MdeModulePkg: Deprecate EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS

Mark EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS as deprecated.
1. Make SetVariable/QueryVariableInfo return EFI_UNSUPPORTED with this
   attribute
2. No change to GetVariable/GetNextVariableName
Also update several function descriptors accordingly

Cc: Long Qin <qin.long@intel.com>
Cc: Star Zeng <star.zeng@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Long Qin <qin.long@intel.com>

diff --git a/MdeModulePkg/Include/Guid/VariableFormat.h b/MdeModulePkg/Include/Guid/VariableFormat.h
index ce71aab89889e8fe0c0365211af727f572873698..b0c2616c4d9a96f988925e8b2d6e2b184a41dffd 100644 (file)
--- a/MdeModulePkg/Include/Guid/VariableFormat.h
+++ b/MdeModulePkg/Include/Guid/VariableFormat.h
@@ -2,7 +2,7 @@
   The variable data structures are related to EDK II-specific implementation of UEFI variables.\r
   VariableFormat.h defines variable data headers and variable storage region headers.\r
 \r
   The variable data structures are related to EDK II-specific implementation of UEFI variables.\r
   VariableFormat.h defines variable data headers and variable storage region headers.\r
 \r

-Copyright (c) 2006 - 2016, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2006 - 2017, Intel Corporation. All rights reserved.<BR>\r

 This program and the accompanying materials are licensed and made available under\r
 the terms and conditions of the BSD License that accompanies this distribution.\r
 The full text of the license may be found at\r
 This program and the accompanying materials are licensed and made available under\r
 the terms and conditions of the BSD License that accompanies this distribution.\r
 The full text of the license may be found at\r


@@ -115,11 +115,16 @@ typedef struct {
 ///\r
 #define VARIABLE_ATTRIBUTE_NV_BS        (EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS)\r
 #define VARIABLE_ATTRIBUTE_BS_RT        (EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS)\r
 ///\r
 #define VARIABLE_ATTRIBUTE_NV_BS        (EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS)\r
 #define VARIABLE_ATTRIBUTE_BS_RT        (EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS)\r

-#define VARIABLE_ATTRIBUTE_AT_AW        (EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS)\r

 #define VARIABLE_ATTRIBUTE_BS_RT_AT     (VARIABLE_ATTRIBUTE_BS_RT | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)\r
 #define VARIABLE_ATTRIBUTE_NV_BS_RT     (VARIABLE_ATTRIBUTE_BS_RT | EFI_VARIABLE_NON_VOLATILE)\r
 #define VARIABLE_ATTRIBUTE_NV_BS_RT_HR  (VARIABLE_ATTRIBUTE_NV_BS_RT | EFI_VARIABLE_HARDWARE_ERROR_RECORD)\r
 #define VARIABLE_ATTRIBUTE_NV_BS_RT_AT  (VARIABLE_ATTRIBUTE_NV_BS_RT | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)\r
 #define VARIABLE_ATTRIBUTE_BS_RT_AT     (VARIABLE_ATTRIBUTE_BS_RT | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)\r
 #define VARIABLE_ATTRIBUTE_NV_BS_RT     (VARIABLE_ATTRIBUTE_BS_RT | EFI_VARIABLE_NON_VOLATILE)\r
 #define VARIABLE_ATTRIBUTE_NV_BS_RT_HR  (VARIABLE_ATTRIBUTE_NV_BS_RT | EFI_VARIABLE_HARDWARE_ERROR_RECORD)\r
 #define VARIABLE_ATTRIBUTE_NV_BS_RT_AT  (VARIABLE_ATTRIBUTE_NV_BS_RT | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)\r

+#define VARIABLE_ATTRIBUTE_AT           EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS\r
+#define VARIABLE_ATTRIBUTE_NV_BS_RT_HR_AT    (VARIABLE_ATTRIBUTE_NV_BS_RT_HR | VARIABLE_ATTRIBUTE_AT)\r
+///\r
+/// EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS is deprecated and should be considered as reserved\r
+///\r
+#define VARIABLE_ATTRIBUTE_AT_AW        (EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS)\r

