gRT->SetVariable ACCESS DENIED error

gRT->SetVariable ACCESS DENIED error

[Toan Le manh]

Dear all,

I'm facing the Status EFI_ACCESS_DENIED when using gRT->SetVariable()
method.
There is no description of this returned status for SetVariable()  in UEFI
spec.
Have you ever faced this type of error? Could you please give me any idea
on how this happen?
Sorry for any inconvenience, I'm newbie in EDK2.

Thanks & Best Regards,
Toan

Re: gRT->SetVariable ACCESS DENIED error

[Andrew Fish]

Toan,

What arguments did you pass to gRT->SetVariable()?

What implementation did you test on? 

In general there are "wiggle words" in the UEFI Spec that make it legal to return other error codes. Back in the day when NOR FLASH was expensive and EFI was size constrained we did not want to have to filter every return value from a lower level to convert it to a spec required return code. 

Thanks,

Andrew Fish

> On Jul 3, 2018, at 2:10 AM, Toan Le manh <lemanhtoantb@gmail.com> wrote:
> 
> Dear all,
> 
> I'm facing the Status EFI_ACCESS_DENIED when using gRT->SetVariable()
> method.
> There is no description of this returned status for SetVariable()  in UEFI
> spec.
> Have you ever faced this type of error? Could you please give me any idea
> on how this happen?
> Sorry for any inconvenience, I'm newbie in EDK2.
> 
> Thanks & Best Regards,
> Toan
> _______________________________________________
> edk2-devel mailing list
> edk2-devel@lists.01.org
> https://lists.01.org/mailman/listinfo/edk2-devel

Re: gRT->SetVariable ACCESS DENIED error

[Toan Le manh]

Hi Andrew,

I'm trying to set some variables to NVRAM at the beginning of BDS phase.
For example, this function returned EFI_ACCESS_DENIED
    Status = gRT->SetVariable (
                    L"HwErrRecSupport",
                    &gEfiGlobalVariableGuid,
                    EFI_VARIABLE_BOOTSERVICE_ACCESS |
EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_NON_VOLATILE,
                    sizeof (UINT16),
                    &HardwareErrorRecordLevel
                    );

Thanks & BRs,
Toan

On Wed, Jul 4, 2018 at 12:12 AM Andrew Fish <afish@apple.com> wrote:

> Toan,
>
> What arguments did you pass to gRT->SetVariable()?
>
> What implementation did you test on?
>
> In general there are "wiggle words" in the UEFI Spec that make it legal to
> return other error codes. Back in the day when NOR FLASH was expensive and
> EFI was size constrained we did not want to have to filter every return
> value from a lower level to convert it to a spec required return code.
>
> Thanks,
>
> Andrew Fish
>
> > On Jul 3, 2018, at 2:10 AM, Toan Le manh <lemanhtoantb@gmail.com> wrote:
> >
> > Dear all,
> >
> > I'm facing the Status EFI_ACCESS_DENIED when using gRT->SetVariable()
> > method.
> > There is no description of this returned status for SetVariable()  in
> UEFI
> > spec.
> > Have you ever faced this type of error? Could you please give me any idea
> > on how this happen?
> > Sorry for any inconvenience, I'm newbie in EDK2.
> >
> > Thanks & Best Regards,
> > Toan
> > _______________________________________________
> > edk2-devel mailing list
> > edk2-devel@lists.01.org
> > https://lists.01.org/mailman/listinfo/edk2-devel
>
>

Re: gRT->SetVariable ACCESS DENIED error

[Andrew Fish]

Toan,

gEfiGlobalVariableGuid means it is defined in section 3.3, Globally Defined Variables, in the UEFI Spec:
Identifies the level of hardware error record persistence support implemented by the platform. This variable is only modified by firmware and is read-only to the OS.

As you see it is defined as read only, so it is a special variable. Lets search the UDK2018 for it and look for it being special cased....

