diff options
7 files changed, 706 insertions, 429 deletions
diff --git a/SecurityPkg/VariableAuthenticated/Pei/Variable.c b/SecurityPkg/VariableAuthenticated/Pei/Variable.c index 240bc8aa43..7549be2dca 100644 --- a/SecurityPkg/VariableAuthenticated/Pei/Variable.c +++ b/SecurityPkg/VariableAuthenticated/Pei/Variable.c @@ -323,7 +323,7 @@ CompareWithValidVariable ( /**
Return the variable store header and the index table based on the Index.
- @param Index The index of the variable store.
+ @param Type The type of the variable store.
@param IndexTable Return the index table.
@return Pointer to the variable store header.
diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c b/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c index ff5c653912..bb625ff2c0 100644 --- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c +++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c @@ -3,12 +3,12 @@ service in UEFI2.2.
Copyright (c) 2009 - 2011, Intel Corporation. All rights reserved.<BR>
-This program and the accompanying materials
-are licensed and made available under the terms and conditions of the BSD License
-which accompanies this distribution. The full text of the license may be found at
+This program and the accompanying materials
+are licensed and made available under the terms and conditions of the BSD License
+which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php
-THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
**/
@@ -18,7 +18,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED. ///
/// Global database array for scratch
-///
+///
UINT8 mPubKeyStore[MAX_KEYDB_SIZE];
UINT32 mPubKeyNumber;
UINT32 mPlatformMode;
@@ -32,28 +32,50 @@ CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 }; //
VOID *mHashCtx = NULL;
-
//
-// Pointer to runtime buffer.
-// For "Append" operation to an existing variable, a read/modify/write operation
-// is supported by firmware internally. Reserve runtime buffer to cache previous
+// Pointer to runtime buffer.
+// For "Append" operation to an existing variable, a read/modify/write operation
+// is supported by firmware internally. Reserve runtime buffer to cache previous
// variable data in runtime phase because memory allocation is forbidden in virtual mode.
//
VOID *mStorageArea = NULL;
+//
+// The serialization of the values of the VariableName, VendorGuid and Attributes
+// parameters of the SetVariable() call and the TimeStamp component of the
+// EFI_VARIABLE_AUTHENTICATION_2 descriptor followed by the variable's new value
+// i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data)
+//
+UINT8 *mSerializationRuntimeBuffer = NULL;
+
/**
- Update platform mode.
+ Internal function to delete a Variable given its name and GUID, no authentication
+ required.
- @param[in] Mode SETUP_MODE or USER_MODE.
+ @param[in] VariableName Name of the Variable.
+ @param[in] VendorGuid GUID of the Variable.
- @return EFI_INVALID_PARAMETER Invalid parameter.
- @return EFI_SUCCESS Update platform mode successfully.
+ @retval EFI_SUCCESS Variable deleted successfully.
+ @retval Others The driver failded to start the device.
**/
EFI_STATUS
-UpdatePlatformMode (
- IN UINT32 Mode
- );
+DeleteVariable (
+ IN CHAR16 *VariableName,
+ IN EFI_GUID *VendorGuid
+ )
+{
+ EFI_STATUS Status;
+ VARIABLE_POINTER_TRACK Variable;
+
+ Status = FindVariable (VariableName, VendorGuid, &Variable, &mVariableModuleGlobal->VariableGlobal);
+ if (EFI_ERROR (Status)) {
+ return EFI_SUCCESS;
+ }
+
+ ASSERT (Variable.CurrPtr != NULL);
+ return UpdateVariable (VariableName, VendorGuid, NULL, 0, 0, 0, 0, &Variable, NULL);
+}
/**
Initializes for authenticated varibale service.
@@ -69,7 +91,6 @@ AutenticatedVariableServiceInitialize ( {
EFI_STATUS Status;
VARIABLE_POINTER_TRACK Variable;
- VARIABLE_POINTER_TRACK Variable2;
UINT8 VarValue;
UINT32 VarAttr;
UINT8 *Data;
@@ -77,7 +98,7 @@ AutenticatedVariableServiceInitialize ( UINTN CtxSize;
UINT8 SecureBootMode;
UINT8 SecureBootEnable;
-
+
//
// Initialize hash context.
//
@@ -90,19 +111,28 @@ AutenticatedVariableServiceInitialize ( //
// Reserved runtime buffer for "Append" operation in virtual mode.
//
- mStorageArea = AllocateRuntimePool (PcdGet32 (PcdMaxAppendVariableSize));
+ mStorageArea = AllocateRuntimePool (PcdGet32 (PcdMaxVariableSize));
if (mStorageArea == NULL) {
return EFI_OUT_OF_RESOURCES;
}
//
- // Check "AuthVarKeyDatabase" variable's existence.
- // If it doesn't exist, create a new one with initial value of 0 and EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
+ // Prepare runtime buffer for serialized data of time-based authenticated
+ // Variable, i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data).
+ //
+ mSerializationRuntimeBuffer = AllocateRuntimePool (PcdGet32 (PcdMaxVariableSize) + sizeof (EFI_GUID) + sizeof (UINT32) + sizeof (EFI_TIME));
+ if (mSerializationRuntimeBuffer == NULL) {
+ return EFI_OUT_OF_RESOURCES;
+ }
+
+ //
+ // Check "AuthVarKeyDatabase" variable's existence.
+ // If it doesn't exist, create a new one with initial value of 0 and EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
//
Status = FindVariable (
- AUTHVAR_KEYDB_NAME,
- &gEfiAuthenticatedVariableGuid,
- &Variable,
+ AUTHVAR_KEYDB_NAME,
+ &gEfiAuthenticatedVariableGuid,
+ &Variable,
&mVariableModuleGlobal->VariableGlobal
);
@@ -135,31 +165,31 @@ AutenticatedVariableServiceInitialize ( mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
}
//
- // Check "SetupMode" variable's existence.
+ // Check "SetupMode" variable's existence.
// If it doesn't exist, check PK database's existence to determine the value.
- // Then create a new one with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
+ // Then create a new one with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
//
Status = FindVariable (
- EFI_SETUP_MODE_NAME,
- &gEfiGlobalVariableGuid,
- &Variable,
+ EFI_SETUP_MODE_NAME,
+ &gEfiGlobalVariableGuid,
+ &Variable,
&mVariableModuleGlobal->VariableGlobal
);
if (Variable.CurrPtr == NULL) {
Status = FindVariable (
- EFI_PLATFORM_KEY_NAME,
- &gEfiGlobalVariableGuid,
- &Variable2,
+ EFI_PLATFORM_KEY_NAME,
+ &gEfiGlobalVariableGuid,
+ &Variable,
&mVariableModuleGlobal->VariableGlobal
);
- if (Variable2.CurrPtr == NULL) {
+ if (Variable.CurrPtr == NULL) {
mPlatformMode = SETUP_MODE;
} else {
mPlatformMode = USER_MODE;
}
- VarAttr = EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
+ VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
Status = UpdateVariable (
EFI_SETUP_MODE_NAME,
&gEfiGlobalVariableGuid,
@@ -178,17 +208,16 @@ AutenticatedVariableServiceInitialize ( mPlatformMode = *(GetVariableDataPtr (Variable.CurrPtr));
}
//
- // Check "SignatureSupport" variable's existence.
- // If it doesn't exist, then create a new one with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
+ // Check "SignatureSupport" variable's existence.
+ // If it doesn't exist, then create a new one with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
//
Status = FindVariable (
- EFI_SIGNATURE_SUPPORT_NAME,
- &gEfiGlobalVariableGuid,
- &Variable,
+ EFI_SIGNATURE_SUPPORT_NAME,
+ &gEfiGlobalVariableGuid,
+ &Variable,
&mVariableModuleGlobal->VariableGlobal
);
-
if (Variable.CurrPtr == NULL) {
VarAttr = EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
Status = UpdateVariable (
@@ -206,26 +235,26 @@ AutenticatedVariableServiceInitialize ( //
// If "SecureBootEnable" variable exists, then update "SecureBoot" variable.
- // If "SecureBootEnable" variable is SECURE_BOOT_ENABLE, Set "SecureBoot" variable to SECURE_BOOT_MODE_ENABLE.
+ // If "SecureBootEnable" variable is SECURE_BOOT_ENABLE and in USER_MODE, Set "SecureBoot" variable to SECURE_BOOT_MODE_ENABLE.
// If "SecureBootEnable" variable is SECURE_BOOT_DISABLE, Set "SecureBoot" variable to SECURE_BOOT_MODE_DISABLE.
//
+ SecureBootEnable = SECURE_BOOT_MODE_DISABLE;
FindVariable (EFI_SECURE_BOOT_ENABLE_NAME, &gEfiSecureBootEnableDisableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal);
if (Variable.CurrPtr != NULL) {
SecureBootEnable = *(GetVariableDataPtr (Variable.CurrPtr));
- if (SecureBootEnable == SECURE_BOOT_ENABLE) {
- SecureBootMode = SECURE_BOOT_MODE_ENABLE;
- } else {
- SecureBootMode = SECURE_BOOT_MODE_DISABLE;
- }
- FindVariable (EFI_SECURE_BOOT_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal);
+ } else if (mPlatformMode == USER_MODE) {
+ //
+ // "SecureBootEnable" not exist, initialize it in USER_MODE.
+ //
+ SecureBootEnable = SECURE_BOOT_MODE_ENABLE;
Status = UpdateVariable (
- EFI_SECURE_BOOT_MODE_NAME,
- &gEfiGlobalVariableGuid,
- &SecureBootMode,
- sizeof(UINT8),
- EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS,
- 0,
- 0,
+ EFI_SECURE_BOOT_ENABLE_NAME,
+ &gEfiSecureBootEnableDisableGuid,
+ &SecureBootEnable,
+ sizeof (UINT8),
+ EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
+ 0,
+ 0,
&Variable,
NULL
);
@@ -234,44 +263,54 @@ AutenticatedVariableServiceInitialize ( }
}
+ if (SecureBootEnable == SECURE_BOOT_ENABLE && mPlatformMode == USER_MODE) {
+ SecureBootMode = SECURE_BOOT_MODE_ENABLE;
+ } else {
+ SecureBootMode = SECURE_BOOT_MODE_DISABLE;
+ }
+ FindVariable (EFI_SECURE_BOOT_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal);
+ Status = UpdateVariable (
+ EFI_SECURE_BOOT_MODE_NAME,
+ &gEfiGlobalVariableGuid,
+ &SecureBootMode,
+ sizeof (UINT8),
+ EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS,
+ 0,
+ 0,
+ &Variable,
+ NULL
+ );
+ if (EFI_ERROR (Status)) {
+ return Status;
+ }
+
//
// Detect whether a secure platform-specific method to clear PK(Platform Key)
- // is configured by platform owner. This method is provided for users force to clear PK
+ // is configured by platform owner. This method is provided for users force to clear PK
// in case incorrect enrollment mis-haps.
//
if (ForceClearPK ()) {
//
- // 1. Check whether PK is existing, and clear PK if existing
+ // 1. Clear PK.
