Fix a bug that “SecureBoot” varaible will be updated to NV+AT attribute incorrectly.

Signed-off-by: Fu Siyuan <siyuan.fu@intel.com>
Reviewed-by: Ni Ruiyu <ruiyu.ni@intel.com>
Reviewed-by: Dong Guo <guo.dong@intel.com>
git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@14375 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
index 5bc29cf1458864a00ea0ccc8dd79419d51ddf4c2..9e4bf8681b959a12bbe5906c4647e534a67eceaa 100644 (file)
--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
+++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.c
@@ -1347,53 +1347,6 @@ Done:
   return Status;\r
 }\r
 \r
-/**\r
-  When VariableWriteArchProtocol install, create "SecureBoot" variable.\r
-\r
-  @param[in] Event    Event whose notification function is being invoked.\r
-  @param[in] Context  Pointer to the notification function's context.\r
-\r
-**/\r
-VOID\r
-EFIAPI\r
-VariableWriteCallBack (\r
-  IN  EFI_EVENT                           Event,\r
-  IN  VOID                                *Context\r
-  )\r
-{\r
-  UINT8                       SecureBootMode;\r
-  UINT8                       *SecureBootModePtr;\r
-  EFI_STATUS                  Status;\r
-  VOID                        *ProtocolPointer;\r
-\r
-  Status = gBS->LocateProtocol (&gEfiVariableWriteArchProtocolGuid, NULL, &ProtocolPointer);\r
-  if (EFI_ERROR (Status)) {\r
-    return;\r
-  }\r
-\r
-  //\r
-  // Check whether "SecureBoot" variable exists.\r
-  // If this library is built-in, it means firmware has capability to perform\r
-  // driver signing verification.\r
-  //\r
-  GetEfiGlobalVariable2 (EFI_SECURE_BOOT_MODE_NAME, (VOID**)&SecureBootModePtr, NULL);\r
-  if (SecureBootModePtr == NULL) {\r
-    SecureBootMode   = SECURE_BOOT_MODE_DISABLE;\r
-    //\r
-    // Authenticated variable driver will update "SecureBoot" depending on SetupMode variable.\r
-    //\r
-    gRT->SetVariable (\r
-           EFI_SECURE_BOOT_MODE_NAME,\r
-           &gEfiGlobalVariableGuid,\r
-           EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_NON_VOLATILE,\r
-           sizeof (UINT8),\r
-           &SecureBootMode\r
-           );\r
-  } else {\r
-    FreePool (SecureBootModePtr);\r
-  }\r
-}\r
-\r
 /**\r
   Register security measurement handler.\r
 \r
@@ -1409,19 +1362,6 @@ DxeImageVerificationLibConstructor (
   IN EFI_SYSTEM_TABLE  *SystemTable\r
   )\r
 {\r
-  VOID                *Registration;\r
-\r
-  //\r
-  // Register callback function upon VariableWriteArchProtocol.\r
-  //\r
-  EfiCreateProtocolNotifyEvent (\r
-    &gEfiVariableWriteArchProtocolGuid,\r
-    TPL_CALLBACK,\r
-    VariableWriteCallBack,\r
-    NULL,\r
-    &Registration\r
-    );\r
-\r
   return RegisterSecurity2Handler (\r
           DxeImageVerificationHandler,\r
           EFI_AUTH_OPERATION_VERIFY_IMAGE | EFI_AUTH_OPERATION_IMAGE_REQUIRED\r

diff --git a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf
index dd03b0bf8a2023a0e31b3a1a7216cf2a3d817f90..0c6ab968f0c11f41a5fe9c4f1e0c9ee7642203cb 100644 (file)
--- a/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf
+++ b/SecurityPkg/Library/DxeImageVerificationLib/DxeImageVerificationLib.inf
@@ -7,7 +7,7 @@
 #  This external input must be validated carefully to avoid security issue like\r
 #  buffer overflow, integer overflow.\r
 #\r
-# Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>\r
+# Copyright (c) 2009 - 2013, Intel Corporation. All rights reserved.<BR>\r
 # This program and the accompanying materials\r
 # are licensed and made available under the terms and conditions of the BSD License\r
 # which accompanies this distribution. The full text of the license may be found at\r
@@ -59,7 +59,6 @@
   gEfiFirmwareVolume2ProtocolGuid\r
   gEfiBlockIoProtocolGuid\r
   gEfiSimpleFileSystemProtocolGuid\r
-  gEfiVariableWriteArchProtocolGuid\r
   \r
 [Guids]\r
   gEfiCertTypeRsa2048Sha256Guid\r

diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c b/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c
index 440ede9144db4cecde60dc730b50352deffe9875..7da0d63aba90dc86448cd9b46b4e8512afd386af 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c
+++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c
@@ -675,7 +675,6 @@ UpdatePlatformMode (
 {\r
   EFI_STATUS              Status;\r
   VARIABLE_POINTER_TRACK  Variable;\r
-  UINT32                  VarAttr;\r
   UINT8                   SecureBootMode;\r
   UINT8                   SecureBootEnable;\r
   UINTN                   VariableDataSize;\r
@@ -736,13 +735,12 @@ UpdatePlatformMode (
     }\r
   }\r
 \r
-  VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;\r
   Status  = UpdateVariable (\r
               EFI_SECURE_BOOT_MODE_NAME,\r
               &gEfiGlobalVariableGuid,\r
               &SecureBootMode,\r
               sizeof(UINT8),\r
-              VarAttr,\r
+              EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,\r
               0,\r
               0,\r
               &Variable,\r