MdeModulePkg: Change TCG MOR variables to use VariablePolicy

https://bugzilla.tianocore.org/show_bug.cgi?id=2522

These were previously using VarLock, which is
being deprecated.

Cc: Jian J Wang <jian.j.wang@intel.com>
Cc: Hao A Wu <hao.a.wu@intel.com>
Cc: Liming Gao <liming.gao@intel.com>
Cc: Bret Barkelew <brbarkel@microsoft.com>
Signed-off-by: Bret Barkelew <brbarkel@microsoft.com>
Reviewed-by: Dandan Bi <dandan.bi@intel.com>
Acked-by: Jian J Wang <jian.j.wang@intel.com>

diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c b/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c
index e7accf4ed80638609eabb684b6a76259f9415a75..b85f08c48c1130eca8191367fc7aee68eb599cbf 100644 (file)
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c
@@ -5,6 +5,7 @@
   MOR lock control unsupported.\r
 \r
 Copyright (c) 2016, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) Microsoft Corporation.\r
 SPDX-License-Identifier: BSD-2-Clause-Patent\r
 \r
 **/\r
@@ -17,7 +18,8 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #include <Library/BaseMemoryLib.h>\r
 #include "Variable.h"\r
 \r
-extern EDKII_VARIABLE_LOCK_PROTOCOL     mVariableLock;\r
+#include <Protocol/VariablePolicy.h>\r
+#include <Library/VariablePolicyHelperLib.h>\r
 \r
 /**\r
   This service is an MOR/MorLock checker handler for the SetVariable().\r
@@ -77,11 +79,6 @@ MorLockInit (
     NULL                                        // Data\r
     );\r
 \r
-  //\r
-  // Need set this variable to be read-only to prevent other module set it.\r
-  //\r
-  VariableLockRequestToLock (&mVariableLock, MEMORY_OVERWRITE_REQUEST_CONTROL_LOCK_NAME, &gEfiMemoryOverwriteRequestControlLockGuid);\r
-\r
   //\r
   // The MOR variable can effectively improve platform security only when the\r
   // MorLock variable protects the MOR variable. In turn MorLock cannot be made\r
@@ -99,11 +96,6 @@ MorLockInit (
     0,                                      // DataSize\r
     NULL                                    // Data\r
     );\r
-  VariableLockRequestToLock (\r
-    &mVariableLock,\r
-    MEMORY_OVERWRITE_REQUEST_VARIABLE_NAME,\r
-    &gEfiMemoryOverwriteControlDataGuid\r
-    );\r
 \r
   return EFI_SUCCESS;\r
 }\r
@@ -118,7 +110,39 @@ MorLockInitAtEndOfDxe (
   VOID\r
   )\r
 {\r
-  //\r
-  // Do nothing.\r
-  //\r
+  EFI_STATUS                        Status;\r
+  EDKII_VARIABLE_POLICY_PROTOCOL    *VariablePolicy;\r
+\r
+  // First, we obviously need to locate the VariablePolicy protocol.\r
+  Status = gBS->LocateProtocol( &gEdkiiVariablePolicyProtocolGuid, NULL, (VOID**)&VariablePolicy );\r
+  if (EFI_ERROR( Status )) {\r
+    DEBUG(( DEBUG_ERROR, "%a - Could not locate VariablePolicy protocol! %r\n", __FUNCTION__, Status ));\r
+    return;\r
+  }\r
+\r
+  // If we're successful, go ahead and set the policies to protect the target variables.\r
+  Status = RegisterBasicVariablePolicy( VariablePolicy,\r
+                                        &gEfiMemoryOverwriteRequestControlLockGuid,\r
+                                        MEMORY_OVERWRITE_REQUEST_CONTROL_LOCK_NAME,\r
+                                        VARIABLE_POLICY_NO_MIN_SIZE,\r
+                                        VARIABLE_POLICY_NO_MAX_SIZE,\r
+                                        VARIABLE_POLICY_NO_MUST_ATTR,\r
+                                        VARIABLE_POLICY_NO_CANT_ATTR,\r
+                                        VARIABLE_POLICY_TYPE_LOCK_NOW );\r
+  if (EFI_ERROR( Status )) {\r
+    DEBUG(( DEBUG_ERROR, "%a - Could not lock variable %s! %r\n", __FUNCTION__, MEMORY_OVERWRITE_REQUEST_CONTROL_LOCK_NAME, Status ));\r
+  }\r
+  Status = RegisterBasicVariablePolicy( VariablePolicy,\r
+                                        &gEfiMemoryOverwriteControlDataGuid,\r
+                                        MEMORY_OVERWRITE_REQUEST_VARIABLE_NAME,\r
+                                        VARIABLE_POLICY_NO_MIN_SIZE,\r
+                                        VARIABLE_POLICY_NO_MAX_SIZE,\r
+                                        VARIABLE_POLICY_NO_MUST_ATTR,\r
+                                        VARIABLE_POLICY_NO_CANT_ATTR,\r
+                                        VARIABLE_POLICY_TYPE_LOCK_NOW );\r
+  if (EFI_ERROR( Status )) {\r
+    DEBUG(( DEBUG_ERROR, "%a - Could not lock variable %s! %r\n", __FUNCTION__, MEMORY_OVERWRITE_REQUEST_VARIABLE_NAME, Status ));\r
+  }\r
+\r
+  return;\r
 }\r

diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c b/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c
index 085f82035f4b90fa0edefeee6753049c82eac250..ee37942a6b0c6795da61eb9feed9974cef7db26d 100644 (file)
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c
@@ -19,7 +19,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent
 #include "Variable.h"\r
 \r
 #include <Protocol/VariablePolicy.h>\r
-\r
+#include <Library/VariablePolicyHelperLib.h>\r
 #include <Library/VariablePolicyLib.h>\r
 \r
 typedef struct {\r
@@ -422,6 +422,8 @@ MorLockInitAtEndOfDxe (
 {\r
   UINTN      MorSize;\r
   EFI_STATUS MorStatus;\r
+  EFI_STATUS              Status;\r
+  VARIABLE_POLICY_ENTRY   *NewPolicy;\r
 \r
   if (!mMorLockInitializationRequired) {\r
     //\r
@@ -494,11 +496,25 @@ MorLockInitAtEndOfDxe (
   // The MOR variable is absent; the platform firmware does not support it.\r
   // Lock the variable so that no other module may create it.\r
   //\r
-  VariableLockRequestToLock (\r
-    NULL,                                   // This\r
-    MEMORY_OVERWRITE_REQUEST_VARIABLE_NAME,\r
-    &gEfiMemoryOverwriteControlDataGuid\r
-    );\r
+  NewPolicy = NULL;\r
+  Status = CreateBasicVariablePolicy( &gEfiMemoryOverwriteControlDataGuid,\r
+                                      MEMORY_OVERWRITE_REQUEST_VARIABLE_NAME,\r
+                                      VARIABLE_POLICY_NO_MIN_SIZE,\r
+                                      VARIABLE_POLICY_NO_MAX_SIZE,\r
+                                      VARIABLE_POLICY_NO_MUST_ATTR,\r
+                                      VARIABLE_POLICY_NO_CANT_ATTR,\r
+                                      VARIABLE_POLICY_TYPE_LOCK_NOW,\r
+                                      &NewPolicy );\r
+  if (!EFI_ERROR( Status )) {\r
+    Status = RegisterVariablePolicy( NewPolicy );\r
+  }\r
+  if (EFI_ERROR( Status )) {\r
+    DEBUG(( DEBUG_ERROR, "%a - Failed to lock variable %s! %r\n", __FUNCTION__, MEMORY_OVERWRITE_REQUEST_VARIABLE_NAME, Status ));\r
+    ASSERT_EFI_ERROR( Status );\r
+  }\r
+  if (NewPolicy != NULL) {\r
+    FreePool( NewPolicy );\r
+  }\r
 \r
   //\r
   // Delete the MOR Control Lock variable too (should it exists for some\r
@@ -514,9 +530,23 @@ MorLockInitAtEndOfDxe (
     );\r
   mMorLockPassThru = FALSE;\r
 \r
-  VariableLockRequestToLock (\r
-    NULL,                                       // This\r
-    MEMORY_OVERWRITE_REQUEST_CONTROL_LOCK_NAME,\r
-    &gEfiMemoryOverwriteRequestControlLockGuid\r
-    );\r
+  NewPolicy = NULL;\r
+  Status = CreateBasicVariablePolicy( &gEfiMemoryOverwriteRequestControlLockGuid,\r
+                                      MEMORY_OVERWRITE_REQUEST_CONTROL_LOCK_NAME,\r
+                                      VARIABLE_POLICY_NO_MIN_SIZE,\r
+                                      VARIABLE_POLICY_NO_MAX_SIZE,\r
+                                      VARIABLE_POLICY_NO_MUST_ATTR,\r
+                                      VARIABLE_POLICY_NO_CANT_ATTR,\r
+                                      VARIABLE_POLICY_TYPE_LOCK_NOW,\r
+                                      &NewPolicy );\r
+  if (!EFI_ERROR( Status )) {\r
+    Status = RegisterVariablePolicy( NewPolicy );\r
+  }\r
+  if (EFI_ERROR( Status )) {\r
+    DEBUG(( DEBUG_ERROR, "%a - Failed to lock variable %s! %r\n", __FUNCTION__, MEMORY_OVERWRITE_REQUEST_CONTROL_LOCK_NAME, Status ));\r
+    ASSERT_EFI_ERROR( Status );\r
+  }\r
+  if (NewPolicy != NULL) {\r
+    FreePool( NewPolicy );\r
+  }\r
 }\r

diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
index 48ac167906f7c8b89759e26d5462a0acc1655e35..8debc560e6dc2278cb538bfc0350ae0b9ce9a9d2 100644 (file)
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableRuntimeDxe.inf
@@ -71,6 +71,7 @@
   AuthVariableLib\r
   VarCheckLib\r
   VariablePolicyLib\r
+  VariablePolicyHelperLib\r
 \r
 [Protocols]\r
   gEfiFirmwareVolumeBlockProtocolGuid           ## CONSUMES\r
@@ -80,6 +81,7 @@
   gEfiVariableWriteArchProtocolGuid             ## PRODUCES\r
   gEfiVariableArchProtocolGuid                  ## PRODUCES\r
   gEdkiiVariableLockProtocolGuid                ## PRODUCES\r
+  gEdkiiVariablePolicyProtocolGuid              ## CONSUMES\r
   gEdkiiVarCheckProtocolGuid                    ## PRODUCES\r
 \r
 [Guids]\r

diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf
index d8f480be27ccd6aa86c7da675c24b1c77695ed27..62f2f9252f438195171641f1907edee8ff8bd7e7 100644 (file)
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableStandaloneMm.inf
@@ -76,6 +76,7 @@
   SynchronizationLib\r
   VarCheckLib\r
   VariablePolicyLib\r
+  VariablePolicyHelperLib\r
 \r
 [Protocols]\r
   gEfiSmmFirmwareVolumeBlockProtocolGuid        ## CONSUMES\r