1 /** @file -- VariablePolicyLib.c
2 Business logic for Variable Policy enforcement.
4 Copyright (c) Microsoft Corporation.
5 SPDX-License-Identifier: BSD-2-Clause-Patent
11 #include <Library/SafeIntLib.h>
12 #include <Library/MemoryAllocationLib.h>
13 #include <Library/BaseMemoryLib.h>
14 #include <Library/DebugLib.h>
15 #include <Library/PcdLib.h>
17 #include <Protocol/VariablePolicy.h>
18 #include <Library/VariablePolicyLib.h>
21 // IMPORTANT NOTE: This library is currently rife with multiple return statements
22 // for error handling. A refactor should remove these at some point.
25 // This library was designed with advanced unit-test features.
26 // This define handles the configuration.
27 #ifdef INTERNAL_UNIT_TEST
29 #define STATIC // Nothing...
32 // An abstracted GetVariable interface that enables configuration regardless of the environment.
33 EFI_GET_VARIABLE mGetVariableHelper
= NULL
;
35 // Master switch to lock this entire interface. Does not stop enforcement,
36 // just prevents the configuration from being changed for the rest of the boot.
37 STATIC BOOLEAN mInterfaceLocked
= FALSE
;
39 // Master switch to disable the entire interface for a single boot.
40 // This will disable all policy enforcement for the duration of the boot.
41 STATIC BOOLEAN mProtectionDisabled
= FALSE
;
43 // Table to hold all the current policies.
44 UINT8
*mPolicyTable
= NULL
;
45 STATIC UINT32 mCurrentTableSize
= 0;
46 STATIC UINT32 mCurrentTableUsage
= 0;
47 STATIC UINT32 mCurrentTableCount
= 0;
49 #define POLICY_TABLE_STEP_SIZE 0x1000
51 // NOTE: DO NOT USE THESE MACROS on any structure that has not been validated.
52 // Current table data has already been sanitized.
53 #define GET_NEXT_POLICY(CurPolicy) (VARIABLE_POLICY_ENTRY*)((UINT8*)CurPolicy + CurPolicy->Size)
54 #define GET_POLICY_NAME(CurPolicy) (CHAR16*)((UINTN)CurPolicy + CurPolicy->OffsetToName)
56 #define MATCH_PRIORITY_EXACT 0
57 #define MATCH_PRIORITY_MAX MATCH_PRIORITY_EXACT
58 #define MATCH_PRIORITY_MIN MAX_UINT8
62 An extra init hook that enables the RuntimeDxe library instance to
63 register VirtualAddress change callbacks. Among other things.
65 @retval EFI_SUCCESS Everything is good. Continue with init.
66 @retval Others Uh... don't continue.
70 VariablePolicyExtraInit (
75 An extra deinit hook that enables the RuntimeDxe library instance to
76 register VirtualAddress change callbacks. Among other things.
78 @retval EFI_SUCCESS Everything is good. Continue with deinit.
79 @retval Others Uh... don't continue.
83 VariablePolicyExtraDeinit (
89 This helper function determines whether the structure of an incoming policy
90 is valid and internally consistent.
92 @param[in] NewPolicy Pointer to the incoming policy structure.
95 @retval FALSE Pointer is NULL, size is wrong, strings are empty, or
96 substructures overlap.
101 IsValidVariablePolicyStructure (
102 IN CONST VARIABLE_POLICY_ENTRY
*NewPolicy
110 // Sanitize some quick values.
111 if (NewPolicy
== NULL
|| NewPolicy
->Size
== 0 ||
112 // Structure size should be at least as long as the minumum structure and a NULL string.
113 NewPolicy
->Size
< sizeof(VARIABLE_POLICY_ENTRY
) ||
114 // Check for the known revision.
115 NewPolicy
->Version
!= VARIABLE_POLICY_ENTRY_REVISION
) {
119 // Calculate the theoretical end of the structure and make sure
120 // that the structure can fit in memory.
121 Status
= SafeUintnAdd( (UINTN
)NewPolicy
, NewPolicy
->Size
, &EntryEnd
);
122 if (EFI_ERROR( Status
)) {
126 // Check for a valid Max Size.
127 if (NewPolicy
->MaxSize
== 0) {
131 // Check for the valid list of lock policies.
