[mirror_edk2.git] / MdeModulePkg / Universal / Variable / RuntimeDxe / Measurement.c

/** @file\r
  Measure TrEE required variable.\r
\r
Copyright (c) 2013 - 2017, Intel Corporation. All rights reserved.<BR>\r
This program and the accompanying materials\r
are licensed and made available under the terms and conditions of the BSD License\r
which accompanies this distribution.  The full text of the license may be found at\r
http://opensource.org/licenses/bsd-license.php\r
\r
THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
\r
**/\r
\r
#include <PiDxe.h>\r
#include <Guid/ImageAuthentication.h>\r
#include <IndustryStandard/UefiTcgPlatform.h>\r
#include <Protocol/TrEEProtocol.h>\r
\r
#include <Library/UefiBootServicesTableLib.h>\r
#include <Library/UefiRuntimeServicesTableLib.h>\r
#include <Library/MemoryAllocationLib.h>\r
#include <Library/BaseMemoryLib.h>\r
#include <Library/DebugLib.h>\r
#include <Library/BaseLib.h>\r
#include <Library/TpmMeasurementLib.h>\r
\r
typedef struct {\r
  CHAR16                                 *VariableName;\r
  EFI_GUID                               *VendorGuid;\r
} VARIABLE_TYPE;\r
\r
VARIABLE_TYPE  mVariableType[] = {\r
  {EFI_SECURE_BOOT_MODE_NAME,    &gEfiGlobalVariableGuid},\r
  {EFI_PLATFORM_KEY_NAME,        &gEfiGlobalVariableGuid},\r
  {EFI_KEY_EXCHANGE_KEY_NAME,    &gEfiGlobalVariableGuid},\r
  {EFI_IMAGE_SECURITY_DATABASE,  &gEfiImageSecurityDatabaseGuid},\r
  {EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid},\r
  {EFI_IMAGE_SECURITY_DATABASE2, &gEfiImageSecurityDatabaseGuid},\r
};\r
\r
//\r
// "SecureBoot" may update following PK Del/Add\r
//  Cache its value to detect value update\r
//\r
UINT8       *mSecureBootVarData    = NULL;\r
UINTN       mSecureBootVarDataSize = 0;\r
\r
/**\r
  This function will return if this variable is SecureBootPolicy Variable.\r
\r
  @param[in]  VariableName      A Null-terminated string that is the name of the vendor's variable.\r
  @param[in]  VendorGuid        A unique identifier for the vendor.\r
\r
  @retval TRUE  This is SecureBootPolicy Variable\r
  @retval FALSE This is not SecureBootPolicy Variable\r
**/\r
BOOLEAN\r
IsSecureBootPolicyVariable (\r
  IN CHAR16                                 *VariableName,\r
  IN EFI_GUID                               *VendorGuid\r
  )\r
{\r
  UINTN   Index;\r
\r
  for (Index = 0; Index < sizeof(mVariableType)/sizeof(mVariableType[0]); Index++) {\r
    if ((StrCmp (VariableName, mVariableType[Index].VariableName) == 0) &&\r
        (CompareGuid (VendorGuid, mVariableType[Index].VendorGuid))) {\r
      return TRUE;\r
    }\r
  }\r
  return FALSE;\r
}\r
\r
/**\r
  Measure and log an EFI variable, and extend the measurement result into a specific PCR.\r
\r
  @param[in]  VarName           A Null-terminated string that is the name of the vendor's variable.\r
  @param[in]  VendorGuid        A unique identifier for the vendor.\r
  @param[in]  VarData           The content of the variable data.\r
  @param[in]  VarSize           The size of the variable data.\r
\r
