From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from NAM11-DM6-obe.outbound.protection.outlook.com (NAM11-DM6-obe.outbound.protection.outlook.com [40.107.223.126]) by mx.groups.io with SMTP id smtpd.web12.1192.1593672355749453428 for ; Wed, 01 Jul 2020 23:45:55 -0700 Authentication-Results: mx.groups.io; dkim=pass header.i=@microsoft.com header.s=selector2 header.b=PzcMbQE+; spf=pass (domain: microsoft.com, ip: 40.107.223.126, mailfrom: bret.barkelew@microsoft.com) ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=M/kF1HopPOqjsGZrIlhMfYPDUD4X3dQ4SIZVQJo8UTLpSyXmSr4I3GmBJVG8k1fIrguq5jaK2PpMkmTx0kDJP5TeeV7RNKnawqDhLSH7aF63QkqInfHDSTtiyeK0Tr8aAYAQhrFSp1flGE0fbRVrYfXAvsytgk1V1Oxn9SjfjyYLmEftC7ebttro84lJMNNdEuAYGy1+ATOTuju1Ofwb5Ckhb/e7FV4zin3vLwa32ow763UVxlkzkckp0rDTIh0rsHuh7fEdTQndwf0PhX7GA/Z6nB/ncGrfDztzu0+nbfGszWXO+cXDzHnu6vMsCE/fg/zQe/O8cdaXijPe0xwmbw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=wwsFvpmym2uEy24Rtu0zkc1Tc3jk31dsBHYvSIt48jc=; b=O+7cRWm1IB4XSh0QGfT7u91wy3iK876rGvVbIWQNyw46oa0E1asq/fWbD+Xl4uwl2+OsBGyT8+cwoItSYlOAHYtgCmvJV/1IMbWIdx0Qiifdl/x5vRBACJhm2yFya+TFr33Ho/dRmMc/7G/wr+mPzfiN5U6qZO0jwJiynPqR7q/rGBiYMXZw139MqfvN0rHTG36czjAydXs/saF+cBOR1LiG9uk97vmVbVQfvDKgmdMLcl9XM5+BHRNRcEpeVo9OUBgeHeBu4VfRlo0MiZHhbuaO+WcERl/u1UdelVC4A9vwDpqOvZAZONEmtQ9WAykrHxel/jiLyPZMMC+m7qzQEA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=microsoft.com; dmarc=pass action=none header.from=microsoft.com; dkim=pass header.d=microsoft.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=wwsFvpmym2uEy24Rtu0zkc1Tc3jk31dsBHYvSIt48jc=; b=PzcMbQE+ErAKVewNpH8falzFHFZLzlYAdYXzLM04WvPTX9VeuW79QjgztP8O93f7NYr9wyO4yM3cOQ0LGe2p5vxpXMO0wVpqt92ya3FEYROhzSZUAT888kD3NuSo8FQYgdbcPf182W4r/2aZ9q8MvaZY7GpJNNbbhiOLpQ1XJtQ= Received: from CY4PR21MB0743.namprd21.prod.outlook.com (2603:10b6:903:b2::9) by CY4PR21MB0167.namprd21.prod.outlook.com (2603:10b6:903:b9::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3174.1; Thu, 2 Jul 2020 06:45:53 +0000 Received: from CY4PR21MB0743.namprd21.prod.outlook.com ([fe80::f112:82fb:d4fd:f7dd]) by CY4PR21MB0743.namprd21.prod.outlook.com ([fe80::f112:82fb:d4fd:f7dd%12]) with mapi id 15.20.3174.012; Thu, 2 Jul 2020 06:45:53 +0000 From: "Bret Barkelew" To: "devel@edk2.groups.io" , "dandan.bi@intel.com" , "bret@corthon.com" CC: "Yao, Jiewen" , "Zhang, Chao B" , "Wang, Jian J" , "Wu, Hao A" , liming.gao , "Justen, Jordan L" , Laszlo Ersek , Ard Biesheuvel , Andrew Fish , "Ni, Ray" Subject: Re: [edk2-devel] [PATCH v6 00/14] Add the VariablePolicy feature Thread-Topic: [edk2-devel] [PATCH v6 00/14] Add the VariablePolicy feature Thread-Index: AQHWUBZuNMXzI1m6a02/KfjKAWEPGKjz17vE Date: Thu, 2 Jul 2020 06:45:53 +0000 Message-ID: References: <20200623064104.1908-1-brbarkel@microsoft.com>, In-Reply-To: Accept-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: msip_labels: MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Enabled=True;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SiteId=72f988bf-86f1-41af-91ab-2d7cd011db47;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_SetDate=2020-07-02T06:42:28.4511035Z;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_ContentBits=0;MSIP_Label_f42aa342-8706-4288-bd11-ebb85995028c_Method=Privileged authentication-results: edk2.groups.io; dkim=none (message not signed) header.d=none;edk2.groups.io; dmarc=none action=none header.from=microsoft.com; x-originating-ip: [174.21.80.75] x-ms-publictraffictype: Email