[stable/202011][Patch 1/1] MdeModulePkg/Library/VarCheckLib: Allow SetVariable from SMM

[stable/202011][Patch 1/1] MdeModulePkg/Library/VarCheckLib: Allow SetVariable from SMM

[Michael D Kinney]

REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3154

Update VarCheckLibSetVariableCheck() to allow locked variables
to be updated if the RequestSource is VarCheckFromTrusted even
if one or more variable check handlers return EFI_WRITE_PROTECTED.
RequestSource is only set to VarCheckFromTrusted if the request
is through the EFI_SMM_VARAIBLE_PROTOCOL.

Cc: Bret Barkelew <Bret.Barkelew@microsoft.com>
Cc: Hao A Wu <hao.a.wu@intel.com>
Cc: Liming Gao <gaoliming@byosoft.com.cn>
Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
Reviewed-by: Bret Barkelew <bret.barkelew@microsoft.com>
Reviewed-by: Hao A Wu <hao.a.wu@intel.com>
(cherry picked from commit 248d08c5983b561549891fec54c213e1f354179c)
---
 MdeModulePkg/Library/VarCheckLib/VarCheckLib.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/MdeModulePkg/Library/VarCheckLib/VarCheckLib.c b/MdeModulePkg/Library/VarCheckLib/VarCheckLib.c
index 470d782444bf..9596d760e945 100644
--- a/MdeModulePkg/Library/VarCheckLib/VarCheckLib.c
+++ b/MdeModulePkg/Library/VarCheckLib/VarCheckLib.c
@@ -1,7 +1,7 @@
 /** @file
   Implementation functions and structures for var check services.
 
-Copyright (c) 2015 - 2016, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2015 - 2021, Intel Corporation. All rights reserved.<BR>
 SPDX-License-Identifier: BSD-2-Clause-Patent
 
 **/
@@ -655,6 +655,13 @@ VarCheckLibSetVariableCheck (
                DataSize,
                Data
                );
+    if (Status == EFI_WRITE_PROTECTED && RequestSource == VarCheckFromTrusted) {
+      //
+      // If RequestSource is trusted, then allow variable to be set even if it
+      // is write protected.
+      //
+      continue;
+    }
     if (EFI_ERROR (Status)) {
       DEBUG ((EFI_D_INFO, "Variable Check handler fail %r - %g:%s\n", Status, VendorGuid, VariableName));
       return Status;
-- 
2.29.2.windows.2

回复: [edk2-devel] [stable/202011][Patch 1/1] MdeModulePkg/Library/VarCheckLib: Allow SetVariable from SMM

[gaoliming]

Reviewed-by: Liming Gao <gaoliming@byosoft.com.cn>

> -----邮件原件-----
> 发件人: bounce+27952+69945+4905953+8761045@groups.io
> <bounce+27952+69945+4905953+8761045@groups.io> 代表 Michael D
> Kinney
> 发送时间: 2021年1月8日 1:48
> 收件人: devel@edk2.groups.io
> 抄送: Bret Barkelew <Bret.Barkelew@microsoft.com>; Hao A Wu
> <hao.a.wu@intel.com>; Liming Gao <gaoliming@byosoft.com.cn>; Bret
> Barkelew <bret.barkelew@microsoft.com>
> 主题: [edk2-devel] [stable/202011][Patch 1/1]
> MdeModulePkg/Library/VarCheckLib: Allow SetVariable from SMM
> 
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3154
> 
> Update VarCheckLibSetVariableCheck() to allow locked variables
> to be updated if the RequestSource is VarCheckFromTrusted even
> if one or more variable check handlers return EFI_WRITE_PROTECTED.
> RequestSource is only set to VarCheckFromTrusted if the request
> is through the EFI_SMM_VARAIBLE_PROTOCOL.
> 
> Cc: Bret Barkelew <Bret.Barkelew@microsoft.com>
> Cc: Hao A Wu <hao.a.wu@intel.com>
> Cc: Liming Gao <gaoliming@byosoft.com.cn>
> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
> Reviewed-by: Bret Barkelew <bret.barkelew@microsoft.com>
> Reviewed-by: Hao A Wu <hao.a.wu@intel.com>
> (cherry picked from commit 248d08c5983b561549891fec54c213e1f354179c)
> ---
>  MdeModulePkg/Library/VarCheckLib/VarCheckLib.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/MdeModulePkg/Library/VarCheckLib/VarCheckLib.c
> b/MdeModulePkg/Library/VarCheckLib/VarCheckLib.c
> index 470d782444bf..9596d760e945 100644
> --- a/MdeModulePkg/Library/VarCheckLib/VarCheckLib.c
> +++ b/MdeModulePkg/Library/VarCheckLib/VarCheckLib.c
> @@ -1,7 +1,7 @@
>  /** @file
>    Implementation functions and structures for var check services.
> 
> -Copyright (c) 2015 - 2016, Intel Corporation. All rights reserved.<BR>
> +Copyright (c) 2015 - 2021, Intel Corporation. All rights reserved.<BR>
>  SPDX-License-Identifier: BSD-2-Clause-Patent
> 
>  **/
> @@ -655,6 +655,13 @@ VarCheckLibSetVariableCheck (
>                 DataSize,
>                 Data
>                 );
> +    if (Status == EFI_WRITE_PROTECTED && RequestSource ==
> VarCheckFromTrusted) {
> +      //
> +      // If RequestSource is trusted, then allow variable to be set even
if it
> +      // is write protected.
> +      //
> +      continue;
> +    }
>      if (EFI_ERROR (Status)) {
>        DEBUG ((EFI_D_INFO, "Variable Check handler fail %r - %g:%s\n",
> Status, VendorGuid, VariableName));
>        return Status;
> --
> 2.29.2.windows.2
> 
> 
> 
> 
>