  @retval EFI_SUCCESS           Operation completed successfully.\r
  @retval EFI_OUT_OF_RESOURCES  Out of memory.\r
  @retval EFI_DEVICE_ERROR      The operation was unsuccessful.\r
\r
**/\r
EFI_STATUS\r
EFIAPI\r
MeasureVariable (\r
  IN      CHAR16                    *VarName,\r
  IN      EFI_GUID                  *VendorGuid,\r
  IN      VOID                      *VarData,\r
  IN      UINTN                     VarSize\r
  )\r
{\r
  EFI_STATUS                        Status;\r
  UINTN                             VarNameLength;\r
  EFI_VARIABLE_DATA_TREE            *VarLog;\r
  UINT32                            VarLogSize;\r
\r
  ASSERT ((VarSize == 0 && VarData == NULL) || (VarSize != 0 && VarData != NULL));\r
\r
  VarNameLength      = StrLen (VarName);\r
  VarLogSize = (UINT32)(sizeof (*VarLog) + VarNameLength * sizeof (*VarName) + VarSize\r
                        - sizeof (VarLog->UnicodeName) - sizeof (VarLog->VariableData));\r
\r
  VarLog = (EFI_VARIABLE_DATA_TREE *) AllocateZeroPool (VarLogSize);\r
  if (VarLog == NULL) {\r
    return EFI_OUT_OF_RESOURCES;\r
  }\r
\r
  CopyMem (&VarLog->VariableName, VendorGuid, sizeof(VarLog->VariableName));\r
  VarLog->UnicodeNameLength  = VarNameLength;\r
  VarLog->VariableDataLength = VarSize;\r
  CopyMem (\r
     VarLog->UnicodeName,\r
     VarName,\r
     VarNameLength * sizeof (*VarName)\r
     );\r
  if (VarSize != 0) {\r
    CopyMem (\r
       (CHAR16 *)VarLog->UnicodeName + VarNameLength,\r
       VarData,\r
       VarSize\r
       );\r
  }\r
\r
  DEBUG ((EFI_D_INFO, "AuthVariableDxe: MeasureVariable (Pcr - %x, EventType - %x, ", (UINTN)7, (UINTN)EV_EFI_VARIABLE_AUTHORITY));\r
  DEBUG ((EFI_D_INFO, "VariableName - %s, VendorGuid - %g)\n", VarName, VendorGuid));\r
\r
  Status = TpmMeasureAndLogData (\r
             7,\r
             EV_EFI_VARIABLE_DRIVER_CONFIG,\r
             VarLog,\r
             VarLogSize,\r
             VarLog,\r
             VarLogSize\r
             );\r
  FreePool (VarLog);\r
  return Status;\r
}\r
\r
/**\r
  Returns the status whether get the variable success. The function retrieves\r
  variable  through the UEFI Runtime Service GetVariable().  The\r
  returned buffer is allocated using AllocatePool().  The caller is responsible\r
  for freeing this buffer with FreePool().\r
\r
  This API is only invoked in boot time. It may NOT be invoked at runtime.\r
\r
  @param[in]  Name  The pointer to a Null-terminated Unicode string.\r
  @param[in]  Guid  The pointer to an EFI_GUID structure\r
  @param[out] Value The buffer point saved the variable info.\r
  @param[out] Size  The buffer size of the variable.\r
\r
  @return EFI_OUT_OF_RESOURCES      Allocate buffer failed.\r
  @return EFI_SUCCESS               Find the specified variable.\r
  @return Others Errors             Return errors from call to gRT->GetVariable.\r
\r
**/\r
EFI_STATUS\r
InternalGetVariable (\r
  IN CONST CHAR16    *Name,\r
  IN CONST EFI_GUID  *Guid,\r
  OUT VOID           **Value,\r
  OUT UINTN          *Size\r
  )\r
{\r
  EFI_STATUS  Status;\r