132 if (NewPolicy
->LockPolicyType
!= VARIABLE_POLICY_TYPE_NO_LOCK
&&
133 NewPolicy
->LockPolicyType
!= VARIABLE_POLICY_TYPE_LOCK_NOW
&&
134 NewPolicy
->LockPolicyType
!= VARIABLE_POLICY_TYPE_LOCK_ON_CREATE
&&
135 NewPolicy
->LockPolicyType
!= VARIABLE_POLICY_TYPE_LOCK_ON_VAR_STATE
)
140 // If the policy type is VARIABLE_POLICY_TYPE_LOCK_ON_VAR_STATE, make sure that the matching state variable Name
141 // terminates before the OffsetToName for the matching policy variable Name.
142 if (NewPolicy
->LockPolicyType
== VARIABLE_POLICY_TYPE_LOCK_ON_VAR_STATE
) {
143 // Adjust CheckChar to the offset of the LockPolicy->Name.
144 Status
= SafeUintnAdd( (UINTN
)NewPolicy
+ sizeof(VARIABLE_POLICY_ENTRY
),
145 sizeof(VARIABLE_LOCK_ON_VAR_STATE_POLICY
),
146 (UINTN
*)&CheckChar
);
147 if (EFI_ERROR( Status
) || EntryEnd
<= (UINTN
)CheckChar
) {
150 while (*CheckChar
!= CHAR_NULL
) {
151 if (EntryEnd
<= (UINTN
)CheckChar
) {
156 // At this point we should have either exeeded the structure or be pointing at the last char in LockPolicy->Name.
157 // We should check to make sure that the policy Name comes immediately after this charcter.
158 if ((UINTN
)++CheckChar
!= (UINTN
)NewPolicy
+ NewPolicy
->OffsetToName
) {
161 // If the policy type is any other value, make sure that the LockPolicy structure has a zero length.
163 if (NewPolicy
->OffsetToName
!= sizeof(VARIABLE_POLICY_ENTRY
)) {
168 // Check to make sure that the name has a terminating character
169 // before the end of the structure.
170 // We've already checked that the name is within the bounds of the structure.
171 if (NewPolicy
->Size
!= NewPolicy
->OffsetToName
) {
172 CheckChar
= (CHAR16
*)((UINTN
)NewPolicy
+ NewPolicy
->OffsetToName
);
174 while (*CheckChar
!= CHAR_NULL
) {
175 // Make sure there aren't excessive wildcards.
176 if (*CheckChar
== '#') {
178 if (WildcardCount
> MATCH_PRIORITY_MIN
) {
182 // Make sure you're still within the bounds of the policy structure.
183 if (EntryEnd
<= (UINTN
)CheckChar
) {
189 // Finally, we should be pointed at the very last character in Name, so we should be right
190 // up against the end of the structure.
191 if ((UINTN
)++CheckChar
!= EntryEnd
) {
201 This helper function evaluates a policy and determines whether it matches the target
202 variable. If matched, will also return a value corresponding to the priority of the match.
204 The rules for "best match" are listed in the Variable Policy Spec.
205 Perfect name matches will return 0.
206 Single wildcard characters will return the number of wildcard characters.
207 Full namespaces will return MAX_UINT8.
209 @param[in] EvalEntry Pointer to the policy entry being evaluated.
210 @param[in] VariableName Same as EFI_SET_VARIABLE.
211 @param[in] VendorGuid Same as EFI_SET_VARIABLE.
212 @param[out] MatchPriority [Optional] On finding a match, this value contains the priority of the match.
213 Lower number == higher priority. Only valid if a match found.
215 @retval TRUE Current entry matches the target variable.
216 @retval FALSE Current entry does not match at all.
221 EvaluatePolicyMatch (
222 IN CONST VARIABLE_POLICY_ENTRY
*EvalEntry
,
223 IN CONST CHAR16
*VariableName
,
224 IN CONST EFI_GUID
*VendorGuid
,
225 OUT UINT8
*MatchPriority OPTIONAL
230 UINT8 CalculatedPriority
;
234 CalculatedPriority
= MATCH_PRIORITY_EXACT
;
236 // Step 1: If the GUID doesn't match, we're done. No need to evaluate anything else.
237 if (!CompareGuid( &EvalEntry
->Namespace
, VendorGuid
)) {
241 // If the GUID matches, check to see whether there is a Name associated
242 // with the policy. If not, this policy matches the entire namespace.
243 // Missing Name is indicated by size being equal to name.
244 if (EvalEntry
->Size
== EvalEntry
->OffsetToName
) {
245 CalculatedPriority
= MATCH_PRIORITY_MIN
;
250 // Now that we know the name exists, get it.
