkndwth4y9Qrei4WvNT5DNUld9jVtXyv5FZDsIEbObZweadrD/cI4P3xooT784wrogTufhle6CK x-ms-exchange-transport-forked: True MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-Network-Message-Id: cda33dc5-389a-4849-771b-08d7f751e76a X-MS-Exchange-CrossTenant-originalarrivaltime: 13 May 2020 15:25:43.9891 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: O4MUEb9uco/X4sETlHpVYZIwk6XWmkiHyaDd6sX8CsqSS17UCVpWM/HE3v7j7fVXHZptNoZbR94S0LPASMF/GQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0821 Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_CY4PR21MB0743B7D4506CD9A1DA41E836EFBF0CY4PR21MB0743namp_" --_000_CY4PR21MB0743B7D4506CD9A1DA41E836EFBF0CY4PR21MB0743namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Sure. Thanks. - Bret ________________________________ From: Ma, Maurice Sent: Wednesday, May 13, 2020 8:18:08 AM To: devel@edk2.groups.io ; Bret Barkelew Cc: Dong, Guo ; You, Benjamin Subject: RE: [EXTERNAL] Re: [edk2-devel] [PATCH v2 00/12] Add the Variable= Policy feature Hi, Bret For UefiPayloadPkg, could you please provide a patch for it ? Thanks Maurice From: devel@edk2.groups.io On Behalf Of Bret Barkel= ew via groups.io Sent: Tuesday, May 12, 2020 22:19 To: devel@edk2.groups.io; lersek@redhat.com; michael.kubacki@outlook.com Cc: Yao, Jiewen ; Zhang, Chao B ; Wang, Jian J ; Wu, Hao A ;= Gao, Liming ; Justen, Jordan L ; Ard Biesheuvel ; Andrew Fish ; Ni, Ray ; Anthony Perard = ; Julien Grall ; Ma, Maurice ; Dong, = Guo ; You, Benjamin Subject: Re: [EXTERNAL] Re: [edk2-devel] [PATCH v2 00/12] Add the Variable= Policy feature =93Not sure about the UefiPayloadPkg platforms; please ask their maintaine= rs.=94 UefiPayloadPkg maintainers: what say you? ?? - Bret ________________________________ From: devel@edk2.groups.io > on behalf of Laszlo Ersek via groups.io <= lersek=3Dredhat.com@groups.io> Sent: Tuesday, May 12, 2020 4:52:52 AM To: devel@edk2.groups.io >; michael.kubacki@outlook.com > Cc: Yao, Jiewen >; Chao = Zhang >; Jian J Wang = >; Hao A Wu >; liming.gao >; Jordan Justen >; Ard Biesheuvel >; Andrew Fish >; Ni, Ray >; Anthony Perard <= anthony.perard@citrix.com>; Julien Grall = >; Maurice Ma >; Guo Dong >; Benjamin You > Subject: [EXTERNAL] Re: [edk2-devel] [PATCH v2 00/12] Add the VariablePoli= cy feature On 05/12/20 08:46, Michael Kubacki wrote: > From: Michael Kubacki > > > REF:https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2F= bugzilla.tianocore.org%2Fshow_bug.cgi%3Fid%3D2522&data=3D02%7C01%7Cbret= .barkelew%40microsoft.com%7C98d423482cea4e143c4308d7f66b0927%7C72f988bf86f1= 41af91ab2d7cd011db47%7C1%7C0%7C637248811886928541&sdata=3DGlpxfE6%2FzZR= 01KXRvOoaXQTQEG%2F3TNuaZxJ6C1fl6LI%3D&reserved=3D0 > > The 12 patches in this series add the VariablePolicy feature to the core= , > deprecate Edk2VarLock (while adding a compatibility layer to reduce code > churn), and integrate the VariablePolicy libraries and protocols into > Variable Services. > > Since the integration requires multiple changes, including adding librar= ies, > a protocol, an SMI communication handler, and VariableServices integrati= on, > the patches are broken up by individual library additions and then a fin= al > integration. Security-sensitive changes like bypassing Authenticated > Variable enforcement are also broken out into individual patches so that > attention can be called directly to them. > > Platform porting instructions are described in this wiki entry: > https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fgith= ub.com%2Ftianocore%2Ftianocore.github.io%2Fwiki%2FVariablePolicy-Protocol--= -Enhanced-Method-for-Managing-Variables%23platform-porting&data=3D02%7C= 01%7Cbret.barkelew%40microsoft.com%7C98d423482cea4e143c4308d7f66b0927%7C72f= 988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637248811886928541&sdata=3Do%2F= raXnHgx4RMreIkSFSONm8He0CzM7ZTXoV8loOrxe0%3D&reserved=3D0 (1) This wiki article is helpful, thanks. I have one remark: there's a heading saying "VarCheckPolicyLib NULL Instance": https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fgithub= .com%2Ftianocore%2Ftianocore.github.io%2Fwiki%2FVariablePolicy-Protocol---E= nhanced-Method-for-Managing-Variables%23varcheckpolicylib-null-instance&= ;data=3D02%7C01%7Cbret.barkelew%40microsoft.com%7C98d423482cea4e143c4308d7f= 66b0927%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637248811886928541&= ;sdata=3D4qTYEB6%2F3uJnLZ9MjRHODQGaaPq6zZEp7bFlCXEP7gI%3D&reserved=3D0<= https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fgithub.