From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mga09.intel.com (mga09.intel.com [134.134.136.24]) by mx.groups.io with SMTP id smtpd.web11.5072.1644570134094657749 for ; Fri, 11 Feb 2022 01:02:15 -0800 Authentication-Results: mx.groups.io; dkim=fail reason="unable to parse pub key" header.i=@intel.com header.s=intel header.b=VmECC5H1; spf=pass (domain: intel.com, ip: 134.134.136.24, mailfrom: chasel.chiu@intel.com) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1644570134; x=1676106134; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=yHG/UjgbD1qD5jQ+h7f7/K/i6Nqq8eucJff+i6/Gusg=; b=VmECC5H1rhuUtR58pHGQ8mkq/hzdUJo/8drp55VXIlIXRetrZ+D3N54H QWVM+CRiYBY/ERW1wOZfAZFfh0TfU201N+gdvCEy4sB03tU3spp18oZPa OMS47d7eVGJGtt0GSdDqYD2rFcYGBlrTsCcmXKlNdln1dwDrpb3+Uthy5 lBVVjPm7G7YY7gkkFYU6POeGxS8CLiuHRoad+OXxLZ2UqHvlklaDXWouD GWWgX1Yzd/pX/m7LxsNnOB8vxIsznIn2IqGOvAFmPrP/bv28MK3wW6PMy kcnKeN3VfmGujW1au69pp6R0v75kGFcOzJq9elHN0MougGfCkiQ4X7y/C A==; X-IronPort-AV: E=McAfee;i="6200,9189,10254"; a="249444055" X-IronPort-AV: E=Sophos;i="5.88,360,1635231600"; d="scan'208";a="249444055" Received: from orsmga003.jf.intel.com ([10.7.209.27]) by orsmga102.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 11 Feb 2022 01:02:13 -0800 X-IronPort-AV: E=Sophos;i="5.88,360,1635231600"; d="scan'208";a="483231233" Received: from cchiu4-mobl.gar.corp.intel.com ([10.252.189.32]) by orsmga003-auth.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 11 Feb 2022 01:02:11 -0800 From: "Chiu, Chasel" To: devel@edk2.groups.io Cc: "Chiu, Chasel" , Nate DeSimone , Liming Gao , Eric Dong Subject: [edk2-platforms: PATCH v3] MinPlatformPkg/SaveMemoryConfig: Variable may not be locked. Date: Fri, 11 Feb 2022 17:02:04 +0800 Message-Id: <20220211090204.987-1-chasel.chiu@intel.com> X-Mailer: git-send-email 2.28.0.windows.1 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable From: "Chiu, Chasel" REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3D3829 Fixed the bug that existing variable will not be locked when it is identical with hob data by creating LockLargeVariable function, also switched to VariablePolicyProtocol for locking variables. Failing to lock variable could be security vulnerability, so the function will return EFI_ABORTED when it failed and SaveMemoryConfig driver will halt the system for developers to resolve this issue. This patch also modified SaveMemoryConfig driver to be unloaded after execution because it does not produce any service protocol. To achieve this goal the DxeRuntimeVariableWriteLib should close registered ExitBootService events in its DESTRUCTOR. Cc: Nate DeSimone Cc: Liming Gao Cc: Eric Dong Signed-off-by: Chasel Chiu ---=0D =0D V3:=0D Updated LargeVariableWriteLib to return EFI_ABORTED when locking variables = failed.=0D Also SaveMemoryConfig driver will halt the system in this case for develope= rs to fix=0D such security vulnerability issue.=0D Platform/Intel/MinPlatformPkg/FspWrapper/SaveMemoryConfig/SaveMemoryConfig= .c | 27 ++++++++++++++++++++++++--- Platform/Intel/MinPlatformPkg/Library/BaseLargeVariableLib/LargeVariableWr= iteLib.c | 115 +++++++++++++++++++++++++++++++++++++++++++++++= +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++----- Platform/Intel/MinPlatformPkg/Library/DxeRuntimeVariableWriteLib/DxeRuntim= eVariableWriteLib.c | 61 +++++++++++++++++++++++++++++++++++++++++++++--= -------------- Platform/Intel/MinPlatformPkg/FspWrapper/SaveMemoryConfig/SaveMemoryConfig= .inf | 3 ++- Platform/Intel/MinPlatformPkg/Include/Library/LargeVariableWriteLib.h = | 25 +++++++++++++++++++++++-- Platform/Intel/MinPlatformPkg/Library/DxeRuntimeVariableWriteLib/DxeRuntim= eVariableWriteLib.inf | 8 +++++--- 6 files changed, 209 insertions(+), 30 deletions(-) diff --git a/Platform/Intel/MinPlatformPkg/FspWrapper/SaveMemoryConfig/Save= MemoryConfig.c b/Platform/Intel/MinPlatformPkg/FspWrapper/SaveMemoryConfig/= SaveMemoryConfig.c index 820585f676..54e11e20bd 100644 --- a/Platform/Intel/MinPlatformPkg/FspWrapper/SaveMemoryConfig/SaveMemoryC= onfig.c +++ b/Platform/Intel/MinPlatformPkg/FspWrapper/SaveMemoryConfig/SaveMemoryC= onfig.c @@ -2,13 +2,14 @@ This is the driver that locates the MemoryConfigurationData HOB, if it=0D exists, and saves the data to nvRAM.=0D =0D -Copyright (c) 2017 - 2021, Intel Corporation. All rights reserved.
=0D +Copyright (c) 2017 - 2022, Intel Corporation. All rights reserved.
=0D SPDX-License-Identifier: BSD-2-Clause-Patent=0D =0D **/=0D =0D #include =0D #include =0D +#include =0D #include =0D #include =0D #include =0D @@ -18,6 +19,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #include =0D #include =0D #include =0D +#include =0D #include =0D =0D /**=0D @@ -86,6 +88,18 @@ SaveMemoryConfigEntryPoint ( Status =3D GetLargeVariable (L"FspNvsBuffer", &gFspNvsBufferVa= riableGuid, &BufferSize, VariableData);=0D if (!EFI_ERROR (Status) && (BufferSize =3D=3D DataSize) && (0 = =3D=3D CompareMem (HobData, VariableData, DataSize))) {=0D DataIsIdentical =3D TRUE;=0D + //=0D + // No need to update Variable, only lock it.=0D + //=0D + Status =3D LockLargeVariable (L"FspNvsBuffer", &gFspNvsBuff= erVariableGuid);=0D + if (EFI_ERROR(Status)) {=0D + //=0D + // Fail to lock variable is security vulnerability and sho= uld not happen.=0D + //=0D + DEBUG ((DEBUG_ERROR, "LockVariable is requested but failed= unexpectedly!\n"));=0D + ASSERT_EFI_ERROR (Status);=0D + CpuDeadLoop();=0D + }=0D }=0D FreePool (VariableData);=0D }=0D @@ -96,6 +110,13 @@ SaveMemoryConfigEntryPoint ( if (!DataIsIdentical) {=0D Status =3D SetLargeVariable (L"FspNvsBuffer", &gFspNvsBufferVariab= leGuid, TRUE, DataSize, HobData);=0D ASSERT_EFI_ERROR (Status);=0D + if (Status =3D=3D EFI_ABORTED) {=0D + //=0D + // Fail to lock variable is security vulnerability and should no= t happen.=0D + //=0D + DEBUG ((DEBUG_ERROR, "LockVariable is requested but failed unexp= ectedly!\n"));=0D + CpuDeadLoop();=0D + }=0D DEBUG ((DEBUG_INFO, "Saved size of FSP / MRC Training Data: 0x%x\n= ", DataSize));=0D } else {=0D DEBUG ((DEBUG_INFO, "FSP / MRC Training Data is identical to data = from last boot, no need to save.\n"));=0D @@ -106,7 +127,7 @@ SaveMemoryConfigEntryPoint ( }=0D =0D //=0D - // This driver cannot be unloaded because DxeRuntimeVariableWriteLib con= structor will register ExitBootServices callback.=0D + // This driver does not produce any protocol services, so always unload = it.=0D //=0D - return EFI_SUCCESS;=0D + return EFI_REQUEST_UNLOAD_IMAGE;=0D }=0D diff --git a/Platform/Intel/MinPlatformPkg/Library/BaseLargeVariableLib/Lar= geVariableWriteLib.c b/Platform/Intel/MinPlatformPkg/Library/BaseLargeVaria= bleLib/LargeVariableWriteLib.c index e4b97ef1df..154f6f448f 100644 --- a/Platform/Intel/MinPlatformPkg/Library/BaseLargeVariableLib/LargeVaria= bleWriteLib.c +++ b/Platform/Intel/MinPlatformPkg/Library/BaseLargeVariableLib/LargeVaria= bleWriteLib.c @@ -10,7 +10,7 @@ integer number will be added to the end of the variable name. This numbe= r=0D will be incremented for each variable as needed to store the entire data= set.=0D =0D - Copyright (c) 2021, Intel Corporation. All rights reserved.