  UINTN       BufferSize;\r
\r
  //\r
  // Try to get the variable size.\r
  //\r
  BufferSize = 0;\r
  *Value     = NULL;\r
  if (Size != NULL) {\r
    *Size  = 0;\r
  }\r
\r
  Status = gRT->GetVariable ((CHAR16 *) Name, (EFI_GUID *) Guid, NULL, &BufferSize, *Value);\r
  if (Status != EFI_BUFFER_TOO_SMALL) {\r
    return Status;\r
  }\r
\r
  //\r
  // Allocate buffer to get the variable.\r
  //\r
  *Value = AllocatePool (BufferSize);\r
  ASSERT (*Value != NULL);\r
  if (*Value == NULL) {\r
    return EFI_OUT_OF_RESOURCES;\r
  }\r
\r
  //\r
  // Get the variable data.\r
  //\r
  Status = gRT->GetVariable ((CHAR16 *) Name, (EFI_GUID *) Guid, NULL, &BufferSize, *Value);\r
  if (EFI_ERROR (Status)) {\r
    FreePool(*Value);\r
    *Value = NULL;\r
  }\r
\r
  if (Size != NULL) {\r
    *Size = BufferSize;\r
  }\r
\r
  return Status;\r
}\r
\r
/**\r
  SecureBoot Hook for SetVariable.\r
\r
  @param[in] VariableName                 Name of Variable to be found.\r
  @param[in] VendorGuid                   Variable vendor GUID.\r
\r
**/\r
VOID\r
EFIAPI\r
SecureBootHook (\r
  IN CHAR16                                 *VariableName,\r
  IN EFI_GUID                               *VendorGuid\r
  )\r
{\r
  EFI_STATUS                        Status;\r
  UINTN                             VariableDataSize;\r
  VOID                              *VariableData;\r
\r
  if (!IsSecureBootPolicyVariable (VariableName, VendorGuid)) {\r
    return ;\r
  }\r
\r
  //\r
  // We should NOT use Data and DataSize here,because it may include signature,\r
  // or is just partial with append attributes, or is deleted.\r
  // We should GetVariable again, to get full variable content.\r
  //\r
  Status = InternalGetVariable (\r
             VariableName,\r
             VendorGuid,\r
             &VariableData,\r
             &VariableDataSize\r
             );\r
  if (EFI_ERROR (Status)) {\r
    VariableData     = NULL;\r
    VariableDataSize = 0;\r
  }\r
\r
  Status = MeasureVariable (\r
             VariableName,\r
             VendorGuid,\r
             VariableData,\r
             VariableDataSize\r
             );\r
  DEBUG ((EFI_D_INFO, "MeasureBootPolicyVariable - %r\n", Status));\r
\r
  if (VariableData != NULL) {\r
    FreePool (VariableData);\r
  }\r
\r
  //\r
  // "SecureBoot" is 8bit & read-only. It can only be changed according to PK update\r
  //\r
  if ((StrCmp (VariableName, EFI_PLATFORM_KEY_NAME) == 0) &&\r
       CompareGuid (VendorGuid, &gEfiGlobalVariableGuid)) {\r
     Status = InternalGetVariable (\r
                EFI_SECURE_BOOT_MODE_NAME,\r
                &gEfiGlobalVariableGuid,\r
                &VariableData,\r
                &VariableDataSize\r
                );\r
     if (EFI_ERROR (Status)) {\r
       return;\r
     }\r
\r
     //\r
     // If PK update is successful. "SecureBoot" shall always exist ever since variable write service is ready\r
     //\r
     ASSERT(mSecureBootVarData != NULL);\r
\r
     if (CompareMem(mSecureBootVarData, VariableData, VariableDataSize) != 0) {\r
       FreePool(mSecureBootVarData);\r
