MdeModulePkg/Variable/RuntimeDxe: permit MorLock deletion for passthru req

The SetMorLockVariable() function sets "mMorLockPassThru" to TRUE
temporarily, so that it can set the MOR Control Lock variable to
well-formed values without permission checks.

In the next patch, we'll need the same override for deleting the MOR
Control Lock variable; hence obey "mMorLockPassThru" in the deletion
branch of SetVariableCheckHandlerMorLock() as well.

Cc: Eric Dong <eric.dong@intel.com>
Cc: Jiewen Yao <jiewen.yao@intel.com>
Cc: Ladi Prosek <lprosek@redhat.com>
Cc: Star Zeng <star.zeng@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Tested-by: Ladi Prosek <lprosek@redhat.com>

diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c b/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c
index 534bc5c7fab424cf15b69aaddab3d256e49839e1..3b2d555d2e45a200fd9faccaa99e943c50b4a212 100644 (file)
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/TcgMorLockSmm.c
@@ -169,7 +169,10 @@ SetVariableCheckHandlerMorLock (
   // Basic Check\r
   //\r
   if (Attributes == 0 || DataSize == 0 || Data == NULL) {\r
-    return EFI_WRITE_PROTECTED;\r
+    //\r
+    // Permit deletion for passthru request, deny it otherwise.\r
+    //\r
+    return mMorLockPassThru ? EFI_SUCCESS : EFI_WRITE_PROTECTED;\r
   }\r
 \r
   if ((Attributes != (EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS)) ||\r