=0D + Copyright (c) 2021 - 2022, Intel Corporation. All rights reserved.
=0D SPDX-License-Identifier: BSD-2-Clause-Patent=0D =0D **/=0D @@ -245,7 +245,7 @@ Done: @retval EFI_DEVICE_ERROR The variable could not be retrieved due t= o a hardware error.=0D @retval EFI_WRITE_PROTECTED The variable in question is read-only.=0D @retval EFI_WRITE_PROTECTED The variable in question cannot be delete= d.=0D -=0D + @retval EFI_ABORTED LockVariable was requested but failed.=0D @retval EFI_NOT_FOUND The variable trying to be updated or dele= ted was not found.=0D =0D **/=0D @@ -412,7 +412,7 @@ SetLargeVariable ( // all data is saved.=0D //=0D if (LockVariable) {=0D - for (Index =3D 0; Index < VariablesSaved; Index++) {=0D + for (Index =3D 0; Index <=3D VariablesSaved; Index++) {=0D ZeroMem (TempVariableName, MAX_VARIABLE_NAME_SIZE);=0D UnicodeSPrint (TempVariableName, MAX_VARIABLE_NAME_SIZE, L"%s%d", = VariableName, Index);=0D =0D @@ -420,7 +420,7 @@ SetLargeVariable ( Status =3D VarLibVariableRequestToLock (TempVariableName, VendorGu= id);=0D if (EFI_ERROR (Status)) {=0D DEBUG ((DEBUG_ERROR, "SetLargeVariable: Error locking variable: = Status =3D %r\n", Status));=0D - VariablesSaved =3D 0;=0D + Status =3D EFI_ABORTED;=0D goto Done;=0D }=0D }=0D @@ -442,9 +442,114 @@ Done: 0,=0D NULL=0D );=0D - DEBUG ((DEBUG_ERROR, "SetLargeVariable: Error deleting variable: Statu= s =3D %r\n", Status2));=0D + if (EFI_ERROR (Status2)) {=0D + DEBUG ((DEBUG_ERROR, "SetLargeVariable: Error deleting variable: S= tatus =3D %r\n", Status2));=0D + }=0D }=0D }=0D DEBUG ((DEBUG_ERROR, "SetLargeVariable: Status =3D %r\n", Status));=0D return Status;=0D }=0D +=0D +/**=0D + Locks the existing large variable.=0D +=0D + @param[in] VariableName A Null-terminated string that is the name= of the vendor's variable.=0D + Each VariableName is unique for each Vend= orGuid. VariableName must=0D + contain 1 or more characters. If Variable= Name is an empty string,=0D + then EFI_INVALID_PARAMETER is returned.=0D + @param[in] VendorGuid A unique identifier for the vendor.=0D + @retval EFI_SUCCESS The firmware has successfully locked the = variable.=0D + @retval EFI_INVALID_PARAMETER An invalid combination of variable name a= nd GUID was supplied=0D + @retval EFI_UNSUPPORTED The service for locking variable is not r= eady.=0D + @retval EFI_NOT_FOUND The targeting variable for locking is not= present.=0D + @retval EFI_ABORTED Fail to lock variable.=0D +**/=0D +EFI_STATUS=0D +EFIAPI=0D +LockLargeVariable (=0D + IN CHAR16 *VariableName,=0D + IN EFI_GUID *VendorGuid=0D + )=0D +{=0D + CHAR16 TempVariableName[MAX_VARIABLE_NAME_SIZE];=0D + UINT64 VariableSize;=0D + EFI_STATUS Status;=0D + UINTN Index;=0D +=0D + //=0D + // Check input parameters.