[mirror_edk2.git] / MdeModulePkg / Universal / Variable / RuntimeDxe / Measurement.c

/** @file\r
  Measure TCG required variable.\r
\r
Copyright (c) 2013 - 2017, Intel Corporation. All rights reserved.<BR>\r
SPDX-License-Identifier: BSD-2-Clause-Patent\r
\r
**/\r
\r
#include <PiDxe.h>\r
#include <Guid/ImageAuthentication.h>\r
#include <IndustryStandard/UefiTcgPlatform.h>\r
\r
#include <Library/UefiBootServicesTableLib.h>\r
#include <Library/UefiRuntimeServicesTableLib.h>\r
#include <Library/MemoryAllocationLib.h>\r
#include <Library/BaseMemoryLib.h>\r
#include <Library/DebugLib.h>\r
#include <Library/BaseLib.h>\r
#include <Library/TpmMeasurementLib.h>\r
\r
#include "PrivilegePolymorphic.h"\r
\r
typedef struct {\r
  CHAR16                                 *VariableName;\r
  EFI_GUID                               *VendorGuid;\r
} VARIABLE_TYPE;\r
\r
VARIABLE_TYPE  mVariableType[] = {\r
  {EFI_SECURE_BOOT_MODE_NAME,    &gEfiGlobalVariableGuid},\r
  {EFI_PLATFORM_KEY_NAME,        &gEfiGlobalVariableGuid},\r
  {EFI_KEY_EXCHANGE_KEY_NAME,    &gEfiGlobalVariableGuid},\r
  {EFI_IMAGE_SECURITY_DATABASE,  &gEfiImageSecurityDatabaseGuid},\r
  {EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid},\r
  {EFI_IMAGE_SECURITY_DATABASE2, &gEfiImageSecurityDatabaseGuid},\r
};\r
\r
//\r
// "SecureBoot" may update following PK Del/Add\r
//  Cache its value to detect value update\r
//\r
UINT8       *mSecureBootVarData    = NULL;\r
UINTN       mSecureBootVarDataSize = 0;\r
\r
/**\r
  This function will return if this variable is SecureBootPolicy Variable.\r
\r
  @param[in]  VariableName      A Null-terminated string that is the name of the vendor's variable.\r
  @param[in]  VendorGuid        A unique identifier for the vendor.\r
\r
  @retval TRUE  This is SecureBootPolicy Variable\r
  @retval FALSE This is not SecureBootPolicy Variable\r
**/\r
BOOLEAN\r
IsSecureBootPolicyVariable (\r
  IN CHAR16                                 *VariableName,\r
  IN EFI_GUID                               *VendorGuid\r
  )\r
{\r
  UINTN   Index;\r
\r
  for (Index = 0; Index < sizeof(mVariableType)/sizeof(mVariableType[0]); Index++) {\r
    if ((StrCmp (VariableName, mVariableType[Index].VariableName) == 0) &&\r
        (CompareGuid (VendorGuid, mVariableType[Index].VendorGuid))) {\r
      return TRUE;\r
    }\r
  }\r
  return FALSE;\r
}\r
\r
/**\r
  Measure and log an EFI variable, and extend the measurement result into a specific PCR.\r
\r
  @param[in]  VarName           A Null-terminated string that is the name of the vendor's variable.\r
  @param[in]  VendorGuid        A unique identifier for the vendor.\r
  @param[in]  VarData           The content of the variable data.\r
  @param[in]  VarSize           The size of the variable data.\r
\r
  @retval EFI_SUCCESS           Operation completed successfully.\r
  @retval EFI_OUT_OF_RESOURCES  Out of memory.\r
  @retval EFI_DEVICE_ERROR      The operation was unsuccessful.\r
\r
**/\r
EFI_STATUS\r
EFIAPI\r
MeasureVariable (\r
  IN      CHAR16                    *VarName,\r
  IN      EFI_GUID                  *VendorGuid,\r