 #define VARIABLE_ATTRIBUTE_NV_BS_RT_AW  (VARIABLE_ATTRIBUTE_NV_BS_RT | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS)\r
 #define VARIABLE_ATTRIBUTE_NV_BS_RT_HR_AT_AW    (VARIABLE_ATTRIBUTE_NV_BS_RT_HR | VARIABLE_ATTRIBUTE_AT_AW)\r
 \r
 #define VARIABLE_ATTRIBUTE_NV_BS_RT_AW  (VARIABLE_ATTRIBUTE_NV_BS_RT | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS)\r
 #define VARIABLE_ATTRIBUTE_NV_BS_RT_HR_AT_AW    (VARIABLE_ATTRIBUTE_NV_BS_RT_HR | VARIABLE_ATTRIBUTE_AT_AW)\r
 \r

diff --git a/MdeModulePkg/Include/Library/AuthVariableLib.h b/MdeModulePkg/Include/Library/AuthVariableLib.h
index 0731b8d748aeccd9c16967dfd35e7b0bf07b9281..bdf596337f398e4dfcc16142f934570601d6eab7 100644 (file)
--- a/MdeModulePkg/Include/Library/AuthVariableLib.h
+++ b/MdeModulePkg/Include/Library/AuthVariableLib.h
@@ -1,7 +1,7 @@
 /** @file\r
   Provides services to initialize and process authenticated variables.\r
 \r
 /** @file\r
   Provides services to initialize and process authenticated variables.\r
 \r

-Copyright (c) 2015, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2015 - 2017, Intel Corporation. All rights reserved.<BR>\r

 This program and the accompanying materials are licensed and made available under\r
 the terms and conditions of the BSD License that accompanies this distribution.\r
 The full text of the license may be found at\r
 This program and the accompanying materials are licensed and made available under\r
 the terms and conditions of the BSD License that accompanies this distribution.\r
 The full text of the license may be found at\r


@@ -228,7 +228,7 @@ AuthVariableLibInitialize (
   );\r
 \r
 /**\r
   );\r
 \r
 /**\r

-  Process variable with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS/EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.\r
+  Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.\r

 \r
   @param[in] VariableName           Name of the variable.\r
   @param[in] VendorGuid             Variable vendor GUID.\r
 \r
   @param[in] VariableName           Name of the variable.\r
   @param[in] VendorGuid             Variable vendor GUID.\r


@@ -241,8 +241,7 @@ AuthVariableLibInitialize (
   @retval EFI_INVALID_PARAMETER     Invalid parameter.\r
   @retval EFI_WRITE_PROTECTED       Variable is write-protected.\r
   @retval EFI_OUT_OF_RESOURCES      There is not enough resource.\r
   @retval EFI_INVALID_PARAMETER     Invalid parameter.\r
   @retval EFI_WRITE_PROTECTED       Variable is write-protected.\r
   @retval EFI_OUT_OF_RESOURCES      There is not enough resource.\r

-  @retval EFI_SECURITY_VIOLATION    The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS\r
-                                    or EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACESS\r
+  @retval EFI_SECURITY_VIOLATION    The variable is with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACESS\r

                                     set, but the AuthInfo does NOT pass the validation\r
                                     check carried out by the firmware.\r
   @retval EFI_UNSUPPORTED           Unsupported to process authenticated variable.\r
                                     set, but the AuthInfo does NOT pass the validation\r
                                     check carried out by the firmware.\r
   @retval EFI_UNSUPPORTED           Unsupported to process authenticated variable.\r

diff --git a/MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.c b/MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.c
index 054131fd3e6369c99bab75ca510957ae19eb383e..e5c2c8ce7daea4566608fb39ec9f8b9231d35004 100644 (file)
--- a/MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.c
+++ b/MdeModulePkg/Library/AuthVariableLibNull/AuthVariableLibNull.c
@@ -1,7 +1,7 @@
 /** @file\r
   Implements NULL authenticated variable services.\r
 \r
 /** @file\r
   Implements NULL authenticated variable services.\r
 \r

-Copyright (c) 2015, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2015 - 2017, Intel Corporation. All rights reserved.<BR>\r

 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r


@@ -43,7 +43,7 @@ AuthVariableLibInitialize (
 }\r
 \r
 /**\r
 }\r
 \r
 /**\r

-  Process variable with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS/EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.\r
+  Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.\r

 \r
   @param[in] VariableName           Name of the variable.\r
   @param[in] VendorGuid             Variable vendor GUID.\r
 \r
   @param[in] VariableName           Name of the variable.\r
   @param[in] VendorGuid             Variable vendor GUID.\r