//
- FindVariable (
- EFI_PLATFORM_KEY_NAME,
- &gEfiGlobalVariableGuid,
- &Variable,
- &mVariableModuleGlobal->VariableGlobal
- );
- if (Variable.CurrPtr != NULL) {
- VarAttr = EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
- Status = UpdateVariable (
- EFI_PLATFORM_KEY_NAME,
- &gEfiGlobalVariableGuid,
- NULL,
- 0,
- VarAttr,
- 0,
- 0,
- &Variable,
- NULL
- );
- if (EFI_ERROR (Status)) {
- return Status;
- }
+ Status = DeleteVariable (EFI_PLATFORM_KEY_NAME, &gEfiGlobalVariableGuid);
+ if (EFI_ERROR (Status)) {
+ return Status;
}
//
- // 2. Update "SetupMode" variable to SETUP_MODE
+ // 2. Update "SetupMode" variable to SETUP_MODE.
//
UpdatePlatformMode (SETUP_MODE);
+
+ //
+ // 3. Clear KEK, DB and DBX.
+ //
+ DeleteVariable (EFI_KEY_EXCHANGE_KEY_NAME, &gEfiGlobalVariableGuid);
+ DeleteVariable (EFI_IMAGE_SECURITY_DATABASE, &gEfiImageSecurityDatabaseGuid);
+ DeleteVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid);
}
+
return Status;
}
@@ -358,9 +397,9 @@ AddPubKeyInStore ( @param[in] DataSize Size of Data.
@param[in] PubKey Public key used for verification.
- @return EFI_INVALID_PARAMETER Invalid parameter.
+ @retval EFI_INVALID_PARAMETER Invalid parameter.
@retval EFI_SECURITY_VIOLATION If authentication failed.
- @return EFI_SUCCESS Authentication successful.
+ @retval EFI_SUCCESS Authentication successful.
**/
EFI_STATUS
@@ -427,7 +466,7 @@ VerifyCounterBasedPayload ( //
Rsa = RsaNew ();
ASSERT (Rsa != NULL);
- //
+ //
// Set RSA Key Components.
// NOTE: Only N and E are needed to be set as RSA public key for signature verification.
//
@@ -443,10 +482,10 @@ VerifyCounterBasedPayload ( // Verify the signature.
//
Status = RsaPkcs1Verify (
- Rsa,
- Digest,
- SHA256_DIGEST_SIZE,
- CertBlock->Signature,
+ Rsa,
+ Digest,
+ SHA256_DIGEST_SIZE,
+ CertBlock->Signature,
EFI_CERT_TYPE_RSA2048_SHA256_SIZE
);
@@ -461,7 +500,6 @@ Done: }
}
-
/**
Update platform mode.
@@ -482,11 +520,11 @@ UpdatePlatformMode ( UINT8 SecureBootMode;
UINT8 SecureBootEnable;
UINTN VariableDataSize;
-
+
Status = FindVariable (
- EFI_SETUP_MODE_NAME,
- &gEfiGlobalVariableGuid,
- &Variable,
+ EFI_SETUP_MODE_NAME,
+ &gEfiGlobalVariableGuid,
+ &Variable,
&mVariableModuleGlobal->VariableGlobal
);
if (EFI_ERROR (Status)) {
@@ -494,7 +532,7 @@ UpdatePlatformMode ( }
mPlatformMode = Mode;
- VarAttr = EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
+ VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
Status = UpdateVariable (
EFI_SETUP_MODE_NAME,
&gEfiGlobalVariableGuid,
@@ -510,15 +548,24 @@ UpdatePlatformMode ( return Status;
}
+ if (AtRuntime ()) {
+ //
+ // SecureBoot Variable indicates whether the platform firmware is operating
+ // in Secure boot mode (1) or not (0), so we should not change SecureBoot
+ // Variable in runtime.
+ //
+ return Status;
+ }
+
//
// Check "SecureBoot" variable's existence.
// If it doesn't exist, firmware has no capability to perform driver signing verification,
// then set "SecureBoot" to 0.
//
Status = FindVariable (
- EFI_SECURE_BOOT_MODE_NAME,
- &gEfiGlobalVariableGuid,
- &Variable,
+ EFI_SECURE_BOOT_MODE_NAME,
+ &gEfiGlobalVariableGuid,
+ &Variable,
&mVariableModuleGlobal->VariableGlobal
);
//
@@ -538,7 +585,7 @@ UpdatePlatformMode ( }
}
- VarAttr = EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
+ VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
Status = UpdateVariable (
EFI_SECURE_BOOT_MODE_NAME,
&gEfiGlobalVariableGuid,
@@ -550,7 +597,6 @@ UpdatePlatformMode ( &Variable,
NULL
);
-
if (EFI_ERROR (Status)) {
return Status;
}
@@ -559,12 +605,12 @@ UpdatePlatformMode ( // Check "SecureBootEnable" variable's existence. It can enable/disable secure boot feature.
//
Status = FindVariable (
- EFI_SECURE_BOOT_ENABLE_NAME,
- &gEfiSecureBootEnableDisableGuid,
- &Variable,
+ EFI_SECURE_BOOT_ENABLE_NAME,
+ &gEfiSecureBootEnableDisableGuid,
+ &Variable,
&mVariableModuleGlobal->VariableGlobal
);
-
+
if (SecureBootMode == SECURE_BOOT_MODE_ENABLE) {
//
// Create the "SecureBootEnable" variable as secure boot is enabled.
@@ -573,7 +619,7 @@ UpdatePlatformMode ( VariableDataSize = sizeof (SecureBootEnable);
} else {
//
- // Delete the "SecureBootEnable" variable if this variable exist as "SecureBoot"
+ // Delete the "SecureBootEnable" variable if this variable exist as "SecureBoot"
// variable is not in secure boot state.
//
if (Variable.CurrPtr == NULL || EFI_ERROR (Status)) {
@@ -582,15 +628,15 @@ UpdatePlatformMode ( SecureBootEnable = SECURE_BOOT_DISABLE;
VariableDataSize = 0;
}
-
+
Status = UpdateVariable (
- EFI_SECURE_BOOT_ENABLE_NAME,
- &gEfiSecureBootEnableDisableGuid,
- &SecureBootEnable,
- VariableDataSize,
- EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
- 0,
- 0,
+ EFI_SECURE_BOOT_ENABLE_NAME,
+ &gEfiSecureBootEnableDisableGuid,
+ &SecureBootEnable,
+ VariableDataSize,
+ EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
+ 0,
+ 0,
&Variable,
NULL
);
@@ -610,8 +656,8 @@ UpdatePlatformMode ( @param[in] IsPk Indicate whether it is to process pk.
@return EFI_INVALID_PARAMETER Invalid parameter.
- @return EFI_SECURITY_VIOLATION The variable does NOT pass the validation.
- check carried out by the firmware.
+ @return EFI_SECURITY_VIOLATION The variable does NOT pass the validation.
+ check carried out by the firmware.
@return EFI_SUCCESS Variable passed validation successfully.
**/
@@ -633,6 +679,10 @@ ProcessVarWithPk ( EFI_VARIABLE_AUTHENTICATION *CertData;
BOOLEAN TimeBase;
BOOLEAN Del;
+ UINT8 *Payload;
+ UINTN PayloadSize;
+ UINT64 MonotonicCount;
+ EFI_TIME *TimeStamp;
if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0) {
//
@@ -687,29 +737,29 @@ ProcessVarWithPk ( // Get platform key from variable.
//
Status = FindVariable (
- EFI_PLATFORM_KEY_NAME,
- &gEfiGlobalVariableGuid,
- &PkVariable,
+ EFI_PLATFORM_KEY_NAME,
+ &gEfiGlobalVariableGuid,
+ &PkVariable,
&mVariableModuleGlobal->VariableGlobal
);
ASSERT_EFI_ERROR (Status);
-
+
OldPkList = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (PkVariable.CurrPtr);
OldPkData = (EFI_SIGNATURE_DATA *) ((UINT8 *) OldPkList + sizeof (EFI_SIGNATURE_LIST) + OldPkList->SignatureHeaderSize);
Status = VerifyCounterBasedPayload (Data, DataSize, OldPkData->SignatureData);
if (!EFI_ERROR (Status)) {
Status = UpdateVariable (
- VariableName,
- VendorGuid,
- (UINT8*)Data + AUTHINFO_SIZE,
- DataSize - AUTHINFO_SIZE,
- Attributes,
- 0,
- CertData->MonotonicCount,
+ VariableName,
+ VendorGuid,
+ (UINT8*)Data + AUTHINFO_SIZE,
+ DataSize - AUTHINFO_SIZE,
+ Attributes,
+ 0,
+ CertData->MonotonicCount,
Variable,
NULL
);
-
+
if (!EFI_ERROR (Status)) {
//
// If delete PK in user mode, need change to setup mode.
@@ -721,7 +771,46 @@ ProcessVarWithPk ( }
}
} else {
- Status = UpdateVariable (VariableName, VendorGuid, Data, DataSize, Attributes, 0, 0, Variable, NULL);
+ //
+ // Process PK or KEK in Setup mode.
+ //
+ if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
+ //
+ // Time-based Authentication descriptor.
+ //
+ MonotonicCount = 0;
+ TimeStamp = &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp;
+ Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
+ PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
+ } else if ((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) {
+ //
+ // Counter-based Authentication descriptor.
+ //
+ MonotonicCount = ((EFI_VARIABLE_AUTHENTICATION *) Data)->MonotonicCount;
+ TimeStamp = NULL;
+ Payload = (UINT8*) Data + AUTHINFO_SIZE;
+ PayloadSize = DataSize - AUTHINFO_SIZE;
+ } else {
+ //
+ // No Authentication descriptor.
+ //
+ MonotonicCount = 0;
+ TimeStamp = NULL;
+ Payload = Data;
+ PayloadSize = DataSize;
+ }
+
+ Status = UpdateVariable (
+ VariableName,
+ VendorGuid,
+ Payload,
+ PayloadSize,
+ Attributes,
+ 0,
+ MonotonicCount,
+ Variable,
+ TimeStamp
+ );
//
// If enroll PK in setup mode, need change to user mode.
//
@@ -745,8 +834,8 @@ ProcessVarWithPk ( @param[in] Attributes Attribute value of the variable.
@return EFI_INVALID_PARAMETER Invalid parameter.
- @return EFI_SECURITY_VIOLATION The variable does NOT pass the validation
- check carried out by the firmware.
+ @return EFI_SECURITY_VIOLATION The variable does NOT pass the validation
+ check carried out by the firmware.
@return EFI_SUCCESS Variable pass validation successfully.
**/
@@ -770,6 +859,9 @@ ProcessVarWithKek ( BOOLEAN IsFound;
UINT32 Index;
UINT32 KekDataSize;
+ UINT8 *Payload;
+ UINTN PayloadSize;
+ UINT64 MonotonicCount;
if (mPlatformMode == USER_MODE) {
if ((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) == 0) {
@@ -791,9 +883,9 @@ ProcessVarWithKek ( // Get KEK database from variable.