251 PolicyName
= GET_POLICY_NAME( EvalEntry
);
253 // Evaluate the name against the policy name and check for a match.
254 // Account for any wildcards.
257 // Keep going until the end of both strings.
258 while (PolicyName
[Index
] != CHAR_NULL
|| VariableName
[Index
] != CHAR_NULL
) {
259 // If we don't have a match...
260 if (PolicyName
[Index
] != VariableName
[Index
] || PolicyName
[Index
] == '#') {
261 // If this is a numerical wildcard, we can consider
262 // it a match if we alter the priority.
263 if (PolicyName
[Index
] == L
'#' &&
264 ((L
'0' <= VariableName
[Index
] && VariableName
[Index
] <= L
'9') ||
265 (L
'A' <= VariableName
[Index
] && VariableName
[Index
] <= L
'F') ||
266 (L
'a' <= VariableName
[Index
] && VariableName
[Index
] <= L
'f'))) {
267 if (CalculatedPriority
< MATCH_PRIORITY_MIN
) {
268 CalculatedPriority
++;
270 // Otherwise, not a match.
280 if (Result
&& MatchPriority
!= NULL
) {
281 *MatchPriority
= CalculatedPriority
;
288 This helper function walks the current policy table and returns a pointer
289 to the best match, if any are found. Leverages EvaluatePolicyMatch() to
292 @param[in] VariableName Same as EFI_SET_VARIABLE.
293 @param[in] VendorGuid Same as EFI_SET_VARIABLE.
294 @param[out] ReturnPriority [Optional] If pointer is provided, return the
295 priority of the match. Same as EvaluatePolicyMatch().
296 Only valid if a match is returned.
298 @retval VARIABLE_POLICY_ENTRY* Best match that was found.
299 @retval NULL No match was found.
303 VARIABLE_POLICY_ENTRY
*
305 IN CONST CHAR16
*VariableName
,
306 IN CONST EFI_GUID
*VendorGuid
,
307 OUT UINT8
*ReturnPriority OPTIONAL
310 VARIABLE_POLICY_ENTRY
*BestResult
;
311 VARIABLE_POLICY_ENTRY
*CurrentEntry
;
313 UINT8 CurrentPriority
;
317 MatchPriority
= MATCH_PRIORITY_EXACT
;
319 // Walk all entries in the table, looking for matches.
320 CurrentEntry
= (VARIABLE_POLICY_ENTRY
*)mPolicyTable
;
321 for (Index
= 0; Index
< mCurrentTableCount
; Index
++) {
322 // Check for a match.
323 if (EvaluatePolicyMatch( CurrentEntry
, VariableName
, VendorGuid
, &CurrentPriority
)) {
324 // If match is better, take it.
325 if (BestResult
== NULL
|| CurrentPriority
< MatchPriority
) {
326 BestResult
= CurrentEntry
;
327 MatchPriority
= CurrentPriority
;
330 // If you've hit the highest-priority match, can exit now.
331 if (MatchPriority
== 0) {
336 // If we're still in the loop, move to the next entry.
337 CurrentEntry
= GET_NEXT_POLICY( CurrentEntry
);
340 // If a return priority was requested, return it.
341 if (ReturnPriority
!= NULL
) {
342 *ReturnPriority
= MatchPriority
;
350 This API function validates and registers a new policy with
351 the policy enforcement engine.
353 @param[in] NewPolicy Pointer to the incoming policy structure.
356 @retval EFI_INVALID_PARAMETER NewPolicy is NULL or is internally inconsistent.
357 @retval EFI_ALREADY_STARTED An identical matching policy already exists.
358 @retval EFI_WRITE_PROTECTED The interface has been locked until the next reboot.
359 @retval EFI_UNSUPPORTED Policy enforcement has been disabled. No reason to add more policies.
360 @retval EFI_ABORTED A calculation error has prevented this function from completing.
361 @retval EFI_OUT_OF_RESOURCES Cannot grow the table to hold any more policies.
362 @retval EFI_NOT_READY Library has not yet been initialized.
367 RegisterVariablePolicy (
368 IN CONST VARIABLE_POLICY_ENTRY
*NewPolicy
372 VARIABLE_POLICY_ENTRY
*MatchPolicy
;
377 if (!IsVariablePolicyLibInitialized()) {
378 return EFI_NOT_READY
;
380 if (mInterfaceLocked
) {
381 return EFI_WRITE_PROTECTED
;
384 if (!IsValidVariablePolicyStructure( NewPolicy
)) {
385 return EFI_INVALID_PARAMETER
;
388 // Check to see whether an exact matching policy already exists.