/Volumes/Case/UDK2018(vUDK2018)>git grep EFI_HW_ERR_REC_SUPPORT_VARIABLE_NAME -- *.h
MdePkg/Include/Guid/GlobalVariable.h:121:#define EFI_HW_ERR_REC_SUPPORT_VARIABLE_NAME        L"HwErrRecSupport"
/Volumes/Case/UDK2018(vUDK2018)>git grep EFI_HW_ERR_REC_SUPPORT_VARIABLE_NAME -- *.c
MdeModulePkg/Library/VarCheckUefiLib/VarCheckUefiLibNullClass.c:407:    EFI_HW_ERR_REC_SUPPORT_VARIABLE_NAME,
MdeModulePkg/Universal/BdsDxe/BdsEntry.c:48:  EFI_HW_ERR_REC_SUPPORT_VARIABLE_NAME,
/Volumes/Case/UDK2018(vUDK2018)>git grep 'L"HwErrRecSupport"' -- *.c
IntelFrameworkModulePkg/Universal/BdsDxe/BdsEntry.c:48:  L"HwErrRecSupport",
IntelFrameworkModulePkg/Universal/BdsDxe/HwErrRecSupport.c:37:    // define same behavior between no value or 0 value for L"HwErrRecSupport".
IntelFrameworkModulePkg/Universal/BdsDxe/HwErrRecSupport.c:40:                    L"HwErrRecSupport",
MdeModulePkg/Universal/BdsDxe/HwErrRecSupport.c:37:    // define same behavior between no value or 0 value for L"HwErrRecSupport".
MdeModulePkg/Universal/BdsDxe/HwErrRecSupport.c:40:                    L"HwErrRecSupport",

Yep looks like some locking happens in the BDS, so maybe you are writing after the lock event?

https://github.com/tianocore/edk2/blob/master/MdeModulePkg/Universal/BdsDxe/BdsEntry.c#L44

///
/// The read-only variables defined in UEFI Spec.
///
CHAR16  *mReadOnlyVariables[] = {
  EFI_PLATFORM_LANG_CODES_VARIABLE_NAME,
  EFI_LANG_CODES_VARIABLE_NAME,
  EFI_BOOT_OPTION_SUPPORT_VARIABLE_NAME,
  EFI_HW_ERR_REC_SUPPORT_VARIABLE_NAME,
  EFI_OS_INDICATIONS_SUPPORT_VARIABLE_NAME
  };


https://github.com/tianocore/edk2/blob/master/MdeModulePkg/Universal/BdsDxe/BdsEntry.c#L754



  //
  // Mark the read-only variables if the Variable Lock protocol exists
  //
  Status = gBS->LocateProtocol (&gEdkiiVariableLockProtocolGuid, NULL, (VOID **) &VariableLock);
  DEBUG ((EFI_D_INFO, "[BdsDxe] Locate Variable Lock protocol - %r\n", Status));
  if (!EFI_ERROR (Status)) {
    for (Index = 0; Index < ARRAY_SIZE (mReadOnlyVariables); Index++) {
      Status = VariableLock->RequestToLock (VariableLock, mReadOnlyVariables[Index], &gEfiGlobalVariableGuid);
      ASSERT_EFI_ERROR (Status);
    }
  }


Maybe you missed it due the mixing of the #define and the architectural name from the UEFI Spec?

Thanks,

Andrew Fish

PS 
<Grumpy Old Man>
I really hate when folks take the architecturally defined strings in the gEfiGlobalVariableGuid name space and obfuscate them with #defines. Especially when it is not done in a non-consistent way. The #define solves nothing, and obfuscates reading the code. In general in the edk2 we follow the type system in the UEFI spec, and there is is only the Unicode string for variables, not a #define value. 

Lets be real if the UEFI spec ever changed the  L"HwErrRecSupport" it would have to be tied to spec version, so all the places that used that variable would need the spec revision check and the #define is still just obfuscation and the code is not constructed with a version check. 
</Grumpy Old Man>

> On Jul 3, 2018, at 6:21 PM, Toan Le manh <lemanhtoantb@gmail.com> wrote:
> 
> Hi Andrew,
> 
> I'm trying to set some variables to NVRAM at the beginning of BDS phase.
> For example, this function returned EFI_ACCESS_DENIED
>    Status = gRT->SetVariable (
>                    L"HwErrRecSupport",
>                    &gEfiGlobalVariableGuid,
>                    EFI_VARIABLE_BOOTSERVICE_ACCESS |
> EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_NON_VOLATILE,
>                    sizeof (UINT16),
>                    &HardwareErrorRecordLevel
>                    );
> 
> Thanks & BRs,
> Toan