MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c | 318 +++ MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c | 396 ++++ MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c | 46 + MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDxe.c | 85 + MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c | 806 +++++++ MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.c | 2285 ++++++++++++++++++++ MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.c | 1942 +++++++++++++++++ MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c | 52 +- MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c | 60 +- MdeModulePkg/Universal/Variable/RuntimeDxe/VarCheck.c | 49 +- MdeModulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c | 53 + MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock.c | 71 + MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c | 653 ++++++ MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c | 14 + SecurityPkg/Library/AuthVariableLib/AuthService.c | 22 +- EmulatorPkg/EmulatorPkg.dsc | 6 + MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h | 54 + MdeModulePkg/Include/Library/VariablePolicyHelperLib.h | 164 ++ MdeModulePkg/Include/Library/VariablePolicyLib.h | 207 ++ MdeModulePkg/Include/Protocol/VariablePolicy.h | 157 ++ MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf | 44 + MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni | 12 + MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf | 36 + MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.uni | 12 + MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf | 44 + MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni | 12 + MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf | 52 + MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.inf | 41 + MdeModulePkg/MdeModulePkg.ci.yaml | 4 +- MdeModulePkg/MdeModulePkg.dec | 26 +- MdeModulePkg/MdeModulePkg.dsc | 15 + MdeModulePkg/Test/MdeModulePkgHostTest.dsc | 11 + MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md | 55 + MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.inf | 42 + MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf | 5 + MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf | 4 + MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf | 12 + MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf | 4 + OvmfPkg/OvmfPkgIa32.dsc | 8 + OvmfPkg/OvmfPkgIa32X64.dsc | 8 + OvmfPkg/OvmfPkgX64.dsc | 8 + SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf | 2 + 42 files changed, 7819 insertions(+), 78 deletions(-) create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDxe.c create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.c create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.c create mode 100644 MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock.c create mode 100644 MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c create mode 100644 MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h create mode 100644 MdeModulePkg/Include/Library/VariablePolicyHelperLib.h create mode 100644 MdeModulePkg/Include/Library/VariablePolicyLib.h create mode 100644 MdeModulePkg/Include/Protocol/VariablePolicy.h create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.uni create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.inf create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.inf
From: Michael Kubacki <michael.kubacki@microsoft.com> REF:https://bugzilla.tianocore.org/show_bug.cgi?id=2522 The 12 patches in this series add the VariablePolicy feature to the core, deprecate Edk2VarLock (while adding a compatibility layer to reduce code churn), and integrate the VariablePolicy libraries and protocols into Variable Services. Since the integration requires multiple changes, including adding libraries, a protocol, an SMI communication handler, and VariableServices integration, the patches are broken up by individual library additions and then a final integration. Security-sensitive changes like bypassing Authenticated Variable enforcement are also broken out into individual patches so that attention can be called directly to them. Platform porting instructions are described in this wiki entry: https://github.com/tianocore/tianocore.github.io/wiki/VariablePolicy-Protocol---Enhanced-Method-for-Managing-Variables#platform-porting Discussion of the feature can be found in multiple places throughout the last year on the RFC channel, staging branches, and in devel. Most recently, this subject was discussed in this thread: https://edk2.groups.io/g/devel/message/53712 (the code branches shared in that discussion are now out of date, but the whitepapers and discussion are relevant). Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Chao Zhang <chao.b.zhang@intel.com> Cc: Jian J Wang <jian.j.wang@intel.com> Cc: Hao A Wu <hao.a.wu@intel.com> Cc: Liming Gao <liming.gao@intel.com> Cc: Jordan Justen <jordan.l.justen@intel.com> Cc: Laszlo Ersek <lersek@redhat.com> Cc: Ard Biesheuvel <ard.biesheuvel@arm.com> Cc: Andrew Fish <afish@apple.com> Cc: Ray Ni <ray.ni@intel.com> Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com> Changes since v1: * Fixed implementation for RuntimeDxe * Add PCD to block DisableVariablePolicy * Fix the DumpVariablePolicy pagination in SMM Bret Barkelew (12): MdeModulePkg: Define the VariablePolicy protocol interface MdeModulePkg: Define the VariablePolicyLib MdeModulePkg: Define the VariablePolicyHelperLib MdeModulePkg: Define the VarCheckPolicyLib and SMM interface MdeModulePkg: Connect VariablePolicy business logic to VariableServices MdeModulePkg: Allow VariablePolicy state to delete protected variables SecurityPkg: Allow VariablePolicy state to delete authenticated variables MdeModulePkg: Change TCG MOR variables to use VariablePolicy MdeModulePkg: Drop VarLock from RuntimeDxe variable driver MdeModulePkg: Add a shell-based functional test for VariablePolicy OvmfPkg: Add VariablePolicy engine to OvmfPkg platform EmulatorPkg: Add VariablePolicy engine to EmulatorPkg platform MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c | 318 +++ MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c | 396 ++++ MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c | 46 + MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDxe.c | 85 + MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c | 806 +++++++ MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.c | 2285 ++++++++++++++++++++ MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.c | 1942 +++++++++++++++++ MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c | 52 +- MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c | 60 +- MdeModulePkg/Universal/Variable/RuntimeDxe/VarCheck.c | 49 +- MdeModulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c | 53 + MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock.c | 71 + MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c | 653 ++++++ MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c | 14 + SecurityPkg/Library/AuthVariableLib/AuthService.c | 22 +- EmulatorPkg/EmulatorPkg.dsc | 6 + MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h | 54 + MdeModulePkg/Include/Library/VariablePolicyHelperLib.h | 164 ++ MdeModulePkg/Include/Library/VariablePolicyLib.h | 207 ++ MdeModulePkg/Include/Protocol/VariablePolicy.h | 157 ++ MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf | 44 + MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni | 12 + MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf | 36 + MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.uni | 12 + MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf | 44 + MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni | 12 + MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf | 52 + MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.inf | 41 + MdeModulePkg/MdeModulePkg.ci.yaml | 4 +- MdeModulePkg/MdeModulePkg.dec | 26 +- MdeModulePkg/MdeModulePkg.dsc | 15 + MdeModulePkg/Test/MdeModulePkgHostTest.dsc | 11 + MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md | 55 + MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.inf | 42 + MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf | 5 + MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf | 4 + MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf | 12 + MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf | 4 + OvmfPkg/OvmfPkgIa32.dsc | 8 + OvmfPkg/OvmfPkgIa32X64.dsc | 8 + OvmfPkg/OvmfPkgX64.dsc | 8 + SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf | 2 + 42 files changed, 7819 insertions(+), 78 deletions(-) create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDxe.c create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.c create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.c create mode 100644 MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock.c create mode 100644 MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c create mode 100644 MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h create mode 100644 MdeModulePkg/Include/Library/VariablePolicyHelperLib.h create mode 100644 MdeModulePkg/Include/Library/VariablePolicyLib.h create mode 100644 MdeModulePkg/Include/Protocol/VariablePolicy.h create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.uni create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.inf create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.inf -- 2.16.3.windows.1 -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#59233): https://edk2.groups.io/g/devel/message/59233 Mute This Topic: https://groups.io/mt/74153769/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=-=-=-=-=-=-=-=-=-=-=-