@@ -56,8 +56,7 @@ AuthVariableLibInitialize (
   @retval EFI_INVALID_PARAMETER     Invalid parameter.\r
   @retval EFI_WRITE_PROTECTED       Variable is write-protected.\r
   @retval EFI_OUT_OF_RESOURCES      There is not enough resource.\r
   @retval EFI_INVALID_PARAMETER     Invalid parameter.\r
   @retval EFI_WRITE_PROTECTED       Variable is write-protected.\r
   @retval EFI_OUT_OF_RESOURCES      There is not enough resource.\r

-  @retval EFI_SECURITY_VIOLATION    The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS\r
-                                    or EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACESS\r
+  @retval EFI_SECURITY_VIOLATION    The variable is with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACESS\r

                                     set, but the AuthInfo does NOT pass the validation\r
                                     check carried out by the firmware.\r
   @retval EFI_UNSUPPORTED           Unsupported to process authenticated variable.\r
                                     set, but the AuthInfo does NOT pass the validation\r
                                     check carried out by the firmware.\r
   @retval EFI_UNSUPPORTED           Unsupported to process authenticated variable.\r

diff --git a/MdeModulePkg/Library/UefiBootManagerLib/BmMisc.c b/MdeModulePkg/Library/UefiBootManagerLib/BmMisc.c
index a3fa254245928656827c6ddc74aa7f91fd9e855c..81d365940043c9bcf1ea28195c977bd789249df6 100644 (file)
--- a/MdeModulePkg/Library/UefiBootManagerLib/BmMisc.c
+++ b/MdeModulePkg/Library/UefiBootManagerLib/BmMisc.c
@@ -305,8 +305,7 @@ BmSetMemoryTypeInformationVariable (
   @param  VendorGuid             A unique identifier for the vendor.\r
   @param  Attributes             Attributes bitmask to set for the variable.\r
   @param  DataSize               The size in bytes of the Data buffer. Unless the EFI_VARIABLE_APPEND_WRITE, \r
   @param  VendorGuid             A unique identifier for the vendor.\r
   @param  Attributes             Attributes bitmask to set for the variable.\r
   @param  DataSize               The size in bytes of the Data buffer. Unless the EFI_VARIABLE_APPEND_WRITE, \r

-                                 EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS, or \r
-                                 EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS attribute is set, a size of zero \r
+                                 or EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS attribute is set, a size of zero\r

                                  causes the variable to be deleted. When the EFI_VARIABLE_APPEND_WRITE attribute is \r
                                  set, then a SetVariable() call with a DataSize of zero will not cause any change to \r
                                  the variable value (the timestamp associated with the variable may be updated however \r
                                  causes the variable to be deleted. When the EFI_VARIABLE_APPEND_WRITE attribute is \r
                                  set, then a SetVariable() call with a DataSize of zero will not cause any change to \r
                                  the variable value (the timestamp associated with the variable may be updated however \r


@@ -324,9 +323,8 @@ BmSetMemoryTypeInformationVariable (
   @retval EFI_DEVICE_ERROR       The variable could not be retrieved due to a hardware error.\r
   @retval EFI_WRITE_PROTECTED    The variable in question is read-only.\r
   @retval EFI_WRITE_PROTECTED    The variable in question cannot be deleted.\r
   @retval EFI_DEVICE_ERROR       The variable could not be retrieved due to a hardware error.\r
   @retval EFI_WRITE_PROTECTED    The variable in question is read-only.\r
   @retval EFI_WRITE_PROTECTED    The variable in question cannot be deleted.\r

-  @retval EFI_SECURITY_VIOLATION The variable could not be written due to EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS \r
-                                 or EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACESS being set, but the AuthInfo \r
-                                 does NOT pass the validation check carried out by the firmware.\r
+  @retval EFI_SECURITY_VIOLATION The variable could not be written due to EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACESS\r
+                                 being set, but the AuthInfo does NOT pass the validation check carried out by the firmware.\r