389 MatchPolicy
= GetBestPolicyMatch( GET_POLICY_NAME( NewPolicy
),
390 &NewPolicy
->Namespace
,
392 if (MatchPolicy
!= NULL
&& MatchPriority
== MATCH_PRIORITY_EXACT
) {
393 return EFI_ALREADY_STARTED
;
396 // If none exists, create it.
397 // If we need more space, allocate that now.
398 Status
= SafeUint32Add( mCurrentTableUsage
, NewPolicy
->Size
, &NewSize
);
399 if (EFI_ERROR( Status
)) {
402 if (NewSize
> mCurrentTableSize
) {
403 // Use NewSize to calculate the new table size in units of POLICY_TABLE_STEP_SIZE.
404 NewSize
= (NewSize
% POLICY_TABLE_STEP_SIZE
) > 0 ?
405 (NewSize
/ POLICY_TABLE_STEP_SIZE
) + 1 :
406 (NewSize
/ POLICY_TABLE_STEP_SIZE
);
407 // Calculate the new table size in absolute bytes.
408 Status
= SafeUint32Mult( NewSize
, POLICY_TABLE_STEP_SIZE
, &NewSize
);
409 if (EFI_ERROR( Status
)) {
413 // Reallocate and copy the table.
414 NewTable
= AllocateRuntimePool( NewSize
);
415 if (NewTable
== NULL
) {
416 return EFI_OUT_OF_RESOURCES
;
418 CopyMem( NewTable
, mPolicyTable
, mCurrentTableUsage
);
419 mCurrentTableSize
= NewSize
;
420 if (mPolicyTable
!= NULL
) {
421 FreePool( mPolicyTable
);
423 mPolicyTable
= NewTable
;
425 // Copy the policy into the table.
426 CopyMem( mPolicyTable
+ mCurrentTableUsage
, NewPolicy
, NewPolicy
->Size
);
427 mCurrentTableUsage
+= NewPolicy
->Size
;
428 mCurrentTableCount
+= 1;
437 This API function checks to see whether the parameters to SetVariable would
438 be allowed according to the current variable policies.
440 @param[in] VariableName Same as EFI_SET_VARIABLE.
441 @param[in] VendorGuid Same as EFI_SET_VARIABLE.
442 @param[in] Attributes Same as EFI_SET_VARIABLE.
443 @param[in] DataSize Same as EFI_SET_VARIABLE.
444 @param[in] Data Same as EFI_SET_VARIABLE.
446 @retval EFI_SUCCESS A matching policy allows this update.
447 @retval EFI_SUCCESS There are currently no policies that restrict this update.
448 @retval EFI_SUCCESS The protections have been disable until the next reboot.
449 @retval EFI_WRITE_PROTECTED Variable is currently locked.
450 @retval EFI_INVALID_PARAMETER Attributes or size are invalid.
451 @retval EFI_ABORTED A lock policy exists, but an error prevented evaluation.
452 @retval EFI_NOT_READY Library has not been initialized.
457 ValidateSetVariable (
458 IN CHAR16
*VariableName
,
459 IN EFI_GUID
*VendorGuid
,
460 IN UINT32 Attributes
,
466 VARIABLE_POLICY_ENTRY
*ActivePolicy
;
468 EFI_STATUS ReturnStatus
;
469 VARIABLE_LOCK_ON_VAR_STATE_POLICY
*StateVarPolicy
;
470 CHAR16
*StateVarName
;
474 ReturnStatus
= EFI_SUCCESS
;
476 if (!IsVariablePolicyLibInitialized()) {
477 ReturnStatus
= EFI_NOT_READY
;
481 // Bail if the protections are currently disabled.
482 if (mProtectionDisabled
) {
483 ReturnStatus
= EFI_SUCCESS
;
487 // Determine whether this is a delete operation.
488 // If so, it will affect which tests are applied.
489 if ((DataSize
== 0) && ((Attributes
& EFI_VARIABLE_APPEND_WRITE
) == 0)) {
495 // Find an active policy if one exists.
496 ActivePolicy
= GetBestPolicyMatch( VariableName
, VendorGuid
, NULL
);
498 // If we have an active policy, check it against the incoming data.
499 if (ActivePolicy
!= NULL
) {
501 // Only enforce size and attribute constraints when updating data, not deleting.
503 // Check for size constraints.