= com%2Ftianocore%2Ftianocore.github.io%2Fwiki%2FVariablePolicy-Protocol---En= hanced-Method-for-Managing-Variables%23varcheckpolicylib-null-instance&data= = =3D02%7C01%7Cbret.barkelew%40microsoft.com%7Ca163d58b5f994a077c6708d7f750e= bc2%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637249799249552957&sdata= =3DQmLmlnrWR4FBWrA7Kz%2BlQXph%2FvLpQxIPxi5uZPoES%2Bo%3D&reserved=3D0> I think what's meant is "NULL class", not "NULL instance". (2) The following platform DSC files in edk2 include the non-SMM variable driver ("MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf"), but they are not modified by this patch series: ArmVirtPkg/ArmVirtQemu.dsc ArmVirtPkg/ArmVirtQemuKernel.dsc ArmVirtPkg/ArmVirtXen.dsc OvmfPkg/OvmfXen.dsc UefiPayloadPkg/UefiPayloadPkgIa32.dsc UefiPayloadPkg/UefiPayloadPkgIa32X64.dsc I'm asking that you please (a) include a patch for ArmVirtPkg, (b) update the OvmfPkg patch to cover "OvmfXen.dsc" too. Not sure about the UefiPayloadPkg platforms; please ask their maintainers. (I've CC'd the OvmfXen and UefiPayloadPkg maintainers/reviewers.) Thanks, Laszlo > > Discussion of the feature can be found in multiple places throughout > the last year on the RFC channel, staging branches, and in devel. > > Most recently, this subject was discussed in this thread: > https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fedk2= .groups.io%2Fg%2Fdevel%2Fmessage%2F53712&data=3D02%7C01%7Cbret.barkelew= %40microsoft.com%7C98d423482cea4e143c4308d7f66b0927%7C72f988bf86f141af91ab2= d7cd011db47%7C1%7C0%7C637248811886938531&sdata=3D%2FFmQMtE%2Ffrl6UxNdY9= 4mvckwrXVUJySJ%2BWFSSQp8nCk%3D&reserved=3D0 > (the code branches shared in that discussion are now out of date, but th= e > whitepapers and discussion are relevant). > > Cc: Jiewen Yao > > Cc: Chao Zhang > > Cc: Jian J Wang > > Cc: Hao A Wu > > Cc: Liming Gao > > Cc: Jordan Justen > > Cc: Laszlo Ersek > > Cc: Ard Biesheuvel > > Cc: Andrew Fish > > Cc: Ray Ni > > Signed-off-by: Michael Kubacki > > > Changes since v1: > * Fixed implementation for RuntimeDxe > * Add PCD to block DisableVariablePolicy > * Fix the DumpVariablePolicy pagination in SMM > > Bret Barkelew (12): > MdeModulePkg: Define the VariablePolicy protocol interface > MdeModulePkg: Define the VariablePolicyLib > MdeModulePkg: Define the VariablePolicyHelperLib > MdeModulePkg: Define the VarCheckPolicyLib and SMM interface > MdeModulePkg: Connect VariablePolicy business logic to > VariableServices > MdeModulePkg: Allow VariablePolicy state to delete protected variables > SecurityPkg: Allow VariablePolicy state to delete authenticated > variables > MdeModulePkg: Change TCG MOR variables to use VariablePolicy > MdeModulePkg: Drop VarLock from RuntimeDxe variable driver > MdeModulePkg: Add a shell-based functional test for VariablePolicy > OvmfPkg: Add VariablePolicy engine to OvmfPkg platform > EmulatorPkg: Add VariablePolicy engine to EmulatorPkg platform > > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c = | 318 +++ > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c = | 396 ++++ > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c = | 46 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDx= e.c | 85 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c = | 806 +++++++ > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariableP= olicyUnitTest.c | 2285 ++++++++++++++++++++ > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFun= cTestApp.c | 1942 +++++++++++++++++ > MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c = | 52 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c = | 60 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/VarCheck.c = | 49 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c = | 53 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock.c = | 71 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c = | 653 ++++++ > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c = | 14 + > SecurityPkg/Library/AuthVariableLib/AuthService.c = | 22 +- > EmulatorPkg/EmulatorPkg.dsc = | 6 + > MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h = | 54 + > MdeModulePkg/Include/Library/VariablePolicyHelperLib.h = | 164 ++ > MdeModulePkg/Include/Library/VariablePolicyLib.h = | 207 ++ > MdeModulePkg/Include/Protocol/VariablePolicy.h = | 157 ++ > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf = | 44 + > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni = | 12 + > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.in= f | 36 + > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.un= i | 12 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf = | 44 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni = | 12 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf = | 52 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariableP= olicyUnitTest.inf | 41 + > MdeModulePkg/MdeModulePkg.ci.yaml = | 4 +- > MdeModulePkg/MdeModulePkg.dec = | 26 +- > MdeModulePkg/MdeModulePkg.dsc = | 15 + > MdeModulePkg/Test/MdeModulePkgHostTest.dsc = | 11 + > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md = | 55 + > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFun= cTestApp.inf | 42 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf = | 5 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf = | 4 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf = | 12 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf = | 4 + > OvmfPkg/OvmfPkgIa32.dsc = | 8 + > OvmfPkg/OvmfPkgIa32X64.dsc = | 8 + > OvmfPkg/OvmfPkgX64.dsc = | 8 + > SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf = | 2 + > 42 files changed, 7819 insertions(+), 78 deletions(-) > create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolic= yLib.c > create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/Variabl= ePolicyHelperLib.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolic= yExtraInitNull.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolic= yExtraInitRuntimeDxe.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolic= yLib.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolic= yUnitTest/VariablePolicyUnitTest.c > create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestAp= p/VariablePolicyFuncTestApp.c > create mode 100644 MdeModulePkg/Universal/Variable/RuntimeDxe/VariableL= ockRequstToLock.c > create mode 100644 MdeModulePkg/Universal/Variable/RuntimeDxe/VariableP= olicySmmDxe.c > create mode 100644 MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h > create mode 100644 MdeModulePkg/Include/Library/VariablePolicyHelperLib= .h > create mode 100644 MdeModulePkg/Include/Library/VariablePolicyLib.h > create mode 100644 MdeModulePkg/Include/Protocol/VariablePolicy.h > create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolic= yLib.inf > create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolic= yLib.uni > create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/Variabl= ePolicyHelperLib.inf > create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/Variabl= ePolicyHelperLib.uni > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolic= yLib.inf > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolic= yLib.uni > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolic= yLibRuntimeDxe.inf > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolic= yUnitTest/VariablePolicyUnitTest.inf > create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestAp= p/Readme.md > create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestAp= p/VariablePolicyFuncTestApp.inf > --_000_CY4PR21MB0743B7D4506CD9A1DA41E836EFBF0CY4PR21MB0743namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

