public inbox for devel@edk2.groups.io
 help / color / mirror / Atom feed
From: "Guomin Jiang" <guomin.jiang@intel.com>
To: "devel@edk2.groups.io" <devel@edk2.groups.io>,
	"michael.kubacki@outlook.com" <michael.kubacki@outlook.com>
Cc: "Yao, Jiewen" <jiewen.yao@intel.com>,
	"Zhang, Chao B" <chao.b.zhang@intel.com>,
	"Wang, Jian J" <jian.j.wang@intel.com>,
	"Wu, Hao A" <hao.a.wu@intel.com>,
	"Gao, Liming" <liming.gao@intel.com>,
	"Justen, Jordan L" <jordan.l.justen@intel.com>,
	Laszlo Ersek <lersek@redhat.com>,
	"Ard Biesheuvel" <ard.biesheuvel@arm.com>,
	Andrew Fish <afish@apple.com>, "Ni, Ray" <ray.ni@intel.com>,
	Bret Barkelew <brbarkel@microsoft.com>
Subject: Re: [edk2-devel] [PATCH v3 00/14] Add the VariablePolicy feature
Date: Tue, 26 May 2020 01:20:22 +0000	[thread overview]
Message-ID: <DM6PR11MB29555F2C22E463E161BDE3A29DB00@DM6PR11MB2955.namprd11.prod.outlook.com> (raw)
In-Reply-To: <MWHPR07MB344099884131EEBACE77E6D9E9B70@MWHPR07MB3440.namprd07.prod.outlook.com>

Hi Kubacki,

I am reviewing the patch series, I will need 2 weeks to review it and will comment it after review it.