x-ms-office365-filtering-ht: Tenant x-ms-office365-filtering-correlation-id: e91cb9c7-c50c-4d22-d7ae-08d81e5390df x-ms-traffictypediagnostic: CY4PR21MB0167: x-ld-processed: 72f988bf-86f1-41af-91ab-2d7cd011db47,ExtAddr x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: TIZboX11TPjwWk0GuSzuDVnOF/G2su7TsioOoUx/vGAa/2v8Wi7gEPTKAHSFAQx35DrJbjfxtZWrLuBKGIPET4wARa0VOopebLObQ1cTOAsCI6hC2hDh5AZbxy6J7nhEJRw1ZWNxYE78FrJEVBUgStV6TmhJ15kc6lpPx/7kQgx6SYI7sPbgKNHflUc4GrjIpQEimmDcxaBPaSFF+mQrcXGFDpvi9O/nCiaeMUXD54jlbjDNXNWw04cEoFLq58boph8lgH2FZfvvI2qhzuQQIh2xfqoAe5HVF18pby4SV4rFq3QN8/f7f6QuVVBurWQwq7blqRcPEvpMs/rT+ZviqJhvpzvmrQcrauJ+Ldk3k/6AITA+mVjvk5leEILDz1nm+K/XrrJZm4PP3AsvewD0rw== x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CY4PR21MB0743.namprd21.prod.outlook.com;PTR:;CAT:NONE;SFTY:;SFS:(4636009)(366004)(39860400002)(346002)(396003)(376002)(136003)(52536014)(478600001)(7696005)(8676002)(6506007)(53546011)(8936002)(54906003)(316002)(110136005)(5660300002)(66476007)(66446008)(66946007)(966005)(64756008)(10290500003)(2906002)(7416002)(33656002)(66556008)(86362001)(76116006)(83380400001)(55016002)(9686003)(30864003)(166002)(71200400001)(186003)(4326008)(8990500004)(82950400001)(82960400001)(26005);DIR:OUT;SFP:1102; x-ms-exchange-antispam-messagedata: DpPXixA8YJgO0XWeaoXfeiYuOsplBHbjDd62qfIUkZ4ajNq98YEmqiLXcZ/9ZyhqCTTn4ptO4R9bqBgPvoqu7AAS70CJgo4ZzdKR/YP9Lcz7dTGlgYqGhilf1QvxfDjjgb3gei0ppC5PKfQ4t1W4Ndt0hbLeREENq3hj6v3E9twq4OZoJJCovYDnqHXkIWeUV09J2rjXDBqvJjNZk6QMosMaON/3ZeIkF+ko3JCxLWS9GoLaV6oda+fIPB8UdM8KRi4JKV+hOj8VshfpX6la2AajdZuo01PN0JpMnAXQ5zBrM6qRAxgW8IjsxSzmvbGC9Wckr4dlHPYMg8Rrqhw7MRekz/5W8qDhRPr+tIZTP8UvBgrZTYX+e3ipQzrJEwtDduYwryazCSohZHyM2s0zM0pr2Hxg/vdfqyQEnxuyzskHdyF98r83RYp3caf0ED64scRyMUXl0OX0yo5OrTI0vS8A94aWVAYFSmnQgDspgJM= x-ms-exchange-transport-forked: True MIME-Version: 1.0 X-OriginatorOrg: microsoft.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: CY4PR21MB0743.namprd21.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: e91cb9c7-c50c-4d22-d7ae-08d81e5390df X-MS-Exchange-CrossTenant-originalarrivaltime: 02 Jul 2020 06:45:53.3733 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 72f988bf-86f1-41af-91ab-2d7cd011db47 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: FnhnVzrXLgjNfwfoUv4Y+zVMiF5+Eo9TU3GRK9H4JOIulpXFIDqqNph7aXI/VStrfjK0/mWD/7Uo3PEGLTCX8g== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CY4PR21MB0167 Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_CY4PR21MB0743F6EBBD4CED2B2579CAF7EF6D0CY4PR21MB0743namp_" --_000_CY4PR21MB0743F6EBBD4CED2B2579CAF7EF6D0CY4PR21MB0743namp_ Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable Certainly do: https://github.com/corthon/edk2/tree/var_policy_dev_submission_v6 I=92ve already made a change from some of your feedback in that branch and= will restructure the patches for v7 once all feedback is in. Thanks! - Bret From: Dandan Bi via groups.io Sent: Wednesday, July 1, 2020 7:13 PM To: devel@edk2.groups.io; bret@corthon.com Cc: Yao, Jiewen; Zhang, Chao B; Wang, Jian J; Wu, Hao A; liming.gao; Justen, J= ordan L; Laszlo Ersek; Ard Biesheuvel; Andrew Fish; Ni, Ray Subject: [EXTERNAL] Re: [edk2-devel] [PATCH v6 00/14] Add the VariablePoli= cy feature Hi Bret, Thanks for the contribution. I have taken an overview of this patch series and have some small comments= in the related patches, please check in sub-patch. I will review the patch series more in details and bring more comments bac= k if have. Do you have