(+ Bret) On 5/12/20 8:46 AM, michael.kubacki@outlook.com wrote: > From: Michael Kubacki <michael.kubacki@microsoft.com> > > REF:https://bugzilla.tianocore.org/show_bug.cgi?id=2522 > > The 12 patches in this series add the VariablePolicy feature to the core, > deprecate Edk2VarLock (while adding a compatibility layer to reduce code > churn), and integrate the VariablePolicy libraries and protocols into > Variable Services. > > Since the integration requires multiple changes, including adding libraries, > a protocol, an SMI communication handler, and VariableServices integration, > the patches are broken up by individual library additions and then a final > integration. Security-sensitive changes like bypassing Authenticated > Variable enforcement are also broken out into individual patches so that > attention can be called directly to them. > As noted by Bret, this series is affected by the recent PI 1.7 errata A changes, which superseded the MM communicate protocol with MM communicate 2. I will try to have my resulting changes in asap, but I suppose this series will need some minor rework. (MM communicate2 just takes an extra VirtualAddress argument, which is simply the virtual address of the buffer whose address is passed by PA only in MM communicate) > Platform porting instructions are described in this wiki entry: > https://github.com/tianocore/tianocore.github.io/wiki/VariablePolicy-Protocol---Enhanced-Method-for-Managing-Variables#platform-porting > > Discussion of the feature can be found in multiple places throughout > the last year on the RFC channel, staging branches, and in devel. > > Most recently, this subject was discussed in this thread: > https://edk2.groups.io/g/devel/message/53712 > (the code branches shared in that discussion are now out of date, but the > whitepapers and discussion are relevant). > > Cc: Jiewen Yao <jiewen.yao@intel.com> > Cc: Chao Zhang <chao.b.zhang@intel.com> > Cc: Jian J Wang <jian.j.wang@intel.com> > Cc: Hao A Wu <hao.a.wu@intel.com> > Cc: Liming Gao <liming.gao@intel.com> > Cc: Jordan Justen <jordan.l.justen@intel.com> > Cc: Laszlo Ersek <lersek@redhat.com> > Cc: Ard Biesheuvel <ard.biesheuvel@arm.com> > Cc: Andrew Fish <afish@apple.com> > Cc: Ray Ni <ray.ni@intel.com> > Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com> > > Changes since v1: > * Fixed implementation for RuntimeDxe > * Add PCD to block DisableVariablePolicy > * Fix the DumpVariablePolicy pagination in SMM > > Bret Barkelew (12): > MdeModulePkg: Define the VariablePolicy protocol interface > MdeModulePkg: Define the VariablePolicyLib > MdeModulePkg: Define the VariablePolicyHelperLib > MdeModulePkg: Define the VarCheckPolicyLib and SMM interface > MdeModulePkg: Connect VariablePolicy business logic to > VariableServices > MdeModulePkg: Allow VariablePolicy state to delete protected variables > SecurityPkg: Allow VariablePolicy state to delete authenticated > variables > MdeModulePkg: Change TCG MOR variables to use VariablePolicy > MdeModulePkg: Drop VarLock from RuntimeDxe variable driver > MdeModulePkg: Add a shell-based functional test for VariablePolicy > OvmfPkg: Add VariablePolicy engine to OvmfPkg platform > EmulatorPkg: Add VariablePolicy engine to EmulatorPkg platform > > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c | 318 +++ > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c | 396 ++++ > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c | 46 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDxe.c | 85 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c | 806 +++++++ > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.c | 2285 ++++++++++++++++++++ > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.c | 1942 +++++++++++++++++ > MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c | 52 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c | 60 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/VarCheck.c | 49 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c | 53 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock.c | 71 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c | 653 ++++++ > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c | 14 + > SecurityPkg/Library/AuthVariableLib/AuthService.c | 22 +- > EmulatorPkg/EmulatorPkg.dsc | 6 + > MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h | 54 + > MdeModulePkg/Include/Library/VariablePolicyHelperLib.h | 164 ++ > MdeModulePkg/Include/Library/VariablePolicyLib.h | 207 ++ > MdeModulePkg/Include/Protocol/VariablePolicy.h | 157 ++ > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf | 44 + > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni | 12 + > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf | 36 + > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.uni | 12 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf | 44 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni | 12 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf | 52 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.inf | 41 + > MdeModulePkg/MdeModulePkg.ci.yaml | 4 +- > MdeModulePkg/MdeModulePkg.dec | 26 +- > MdeModulePkg/MdeModulePkg.dsc | 15 + > MdeModulePkg/Test/MdeModulePkgHostTest.dsc | 11 + > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md | 55 + > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.inf | 42 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf | 5 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf | 4 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf | 12 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf | 4 + > OvmfPkg/OvmfPkgIa32.dsc | 8 + > OvmfPkg/OvmfPkgIa32X64.dsc | 8 + > OvmfPkg/OvmfPkgX64.dsc | 8 + > SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf | 2 + > 42 files changed, 7819 insertions(+), 78 deletions(-) > create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c > create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDxe.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.c > create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.c > create mode 100644 MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock.c > create mode 100644 MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c > create mode 100644 MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h > create mode 100644 MdeModulePkg/Include/Library/VariablePolicyHelperLib.h > create mode 100644 MdeModulePkg/Include/Library/VariablePolicyLib.h > create mode 100644 MdeModulePkg/Include/Protocol/VariablePolicy.h > create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf > create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni > create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf > create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.uni > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.inf > create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md > create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.inf > -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#59259): https://edk2.groups.io/g/devel/message/59259 Mute This Topic: https://groups.io/mt/74153769/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=-=-=-=-=-=-=-=-=-=-=-
On 05/12/20 08:46, Michael Kubacki wrote: > From: Michael Kubacki <michael.kubacki@microsoft.com> > > REF:https://bugzilla.tianocore.org/show_bug.cgi?id=2522 > > The 12 patches in this series add the VariablePolicy feature to the core, > deprecate Edk2VarLock (while adding a compatibility layer to reduce code > churn), and integrate the VariablePolicy libraries and protocols into > Variable Services. > > Since the integration requires multiple changes, including adding libraries, > a protocol, an SMI communication handler, and VariableServices integration, > the patches are broken up by individual library additions and then a final > integration. Security-sensitive changes like bypassing Authenticated > Variable enforcement are also broken out into individual patches so that > attention can be called directly to them. > > Platform porting instructions are described in this wiki entry: > https://github.com/tianocore/tianocore.github.io/wiki/VariablePolicy-Protocol---Enhanced-Method-for-Managing-Variables#platform-porting (1) This wiki article is helpful, thanks. I have one remark: there's a heading saying "VarCheckPolicyLib NULL Instance": https://github.com/tianocore/tianocore.github.io/wiki/VariablePolicy-Protocol---Enhanced-Method-for-Managing-Variables#varcheckpolicylib-null-instance I think what's meant is "NULL class", not "NULL instance". (2) The following platform DSC files in edk2 include the non-SMM variable driver ("MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf"), but they are not modified by this patch series: ArmVirtPkg/ArmVirtQemu.dsc ArmVirtPkg/ArmVirtQemuKernel.dsc ArmVirtPkg/ArmVirtXen.dsc OvmfPkg/OvmfXen.dsc UefiPayloadPkg/UefiPayloadPkgIa32.dsc UefiPayloadPkg/UefiPayloadPkgIa32X64.dsc I'm asking that you please (a) include a patch for ArmVirtPkg, (b) update the OvmfPkg patch to cover "OvmfXen.dsc" too. Not sure about the UefiPayloadPkg platforms; please ask their maintainers. (I've CC'd the OvmfXen and UefiPayloadPkg maintainers/reviewers.) Thanks, Laszlo > > Discussion of the feature can be found in multiple places throughout > the last year on the RFC channel, staging branches, and in devel. > > Most recently, this subject was discussed in this thread: > https://edk2.groups.io/g/devel/message/53712 > (the code branches shared in that discussion are now out of date, but the > whitepapers and discussion are relevant). > > Cc: Jiewen Yao <jiewen.yao@intel.com> > Cc: Chao Zhang <chao.b.zhang@intel.com> > Cc: Jian J Wang <jian.j.wang@intel.com> > Cc: Hao A Wu <hao.a.wu@intel.com> > Cc: Liming Gao <liming.gao@intel.com> > Cc: Jordan Justen <jordan.l.justen@intel.com> > Cc: Laszlo Ersek <lersek@redhat.com> > Cc: Ard Biesheuvel <ard.biesheuvel@arm.com> > Cc: Andrew Fish <afish@apple.com> > Cc: Ray Ni <ray.ni@intel.com> > Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com> > > Changes since v1: > * Fixed implementation for RuntimeDxe > * Add PCD to block DisableVariablePolicy > * Fix the DumpVariablePolicy pagination in SMM > > Bret Barkelew (12): > MdeModulePkg: Define the VariablePolicy protocol interface > MdeModulePkg: Define the VariablePolicyLib > MdeModulePkg: Define the VariablePolicyHelperLib > MdeModulePkg: Define the VarCheckPolicyLib and SMM interface > MdeModulePkg: Connect VariablePolicy business logic to > VariableServices > MdeModulePkg: Allow VariablePolicy state to delete protected variables > SecurityPkg: Allow VariablePolicy state to delete authenticated > variables > MdeModulePkg: Change TCG MOR variables to use VariablePolicy > MdeModulePkg: Drop VarLock from RuntimeDxe variable driver > MdeModulePkg: Add a shell-based functional test for VariablePolicy > OvmfPkg: Add VariablePolicy engine to OvmfPkg platform > EmulatorPkg: Add VariablePolicy engine to EmulatorPkg platform > > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c | 318 +++ > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c | 396 ++++ > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c | 46 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDxe.c | 85 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c | 806 +++++++ > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.c | 2285 ++++++++++++++++++++ > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.c | 1942 +++++++++++++++++ > MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c | 52 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c | 60 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/VarCheck.c | 49 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c | 53 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock.c | 71 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c | 653 ++++++ > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c | 14 + > SecurityPkg/Library/AuthVariableLib/AuthService.c | 22 +- > EmulatorPkg/EmulatorPkg.dsc | 6 + > MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h | 54 + > MdeModulePkg/Include/Library/VariablePolicyHelperLib.h | 164 ++ > MdeModulePkg/Include/Library/VariablePolicyLib.h | 207 ++ > MdeModulePkg/Include/Protocol/VariablePolicy.h | 157 ++ > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf | 44 + > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni | 12 + > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf | 36 + > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.uni | 12 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf | 44 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni | 12 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf | 52 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.inf | 41 + > MdeModulePkg/MdeModulePkg.ci.yaml | 4 +- > MdeModulePkg/MdeModulePkg.dec | 26 +- > MdeModulePkg/MdeModulePkg.dsc | 15 + > MdeModulePkg/Test/MdeModulePkgHostTest.dsc | 11 + > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md | 55 + > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.inf | 42 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf | 5 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf | 4 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf | 12 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf | 4 + > OvmfPkg/OvmfPkgIa32.dsc | 8 + > OvmfPkg/OvmfPkgIa32X64.dsc | 8 + > OvmfPkg/OvmfPkgX64.dsc | 8 + > SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf | 2 + > 42 files changed, 7819 insertions(+), 78 deletions(-) > create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c > create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDxe.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.c > create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.c > create mode 100644 MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock.c > create mode 100644 MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c > create mode 100644 MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h > create mode 100644 MdeModulePkg/Include/Library/VariablePolicyHelperLib.h > create mode 100644 MdeModulePkg/Include/Library/VariablePolicyLib.h > create mode 100644 MdeModulePkg/Include/Protocol/VariablePolicy.h > create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf > create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni > create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf > create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.uni > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.inf > create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md > create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.inf > -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#59270): https://edk2.groups.io/g/devel/message/59270 Mute This Topic: https://groups.io/mt/74153769/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=-=-=-=-=-=-=-=-=-=-=-
On 05/12/20 13:52, Laszlo Ersek wrote: > On 05/12/20 08:46, Michael Kubacki wrote: >> From: Michael Kubacki <michael.kubacki@microsoft.com> >> >> REF:https://bugzilla.tianocore.org/show_bug.cgi?id=2522 >> >> The 12 patches in this series add the VariablePolicy feature to the core, >> deprecate Edk2VarLock (while adding a compatibility layer to reduce code >> churn), and integrate the VariablePolicy libraries and protocols into >> Variable Services. >> >> Since the integration requires multiple changes, including adding libraries, >> a protocol, an SMI communication handler, and VariableServices integration, >> the patches are broken up by individual library additions and then a final >> integration. Security-sensitive changes like bypassing Authenticated >> Variable enforcement are also broken out into individual patches so that >> attention can be called directly to them. >> >> Platform porting instructions are described in this wiki entry: >> https://github.com/tianocore/tianocore.github.io/wiki/VariablePolicy-Protocol---Enhanced-Method-for-Managing-Variables#platform-porting > > (1) This wiki article is helpful, thanks. > > I have one remark: there's a heading saying "VarCheckPolicyLib NULL > Instance": > > https://github.com/tianocore/tianocore.github.io/wiki/VariablePolicy-Protocol---Enhanced-Method-for-Managing-Variables#varcheckpolicylib-null-instance > > I think what's meant is "NULL class", not "NULL instance". > > (2) The following platform DSC files in edk2 include the non-SMM > variable driver > ("MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf"), > but they are not modified by this patch series: > > ArmVirtPkg/ArmVirtQemu.dsc > ArmVirtPkg/ArmVirtQemuKernel.dsc > ArmVirtPkg/ArmVirtXen.dsc > OvmfPkg/OvmfXen.dsc > UefiPayloadPkg/UefiPayloadPkgIa32.dsc > UefiPayloadPkg/UefiPayloadPkgIa32X64.dsc > > I'm asking that you please (a) include a patch for ArmVirtPkg, (b) > update the OvmfPkg patch to cover "OvmfXen.dsc" too. > > Not sure about the UefiPayloadPkg platforms; please ask their maintainers. > > (I've CC'd the OvmfXen and UefiPayloadPkg maintainers/reviewers.) (3) Could the wiki article please say a few words about what modules are supposed to turn this mechanism into an actual policy? I.e., what modules / use cases would consume the new protocol? In this series, the only INF file that gets a reference to the new protocol but is not related to the implementation of the protocol is VariablePolicyFuncTestApp. Thanks, Laszlo -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#59273): https://edk2.groups.io/g/devel/message/59273 Mute This Topic: https://groups.io/mt/74153769/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=-=-=-=-=-=-=-=-=-=-=-
On 05/12/20 14:15, Laszlo Ersek wrote: > On 05/12/20 13:52, Laszlo Ersek wrote: >> On 05/12/20 08:46, Michael Kubacki wrote: >>> From: Michael Kubacki <michael.kubacki@microsoft.com> >>> >>> REF:https://bugzilla.tianocore.org/show_bug.cgi?id=2522 >>> >>> The 12 patches in this series add the VariablePolicy feature to the >>> core, deprecate Edk2VarLock (while adding a compatibility layer to >>> reduce code churn), and integrate the VariablePolicy libraries and >>> protocols into Variable Services. >>> >>> Since the integration requires multiple changes, including adding >>> libraries, a protocol, an SMI communication handler, and >>> VariableServices integration, the patches are broken up by >>> individual library additions and then a final integration. >>> Security-sensitive changes like bypassing Authenticated Variable >>> enforcement are also broken out into individual patches so that >>> attention can be called directly to them. (4) Can you please run SetupGit.py in your edk2 clone, for the future? It will mark the DEC, DSC, etc "ini-style" files with the "diff=ini" attribute. Furthermore, it will set the "xfuncname" knob for the "diff=ini"-marked files. As a result, when you format a patch that modifies e.g. a DSC file, the "@@" hunk headers will display the section being modified. For example: > @@ -492,6 +496,9 @@ [PcdsFixedAtBuild] > gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVolatileVariableSize|0x40000 > !endif > > + # Optional: Omit if VariablePolicy should be always-on. > + gEfiMdeModulePkgTokenSpaceGuid.PcdAllowVariablePolicyEnforcementDisable|TRUE > + > gEfiMdeModulePkgTokenSpaceGuid.PcdVpdBaseAddress|0x0 > > gEfiMdePkgTokenSpaceGuid.PcdReportStatusCodePropertyMask|0x07 Note that the "@@" hunk header now states "[PcdsFixedAtBuild]". It tells me as a reviewer about the access method of the PCD that was chosen for OvmfPkg. Such hunk headers improve reviewer throughput quite a bit. Thanks, Laszlo -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#59276): https://edk2.groups.io/g/devel/message/59276 Mute This Topic: https://groups.io/mt/74153769/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=-=-=-=-=-=-=-=-=-=-=-
