Re: [Patch 1/1] MdeModulePkg/Library/VarCheckLib: Allow SetVariable from SMM

["Wu, Hao A" <hao.a.wu@intel.com>]

> -----Original Message-----
> From: Michael D Kinney <michael.d.kinney@intel.com>
> Sent: Wednesday, January 6, 2021 11:51 AM
> To: devel@edk2.groups.io
> Cc: Bret Barkelew <Bret.Barkelew@microsoft.com>; Wu, Hao A
> <hao.a.wu@intel.com>; Liming Gao <gaoliming@byosoft.com.cn>
> Subject: [Patch 1/1] MdeModulePkg/Library/VarCheckLib: Allow SetVariable
> from SMM
> 
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3154
> 
> Update VarCheckLibSetVariableCheck() to allow locked variables to be
> updated if the RequestSource is VarCheckFromTrusted even if one or more
> variable check handlers return EFI_WRITE_PROTECTED.
> RequestSource is only set to VarCheckFromTrusted if the request is through
> the EFI_SMM_VARAIBLE_PROTOCOL.


Hello Mike,

Sorry for a question.

If a SetVar request is blocked by a registered VarCheck handler, I think it would better to change that handler to allow requests from SMM.
I am not sure if there is a VarCheck handler that has its own specific rule to return 'EFI_WRITE_PROTECTED' to block some SetVar requests.
Is there any special consideration (e.g. VarCheck handler not being able to get the source of the SetVar request) for not doing this way?

Thanks in advance.

Best Regards,
Hao Wu


> 
> Cc: Bret Barkelew <Bret.Barkelew@microsoft.com>
> Cc: Hao A Wu <hao.a.wu@intel.com>
> Cc: Liming Gao <gaoliming@byosoft.com.cn>
> Signed-off-by: Michael D Kinney <michael.d.kinney@intel.com>
> ---
>  MdeModulePkg/Library/VarCheckLib/VarCheckLib.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/MdeModulePkg/Library/VarCheckLib/VarCheckLib.c
> b/MdeModulePkg/Library/VarCheckLib/VarCheckLib.c
> index 470d782444bf..9596d760e945 100644
> --- a/MdeModulePkg/Library/VarCheckLib/VarCheckLib.c
> +++ b/MdeModulePkg/Library/VarCheckLib/VarCheckLib.c
> @@ -1,7 +1,7 @@
>  /** @file
>    Implementation functions and structures for var check services.
> 
> -Copyright (c) 2015 - 2016, Intel Corporation. All rights reserved.<BR>
> +Copyright (c) 2015 - 2021, Intel Corporation. All rights reserved.<BR>
>  SPDX-License-Identifier: BSD-2-Clause-Patent
> 
>  **/
> @@ -655,6 +655,13 @@ VarCheckLibSetVariableCheck (
>                 DataSize,
>                 Data
>                 );
> +    if (Status == EFI_WRITE_PROTECTED && RequestSource ==
> VarCheckFromTrusted) {
> +      //
> +      // If RequestSource is trusted, then allow variable to be set even if it
> +      // is write protected.
> +      //
> +      continue;
> +    }
>      if (EFI_ERROR (Status)) {
>        DEBUG ((EFI_D_INFO, "Variable Check handler fail %r - %g:%s\n", Status,
> VendorGuid, VariableName));
>        return Status;
> --
> 2.29.2.windows.2