Sure. Thanks.

 

- Bret

 

From: Ma, Maurice <maur= ice.ma@intel.com>
Sent: Wednesday, May 13, 2020 8:18:08 AM
To: devel@edk2.groups.io <devel@edk2.groups.io>; Bret Barkele= w <Bret.Barkelew@microsoft.com>
Cc: Dong, Guo <guo.dong@intel.com>; You, Benjamin <benjami= n.you@intel.com>
Subject: RE: [EXTERNAL] Re: [edk2-devel] [PATCH v2 00/12] Add the V= ariablePolicy feature
 

Hi, Bret

 

For UefiPayloadPkg, could you please provide a pa= tch for it ?

 

Thanks

Maurice

 

From: devel@edk2.groups.io <devel@edk2.= groups.io> On Behalf Of Bret Barkelew via groups.io
Sent: Tuesday, May 12, 2020 22:19
To: devel@edk2.groups.io; lersek@redhat.com; michael.kubacki@outloo= k.com
Cc: Yao, Jiewen <jiewen.yao@intel.com>; Zhang, Chao B <cha= o.b.zhang@intel.com>; Wang, Jian J <jian.j.wang@intel.com>; Wu, Ha= o A <hao.a.wu@intel.com>; Gao, Liming <liming.gao@intel.com>; J= usten, Jordan L <jordan.l.justen@intel.com>; Ard Biesheuvel <ard.b= iesheuvel@arm.com>; Andrew Fish <afish@apple.com>; Ni, Ray <ray.ni@intel.com>; An= thony Perard <anthony.perard@citrix.com>; Julien Grall <julien@xen= .org>; Ma, Maurice <maurice.ma@intel.com>; Dong, Guo <guo.dong@= intel.com>; You, Benjamin <benjamin.you@intel.com>
Subject: Re: [EXTERNAL] Re: [edk2-devel] [PATCH v2 00/12] Add the V= ariablePolicy feature

 

=93Not sure about the UefiPayloadPkg platforms; p= lease ask their maintainers.=94

 

UefiPayloadPkg maintainers: what say you? 😉

 

- Bret

 

From: devel@edk2.groups.io <devel@edk2.groups.io> on behalf o= f Laszlo Ersek via groups.io <lersek=3Dredhat.com@groups.io>
Sent: Tuesday, May 12, 2020 4:52:52 AM
To: devel@edk2.groups.io <devel@edk2.groups.io>; michael.kubacki@outlook.com= <michael.kubacki@out= look.com>
Cc: Yao, Jiewen <jiewen.= yao@intel.com>; Chao Zhang <chao.b.zhang@intel.com>; Jian J Wang <jian.j.wang@intel.com>; Hao A Wu <hao.a.wu@intel.com>; lim= ing.gao <liming.gao@intel.com>; Jordan Justen <jorda= n.l.justen@intel.com>; Ard Biesheuvel <ard.biesheuvel@arm.com>; Andrew Fish <afish@apple.com>= ;; Ni, Ray <ray.ni@intel.com>= ; Anthony Perard <anthony.p= erard@citrix.com>; Julien Grall <julien@xen.org>; Maurice Ma <maurice.ma@intel.c= om>; Guo Dong <guo.dong@int= el.com>; Benjamin You <= benjamin.you@intel.com>
Subject: [EXTERNAL] Re: [edk2-devel] [PATCH v2 00/12] Add the Varia= blePolicy feature

 