//
Status = FindVariable (
- EFI_KEY_EXCHANGE_KEY_NAME,
- &gEfiGlobalVariableGuid,
- &KekVariable,
+ EFI_KEY_EXCHANGE_KEY_NAME,
+ &gEfiGlobalVariableGuid,
+ &KekVariable,
&mVariableModuleGlobal->VariableGlobal
);
ASSERT_EFI_ERROR (Status);
@@ -821,7 +913,7 @@ ProcessVarWithKek ( KekDataSize -= KekList->SignatureListSize;
KekList = (EFI_SIGNATURE_LIST *) ((UINT8 *) KekList + KekList->SignatureListSize);
}
-
+
if (!IsFound) {
return EFI_SECURITY_VIOLATION;
}
@@ -829,13 +921,13 @@ ProcessVarWithKek ( Status = VerifyCounterBasedPayload (Data, DataSize, CertBlock->PublicKey);
if (!EFI_ERROR (Status)) {
Status = UpdateVariable (
- VariableName,
- VendorGuid,
- (UINT8*)Data + AUTHINFO_SIZE,
- DataSize - AUTHINFO_SIZE,
- Attributes,
- 0,
- CertData->MonotonicCount,
+ VariableName,
+ VendorGuid,
+ (UINT8*)Data + AUTHINFO_SIZE,
+ DataSize - AUTHINFO_SIZE,
+ Attributes,
+ 0,
+ CertData->MonotonicCount,
Variable,
NULL
);
@@ -844,14 +936,30 @@ ProcessVarWithKek ( //
// If in setup mode, no authentication needed.
//
+ if ((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) {
+ //
+ // Counter-based Authentication descriptor.
+ //
+ MonotonicCount = ((EFI_VARIABLE_AUTHENTICATION *) Data)->MonotonicCount;
+ Payload = (UINT8*) Data + AUTHINFO_SIZE;
+ PayloadSize = DataSize - AUTHINFO_SIZE;
+ } else {
+ //
+ // No Authentication descriptor.
+ //
+ MonotonicCount = 0;
+ Payload = Data;
+ PayloadSize = DataSize;
+ }
+
Status = UpdateVariable (
- VariableName,
- VendorGuid,
- Data,
- DataSize,
- Attributes,
- 0,
- 0,
+ VariableName,
+ VendorGuid,
+ Payload,
+ PayloadSize,
+ Attributes,
+ 0,
+ MonotonicCount,
Variable,
NULL
);
@@ -876,8 +984,8 @@ ProcessVarWithKek ( @return EFI_WRITE_PROTECTED Variable is write-protected and needs authentication with
EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
@return EFI_SECURITY_VIOLATION The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
- set, but the AuthInfo does NOT pass the validation
- check carried out by the firmware.
+ set, but the AuthInfo does NOT pass the validation
+ check carried out by the firmware.
@return EFI_SUCCESS Variable is not write-protected or pass validation successfully.
**/
@@ -900,7 +1008,7 @@ ProcessVariable ( UINT32 KeyIndex;
UINT64 MonotonicCount;
- KeyIndex = 0;
+ KeyIndex = 0;
CertData = NULL;
CertBlock = NULL;
PubKey = NULL;
@@ -912,7 +1020,7 @@ ProcessVariable ( if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
return VerifyTimeBasedPayload (VariableName, VendorGuid, Data, DataSize, Variable, Attributes, FALSE, NULL);
}
-
+
//
// Determine if first time SetVariable with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS.
//
@@ -979,7 +1087,7 @@ ProcessVariable ( //
return EFI_SECURITY_VIOLATION;
}
- }
+ }
//
// Verify the certificate in Data payload.
//
@@ -987,7 +1095,7 @@ ProcessVariable ( if (EFI_ERROR (Status)) {
return Status;
}
-
+
//
// Now, the signature has been verified!
//
@@ -1005,6 +1113,114 @@ ProcessVariable ( }
/**
+ Merge two buffers which formatted as EFI_SIGNATURE_LIST. Only the new EFI_SIGNATURE_DATA
+ will be appended to the original EFI_SIGNATURE_LIST, duplicate EFI_SIGNATURE_DATA
+ will be ignored.
+
+ @param[in, out] Data Pointer to original EFI_SIGNATURE_LIST.
+ @param[in] DataSize Size of Data buffer.
+ @param[in] NewData Pointer to new EFI_SIGNATURE_LIST to be appended.
+ @param[in] NewDataSize Size of NewData buffer.
+
+ @return Size of the merged buffer.
+
+**/
+UINTN
+AppendSignatureList (
+ IN OUT VOID *Data,
+ IN UINTN DataSize,
+ IN VOID *NewData,
+ IN UINTN NewDataSize
+ )
+{
+ EFI_SIGNATURE_LIST *CertList;
+ EFI_SIGNATURE_DATA *Cert;
+ UINTN CertCount;
+ EFI_SIGNATURE_LIST *NewCertList;
+ EFI_SIGNATURE_DATA *NewCert;
+ UINTN NewCertCount;
+ UINTN Index;
+ UINTN Index2;
+ UINTN Size;
+ UINT8 *Tail;
+ UINTN CopiedCount;
+ UINTN SignatureListSize;
+ BOOLEAN IsNewCert;
+
+ Tail = (UINT8 *) Data + DataSize;
+
+ NewCertList = (EFI_SIGNATURE_LIST *) NewData;
+ while ((NewDataSize > 0) && (NewDataSize >= NewCertList->SignatureListSize)) {
+ NewCert = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCertList + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
+ NewCertCount = (NewCertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - NewCertList->SignatureHeaderSize) / NewCertList->SignatureSize;
+
+ CopiedCount = 0;
+ for (Index = 0; Index < NewCertCount; Index++) {
+ IsNewCert = TRUE;
+
+ Size = DataSize;
+ CertList = (EFI_SIGNATURE_LIST *) Data;
+ while ((Size > 0) && (Size >= CertList->SignatureListSize)) {
+ if (CompareGuid (&CertList->SignatureType, &NewCertList->SignatureType) &&
+ (CertList->SignatureSize == NewCertList->SignatureSize)) {
+ Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
+ CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
+ for (Index2 = 0; Index2 < CertCount; Index2++) {
+ //
+ // Iterate each Signature Data in this Signature List.
+ //
+ if (CompareMem (NewCert, Cert, CertList->SignatureSize) == 0) {
+ IsNewCert = FALSE;
+ break;
+ }
+ Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
+ }
+ }
+
+ if (!IsNewCert) {
+ break;
+ }
+ Size -= CertList->SignatureListSize;
+ CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
+ }
+
+ if (IsNewCert) {
+ //
+ // New EFI_SIGNATURE_DATA, append it.
+ //
+ if (CopiedCount == 0) {
+ //
+ // Copy EFI_SIGNATURE_LIST header for only once.
+ //
+ CopyMem (Tail, NewCertList, sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
+ Tail = Tail + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
+ }
+
+ CopyMem (Tail, NewCert, NewCertList->SignatureSize);
+ Tail += NewCertList->SignatureSize;
+ CopiedCount++;
+ }
+
+ NewCert = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCert + NewCertList->SignatureSize);
+ }
+
+ //
+ // Update SignatureListSize in newly appended EFI_SIGNATURE_LIST.
+ //
+ if (CopiedCount != 0) {
+ SignatureListSize = sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize + (CopiedCount * NewCertList->SignatureSize);
+ CertList = (EFI_SIGNATURE_LIST *) (Tail - SignatureListSize);
+ CertList->SignatureListSize = (UINT32) SignatureListSize;
+ }
+
+ NewDataSize -= NewCertList->SignatureListSize;
+ NewCertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) NewCertList + NewCertList->SignatureListSize);
+ }
+
+ return (Tail - (UINT8 *) Data);
+}
+
+/**
Compare two EFI_TIME data.
@@ -1031,7 +1247,7 @@ CompareTimeStamp ( return (BOOLEAN) (FirstTime->Hour < SecondTime->Hour);
} else if (FirstTime->Minute != SecondTime->Minute) {
return (BOOLEAN) (FirstTime->Minute < FirstTime->Minute);
- }
+ }
return (BOOLEAN) (FirstTime->Second <= SecondTime->Second);
}
@@ -1050,8 +1266,8 @@ CompareTimeStamp ( @param[out] VarDel Delete the variable or not.
@retval EFI_INVALID_PARAMETER Invalid parameter.
- @retval EFI_SECURITY_VIOLATION The variable does NOT pass the validation
- check carried out by the firmware.
+ @retval EFI_SECURITY_VIOLATION The variable does NOT pass the validation
+ check carried out by the firmware.
@retval EFI_OUT_OF_RESOURCES Failed to process variable due to lack
of resources.
@retval EFI_SUCCESS Variable pass validation successfully.
@@ -1071,11 +1287,11 @@ VerifyTimeBasedPayload ( {
UINT8 *RootCert;
UINT8 *SigData;
- UINT8 *PayLoadPtr;
+ UINT8 *PayloadPtr;
UINTN RootCertSize;
UINTN Index;
- UINTN CertCount;
- UINTN PayLoadSize;
+ UINTN CertCount;
+ UINTN PayloadSize;
UINT32 Attr;
UINT32 SigDataSize;
UINT32 KekDataSize;
@@ -1089,7 +1305,8 @@ VerifyTimeBasedPayload ( UINT8 *NewData;
UINTN NewDataSize;
VARIABLE_POINTER_TRACK PkVariable;
-
+ UINT8 *Buffer;
+ UINTN Length;
Result = FALSE;
VerifyStatus = FALSE;
@@ -1098,15 +1315,27 @@ VerifyTimeBasedPayload ( Attr = Attributes;
//
- // When the attribute EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS is
+ // When the attribute EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS is
// set, then the Data buffer shall begin with an instance of a complete (and serialized)
- // EFI_VARIABLE_AUTHENTICATION_2 descriptor. The descriptor shall be followed by the new
- // variable value and DataSize shall reflect the combined size of the descriptor and the new
- // variable value. The authentication descriptor is not part of the variable data and is not
+ // EFI_VARIABLE_AUTHENTICATION_2 descriptor. The descriptor shall be followed by the new
+ // variable value and DataSize shall reflect the combined size of the descriptor and the new
+ // variable value. The authentication descriptor is not part of the variable data and is not
// returned by subsequent calls to GetVariable().
//
CertData = (EFI_VARIABLE_AUTHENTICATION_2 *) Data;
-
+
+ //
+ // Verify that Pad1, Nanosecond, TimeZone, Daylight and Pad2 components of the
+ // TimeStamp value are set to zero.
+ //
+ if ((CertData->TimeStamp.Pad1 != 0) ||
+ (CertData->TimeStamp.Nanosecond != 0) ||
+ (CertData->TimeStamp.TimeZone != 0) ||
+ (CertData->TimeStamp.Daylight != 0) ||
+ (CertData->TimeStamp.Pad2 != 0)) {
+ return EFI_INVALID_PARAMETER;
+ }
+
if ((Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
if (CompareTimeStamp (&CertData->TimeStamp, &Variable->CurrPtr->TimeStamp)) {
//
@@ -1121,84 +1350,60 @@ VerifyTimeBasedPayload ( // Cert type should be EFI_CERT_TYPE_PKCS7_GUID.