 \r
   @retval EFI_NOT_FOUND          The variable trying to be updated or deleted was not found.\r
 **/\r
 \r
   @retval EFI_NOT_FOUND          The variable trying to be updated or deleted was not found.\r
 **/\r

diff --git a/MdeModulePkg/Library/UefiBootManagerLib/InternalBm.h b/MdeModulePkg/Library/UefiBootManagerLib/InternalBm.h
index ef09050a1a708319b48d476bdb003d802c12556f..0224bd34a9ed92fbfc7e4bcdfe29bae91916d1f0 100644 (file)
--- a/MdeModulePkg/Library/UefiBootManagerLib/InternalBm.h
+++ b/MdeModulePkg/Library/UefiBootManagerLib/InternalBm.h
@@ -275,8 +275,7 @@ BmStopHotkeyService (
   @param  VendorGuid             A unique identifier for the vendor.\r
   @param  Attributes             Attributes bitmask to set for the variable.\r
   @param  DataSize               The size in bytes of the Data buffer. Unless the EFI_VARIABLE_APPEND_WRITE, \r
   @param  VendorGuid             A unique identifier for the vendor.\r
   @param  Attributes             Attributes bitmask to set for the variable.\r
   @param  DataSize               The size in bytes of the Data buffer. Unless the EFI_VARIABLE_APPEND_WRITE, \r

-                                 EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS, or \r
-                                 EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS attribute is set, a size of zero \r
+                                 or EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS attribute is set, a size of zero\r

                                  causes the variable to be deleted. When the EFI_VARIABLE_APPEND_WRITE attribute is \r
                                  set, then a SetVariable() call with a DataSize of zero will not cause any change to \r
                                  the variable value (the timestamp associated with the variable may be updated however \r
                                  causes the variable to be deleted. When the EFI_VARIABLE_APPEND_WRITE attribute is \r
                                  set, then a SetVariable() call with a DataSize of zero will not cause any change to \r
                                  the variable value (the timestamp associated with the variable may be updated however \r


@@ -294,9 +293,8 @@ BmStopHotkeyService (
   @retval EFI_DEVICE_ERROR       The variable could not be retrieved due to a hardware error.\r
   @retval EFI_WRITE_PROTECTED    The variable in question is read-only.\r
   @retval EFI_WRITE_PROTECTED    The variable in question cannot be deleted.\r
   @retval EFI_DEVICE_ERROR       The variable could not be retrieved due to a hardware error.\r
   @retval EFI_WRITE_PROTECTED    The variable in question is read-only.\r
   @retval EFI_WRITE_PROTECTED    The variable in question cannot be deleted.\r

-  @retval EFI_SECURITY_VIOLATION The variable could not be written due to EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS \r
-                                 or EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACESS being set, but the AuthInfo \r
-                                 does NOT pass the validation check carried out by the firmware.\r
+  @retval EFI_SECURITY_VIOLATION The variable could not be written due to EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACESS\r
+                                 being set, but the AuthInfo does NOT pass the validation check carried out by the firmware.\r

 \r
   @retval EFI_NOT_FOUND          The variable trying to be updated or deleted was not found.\r
 **/\r
 \r
   @retval EFI_NOT_FOUND          The variable trying to be updated or deleted was not found.\r
 **/\r

diff --git a/MdeModulePkg/Universal/BdsDxe/Bds.h b/MdeModulePkg/Universal/BdsDxe/Bds.h
index 1f8a1924241bafa1108555f938e5e33866936085..5658e61beeb7ac82b564a2d2f733805902163fc7 100644 (file)
--- a/MdeModulePkg/Universal/BdsDxe/Bds.h
+++ b/MdeModulePkg/Universal/BdsDxe/Bds.h
@@ -1,7 +1,7 @@
 /** @file\r
   Head file for BDS Architectural Protocol implementation\r
 \r
 /** @file\r
   Head file for BDS Architectural Protocol implementation\r
 \r

-Copyright (c) 2004 - 2016, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2004 - 2017, Intel Corporation. All rights reserved.<BR>\r

 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r


@@ -80,8 +80,7 @@ BdsEntry (
   @param  VendorGuid             A unique identifier for the vendor.\r
   @param  Attributes             Attributes bitmask to set for the variable.\r
   @param  DataSize               The size in bytes of the Data buffer. Unless the EFI_VARIABLE_APPEND_WRITE, \r
   @param  VendorGuid             A unique identifier for the vendor.\r
   @param  Attributes             Attributes bitmask to set for the variable.\r
   @param  DataSize               The size in bytes of the Data buffer. Unless the EFI_VARIABLE_APPEND_WRITE, \r

-                                 EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS, or \r
-                                 EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS attribute is set, a size of zero \r
+                                 or EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS attribute is set, a size of zero\r

