[202405][Rebase&&FF] Variable Policy Changes

[Flickdm]

Preface

[!NOTE] Depends on #961

Description

Cherry Picks:

1. 1a63f67 - Picked
2. aeb50c2 - Picked
3. 521a898 - Picked
4. 43530fa - Dropped
5. 5b46552 - Picked
6. 7a8dba5 - Picked
7. dac9330 - Picked
8. 0549e53 - Picked & splited
9. 28ec229 - picked
10. 68670a0 - picked
11. a8c4697 - picked
12. 28789f8 - picked
13. 1fc9ff0 - picked
14. 8c63697 - picked
15. 383ec13 - picked

This pull request primarily focuses on modifying the UEFI boot manager library and the variable policy library to improve variable policy enforcement and boot option handling. The most significant changes include the addition of new load option types, the implementation of variable policy locking, and the modification of several methods to ensure better policy enforcement and error handling.

Changes to UEFI Boot Manager Library:

1. MdeModulePkg/Include/Library/UefiBootManagerLib.h: Expanded the Create method to handle additional load option types like SysPrep#### and PlatformRecovery####. Also, added a lock now variable policy for the PlatformRecovery#### variable if the SetVariable call was successful. [1] [2]
2. MdeModulePkg/Library/UefiBootManagerLib/BmBoot.c: Added a constructor for UefiBootManagerLib that locates the VariablePolicy protocol and registers a basic variable policy.
3. MdeModulePkg/Library/UefiBootManagerLib/BmLoadOption.c: Modified the BmGetFreeOptionNumber method to register a lock now variable policy for the PlatformRecovery#### variable if the SetVariable call was successful. Also, moved RegisterBasicVariablePolicy after SetVariable for OptionName.
4. MdeModulePkg/Library/UefiBootManagerLib/InternalBm.h: Included Protocol/VariablePolicy.h and Library/VariablePolicyHelperLib.h for variable policy enforcement. [1] [2]

Changes to Variable Policy Library:

1. MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c: Fixed character comparison in IsValidVariablePolicyStructure and EvaluatePolicyMatch methods. Also, added a security lock report event when the variable policy locks. [1] [2] [3]
2. MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.h, MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLibStandaloneMm.c, MdeModulePkg/Library/VarCheckPolicyLib/VarCheckPolicyLibTraditional.c: Added a wrapper function to validate the communicate buffer. [1] [2] [3]
3. MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.c: Reported a security lock audit event when the variable policy locks.
4. MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLib.inf, MdeModulePkg/Library/VariablePolicyLib/VariablePolicyLibRuntimeDxe.inf: Added SecurityLockAuditLib to report when the variable policy locks. [1] [2]

Additions and Modifications:

1. MdeModulePkg/Include/Library/VariablePolicyLockingExLib.h: A new file was added that contains definitions necessary for a platform to register a pre- and post-lock callback on the VariablePolicy interface.
2. MdeModulePkg/Library/VariablePolicyLib/VariablePolicyUnitTest/VariablePolicyUnitTest.inf: A new unit test file was added for business logic for Variable Policy enforcement.
3. MdeModulePkg/MdeModulePkg.dec: Added VariablePolicyLockingExLib library class and modified PcdAllowVariablePolicyEnforcementDisable PCD to allow policy to be disabled by default. [1] [2]
4. MdeModulePkg/MdeModulePkg.dsc: Included MemoryProtectionHobLib and added SecurityLockAuditLib to report when the variable policy locks.

For each item, place an "x" in between [ and ] if true. Example: [x].
(you can also check items in the GitHub UI)

• Impacts functionality?
  • Functionality - Does the change ultimately impact how firmware functions?
  • Examples: Add a new library, publish a new PPI, update an algorithm, ...
• Impacts security?
  • Security - Does the change have a direct security impact on an application,
    flow, or firmware?
  • Examples: Crypto algorithm change, buffer overflow fix, parameter
    validation improvement, ...
• Breaking change?
  • Breaking change - Will anyone consuming this change experience a break
    in build or boot behavior?
  • Examples: Add a new library class, move a module to a different repo, call
    a function in a new library class in a pre-existing module, ...
• Includes tests?
  • Tests - Does the change include any explicit test code?
  • Examples: Unit tests, integration tests, robot tests, ...
• Includes documentation?
  • Documentation - Does the change contain explicit documentation additions
    outside direct code modifications (and comments)?
  • Examples: Update readme file, add feature readme file, link to documentation
    on an a separate Web page, ...

How This Was Tested

Release/20311

Integration Instructions

N/A

[codecov-commenter]

Codecov Report

Attention: Patch coverage is 3.63636% with 106 lines in your changes missing coverage. Please review.

Please upload report for BASE (release/202405@1a3fe3e). Learn more about missing BASE report.

Files	Patch %	Lines
.../Variable/RuntimeDxe/VariablePolicyLockingCommon.c	0.00%	68 Missing ⚠️
...odulePkg/Library/UefiBootManagerLib/BmLoadOption.c	0.00%	27 Missing ⚠️
...rsal/MonotonicCounterRuntimeDxe/MonotonicCounter.c	0.00%	4 Missing ⚠️
...ModulePkg/Universal/Variable/RuntimeDxe/Variable.c	25.00%	3 Missing ⚠️
...ulePkg/Universal/Variable/RuntimeDxe/VariableDxe.c	0.00%	2 Missing ⚠️
...ePkg/Library/VarCheckPolicyLib/VarCheckPolicyLib.c	0.00%	1 Missing ⚠️
...iversal/Variable/RuntimeDxe/VariablePolicySmmDxe.c	0.00%	1 Missing ⚠️

Additional details and impacted files

@@                Coverage Diff                @@
##             release/202405     #978   +/-   ##
=================================================
  Coverage                  ?    0.98%           
=================================================
  Files                     ?      940           
  Lines                     ?   316802           
  Branches                  ?     3630           
=================================================
  Hits                      ?     3128           
  Misses                    ?   313596           
  Partials                  ?       78           

Flag	Coverage Δ
MdeModulePkg	0.68% <3.63%> (?)
NetworkPkg	0.55% <ø> (?)
UefiCpuPkg	4.75% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.