//
if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
- !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertPkcs7Guid)
- ) {
+ !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertPkcs7Guid)) {
//
// Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
//
return EFI_SECURITY_VIOLATION;
}
-
+
//
// Find out Pkcs7 SignedData which follows the EFI_VARIABLE_AUTHENTICATION_2 descriptor.
// AuthInfo.Hdr.dwLength is the length of the entire certificate, including the length of the header.
//
- SigData = (UINT8*) ((UINTN)Data + OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2, AuthInfo) + OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData));
+ SigData = CertData->AuthInfo.CertData;
+ SigDataSize = CertData->AuthInfo.Hdr.dwLength - (UINT32) (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData));
//
- // Sanity check to avoid corrupted certificate input.
- //
- if (CertData->AuthInfo.Hdr.dwLength < (UINT32)(OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData))) {
- return EFI_SECURITY_VIOLATION;
- }
-
-
-
- SigDataSize = CertData->AuthInfo.Hdr.dwLength - (UINT32)(OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData));
-
- //
// Find out the new data payload which follows Pkcs7 SignedData directly.
//
- PayLoadPtr = (UINT8*) ((UINTN) SigData + (UINTN) SigDataSize);
-
- //
- // Sanity check to avoid corrupted certificate input.
- //
- if (DataSize < (OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2, AuthInfo) + OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData)+ (UINTN) SigDataSize)) {
- return EFI_SECURITY_VIOLATION;
- }
-
- PayLoadSize = DataSize - OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2, AuthInfo) - OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData) - (UINTN) SigDataSize;
-
+ PayloadPtr = SigData + SigDataSize;
+ PayloadSize = DataSize - OFFSET_OF_AUTHINFO2_CERT_DATA - (UINTN) SigDataSize;
//
// Construct a buffer to fill with (VariableName, VendorGuid, Attributes, TimeStamp, Data).
//
- NewDataSize = PayLoadSize + sizeof (EFI_TIME) + sizeof (UINT32) +
- sizeof (EFI_GUID) + StrSize (VariableName);
- NewData = (UINT8 *) AllocateZeroPool (NewDataSize);
-
- if (NewData == NULL) {
- return EFI_OUT_OF_RESOURCES;
- }
-
- CopyMem (NewData, VariableName, StrSize (VariableName));
+ NewDataSize = PayloadSize + sizeof (EFI_TIME) + sizeof (UINT32) +
+ sizeof (EFI_GUID) + StrSize (VariableName) - sizeof (CHAR16);
+ NewData = mSerializationRuntimeBuffer;
- CopyMem (NewData + StrSize (VariableName), VendorGuid, sizeof (EFI_GUID));
+ Buffer = NewData;
+ Length = StrLen (VariableName) * sizeof (CHAR16);
+ CopyMem (Buffer, VariableName, Length);
+ Buffer += Length;
- CopyMem (
- NewData + StrSize (VariableName) + sizeof (EFI_GUID),
- &Attr,
- sizeof (UINT32)
- );
+ Length = sizeof (EFI_GUID);
+ CopyMem (Buffer, VendorGuid, Length);
+ Buffer += Length;
- CopyMem (
- NewData + StrSize (VariableName) + sizeof (EFI_GUID) + sizeof (UINT32),
- &CertData->TimeStamp,
- sizeof (EFI_TIME)
- );
+ Length = sizeof (UINT32);
+ CopyMem (Buffer, &Attr, Length);
+ Buffer += Length;
- CopyMem (NewData + (NewDataSize - PayLoadSize), PayLoadPtr, PayLoadSize);
+ Length = sizeof (EFI_TIME);
+ CopyMem (Buffer, &CertData->TimeStamp, Length);
+ Buffer += Length;
+ CopyMem (Buffer, PayloadPtr, PayloadSize);
if (Pk) {
//
// Get platform key from variable.
//
Status = FindVariable (
- EFI_PLATFORM_KEY_NAME,
- &gEfiGlobalVariableGuid,
- &PkVariable,
+ EFI_PLATFORM_KEY_NAME,
+ &gEfiGlobalVariableGuid,
+ &PkVariable,
&mVariableModuleGlobal->VariableGlobal
);
if (EFI_ERROR (Status)) {
@@ -1224,14 +1429,14 @@ VerifyTimeBasedPayload ( );
} else {
-
+
//
// Get KEK database from variable.
//
Status = FindVariable (
- EFI_KEY_EXCHANGE_KEY_NAME,
- &gEfiGlobalVariableGuid,
- &KekVariable,
+ EFI_KEY_EXCHANGE_KEY_NAME,
+ &gEfiGlobalVariableGuid,
+ &KekVariable,
&mVariableModuleGlobal->VariableGlobal
);
if (EFI_ERROR (Status)) {
@@ -1240,7 +1445,7 @@ VerifyTimeBasedPayload ( //
// Ready to verify Pkcs7 SignedData. Go through KEK Signature Database to find out X.509 CertList.
- //
+ //
KekDataSize = KekVariable.CurrPtr->DataSize;
CertList = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (KekVariable.CurrPtr);
while ((KekDataSize > 0) && (KekDataSize >= CertList->SignatureListSize)) {
@@ -1253,7 +1458,7 @@ VerifyTimeBasedPayload ( //
RootCert = Cert->SignatureData;
RootCertSize = CertList->SignatureSize;
-
+
//
// Verify Pkcs7 SignedData via Pkcs7Verify library.
//
@@ -1278,27 +1483,25 @@ VerifyTimeBasedPayload ( Exit:
- FreePool (NewData);
-
if (!VerifyStatus) {
return EFI_SECURITY_VIOLATION;
}
- if ((PayLoadSize == 0) && (VarDel != NULL)) {
+ if ((PayloadSize == 0) && (VarDel != NULL)) {
*VarDel = TRUE;
}
-
+
//
// Final step: Update/Append Variable if it pass Pkcs7Verify
//
return UpdateVariable (
- VariableName,
- VendorGuid,
- PayLoadPtr,
- PayLoadSize,
- Attributes,
- 0,
- 0,
+ VariableName,
+ VendorGuid,
+ PayloadPtr,
+ PayloadSize,
+ Attributes,
+ 0,
+ 0,
Variable,
&CertData->TimeStamp
);
diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.h b/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.h index 6b0db74c81..54e2ac0a43 100644 --- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.h +++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.h @@ -3,12 +3,12 @@ internal structure and functions used by AuthService module.
Copyright (c) 2009 - 2011, Intel Corporation. All rights reserved.<BR>
-This program and the accompanying materials
-are licensed and made available under the terms and conditions of the BSD License
-which accompanies this distribution. The full text of the license may be found at
+This program and the accompanying materials
+are licensed and made available under the terms and conditions of the BSD License
+which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php
-THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
**/
@@ -20,9 +20,17 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED. #define EFI_CERT_TYPE_RSA2048_SIZE 256
///
-/// Size of AuthInfo prior to the data payload
+/// Size of AuthInfo prior to the data payload.
///
-#define AUTHINFO_SIZE (((UINTN)(((EFI_VARIABLE_AUTHENTICATION *) 0)->AuthInfo.CertData)) + sizeof (EFI_CERT_BLOCK_RSA_2048_SHA256))
+#define AUTHINFO_SIZE ((OFFSET_OF (EFI_VARIABLE_AUTHENTICATION, AuthInfo)) + \
+ (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData)) + \
+ sizeof (EFI_CERT_BLOCK_RSA_2048_SHA256))
+
+#define AUTHINFO2_SIZE(VarAuth2) ((OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2, AuthInfo)) + \
+ (UINTN) ((EFI_VARIABLE_AUTHENTICATION_2 *) (VarAuth2))->AuthInfo.Hdr.dwLength)
+
+#define OFFSET_OF_AUTHINFO2_CERT_DATA ((OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2, AuthInfo)) + \
+ (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData)))
///
/// "AuthVarKeyDatabase" variable for the Public Key store.
@@ -58,8 +66,8 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED. @return EFI_WRITE_PROTECTED Variable is write-protected and needs authentication with
EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
@return EFI_SECURITY_VIOLATION The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
- set, but the AuthInfo does NOT pass the validation
- check carried out by the firmware.
+ set, but the AuthInfo does NOT pass the validation
+ check carried out by the firmware.
@return EFI_SUCCESS Variable is not write-protected, or passed validation successfully.
**/
@@ -74,6 +82,20 @@ ProcessVariable ( );
/**
+ Update platform mode.
+
+ @param[in] Mode SETUP_MODE or USER_MODE.
+
+ @return EFI_INVALID_PARAMETER Invalid parameter.
+ @return EFI_SUCCESS Update platform mode successfully.
+
+**/
+EFI_STATUS
+UpdatePlatformMode (
+ IN UINT32 Mode
+ );
+
+/**
Initializes for authenticated varibale service.
@retval EFI_SUCCESS Function successfully executed.
@@ -107,8 +129,8 @@ CryptLibraryInitialize ( @param[in] IsPk Indicate whether it is to process pk.
@return EFI_INVALID_PARAMETER Invalid parameter
- @return EFI_SECURITY_VIOLATION The variable does NOT pass the validation
- check carried out by the firmware.
+ @return EFI_SECURITY_VIOLATION The variable does NOT pass the validation
+ check carried out by the firmware.
@return EFI_SUCCESS Variable passed validation successfully.
**/
@@ -135,8 +157,8 @@ ProcessVarWithPk ( @param[in] Attributes Attribute value of the variable.
@return EFI_INVALID_PARAMETER Invalid parameter.
- @return EFI_SECURITY_VIOLATION The variable does NOT pass the validation
- check carried out by the firmware.
+ @return EFI_SECURITY_VIOLATION The variable does NOT pass the validation
+ check carried out by the firmware.
@return EFI_SUCCESS Variable passed validation successfully.
**/
@@ -151,6 +173,27 @@ ProcessVarWithKek ( );
/**
+ Merge two buffers which formatted as EFI_SIGNATURE_LIST. Only the new EFI_SIGNATURE_DATA
+ will be appended to the original EFI_SIGNATURE_LIST, duplicate EFI_SIGNATURE_DATA
+ will be ignored.
+
+ @param[in, out] Data Pointer to original EFI_SIGNATURE_LIST.
+ @param[in] DataSize Size of Data buffer.
+ @param[in] NewData Pointer to new EFI_SIGNATURE_LIST to be appended.
+ @param[in] NewDataSize Size of NewData buffer.
+
+ @return Size of the merged buffer.
+
+**/
+UINTN
+AppendSignatureList (
+ IN OUT VOID *Data,
+ IN UINTN DataSize,
+ IN VOID *NewData,
+ IN UINTN NewDataSize
+ );
+
+/**
Compare two EFI_TIME data.
@@ -182,8 +225,8 @@ CompareTimeStamp ( @param[out] VarDel Delete the variable or not.