=0D + //=0D + if (VariableName =3D=3D NULL || VariableName[0] =3D=3D 0 || VendorGuid = =3D=3D NULL) {=0D + return EFI_INVALID_PARAMETER;=0D + }=0D +=0D + if (!VarLibIsVariableRequestToLockSupported ()) {=0D + return EFI_UNSUPPORTED;=0D + }=0D +=0D + VariableSize =3D 0;=0D + Index =3D 0;=0D + ZeroMem (TempVariableName, MAX_VARIABLE_NAME_SIZE);=0D + UnicodeSPrint (TempVariableName, MAX_VARIABLE_NAME_SIZE, L"%s%d", Variab= leName, Index);=0D + Status =3D VarLibGetVariable (TempVariableName, VendorGuid, NULL, &Varia= bleSize, NULL);=0D + if (Status =3D=3D EFI_BUFFER_TOO_SMALL) {=0D + //=0D + // Lock multiple variables.=0D + //=0D +=0D + //=0D + // Lock first variable and continue to rest of the variables.=0D + //=0D + DEBUG ((DEBUG_INFO, "Locking %s, Guid =3D %g\n", TempVariableName, Ven= dorGuid));=0D + Status =3D VarLibVariableRequestToLock (TempVariableName, VendorGuid);= =0D + if (EFI_ERROR(Status)) {=0D + DEBUG ((DEBUG_ERROR, "LockLargeVariable: Failed! Satus =3D %r\n", St= atus));=0D + return EFI_ABORTED;=0D + }=0D + for (Index =3D 1; Index < MAX_VARIABLE_SPLIT; Index++) {=0D + ZeroMem (TempVariableName, MAX_VARIABLE_NAME_SIZE);=0D + UnicodeSPrint (TempVariableName, MAX_VARIABLE_NAME_SIZE, L"%s%d", Va= riableName, Index);=0D +=0D + VariableSize =3D 0;=0D + Status =3D VarLibGetVariable (TempVariableName, VendorGuid, NULL, &V= ariableSize, NULL);=0D + if (Status =3D=3D EFI_BUFFER_TOO_SMALL) {=0D + DEBUG ((DEBUG_INFO, "Locking %s, Guid =3D %g\n", TempVariableName,= VendorGuid));=0D + Status =3D VarLibVariableRequestToLock (TempVariableName, VendorGu= id);=0D + if (EFI_ERROR(Status)) {=0D + DEBUG ((DEBUG_ERROR, "LockLargeVariable: Failed! Satus =3D %r\n"= , Status));=0D + return EFI_ABORTED;=0D + }=0D + } else if (Status =3D=3D EFI_NOT_FOUND) {=0D + //=0D + // No more variables need to lock.=0D + //=0D + return EFI_SUCCESS;=0D + }=0D + } // End of for loop=0D + } else if (Status =3D=3D EFI_NOT_FOUND) {=0D + //=0D + // Check if it is single variable scenario.=0D + //=0D + VariableSize =3D 0;=0D + Status =3D VarLibGetVariable (VariableName, VendorGuid, NULL, &Variabl= eSize, NULL);=0D + if (Status =3D=3D EFI_BUFFER_TOO_SMALL) {=0D + //=0D + // Lock single variable.=0D + //=0D + DEBUG ((DEBUG_INFO, "Locking %s, Guid =3D %g\n", VariableName, Vendo= rGuid));=0D + Status =3D VarLibVariableRequestToLock (VariableName, VendorGuid);=0D + if (EFI_ERROR(Status)) {=0D + DEBUG ((DEBUG_ERROR, "LockLargeVariable: Failed! Satus =3D %r\n", = Status));=0D + return EFI_ABORTED;=0D + }=0D + return EFI_SUCCESS;=0D + }=0D + }=0D +=0D + //=0D + // Here probably means variable not present.=0D + //=0D + return Status;=0D +=0D +}=0D diff --git a/Platform/Intel/MinPlatformPkg/Library/DxeRuntimeVariableWriteL= ib/DxeRuntimeVariableWriteLib.c b/Platform/Intel/MinPlatformPkg/Library/Dxe= RuntimeVariableWriteLib/DxeRuntimeVariableWriteLib.c index 9ed59f8827..28730f858b 100644 --- a/Platform/Intel/MinPlatformPkg/Library/DxeRuntimeVariableWriteLib/DxeR= untimeVariableWriteLib.c +++ b/Platform/Intel/MinPlatformPkg/Library/DxeRuntimeVariableWriteLib/DxeR= untimeVariableWriteLib.c @@ -10,7 +10,7 @@ Using this library allows code to be written in a generic manner that ca= n be=0D used in DXE or SMM without modification.=0D =0D - Copyright (c) 2021, Intel Corporation. All rights reserved.
=0D + Copyright (c) 2021 - 2022, Intel Corporation. All rights reserved.
=0D SPDX-License-Identifier: BSD-2-Clause-Patent=0D =0D **/=0D @@ -18,14 +18,16 @@ #include =0D =0D #include =0D -#include =0D +#include =0D =0D #include =0D #include =0D #include =0D #include =0D =0D -STATIC EDKII_VARIABLE_LOCK_PROTOCOL *mVariableWriteLibVariableLock =3D NU= LL;=0D +STATIC EDKII_VARIABLE_POLICY_PROTOCOL *mVariableWriteLibVariablePolicy = =3D NULL;=0D +EFI_EVENT mExitBootServiceEvent;=0D +EFI_EVENT mLegacyBootEvent;=0D =0D /**=0D Sets the value of a variable.=0D @@ -144,7 +146,7 @@ VarLibIsVariableRequestToLockSupported ( VOID=0D )=0D {=0D - if (mVariableWriteLibVariableLock !=3D NULL) {=0D + if (mVariableWriteLibVariablePolicy !=3D NULL) {=0D return TRUE;=0D } else {=0D return FALSE;=0D @@ -178,16 +180,45 @@ VarLibVariableRequestToLock ( {=0D EFI_STATUS Status =3D EFI_UNSUPPORTED;=0D =0D - if (mVariableWriteLibVariableLock !=3D NULL) {=0D - Status =3D mVariableWriteLibVariableLock->RequestToLock (=0D - mVariableWriteLibVariableLoc= k,=0D - VariableName,=0D - VendorGuid=0D - );=0D + if (mVariableWriteLibVariablePolicy !=3D NULL) {=0D + Status =3D RegisterBasicVariablePolicy (=0D + mVariableWriteLibVariablePolicy,=0D + (CONST EFI_GUID*) VendorGuid,=0D + (CONST CHAR16 *) VariableName,=0D + VARIABLE_POLICY_NO_MIN_SIZE,=0D + VARIABLE_POLICY_NO_MAX_SIZE,=0D + VARIABLE_POLICY_NO_MUST_ATTR,=0D + VARIABLE_POLICY_NO_CANT_ATTR,=0D + VARIABLE_POLICY_TYPE_LOCK_NOW=0D + );=0D }=0D return Status;=0D }=0D =0D +/**=0D + Close events when driver unloaded.=0D +=0D + @param[in] ImageHandle A handle for the image that is initializing this= driver=0D + @param[in] SystemTable A pointer to the EFI system table=0D +=0D + @retval EFI_SUCCESS The initialization finished successfully.=0D +**/=0D +EFI_STATUS=0D +EFIAPI=0D +DxeRuntimeVariableWriteLibDestructor (=0D + IN EFI_HANDLE ImageHandle,=0D + IN EFI_SYSTEM_TABLE *SystemTable=0D + )=0D +{=0D + if (mExitBootServiceEvent !=3D 0) {=0D + gBS->CloseEvent (mExitBootServiceEvent);=0D + }=0D + if (mLegacyBootEvent !=3D 0) {=0D + gBS->CloseEvent (mLegacyBootEvent);=0D + }=0D + return EFI_SUCCESS;=0D +}=0D +=0D /**=0D Exit Boot Services Event notification handler.