  IN      VOID                      *VarData,\r
  IN      UINTN                     VarSize\r
  )\r
{\r
  EFI_STATUS                        Status;\r
  UINTN                             VarNameLength;\r
  UEFI_VARIABLE_DATA                *VarLog;\r
  UINT32                            VarLogSize;\r
\r
  ASSERT ((VarSize == 0 && VarData == NULL) || (VarSize != 0 && VarData != NULL));\r
\r
  VarNameLength      = StrLen (VarName);\r
  VarLogSize = (UINT32)(sizeof (*VarLog) + VarNameLength * sizeof (*VarName) + VarSize\r
                        - sizeof (VarLog->UnicodeName) - sizeof (VarLog->VariableData));\r
\r
  VarLog = (UEFI_VARIABLE_DATA *) AllocateZeroPool (VarLogSize);\r
  if (VarLog == NULL) {\r
    return EFI_OUT_OF_RESOURCES;\r
  }\r
\r
  CopyMem (&VarLog->VariableName, VendorGuid, sizeof(VarLog->VariableName));\r
  VarLog->UnicodeNameLength  = VarNameLength;\r
  VarLog->VariableDataLength = VarSize;\r
  CopyMem (\r
     VarLog->UnicodeName,\r
     VarName,\r
     VarNameLength * sizeof (*VarName)\r
     );\r
  if (VarSize != 0) {\r
    CopyMem (\r
       (CHAR16 *)VarLog->UnicodeName + VarNameLength,\r
       VarData,\r
       VarSize\r
       );\r
  }\r
\r
  DEBUG ((EFI_D_INFO, "VariableDxe: MeasureVariable (Pcr - %x, EventType - %x, ", (UINTN)7, (UINTN)EV_EFI_VARIABLE_DRIVER_CONFIG));\r
  DEBUG ((EFI_D_INFO, "VariableName - %s, VendorGuid - %g)\n", VarName, VendorGuid));\r
\r
  Status = TpmMeasureAndLogData (\r
             7,\r
             EV_EFI_VARIABLE_DRIVER_CONFIG,\r
             VarLog,\r
             VarLogSize,\r
             VarLog,\r
             VarLogSize\r
             );\r
  FreePool (VarLog);\r
  return Status;\r
}\r
\r
/**\r
  Returns the status whether get the variable success. The function retrieves\r
  variable  through the UEFI Runtime Service GetVariable().  The\r
  returned buffer is allocated using AllocatePool().  The caller is responsible\r
  for freeing this buffer with FreePool().\r
\r
  This API is only invoked in boot time. It may NOT be invoked at runtime.\r
\r
  @param[in]  Name  The pointer to a Null-terminated Unicode string.\r
  @param[in]  Guid  The pointer to an EFI_GUID structure\r
  @param[out] Value The buffer point saved the variable info.\r
  @param[out] Size  The buffer size of the variable.\r
\r
  @return EFI_OUT_OF_RESOURCES      Allocate buffer failed.\r
  @return EFI_SUCCESS               Find the specified variable.\r
  @return Others Errors             Return errors from call to gRT->GetVariable.\r
\r
**/\r
EFI_STATUS\r
InternalGetVariable (\r
  IN CONST CHAR16    *Name,\r
  IN CONST EFI_GUID  *Guid,\r
  OUT VOID           **Value,\r
  OUT UINTN          *Size\r
  )\r
{\r
  EFI_STATUS  Status;\r
  UINTN       BufferSize;\r
\r
  //\r
  // Try to get the variable size.\r
  //\r
  BufferSize = 0;\r
  *Value     = NULL;\r
  if (Size != NULL) {\r
    *Size  = 0;\r
  }\r
\r
  Status = gRT->GetVariable ((CHAR16 *) Name, (EFI_GUID *) Guid, NULL, &BufferSize, *Value);\r
  if (Status != EFI_BUFFER_TOO_SMALL) {\r
    return Status;\r
  }\r
\r
  //\r
  // Allocate buffer to get the variable.\r
