<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Hi Bret,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I plan to review it and give feedback before 7/31.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks and Sorry for inconveniences.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Best Regards.<o:p></o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> devel@edk2.groups.io <devel@edk2.groups.io> <b>
On Behalf Of </b>Bret Barkelew via groups.io<br>
<b>Sent:</b> Tuesday, June 9, 2020 1:52 PM<br>
<b>To:</b> devel@edk2.groups.io; bret@corthon.com<br>
<b>Cc:</b> Yao, Jiewen <jiewen.yao@intel.com>; Zhang, Chao B <chao.b.zhang@intel.com>; Wang, Jian J <jian.j.wang@intel.com>; Wu, Hao A <hao.a.wu@intel.com>; Gao, Liming <liming.gao@intel.com>; Justen, Jordan L <jordan.l.justen@intel.com>; Laszlo Ersek <lersek@redhat.com>;
Ard Biesheuvel <ard.biesheuvel@arm.com>; Andrew Fish <afish@apple.com>; Ni, Ray <ray.ni@intel.com><br>
<b>Subject:</b> Re: [EXTERNAL] [edk2-devel] [PATCH v5 00/14] Add the VariablePolicy feature<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Bump.<o:p></o:p></p>
<p class="MsoNormal">Now that the stable tag is behind us, I’d like to get this in to have maximum time before the next stable tag.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I think the only reviews I’ve seen so far are for the platform integrations (Arm, Ovmf, and Embedded). Need more eyeballs, please and thank you!<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">- Bret<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From: </b><a href="mailto:bret=corthon.com@groups.io">Bret Barkelew via groups.io</a><br>
<b>Sent: </b>Wednesday, June 3, 2020 2:52 AM<br>
<b>To: </b><a href="mailto:devel@edk2.groups.io">devel@edk2.groups.io</a><br>
<b>Cc: </b><a href="mailto:jiewen.yao@intel.com">Yao, Jiewen</a>; <a href="mailto:chao.b.zhang@intel.com">
Chao Zhang</a>; <a href="mailto:jian.j.wang@intel.com">Jian J Wang</a>; <a href="mailto:hao.a.wu@intel.com">
Hao A Wu</a>; <a href="mailto:liming.gao@intel.com">liming.gao</a>; <a href="mailto:jordan.l.justen@intel.com">
Jordan Justen</a>; <a href="mailto:lersek@redhat.com">Laszlo Ersek</a>; <a href="mailto:ard.biesheuvel@arm.com">
Ard Biesheuvel</a>; <a href="mailto:afish@apple.com">Andrew Fish</a>; <a href="mailto:ray.ni@intel.com">
Ni, Ray</a><br>
<b>Subject: </b>[EXTERNAL] [edk2-devel] [PATCH v5 00/14] Add the VariablePolicy feature<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt">REF:https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbugzilla.tianocore.org%2Fshow_bug.cgi%3Fid%3D2522&data=02%7C01%7Cbret.barkelew%40microsoft.com%7C90bcb822fa054686203008d807a3e4ee%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637267747784879051&sdata=k9X9qPTDTQlno5%2Ff4koMn6bE9s6nTOIlJ886PQRw%2Bzc%3D&reserved=0<br>
<br>
The 14 patches in this series add the VariablePolicy feature to the core,<br>
deprecate Edk2VarLock (while adding a compatibility layer to reduce code<br>
churn), and integrate the VariablePolicy libraries and protocols into<br>
Variable Services.<br>
<br>
Since the integration requires multiple changes, including adding libraries,<br>
a protocol, an SMI communication handler, and VariableServices integration,<br>
the patches are broken up by individual library additions and then a final<br>
integration. Security-sensitive changes like bypassing Authenticated<br>
Variable enforcement are also broken out into individual patches so that<br>
attention can be called directly to them.<br>
<br>
Platform porting instructions are described in this wiki entry:<br>
<a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Ftianocore%2Ftianocore.github.io%2Fwiki%2FVariablePolicy-Protocol---Enhanced-Method-for-Managing-Variables%23platform-porting&data=02%7C01%7Cbret.barkelew%40microsoft.com%7C90bcb822fa054686203008d807a3e4ee%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637267747784879051&sdata=eIQjfZJQGTECXzETa1iZ3T9vOdNiNEjIzVrjhDR%2B2CE%3D&reserved=0">https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Ftianocore%2Ftianocore.github.io%2Fwiki%2FVariablePolicy-Protocol---Enhanced-Method-for-Managing-Variables%23platform-porting&data=02%7C01%7Cbret.barkelew%40microsoft.com%7C90bcb822fa054686203008d807a3e4ee%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637267747784879051&sdata=eIQjfZJQGTECXzETa1iZ3T9vOdNiNEjIzVrjhDR%2B2CE%3D&reserved=0</a><br>
<br>
Discussion of the feature can be found in multiple places throughout<br>
the last year on the RFC channel, staging branches, and in devel.<br>
<br>
Most recently, this subject was discussed in this thread:<br>