a branch for these patches in GitHub? Which should b= e easy for review. Thanks, Dandan > -----Original Message----- > From: devel@edk2.groups.io On Behalf Of Bret > Barkelew > Sent: Tuesday, June 23, 2020 2:41 PM > To: devel@edk2.groups.io > Cc: Yao, Jiewen ; Zhang, Chao B > ; Wang, Jian J ; Wu, Hao > A ; Gao, Liming ; Justen, > Jordan L ; Laszlo Ersek ; > Ard Biesheuvel ; Andrew Fish > ; Ni, Ray > Subject: [edk2-devel] [PATCH v6 00/14] Add the VariablePolicy feature > > REF:https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2F= bugzilla.tianocore.org%2Fshow_bug.cgi%3Fid%3D2522&data=3D02%7C01%7Cbret= .barkelew%40microsoft.com%7C3fb90fd337a24d2c965d08d81e2d9081%7C72f988bf86f1= 41af91ab2d7cd011db47%7C1%7C0%7C637292528333631839&sdata=3D7hyxOuoJb08Nc= pj6Ww4ABCFx48tdOUKmGZq5uCxLHjo%3D&reserved=3D0 > > The 14 patches in this series add the VariablePolicy feature to the core= , > deprecate Edk2VarLock (while adding a compatibility layer to reduce code > churn), and integrate the VariablePolicy libraries and protocols into Va= riable > Services. > > Since the integration requires multiple changes, including adding librar= ies, a > protocol, an SMI communication handler, and VariableServices integration= , > the patches are broken up by individual library additions and then a fin= al > integration. Security-sensitive changes like bypassing Authenticated Var= iable > enforcement are also broken out into individual patches so that attentio= n can > be called directly to them. > > Platform porting instructions are described in this wiki entry: > https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fgith= ub.com%2Ftianocore%2Ftianocore.github.io%2Fwiki%2FVariablePolicy-&data= =3D02%7C01%7Cbret.barkelew%40microsoft.com%7C3fb90fd337a24d2c965d08d81e2d9= 081%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637292528333631839&sda= ta=3DB%2Bl%2F43l6xTTzvLw00gyXElHqUlu%2BfwhuUJOIEh%2BHN6g%3D&reserved=3D= 0 > Protocol---Enhanced-Method-for-Managing-Variables#platform-porting > > Discussion of the feature can be found in multiple places throughout the= last > year on the RFC channel, staging branches, and in devel. > > Most recently, this subject was discussed in this thread: > https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fedk2= .groups.io%2Fg%2Fdevel%2Fmessage%2F53712&data=3D02%7C01%7Cbret.barkelew= %40microsoft.com%7C3fb90fd337a24d2c965d08d81e2d9081%7C72f988bf86f141af91ab2= d7cd011db47%7C1%7C0%7C637292528333631839&sdata=3DUMEtJ5hxVBmvcWPSLRwDZ6= P6bOaE8N3v5sEgdzyPffw%3D&reserved=3D0 > (the code branches shared in that discussion are now out of date, but th= e > whitepapers and discussion are relevant). > > Cc: Jiewen Yao > Cc: Chao Zhang > Cc: Jian J Wang > Cc: Hao A Wu > Cc: Liming Gao > Cc: Jordan Justen > Cc: Laszlo Ersek > Cc: Ard Biesheuvel > Cc: Andrew Fish > Cc: Ray Ni > Cc: Bret Barkelew > Signed-off-by: Bret Barkelew > > v6 changes: > * Fix an issue with uninitialized Status in InitVariablePolicyLib() and > DeinitVariablePolicyLib() > * Fix GCC building in shell-based functional test > * Rebase on latest origin/master > > v5 changes: > * Fix the CONST mismatch in VariablePolicy.h and VariablePolicySmmDxe.c > * Fix EFIAPI mismatches in the functional unittest > * Rebase on latest origin/master > > v4 changes: > * Remove Optional PcdAllowVariablePolicyEnforcementDisable PCD from > platforms > * Rebase on master > * Migrate to new MmCommunicate2 protocol > * Fix an oversight