  //\r
  *Value = AllocatePool (BufferSize);\r
  ASSERT (*Value != NULL);\r
  if (*Value == NULL) {\r
    return EFI_OUT_OF_RESOURCES;\r
  }\r
\r
  //\r
  // Get the variable data.\r
  //\r
  Status = gRT->GetVariable ((CHAR16 *) Name, (EFI_GUID *) Guid, NULL, &BufferSize, *Value);\r
  if (EFI_ERROR (Status)) {\r
    FreePool(*Value);\r
    *Value = NULL;\r
  }\r
\r
  if (Size != NULL) {\r
    *Size = BufferSize;\r
  }\r
\r
  return Status;\r
}\r
\r
/**\r
  SecureBoot Hook for SetVariable.\r
\r
  @param[in] VariableName                 Name of Variable to be found.\r
  @param[in] VendorGuid                   Variable vendor GUID.\r
\r
**/\r
VOID\r
EFIAPI\r
SecureBootHook (\r
  IN CHAR16                                 *VariableName,\r
  IN EFI_GUID                               *VendorGuid\r
  )\r
{\r
  EFI_STATUS                        Status;\r
  UINTN                             VariableDataSize;\r
  VOID                              *VariableData;\r
\r
  if (!IsSecureBootPolicyVariable (VariableName, VendorGuid)) {\r
    return ;\r
  }\r
\r
  //\r
  // We should NOT use Data and DataSize here,because it may include signature,\r
  // or is just partial with append attributes, or is deleted.\r
  // We should GetVariable again, to get full variable content.\r
  //\r
  Status = InternalGetVariable (\r
             VariableName,\r
             VendorGuid,\r
             &VariableData,\r
             &VariableDataSize\r
             );\r
  if (EFI_ERROR (Status)) {\r
    //\r
    // Measure DBT only if present and not empty\r
    //\r
    if (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0 &&\r
        CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid)) {\r
      DEBUG((DEBUG_INFO, "Skip measuring variable %s since it's deleted\n", EFI_IMAGE_SECURITY_DATABASE2));\r
      return;\r
    } else {\r
      VariableData     = NULL;\r
      VariableDataSize = 0;\r
    }\r
  }\r
\r
  Status = MeasureVariable (\r
             VariableName,\r
             VendorGuid,\r
             VariableData,\r
             VariableDataSize\r
             );\r
  DEBUG ((EFI_D_INFO, "MeasureBootPolicyVariable - %r\n", Status));\r
\r
  if (VariableData != NULL) {\r
    FreePool (VariableData);\r
  }\r
\r
  //\r
  // "SecureBoot" is 8bit & read-only. It can only be changed according to PK update\r
  //\r
  if ((StrCmp (VariableName, EFI_PLATFORM_KEY_NAME) == 0) &&\r
       CompareGuid (VendorGuid, &gEfiGlobalVariableGuid)) {\r
     Status = InternalGetVariable (\r
                EFI_SECURE_BOOT_MODE_NAME,\r
                &gEfiGlobalVariableGuid,\r
                &VariableData,\r
                &VariableDataSize\r
                );\r
     if (EFI_ERROR (Status)) {\r
       return;\r
     }\r
\r
     //\r
     // If PK update is successful. "SecureBoot" shall always exist ever since variable write service is ready\r
     //\r
     ASSERT(mSecureBootVarData != NULL);\r
\r
     if (CompareMem(mSecureBootVarData, VariableData, VariableDataSize) != 0) {\r
       FreePool(mSecureBootVarData);\r
       mSecureBootVarData     = VariableData;\r
       mSecureBootVarDataSize = VariableDataSize;\r
\r
       DEBUG((DEBUG_INFO, "%s variable updated according to PK change. Remeasure the value!\n", EFI_SECURE_BOOT_MODE_NAME));\r
       Status = MeasureVariable (\r
                  EFI_SECURE_BOOT_MODE_NAME,\r
                  &gEfiGlobalVariableGuid,\r
                  mSecureBootVarData,\r
                  mSecureBootVarDataSize\r
                  );\r
       DEBUG ((DEBUG_INFO, "MeasureBootPolicyVariable - %r\n", Status));\r
     } else {\r
       //\r
       // "SecureBoot" variable is not changed\r
       //\r
       FreePool(VariableData);\r
     }\r
  }\r
\r
  return ;\r
}\r
\r
/**\r
  Some Secure Boot Policy Variable may update following other variable changes(SecureBoot follows PK change, etc).\r
  Record their initial State when variable write service is ready.\r
\r
**/\r
VOID\r
EFIAPI\r
RecordSecureBootPolicyVarData(\r
  VOID\r
  )\r
{\r
  EFI_STATUS Status;\r
\r
  //\r
  // Record initial "SecureBoot" variable value.\r
  // It is used to detect SecureBoot variable change in SecureBootHook.\r
  //\r
  Status = InternalGetVariable (\r
             EFI_SECURE_BOOT_MODE_NAME,\r
             &gEfiGlobalVariableGuid,\r
             (VOID **)&mSecureBootVarData,\r
             &mSecureBootVarDataSize\r
             );\r
  if (EFI_ERROR(Status)) {\r
    //\r
    // Read could fail when Auth Variable solution is not supported\r
    //\r
    DEBUG((DEBUG_INFO, "RecordSecureBootPolicyVarData GetVariable %s Status %x\n", EFI_SECURE_BOOT_MODE_NAME, Status));\r
  }\r
}\r
Commit	Line	Data
fa0737a8	1	/** @file\r
1de3b7fd	2	Measure TCG required variable.\r
fa0737a8	3	\r
dc9bd6ed	4	Copyright (c) 2013 - 2017, Intel Corporation. All rights reserved.<BR>\r
9d510e61	5	SPDX-License-Identifier: BSD-2-Clause-Patent\r
fa0737a8 SZ	6	\r
	7	**/\r
	8	\r
	9	#include <PiDxe.h>\r
	10	#include <Guid/ImageAuthentication.h>\r
	11	#include <IndustryStandard/UefiTcgPlatform.h>\r
fa0737a8 SZ	12	\r
	13	#include <Library/UefiBootServicesTableLib.h>\r
	14	#include <Library/UefiRuntimeServicesTableLib.h>\r
	15	#include <Library/MemoryAllocationLib.h>\r
	16	#include <Library/BaseMemoryLib.h>\r
	17	#include <Library/DebugLib.h>\r
	18	#include <Library/BaseLib.h>\r
	19	#include <Library/TpmMeasurementLib.h>\r
	20	\r
00663d04 LE	21	#include "PrivilegePolymorphic.h"\r
00663d04 LE	22	\r
fa0737a8 SZ	23	typedef struct {\r
	24	CHAR16 *VariableName;\r
	25	EFI_GUID *VendorGuid;\r
	26	} VARIABLE_TYPE;\r
	27	\r
	28	VARIABLE_TYPE mVariableType[] = {\r
	29	{EFI_SECURE_BOOT_MODE_NAME, &gEfiGlobalVariableGuid},\r
	30	{EFI_PLATFORM_KEY_NAME, &gEfiGlobalVariableGuid},\r
	31	{EFI_KEY_EXCHANGE_KEY_NAME, &gEfiGlobalVariableGuid},\r
	32	{EFI_IMAGE_SECURITY_DATABASE, &gEfiImageSecurityDatabaseGuid},\r
	33	{EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid},\r
dc9bd6ed	34	{EFI_IMAGE_SECURITY_DATABASE2, &gEfiImageSecurityDatabaseGuid},\r
fa0737a8 SZ	35	};\r
fa0737a8 SZ	36	\r
dc9bd6ed ZC	37	//\r
	38	// "SecureBoot" may update following PK Del/Add\r
	39	// Cache its value to detect value update\r
	40	//\r