On 05/12/20 08:46,= Michael Kubacki wrote:
> From: Michael Kubacki <michael.kubacki@microsoft.com>
>
> REF:https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F= %2Fbugzilla.tianocore.org%2Fshow_bug.cgi%3Fid%3D2522&amp;data=3D02%7C01= %7Cbret.barkelew%40microsoft.com%7C98d423482cea4e143c4308d7f66b0927%7C72f98= 8bf86f141af91ab2d7cd011db47%7C1%7C0%7C637248811886928541&amp;sdata=3DGl= pxfE6%2FzZR01KXRvOoaXQTQEG%2F3TNuaZxJ6C1fl6LI%3D&amp;reserved=3D0
>
> The 12 patches in this series add the VariablePolicy feature to the c= ore,
> deprecate Edk2VarLock (while adding a compatibility layer to reduce c= ode
> churn), and integrate the VariablePolicy libraries and protocols into=
> Variable Services.
>
> Since the integration requires multiple changes, including adding lib= raries,
> a protocol, an SMI communication handler, and VariableServices integr= ation,
> the patches are broken up by individual library additions and then a = final
> integration. Security-sensitive changes like bypassing Authenticated<= br> > Variable enforcement are also broken out into individual patches so t= hat
> attention can be called directly to them.
>
> Platform porting instructions are described in this wiki entry:
> https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fgithub= .com%2Ftianocore%2Ftianocore.github.io%2Fwiki%2FVariablePolicy-Protocol---E= nhanced-Method-for-Managing-Variables%23platform-porting&amp;data=3D02%= 7C01%7Cbret.barkelew%40microsoft.com%7C98d423482cea4e143c4308d7f66b0927%7C7= 2f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637248811886928541&amp;sdata= =3Do%2FraXnHgx4RMreIkSFSONm8He0CzM7ZTXoV8loOrxe0%3D&amp;reserved=3D0

(1) This wiki article is helpful, thanks.

I have one remark: there's a heading saying "VarCheckPolicyLib NULL Instance":

https:/= /nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fgithub.com%2Ft= ianocore%2Ftianocore.github.io%2Fwiki%2FVariablePolicy-Protocol---Enhanced-= Method-for-Managing-Variables%23varcheckpolicylib-null-instance&amp;dat= a=3D02%7C01%7Cbret.barkelew%40microsoft.com%7C98d423482cea4e143c4308d7f66b0= 927%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637248811886928541&amp= ;sdata=3D4qTYEB6%2F3uJnLZ9MjRHODQGaaPq6zZEp7bFlCXEP7gI%3D&amp;reserved= =3D0

I think what's meant is "NULL class", not "NULL instance&qu= ot;.

(2) The following platform DSC files in edk2 include the non-SMM
variable driver
("MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf&q= uot;),
but they are not modified by this patch series:

ArmVirtPkg/ArmVirtQemu.dsc
ArmVirtPkg/ArmVirtQemuKernel.dsc
ArmVirtPkg/ArmVirtXen.dsc
OvmfPkg/OvmfXen.dsc
UefiPayloadPkg/UefiPayloadPkgIa32.dsc
UefiPayloadPkg/UefiPayloadPkgIa32X64.dsc

I'm asking that you please (a) include a patch for ArmVirtPkg, (b)
update the OvmfPkg patch to cover "OvmfXen.dsc" too.

Not sure about the UefiPayloadPkg platforms; please ask their maintainers.=

(I've CC'd the OvmfXen and UefiPayloadPkg maintainers/reviewers.)