in the default return value for > InitMmCommonCommBuffer > * Fix in VariablePolicyLib to allow ExtraInitRuntimeDxe to consume varia= bles > > V3 changes: > * Address all non-unittest issues with ECC > * Make additional style changes > * Include section name in hunk headers in "ini-style" files > * Remove requirement for the EdkiiPiSmmCommunicationsRegionTable > driver > (now allocates its own buffer) > * Change names from VARIABLE_POLICY_PROTOCOL and > gVariablePolicyProtocolGuid > to EDKII_VARIABLE_POLICY_PROTOCOL and > gEdkiiVariablePolicyProtocolGuid > * Fix GCC warning about initializing externs > * Add UNI strings for new PCD > * Add patches for ArmVirtPkg, OvmfXen, and UefiPayloadPkg > * Reorder patches according to Liming's feedback about adding to platfor= ms > before changing variable driver > > V2 changes: > * Fixed implementation for RuntimeDxe > * Add PCD to block DisableVariablePolicy > * Fix the DumpVariablePolicy pagination in SMM > > Bret Barkelew (14): > MdeModulePkg: Define the VariablePolicy protocol interface > MdeModulePkg: Define the VariablePolicyLib > MdeModulePkg: Define the VariablePolicyHelperLib > MdeModulePkg: Define the VarCheckPolicyLib and SMM interface > OvmfPkg: Add VariablePolicy engine to OvmfPkg platform > EmulatorPkg: Add VariablePolicy engine to EmulatorPkg platform > ArmVirtPkg: Add VariablePolicy engine to ArmVirtPkg platform > UefiPayloadPkg: Add VariablePolicy engine to UefiPayloadPkg platform > MdeModulePkg: Connect VariablePolicy business logic to > VariableServices > MdeModulePkg: Allow VariablePolicy state to delete protected variables > SecurityPkg: Allow VariablePolicy state to delete authenticated > variables > MdeModulePkg: Change TCG MOR variables to use VariablePolicy > MdeModulePkg: Drop VarLock from RuntimeDxe variable driver > MdeModulePkg: Add a shell-based functional test for VariablePolicy > > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c > | 320 +++ > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c > | 396 ++++ > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c > | 46 + > > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDx > e.c | 85 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c > | 816 +++++++ > > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePo > licyUnitTest.c | 2440 ++++++++++++++++++++ > > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFu > ncTestApp.c | 1978 ++++++++++++++++ > MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c > | 52 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c > | 60 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/VarCheck.c > | 49 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c > | 53 + > > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock > .c | 71 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c > | 642 +++++ > > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe. > c | 14 + > SecurityPkg/Library/AuthVariableLib/AuthService.c = | 22 > +- > ArmVirtPkg/ArmVirt.dsc.inc = | 4 + > EmulatorPkg/EmulatorPkg.dsc = | 3 + > MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h = | > 54 + > MdeModulePkg/Include/Library/VariablePolicyHelperLib.h > | 164 ++ > MdeModulePkg/Include/Library/VariablePolicyLib.h = | > 207 ++ > MdeModulePkg/Include/Protocol/VariablePolicy.h = | > 157 ++ > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf > | 42 + > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni > | 12 + > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.in= f > | 35 + > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.un= i > | 12 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf > | 44 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni > | 12 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf > | 51 + > > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePo > licyUnitTest.inf | 40 + > MdeModulePkg/MdeModulePkg.ci.yaml = | 4 +- > MdeModulePkg/MdeModulePkg.dec = | 26 +- > MdeModulePkg/MdeModulePkg.dsc = | 15 + > MdeModulePkg/MdeModulePkg.uni = | 7 + > MdeModulePkg/Test/MdeModulePkgHostTest.dsc = | > 11 + > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md > | 55 + > > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFu > ncTestApp.inf | 42 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf > | 5 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf > | 4 + > > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.i > nf | 10 + > > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf > | 4 + > OvmfPkg/OvmfPkgIa32.dsc = | 5 + > OvmfPkg/OvmfPkgIa32X64.dsc = | 5 + > OvmfPkg/OvmfPkgX64.dsc = | 5 + > OvmfPkg/OvmfXen.dsc = | 4 + > SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf = | > 2 + > UefiPayloadPkg/UefiPayloadPkgIa32.dsc = | 4 + > UefiPayloadPkg/UefiPayloadPkgIa32X64.dsc = | 4 + > 47 files changed, 8015 insertions(+), 78 deletions(-) create mode 1006= 44 > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c > create mode 100644 > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c > create mode 100644 > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c > create mode 100644 > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDx > e.c > create mode 100644 > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c > create mode 100644 > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePo > licyUnitTest.c > create mode 100644 > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFu > ncTestApp.c > create mode 100644 > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock > .c > create mode 100644 > MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c > create mode 100644 MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h > create mode 100644 > MdeModulePkg/Include/Library/VariablePolicyHelperLib.h > create mode 100644 MdeModulePkg/Include/Library/VariablePolicyLib.h > create mode 100644 MdeModulePkg/Include/Protocol/VariablePolicy.h > create mode 100644 > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf > create mode 100644 > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni > create mode 100644 > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf > create mode 100644 > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.uni > create mode 100644 > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf > create mode 100644 > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni > create mode 100644 > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf > create mode 100644 > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePo > licyUnitTest.inf > create mode 100644 > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md > create mode 100644 > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFu > ncTestApp.inf > > -- > 2.26.2.windows.1.8.g01c50adf56.20200515075929 > > > --_000_CY4PR21MB0743F6EBBD4CED2B2579CAF7EF6D0CY4PR21MB0743namp_ Content-Type: text/html; charset="Windows-1252" Content-Transfer-Encoding: quoted-printable

