SecurityPkg: AuthVariableLib: Revert UserPhysicalPresent feature from AuthVariableLib

Physical Presence state reporting is constrained by physical presence caching in variable driver. For example, reporting must be prior to Physical Presence caching. Physical Presence state becomes constant rather than instant after caching. Therefore, PlatformSecureLib is responsible for reporting Physical Presence state in expected way.

This reverts commit 90fa53213ec458b5c4f8851c09aeb3de977531e5.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Yao Jiewen <jiewen.yao@intel.com>

diff --git a/SecurityPkg/Library/AuthVariableLib/AuthService.c b/SecurityPkg/Library/AuthVariableLib/AuthService.c
index 1d49b6a16e49b2b93814fef3fea179c2444c2629..6e1e284801124cb71c1982aea8ee27becd7d3968 100644 (file)
--- a/SecurityPkg/Library/AuthVariableLib/AuthService.c
+++ b/SecurityPkg/Library/AuthVariableLib/AuthService.c
@@ -931,7 +931,7 @@ ProcessVarWithPk (
   // Init state of Del. State may change due to secure check\r
   //\r
   Del = FALSE;\r
   // Init state of Del. State may change due to secure check\r
   //\r
   Del = FALSE;\r

-  if ((InCustomMode() && mUserPhysicalPresent) || (mPlatformMode == SETUP_MODE && !IsPk)) {\r
+  if ((InCustomMode() && UserPhysicalPresent()) || (mPlatformMode == SETUP_MODE && !IsPk)) {\r

     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);\r
     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);\r
     if (PayloadSize == 0) {\r
     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);\r
     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);\r
     if (PayloadSize == 0) {\r


@@ -1049,7 +1049,7 @@ ProcessVarWithKek (
   }\r
 \r
   Status = EFI_SUCCESS;\r
   }\r
 \r
   Status = EFI_SUCCESS;\r

-  if (mPlatformMode == USER_MODE && !(InCustomMode() && mUserPhysicalPresent)) {\r
+  if (mPlatformMode == USER_MODE && !(InCustomMode() && UserPhysicalPresent())) {\r

     //\r
     // Time-based, verify against X509 Cert KEK.\r
     //\r
     //\r
     // Time-based, verify against X509 Cert KEK.\r
     //\r


@@ -1204,7 +1204,7 @@ ProcessVariable (
              &OrgVariableInfo\r
              );\r
 \r
              &OrgVariableInfo\r
              );\r
 \r

-  if ((!EFI_ERROR (Status)) && IsDeleteAuthVariable (OrgVariableInfo.Attributes, Data, DataSize, Attributes) && mUserPhysicalPresent) {\r
+  if ((!EFI_ERROR (Status)) && IsDeleteAuthVariable (OrgVariableInfo.Attributes, Data, DataSize, Attributes) && UserPhysicalPresent()) {\r

     //\r
     // Allow the delete operation of common authenticated variable at user physical presence.\r
     //\r
     //\r
     // Allow the delete operation of common authenticated variable at user physical presence.\r
     //\r


@@ -1222,7 +1222,7 @@ ProcessVariable (
     return Status;\r
   }\r
 \r
     return Status;\r
   }\r
 \r

-  if (NeedPhysicallyPresent (VariableName, VendorGuid) && !mUserPhysicalPresent) {\r
+  if (NeedPhysicallyPresent (VariableName, VendorGuid) && !UserPhysicalPresent()) {\r

     //\r
     // This variable is protected, only physical present user could modify its value.\r
     //\r
     //\r
     // This variable is protected, only physical present user could modify its value.\r
     //\r

diff --git a/SecurityPkg/Library/AuthVariableLib/AuthServiceInternal.h b/SecurityPkg/Library/AuthVariableLib/AuthServiceInternal.h
index ac7ea89a803866cb53cb620fe2772d100bfd31f2..e7c4bf043d94d90924310fe3414ac4bb82664222 100644 (file)
--- a/SecurityPkg/Library/AuthVariableLib/AuthServiceInternal.h
+++ b/SecurityPkg/Library/AuthVariableLib/AuthServiceInternal.h
@@ -128,7 +128,6 @@ extern UINT8    *mCertDbStore;
 extern UINT32   mMaxCertDbSize;\r
 extern UINT32   mPlatformMode;\r
 extern UINT8    mVendorKeyState;\r
 extern UINT32   mMaxCertDbSize;\r
 extern UINT32   mPlatformMode;\r
 extern UINT8    mVendorKeyState;\r

-extern BOOLEAN  mUserPhysicalPresent;\r

 \r
 extern VOID     *mHashCtx;\r
 \r
 \r
 extern VOID     *mHashCtx;\r
 \r

diff --git a/SecurityPkg/Library/AuthVariableLib/AuthVariableLib.c b/SecurityPkg/Library/AuthVariableLib/AuthVariableLib.c
index dd35a444092e6e293dc29c4e538f41e2f7c08a1a..c4fbb649f1fd0335e44df1ceb049cb0d385d5871 100644 (file)
--- a/SecurityPkg/Library/AuthVariableLib/AuthVariableLib.c
+++ b/SecurityPkg/Library/AuthVariableLib/AuthVariableLib.c
@@ -35,7 +35,6 @@ UINT8    *mCertDbStore;
 UINT32   mMaxCertDbSize;\r
 UINT32   mPlatformMode;\r
 UINT8    mVendorKeyState;\r
 UINT32   mMaxCertDbSize;\r
 UINT32   mPlatformMode;\r
 UINT8    mVendorKeyState;\r

-BOOLEAN  mUserPhysicalPresent;\r

 \r
 EFI_GUID mSignatureSupport[] = {EFI_CERT_SHA1_GUID, EFI_CERT_SHA256_GUID, EFI_CERT_RSA2048_GUID, EFI_CERT_X509_GUID};\r
 \r
 \r
 EFI_GUID mSignatureSupport[] = {EFI_CERT_SHA1_GUID, EFI_CERT_SHA256_GUID, EFI_CERT_RSA2048_GUID, EFI_CERT_X509_GUID};\r
 \r


@@ -436,12 +435,6 @@ AuthVariableLibInitialize (
   AuthVarLibContextOut->AddressPointer = mAuthVarAddressPointer;\r
   AuthVarLibContextOut->AddressPointerCount = sizeof (mAuthVarAddressPointer) / sizeof (mAuthVarAddressPointer[0]);\r
 \r
   AuthVarLibContextOut->AddressPointer = mAuthVarAddressPointer;\r
   AuthVarLibContextOut->AddressPointerCount = sizeof (mAuthVarAddressPointer) / sizeof (mAuthVarAddressPointer[0]);\r
 \r

-  //\r
-  // Cache UserPhysicalPresent State. \r
-  // Platform should report PhysicalPresent before this point\r
-  //\r
-  mUserPhysicalPresent = UserPhysicalPresent();\r
-\r

   return Status;\r
 }\r
 \r
   return Status;\r
 }\r
 \r