@retval EFI_INVALID_PARAMETER Invalid parameter.
- @retval EFI_SECURITY_VIOLATION The variable does NOT pass the validation
- check carried out by the firmware.
+ @retval EFI_SECURITY_VIOLATION The variable does NOT pass the validation
+ check carried out by the firmware.
@retval EFI_OUT_OF_RESOURCES Failed to process variable due to lack
of resources.
@retval EFI_SUCCESS Variable pass validation successfully.
@@ -205,5 +248,6 @@ extern UINT8 mPubKeyStore[MAX_KEYDB_SIZE]; extern UINT32 mPubKeyNumber;
extern VOID *mHashCtx;
extern VOID *mStorageArea;
-
+extern UINT8 *mSerializationRuntimeBuffer;
+
#endif
diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c b/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c index 32bddbcb02..7d0d21502a 100644 --- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c +++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.c @@ -1,14 +1,14 @@ /** @file
- The common variable operation routines shared by DXE_RINTIME variable
+ The common variable operation routines shared by DXE_RINTIME variable
module and DXE_SMM variable module.
Copyright (c) 2009 - 2011, Intel Corporation. All rights reserved.<BR>
-This program and the accompanying materials
-are licensed and made available under the terms and conditions of the BSD License
-which accompanies this distribution. The full text of the license may be found at
+This program and the accompanying materials
+are licensed and made available under the terms and conditions of the BSD License
+which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php
-THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
**/
@@ -30,13 +30,13 @@ VARIABLE_INFO_ENTRY *gVariableInfo = NULL; /**
- Routine used to track statistical information about variable usage.
+ Routine used to track statistical information about variable usage.
The data is stored in the EFI system table so it can be accessed later.
- VariableInfo.efi can dump out the table. Only Boot Services variable
+ VariableInfo.efi can dump out the table. Only Boot Services variable
accesses are tracked by this code. The PcdVariableCollectStatistics
- build flag controls if this feature is enabled.
+ build flag controls if this feature is enabled.
- A read that hits in the cache will have Read and Cache true for
+ A read that hits in the cache will have Read and Cache true for
the transaction. Data is allocated by this routine, but never
freed.
@@ -84,7 +84,7 @@ UpdateVariableInfo ( gVariableInfo->Volatile = Volatile;
}
-
+
for (Entry = gVariableInfo; Entry != NULL; Entry = Entry->Next) {
if (CompareGuid (VendorGuid, &Entry->VendorGuid)) {
if (StrCmp (VariableName, Entry->Name) == 0) {
@@ -230,14 +230,14 @@ UpdateVariableStore ( if ((DataPtr + DataSize) >= ((UINTN) ((UINT8 *) VolatileBase + VolatileBase->Size))) {
return EFI_INVALID_PARAMETER;
}
-
+
//
// If Volatile Variable just do a simple mem copy.
- //
+ //
CopyMem ((UINT8 *)(UINTN)DataPtr, Buffer, DataSize);
return EFI_SUCCESS;
}
-
+
//
// If we are here we are dealing with Non-Volatile Variables.
//
@@ -412,7 +412,7 @@ GetVariableDataPtr ( )
{
UINTN Value;
-
+
//
// Be careful about pad size for alignment.
//
@@ -483,7 +483,7 @@ GetStartPointer ( @param VarStoreHeader Pointer to the Variable Store Header.
- @return Pointer to the end of the variable storage area.
+ @return Pointer to the end of the variable storage area.
**/
VARIABLE_HEADER *
@@ -557,7 +557,7 @@ Reclaim ( while (IsValidVariableHeader (Variable)) {
NextVariable = GetNextVariablePtr (Variable);
- if (Variable->State == VAR_ADDED ||
+ if (Variable->State == VAR_ADDED ||
Variable->State == (VAR_IN_DELETED_TRANSITION & VAR_ADDED)
) {
VariableSize = (UINTN) NextVariable - (UINTN) Variable;
@@ -568,9 +568,9 @@ Reclaim ( }
//
- // Reserve the 1 Bytes with Oxff to identify the
- // end of the variable buffer.
- //
+ // Reserve the 1 Bytes with Oxff to identify the
+ // end of the variable buffer.
+ //
MaximumBufferSize += 1;
ValidBuffer = AllocatePool (MaximumBufferSize);
if (ValidBuffer == NULL) {
@@ -587,7 +587,7 @@ Reclaim ( //
// Reinstall all ADDED variables as long as they are not identical to Updating Variable.
- //
+ //
Variable = GetStartPointer (VariableStoreHeader);
while (IsValidVariableHeader (Variable)) {
NextVariable = GetNextVariablePtr (Variable);
@@ -638,18 +638,18 @@ Reclaim ( //
// Reinstall all in delete transition variables.
- //
+ //
Variable = GetStartPointer (VariableStoreHeader);
while (IsValidVariableHeader (Variable)) {
NextVariable = GetNextVariablePtr (Variable);
if (Variable != UpdatingVariable && Variable->State == (VAR_IN_DELETED_TRANSITION & VAR_ADDED)) {
//
- // Buffer has cached all ADDED variable.
+ // Buffer has cached all ADDED variable.
// Per IN_DELETED variable, we have to guarantee that
- // no ADDED one in previous buffer.
- //
-
+ // no ADDED one in previous buffer.
+ //
+
FoundAdded = FALSE;
AddedVariable = GetStartPointer ((VARIABLE_STORE_HEADER *) ValidBuffer);
while (IsValidVariableHeader (AddedVariable)) {
@@ -744,7 +744,7 @@ FindVariableEx ( ; (PtrTrack->CurrPtr < PtrTrack->EndPtr) && IsValidVariableHeader (PtrTrack->CurrPtr)
; PtrTrack->CurrPtr = GetNextVariablePtr (PtrTrack->CurrPtr)
) {
- if (PtrTrack->CurrPtr->State == VAR_ADDED ||
+ if (PtrTrack->CurrPtr->State == VAR_ADDED ||
PtrTrack->CurrPtr->State == (VAR_IN_DELETED_TRANSITION & VAR_ADDED)
) {
if (!AtRuntime () || ((PtrTrack->CurrPtr->Attributes & EFI_VARIABLE_RUNTIME_ACCESS) != 0)) {
@@ -875,7 +875,7 @@ GetIndexFromSupportedLangCodes( IN CHAR8 *SupportedLang,
IN CHAR8 *Lang,
IN BOOLEAN Iso639Language
- )
+ )
{
UINTN Index;
UINTN CompareLength;
@@ -910,8 +910,8 @@ GetIndexFromSupportedLangCodes( // Determine the length of the next language code in SupportedLang
//
for (CompareLength = 0; SupportedLang[CompareLength] != '\0' && SupportedLang[CompareLength] != ';'; CompareLength++);
-
- if ((CompareLength == LanguageLength) &&
+
+ if ((CompareLength == LanguageLength) &&
(AsciiStrnCmp (Lang, SupportedLang, CompareLength) == 0)) {
//
// Successfully find the index of Lang string in SupportedLang string.
@@ -972,7 +972,7 @@ GetLangFromSupportedLangCodes ( CompareLength = ISO_639_2_ENTRY_SIZE;
mVariableModuleGlobal->Lang[CompareLength] = '\0';
return CopyMem (mVariableModuleGlobal->Lang, SupportedLang + Index * CompareLength, CompareLength);
-
+
} else {
while (TRUE) {
//
@@ -1009,10 +1009,10 @@ GetLangFromSupportedLangCodes ( }
/**
- Returns a pointer to an allocated buffer that contains the best matching language
- from a set of supported languages.
-
- This function supports both ISO 639-2 and RFC 4646 language codes, but language
+ Returns a pointer to an allocated buffer that contains the best matching language
+ from a set of supported languages.
+
+ This function supports both ISO 639-2 and RFC 4646 language codes, but language
code types may not be mixed in a single call to this function. This function
supports a variable argument list that allows the caller to pass in a prioritized
list of language codes to test against all the language codes in SupportedLanguages.
@@ -1020,37 +1020,37 @@ GetLangFromSupportedLangCodes ( If SupportedLanguages is NULL, then ASSERT().
@param[in] SupportedLanguages A pointer to a Null-terminated ASCII string that
- contains a set of language codes in the format
+ contains a set of language codes in the format
specified by Iso639Language.
@param[in] Iso639Language If TRUE, then all language codes are assumed to be
in ISO 639-2 format. If FALSE, then all language
codes are assumed to be in RFC 4646 language format
- @param[in] ... A variable argument list that contains pointers to
+ @param[in] ... A variable argument list that contains pointers to
Null-terminated ASCII strings that contain one or more
language codes in the format specified by Iso639Language.
The first language code from each of these language
code lists is used to determine if it is an exact or
- close match to any of the language codes in
+ close match to any of the language codes in
SupportedLanguages. Close matches only apply to RFC 4646
language codes, and the matching algorithm from RFC 4647
- is used to determine if a close match is present. If
+ is used to determine if a close match is present. If
an exact or close match is found, then the matching
language code from SupportedLanguages is returned. If
no matches are found, then the next variable argument
- parameter is evaluated. The variable argument list
+ parameter is evaluated. The variable argument list
is terminated by a NULL.
@retval NULL The best matching language could not be found in SupportedLanguages.
- @retval NULL There are not enough resources available to return the best matching
+ @retval NULL There are not enough resources available to return the best matching
language.
- @retval Other A pointer to a Null-terminated ASCII string that is the best matching
+ @retval Other A pointer to a Null-terminated ASCII string that is the best matching
language in SupportedLanguages.
**/
CHAR8 *
EFIAPI
VariableGetBestLanguage (
- IN CONST CHAR8 *SupportedLanguages,
+ IN CONST CHAR8 *SupportedLanguages,
IN BOOLEAN Iso639Language,
...
)
@@ -1127,7 +1127,7 @@ VariableGetBestLanguage ( LanguageLength = 0;
} else {
//
- // If RFC 4646 mode, then trim Language from the right to the next '-' character
+ // If RFC 4646 mode, then trim Language from the right to the next '-' character
//
for (LanguageLength--; LanguageLength > 0 && Language[LanguageLength] != '-'; LanguageLength--);
}
@@ -1136,7 +1136,7 @@ VariableGetBestLanguage ( VA_END (Args);
//
- // No matches were found
+ // No matches were found
//
return NULL;
}
@@ -1201,7 +1201,7 @@ AutoUpdateLangVariable( ASSERT (mVariableModuleGlobal->PlatformLangCodes != NULL);
//
- // PlatformLang holds a single language from PlatformLangCodes,
+ // PlatformLang holds a single language from PlatformLangCodes,
// so the size of PlatformLangCodes is enough for the PlatformLang.