Certainly do:
https://github.com/corthon/edk2/tree/var_policy_dev_submission_v6

 

I=92ve already made a change from some of your feed= back in that branch and will restructure the patches for v7 once all feedba= ck is in.

Thanks!

 

- Bret

 

From: Dandan Bi via groups.io<= br> Sent: Wednesday, July 1, 2020 7:13 PM
To: devel@edk2.groups.io; bret@corthon.com
Cc: Yao, Jiewen; Zhang, Chao B; Wang, Jian J; Wu, Hao A; liming.gao; Justen, Jordan L; Laszlo Ersek; Ard Biesheuvel; Andrew Fish; Ni, Ray
Subject: [EXTERNAL] Re: [edk2-devel] [PATCH v6 00/14] Add the Varia= blePolicy feature

 

Hi Bret,

Thanks for the contribution.

I have taken an overview of this patch series and have some small comments= in the related patches, please check in sub-patch.

I will review the patch series more in details and bring more comments bac= k if have. Do you have a branch for these patches in GitHub? Which should b= e easy for review.


Thanks,
Dandan

> -----Original Message-----
> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of = Bret
> Barkelew
> Sent: Tuesday, June 23, 2020 2:41 PM
> To: devel@edk2.groups.io
> Cc: Yao, Jiewen <jiewen.yao@intel.com>; Zhang, Chao B
> <chao.b.zhang@intel.com>; Wang, Jian J <jian.j.wang@intel.co= m>; Wu, Hao
> A <hao.a.wu@intel.com>; Gao, Liming <liming.gao@intel.com>= ;; Justen,
> Jordan L <jordan.l.justen@intel.com>; Laszlo Ersek <lersek@r= edhat.com>;
> Ard Biesheuvel <ard.biesheuvel@arm.com>; Andrew Fish
> <afish@apple.com>; Ni, Ray <ray.ni@intel.com>
> Subject: [edk2-devel] [PATCH v6 00/14] Add the VariablePolicy feature=
>
> REF:https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F= %2Fbugzilla.tianocore.org%2Fshow_bug.cgi%3Fid%3D2522&amp;data=3D02%7C01= %7Cbret.barkelew%40microsoft.com%7C3fb90fd337a24d2c965d08d81e2d9081%7C72f98= 8bf86f141af91ab2d7cd011db47%7C1%7C0%7C637292528333631839&amp;sdata=3D7h= yxOuoJb08Ncpj6Ww4ABCFx48tdOUKmGZq5uCxLHjo%3D&amp;reserved=3D0
>
> The 14 patches in this series add the VariablePolicy feature to the c= ore,
> deprecate Edk2VarLock (while adding a compatibility layer to reduce c= ode
> churn), and integrate the VariablePolicy libraries and protocols into= Variable
> Services.
>
> Since the integration requires multiple changes, including adding lib= raries, a
> protocol, an SMI communication handler, and VariableServices integrat= ion,
> the patches are broken up by individual library additions and then a = final
> integration. Security-sensitive changes like bypassing Authenticated = Variable
> enforcement are also broken out into individual patches so that atten= tion can
> be called directly to them.
>
> Platform porting instructions are described in this wiki entry:
> https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fgithub= .com%2Ftianocore%2Ftianocore.github.io%2Fwiki%2FVariablePolicy-&amp;dat= a=3D02%7C01%7Cbret.barkelew%40microsoft.com%7C3fb90fd337a24d2c965d08d81e2d9= 081%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637292528333631839&amp= ;sdata=3DB%2Bl%2F43l6xTTzvLw00gyXElHqUlu%2BfwhuUJOIEh%2BHN6g%3D&amp;res= erved=3D0
> Protocol---Enhanced-Method-for-Managing-Variables#platform-porting >
> Discussion of the feature can be found in multiple places throughout = the last
> year on the RFC channel, staging branches, and in devel.
>
> Most recently, this subject was discussed in this thread:
> https://nam06.safelinks.protection.outlook.com/?url=3Dhttps%3A%2F%2Fedk2.g= roups.io%2Fg%2Fdevel%2Fmessage%2F53712&amp;data=3D02%7C01%7Cbret.barkel= ew%40microsoft.com%7C3fb90fd337a24d2c965d08d81e2d9081%7C72f988bf86f141af91a= b2d7cd011db47%7C1%7C0%7C637292528333631839&amp;sdata=3DUMEtJ5hxVBmvcWPS= LRwDZ6P6bOaE8N3v5sEgdzyPffw%3D&amp;reserved=3D0
> (the code branches shared in that discussion are now out of date, but= the
> whitepapers and discussion are relevant).
>
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> Cc: Chao Zhang <chao.b.zhang@intel.com>
> Cc: Jian J Wang <jian.j.wang@intel.com>
> Cc: Hao A Wu <hao.a.wu@intel.com>
> Cc: Liming Gao <liming.gao@intel.com>
> Cc: Jordan Justen <jordan.l.justen@intel.com>
> Cc: Laszlo Ersek <lersek@redhat.com>
> Cc: Ard Biesheuvel <ard.biesheuvel@arm.com>
> Cc: Andrew Fish <afish@apple.com>
> Cc: Ray Ni <ray.ni@intel.com>
> Cc: Bret Barkelew <brbarkel@microsoft.com>
> Signed-off-by: Bret Barkelew <brbarkel@microsoft.com>
>
> v6 changes:
> * Fix an issue with uninitialized Status in InitVariablePolicyLib() a= nd
> DeinitVariablePolicyLib()
> * Fix GCC building in shell-based functional test