Best Regards
Guomin

> -----Original Message-----
> From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Michael
> Kubacki
> Sent: Friday, May 22, 2020 6:43 AM
> To: devel@edk2.groups.io
> Cc: Yao, Jiewen <jiewen.yao@intel.com>; Zhang, Chao B
> <chao.b.zhang@intel.com>; Wang, Jian J <jian.j.wang@intel.com>; Wu, Hao
> A <hao.a.wu@intel.com>; Gao, Liming <liming.gao@intel.com>; Justen,
> Jordan L <jordan.l.justen@intel.com>; Laszlo Ersek <lersek@redhat.com>;
> Ard Biesheuvel <ard.biesheuvel@arm.com>; Andrew Fish
> <afish@apple.com>; Ni, Ray <ray.ni@intel.com>; Bret Barkelew
> <brbarkel@microsoft.com>
> Subject: [edk2-devel] [PATCH v3 00/14] Add the VariablePolicy feature
> 
> From: Michael Kubacki <michael.kubacki@microsoft.com>
> 
> REF:https://bugzilla.tianocore.org/show_bug.cgi?id=2522
> 
> The 14 patches in this series add the VariablePolicy feature to the core,
> deprecate Edk2VarLock (while adding a compatibility layer to reduce code
> churn), and integrate the VariablePolicy libraries and protocols into Variable
> Services.
> 
> Since the integration requires multiple changes, including adding libraries, a
> protocol, an SMI communication handler, and VariableServices integration,
> the patches are broken up by individual library additions and then a final
> integration. Security-sensitive changes like bypassing Authenticated Variable
> enforcement are also broken out into individual patches so that attention can
> be called directly to them.
> 
> Platform porting instructions are described in this wiki entry:
> https://github.com/tianocore/tianocore.github.io/wiki/VariablePolicy-
> Protocol---Enhanced-Method-for-Managing-Variables#platform-porting
> 
> Discussion of the feature can be found in multiple places throughout the last
> year on the RFC channel, staging branches, and in devel.
> 
> Most recently, this subject was discussed in this thread:
> https://edk2.groups.io/g/devel/message/53712
> (the code branches shared in that discussion are now out of date, but the
> whitepapers and discussion are relevant).
> 
> Cc: Jiewen Yao <jiewen.yao@intel.com>
> Cc: Chao Zhang <chao.b.zhang@intel.com>
> Cc: Jian J Wang <jian.j.wang@intel.com>
> Cc: Hao A Wu <hao.a.wu@intel.com>
> Cc: Liming Gao <liming.gao@intel.com>
> Cc: Jordan Justen <jordan.l.justen@intel.com>
> Cc: Laszlo Ersek <lersek@redhat.com>
> Cc: Ard Biesheuvel <ard.biesheuvel@arm.com>
> Cc: Andrew Fish <afish@apple.com>
> Cc: Ray Ni <ray.ni@intel.com>
> Cc: Bret Barkelew <brbarkel@microsoft.com>
> Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com>
> 
> V3 changes:
> * Address all non-unittest issues with ECC
> * Make additional style changes
> * Include section name in hunk headers in "ini-style" files
> * Remove requirement for the EdkiiPiSmmCommunicationsRegionTable
> driver
>   (now allocates its own buffer)
> * Change names from VARIABLE_POLICY_PROTOCOL and
> gVariablePolicyProtocolGuid
>   to EDKII_VARIABLE_POLICY_PROTOCOL and
> gEdkiiVariablePolicyProtocolGuid
> * Fix GCC warning about initializing externs
> * Add UNI strings for new PCD
> * Add patches for ArmVirtPkg, OvmfXen, and UefiPayloadPkg
> * Reorder patches according to Liming's feedback about adding to platforms
>   before changing variable driver
> 
> V2 changes:
> * Fixed implementation for RuntimeDxe
> * Add PCD to block DisableVariablePolicy
> * Fix the DumpVariablePolicy pagination in SMM
> 
> On a separate note, shallow threading might not work on this patch series
> due to changes made by the SMTP server. I apologize for any inconvenience.
> 
> Bret Barkelew (14):
>   MdeModulePkg: Define the VariablePolicy protocol interface
>   MdeModulePkg: Define the VariablePolicyLib
>   MdeModulePkg: Define the VariablePolicyHelperLib
>   MdeModulePkg: Define the VarCheckPolicyLib and SMM interface
>   OvmfPkg: Add VariablePolicy engine to OvmfPkg platform
>   EmulatorPkg: Add VariablePolicy engine to EmulatorPkg platform
>   ArmVirtPkg: Add VariablePolicy engine to ArmVirtPkg platform
>   UefiPayloadPkg: Add VariablePolicy engine to UefiPayloadPkg platform
>   MdeModulePkg: Connect VariablePolicy business logic to
>     VariableServices
>   MdeModulePkg: Allow VariablePolicy state to delete protected variables
>   SecurityPkg: Allow VariablePolicy state to delete authenticated
>     variables
>   MdeModulePkg: Change TCG MOR variables to use VariablePolicy
>   MdeModulePkg: Drop VarLock from RuntimeDxe variable driver
>   MdeModulePkg: Add a shell-based functional test for VariablePolicy
> 
>  MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c
> |  324 +++
>  MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c
> |  404 ++++
>  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c
> |   46 +
> 
> MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDx
> e.c               |   86 +
>  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c
> |  830 +++++++
> 
> MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePo
> licyUnitTest.c   | 2533 ++++++++++++++++++++
> 
> MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFu
> ncTestApp.c        | 1950 +++++++++++++++
>  MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c
> |   56 +-
>  MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c
> |   64 +-
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VarCheck.c
> |   49 +-
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c
> |   53 +
> 
> MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequestToLoc
> k.c                   |   73 +
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c
> |  649 +++++
> 
> MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.
> c                       |   14 +
>  SecurityPkg/Library/AuthVariableLib/AuthService.c                                        |   24
> +-
>  ArmVirtPkg/ArmVirt.dsc.inc                                                               |    7 +
>  EmulatorPkg/EmulatorPkg.dsc                                                              |    6 +
>  MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h                                            |
> 54 +
>  MdeModulePkg/Include/Library/VariablePolicyHelperLib.h
> |  164 ++
>  MdeModulePkg/Include/Library/VariablePolicyLib.h                                         |
> 207 ++
>  MdeModulePkg/Include/Protocol/VariablePolicy.h                                           |
> 157 ++
>  MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf
> |   42 +
>  MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni
> |   12 +
>  MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf
> |   35 +
>  MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.uni
> |   12 +
>  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf
> |   44 +
>  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni
> |   12 +
>  MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf
> |   51 +
> 
> MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePo
> licyUnitTest.inf |   40 +
>  MdeModulePkg/MdeModulePkg.ci.yaml                                                        |    4 +-
>  MdeModulePkg/MdeModulePkg.dec                                                            |   26 +-
>  MdeModulePkg/MdeModulePkg.dsc                                                            |   15 +
>  MdeModulePkg/MdeModulePkg.uni                                                            |    7 +
>  MdeModulePkg/Test/MdeModulePkgHostTest.dsc                                               |
> 11 +
>  MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md
> |   55 +
> 
> MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFu
> ncTestApp.inf      |   42 +
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
> |    5 +
>  MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf
> |    4 +
> 
> MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.i
> nf                     |   11 +
> 
> MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf
> |    4 +
>  OvmfPkg/OvmfPkgIa32.dsc                                                                  |    8 +
>  OvmfPkg/OvmfPkgIa32X64.dsc                                                               |    8 +
>  OvmfPkg/OvmfPkgX64.dsc                                                                   |    8 +
>  OvmfPkg/OvmfXen.dsc                                                                      |    7 +
>  SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf                                  |
> 2 +
>  UefiPayloadPkg/UefiPayloadPkgIa32.dsc                                                    |    7 +
>  UefiPayloadPkg/UefiPayloadPkgIa32X64.dsc                                                 |    7 +
>  47 files changed, 8151 insertions(+), 78 deletions(-)  create mode 100644
> MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c
>  create mode 100644
> MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c
>  create mode 100644
> MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c
>  create mode 100644
> MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDx
> e.c
>  create mode 100644
> MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c
>  create mode 100644
> MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePo
> licyUnitTest.c
>  create mode 100644
> MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFu
> ncTestApp.c
>  create mode 100644
> MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequestToLoc
> k.c
>  create mode 100644
> MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c
>  create mode 100644 MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h
>  create mode 100644
> MdeModulePkg/Include/Library/VariablePolicyHelperLib.h
>  create mode 100644 MdeModulePkg/Include/Library/VariablePolicyLib.h
>  create mode 100644 MdeModulePkg/Include/Protocol/VariablePolicy.h
>  create mode 100644
> MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf
>  create mode 100644
> MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni
>  create mode 100644
> MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf
>  create mode 100644
> MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.uni
>  create mode 100644
> MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf
>  create mode 100644
> MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni
>  create mode 100644
> MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf
>  create mode 100644
> MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePo
> licyUnitTest.inf
>  create mode 100644
> MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md
>  create mode 100644
> MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFu
> ncTestApp.inf
> 
> --
> 2.16.3.windows.1
> 
> 
> 


      reply	other threads:[~2020-05-26  1:20 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-05-21 22:43 [PATCH v3 00/14] Add the VariablePolicy feature Michael Kubacki
2020-05-26  1:20 ` Guomin Jiang [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-list from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=DM6PR11MB29555F2C22E463E161BDE3A29DB00@DM6PR11MB2955.namprd11.prod.outlook.com \
    --to=devel@edk2.groups.io \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox