SecurityPkg: PlatformPKProtectionLib: Added PK protection interface

[mirror_edk2.git] / SecurityPkg / Library / PlatformPKProtectionLibVarPolicy / PlatformPKProtectionLibVarPolicy.c

/** @file\r
  Provides an abstracted interface for configuring PK related variable protection.\r
\r
  Copyright (c) Microsoft Corporation.\r
  SPDX-License-Identifier: BSD-2-Clause-Patent\r
\r
**/\r
#include <Uefi.h>\r
#include <Protocol/VariablePolicy.h>\r
\r
#include <Library/DebugLib.h>\r
#include <Library/UefiBootServicesTableLib.h>\r
\r
/**\r
  Disable any applicable protection against variable 'PK'. The implementation\r
  of this interface is platform specific, depending on the protection techniques\r
  used per platform.\r
\r
  Note: It is the platform's responsibility to conduct cautious operation after\r
        disabling this protection.\r
\r
  @retval     EFI_SUCCESS             State has been successfully updated.\r
  @retval     Others                  Error returned from implementation specific\r
                                      underying APIs.\r
\r
**/\r
EFI_STATUS\r
EFIAPI\r
DisablePKProtection (\r
  VOID\r
  )\r
{\r
  EFI_STATUS                      Status;\r
  EDKII_VARIABLE_POLICY_PROTOCOL  *VariablePolicy;\r
\r
  DEBUG ((DEBUG_INFO, "%a() Entry...\n", __FUNCTION__));\r
\r
  // IMPORTANT NOTE: This operation is sticky and leaves variable protections disabled.\r
  //                  The system *MUST* be reset after performing this operation.\r
  Status = gBS->LocateProtocol (&gEdkiiVariablePolicyProtocolGuid, NULL, (VOID **)&VariablePolicy);\r
  if (!EFI_ERROR (Status)) {\r
    Status = VariablePolicy->DisableVariablePolicy ();\r
    // EFI_ALREADY_STARTED means that everything is currently disabled.\r
    // This should be considered SUCCESS.\r
    if (Status == EFI_ALREADY_STARTED) {\r
      Status = EFI_SUCCESS;\r
    }\r
  }\r
\r
  return Status;\r
}\r