Thanks,
Laszlo

>
> Discussion of the feature can be found in multiple places throughout<= br> > the last year on the RFC channel, staging branches, and in devel.
>
> Most recently, this subject was discussed in this thread:
> https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fedk2.g= roups.io%2Fg%2Fdevel%2Fmessage%2F53712&amp;data=3D02%7C01%7Cbret.barkel= ew%40microsoft.com%7C98d423482cea4e143c4308d7f66b0927%7C72f988bf86f141af91a= b2d7cd011db47%7C1%7C0%7C637248811886938531&amp;sdata=3D%2FFmQMtE%2Ffrl6= UxNdY94mvckwrXVUJySJ%2BWFSSQp8nCk%3D&amp;reserved=3D0
> (the code branches shared in that discussion are now out of date, but= the
> whitepapers and discussion are relevant).
>
> Cc: Jiewen Yao <jiewen.yao= @intel.com>
> Cc: Chao Zhang <chao.b.z= hang@intel.com>
> Cc: Jian J Wang <jian.j.w= ang@intel.com>
> Cc: Hao A Wu <hao.a.wu@intel= .com>
> Cc: Liming Gao <liming.gao= @intel.com>
> Cc: Jordan Justen <jo= rdan.l.justen@intel.com>
> Cc: Laszlo Ersek <lersek@redh= at.com>
> Cc: Ard Biesheuvel <ard.= biesheuvel@arm.com>
> Cc: Andrew Fish <afish@apple.co= m>
> Cc: Ray Ni <ray.ni@intel.com>
> Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
>
> Changes since v1:
> * Fixed implementation for RuntimeDxe
> * Add PCD to block DisableVariablePolicy
> * Fix the DumpVariablePolicy pagination in SMM
>
> Bret Barkelew (12):
>   MdeModulePkg: Define the VariablePolicy protocol interfac= e
>   MdeModulePkg: Define the VariablePolicyLib
>   MdeModulePkg: Define the VariablePolicyHelperLib
>   MdeModulePkg: Define the VarCheckPolicyLib and SMM interf= ace
>   MdeModulePkg: Connect VariablePolicy business logic to >     VariableServices
>   MdeModulePkg: Allow VariablePolicy state to delete protec= ted variables
>   SecurityPkg: Allow VariablePolicy state to delete authent= icated
>     variables
>   MdeModulePkg: Change TCG MOR variables to use VariablePol= icy
>   MdeModulePkg: Drop VarLock from RuntimeDxe variable drive= r
>   MdeModulePkg: Add a shell-based functional test for Varia= blePolicy
>   OvmfPkg: Add VariablePolicy engine to OvmfPkg platform >   EmulatorPkg: Add VariablePolicy engine to EmulatorPkg pla= tform
>
>  MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c = ;            &n= bsp;            = ;     |  318 +++
>  MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelp= erLib.c           &n= bsp;       |  396 ++++ >  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitN= ull.c           &nbs= p;         |   46 + >  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitR= untimeDxe.c          &nbs= p;    |   85 +
>  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c = ;            &n= bsp;            = ;     |  806 +++++++ >  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/V= ariablePolicyUnitTest.c   | 2285 ++++++&#= 43;+++++++++++++
>  MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariableP= olicyFuncTestApp.c        | 1942 +&#= 43;++++++++++++++&#= 43;
>  MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c = ;            &n= bsp;            = ;     |   52 +-
>  MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c = ;            &n= bsp;            = ;     |   60 +-
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VarCheck.c &nbs= p;            &= nbsp;           &nbs= p;         |   49 +-<= br> >  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c &= nbsp;           &nbs= p;            &= nbsp;      |   53 +
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstTo= Lock.c           &nb= sp;        |   71 +
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe= .c            &= nbsp;           |  6= 53 ++++++
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDx= e.c            =            |   = 14 +
>  SecurityPkg/Library/AuthVariableLib/AuthService.c  &n= bsp;            = ;            &n= bsp;            |&nb= sp;  22 +-
>  EmulatorPkg/EmulatorPkg.dsc      =             &nb= sp;            =             &nb= sp;            =       |    6 +
>  MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h   =             &nb= sp;            =             &nb= sp;   |   54 +
>  MdeModulePkg/Include/Library/VariablePolicyHelperLib.h &nb= sp;            =             &nb= sp;        |  164 ++
>  MdeModulePkg/Include/Library/VariablePolicyLib.h  &nb= sp;            =             &nb= sp;            = |  207 ++
>  MdeModulePkg/Include/Protocol/VariablePolicy.h   = ;            &n= bsp;            = ;            &n= bsp;  |  157 ++