	41	UINT8 *mSecureBootVarData = NULL;\r
	42	UINTN mSecureBootVarDataSize = 0;\r
	43	\r
fa0737a8 SZ	44	/**\r
	45	This function will return if this variable is SecureBootPolicy Variable.\r
	46	\r
	47	@param[in] VariableName A Null-terminated string that is the name of the vendor's variable.\r
	48	@param[in] VendorGuid A unique identifier for the vendor.\r
	49	\r
	50	@retval TRUE This is SecureBootPolicy Variable\r
	51	@retval FALSE This is not SecureBootPolicy Variable\r
	52	**/\r
	53	BOOLEAN\r
	54	IsSecureBootPolicyVariable (\r
	55	IN CHAR16 *VariableName,\r
	56	IN EFI_GUID *VendorGuid\r
	57	)\r
	58	{\r
	59	UINTN Index;\r
	60	\r
	61	for (Index = 0; Index < sizeof(mVariableType)/sizeof(mVariableType[0]); Index++) {\r
	62	if ((StrCmp (VariableName, mVariableType[Index].VariableName) == 0) &&\r
	63	(CompareGuid (VendorGuid, mVariableType[Index].VendorGuid))) {\r
	64	return TRUE;\r
	65	}\r
	66	}\r
	67	return FALSE;\r
	68	}\r
	69	\r
	70	/**\r
	71	Measure and log an EFI variable, and extend the measurement result into a specific PCR.\r
	72	\r
	73	@param[in] VarName A Null-terminated string that is the name of the vendor's variable.\r
	74	@param[in] VendorGuid A unique identifier for the vendor.\r
	75	@param[in] VarData The content of the variable data.\r
	76	@param[in] VarSize The size of the variable data.\r
	77	\r
	78	@retval EFI_SUCCESS Operation completed successfully.\r
	79	@retval EFI_OUT_OF_RESOURCES Out of memory.\r
	80	@retval EFI_DEVICE_ERROR The operation was unsuccessful.\r
	81	\r
	82	**/\r
	83	EFI_STATUS\r
	84	EFIAPI\r
	85	MeasureVariable (\r
	86	IN CHAR16 *VarName,\r
	87	IN EFI_GUID *VendorGuid,\r
	88	IN VOID *VarData,\r
	89	IN UINTN VarSize\r
	90	)\r
	91	{\r
	92	EFI_STATUS Status;\r
	93	UINTN VarNameLength;\r
1de3b7fd	94	UEFI_VARIABLE_DATA *VarLog;\r
fa0737a8 SZ	95	UINT32 VarLogSize;\r
	96	\r
	97	ASSERT ((VarSize == 0 && VarData == NULL) \|\| (VarSize != 0 && VarData != NULL));\r
	98	\r
	99	VarNameLength = StrLen (VarName);\r
	100	VarLogSize = (UINT32)(sizeof (VarLog) + VarNameLength sizeof (*VarName) + VarSize\r
	101	- sizeof (VarLog->UnicodeName) - sizeof (VarLog->VariableData));\r
	102	\r
1de3b7fd	103	VarLog = (UEFI_VARIABLE_DATA *) AllocateZeroPool (VarLogSize);\r
fa0737a8 SZ	104	if (VarLog == NULL) {\r
	105	return EFI_OUT_OF_RESOURCES;\r
	106	}\r
	107	\r
	108	CopyMem (&VarLog->VariableName, VendorGuid, sizeof(VarLog->VariableName));\r
	109	VarLog->UnicodeNameLength = VarNameLength;\r
	110	VarLog->VariableDataLength = VarSize;\r
	111	CopyMem (\r
	112	VarLog->UnicodeName,\r
	113	VarName,\r
	114	VarNameLength * sizeof (*VarName)\r
	115	);\r
	116	if (VarSize != 0) {\r
	117	CopyMem (\r
	118	(CHAR16 *)VarLog->UnicodeName + VarNameLength,\r
	119	VarData,\r
	120	VarSize\r
	121	);\r
	122	}\r
	123	\r
7ef0dae0	124	DEBUG ((EFI_D_INFO, "VariableDxe: MeasureVariable (Pcr - %x, EventType - %x, ", (UINTN)7, (UINTN)EV_EFI_VARIABLE_DRIVER_CONFIG));\r
fa0737a8 SZ	125	DEBUG ((EFI_D_INFO, "VariableName - %s, VendorGuid - %g)\n", VarName, VendorGuid));\r
	126	\r
	127	Status = TpmMeasureAndLogData (\r
	128	7,\r
	129	EV_EFI_VARIABLE_DRIVER_CONFIG,\r