504 if ((ActivePolicy
->MinSize
> 0 && DataSize
< ActivePolicy
->MinSize
) ||
505 (ActivePolicy
->MaxSize
> 0 && DataSize
> ActivePolicy
->MaxSize
)) {
506 ReturnStatus
= EFI_INVALID_PARAMETER
;
507 DEBUG(( DEBUG_VERBOSE
, "%a - Bad Size. 0x%X <> 0x%X-0x%X\n", __FUNCTION__
,
508 DataSize
, ActivePolicy
->MinSize
, ActivePolicy
->MaxSize
));
512 // Check for attribute constraints.
513 if ((ActivePolicy
->AttributesMustHave
& Attributes
) != ActivePolicy
->AttributesMustHave
||
514 (ActivePolicy
->AttributesCantHave
& Attributes
) != 0) {
515 ReturnStatus
= EFI_INVALID_PARAMETER
;
516 DEBUG(( DEBUG_VERBOSE
, "%a - Bad Attributes. 0x%X <> 0x%X:0x%X\n", __FUNCTION__
,
517 Attributes
, ActivePolicy
->AttributesMustHave
, ActivePolicy
->AttributesCantHave
));
523 // Lock policy check.
525 // Check for immediate lock.
526 if (ActivePolicy
->LockPolicyType
== VARIABLE_POLICY_TYPE_LOCK_NOW
) {
527 ReturnStatus
= EFI_WRITE_PROTECTED
;
529 // Check for lock on create.
530 } else if (ActivePolicy
->LockPolicyType
== VARIABLE_POLICY_TYPE_LOCK_ON_CREATE
) {
532 Status
= mGetVariableHelper( VariableName
,
537 if (Status
== EFI_BUFFER_TOO_SMALL
) {
538 ReturnStatus
= EFI_WRITE_PROTECTED
;
541 // Check for lock on state variable.
542 } else if (ActivePolicy
->LockPolicyType
== VARIABLE_POLICY_TYPE_LOCK_ON_VAR_STATE
) {
543 StateVarPolicy
= (VARIABLE_LOCK_ON_VAR_STATE_POLICY
*)((UINT8
*)ActivePolicy
+ sizeof(VARIABLE_POLICY_ENTRY
));
544 StateVarName
= (CHAR16
*)((UINT8
*)StateVarPolicy
+ sizeof(VARIABLE_LOCK_ON_VAR_STATE_POLICY
));
545 StateVarSize
= sizeof(StateVar
);
546 Status
= mGetVariableHelper( StateVarName
,
547 &StateVarPolicy
->Namespace
,
552 // If the variable was found, check the state. If matched, this variable is locked.
553 if (!EFI_ERROR( Status
)) {
554 if (StateVar
== StateVarPolicy
->Value
) {
555 ReturnStatus
= EFI_WRITE_PROTECTED
;
558 // EFI_NOT_FOUND and EFI_BUFFER_TOO_SMALL indicate that the state doesn't match.
559 } else if (Status
!= EFI_NOT_FOUND
&& Status
!= EFI_BUFFER_TOO_SMALL
) {
560 // We don't know what happened, but it isn't good.
561 ReturnStatus
= EFI_ABORTED
;
568 DEBUG(( DEBUG_VERBOSE
, "%a - Variable (%g:%s) returning %r.\n", __FUNCTION__
, VendorGuid
, VariableName
, ReturnStatus
));
574 This API function disables the variable policy enforcement. If it's
575 already been called once, will return EFI_ALREADY_STARTED.
578 @retval EFI_ALREADY_STARTED Has already been called once this boot.
579 @retval EFI_WRITE_PROTECTED Interface has been locked until reboot.
580 @retval EFI_WRITE_PROTECTED Interface option is disabled by platform PCD.
581 @retval EFI_NOT_READY Library has not yet been initialized.
586 DisableVariablePolicy (
590 if (!IsVariablePolicyLibInitialized()) {
591 return EFI_NOT_READY
;
593 if (mProtectionDisabled
) {
594 return EFI_ALREADY_STARTED
;
596 if (mInterfaceLocked
) {
597 return EFI_WRITE_PROTECTED
;
599 if (!PcdGetBool (PcdAllowVariablePolicyEnforcementDisable
)) {
600 return EFI_WRITE_PROTECTED
;
602 mProtectionDisabled
= TRUE
;
608 This API function will dump the entire contents of the variable policy table.
610 Similar to GetVariable, the first call can be made with a 0 size and it will return
611 the size of the buffer required to hold the entire table.