//
if (mVariableModuleGlobal->PlatformLang != NULL) {
@@ -1231,7 +1231,7 @@ AutoUpdateLangVariable( ASSERT (mVariableModuleGlobal->LangCodes != NULL);
}
- if (SetLanguageCodes
+ if (SetLanguageCodes
&& (mVariableModuleGlobal->PlatformLangCodes != NULL)
&& (mVariableModuleGlobal->LangCodes != NULL)) {
//
@@ -1263,7 +1263,7 @@ AutoUpdateLangVariable( }
}
}
-
+
//
// According to UEFI spec, "Lang" and "PlatformLang" is NV|BS|RT attributions.
//
@@ -1328,7 +1328,7 @@ AutoUpdateLangVariable( //
FindVariable (L"PlatformLang", &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal);
- Status = UpdateVariable (L"PlatformLang", &gEfiGlobalVariableGuid, BestPlatformLang,
+ Status = UpdateVariable (L"PlatformLang", &gEfiGlobalVariableGuid, BestPlatformLang,
AsciiStrSize (BestPlatformLang), Attributes, 0, 0, &Variable, NULL);
DEBUG ((EFI_D_INFO, "Variable Driver Auto Update Lang, Lang:%a, PlatformLang:%a\n", BestLang, BestPlatformLang));
@@ -1351,7 +1351,7 @@ AutoUpdateLangVariable( @param[in] MonotonicCount Value of associated monotonic count.
@param[in] CacheVariable The variable information which is used to keep track of variable usage.
@param[in] TimeStamp Value of associated TimeStamp.
-
+
@retval EFI_SUCCESS The update operation is success.
@retval EFI_OUT_OF_RESOURCES Variable region is full, can not write other data into this region.
@@ -1417,12 +1417,12 @@ UpdateVariable ( // Now let Variable points to the same variable in Flash area.
//
VariableStoreHeader = (VARIABLE_STORE_HEADER *) ((UINTN) mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase);
- Variable = &NvVariable;
+ Variable = &NvVariable;
Variable->StartPtr = GetStartPointer (VariableStoreHeader);
Variable->EndPtr = GetEndPointer (VariableStoreHeader);
Variable->CurrPtr = (VARIABLE_HEADER *)((UINTN)Variable->StartPtr + ((UINTN)CacheVariable->CurrPtr - (UINTN)CacheVariable->StartPtr));
Variable->Volatile = FALSE;
- }
+ }
Fvb = mVariableModuleGlobal->FvbInstance;
Reclaimed = FALSE;
@@ -1439,10 +1439,10 @@ UpdateVariable ( //
// Update/Delete existing variable.
//
- if (AtRuntime ()) {
+ if (AtRuntime ()) {
//
- // If AtRuntime and the variable is Volatile and Runtime Access,
- // the volatile is ReadOnly, and SetVariable should be aborted and
+ // If AtRuntime and the variable is Volatile and Runtime Access,
+ // the volatile is ReadOnly, and SetVariable should be aborted and
// return EFI_WRITE_PROTECTED.
//
if (Variable->Volatile) {
@@ -1454,17 +1454,17 @@ UpdateVariable ( //
if ((Variable->CurrPtr->Attributes & EFI_VARIABLE_NON_VOLATILE) == 0) {
Status = EFI_INVALID_PARAMETER;
- goto Done;
+ goto Done;
}
}
//
// Setting a data variable with no access, or zero DataSize attributes
// causes it to be deleted.
- // When the EFI_VARIABLE_APPEND_WRITE attribute is set, DataSize of zero will
- // not delete the variable.
+ // When the EFI_VARIABLE_APPEND_WRITE attribute is set, DataSize of zero will
+ // not delete the variable.
//
- if ((((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0) && (DataSize == 0))|| ((Attributes & (EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS)) == 0)) {
+ if ((((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0) && (DataSize == 0))|| ((Attributes & (EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS)) == 0)) {
State = Variable->CurrPtr->State;
State &= VAR_DELETED;
@@ -1476,14 +1476,14 @@ UpdateVariable ( (UINTN) &Variable->CurrPtr->State,
sizeof (UINT8),
&State
- );
+ );
if (!EFI_ERROR (Status)) {
UpdateVariableInfo (VariableName, VendorGuid, Variable->Volatile, FALSE, FALSE, TRUE, FALSE);
if (!Variable->Volatile) {
CacheVariable->CurrPtr->State = State;
}
}
- goto Done;
+ goto Done;
}
//
// If the variable is marked valid, and the same data has been passed in,
@@ -1491,8 +1491,11 @@ UpdateVariable ( //
if (DataSizeOfVariable (Variable->CurrPtr) == DataSize &&
(CompareMem (Data, GetVariableDataPtr (Variable->CurrPtr), DataSize) == 0) &&
- ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
-
+ ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0) &&
+ (TimeStamp == NULL)) {
+ //
+ // Variable content unchanged and no need to update timestamp, just return.
+ //
UpdateVariableInfo (VariableName, VendorGuid, Variable->Volatile, FALSE, TRUE, FALSE, FALSE);
Status = EFI_SUCCESS;
goto Done;
@@ -1503,10 +1506,40 @@ UpdateVariable ( // EFI_VARIABLE_APPEND_WRITE attribute only effects for existing variable
//
if ((Attributes & EFI_VARIABLE_APPEND_WRITE) != 0) {
-
- BufSize = Variable->CurrPtr->DataSize + DataSize;
- RevBufSize = MIN (PcdGet32 (PcdMaxAppendVariableSize), ScratchDataSize);
-
+ //
+ // Cache the previous variable data into StorageArea.
+ //
+ DataOffset = sizeof (VARIABLE_HEADER) + Variable->CurrPtr->NameSize + GET_PAD_SIZE (Variable->CurrPtr->NameSize);
+ CopyMem (mStorageArea, (UINT8*)((UINTN) Variable->CurrPtr + DataOffset), Variable->CurrPtr->DataSize);
+
+ if (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) ||
+ (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0))) {
+ //
+ // For variables with the GUID EFI_IMAGE_SECURITY_DATABASE_GUID (i.e. where the data
+ // buffer is formatted as EFI_SIGNATURE_LIST), the driver shall not perform an append of
+ // EFI_SIGNATURE_DATA values that are already part of the existing variable value.
+ //
+ BufSize = AppendSignatureList (mStorageArea, Variable->CurrPtr->DataSize, Data, DataSize);
+ if (BufSize == Variable->CurrPtr->DataSize) {
+ if ((TimeStamp == NULL) || CompareTimeStamp (TimeStamp, &Variable->CurrPtr->TimeStamp)) {
+ //
+ // New EFI_SIGNATURE_DATA is not found and timestamp is not later
+ // than current timestamp, return EFI_SUCCESS directly.
+ //
+ UpdateVariableInfo (VariableName, VendorGuid, Variable->Volatile, FALSE, TRUE, FALSE, FALSE);
+ Status = EFI_SUCCESS;
+ goto Done;
+ }
+ }
+ } else {
+ //
+ // For other Variables, append the new data to the end of previous data.
+ //
+ CopyMem ((UINT8*)((UINTN) mStorageArea + Variable->CurrPtr->DataSize), Data, DataSize);
+ BufSize = Variable->CurrPtr->DataSize + DataSize;
+ }
+
+ RevBufSize = MIN (PcdGet32 (PcdMaxVariableSize), ScratchDataSize);
if (BufSize > RevBufSize) {
//
// If variable size (previous + current) is bigger than reserved buffer in runtime,
@@ -1514,19 +1547,7 @@ UpdateVariable ( //
return EFI_OUT_OF_RESOURCES;
}
-
- SetMem (mStorageArea, PcdGet32 (PcdMaxAppendVariableSize), 0xff);
- //
- // Cache the previous variable data into StorageArea.
- //
- DataOffset = sizeof (VARIABLE_HEADER) + Variable->CurrPtr->NameSize + GET_PAD_SIZE (Variable->CurrPtr->NameSize);
- CopyMem (mStorageArea, (UINT8*)((UINTN)Variable->CurrPtr + DataOffset), Variable->CurrPtr->DataSize);
-
- //
- // Append the new data to the end of previous data.
- //
- CopyMem ((UINT8*)((UINTN)mStorageArea + Variable->CurrPtr->DataSize), Data, DataSize);
-
+
//
// Override Data and DataSize which are used for combined data area including previous and new data.
//
@@ -1548,36 +1569,33 @@ UpdateVariable ( (UINTN) &Variable->CurrPtr->State,
sizeof (UINT8),
&State
- );
+ );
if (EFI_ERROR (Status)) {
- goto Done;
- }
+ goto Done;
+ }
if (!Variable->Volatile) {
CacheVariable->CurrPtr->State = State;
}
- }
+ }
} else {
//
// Not found existing variable. Create a new variable.
- //
-
- //
- // EFI_VARIABLE_APPEND_WRITE attribute only set for existing variable
//
- if ((Attributes & EFI_VARIABLE_APPEND_WRITE) != 0) {
- Status = EFI_INVALID_PARAMETER;
+
+ if ((DataSize == 0) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) != 0)) {
+ Status = EFI_SUCCESS;
goto Done;
}
-
+
//
// Make sure we are trying to create a new variable.
- // Setting a data variable with zero DataSize or no access attributes means to delete it.
+ // Setting a data variable with zero DataSize or no access attributes means to delete it.
//
if (DataSize == 0 || (Attributes & (EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS)) == 0) {
Status = EFI_NOT_FOUND;
goto Done;
}
-
+
//
// Only variable have NV|RT attribute can be created in Runtime.
//
@@ -1585,7 +1603,7 @@ UpdateVariable ( (((Attributes & EFI_VARIABLE_RUNTIME_ACCESS) == 0) || ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0))) {
Status = EFI_INVALID_PARAMETER;
goto Done;
- }
+ }
}
//
@@ -1601,10 +1619,10 @@ UpdateVariable ( NextVariable->Reserved = 0;
NextVariable->PubKeyIndex = KeyIndex;
NextVariable->MonotonicCount = MonotonicCount;
- SetMem (&NextVariable->TimeStamp, sizeof (EFI_TIME), 0);
+ ZeroMem (&NextVariable->TimeStamp, sizeof (EFI_TIME));
if (((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) &&
- TimeStamp != NULL) {
+ (TimeStamp != NULL)) {
if ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0) {
CopyMem (&NextVariable->TimeStamp, TimeStamp, sizeof (EFI_TIME));
} else {
@@ -1613,18 +1631,20 @@ UpdateVariable ( // when the new TimeStamp value is later than the current timestamp associated
// with the variable, we need associate the new timestamp with the updated value.
//
- if (CompareTimeStamp (&Variable->CurrPtr->TimeStamp, TimeStamp)) {
- CopyMem (&NextVariable->TimeStamp, TimeStamp, sizeof (EFI_TIME));
+ if (Variable->CurrPtr != NULL) {
+ if (CompareTimeStamp (&Variable->CurrPtr->TimeStamp, TimeStamp)) {
+ CopyMem (&NextVariable->TimeStamp, TimeStamp, sizeof (EFI_TIME));
+ }
}
}
}
//
- // The EFI_VARIABLE_APPEND_WRITE attribute will never be set in the returned
+ // The EFI_VARIABLE_APPEND_WRITE attribute will never be set in the returned
// Attributes bitmask parameter of a GetVariable() call.