       mSecureBootVarData     = VariableData;\r
       mSecureBootVarDataSize = VariableDataSize;\r
\r
       DEBUG((DEBUG_INFO, "%s variable updated according to PK change. Remeasure the value!\n", EFI_SECURE_BOOT_MODE_NAME));\r
       Status = MeasureVariable (\r
                  EFI_SECURE_BOOT_MODE_NAME,\r
                  &gEfiGlobalVariableGuid,\r
                  mSecureBootVarData,\r
                  mSecureBootVarDataSize\r
                  );\r
       DEBUG ((DEBUG_INFO, "MeasureBootPolicyVariable - %r\n", Status));\r
     } else {\r
       //\r
       // "SecureBoot" variable is not changed\r
       //\r
       FreePool(VariableData);\r
     }\r
  }\r
\r
  return ;\r
}\r
\r
/**\r
  Some Secure Boot Policy Variable may update following other variable changes(SecureBoot follows PK change, etc).\r
  Record their initial State when variable write service is ready.\r
\r
**/\r
VOID\r
EFIAPI\r
RecordSecureBootPolicyVarData(\r
  VOID\r
  )\r
{\r
  EFI_STATUS Status;\r
\r
  //\r
  // Record initial "SecureBoot" variable value.\r
  // It is used to detect SecureBoot variable change in SecureBootHook.\r
  //\r
  Status = InternalGetVariable (\r
             EFI_SECURE_BOOT_MODE_NAME,\r
             &gEfiGlobalVariableGuid,\r
             (VOID **)&mSecureBootVarData,\r
             &mSecureBootVarDataSize\r
             );\r
  if (EFI_ERROR(Status)) {\r
    //\r
    // Read could fail when Auth Variable solution is not supported\r
    //\r
    DEBUG((DEBUG_INFO, "RecordSecureBootPolicyVarData GetVariable %s Status %x\n", EFI_SECURE_BOOT_MODE_NAME, Status));\r
  }\r
}\r
Commit	Line	Data
fa0737a8 SZ	1	/** @file\r
	2	Measure TrEE required variable.\r
	3	\r
dc9bd6ed	4	Copyright (c) 2013 - 2017, Intel Corporation. All rights reserved.<BR>\r
fa0737a8 SZ	5	This program and the accompanying materials\r
	6	are licensed and made available under the terms and conditions of the BSD License\r
	7	which accompanies this distribution. The full text of the license may be found at\r
	8	http://opensource.org/licenses/bsd-license.php\r
	9	\r
	10	THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
	11	WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
	12	\r
	13	**/\r
	14	\r
	15	#include <PiDxe.h>\r
	16	#include <Guid/ImageAuthentication.h>\r
	17	#include <IndustryStandard/UefiTcgPlatform.h>\r
	18	#include <Protocol/TrEEProtocol.h>\r
	19	\r
	20	#include <Library/UefiBootServicesTableLib.h>\r
	21	#include <Library/UefiRuntimeServicesTableLib.h>\r
	22	#include <Library/MemoryAllocationLib.h>\r
	23	#include <Library/BaseMemoryLib.h>\r
	24	#include <Library/DebugLib.h>\r
	25	#include <Library/BaseLib.h>\r
	26	#include <Library/TpmMeasurementLib.h>\r
	27	\r
	28	typedef struct {\r
	29	CHAR16 *VariableName;\r
	30	EFI_GUID *VendorGuid;\r
	31	} VARIABLE_TYPE;\r
	32	\r
	33	VARIABLE_TYPE mVariableType[] = {\r
	34	{EFI_SECURE_BOOT_MODE_NAME, &gEfiGlobalVariableGuid},\r
	35	{EFI_PLATFORM_KEY_NAME, &gEfiGlobalVariableGuid},\r
	36	{EFI_KEY_EXCHANGE_KEY_NAME, &gEfiGlobalVariableGuid},\r