>  MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf&nb= sp;            =             &nb= sp;   |   44 +
>  MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni&nb= sp;            =             &nb= sp;   |   12 +
>  MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelp= erLib.inf           =       |   36 +
>  MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelp= erLib.uni           =       |   12 +
>  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf&nb= sp;            =             &nb= sp;   |   44 +
>  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni&nb= sp;            =             &nb= sp;   |   12 +
>  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntime= Dxe.inf           &n= bsp;       |   52 +
>  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/V= ariablePolicyUnitTest.inf |   41 +
>  MdeModulePkg/MdeModulePkg.ci.yaml     =             &nb= sp;            =             &nb= sp;            = |    4 +-
>  MdeModulePkg/MdeModulePkg.dec     &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;    |   26 +-
>  MdeModulePkg/MdeModulePkg.dsc     &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;    |   15 +
>  MdeModulePkg/Test/MdeModulePkgHostTest.dsc   &nb= sp;            =             &nb= sp;            =       |   11 +
>  MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md=             &nb= sp;            = |   55 +
>  MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariableP= olicyFuncTestApp.inf      |   42 + >  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.i= nf            &= nbsp;           | &n= bsp;  5 +
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf = ;            &n= bsp;            = ;     |    4 +
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDx= e.inf           &nbs= p;         |   12 + >  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm= .inf            = ;          |   = 4 +
>  OvmfPkg/OvmfPkgIa32.dsc      &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;         |    8 &#= 43;
>  OvmfPkg/OvmfPkgIa32X64.dsc      &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;      |    8 +
>  OvmfPkg/OvmfPkgX64.dsc       = ;            &n= bsp;            = ;            &n= bsp;            = ;          |   = 8 +
>  SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf &n= bsp;            = ;            &n= bsp;       |    2 +
>  42 files changed, 7819 insertions(+), 78 deletions(-)
>  create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCh= eckPolicyLib.c
>  create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib= /VariablePolicyHelperLib.c
>  create mode 100644 MdeModulePkg/Library/VariablePolicyLib/Varia= blePolicyExtraInitNull.c
>  create mode 100644 MdeModulePkg/Library/VariablePolicyLib/Varia= blePolicyExtraInitRuntimeDxe.c
>  create mode 100644 MdeModulePkg/Library/VariablePolicyLib/Varia= blePolicyLib.c
>  create mode 100644 MdeModulePkg/Library/VariablePolicyLib/Varia= blePolicyUnitTest/VariablePolicyUnitTest.c
>  create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFu= ncTestApp/VariablePolicyFuncTestApp.c
>  create mode 100644 MdeModulePkg/Universal/Variable/RuntimeDxe/V= ariableLockRequstToLock.c
>  create mode 100644 MdeModulePkg/Universal/Variable/RuntimeDxe/V= ariablePolicySmmDxe.c
>  create mode 100644 MdeModulePkg/Include/Guid/VarCheckPolicyMmi.= h
>  create mode 100644 MdeModulePkg/Include/Library/VariablePolicyH= elperLib.h
>  create mode 100644 MdeModulePkg/Include/Library/VariablePolicyL= ib.h
>  create mode 100644 MdeModulePkg/Include/Protocol/VariablePolicy= .h
>  create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCh= eckPolicyLib.inf
>  create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCh= eckPolicyLib.uni
>  create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib= /VariablePolicyHelperLib.inf
>  create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib= /VariablePolicyHelperLib.uni
>  create mode 100644 MdeModulePkg/Library/VariablePolicyLib/Varia= blePolicyLib.inf
>  create mode 100644 MdeModulePkg/Library/VariablePolicyLib/Varia= blePolicyLib.uni
>  create mode 100644 MdeModulePkg/Library/VariablePolicyLib/Varia= blePolicyLibRuntimeDxe.inf
>  create mode 100644 MdeModulePkg/Library/VariablePolicyLib/Varia= blePolicyUnitTest/VariablePolicyUnitTest.inf
>  create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFu= ncTestApp/Readme.md
>  create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFu= ncTestApp/VariablePolicyFuncTestApp.inf
>



--_000_CY4PR21MB0743B7D4506CD9A1DA41E836EFBF0CY4PR21MB0743namp_--