2 Measure TrEE required variable.
4 Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved.<BR>
5 This program and the accompanying materials
6 are licensed and made available under the terms and conditions of the BSD License
7 which accompanies this distribution. The full text of the license may be found at
8 http://opensource.org/licenses/bsd-license.php
10 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
11 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
16 #include <Guid/ImageAuthentication.h>
17 #include <IndustryStandard/UefiTcgPlatform.h>
18 #include <Protocol/TrEEProtocol.h>
20 #include <Library/UefiBootServicesTableLib.h>
21 #include <Library/UefiRuntimeServicesTableLib.h>
22 #include <Library/MemoryAllocationLib.h>
23 #include <Library/BaseMemoryLib.h>
24 #include <Library/DebugLib.h>
25 #include <Library/BaseLib.h>
26 #include <Library/TpmMeasurementLib.h>
33 VARIABLE_TYPE mVariableType
[] = {
34 {EFI_SECURE_BOOT_MODE_NAME
, &gEfiGlobalVariableGuid
},
35 {EFI_PLATFORM_KEY_NAME
, &gEfiGlobalVariableGuid
},
36 {EFI_KEY_EXCHANGE_KEY_NAME
, &gEfiGlobalVariableGuid
},
37 {EFI_IMAGE_SECURITY_DATABASE
, &gEfiImageSecurityDatabaseGuid
},
38 {EFI_IMAGE_SECURITY_DATABASE1
, &gEfiImageSecurityDatabaseGuid
},
42 This function will return if this variable is SecureBootPolicy Variable.
44 @param[in] VariableName A Null-terminated string that is the name of the vendor's variable.
45 @param[in] VendorGuid A unique identifier for the vendor.
47 @retval TRUE This is SecureBootPolicy Variable
48 @retval FALSE This is not SecureBootPolicy Variable
51 IsSecureBootPolicyVariable (
52 IN CHAR16
*VariableName
,
53 IN EFI_GUID
*VendorGuid
58 for (Index
= 0; Index
< sizeof(mVariableType
)/sizeof(mVariableType
[0]); Index
++) {
59 if ((StrCmp (VariableName
, mVariableType
[Index
].VariableName
) == 0) &&
60 (CompareGuid (VendorGuid
, mVariableType
[Index
].VendorGuid
))) {
68 Measure and log an EFI variable, and extend the measurement result into a specific PCR.
70 @param[in] VarName A Null-terminated string that is the name of the vendor's variable.
71 @param[in] VendorGuid A unique identifier for the vendor.
72 @param[in] VarData The content of the variable data.
73 @param[in] VarSize The size of the variable data.
75 @retval EFI_SUCCESS Operation completed successfully.
76 @retval EFI_OUT_OF_RESOURCES Out of memory.
77 @retval EFI_DEVICE_ERROR The operation was unsuccessful.
84 IN EFI_GUID
*VendorGuid
,
91 EFI_VARIABLE_DATA_TREE
*VarLog
;
94 ASSERT ((VarSize
== 0 && VarData
== NULL
) || (VarSize
!= 0 && VarData
!= NULL
));
96 VarNameLength
= StrLen (VarName
);
97 VarLogSize
= (UINT32
)(sizeof (*VarLog
) + VarNameLength
* sizeof (*VarName
) + VarSize
98 - sizeof (VarLog
->UnicodeName
) - sizeof (VarLog
->VariableData
));
100 VarLog
= (EFI_VARIABLE_DATA_TREE
*) AllocateZeroPool (VarLogSize
);
101 if (VarLog
== NULL
) {
102 return EFI_OUT_OF_RESOURCES
;
105 CopyMem (&VarLog
->VariableName
, VendorGuid
, sizeof(VarLog
->VariableName
));
106 VarLog
->UnicodeNameLength
= VarNameLength
;
107 VarLog
->VariableDataLength
= VarSize
;
111 VarNameLength
* sizeof (*VarName
)
115 (CHAR16
*)VarLog
->UnicodeName
+ VarNameLength
,
121 DEBUG ((EFI_D_INFO
, "AuthVariableDxe: MeasureVariable (Pcr - %x, EventType - %x, ", (UINTN
)7, (UINTN
)EV_EFI_VARIABLE_AUTHORITY
));
122 DEBUG ((EFI_D_INFO
, "VariableName - %s, VendorGuid - %g)\n", VarName
, VendorGuid
));
124 Status
= TpmMeasureAndLogData (
126 EV_EFI_VARIABLE_DRIVER_CONFIG
,
137 Returns the status whether get the variable success. The function retrieves
138 variable through the UEFI Runtime Service GetVariable(). The
139 returned buffer is allocated using AllocatePool(). The caller is responsible
140 for freeing this buffer with FreePool().
142 This API is only invoked in boot time. It may NOT be invoked at runtime.
144 @param[in] Name The pointer to a Null-terminated Unicode string.
145 @param[in] Guid The pointer to an EFI_GUID structure
146 @param[out] Value The buffer point saved the variable info.
147 @param[out] Size The buffer size of the variable.
149 @return EFI_OUT_OF_RESOURCES Allocate buffer failed.
150 @return EFI_SUCCESS Find the specified variable.
151 @return Others Errors Return errors from call to gRT->GetVariable.
155 InternalGetVariable (
156 IN CONST CHAR16
*Name
,
157 IN CONST EFI_GUID
*Guid
,
166 // Try to get the variable size.
174 Status
= gRT
->GetVariable ((CHAR16
*) Name
, (EFI_GUID
*) Guid
, NULL
, &BufferSize
, *Value
);
175 if (Status
!= EFI_BUFFER_TOO_SMALL
) {
180 // Allocate buffer to get the variable.
182 *Value
= AllocatePool (BufferSize
);
183 ASSERT (*Value
!= NULL
);
184 if (*Value
== NULL
) {
185 return EFI_OUT_OF_RESOURCES
;
189 // Get the variable data.
191 Status
= gRT
->GetVariable ((CHAR16
*) Name
, (EFI_GUID
*) Guid
, NULL
, &BufferSize
, *Value
);
192 if (EFI_ERROR (Status
)) {
205 SecureBoot Hook for SetVariable.
207 @param[in] VariableName Name of Variable to be found.
208 @param[in] VendorGuid Variable vendor GUID.
214 IN CHAR16
*VariableName
,
215 IN EFI_GUID
*VendorGuid
219 UINTN VariableDataSize
;
222 if (!IsSecureBootPolicyVariable (VariableName
, VendorGuid
)) {
227 // We should NOT use Data and DataSize here,because it may include signature,
228 // or is just partial with append attributes, or is deleted.
229 // We should GetVariable again, to get full variable content.
231 Status
= InternalGetVariable (
237 if (EFI_ERROR (Status
)) {
239 VariableDataSize
= 0;
242 Status
= MeasureVariable (
248 DEBUG ((EFI_D_INFO
, "MeasureBootPolicyVariable - %r\n", Status
));
250 if (VariableData
!= NULL
) {
251 FreePool (VariableData
);