	37	{EFI_IMAGE_SECURITY_DATABASE, &gEfiImageSecurityDatabaseGuid},\r
	38	{EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid},\r
dc9bd6ed	39	{EFI_IMAGE_SECURITY_DATABASE2, &gEfiImageSecurityDatabaseGuid},\r
fa0737a8 SZ	40	};\r
fa0737a8 SZ	41	\r
dc9bd6ed ZC	42	//\r
	43	// "SecureBoot" may update following PK Del/Add\r
	44	// Cache its value to detect value update\r
	45	//\r
	46	UINT8 *mSecureBootVarData = NULL;\r
	47	UINTN mSecureBootVarDataSize = 0;\r
	48	\r
fa0737a8 SZ	49	/**\r
	50	This function will return if this variable is SecureBootPolicy Variable.\r
	51	\r
	52	@param[in] VariableName A Null-terminated string that is the name of the vendor's variable.\r
	53	@param[in] VendorGuid A unique identifier for the vendor.\r
	54	\r
	55	@retval TRUE This is SecureBootPolicy Variable\r
	56	@retval FALSE This is not SecureBootPolicy Variable\r
	57	**/\r
	58	BOOLEAN\r
	59	IsSecureBootPolicyVariable (\r
	60	IN CHAR16 *VariableName,\r
	61	IN EFI_GUID *VendorGuid\r
	62	)\r
	63	{\r
	64	UINTN Index;\r
	65	\r
	66	for (Index = 0; Index < sizeof(mVariableType)/sizeof(mVariableType[0]); Index++) {\r
	67	if ((StrCmp (VariableName, mVariableType[Index].VariableName) == 0) &&\r
	68	(CompareGuid (VendorGuid, mVariableType[Index].VendorGuid))) {\r
	69	return TRUE;\r
	70	}\r
	71	}\r
	72	return FALSE;\r
	73	}\r
	74	\r
	75	/**\r
	76	Measure and log an EFI variable, and extend the measurement result into a specific PCR.\r
	77	\r
	78	@param[in] VarName A Null-terminated string that is the name of the vendor's variable.\r
	79	@param[in] VendorGuid A unique identifier for the vendor.\r
	80	@param[in] VarData The content of the variable data.\r
	81	@param[in] VarSize The size of the variable data.\r
	82	\r
	83	@retval EFI_SUCCESS Operation completed successfully.\r
	84	@retval EFI_OUT_OF_RESOURCES Out of memory.\r
	85	@retval EFI_DEVICE_ERROR The operation was unsuccessful.\r
	86	\r
	87	**/\r
	88	EFI_STATUS\r
	89	EFIAPI\r
	90	MeasureVariable (\r
	91	IN CHAR16 *VarName,\r
	92	IN EFI_GUID *VendorGuid,\r
	93	IN VOID *VarData,\r
	94	IN UINTN VarSize\r
	95	)\r
	96	{\r
	97	EFI_STATUS Status;\r
	98	UINTN VarNameLength;\r
	99	EFI_VARIABLE_DATA_TREE *VarLog;\r
	100	UINT32 VarLogSize;\r
	101	\r
	102	ASSERT ((VarSize == 0 && VarData == NULL) \|\| (VarSize != 0 && VarData != NULL));\r
	103	\r
	104	VarNameLength = StrLen (VarName);\r
	105	VarLogSize = (UINT32)(sizeof (VarLog) + VarNameLength sizeof (*VarName) + VarSize\r
	106	- sizeof (VarLog->UnicodeName) - sizeof (VarLog->VariableData));\r
	107	\r
	108	VarLog = (EFI_VARIABLE_DATA_TREE *) AllocateZeroPool (VarLogSize);\r
	109	if (VarLog == NULL) {\r
	110	return EFI_OUT_OF_RESOURCES;\r
	111	}\r
	112	\r
113	CopyMem (&VarLog->VariableName, VendorGuid, sizeof(VarLog->VariableName));\r
114	VarLog->UnicodeNameLength = VarNameLength;\r
115	VarLog->VariableDataLength = VarSize;\r
116	CopyMem (\r
117	VarLog->UnicodeName,\r
118	VarName,\r
119	VarNameLength * sizeof (*VarName)\r
120	);\r
121	if (VarSize != 0) {\r
122	CopyMem (\r
123	(CHAR16 *)VarLog->UnicodeName + VarNameLength,\r
124	VarData,\r
