[edk2-devel] [Patch 1/1] MdeModulePkg/Library/VarCheckLib: Allow SetVariable from SMM

[Wu, Hao A]

> -----Original Message-----
> From: Michael D Kinney <michael.d.kinney at intel.com>
> Sent: Wednesday, January 6, 2021 11:51 AM
> To: devel at edk2.groups.io
> Cc: Bret Barkelew <Bret.Barkelew at microsoft.com>; Wu, Hao A
> <hao.a.wu at intel.com>; Liming Gao <gaoliming at byosoft.com.cn>
> Subject: [Patch 1/1] MdeModulePkg/Library/VarCheckLib: Allow SetVariable
> from SMM
> 
> REF: https://bugzilla.tianocore.org/show_bug.cgi?id=3154
> 
> Update VarCheckLibSetVariableCheck() to allow locked variables to be
> updated if the RequestSource is VarCheckFromTrusted even if one or more
> variable check handlers return EFI_WRITE_PROTECTED.
> RequestSource is only set to VarCheckFromTrusted if the request is through
> the EFI_SMM_VARAIBLE_PROTOCOL.


Hello Mike,

Sorry for a question.

If a SetVar request is blocked by a registered VarCheck handler, I think it would better to change that handler to allow requests from SMM.
I am not sure if there is a VarCheck handler that has its own specific rule to return 'EFI_WRITE_PROTECTED' to block some SetVar requests.
Is there any special consideration (e.g. VarCheck handler not being able to get the source of the SetVar request) for not doing this way?

Thanks in advance.

Best Regards,
Hao Wu


> 
> Cc: Bret Barkelew <Bret.Barkelew at microsoft.com>
> Cc: Hao A Wu <hao.a.wu at intel.com>
> Cc: Liming Gao <gaoliming at byosoft.com.cn>
> Signed-off-by: Michael D Kinney <michael.d.kinney at intel.com>
> ---
>  MdeModulePkg/Library/VarCheckLib/VarCheckLib.c | 9 ++++++++-
>  1 file changed, 8 insertions(+), 1 deletion(-)
> 
> diff --git a/MdeModulePkg/Library/VarCheckLib/VarCheckLib.c
> b/MdeModulePkg/Library/VarCheckLib/VarCheckLib.c
> index 470d782444bf..9596d760e945 100644
> --- a/MdeModulePkg/Library/VarCheckLib/VarCheckLib.c
> +++ b/MdeModulePkg/Library/VarCheckLib/VarCheckLib.c
> @@ -1,7 +1,7 @@
>  /** @file
>    Implementation functions and structures for var check services.
> 
> -Copyright (c) 2015 - 2016, Intel Corporation. All rights reserved.<BR>
> +Copyright (c) 2015 - 2021, Intel Corporation. All rights reserved.<BR>
>  SPDX-License-Identifier: BSD-2-Clause-Patent
> 
>  **/
> @@ -655,6 +655,13 @@ VarCheckLibSetVariableCheck (
>                 DataSize,
>                 Data
>                 );
> +    if (Status == EFI_WRITE_PROTECTED && RequestSource ==
> VarCheckFromTrusted) {
> +      //
> +      // If RequestSource is trusted, then allow variable to be set even if it
> +      // is write protected.
> +      //
> +      continue;
> +    }
>      if (EFI_ERROR (Status)) {
>        DEBUG ((EFI_D_INFO, "Variable Check handler fail %r - %g:%s\n", Status,
> VendorGuid, VariableName));
>        return Status;
> --
> 2.29.2.windows.2



-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#69784): https://edk2.groups.io/g/devel/message/69784
Mute This Topic: https://groups.io/mt/79468410/1813853
Group Owner: devel+owner at edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [edk2-devel-archive at redhat.com]
-=-=-=-=-=-=-=-=-=-=-=-