	130	VarLog,\r
	131	VarLogSize,\r
	132	VarLog,\r
	133	VarLogSize\r
	134	);\r
	135	FreePool (VarLog);\r
	136	return Status;\r
	137	}\r
	138	\r
	139	/**\r
	140	Returns the status whether get the variable success. The function retrieves\r
	141	variable through the UEFI Runtime Service GetVariable(). The\r
	142	returned buffer is allocated using AllocatePool(). The caller is responsible\r
	143	for freeing this buffer with FreePool().\r
	144	\r
	145	This API is only invoked in boot time. It may NOT be invoked at runtime.\r
	146	\r
	147	@param[in] Name The pointer to a Null-terminated Unicode string.\r
	148	@param[in] Guid The pointer to an EFI_GUID structure\r
	149	@param[out] Value The buffer point saved the variable info.\r
	150	@param[out] Size The buffer size of the variable.\r
	151	\r
	152	@return EFI_OUT_OF_RESOURCES Allocate buffer failed.\r
	153	@return EFI_SUCCESS Find the specified variable.\r
	154	@return Others Errors Return errors from call to gRT->GetVariable.\r
	155	\r
	156	**/\r
	157	EFI_STATUS\r
	158	InternalGetVariable (\r
	159	IN CONST CHAR16 *Name,\r
	160	IN CONST EFI_GUID *Guid,\r
	161	OUT VOID **Value,\r
	162	OUT UINTN *Size\r
	163	)\r
	164	{\r
	165	EFI_STATUS Status;\r
	166	UINTN BufferSize;\r
	167	\r
	168	//\r
	169	// Try to get the variable size.\r
	170	//\r
	171	BufferSize = 0;\r
	172	*Value = NULL;\r
	173	if (Size != NULL) {\r
	174	*Size = 0;\r
	175	}\r
	176	\r
	177	Status = gRT->GetVariable ((CHAR16 ) Name, (EFI_GUID ) Guid, NULL, &BufferSize, *Value);\r
	178	if (Status != EFI_BUFFER_TOO_SMALL) {\r
	179	return Status;\r
	180	}\r
	181	\r
	182	//\r
	183	// Allocate buffer to get the variable.\r
	184	//\r
	185	*Value = AllocatePool (BufferSize);\r
	186	ASSERT (*Value != NULL);\r
	187	if (*Value == NULL) {\r
	188	return EFI_OUT_OF_RESOURCES;\r
189	}\r
190	\r
191	//\r
192	// Get the variable data.\r
193	//\r
194	Status = gRT->GetVariable ((CHAR16 ) Name, (EFI_GUID ) Guid, NULL, &BufferSize, *Value);\r
195	if (EFI_ERROR (Status)) {\r
196	FreePool(*Value);\r
197	*Value = NULL;\r
198	}\r
199	\r
200	if (Size != NULL) {\r
201	*Size = BufferSize;\r
202	}\r
203	\r
204	return Status;\r
205	}\r
206	\r
207	/**\r
208	SecureBoot Hook for SetVariable.\r
209	\r
210	@param[in] VariableName Name of Variable to be found.\r
211	@param[in] VendorGuid Variable vendor GUID.\r
212	\r
213	**/\r
214	VOID\r
215	EFIAPI\r
216	SecureBootHook (\r
217	IN CHAR16 *VariableName,\r
218	IN EFI_GUID *VendorGuid\r
219	)\r
220	{\r
221	EFI_STATUS Status;\r
222	UINTN VariableDataSize;\r
223	VOID *VariableData;\r
224	\r
225	if (!IsSecureBootPolicyVariable (VariableName, VendorGuid)) {\r
226	return ;\r
227	}\r
228	\r
229	//\r
230	// We should NOT use Data and DataSize here,because it may include signature,\r
231	// or is just partial with append attributes, or is deleted.\r
232	// We should GetVariable again, to get full variable content.\r
233	//\r
234	Status = InternalGetVariable (\r
235	VariableName,\r
236	VendorGuid,\r
237	&VariableData,\r
238	&VariableDataSize\r
239	);\r
240	if (EFI_ERROR (Status)) {\r
588bb5ae ZC	241	//\r
	242	// Measure DBT only if present and not empty\r