//
NextVariable->Attributes = Attributes & (~EFI_VARIABLE_APPEND_WRITE);
-
+
VarNameOffset = sizeof (VARIABLE_HEADER);
VarNameSize = StrSize (VariableName);
CopyMem (
@@ -1658,9 +1678,9 @@ UpdateVariable ( //
Volatile = FALSE;
NonVolatileVarableStoreSize = ((VARIABLE_STORE_HEADER *)(UINTN)(mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase))->Size;
- if ((((Attributes & EFI_VARIABLE_HARDWARE_ERROR_RECORD) != 0)
+ if ((((Attributes & EFI_VARIABLE_HARDWARE_ERROR_RECORD) != 0)
&& ((VarSize + mVariableModuleGlobal->HwErrVariableTotalSize) > PcdGet32 (PcdHwErrStorageSize)))
- || (((Attributes & EFI_VARIABLE_HARDWARE_ERROR_RECORD) == 0)
+ || (((Attributes & EFI_VARIABLE_HARDWARE_ERROR_RECORD) == 0)
&& ((VarSize + mVariableModuleGlobal->CommonVariableTotalSize) > NonVolatileVarableStoreSize - sizeof (VARIABLE_STORE_HEADER) - PcdGet32 (PcdHwErrStorageSize)))) {
if (AtRuntime ()) {
Status = EFI_OUT_OF_RESOURCES;
@@ -1669,7 +1689,7 @@ UpdateVariable ( //
// Perform garbage collection & reclaim operation.
//
- Status = Reclaim (mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase,
+ Status = Reclaim (mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase,
&mVariableModuleGlobal->NonVolatileLastVariableOffset, FALSE, Variable->CurrPtr);
if (EFI_ERROR (Status)) {
goto Done;
@@ -1677,9 +1697,9 @@ UpdateVariable ( //
// If still no enough space, return out of resources.
//
- if ((((Attributes & EFI_VARIABLE_HARDWARE_ERROR_RECORD) != 0)
+ if ((((Attributes & EFI_VARIABLE_HARDWARE_ERROR_RECORD) != 0)
&& ((VarSize + mVariableModuleGlobal->HwErrVariableTotalSize) > PcdGet32 (PcdHwErrStorageSize)))
- || (((Attributes & EFI_VARIABLE_HARDWARE_ERROR_RECORD) == 0)
+ || (((Attributes & EFI_VARIABLE_HARDWARE_ERROR_RECORD) == 0)
&& ((VarSize + mVariableModuleGlobal->CommonVariableTotalSize) > NonVolatileVarableStoreSize - sizeof (VARIABLE_STORE_HEADER) - PcdGet32 (PcdHwErrStorageSize)))) {
Status = EFI_OUT_OF_RESOURCES;
goto Done;
@@ -1689,7 +1709,7 @@ UpdateVariable ( //
// Four steps
// 1. Write variable header
- // 2. Set variable state to header valid
+ // 2. Set variable state to header valid
// 3. Write variable data
// 4. Set variable state to valid
//
@@ -1776,7 +1796,7 @@ UpdateVariable ( } else {
//
// Create a volatile variable.
- //
+ //
Volatile = TRUE;
if ((UINT32) (VarSize + mVariableModuleGlobal->VolatileLastVariableOffset) >
@@ -1784,7 +1804,7 @@ UpdateVariable ( //
// Perform garbage collection & reclaim operation.
//
- Status = Reclaim (mVariableModuleGlobal->VariableGlobal.VolatileVariableBase,
+ Status = Reclaim (mVariableModuleGlobal->VariableGlobal.VolatileVariableBase,
&mVariableModuleGlobal->VolatileLastVariableOffset, TRUE, Variable->CurrPtr);
if (EFI_ERROR (Status)) {
goto Done;
@@ -1835,7 +1855,7 @@ UpdateVariable ( sizeof (UINT8),
&State
);
- if (!EFI_ERROR (Status) && !Variable->Volatile) {
+ if (!EFI_ERROR (Status) && !Variable->Volatile) {
CacheVariable->CurrPtr->State = State;
}
}
@@ -1858,7 +1878,7 @@ Done: @param DataSize Size of Data found. If size is less than the
data, this value contains the required size.
@param Data Data pointer.
-
+
@return EFI_INVALID_PARAMETER Invalid parameter.
@return EFI_SUCCESS Find the specified variable.
@return EFI_NOT_FOUND Not found.
@@ -1884,7 +1904,7 @@ VariableServiceGetVariable ( }
AcquireLockOnlyAtBootTime(&mVariableModuleGlobal->VariableGlobal.VariableServicesLock);
-
+
Status = FindVariable (VariableName, VendorGuid, &Variable, &mVariableModuleGlobal->VariableGlobal);
if (Variable.CurrPtr == NULL || EFI_ERROR (Status)) {
goto Done;
@@ -1909,7 +1929,7 @@ VariableServiceGetVariable ( *DataSize = VarDataSize;
UpdateVariableInfo (VariableName, VendorGuid, Variable.Volatile, TRUE, FALSE, FALSE, FALSE);
-
+
Status = EFI_SUCCESS;
goto Done;
} else {
@@ -2007,7 +2027,7 @@ VariableServiceGetNextVariableName ( }
}
//
- // Capture the case that
+ // Capture the case that
// 1. current storage is the last one, or
// 2. no further storage
//
@@ -2029,7 +2049,7 @@ VariableServiceGetNextVariableName ( //
// Don't return NV variable when HOB overrides it
//
- if ((VariableStoreHeader[VariableStoreTypeHob] != NULL) && (VariableStoreHeader[VariableStoreTypeNv] != NULL) &&
+ if ((VariableStoreHeader[VariableStoreTypeHob] != NULL) && (VariableStoreHeader[VariableStoreTypeNv] != NULL) &&
(Variable.StartPtr == GetStartPointer (VariableStoreHeader[VariableStoreTypeNv]))
) {
VariableInHob.StartPtr = GetStartPointer (VariableStoreHeader[VariableStoreTypeHob]);
@@ -2108,7 +2128,7 @@ VariableServiceSetVariable ( //
if (VariableName == NULL || VariableName[0] == 0 || VendorGuid == NULL) {
return EFI_INVALID_PARAMETER;
- }
+ }
if (DataSize != 0 && Data == NULL) {
return EFI_INVALID_PARAMETER;
@@ -2122,25 +2142,36 @@ VariableServiceSetVariable ( }
//
- // EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS and EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS attribute
+ // EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS and EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS attribute
// cannot be set both.
//
- if (((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) == EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) \
+ if (((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) == EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS)
&& ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) {
return EFI_INVALID_PARAMETER;
- }
+ }
if ((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) == EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) {
if (DataSize < AUTHINFO_SIZE) {
//
- // Try to write Authencated Variable without AuthInfo.
+ // Try to write Authenticated Variable without AuthInfo.
//
return EFI_SECURITY_VIOLATION;
- }
- PayloadSize = DataSize - AUTHINFO_SIZE;
+ }
+ PayloadSize = DataSize - AUTHINFO_SIZE;
+ } else if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) {
+ //
+ // Sanity check for EFI_VARIABLE_AUTHENTICATION_2 descriptor.
+ //
+ if (DataSize < OFFSET_OF_AUTHINFO2_CERT_DATA ||
+ DataSize < AUTHINFO2_SIZE (Data) ||
+ ((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->AuthInfo.Hdr.dwLength < OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData)) {
+ return EFI_SECURITY_VIOLATION;
+ }
+ PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
} else {
- PayloadSize = DataSize;
+ PayloadSize = DataSize;
}
+
//
// The size of the VariableName, including the Unicode Null in bytes plus
// the DataSize is limited to maximum size of PcdGet32 (PcdMaxHardwareErrorVariableSize)
@@ -2165,8 +2196,8 @@ VariableServiceSetVariable ( if ((PayloadSize > PcdGet32 (PcdMaxVariableSize)) ||
(sizeof (VARIABLE_HEADER) + StrSize (VariableName) + PayloadSize > PcdGet32 (PcdMaxVariableSize))) {
return EFI_INVALID_PARAMETER;
- }
- }
+ }
+ }
AcquireLockOnlyAtBootTime(&mVariableModuleGlobal->VariableGlobal.VariableServicesLock);
@@ -2179,7 +2210,7 @@ VariableServiceSetVariable ( // Parse non-volatile variable data and get last variable offset.
//
NextVariable = GetStartPointer ((VARIABLE_STORE_HEADER *) (UINTN) Point);
- while ((NextVariable < GetEndPointer ((VARIABLE_STORE_HEADER *) (UINTN) Point))
+ while ((NextVariable < GetEndPointer ((VARIABLE_STORE_HEADER *) (UINTN) Point))
&& IsValidVariableHeader (NextVariable)) {
NextVariable = GetNextVariablePtr (NextVariable);
}
@@ -2259,7 +2290,7 @@ VariableServiceQueryVariableInfo ( //
// Make sure the Attributes combination is supported by the platform.
//
- return EFI_UNSUPPORTED;
+ return EFI_UNSUPPORTED;
} else if ((Attributes & (EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS)) == EFI_VARIABLE_RUNTIME_ACCESS) {
//
// Make sure if runtime bit is set, boot service bit is set also.
@@ -2378,7 +2409,7 @@ VariableServiceQueryVariableInfo ( /**
This function reclaims variable storage if free size is below the threshold.
-
+
**/
VOID
ReclaimForOS(
@@ -2390,7 +2421,7 @@ ReclaimForOS( UINTN RemainingCommonVariableSpace;
UINTN RemainingHwErrVariableSpace;
- Status = EFI_SUCCESS;
+ Status = EFI_SUCCESS;
CommonVariableSpace = ((VARIABLE_STORE_HEADER *) ((UINTN) (mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase)))->Size - sizeof (VARIABLE_STORE_HEADER) - PcdGet32(PcdHwErrStorageSize); //Allowable max size of common variable storage space
@@ -2401,7 +2432,7 @@ ReclaimForOS( // Check if the free area is blow a threshold.
//
if ((RemainingCommonVariableSpace < PcdGet32 (PcdMaxVariableSize))
- || ((PcdGet32 (PcdHwErrStorageSize) != 0) &&
+ || ((PcdGet32 (PcdHwErrStorageSize) != 0) &&
(RemainingHwErrVariableSpace < PcdGet32 (PcdMaxHardwareErrorVariableSize)))){
Status = Reclaim (
mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase,
@@ -2436,7 +2467,7 @@ VariableWriteServiceInitialize ( VariableStoreBase = mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase;
VariableStoreHeader = (VARIABLE_STORE_HEADER *)(UINTN)VariableStoreBase;
-
+
//
// Check if the free area is really free.
//
@@ -2459,7 +2490,7 @@ VariableWriteServiceInitialize ( }
}
-
+
//
// Flush the HOB variable to flash and invalidate HOB variable.