=0D =0D @@ -202,7 +233,7 @@ DxeRuntimeVariableWriteLibOnExitBootServices ( IN VOID *Context=0D )=0D {=0D - mVariableWriteLibVariableLock =3D NULL;=0D + mVariableWriteLibVariablePolicy =3D NULL;=0D }=0D =0D /**=0D @@ -227,13 +258,11 @@ DxeRuntimeVariableWriteLibConstructor ( )=0D {=0D EFI_STATUS Status;=0D - EFI_EVENT ExitBootServiceEvent;=0D - EFI_EVENT LegacyBootEvent;=0D =0D //=0D // Locate VariableLockProtocol.=0D //=0D - Status =3D gBS->LocateProtocol (&gEdkiiVariableLockProtocolGuid, NULL, (= VOID **)&mVariableWriteLibVariableLock);=0D + Status =3D gBS->LocateProtocol (&gEdkiiVariablePolicyProtocolGuid, NULL,= (VOID **)&mVariableWriteLibVariablePolicy);=0D ASSERT_EFI_ERROR (Status);=0D =0D //=0D @@ -245,7 +274,7 @@ DxeRuntimeVariableWriteLibConstructor ( DxeRuntimeVariableWriteLibOnExitBootServices,=0D NULL,=0D &gEfiEventExitBootServicesGuid,=0D - &ExitBootServiceEvent=0D + &mExitBootServiceEvent=0D );=0D ASSERT_EFI_ERROR (Status);=0D =0D @@ -257,7 +286,7 @@ DxeRuntimeVariableWriteLibConstructor ( TPL_NOTIFY,=0D DxeRuntimeVariableWriteLibOnExitBootServices,=0D NULL,=0D - &LegacyBootEvent=0D + &mLegacyBootEvent=0D );=0D ASSERT_EFI_ERROR (Status);=0D =0D diff --git a/Platform/Intel/MinPlatformPkg/FspWrapper/SaveMemoryConfig/Save= MemoryConfig.inf b/Platform/Intel/MinPlatformPkg/FspWrapper/SaveMemoryConfi= g/SaveMemoryConfig.inf index e2dbd2fb49..61e85a6586 100644 --- a/Platform/Intel/MinPlatformPkg/FspWrapper/SaveMemoryConfig/SaveMemoryC= onfig.inf +++ b/Platform/Intel/MinPlatformPkg/FspWrapper/SaveMemoryConfig/SaveMemoryC= onfig.inf @@ -1,7 +1,7 @@ ### @file=0D # Component information file for SaveMemoryConfig module=0D #=0D -# Copyright (c) 2017 - 2021, Intel Corporation. All rights reserved.
=0D +# Copyright (c) 2017 - 2022, Intel Corporation. All rights reserved.
=0D #=0D # SPDX-License-Identifier: BSD-2-Clause-Patent=0D #=0D @@ -25,6 +25,7 @@ BaseMemoryLib=0D LargeVariableReadLib=0D LargeVariableWriteLib=0D + BaseLib=0D =0D [Packages]=0D MdePkg/MdePkg.dec=0D diff --git a/Platform/Intel/MinPlatformPkg/Include/Library/LargeVariableWri= teLib.h b/Platform/Intel/MinPlatformPkg/Include/Library/LargeVariableWriteL= ib.h index c847d7f152..64b0090c2c 100644 --- a/Platform/Intel/MinPlatformPkg/Include/Library/LargeVariableWriteLib.h +++ b/Platform/Intel/MinPlatformPkg/Include/Library/LargeVariableWriteLib.h @@ -16,7 +16,7 @@ is possible, adjusting the value of PcdMaxVariableSize may provide a sim= pler=0D solution to this problem.=0D =0D - Copyright (c) 2021, Intel Corporation. All rights reserved.
=0D + Copyright (c) 2021 - 2022, Intel Corporation. All rights reserved.