> * Rebase on latest origin/master
>
> v5 changes:
> * Fix the CONST mismatch in VariablePolicy.h and VariablePolicySmmDxe= .c
> * Fix EFIAPI mismatches in the functional unittest
> * Rebase on latest origin/master
>
> v4 changes:
> * Remove Optional PcdAllowVariablePolicyEnforcementDisable PCD from > platforms
> * Rebase on master
> * Migrate to new MmCommunicate2 protocol
> * Fix an oversight in the default return value for
> InitMmCommonCommBuffer
> * Fix in VariablePolicyLib to allow ExtraInitRuntimeDxe to consume va= riables
>
> V3 changes:
> * Address all non-unittest issues with ECC
> * Make additional style changes
> * Include section name in hunk headers in "ini-style" files=
> * Remove requirement for the EdkiiPiSmmCommunicationsRegionTable
> driver
>   (now allocates its own buffer)
> * Change names from VARIABLE_POLICY_PROTOCOL and
> gVariablePolicyProtocolGuid
>   to EDKII_VARIABLE_POLICY_PROTOCOL and
> gEdkiiVariablePolicyProtocolGuid
> * Fix GCC warning about initializing externs
> * Add UNI strings for new PCD
> * Add patches for ArmVirtPkg, OvmfXen, and UefiPayloadPkg
> * Reorder patches according to Liming's feedback about adding to plat= forms
>   before changing variable driver
>
> V2 changes:
> * Fixed implementation for RuntimeDxe
> * Add PCD to block DisableVariablePolicy
> * Fix the DumpVariablePolicy pagination in SMM
>
> Bret Barkelew (14):
>   MdeModulePkg: Define the VariablePolicy protocol interfac= e
>   MdeModulePkg: Define the VariablePolicyLib
>   MdeModulePkg: Define the VariablePolicyHelperLib
>   MdeModulePkg: Define the VarCheckPolicyLib and SMM interf= ace
>   OvmfPkg: Add VariablePolicy engine to OvmfPkg platform >   EmulatorPkg: Add VariablePolicy engine to EmulatorPkg pla= tform
>   ArmVirtPkg: Add VariablePolicy engine to ArmVirtPkg platf= orm
>   UefiPayloadPkg: Add VariablePolicy engine to UefiPayloadP= kg platform
>   MdeModulePkg: Connect VariablePolicy business logic to >     VariableServices
>   MdeModulePkg: Allow VariablePolicy state to delete protec= ted variables
>   SecurityPkg: Allow VariablePolicy state to delete authent= icated
>     variables
>   MdeModulePkg: Change TCG MOR variables to use VariablePol= icy
>   MdeModulePkg: Drop VarLock from RuntimeDxe variable drive= r
>   MdeModulePkg: Add a shell-based functional test for Varia= blePolicy
>
>  MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c
> |  320 +++
>  MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelp= erLib.c
> |  396 ++++
>  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitN= ull.c
> |   46 +
>
> MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntime= Dx
> e.c           =     |   85 +
>  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c
> |  816 +++++++
>
> MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/Variabl= ePo
> licyUnitTest.c   | 2440 +++++++= +++++++++++++
>
> MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyF= u
> ncTestApp.c        | 1978 += 3;++++++++++++++ >  MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c
> |   52 +-
>  MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c
> |   60 +-
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VarCheck.c
> |   49 +-
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c
> |   53 +
>
> MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock > .c           &= nbsp;        |   71 +
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe= .c
> |  642 +++++
>
> MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.
> c           &n= bsp;           | &nb= sp; 14 +
>  SecurityPkg/Library/AuthVariableLib/AuthService.c  &n= bsp;            = ;            &n= bsp;            |&nb= sp;  22
> +-
>  ArmVirtPkg/ArmVirt.dsc.inc      &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;      |    4 +
>  EmulatorPkg/EmulatorPkg.dsc      =             &nb= sp;            =             &nb= sp;            =       |    3 +
>  MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h   =             &nb= sp;            =             &nb= sp;   |
> 54 +
>  MdeModulePkg/Include/Library/VariablePolicyHelperLib.h
> |  164 ++
>  MdeModulePkg/Include/Library/VariablePolicyLib.h  &nb= sp;            =             &nb= sp;            = |
> 207 ++
>  MdeModulePkg/Include/Protocol/VariablePolicy.h   = ;            &n= bsp;            = ;            &n= bsp;  |
> 157 ++
>  MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf > |   42 +
>  MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni > |   12 +