613 @param[out] Policy Pointer to the policy buffer. Can be NULL if Size is 0.
614 @param[in,out] Size On input, the size of the output buffer. On output, the size
615 of the data returned.
617 @retval EFI_SUCCESS Policy data is in the output buffer and Size has been updated.
618 @retval EFI_INVALID_PARAMETER Size is NULL, or Size is non-zero and Policy is NULL.
619 @retval EFI_BUFFER_TOO_SMALL Size is insufficient to hold policy. Size updated with required size.
620 @retval EFI_NOT_READY Library has not yet been initialized.
630 if (!IsVariablePolicyLibInitialized()) {
631 return EFI_NOT_READY
;
634 // Check the parameters.
635 if (Size
== NULL
|| (*Size
> 0 && Policy
== NULL
)) {
636 return EFI_INVALID_PARAMETER
;
639 // Make sure the size is sufficient to hold the policy table.
640 if (*Size
< mCurrentTableUsage
) {
641 *Size
= mCurrentTableUsage
;
642 return EFI_BUFFER_TOO_SMALL
;
645 // If we're still here, copy the table and bounce.
646 CopyMem( Policy
, mPolicyTable
, mCurrentTableUsage
);
647 *Size
= mCurrentTableUsage
;
654 This API function returns whether or not the policy engine is
655 currently being enforced.
659 @retval FALSE Library has not yet been initialized.
664 IsVariablePolicyEnabled (
668 if (!IsVariablePolicyLibInitialized()) {
671 return !mProtectionDisabled
;
676 This API function locks the interface so that no more policy updates
677 can be performed or changes made to the enforcement until the next boot.
680 @retval EFI_NOT_READY Library has not yet been initialized.
689 if (!IsVariablePolicyLibInitialized()) {
690 return EFI_NOT_READY
;
692 if (mInterfaceLocked
) {
693 return EFI_WRITE_PROTECTED
;
695 mInterfaceLocked
= TRUE
;
701 This API function returns whether or not the policy interface is locked
702 for the remainder of the boot.
706 @retval FALSE Library has not yet been initialized.
711 IsVariablePolicyInterfaceLocked (
715 if (!IsVariablePolicyLibInitialized()) {
718 return mInterfaceLocked
;
723 This helper function initializes the library and sets
724 up any required internal structures or handlers.
726 Also registers the internal pointer for the GetVariable helper.
728 @param[in] GetVariableHelper A function pointer matching the EFI_GET_VARIABLE prototype that will be used to
729 check policy criteria that involve the existence of other variables.
732 @retval EFI_ALREADY_STARTED The initialize function has been called more than once without a call to
738 InitVariablePolicyLib (
739 IN EFI_GET_VARIABLE GetVariableHelper
744 Status
= EFI_SUCCESS
;
746 if (mGetVariableHelper
!= NULL
) {
747 return EFI_ALREADY_STARTED
;
750 if (!EFI_ERROR( Status
)) {
751 Status
= VariablePolicyExtraInit();
754 if (!EFI_ERROR( Status
)) {
755 // Save an internal pointer to the GetVariableHelper.
756 mGetVariableHelper
= GetVariableHelper
;
758 // Initialize the global state.
759 mInterfaceLocked
= FALSE
;
760 mProtectionDisabled
= FALSE
;
762 mCurrentTableSize
= 0;
763 mCurrentTableUsage
= 0;
764 mCurrentTableCount
= 0;
772 This helper function returns whether or not the library is currently initialized.
780 IsVariablePolicyLibInitialized (
784 return (mGetVariableHelper
!= NULL
);
789 This helper function tears down the library.
791 Should generally only be used for test harnesses.
794 @retval EFI_NOT_READY Deinitialize was called without first calling initialize.
799 DeinitVariablePolicyLib (
805 Status
= EFI_SUCCESS
;
807 if (mGetVariableHelper
== NULL
) {
808 return EFI_NOT_READY
;
811 if (!EFI_ERROR( Status
)) {
812 Status
= VariablePolicyExtraDeinit();
815 if (!EFI_ERROR( Status
)) {
816 mGetVariableHelper
= NULL
;
817 mInterfaceLocked
= FALSE
;
818 mProtectionDisabled
= FALSE
;
819 mCurrentTableSize
= 0;
820 mCurrentTableUsage
= 0;
821 mCurrentTableCount
= 0;
823 if (mPolicyTable
!= NULL
) {
824 FreePool( mPolicyTable
);