=0D SPDX-License-Identifier: BSD-2-Clause-Patent=0D =0D **/=0D @@ -52,7 +52,7 @@ @retval EFI_DEVICE_ERROR The variable could not be retrieved due t= o a hardware error.=0D @retval EFI_WRITE_PROTECTED The variable in question is read-only.=0D @retval EFI_WRITE_PROTECTED The variable in question cannot be delete= d.=0D -=0D + @retval EFI_ABORTED LockVariable was requested but failed.=0D @retval EFI_NOT_FOUND The variable trying to be updated or dele= ted was not found.=0D =0D **/=0D @@ -66,4 +66,25 @@ SetLargeVariable ( IN VOID *Data=0D );=0D =0D +/**=0D + Locks the existing large variable.=0D +=0D + @param[in] VariableName A Null-terminated string that is the name= of the vendor's variable.=0D + Each VariableName is unique for each Vend= orGuid. VariableName must=0D + contain 1 or more characters. If Variable= Name is an empty string,=0D + then EFI_INVALID_PARAMETER is returned.=0D + @param[in] VendorGuid A unique identifier for the vendor.=0D + @retval EFI_SUCCESS The firmware has successfully locked the = variable.=0D + @retval EFI_INVALID_PARAMETER An invalid combination of variable name a= nd GUID was supplied=0D + @retval EFI_UNSUPPORTED The service for locking variable is not r= eady.=0D + @retval EFI_NOT_FOUND The targeting variable for locking is not= present.=0D + @retval EFI_ABORTED Fail to lock variable.=0D +**/=0D +EFI_STATUS=0D +EFIAPI=0D +LockLargeVariable (=0D + IN CHAR16 *VariableName,=0D + IN EFI_GUID *VendorGuid=0D + );=0D +=0D #endif // _LARGE_VARIABLE_WRITE_LIB_H_=0D diff --git a/Platform/Intel/MinPlatformPkg/Library/DxeRuntimeVariableWriteL= ib/DxeRuntimeVariableWriteLib.inf b/Platform/Intel/MinPlatformPkg/Library/D= xeRuntimeVariableWriteLib/DxeRuntimeVariableWriteLib.inf index 704a8ac7cc..f83090c847 100644 --- a/Platform/Intel/MinPlatformPkg/Library/DxeRuntimeVariableWriteLib/DxeR= untimeVariableWriteLib.inf +++ b/Platform/Intel/MinPlatformPkg/Library/DxeRuntimeVariableWriteLib/DxeR= untimeVariableWriteLib.inf @@ -10,7 +10,7 @@ # Using this library allows code to be written in a generic manner that ca= n be=0D # used in DXE or SMM without modification.=0D #=0D -# Copyright (c) 2021, Intel Corporation. All rights reserved.
=0D +# Copyright (c) 2021 - 2022, Intel Corporation. All rights reserved.
=0D #=0D # SPDX-License-Identifier: BSD-2-Clause-Patent=0D #=0D @@ -24,6 +24,7 @@ MODULE_TYPE =3D DXE_RUNTIME_DRIVER=0D LIBRARY_CLASS =3D VariableWriteLib|DXE_CORE DXE_DRIVER = DXE_RUNTIME_DRIVER UEFI_APPLICATION UEFI_DRIVER=0D CONSTRUCTOR =3D DxeRuntimeVariableWriteLibConstructor= =0D + DESTRUCTOR =3D DxeRuntimeVariableWriteLibDestructor= =0D =0D [Packages]=0D MdePkg/MdePkg.dec=0D @@ -37,13 +38,14 @@ UefiLib=0D UefiBootServicesTableLib=0D UefiRuntimeServicesTableLib=0D + VariablePolicyHelperLib=0D =0D [Guids]=0D gEfiEventExitBootServicesGuid ## CONSUMES ## Event=0D =0D [Protocols]=0D gEfiVariableWriteArchProtocolGuid ## CONSUMES=0D - gEdkiiVariableLockProtocolGuid ## CONSUMES=0D + gEdkiiVariablePolicyProtocolGuid ## CONSUMES=0D =0D [Depex]=0D - gEfiVariableWriteArchProtocolGuid AND gEdkiiVariableLockProtocolGuid=0D + gEfiVariableWriteArchProtocolGuid AND gEdkiiVariablePolicyProtocolGuid=0D --=20 2.28.0.windows.1