While most of the feedback in the series is relevant for the author (Bret), this is a change I will make for the patches I generate. Thanks, Michael On 5/12/2020 5:37 AM, Laszlo Ersek wrote: > On 05/12/20 14:15, Laszlo Ersek wrote: >> On 05/12/20 13:52, Laszlo Ersek wrote: >>> On 05/12/20 08:46, Michael Kubacki wrote: >>>> From: Michael Kubacki <michael.kubacki@microsoft.com> >>>> >>>> REF:https://bugzilla.tianocore.org/show_bug.cgi?id=2522 >>>> >>>> The 12 patches in this series add the VariablePolicy feature to the >>>> core, deprecate Edk2VarLock (while adding a compatibility layer to >>>> reduce code churn), and integrate the VariablePolicy libraries and >>>> protocols into Variable Services. >>>> >>>> Since the integration requires multiple changes, including adding >>>> libraries, a protocol, an SMI communication handler, and >>>> VariableServices integration, the patches are broken up by >>>> individual library additions and then a final integration. >>>> Security-sensitive changes like bypassing Authenticated Variable >>>> enforcement are also broken out into individual patches so that >>>> attention can be called directly to them. > > (4) Can you please run SetupGit.py in your edk2 clone, for the future? > > It will mark the DEC, DSC, etc "ini-style" files with the "diff=ini" > attribute. Furthermore, it will set the "xfuncname" knob for the > "diff=ini"-marked files. > > As a result, when you format a patch that modifies e.g. a DSC file, the > "@@" hunk headers will display the section being modified. For example: > >> @@ -492,6 +496,9 @@ [PcdsFixedAtBuild] >> gEfiMdeModulePkgTokenSpaceGuid.PcdMaxVolatileVariableSize|0x40000 >> !endif >> >> + # Optional: Omit if VariablePolicy should be always-on. >> + gEfiMdeModulePkgTokenSpaceGuid.PcdAllowVariablePolicyEnforcementDisable|TRUE >> + >> gEfiMdeModulePkgTokenSpaceGuid.PcdVpdBaseAddress|0x0 >> >> gEfiMdePkgTokenSpaceGuid.PcdReportStatusCodePropertyMask|0x07 > > Note that the "@@" hunk header now states "[PcdsFixedAtBuild]". It tells > me as a reviewer about the access method of the PCD that was chosen for > OvmfPkg. > > Such hunk headers improve reviewer throughput quite a bit. > > Thanks, > Laszlo > -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#59345): https://edk2.groups.io/g/devel/message/59345 Mute This Topic: https://groups.io/mt/74153769/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=-=-=-=-=-=-=-=-=-=-=-
Michael: > -----Original Message----- > From: Laszlo Ersek <lersek@redhat.com> > Sent: Tuesday, May 12, 2020 7:53 PM > To: devel@edk2.groups.io; michael.kubacki@outlook.com > Cc: Yao, Jiewen <jiewen.yao@intel.com>; Zhang, Chao B <chao.b.zhang@intel.com>; Wang, Jian J <jian.j.wang@intel.com>; Wu, Hao A > <hao.a.wu@intel.com>; Gao, Liming <liming.gao@intel.com>; Justen, Jordan L <jordan.l.justen@intel.com>; Ard Biesheuvel > <ard.biesheuvel@arm.com>; Andrew Fish <afish@apple.com>; Ni, Ray <ray.ni@intel.com>; Anthony Perard > <anthony.perard@citrix.com>; Julien Grall <julien@xen.org>; Ma, Maurice <maurice.ma@intel.com>; Dong, Guo > <guo.dong@intel.com>; You, Benjamin <benjamin.you@intel.com> > Subject: Re: [edk2-devel] [PATCH v2 00/12] Add the VariablePolicy feature > > On 05/12/20 08:46, Michael Kubacki wrote: > > From: Michael Kubacki <michael.kubacki@microsoft.com> > > > > REF:https://bugzilla.tianocore.org/show_bug.cgi?id=2522 > > > > The 12 patches in this series add the VariablePolicy feature to the core, > > deprecate Edk2VarLock (while adding a compatibility layer to reduce code > > churn), and integrate the VariablePolicy libraries and protocols into > > Variable Services. > > > > Since the integration requires multiple changes, including adding libraries, > > a protocol, an SMI communication handler, and VariableServices integration, > > the patches are broken up by individual library additions and then a final > > integration. Security-sensitive changes like bypassing Authenticated > > Variable enforcement are also broken out into individual patches so that > > attention can be called directly to them. > > > > Platform porting instructions are described in this wiki entry: > > https://github.com/tianocore/tianocore.github.io/wiki/VariablePolicy-Protocol---Enhanced-Method-for-Managing- > Variables#platform-porting > > (1) This wiki article is helpful, thanks. > > I have one remark: there's a heading saying "VarCheckPolicyLib NULL > Instance": > > https://github.com/tianocore/tianocore.github.io/wiki/VariablePolicy-Protocol---Enhanced-Method-for-Managing- > Variables#varcheckpolicylib-null-instance > > I think what's meant is "NULL class", not "NULL instance". > > (2) The following platform DSC files in edk2 include the non-SMM > variable driver > ("MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf"), > but they are not modified by this patch series: > > ArmVirtPkg/ArmVirtQemu.dsc > ArmVirtPkg/ArmVirtQemuKernel.dsc > ArmVirtPkg/ArmVirtXen.dsc > OvmfPkg/OvmfXen.dsc > UefiPayloadPkg/UefiPayloadPkgIa32.dsc > UefiPayloadPkg/UefiPayloadPkgIa32X64.dsc > > I'm asking that you please (a) include a patch for ArmVirtPkg, (b) > update the OvmfPkg patch to cover "OvmfXen.dsc" too. > > Not sure about the UefiPayloadPkg platforms; please ask their maintainers. > > (I've CC'd the OvmfXen and UefiPayloadPkg maintainers/reviewers.) To keep each commit build pass, the patch set should first add new library instance, then add the library instance into each platform DSC, last update Variable driver to consume new library instance. This patch also impacts the platforms in edk2-platforms. If you expect the platform maintainer to update their platform DSC, please send the mail and let them aware this change or submit BZ to track the changes in edk2-platforms. Thanks Liming > > Thanks, > Laszlo > > > > > Discussion of the feature can be found in multiple places throughout > > the last year on the RFC channel, staging branches, and in devel. > > > > Most recently, this subject was discussed in this thread: > > https://edk2.groups.io/g/devel/message/53712 > > (the code branches shared in that discussion are now out of date, but the > > whitepapers and discussion are relevant). > > > > Cc: Jiewen Yao <jiewen.yao@intel.com> > > Cc: Chao Zhang <chao.b.zhang@intel.com> > > Cc: Jian J Wang <jian.j.wang@intel.com> > > Cc: Hao A Wu <hao.a.wu@intel.com> > > Cc: Liming Gao <liming.gao@intel.com> > > Cc: Jordan Justen <jordan.l.justen@intel.com> > > Cc: Laszlo Ersek <lersek@redhat.com> > > Cc: Ard Biesheuvel <ard.biesheuvel@arm.com> > > Cc: Andrew Fish <afish@apple.com> > > Cc: Ray Ni <ray.ni@intel.com> > > Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com> > > > > Changes since v1: > > * Fixed implementation for RuntimeDxe > > * Add PCD to block DisableVariablePolicy > > * Fix the DumpVariablePolicy pagination in SMM > > > > Bret Barkelew (12): > > MdeModulePkg: Define the VariablePolicy protocol interface > > MdeModulePkg: Define the VariablePolicyLib > > MdeModulePkg: Define the VariablePolicyHelperLib > > MdeModulePkg: Define the VarCheckPolicyLib and SMM interface > > MdeModulePkg: Connect VariablePolicy business logic to > > VariableServices > > MdeModulePkg: Allow VariablePolicy state to delete protected variables > > SecurityPkg: Allow VariablePolicy state to delete authenticated > > variables > > MdeModulePkg: Change TCG MOR variables to use VariablePolicy > > MdeModulePkg: Drop VarLock from RuntimeDxe variable driver > > MdeModulePkg: Add a shell-based functional test for VariablePolicy > > OvmfPkg: Add VariablePolicy engine to OvmfPkg platform > > EmulatorPkg: Add VariablePolicy engine to EmulatorPkg platform > > > > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c | 318 +++ > > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c | 396 ++++ > > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c | 46 + > > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDxe.c | 85 + > > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c | 806 +++++++ > > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.c | 2285 ++++++++++++++++++++ > > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.c | 1942 +++++++++++++++++ > > MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c | 52 +- > > MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c | 60 +- > > MdeModulePkg/Universal/Variable/RuntimeDxe/VarCheck.c | 49 +- > > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c | 53 + > > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock.c | 71 + > > MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c | 653 ++++++ > > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c | 14 + > > SecurityPkg/Library/AuthVariableLib/AuthService.c | 22 +- > > EmulatorPkg/EmulatorPkg.dsc | 6 + > > MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h | 54 + > > MdeModulePkg/Include/Library/VariablePolicyHelperLib.h | 164 ++ > > MdeModulePkg/Include/Library/VariablePolicyLib.h | 207 ++ > > MdeModulePkg/Include/Protocol/VariablePolicy.h | 157 ++ > > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf | 44 + > > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni | 12 + > > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf | 36 + > > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.uni | 12 + > > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf | 44 + > > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni | 12 + > > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf | 52 + > > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.inf | 41 + > > MdeModulePkg/MdeModulePkg.ci.yaml | 4 +- > > MdeModulePkg/MdeModulePkg.dec | 26 +- > > MdeModulePkg/MdeModulePkg.dsc | 15 + > > MdeModulePkg/Test/MdeModulePkgHostTest.dsc | 11 + > > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md | 55 + > > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.inf | 42 + > > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf | 5 + > > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf | 4 + > > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf | 12 + > > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf | 4 + > > OvmfPkg/OvmfPkgIa32.dsc | 8 + > > OvmfPkg/OvmfPkgIa32X64.dsc | 8 + > > OvmfPkg/OvmfPkgX64.dsc | 8 + > > SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf | 2 + > > 42 files changed, 7819 insertions(+), 78 deletions(-) > > create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c > > create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c > > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c > > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDxe.c > > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c > > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.c > > create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.c > > create mode 100644 MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock.c > > create mode 100644 MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c > > create mode 100644 MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h > > create mode 100644 MdeModulePkg/Include/Library/VariablePolicyHelperLib.h > > create mode 100644 MdeModulePkg/Include/Library/VariablePolicyLib.h > > create mode 100644 MdeModulePkg/Include/Protocol/VariablePolicy.h > > create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf > > create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni > > create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf > > create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.uni > > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf > > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni > > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf > > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.inf > > create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md > > create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.inf > > -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#59280): https://edk2.groups.io/g/devel/message/59280 Mute This Topic: https://groups.io/mt/74153769/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=-=-=-=-=-=-=-=-=-=-=-
"Not sure about the UefiPayloadPkg platforms; please ask their maintainers." UefiPayloadPkg maintainers: what say you? ? - Bret ________________________________ From: devel@edk2.groups.io <devel@edk2.groups.io> on behalf of Laszlo Ersek via groups.io <lersek=redhat.com@groups.io> Sent: Tuesday, May 12, 2020 4:52:52 AM To: devel@edk2.groups.io <devel@edk2.groups.io>; michael.kubacki@outlook.com <michael.kubacki@outlook.com> Cc: Yao, Jiewen <jiewen.yao@intel.com>; Chao Zhang <chao.b.zhang@intel.com>; Jian J Wang <jian.j.wang@intel.com>; Hao A Wu <hao.a.wu@intel.com>; liming.gao <liming.gao@intel.com>; Jordan Justen <jordan.l.justen@intel.com>; Ard Biesheuvel <ard.biesheuvel@arm.com>; Andrew Fish <afish@apple.com>; Ni, Ray <ray.ni@intel.com>; Anthony Perard <anthony.perard@citrix.com>; Julien Grall <julien@xen.org>; Maurice Ma <maurice.ma@intel.com>; Guo Dong <guo.dong@intel.com>; Benjamin You <benjamin.you@intel.com> Subject: [EXTERNAL] Re: [edk2-devel] [PATCH v2 00/12] Add the VariablePolicy feature On 05/12/20 08:46, Michael Kubacki wrote: > From: Michael Kubacki <michael.kubacki@microsoft.com> > > REF:https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzilla.tianocore.org%2Fshow_bug.cgi%3Fid%3D2522&data=02%7C01%7Cbret.barkelew%40microsoft.com%7C98d423482cea4e143c4308d7f66b0927%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637248811886928541&sdata=GlpxfE6%2FzZR01KXRvOoaXQTQEG%2F3TNuaZxJ6C1fl6LI%3D&reserved=0 > > The 12 patches in this series add the VariablePolicy feature to the core, > deprecate Edk2VarLock (while adding a compatibility layer to reduce code > churn), and integrate the VariablePolicy libraries and protocols into > Variable Services. > > Since the integration requires multiple changes, including adding libraries, > a protocol, an SMI communication handler, and VariableServices integration, > the patches are broken up by individual library additions and then a final > integration. Security-sensitive changes like bypassing Authenticated > Variable enforcement are also broken out into individual patches so that > attention can be called directly to them. > > Platform porting instructions are described in this wiki entry: > https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Ftianocore%2Ftianocore.github.io%2Fwiki%2FVariablePolicy-Protocol---Enhanced-Method-for-Managing-Variables%23platform-porting&data=02%7C01%7Cbret.barkelew%40microsoft.com%7C98d423482cea4e143c4308d7f66b0927%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637248811886928541&sdata=o%2FraXnHgx4RMreIkSFSONm8He0CzM7ZTXoV8loOrxe0%3D&reserved=0 (1) This wiki article is helpful, thanks. I have one remark: there's a heading saying "VarCheckPolicyLib NULL Instance": https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Ftianocore%2Ftianocore.github.io%2Fwiki%2FVariablePolicy-Protocol---Enhanced-Method-for-Managing-Variables%23varcheckpolicylib-null-instance&data=02%7C01%7Cbret.barkelew%40microsoft.com%7C98d423482cea4e143c4308d7f66b0927%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637248811886928541&sdata=4qTYEB6%2F3uJnLZ9MjRHODQGaaPq6zZEp7bFlCXEP7gI%3D&reserved=0 I think what's meant is "NULL class", not "NULL instance". (2) The following platform DSC files in edk2 include the non-SMM variable driver ("MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf"), but they are not modified by this patch series: ArmVirtPkg/ArmVirtQemu.dsc ArmVirtPkg/ArmVirtQemuKernel.dsc ArmVirtPkg/ArmVirtXen.dsc OvmfPkg/OvmfXen.dsc UefiPayloadPkg/UefiPayloadPkgIa32.dsc UefiPayloadPkg/UefiPayloadPkgIa32X64.dsc I'm asking that you please (a) include a patch for ArmVirtPkg, (b) update the OvmfPkg patch to cover "OvmfXen.dsc" too. Not sure about the UefiPayloadPkg platforms; please ask their maintainers. (I've CC'd the OvmfXen and UefiPayloadPkg maintainers/reviewers.) Thanks, Laszlo > > Discussion of the feature can be found in multiple places throughout > the last year on the RFC channel, staging branches, and in devel. > > Most recently, this subject was discussed in this thread: > https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fedk2.groups.io%2Fg%2Fdevel%2Fmessage%2F53712&data=02%7C01%7Cbret.barkelew%40microsoft.com%7C98d423482cea4e143c4308d7f66b0927%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637248811886938531&sdata=%2FFmQMtE%2Ffrl6UxNdY94mvckwrXVUJySJ%2BWFSSQp8nCk%3D&reserved=0 > (the code branches shared in that discussion are now out of date, but the > whitepapers and discussion are relevant). > > Cc: Jiewen Yao <jiewen.yao@intel.com> > Cc: Chao Zhang <chao.b.zhang@intel.com> > Cc: Jian J Wang <jian.j.wang@intel.com> > Cc: Hao A Wu <hao.a.wu@intel.com> > Cc: Liming Gao <liming.gao@intel.com> > Cc: Jordan Justen <jordan.l.justen@intel.com> > Cc: Laszlo Ersek <lersek@redhat.com> > Cc: Ard Biesheuvel <ard.biesheuvel@arm.com> > Cc: Andrew Fish <afish@apple.com> > Cc: Ray Ni <ray.ni@intel.com> > Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com> > > Changes since v1: > * Fixed implementation for RuntimeDxe > * Add PCD to block DisableVariablePolicy > * Fix the DumpVariablePolicy pagination in SMM > > Bret Barkelew (12): > MdeModulePkg: Define the VariablePolicy protocol interface > MdeModulePkg: Define the VariablePolicyLib > MdeModulePkg: Define the VariablePolicyHelperLib > MdeModulePkg: Define the VarCheckPolicyLib and SMM interface > MdeModulePkg: Connect VariablePolicy business logic to > VariableServices > MdeModulePkg: Allow VariablePolicy state to delete protected variables > SecurityPkg: Allow VariablePolicy state to delete authenticated > variables > MdeModulePkg: Change TCG MOR variables to use VariablePolicy > MdeModulePkg: Drop VarLock from RuntimeDxe variable driver > MdeModulePkg: Add a shell-based functional test for VariablePolicy > OvmfPkg: Add VariablePolicy engine to OvmfPkg platform > EmulatorPkg: Add VariablePolicy engine to EmulatorPkg platform > > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c | 318 +++ > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c | 396 ++++ > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c | 46 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDxe.c | 85 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c | 806 +++++++ > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.c | 2285 ++++++++++++++++++++ > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.c | 1942 +++++++++++++++++ > MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c | 52 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c | 60 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/VarCheck.c | 49 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c | 53 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock.c | 71 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c | 653 ++++++ > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c | 14 + > SecurityPkg/Library/AuthVariableLib/AuthService.c | 22 +- > EmulatorPkg/EmulatorPkg.dsc | 6 + > MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h | 54 + > MdeModulePkg/Include/Library/VariablePolicyHelperLib.h | 164 ++ > MdeModulePkg/Include/Library/VariablePolicyLib.h | 207 ++ > MdeModulePkg/Include/Protocol/VariablePolicy.h | 157 ++ > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf | 44 + > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni | 12 + > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf | 36 + > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.uni | 12 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf | 44 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni | 12 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf | 52 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.inf | 41 + > MdeModulePkg/MdeModulePkg.ci.yaml | 4 +- > MdeModulePkg/MdeModulePkg.dec | 26 +- > MdeModulePkg/MdeModulePkg.dsc | 15 + > MdeModulePkg/Test/MdeModulePkgHostTest.dsc | 11 + > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md | 55 + > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.inf | 42 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf | 5 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf | 4 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf | 12 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf | 4 + > OvmfPkg/OvmfPkgIa32.dsc | 8 + > OvmfPkg/OvmfPkgIa32X64.dsc | 8 + > OvmfPkg/OvmfPkgX64.dsc | 8 + > SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf | 2 + > 42 files changed, 7819 insertions(+), 78 deletions(-) > create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c > create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDxe.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.c > create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.c > create mode 100644 MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock.c > create mode 100644 MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c > create mode 100644 MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h > create mode 100644 MdeModulePkg/Include/Library/VariablePolicyHelperLib.h > create mode 100644 MdeModulePkg/Include/Library/VariablePolicyLib.h > create mode 100644 MdeModulePkg/Include/Protocol/VariablePolicy.h > create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf > create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni > create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf > create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.uni > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.inf > create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md > create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.inf > -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#59400): https://edk2.groups.io/g/devel/message/59400 Mute This Topic: https://groups.io/mt/74175627/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=-=-=-=-=-=-=-=-=-=-=-
Hi, Bret For UefiPayloadPkg, could you please provide a patch for it ? Thanks Maurice From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Bret Barkelew via groups.io Sent: Tuesday, May 12, 2020 22:19 To: devel@edk2.groups.io; lersek@redhat.com; michael.kubacki@outlook.com Cc: Yao, Jiewen <jiewen.yao@intel.com>; Zhang, Chao B <chao.b.zhang@intel.com>; Wang, Jian J <jian.j.wang@intel.com>; Wu, Hao A <hao.a.wu@intel.com>; Gao, Liming <liming.gao@intel.com>; Justen, Jordan L <jordan.l.justen@intel.com>; Ard Biesheuvel <ard.biesheuvel@arm.com>; Andrew Fish <afish@apple.com>; Ni, Ray <ray.ni@intel.com>; Anthony Perard <anthony.perard@citrix.com>; Julien Grall <julien@xen.org>; Ma, Maurice <maurice.ma@intel.com>; Dong, Guo <guo.dong@intel.com>; You, Benjamin <benjamin.you@intel.com> Subject: Re: [EXTERNAL] Re: [edk2-devel] [PATCH v2 00/12] Add the VariablePolicy feature “Not sure about the UefiPayloadPkg platforms; please ask their maintainers.” UefiPayloadPkg maintainers: what say you? 😉 - Bret ________________________________ From: devel@edk2.groups.io<mailto:devel@edk2.groups.io> <devel@edk2.groups.io<mailto:devel@edk2.groups.io>> on behalf of Laszlo Ersek via groups.io <lersek=redhat.com@groups.io<mailto:lersek=redhat.com@groups.io>> Sent: Tuesday, May 12, 2020 4:52:52 AM To: devel@edk2.groups.io<mailto:devel@edk2.groups.io> <devel@edk2.groups.io<mailto:devel@edk2.groups.io>>; michael.kubacki@outlook.com<mailto:michael.kubacki@outlook.com> <michael.kubacki@outlook.com<mailto:michael.kubacki@outlook.com>> Cc: Yao, Jiewen <jiewen.yao@intel.com<mailto:jiewen.yao@intel.com>>; Chao Zhang <chao.b.zhang@intel.com<mailto:chao.b.zhang@intel.com>>; Jian J Wang <jian.j.wang@intel.com<mailto:jian.j.wang@intel.com>>; Hao A Wu <hao.a.wu@intel.com<mailto:hao.a.wu@intel.com>>; liming.gao <liming.gao@intel.com<mailto:liming.gao@intel.com>>; Jordan Justen <jordan.l.justen@intel.com<mailto:jordan.l.justen@intel.com>>; Ard Biesheuvel <ard.biesheuvel@arm.com<mailto:ard.biesheuvel@arm.com>>; Andrew Fish <afish@apple.com<mailto:afish@apple.com>>; Ni, Ray <ray.ni@intel.com<mailto:ray.ni@intel.com>>; Anthony Perard <anthony.perard@citrix.com<mailto:anthony.perard@citrix.com>>; Julien Grall <julien@xen.org<mailto:julien@xen.org>>; Maurice Ma <maurice.ma@intel.com<mailto:maurice.ma@intel.com>>; Guo Dong <guo.dong@intel.com<mailto:guo.dong@intel.com>>; Benjamin You <benjamin.you@intel.com<mailto:benjamin.you@intel.com>> Subject: [EXTERNAL] Re: [edk2-devel] [PATCH v2 00/12] Add the VariablePolicy feature On 05/12/20 08:46, Michael Kubacki wrote: > From: Michael Kubacki <michael.kubacki@microsoft.com<mailto:michael.kubacki@microsoft.com>> > > REF:https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzilla.tianocore.org%2Fshow_bug.cgi%3Fid%3D2522&data=02%7C01%7Cbret.barkelew%40microsoft.com%7C98d423482cea4e143c4308d7f66b0927%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637248811886928541&sdata=GlpxfE6%2FzZR01KXRvOoaXQTQEG%2F3TNuaZxJ6C1fl6LI%3D&reserved=0 > > The 12 patches in this series add the VariablePolicy feature to the core, > deprecate Edk2VarLock (while adding a compatibility layer to reduce code > churn), and integrate the VariablePolicy libraries and protocols into > Variable Services. > > Since the integration requires multiple changes, including adding libraries, > a protocol, an SMI communication handler, and VariableServices integration, > the patches are broken up by individual library additions and then a final > integration. Security-sensitive changes like bypassing Authenticated > Variable enforcement are also broken out into individual patches so that > attention can be called directly to them. > > Platform porting instructions are described in this wiki entry: > https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Ftianocore%2Ftianocore.github.io%2Fwiki%2FVariablePolicy-Protocol---Enhanced-Method-for-Managing-Variables%23platform-porting&data=02%7C01%7Cbret.barkelew%40microsoft.com%7C98d423482cea4e143c4308d7f66b0927%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637248811886928541&sdata=o%2FraXnHgx4RMreIkSFSONm8He0CzM7ZTXoV8loOrxe0%3D&reserved=0 (1) This wiki article is helpful, thanks. I have one remark: there's a heading saying "VarCheckPolicyLib NULL Instance": https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Ftianocore%2Ftianocore.github.io%2Fwiki%2FVariablePolicy-Protocol---Enhanced-Method-for-Managing-Variables%23varcheckpolicylib-null-instance&data=02%7C01%7Cbret.barkelew%40microsoft.com%7C98d423482cea4e143c4308d7f66b0927%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637248811886928541&sdata=4qTYEB6%2F3uJnLZ9MjRHODQGaaPq6zZEp7bFlCXEP7gI%3D&reserved=0 I think what's meant is "NULL class", not "NULL instance". (2) The following platform DSC files in edk2 include the non-SMM variable driver ("MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf"), but they are not modified by this patch series: ArmVirtPkg/ArmVirtQemu.dsc ArmVirtPkg/ArmVirtQemuKernel.dsc ArmVirtPkg/ArmVirtXen.dsc OvmfPkg/OvmfXen.dsc UefiPayloadPkg/UefiPayloadPkgIa32.dsc UefiPayloadPkg/UefiPayloadPkgIa32X64.dsc I'm asking that you please (a) include a patch for ArmVirtPkg, (b) update the OvmfPkg patch to cover "OvmfXen.dsc" too. Not sure about the UefiPayloadPkg platforms; please ask their maintainers. (I've CC'd the OvmfXen and UefiPayloadPkg maintainers/reviewers.) Thanks, Laszlo > > Discussion of the feature can be found in multiple places throughout > the last year on the RFC channel, staging branches, and in devel. > > Most recently, this subject was discussed in this thread: > https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fedk2.groups.io%2Fg%2Fdevel%2Fmessage%2F53712&data=02%7C01%7Cbret.barkelew%40microsoft.com%7C98d423482cea4e143c4308d7f66b0927%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637248811886938531&sdata=%2FFmQMtE%2Ffrl6UxNdY94mvckwrXVUJySJ%2BWFSSQp8nCk%3D&reserved=0 > (the code branches shared in that discussion are now out of date, but the > whitepapers and discussion are relevant). > > Cc: Jiewen Yao <jiewen.yao@intel.com<mailto:jiewen.yao@intel.com>> > Cc: Chao Zhang <chao.b.zhang@intel.com<mailto:chao.b.zhang@intel.com>> > Cc: Jian J Wang <jian.j.wang@intel.com<mailto:jian.j.wang@intel.com>> > Cc: Hao A Wu <hao.a.wu@intel.com<mailto:hao.a.wu@intel.com>> > Cc: Liming Gao <liming.gao@intel.com<mailto:liming.gao@intel.com>> > Cc: Jordan Justen <jordan.l.justen@intel.com<mailto:jordan.l.justen@intel.com>> > Cc: Laszlo Ersek <lersek@redhat.com<mailto:lersek@redhat.com>> > Cc: Ard Biesheuvel <ard.biesheuvel@arm.com<mailto:ard.biesheuvel@arm.com>> > Cc: Andrew Fish <afish@apple.com<mailto:afish@apple.com>> > Cc: Ray Ni <ray.ni@intel.com<mailto:ray.ni@intel.com>> > Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com<mailto:michael.kubacki@microsoft.com>> > > Changes since v1: > * Fixed implementation for RuntimeDxe > * Add PCD to block DisableVariablePolicy > * Fix the DumpVariablePolicy pagination in SMM > > Bret Barkelew (12): > MdeModulePkg: Define the VariablePolicy protocol interface > MdeModulePkg: Define the VariablePolicyLib > MdeModulePkg: Define the VariablePolicyHelperLib > MdeModulePkg: Define the VarCheckPolicyLib and SMM interface > MdeModulePkg: Connect VariablePolicy business logic to > VariableServices > MdeModulePkg: Allow VariablePolicy state to delete protected variables > SecurityPkg: Allow VariablePolicy state to delete authenticated > variables > MdeModulePkg: Change TCG MOR variables to use VariablePolicy > MdeModulePkg: Drop VarLock from RuntimeDxe variable driver > MdeModulePkg: Add a shell-based functional test for VariablePolicy > OvmfPkg: Add VariablePolicy engine to OvmfPkg platform > EmulatorPkg: Add VariablePolicy engine to EmulatorPkg platform > > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c | 318 +++ > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c | 396 ++++ > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c | 46 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDxe.c | 85 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c | 806 +++++++ > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.c | 2285 ++++++++++++++++++++ > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.c | 1942 +++++++++++++++++ > MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c | 52 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c | 60 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/VarCheck.c | 49 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c | 53 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock.c | 71 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c | 653 ++++++ > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c | 14 + > SecurityPkg/Library/AuthVariableLib/AuthService.c | 22 +- > EmulatorPkg/EmulatorPkg.dsc | 6 + > MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h | 54 + > MdeModulePkg/Include/Library/VariablePolicyHelperLib.h | 164 ++ > MdeModulePkg/Include/Library/VariablePolicyLib.h | 207 ++ > MdeModulePkg/Include/Protocol/VariablePolicy.h | 157 ++ > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf | 44 + > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni | 12 + > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf | 36 + > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.uni | 12 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf | 44 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni | 12 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf | 52 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.inf | 41 + > MdeModulePkg/MdeModulePkg.ci.yaml | 4 +- > MdeModulePkg/MdeModulePkg.dec | 26 +- > MdeModulePkg/MdeModulePkg.dsc | 15 + > MdeModulePkg/Test/MdeModulePkgHostTest.dsc | 11 + > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md | 55 + > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.inf | 42 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf | 5 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf | 4 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf | 12 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf | 4 + > OvmfPkg/OvmfPkgIa32.dsc | 8 + > OvmfPkg/OvmfPkgIa32X64.dsc | 8 + > OvmfPkg/OvmfPkgX64.dsc | 8 + > SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf | 2 + > 42 files changed, 7819 insertions(+), 78 deletions(-) > create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c > create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDxe.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.c > create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.c > create mode 100644 MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock.c > create mode 100644 MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c > create mode 100644 MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h > create mode 100644 MdeModulePkg/Include/Library/VariablePolicyHelperLib.h > create mode 100644 MdeModulePkg/Include/Library/VariablePolicyLib.h > create mode 100644 MdeModulePkg/Include/Protocol/VariablePolicy.h > create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf > create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni > create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf > create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.uni > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.inf > create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md > create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.inf > -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#59439): https://edk2.groups.io/g/devel/message/59439 Mute This Topic: https://groups.io/mt/74175627/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=-=-=-=-=-=-=-=-=-=-=-
Sure. Thanks. - Bret ________________________________ From: Ma, Maurice <maurice.ma@intel.com> Sent: Wednesday, May 13, 2020 8:18:08 AM To: devel@edk2.groups.io <devel@edk2.groups.io>; Bret Barkelew <Bret.Barkelew@microsoft.com> Cc: Dong, Guo <guo.dong@intel.com>; You, Benjamin <benjamin.you@intel.com> Subject: RE: [EXTERNAL] Re: [edk2-devel] [PATCH v2 00/12] Add the VariablePolicy feature Hi, Bret For UefiPayloadPkg, could you please provide a patch for it ? Thanks Maurice From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Bret Barkelew via groups.io Sent: Tuesday, May 12, 2020 22:19 To: devel@edk2.groups.io; lersek@redhat.com; michael.kubacki@outlook.com Cc: Yao, Jiewen <jiewen.yao@intel.com>; Zhang, Chao B <chao.b.zhang@intel.com>; Wang, Jian J <jian.j.wang@intel.com>; Wu, Hao A <hao.a.wu@intel.com>; Gao, Liming <liming.gao@intel.com>; Justen, Jordan L <jordan.l.justen@intel.com>; Ard Biesheuvel <ard.biesheuvel@arm.com>; Andrew Fish <afish@apple.com>; Ni, Ray <ray.ni@intel.com>; Anthony Perard <anthony.perard@citrix.com>; Julien Grall <julien@xen.org>; Ma, Maurice <maurice.ma@intel.com>; Dong, Guo <guo.dong@intel.com>; You, Benjamin <benjamin.you@intel.com> Subject: Re: [EXTERNAL] Re: [edk2-devel] [PATCH v2 00/12] Add the VariablePolicy feature “Not sure about the UefiPayloadPkg platforms; please ask their maintainers.” UefiPayloadPkg maintainers: what say you? ?? - Bret ________________________________ From: devel@edk2.groups.io<mailto:devel@edk2.groups.io> <devel@edk2.groups.io<mailto:devel@edk2.groups.io>> on behalf of Laszlo Ersek via groups.io <lersek=redhat.com@groups.io<mailto:lersek=redhat.com@groups.io>> Sent: Tuesday, May 12, 2020 4:52:52 AM To: devel@edk2.groups.io<mailto:devel@edk2.groups.io> <devel@edk2.groups.io<mailto:devel@edk2.groups.io>>; michael.kubacki@outlook.com<mailto:michael.kubacki@outlook.com> <michael.kubacki@outlook.com<mailto:michael.kubacki@outlook.com>> Cc: Yao, Jiewen <jiewen.yao@intel.com<mailto:jiewen.yao@intel.com>>; Chao Zhang <chao.b.zhang@intel.com<mailto:chao.b.zhang@intel.com>>; Jian J Wang <jian.j.wang@intel.com<mailto:jian.j.wang@intel.com>>; Hao A Wu <hao.a.wu@intel.com<mailto:hao.a.wu@intel.com>>; liming.gao <liming.gao@intel.com<mailto:liming.gao@intel.com>>; Jordan Justen <jordan.l.justen@intel.com<mailto:jordan.l.justen@intel.com>>; Ard Biesheuvel <ard.biesheuvel@arm.com<mailto:ard.biesheuvel@arm.com>>; Andrew Fish <afish@apple.com<mailto:afish@apple.com>>; Ni, Ray <ray.ni@intel.com<mailto:ray.ni@intel.com>>; Anthony Perard <anthony.perard@citrix.com<mailto:anthony.perard@citrix.com>>; Julien Grall <julien@xen.org<mailto:julien@xen.org>>; Maurice Ma <maurice.ma@intel.com<mailto:maurice.ma@intel.com>>; Guo Dong <guo.dong@intel.com<mailto:guo.dong@intel.com>>; Benjamin You <benjamin.you@intel.com<mailto:benjamin.you@intel.com>> Subject: [EXTERNAL] Re: [edk2-devel] [PATCH v2 00/12] Add the VariablePolicy feature On 05/12/20 08:46, Michael Kubacki wrote: > From: Michael Kubacki <michael.kubacki@microsoft.com<mailto:michael.kubacki@microsoft.com>> > > REF:https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzilla.tianocore.org%2Fshow_bug.cgi%3Fid%3D2522&data=02%7C01%7Cbret.barkelew%40microsoft.com%7C98d423482cea4e143c4308d7f66b0927%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637248811886928541&sdata=GlpxfE6%2FzZR01KXRvOoaXQTQEG%2F3TNuaZxJ6C1fl6LI%3D&reserved=0 > > The 12 patches in this series add the VariablePolicy feature to the core, > deprecate Edk2VarLock (while adding a compatibility layer to reduce code > churn), and integrate the VariablePolicy libraries and protocols into > Variable Services. > > Since the integration requires multiple changes, including adding libraries, > a protocol, an SMI communication handler, and VariableServices integration, > the patches are broken up by individual library additions and then a final > integration. Security-sensitive changes like bypassing Authenticated > Variable enforcement are also broken out into individual patches so that > attention can be called directly to them. > > Platform porting instructions are described in this wiki entry: > https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Ftianocore%2Ftianocore.github.io%2Fwiki%2FVariablePolicy-Protocol---Enhanced-Method-for-Managing-Variables%23platform-porting&data=02%7C01%7Cbret.barkelew%40microsoft.com%7C98d423482cea4e143c4308d7f66b0927%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637248811886928541&sdata=o%2FraXnHgx4RMreIkSFSONm8He0CzM7ZTXoV8loOrxe0%3D&reserved=0<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Ftianocore%2Ftianocore.github.io%2Fwiki%2FVariablePolicy-Protocol---Enhanced-Method-for-Managing-Variables%23platform-porting&data=02%7C01%7Cbret.barkelew%40microsoft.com%7Ca163d58b5f994a077c6708d7f750ebc2%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637249799249542967&sdata=C0rFRlAdXA9V1C2ItbnXUqP4T4%2BDA1z2EHS%2BFXmDot0%3D&reserved=0> (1) This wiki article is helpful, thanks. I have one remark: there's a heading saying "VarCheckPolicyLib NULL Instance": https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Ftianocore%2Ftianocore.github.io%2Fwiki%2FVariablePolicy-Protocol---Enhanced-Method-for-Managing-Variables%23varcheckpolicylib-null-instance&data=02%7C01%7Cbret.barkelew%40microsoft.com%7C98d423482cea4e143c4308d7f66b0927%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637248811886928541&sdata=4qTYEB6%2F3uJnLZ9MjRHODQGaaPq6zZEp7bFlCXEP7gI%3D&reserved=0<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Ftianocore%2Ftianocore.github.io%2Fwiki%2FVariablePolicy-Protocol---Enhanced-Method-for-Managing-Variables%23varcheckpolicylib-null-instance&data=02%7C01%7Cbret.barkelew%40microsoft.com%7Ca163d58b5f994a077c6708d7f750ebc2%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637249799249552957&sdata=QmLmlnrWR4FBWrA7Kz%2BlQXph%2FvLpQxIPxi5uZPoES%2Bo%3D&reserved=0> I think what's meant is "NULL class", not "NULL instance". (2) The following platform DSC files in edk2 include the non-SMM variable driver ("MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf"), but they are not modified by this patch series: ArmVirtPkg/ArmVirtQemu.dsc ArmVirtPkg/ArmVirtQemuKernel.dsc ArmVirtPkg/ArmVirtXen.dsc OvmfPkg/OvmfXen.dsc UefiPayloadPkg/UefiPayloadPkgIa32.dsc UefiPayloadPkg/UefiPayloadPkgIa32X64.dsc I'm asking that you please (a) include a patch for ArmVirtPkg, (b) update the OvmfPkg patch to cover "OvmfXen.dsc" too. Not sure about the UefiPayloadPkg platforms; please ask their maintainers. (I've CC'd the OvmfXen and UefiPayloadPkg maintainers/reviewers.) Thanks, Laszlo > > Discussion of the feature can be found in multiple places throughout > the last year on the RFC channel, staging branches, and in devel. > > Most recently, this subject was discussed in this thread: > https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fedk2.groups.io%2Fg%2Fdevel%2Fmessage%2F53712&data=02%7C01%7Cbret.barkelew%40microsoft.com%7C98d423482cea4e143c4308d7f66b0927%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637248811886938531&sdata=%2FFmQMtE%2Ffrl6UxNdY94mvckwrXVUJySJ%2BWFSSQp8nCk%3D&reserved=0<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fedk2.groups.io%2Fg%2Fdevel%2Fmessage%2F53712&data=02%7C01%7Cbret.barkelew%40microsoft.com%7Ca163d58b5f994a077c6708d7f750ebc2%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637249799249552957&sdata=zivivsvT91knKsCrZRctVI%2BwlR%2FEaH6sTZkpSp1iM8E%3D&reserved=0> > (the code branches shared in that discussion are now out of date, but the > whitepapers and discussion are relevant). > > Cc: Jiewen Yao <jiewen.yao@intel.com<mailto:jiewen.yao@intel.com>> > Cc: Chao Zhang <chao.b.zhang@intel.com<mailto:chao.b.zhang@intel.com>> > Cc: Jian J Wang <jian.j.wang@intel.com<mailto:jian.j.wang@intel.com>> > Cc: Hao A Wu <hao.a.wu@intel.com<mailto:hao.a.wu@intel.com>> > Cc: Liming Gao <liming.gao@intel.com<mailto:liming.gao@intel.com>> > Cc: Jordan Justen <jordan.l.justen@intel.com<mailto:jordan.l.justen@intel.com>> > Cc: Laszlo Ersek <lersek@redhat.com<mailto:lersek@redhat.com>> > Cc: Ard Biesheuvel <ard.biesheuvel@arm.com<mailto:ard.biesheuvel@arm.com>> > Cc: Andrew Fish <afish@apple.com<mailto:afish@apple.com>> > Cc: Ray Ni <ray.ni@intel.com<mailto:ray.ni@intel.com>> > Signed-off-by: Michael Kubacki <michael.kubacki@microsoft.com<mailto:michael.kubacki@microsoft.com>> > > Changes since v1: > * Fixed implementation for RuntimeDxe > * Add PCD to block DisableVariablePolicy > * Fix the DumpVariablePolicy pagination in SMM > > Bret Barkelew (12): > MdeModulePkg: Define the VariablePolicy protocol interface > MdeModulePkg: Define the VariablePolicyLib > MdeModulePkg: Define the VariablePolicyHelperLib > MdeModulePkg: Define the VarCheckPolicyLib and SMM interface > MdeModulePkg: Connect VariablePolicy business logic to > VariableServices > MdeModulePkg: Allow VariablePolicy state to delete protected variables > SecurityPkg: Allow VariablePolicy state to delete authenticated > variables > MdeModulePkg: Change TCG MOR variables to use VariablePolicy > MdeModulePkg: Drop VarLock from RuntimeDxe variable driver > MdeModulePkg: Add a shell-based functional test for VariablePolicy > OvmfPkg: Add VariablePolicy engine to OvmfPkg platform > EmulatorPkg: Add VariablePolicy engine to EmulatorPkg platform > > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c | 318 +++ > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c | 396 ++++ > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c | 46 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDxe.c | 85 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c | 806 +++++++ > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.c | 2285 ++++++++++++++++++++ > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.c | 1942 +++++++++++++++++ > MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c | 52 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c | 60 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/VarCheck.c | 49 +- > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c | 53 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock.c | 71 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c | 653 ++++++ > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c | 14 + > SecurityPkg/Library/AuthVariableLib/AuthService.c | 22 +- > EmulatorPkg/EmulatorPkg.dsc | 6 + > MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h | 54 + > MdeModulePkg/Include/Library/VariablePolicyHelperLib.h | 164 ++ > MdeModulePkg/Include/Library/VariablePolicyLib.h | 207 ++ > MdeModulePkg/Include/Protocol/VariablePolicy.h | 157 ++ > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf | 44 + > MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni | 12 + > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf | 36 + > MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.uni | 12 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf | 44 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni | 12 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf | 52 + > MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.inf | 41 + > MdeModulePkg/MdeModulePkg.ci.yaml | 4 +- > MdeModulePkg/MdeModulePkg.dec | 26 +- > MdeModulePkg/MdeModulePkg.dsc | 15 + > MdeModulePkg/Test/MdeModulePkgHostTest.dsc | 11 + > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md | 55 + > MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.inf | 42 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf | 5 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf | 4 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf | 12 + > MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf | 4 + > OvmfPkg/OvmfPkgIa32.dsc | 8 + > OvmfPkg/OvmfPkgIa32X64.dsc | 8 + > OvmfPkg/OvmfPkgX64.dsc | 8 + > SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf | 2 + > 42 files changed, 7819 insertions(+), 78 deletions(-) > create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c > create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDxe.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.c > create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.c > create mode 100644 MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock.c > create mode 100644 MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c > create mode 100644 MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h > create mode 100644 MdeModulePkg/Include/Library/VariablePolicyHelperLib.h > create mode 100644 MdeModulePkg/Include/Library/VariablePolicyLib.h > create mode 100644 MdeModulePkg/Include/Protocol/VariablePolicy.h > create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf > create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni > create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf > create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.uni > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf > create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.inf > create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md > create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.inf > -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#59440): https://edk2.groups.io/g/devel/message/59440 Mute This Topic: https://groups.io/mt/74175627/1787277 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org] -=-=-=-=-=-=-=-=-=-=-=-
© 2016 - 2024 Red Hat, Inc.