                                  causes the variable to be deleted. When the EFI_VARIABLE_APPEND_WRITE attribute is \r
                                  set, then a SetVariable() call with a DataSize of zero will not cause any change to \r
                                  the variable value (the timestamp associated with the variable may be updated however \r
                                  causes the variable to be deleted. When the EFI_VARIABLE_APPEND_WRITE attribute is \r
                                  set, then a SetVariable() call with a DataSize of zero will not cause any change to \r
                                  the variable value (the timestamp associated with the variable may be updated however \r


@@ -99,9 +98,8 @@ BdsEntry (
   @retval EFI_DEVICE_ERROR       The variable could not be retrieved due to a hardware error.\r
   @retval EFI_WRITE_PROTECTED    The variable in question is read-only.\r
   @retval EFI_WRITE_PROTECTED    The variable in question cannot be deleted.\r
   @retval EFI_DEVICE_ERROR       The variable could not be retrieved due to a hardware error.\r
   @retval EFI_WRITE_PROTECTED    The variable in question is read-only.\r
   @retval EFI_WRITE_PROTECTED    The variable in question cannot be deleted.\r

-  @retval EFI_SECURITY_VIOLATION The variable could not be written due to EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS \r
-                                 or EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACESS being set, but the AuthInfo \r
-                                 does NOT pass the validation check carried out by the firmware.\r
+  @retval EFI_SECURITY_VIOLATION The variable could not be written due to EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACESS\r
+                                 being set, but the AuthInfo does NOT pass the validation check carried out by the firmware.\r

 \r
   @retval EFI_NOT_FOUND          The variable trying to be updated or deleted was not found.\r
 **/\r
 \r
   @retval EFI_NOT_FOUND          The variable trying to be updated or deleted was not found.\r
 **/\r

diff --git a/MdeModulePkg/Universal/BdsDxe/BdsEntry.c b/MdeModulePkg/Universal/BdsDxe/BdsEntry.c
index a6fe617b56939ea169a86e113fb6d52e9b5d3a13..dccc4909021967cf1bf2cbf4409aaf4cfbc6a3b0 100644 (file)
--- a/MdeModulePkg/Universal/BdsDxe/BdsEntry.c
+++ b/MdeModulePkg/Universal/BdsDxe/BdsEntry.c
@@ -1112,8 +1112,7 @@ BdsEntry (
   @param  VendorGuid             A unique identifier for the vendor.\r
   @param  Attributes             Attributes bitmask to set for the variable.\r
   @param  DataSize               The size in bytes of the Data buffer. Unless the EFI_VARIABLE_APPEND_WRITE, \r
   @param  VendorGuid             A unique identifier for the vendor.\r
   @param  Attributes             Attributes bitmask to set for the variable.\r
   @param  DataSize               The size in bytes of the Data buffer. Unless the EFI_VARIABLE_APPEND_WRITE, \r

-                                 EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS, or \r
-                                 EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS attribute is set, a size of zero \r
+                                 or EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS attribute is set, a size of zero\r

                                  causes the variable to be deleted. When the EFI_VARIABLE_APPEND_WRITE attribute is \r
                                  set, then a SetVariable() call with a DataSize of zero will not cause any change to \r
                                  the variable value (the timestamp associated with the variable may be updated however \r
                                  causes the variable to be deleted. When the EFI_VARIABLE_APPEND_WRITE attribute is \r
                                  set, then a SetVariable() call with a DataSize of zero will not cause any change to \r
                                  the variable value (the timestamp associated with the variable may be updated however \r


@@ -1131,9 +1130,8 @@ BdsEntry (
   @retval EFI_DEVICE_ERROR       The variable could not be retrieved due to a hardware error.\r
   @retval EFI_WRITE_PROTECTED    The variable in question is read-only.\r
   @retval EFI_WRITE_PROTECTED    The variable in question cannot be deleted.\r
   @retval EFI_DEVICE_ERROR       The variable could not be retrieved due to a hardware error.\r
   @retval EFI_WRITE_PROTECTED    The variable in question is read-only.\r
   @retval EFI_WRITE_PROTECTED    The variable in question cannot be deleted.\r

