MdeModulePkg: Add MorLockDxe to variable driver.

Per secure MOR implementation document, it is not proper to add MOR lock in non-SMM version, because DXE version can not provide protection.

This patch add standalone TcgMorLockDxe implementation.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: "Yao, Jiewen" <jiewen.yao@intel.com>
Reviewed-by: "Zhang, Chao B" <chao.b.zhang@intel.com>
Reviewed-by: "Zeng, Star" <star.zeng@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19689 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c b/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c
new file mode 100644 (file)
index 0000000..c32eb3b
--- /dev/null
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockDxe.c
@@ -0,0 +1,89 @@
+/** @file\r
+  TCG MOR (Memory Overwrite Request) Lock Control support (DXE version).\r
+\r
+  This module clears MemoryOverwriteRequestControlLock variable to indicate\r
+  MOR lock control unsupported.\r
+\r
+Copyright (c) 2016, Intel Corporation. All rights reserved.<BR>\r
+This program and the accompanying materials\r
+are licensed and made available under the terms and conditions of the BSD License\r
+which accompanies this distribution.  The full text of the license may be found at\r
+http://opensource.org/licenses/bsd-license.php\r
+\r
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
+WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
+\r
+**/\r
+\r
+#include <PiDxe.h>\r
+#include <Guid/MemoryOverwriteControl.h>\r
+#include <IndustryStandard/MemoryOverwriteRequestControlLock.h>\r
+#include <Library/DebugLib.h>\r
+#include <Library/BaseLib.h>\r
+#include <Library/BaseMemoryLib.h>\r
+#include "Variable.h"\r
+\r
+extern EDKII_VARIABLE_LOCK_PROTOCOL     mVariableLock;\r
+\r
+/**\r
+  This service is an MOR/MorLock checker handler for the SetVariable().\r
+\r
+  @param  VariableName the name of the vendor's variable, as a\r
+                       Null-Terminated Unicode String\r
+  @param  VendorGuid   Unify identifier for vendor.\r
+  @param  Attributes   Point to memory location to return the attributes of variable. If the point\r
+                       is NULL, the parameter would be ignored.\r
+  @param  DataSize     The size in bytes of Data-Buffer.\r
+  @param  Data         Point to the content of the variable.\r
+\r
+  @retval  EFI_SUCCESS            The MOR/MorLock check pass, and Variable driver can store the variable data.\r
+  @retval  EFI_INVALID_PARAMETER  The MOR/MorLock data or data size or attributes is not allowed for MOR variable.\r
+  @retval  EFI_ACCESS_DENIED      The MOR/MorLock is locked.\r
+  @retval  EFI_ALREADY_STARTED    The MorLock variable is handled inside this function.\r
+                                  Variable driver can just return EFI_SUCCESS.\r
+**/\r
+EFI_STATUS\r
+SetVariableCheckHandlerMor (\r
+  IN CHAR16     *VariableName,\r
+  IN EFI_GUID   *VendorGuid,\r
+  IN UINT32     Attributes,\r
+  IN UINTN      DataSize,\r
+  IN VOID       *Data\r
+  )\r
+{\r
+  //\r
+  // Just let it pass. No need provide protection for DXE version.\r
+  //\r
+  return EFI_SUCCESS;\r
+}\r
+\r
+/**\r
+  Initialization for MOR Lock Control.\r
+\r
+  @retval EFI_SUCEESS     MorLock initialization success.\r
+  @return Others          Some error occurs.\r
+**/\r
+EFI_STATUS\r
+MorLockInit (\r
+  VOID\r
+  )\r
+{\r
+  //\r
+  // Always clear variable to report unsupported to OS.\r
+  // The reason is that the DXE version is not proper to provide *protection*.\r
+  // BIOS should use SMM version variable driver to provide such capability.\r
+  //\r
+  VariableServiceSetVariable (\r
+    MEMORY_OVERWRITE_REQUEST_CONTROL_LOCK_NAME,\r
+    &gEfiMemoryOverwriteRequestControlLockGuid,\r
+    EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,\r
+    0,\r
+    NULL\r
+    );\r
+\r
+  //\r
+  // Need set this variable to be read-only to prevent other module set it.\r
+  //\r
+  VariableLockRequestToLock (&mVariableLock, MEMORY_OVERWRITE_REQUEST_CONTROL_LOCK_NAME, &gEfiMemoryOverwriteRequestControlLockGuid);\r
+  return EFI_SUCCESS;\r
+}\r