125	VarSize\r
126	);\r
127	}\r
128	\r
129	DEBUG ((EFI_D_INFO, "AuthVariableDxe: MeasureVariable (Pcr - %x, EventType - %x, ", (UINTN)7, (UINTN)EV_EFI_VARIABLE_AUTHORITY));\r
130	DEBUG ((EFI_D_INFO, "VariableName - %s, VendorGuid - %g)\n", VarName, VendorGuid));\r
131	\r
132	Status = TpmMeasureAndLogData (\r
133	7,\r
134	EV_EFI_VARIABLE_DRIVER_CONFIG,\r
135	VarLog,\r
136	VarLogSize,\r
137	VarLog,\r
138	VarLogSize\r
139	);\r
140	FreePool (VarLog);\r
141	return Status;\r
142	}\r
143	\r
144	/**\r
145	Returns the status whether get the variable success. The function retrieves\r
146	variable through the UEFI Runtime Service GetVariable(). The\r
147	returned buffer is allocated using AllocatePool(). The caller is responsible\r
148	for freeing this buffer with FreePool().\r
149	\r
150	This API is only invoked in boot time. It may NOT be invoked at runtime.\r
151	\r
152	@param[in] Name The pointer to a Null-terminated Unicode string.\r
153	@param[in] Guid The pointer to an EFI_GUID structure\r
154	@param[out] Value The buffer point saved the variable info.\r
155	@param[out] Size The buffer size of the variable.\r
156	\r
157	@return EFI_OUT_OF_RESOURCES Allocate buffer failed.\r
158	@return EFI_SUCCESS Find the specified variable.\r
159	@return Others Errors Return errors from call to gRT->GetVariable.\r
160	\r
161	**/\r
162	EFI_STATUS\r
163	InternalGetVariable (\r
164	IN CONST CHAR16 *Name,\r
165	IN CONST EFI_GUID *Guid,\r
166	OUT VOID **Value,\r
167	OUT UINTN *Size\r
168	)\r
169	{\r
170	EFI_STATUS Status;\r
171	UINTN BufferSize;\r
172	\r
173	//\r
174	// Try to get the variable size.\r
175	//\r
176	BufferSize = 0;\r
177	*Value = NULL;\r
178	if (Size != NULL) {\r
179	*Size = 0;\r
180	}\r
181	\r
182	Status = gRT->GetVariable ((CHAR16 ) Name, (EFI_GUID ) Guid, NULL, &BufferSize, *Value);\r
183	if (Status != EFI_BUFFER_TOO_SMALL) {\r
184	return Status;\r
185	}\r
186	\r
187	//\r
188	// Allocate buffer to get the variable.\r
189	//\r
190	*Value = AllocatePool (BufferSize);\r
191	ASSERT (*Value != NULL);\r
192	if (*Value == NULL) {\r
193	return EFI_OUT_OF_RESOURCES;\r
194	}\r
195	\r
196	//\r
197	// Get the variable data.\r
198	//\r
199	Status = gRT->GetVariable ((CHAR16 ) Name, (EFI_GUID ) Guid, NULL, &BufferSize, *Value);\r
200	if (EFI_ERROR (Status)) {\r
201	FreePool(*Value);\r
202	*Value = NULL;\r
203	}\r
204	\r
205	if (Size != NULL) {\r
206	*Size = BufferSize;\r
207	}\r
208	\r
209	return Status;\r
210	}\r
211	\r
212	/**\r
213	SecureBoot Hook for SetVariable.\r
214	\r
215	@param[in] VariableName Name of Variable to be found.\r
216	@param[in] VendorGuid Variable vendor GUID.\r
217	\r
218	**/\r
219	VOID\r
220	EFIAPI\r
221	SecureBootHook (\r
222	IN CHAR16 *VariableName,\r
223	IN EFI_GUID *VendorGuid\r
224	)\r
225	{\r
226	EFI_STATUS Status;\r
227	UINTN VariableDataSize;\r
228	VOID *VariableData;\r
229	\r
230	if (!IsSecureBootPolicyVariable (VariableName, VendorGuid)) {\r
231	return ;\r
232	}\r
233	\r
234	//\r
235	// We should NOT use Data and DataSize here,because it may include signature,\r