-  @retval EFI_SECURITY_VIOLATION The variable could not be written due to EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS \r
-                                 or EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACESS being set, but the AuthInfo \r
-                                 does NOT pass the validation check carried out by the firmware.\r
+  @retval EFI_SECURITY_VIOLATION The variable could not be written due to EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACESS\r
+                                 being set, but the AuthInfo does NOT pass the validation check carried out by the firmware.\r

 \r
   @retval EFI_NOT_FOUND          The variable trying to be updated or deleted was not found.\r
 **/\r
 \r
   @retval EFI_NOT_FOUND          The variable trying to be updated or deleted was not found.\r
 **/\r

diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c b/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c
index 93a300a84677618c9bee06c381e6274db37c2802..c26616ecfe769a76263e70a2459fc1f786354f48 100644 (file)
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c
@@ -4,7 +4,7 @@
   This module initilizes MemoryOverwriteRequestControlLock variable.\r
   This module adds Variable Hook and check MemoryOverwriteRequestControlLock.\r
 \r
   This module initilizes MemoryOverwriteRequestControlLock variable.\r
   This module adds Variable Hook and check MemoryOverwriteRequestControlLock.\r
 \r

-Copyright (c) 2016, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2016 - 2017, Intel Corporation. All rights reserved.<BR>\r

 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r


@@ -116,7 +116,7 @@ IsMorLockVariable (
   @retval  EFI_DEVICE_ERROR       The variable could not be saved due to a hardware failure.\r
   @retval  EFI_WRITE_PROTECTED    The variable in question is read-only.\r
   @retval  EFI_WRITE_PROTECTED    The variable in question cannot be deleted.\r
   @retval  EFI_DEVICE_ERROR       The variable could not be saved due to a hardware failure.\r
   @retval  EFI_WRITE_PROTECTED    The variable in question is read-only.\r
   @retval  EFI_WRITE_PROTECTED    The variable in question cannot be deleted.\r

-  @retval  EFI_SECURITY_VIOLATION The variable could not be written due to EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS\r
+  @retval  EFI_SECURITY_VIOLATION The variable could not be written due to EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS\r

                                   set but the AuthInfo does NOT pass the validation check carried\r
                                   out by the firmware.\r
   @retval  EFI_NOT_FOUND          The variable trying to be updated or deleted was not found.\r
                                   set but the AuthInfo does NOT pass the validation check carried\r
                                   out by the firmware.\r
   @retval  EFI_NOT_FOUND          The variable trying to be updated or deleted was not found.\r

diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c b/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c
index d68dfbe648ce570bf614f717f251e44c0293075b..f39be6b0b4d1df92821966d501cd36d6adb34e99 100644 (file)
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c
@@ -3133,8 +3133,11 @@ VariableServiceSetVariable (
 \r
   //\r
   // Check for reserverd bit in variable attribute.\r
 \r
   //\r
   // Check for reserverd bit in variable attribute.\r

+  // EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS is deprecated but we still allow\r
+  // the delete operation of common authenticated variable at user physical presence.\r
+  // So leave EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS attribute check to AuthVariableLib\r

   //\r
   //\r

-  if ((Attributes & (~EFI_VARIABLE_ATTRIBUTES_MASK)) != 0) {\r
+  if ((Attributes & (~(EFI_VARIABLE_ATTRIBUTES_MASK | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS))) != 0) {\r

     return EFI_INVALID_PARAMETER;\r
   }\r
 \r
     return EFI_INVALID_PARAMETER;\r
   }\r
 \r

diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.h b/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.h
index ec9b9849ec099b0261558d066e3ad8c751affe9c..b35e8ab912733114cfbe3d7f9e1a1bc4ad0ac0e0 100644 (file)
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.h
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.h
@@ -50,7 +50,6 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
                                       EFI_VARIABLE_BOOTSERVICE_ACCESS | \\r
                                       EFI_VARIABLE_RUNTIME_ACCESS | \\r
                                       EFI_VARIABLE_HARDWARE_ERROR_RECORD | \\r
                                       EFI_VARIABLE_BOOTSERVICE_ACCESS | \\r
                                       EFI_VARIABLE_RUNTIME_ACCESS | \\r
                                       EFI_VARIABLE_HARDWARE_ERROR_RECORD | \\r

-                                      EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | \\r

                                       EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS | \\r
                                       EFI_VARIABLE_APPEND_WRITE)\r
 \r
                                       EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS | \\r
                                       EFI_VARIABLE_APPEND_WRITE)\r
 \r