<a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fedk2.groups.io%2Fg%2Fdevel%2Fmessage%2F53712&data=02%7C01%7Cbret.barkelew%40microsoft.com%7C90bcb822fa054686203008d807a3e4ee%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637267747784879051&sdata=rhwUXzkU%2B71sFkomJvPzi4IN6hz2JKIbDBnNt0wCJS8%3D&reserved=0">https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fedk2.groups.io%2Fg%2Fdevel%2Fmessage%2F53712&data=02%7C01%7Cbret.barkelew%40microsoft.com%7C90bcb822fa054686203008d807a3e4ee%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637267747784879051&sdata=rhwUXzkU%2B71sFkomJvPzi4IN6hz2JKIbDBnNt0wCJS8%3D&reserved=0</a><br>
(the code branches shared in that discussion are now out of date, but the<br>
whitepapers and discussion are relevant).<br>
<br>
Cc: Jiewen Yao <<a href="mailto:jiewen.yao@intel.com">jiewen.yao@intel.com</a>><br>
Cc: Chao Zhang <<a href="mailto:chao.b.zhang@intel.com">chao.b.zhang@intel.com</a>><br>
Cc: Jian J Wang <<a href="mailto:jian.j.wang@intel.com">jian.j.wang@intel.com</a>><br>
Cc: Hao A Wu <<a href="mailto:hao.a.wu@intel.com">hao.a.wu@intel.com</a>><br>
Cc: Liming Gao <<a href="mailto:liming.gao@intel.com">liming.gao@intel.com</a>><br>
Cc: Jordan Justen <<a href="mailto:jordan.l.justen@intel.com">jordan.l.justen@intel.com</a>><br>
Cc: Laszlo Ersek <<a href="mailto:lersek@redhat.com">lersek@redhat.com</a>><br>
Cc: Ard Biesheuvel <<a href="mailto:ard.biesheuvel@arm.com">ard.biesheuvel@arm.com</a>><br>
Cc: Andrew Fish <<a href="mailto:afish@apple.com">afish@apple.com</a>><br>
Cc: Ray Ni <<a href="mailto:ray.ni@intel.com">ray.ni@intel.com</a>><br>
Cc: Bret Barkelew <<a href="mailto:brbarkel@microsoft.com">brbarkel@microsoft.com</a>><br>
Signed-off-by: Bret Barkelew <<a href="mailto:brbarkel@microsoft.com">brbarkel@microsoft.com</a>><br>
<br>
v5 changes:<br>
* Fix the CONST mismatch in VariablePolicy.h and VariablePolicySmmDxe.c<br>
* Fix EFIAPI mismatches in the functional unittest<br>
* Rebase on latest origin/master<br>
<br>
v4 changes:<br>
* Remove Optional PcdAllowVariablePolicyEnforcementDisable PCD from platforms<br>
* Rebase on master<br>
* Migrate to new MmCommunicate2 protocol<br>
* Fix an oversight in the default return value for InitMmCommonCommBuffer<br>
* Fix in VariablePolicyLib to allow ExtraInitRuntimeDxe to consume variables<br>
<br>
V3 changes:<br>
* Address all non-unittest issues with ECC<br>
* Make additional style changes<br>
* Include section name in hunk headers in "ini-style" files<br>
* Remove requirement for the EdkiiPiSmmCommunicationsRegionTable driver<br>
(now allocates its own buffer)<br>
* Change names from VARIABLE_POLICY_PROTOCOL and gVariablePolicyProtocolGuid<br>
to EDKII_VARIABLE_POLICY_PROTOCOL and gEdkiiVariablePolicyProtocolGuid<br>
* Fix GCC warning about initializing externs<br>
* Add UNI strings for new PCD<br>
* Add patches for ArmVirtPkg, OvmfXen, and UefiPayloadPkg<br>
* Reorder patches according to Liming's feedback about adding to platforms<br>
before changing variable driver<br>
<br>
V2 changes:<br>
* Fixed implementation for RuntimeDxe<br>
* Add PCD to block DisableVariablePolicy<br>
* Fix the DumpVariablePolicy pagination in SMM<br>
<br>
Bret Barkelew (14):<br>
MdeModulePkg: Define the VariablePolicy protocol interface<br>
MdeModulePkg: Define the VariablePolicyLib<br>
MdeModulePkg: Define the VariablePolicyHelperLib<br>
MdeModulePkg: Define the VarCheckPolicyLib and SMM interface<br>
OvmfPkg: Add VariablePolicy engine to OvmfPkg platform<br>
EmulatorPkg: Add VariablePolicy engine to EmulatorPkg platform<br>
ArmVirtPkg: Add VariablePolicy engine to ArmVirtPkg platform<br>
UefiPayloadPkg: Add VariablePolicy engine to UefiPayloadPkg platform<br>
MdeModulePkg: Connect VariablePolicy business logic to<br>
VariableServices<br>
MdeModulePkg: Allow VariablePolicy state to delete protected variables<br>
SecurityPkg: Allow VariablePolicy state to delete authenticated<br>
variables<br>
MdeModulePkg: Change TCG MOR variables to use VariablePolicy<br>
MdeModulePkg: Drop VarLock from RuntimeDxe variable driver<br>
MdeModulePkg: Add a shell-based functional test for VariablePolicy<br>
<br>
MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c | 320 +++<br>
MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c | 396 ++++<br>
MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c | 46 +<br>
MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDxe.c | 85 +<br>
MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c | 813 +++++++<br>
MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.c | 2436 ++++++++++++++++++++<br>
MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.c | 1978 ++++++++++++++++<br>
MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c | 52 +-<br>
MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c | 60 +-<br>
MdeModulePkg/Universal/Variable/RuntimeDxe/VarCheck.c | 49 +-<br>
MdeModulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c | 53 +<br>
MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock.c | 71 +<br>
MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c | 642 ++++++<br>
MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c | 14 +<br>
SecurityPkg/Library/AuthVariableLib/AuthService.c | 22 +-<br>
ArmVirtPkg/ArmVirt.dsc.inc | 4 +<br>
EmulatorPkg/EmulatorPkg.dsc | 3 +<br>
MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h | 54 +<br>
MdeModulePkg/Include/Library/VariablePolicyHelperLib.h | 164 ++<br>
MdeModulePkg/Include/Library/VariablePolicyLib.h | 207 ++<br>
MdeModulePkg/Include/Protocol/VariablePolicy.h | 157 ++<br>
MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf | 42 +<br>
MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni | 12 +<br>
MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf | 35 +<br>
MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.uni | 12 +<br>
MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf | 44 +<br>
MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni | 12 +<br>
MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf | 51 +<br>
MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.inf | 40 +<br>
MdeModulePkg/MdeModulePkg.ci.yaml | 4 +-<br>
MdeModulePkg/MdeModulePkg.dec | 26 +-<br>
MdeModulePkg/MdeModulePkg.dsc | 15 +<br>
MdeModulePkg/MdeModulePkg.uni | 7 +<br>
MdeModulePkg/Test/MdeModulePkgHostTest.dsc | 11 +<br>
MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md | 55 +<br>
MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.inf | 42 +<br>
MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf | 5 +<br>
MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmm.inf | 4 +<br>
MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.inf | 10 +<br>
MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf | 4 +<br>
OvmfPkg/OvmfPkgIa32.dsc | 5 +<br>
OvmfPkg/OvmfPkgIa32X64.dsc | 5 +<br>
OvmfPkg/OvmfPkgX64.dsc | 5 +<br>
OvmfPkg/OvmfXen.dsc | 4 +<br>
SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf | 2 +<br>
UefiPayloadPkg/UefiPayloadPkgIa32.dsc | 4 +<br>
UefiPayloadPkg/UefiPayloadPkgIa32X64.dsc | 4 +<br>
47 files changed, 8008 insertions(+), 78 deletions(-)<br>
create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c<br>
create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.c<br>
create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitNull.c<br>
create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyExtraInitRuntimeDxe.c<br>
create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c<br>
create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.c<br>
create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.c<br>
create mode 100644 MdeModulePkg/Universal/Variable/RuntimeDxe/VariableLockRequstToLock.c<br>
create mode 100644 MdeModulePkg/Universal/Variable/RuntimeDxe/VariablePolicySmmDxe.c<br>
create mode 100644 MdeModulePkg/Include/Guid/VarCheckPolicyMmi.h<br>
create mode 100644 MdeModulePkg/Include/Library/VariablePolicyHelperLib.h<br>
create mode 100644 MdeModulePkg/Include/Library/VariablePolicyLib.h<br>
create mode 100644 MdeModulePkg/Include/Protocol/VariablePolicy.h<br>
create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.inf<br>
create mode 100644 MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.uni<br>
create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.inf<br>
create mode 100644 MdeModulePkg/Library/VariablePolicyHelperLib/VariablePolicyHelperLib.uni<br>
create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf<br>
create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.uni<br>
create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf<br>
create mode 100644 MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.inf<br>
create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/Readme.md<br>
create mode 100644 MdeModulePkg/Test/ShellTest/VariablePolicyFuncTestApp/VariablePolicyFuncTestApp.inf<br>
<br>
-- <br>
2.26.2.windows.1.8.g01c50adf56.20200515075929<br>
<br>
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"></o:p></span></p>
</div>
</div>
</body>
</html>
<div width="1" style="color:white;clear:both">_._,_._,_</div>
<hr>
Groups.io Links:<p>
You receive all messages sent to this group.
<p>
<a target="_blank" href="https://edk2.groups.io/g/devel/message/61388">View/Reply Online (#61388)</a> |
|
<a target="_blank" href="https://groups.io/mt/74768732/1813853">Mute This Topic</a>
| <a href="https://edk2.groups.io/g/devel/post">New Topic</a><br>
<br>
<a href="https://edk2.groups.io/g/devel/editsub/1813853">Your Subscription</a> |
<a href="mailto:devel+owner@edk2.groups.io">Contact Group Owner</a> |
<a href="https://edk2.groups.io/g/devel/unsub">Unsubscribe</a>
[edk2-devel-archive@redhat.com]<br>
<div width="1" style="color:white;clear:both">_._,_._,_</div>