236	// or is just partial with append attributes, or is deleted.\r
237	// We should GetVariable again, to get full variable content.\r
238	//\r
239	Status = InternalGetVariable (\r
240	VariableName,\r
241	VendorGuid,\r
242	&VariableData,\r
243	&VariableDataSize\r
244	);\r
245	if (EFI_ERROR (Status)) {\r
246	VariableData = NULL;\r
247	VariableDataSize = 0;\r
248	}\r
249	\r
250	Status = MeasureVariable (\r
251	VariableName,\r
252	VendorGuid,\r
253	VariableData,\r
254	VariableDataSize\r
255	);\r
256	DEBUG ((EFI_D_INFO, "MeasureBootPolicyVariable - %r\n", Status));\r
257	\r
258	if (VariableData != NULL) {\r
259	FreePool (VariableData);\r
260	}\r
261	\r
dc9bd6ed ZC	262	//\r
	263	// "SecureBoot" is 8bit & read-only. It can only be changed according to PK update\r
	264	//\r
	265	if ((StrCmp (VariableName, EFI_PLATFORM_KEY_NAME) == 0) &&\r
	266	CompareGuid (VendorGuid, &gEfiGlobalVariableGuid)) {\r
	267	Status = InternalGetVariable (\r
	268	EFI_SECURE_BOOT_MODE_NAME,\r
	269	&gEfiGlobalVariableGuid,\r
	270	&VariableData,\r
	271	&VariableDataSize\r
	272	);\r
	273	if (EFI_ERROR (Status)) {\r
	274	return;\r
	275	}\r
	276	\r
	277	//\r
	278	// If PK update is successful. "SecureBoot" shall always exist ever since variable write service is ready\r
	279	//\r
	280	ASSERT(mSecureBootVarData != NULL);\r
	281	\r
	282	if (CompareMem(mSecureBootVarData, VariableData, VariableDataSize) != 0) {\r
	283	FreePool(mSecureBootVarData);\r
	284	mSecureBootVarData = VariableData;\r
	285	mSecureBootVarDataSize = VariableDataSize;\r
	286	\r
	287	DEBUG((DEBUG_INFO, "%s variable updated according to PK change. Remeasure the value!\n", EFI_SECURE_BOOT_MODE_NAME));\r
	288	Status = MeasureVariable (\r
	289	EFI_SECURE_BOOT_MODE_NAME,\r
	290	&gEfiGlobalVariableGuid,\r
	291	mSecureBootVarData,\r
	292	mSecureBootVarDataSize\r
	293	);\r
	294	DEBUG ((DEBUG_INFO, "MeasureBootPolicyVariable - %r\n", Status));\r
	295	} else {\r
	296	//\r
	297	// "SecureBoot" variable is not changed\r
	298	//\r
	299	FreePool(VariableData);\r
	300	}\r
	301	}\r
	302	\r
fa0737a8 SZ	303	return ;\r
fa0737a8 SZ	304	}\r
dc9bd6ed ZC	305	\r
	306	/**\r
	307	Some Secure Boot Policy Variable may update following other variable changes(SecureBoot follows PK change, etc).\r
	308	Record their initial State when variable write service is ready.\r
	309	\r
	310	**/\r
	311	VOID\r
	312	EFIAPI\r
	313	RecordSecureBootPolicyVarData(\r
	314	VOID\r
	315	)\r
	316	{\r
	317	EFI_STATUS Status;\r
	318	\r
	319	//\r
	320	// Record initial "SecureBoot" variable value.\r
	321	// It is used to detect SecureBoot variable change in SecureBootHook.\r
	322	//\r
	323	Status = InternalGetVariable (\r
	324	EFI_SECURE_BOOT_MODE_NAME,\r
	325	&gEfiGlobalVariableGuid,\r
	326	(VOID **)&mSecureBootVarData,\r
	327	&mSecureBootVarDataSize\r
	328	);\r
	329	if (EFI_ERROR(Status)) {\r
	330	//\r
	331	// Read could fail when Auth Variable solution is not supported\r
	332	//\r
	333	DEBUG((DEBUG_INFO, "RecordSecureBootPolicyVarData GetVariable %s Status %x\n", EFI_SECURE_BOOT_MODE_NAME, Status));\r
	334	}\r
	335	}\r