>  MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelp= erLib.inf
> |   35 +
>  MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelp= erLib.uni
> |   12 +
>  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf > |   44 +
>  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni > |   12 +
>  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntime= Dxe.inf
> |   51 +
>
> MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/Variabl= ePo
> licyUnitTest.inf |   40 +
>  MdeModulePkg/MdeModulePkg.ci.yaml     =             &nb= sp;            =             &nb= sp;            = |    4 +-
>  MdeModulePkg/MdeModulePkg.dec     &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;    |   26 +-
>  MdeModulePkg/MdeModulePkg.dsc     &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;    |   15 +
>  MdeModulePkg/MdeModulePkg.uni     &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;    |    7 +
>  MdeModulePkg/Test/MdeModulePkgHostTest.dsc   &nb= sp;            =             &nb= sp;            =       |
> 11 +
>  MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md=
> |   55 +
>
> MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyF= u
> ncTestApp.inf      |   42 + >  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.i= nf
> |    5 +
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf
> |    4 +
>
> MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.i > nf           &= nbsp;         |   10 += ;
>
> MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf > |    4 +
>  OvmfPkg/OvmfPkgIa32.dsc      &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;         |    5 &#= 43;
>  OvmfPkg/OvmfPkgIa32X64.dsc      &= nbsp;           &nbs= p;            &= nbsp;           &nbs= p;            &= nbsp;      |    5 +
>  OvmfPkg/OvmfPkgX64.dsc       = ;            &n= bsp;            = ;            &n= bsp;            = ;          |   = 5 +
>  OvmfPkg/OvmfXen.dsc       &n= bsp;            = ;            &n= bsp;            = ;            &n= bsp;            |&nb= sp;   4 +
>  SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf &n= bsp;            = ;            &n= bsp;       |
> 2 +
>  UefiPayloadPkg/UefiPayloadPkgIa32.dsc    &n= bsp;            = ;            &n= bsp;            = ;          |   = 4 +
>  UefiPayloadPkg/UefiPayloadPkgIa32X64.dsc    = ;            &n= bsp;            = ;            &n= bsp;       |    4 +
>  47 files changed, 8015 insertions(+), 78 deletions(-) = create mode 100644
> MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c
>  create mode 100644
> MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.= c
>  create mode 100644
> MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c<= br> >  create mode 100644
> MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntime= Dx
> e.c
>  create mode 100644
> MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c
>  create mode 100644
> MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/Variabl= ePo
> licyUnitTest.c
>  create mode 100644
> MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyF= u
> ncTestApp.c
>  create mode 100644
> MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock > .c
>  create mode 100644
> MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c
>  create mode 100644 MdeModulePkg/Include/Guid/VarCheckPolicyMmi.= h
>  create mode 100644
> MdeModulePkg/Include/Library/VariablePolicyHelperLib.h
>  create mode 100644 MdeModulePkg/Include/Library/VariablePolicyL= ib.h
>  create mode 100644 MdeModulePkg/Include/Protocol/VariablePolicy= .h
>  create mode 100644
> MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf
>  create mode 100644
> MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni
>  create mode 100644
> MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.= inf
>  create mode 100644
> MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.= uni
>  create mode 100644
> MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf
>  create mode 100644
> MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni
>  create mode 100644
> MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.in= f
>  create mode 100644
> MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/Variabl= ePo
> licyUnitTest.inf
>  create mode 100644
> MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md
>  create mode 100644
> MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyF= u
> ncTestApp.inf
>
> --
> 2.26.2.windows.1.8.g01c50adf56.20200515075929
>
>
>


 

--_000_CY4PR21MB0743F6EBBD4CED2B2579CAF7EF6D0CY4PR21MB0743namp_--