	243	//\r
	244	if (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0 &&\r
	245	CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid)) {\r
	246	DEBUG((DEBUG_INFO, "Skip measuring variable %s since it's deleted\n", EFI_IMAGE_SECURITY_DATABASE2));\r
	247	return;\r
	248	} else {\r
	249	VariableData = NULL;\r
	250	VariableDataSize = 0;\r
	251	}\r
fa0737a8 SZ	252	}\r
	253	\r
	254	Status = MeasureVariable (\r
	255	VariableName,\r
	256	VendorGuid,\r
	257	VariableData,\r
	258	VariableDataSize\r
	259	);\r
	260	DEBUG ((EFI_D_INFO, "MeasureBootPolicyVariable - %r\n", Status));\r
	261	\r
	262	if (VariableData != NULL) {\r
	263	FreePool (VariableData);\r
	264	}\r
	265	\r
dc9bd6ed ZC	266	//\r
	267	// "SecureBoot" is 8bit & read-only. It can only be changed according to PK update\r
	268	//\r
	269	if ((StrCmp (VariableName, EFI_PLATFORM_KEY_NAME) == 0) &&\r
	270	CompareGuid (VendorGuid, &gEfiGlobalVariableGuid)) {\r
	271	Status = InternalGetVariable (\r
	272	EFI_SECURE_BOOT_MODE_NAME,\r
	273	&gEfiGlobalVariableGuid,\r
	274	&VariableData,\r
	275	&VariableDataSize\r
	276	);\r
	277	if (EFI_ERROR (Status)) {\r
	278	return;\r
	279	}\r
	280	\r
	281	//\r
	282	// If PK update is successful. "SecureBoot" shall always exist ever since variable write service is ready\r
	283	//\r
	284	ASSERT(mSecureBootVarData != NULL);\r
	285	\r
	286	if (CompareMem(mSecureBootVarData, VariableData, VariableDataSize) != 0) {\r
	287	FreePool(mSecureBootVarData);\r
	288	mSecureBootVarData = VariableData;\r
	289	mSecureBootVarDataSize = VariableDataSize;\r
	290	\r
	291	DEBUG((DEBUG_INFO, "%s variable updated according to PK change. Remeasure the value!\n", EFI_SECURE_BOOT_MODE_NAME));\r
	292	Status = MeasureVariable (\r
	293	EFI_SECURE_BOOT_MODE_NAME,\r
	294	&gEfiGlobalVariableGuid,\r
	295	mSecureBootVarData,\r
	296	mSecureBootVarDataSize\r
	297	);\r
	298	DEBUG ((DEBUG_INFO, "MeasureBootPolicyVariable - %r\n", Status));\r
	299	} else {\r
	300	//\r
	301	// "SecureBoot" variable is not changed\r
	302	//\r
	303	FreePool(VariableData);\r
	304	}\r
	305	}\r
	306	\r
fa0737a8 SZ	307	return ;\r
fa0737a8 SZ	308	}\r
dc9bd6ed ZC	309	\r
	310	/**\r
	311	Some Secure Boot Policy Variable may update following other variable changes(SecureBoot follows PK change, etc).\r
	312	Record their initial State when variable write service is ready.\r
	313	\r
	314	**/\r
	315	VOID\r
	316	EFIAPI\r
	317	RecordSecureBootPolicyVarData(\r
	318	VOID\r
	319	)\r
	320	{\r
	321	EFI_STATUS Status;\r
	322	\r
	323	//\r
	324	// Record initial "SecureBoot" variable value.\r
	325	// It is used to detect SecureBoot variable change in SecureBootHook.\r
	326	//\r
	327	Status = InternalGetVariable (\r
	328	EFI_SECURE_BOOT_MODE_NAME,\r
	329	&gEfiGlobalVariableGuid,\r
	330	(VOID **)&mSecureBootVarData,\r
	331	&mSecureBootVarDataSize\r
	332	);\r
	333	if (EFI_ERROR(Status)) {\r
	334	//\r
	335	// Read could fail when Auth Variable solution is not supported\r
	336	//\r
	337	DEBUG((DEBUG_INFO, "RecordSecureBootPolicyVarData GetVariable %s Status %x\n", EFI_SECURE_BOOT_MODE_NAME, Status));\r
	338	}\r
	339	}\r