//
@@ -2533,7 +2564,7 @@ VariableCommonInitialize ( //
// Note that in EdkII variable driver implementation, Hardware Error Record type variable
// is stored with common variable in the same NV region. So the platform integrator should
- // ensure that the value of PcdHwErrStorageSize is less than or equal to the value of
+ // ensure that the value of PcdHwErrStorageSize is less than or equal to the value of
// PcdFlashNvStorageVariableSize.
//
ASSERT (PcdGet32 (PcdHwErrStorageSize) <= PcdGet32 (PcdFlashNvStorageVariableSize));
@@ -2596,9 +2627,9 @@ VariableCommonInitialize ( Status = EFI_VOLUME_CORRUPTED;
DEBUG((EFI_D_INFO, "Variable Store header is corrupted\n"));
goto Done;
- }
+ }
ASSERT(VariableStoreHeader->Size == VariableStoreLength);
-
+
//
// Parse non-volatile variable data and get last variable offset.
//
@@ -2615,7 +2646,7 @@ VariableCommonInitialize ( }
mVariableModuleGlobal->NonVolatileLastVariableOffset = (UINTN) NextVariable - (UINTN) VariableStoreBase;
-
+
//
// Allocate runtime memory used for a memory copy of the FLASH region.
// Keep the memory and the FLASH in sync as updates occur
@@ -2661,7 +2692,7 @@ GetFvbInfoByAddress ( EFI_FIRMWARE_VOLUME_BLOCK_PROTOCOL *Fvb;
EFI_FIRMWARE_VOLUME_HEADER *FwVolHeader;
EFI_FVB_ATTRIBUTES_2 Attributes;
-
+
//
// Get all FVB handles.
//
@@ -2686,9 +2717,9 @@ GetFvbInfoByAddress ( //
Status = Fvb->GetAttributes (Fvb, &Attributes);
if (EFI_ERROR (Status) || ((Attributes & EFI_FVB2_WRITE_STATUS) == 0)) {
- continue;
+ continue;
}
-
+
//
// Compare the address and select the right one.
//
@@ -2714,7 +2745,7 @@ GetFvbInfoByAddress ( if (Fvb == NULL) {
Status = EFI_NOT_FOUND;
}
-
- return Status;
+
+ return Status;
}
diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableDxe.c b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableDxe.c index 7b88f15163..f91cb5dc56 100644 --- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableDxe.c +++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableDxe.c @@ -3,12 +3,12 @@ and volatile storage space and install variable architecture protocol.
Copyright (c) 2009 - 2011, Intel Corporation. All rights reserved.<BR>
-This program and the accompanying materials
-are licensed and made available under the terms and conditions of the BSD License
-which accompanies this distribution. The full text of the license may be found at
+This program and the accompanying materials
+are licensed and made available under the terms and conditions of the BSD License
+which accompanies this distribution. The full text of the license may be found at
http://opensource.org/licenses/bsd-license.php
-THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
+THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
**/
@@ -24,7 +24,7 @@ EFI_EVENT mFtwRegistration = NULL; /**
Return TRUE if ExitBootServices () has been called.
-
+
@retval TRUE If ExitBootServices () has been called.
**/
BOOLEAN
@@ -39,8 +39,8 @@ AtRuntime ( /**
Initializes a basic mutual exclusion lock.
- This function initializes a basic mutual exclusion lock to the released state
- and returns the lock. Each lock provides mutual exclusion access at its task
+ This function initializes a basic mutual exclusion lock to the released state
+ and returns the lock. Each lock provides mutual exclusion access at its task
priority level. Since there is no preemption or multiprocessor support in EFI,
acquiring the lock only consists of raising to the locks TPL.
If Lock is NULL, then ASSERT().
@@ -131,7 +131,7 @@ GetFtwProtocol ( &gEfiFaultTolerantWriteProtocolGuid,
NULL,
FtwProtocol
- );
+ );
return Status;
}
@@ -145,7 +145,7 @@ GetFtwProtocol ( @retval EFI_SUCCESS The interface information for the specified protocol was returned.
@retval EFI_UNSUPPORTED The device does not support the FVB protocol.
@retval EFI_INVALID_PARAMETER FvBlockHandle is not a valid EFI_HANDLE or FvBlock is NULL.
-
+
**/
EFI_STATUS
GetFvbByHandle (
@@ -166,7 +166,7 @@ GetFvbByHandle ( /**
Function returns an array of handles that support the FVB protocol
- in a buffer allocated from pool.
+ in a buffer allocated from pool.
@param[out] NumberHandles The number of handles returned in Buffer.
@param[out] Buffer A pointer to the buffer to return the requested
@@ -177,7 +177,7 @@ GetFvbByHandle ( @retval EFI_NOT_FOUND No FVB handle was found.
@retval EFI_OUT_OF_RESOURCES There is not enough pool memory to store the matching results.
@retval EFI_INVALID_PARAMETER NumberHandles is NULL or Buffer is NULL.
-
+
**/
EFI_STATUS
GetFvbCountAndBuffer (
@@ -233,8 +233,9 @@ VariableClassAddressChangeEvent ( EfiConvertPointer (0x0, (VOID **) &mVariableModuleGlobal->VariableGlobal.VolatileVariableBase);
EfiConvertPointer (0x0, (VOID **) &mVariableModuleGlobal);
EfiConvertPointer (0x0, (VOID **) &mHashCtx);
- EfiConvertPointer (0x0, (VOID **) &mStorageArea);
- EfiConvertPointer (0x0, (VOID **) &mNvVariableCache);
+ EfiConvertPointer (0x0, (VOID **) &mStorageArea);
+ EfiConvertPointer (0x0, (VOID **) &mSerializationRuntimeBuffer);
+ EfiConvertPointer (0x0, (VOID **) &mNvVariableCache);
}
@@ -266,12 +267,12 @@ OnReadyToBoot ( /**
Fault Tolerant Write protocol notification event handler.
- Non-Volatile variable write may needs FTW protocol to reclaim when
+ Non-Volatile variable write may needs FTW protocol to reclaim when
writting variable.
@param[in] Event Event whose notification function is being invoked.
@param[in] Context Pointer to the notification function's context.
-
+
**/
VOID
EFIAPI
@@ -297,7 +298,7 @@ FtwNotificationEvent ( if (EFI_ERROR (Status)) {
return ;
}
-
+
//
// Find the proper FVB protocol for variable.
//
@@ -333,21 +334,21 @@ FtwNotificationEvent ( DEBUG ((DEBUG_WARN, "Variable driver failed to add EFI_MEMORY_RUNTIME attribute to Flash.\n"));
}
}
-
+
Status = VariableWriteServiceInitialize ();
ASSERT_EFI_ERROR (Status);
-
+
//
// Install the Variable Write Architectural protocol.
//
Status = gBS->InstallProtocolInterface (
&mHandle,
- &gEfiVariableWriteArchProtocolGuid,
+ &gEfiVariableWriteArchProtocolGuid,
EFI_NATIVE_INTERFACE,
NULL
);
ASSERT_EFI_ERROR (Status);
-
+
//
// Close the notify event to avoid install gEfiVariableWriteArchProtocolGuid again.
//
@@ -358,13 +359,13 @@ FtwNotificationEvent ( /**
Variable Driver main entry point. The Variable driver places the 4 EFI
- runtime services in the EFI System Table and installs arch protocols
+ runtime services in the EFI System Table and installs arch protocols
for variable read and write services being available. It also registers
a notification function for an EVT_SIGNAL_VIRTUAL_ADDRESS_CHANGE event.
- @param[in] ImageHandle The firmware allocated handle for the EFI image.
+ @param[in] ImageHandle The firmware allocated handle for the EFI image.
@param[in] SystemTable A pointer to the EFI System Table.
-
+
@retval EFI_SUCCESS Variable service successfully initialized.
**/
@@ -376,7 +377,7 @@ VariableServiceInitialize ( )
{
EFI_STATUS Status;
- EFI_EVENT ReadyToBootEvent;
+ EFI_EVENT ReadyToBootEvent;
Status = VariableCommonInitialize ();
ASSERT_EFI_ERROR (Status);
@@ -385,13 +386,13 @@ VariableServiceInitialize ( SystemTable->RuntimeServices->GetNextVariableName = VariableServiceGetNextVariableName;
SystemTable->RuntimeServices->SetVariable = VariableServiceSetVariable;
SystemTable->RuntimeServices->QueryVariableInfo = VariableServiceQueryVariableInfo;
-
+
//
// Now install the Variable Runtime Architectural protocol on a new handle.
//
Status = gBS->InstallProtocolInterface (
&mHandle,
- &gEfiVariableArchProtocolGuid,
+ &gEfiVariableArchProtocolGuid,
EFI_NATIVE_INTERFACE,
NULL
);
@@ -399,7 +400,7 @@ VariableServiceInitialize ( //
// Register FtwNotificationEvent () notify function.
- //
+ //
EfiCreateProtocolNotifyEvent (
&gEfiFaultTolerantWriteProtocolGuid,
TPL_CALLBACK,
@@ -422,9 +423,9 @@ VariableServiceInitialize ( // Register the event handling function to reclaim variable for OS usage.
//
Status = EfiCreateEventReadyToBootEx (
- TPL_NOTIFY,
- OnReadyToBoot,
- NULL,
+ TPL_NOTIFY,
+ OnReadyToBoot,
+ NULL,
&ReadyToBootEvent
);
diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableRuntimeDxe.inf b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableRuntimeDxe.inf index d2a2025b66..5e741d204a 100644 --- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableRuntimeDxe.inf +++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableRuntimeDxe.inf @@ -64,7 +64,7 @@ gEfiFaultTolerantWriteProtocolGuid ## SOMETIMES_CONSUMES
[Guids]
- gEfiAuthenticatedVariableGuid ## PRODUCES ## Configuration Table Guid
+ gEfiAuthenticatedVariableGuid ## PRODUCES ## Configuration Table Guid
gEfiGlobalVariableGuid ## PRODUCES ## Variable Guid
gEfiEventVirtualAddressChangeGuid ## PRODUCES ## Event
gEfiCertRsa2048Sha256Guid
@@ -82,8 +82,7 @@ gEfiMdeModulePkgTokenSpaceGuid.PcdMaxHardwareErrorVariableSize
gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize
gEfiMdeModulePkgTokenSpaceGuid.PcdHwErrStorageSize
- gEfiSecurityPkgTokenSpaceGuid.PcdMaxAppendVariableSize
-
+
[FeaturePcd]
gEfiMdeModulePkgTokenSpaceGuid.PcdVariableCollectStatistics ## SOMETIME_CONSUMES (statistic the information of variable.)
@@ -97,4 +96,4 @@ # EVENT_TYPE_NOTIFY_SIGNAL ## PRODUCES
#
#
-
+
diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmm.inf b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmm.inf index 86f6e92347..c43cf2d619 100644 --- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmm.inf +++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmm.inf @@ -2,11 +2,11 @@ # Component description file for SMM Authenticated Variable module.
#
# This module installs SMM variable protocol into SMM protocol database,
-# which can be used by SMM driver, and installs SMM variable protocol
+# which can be used by SMM driver, and installs SMM variable protocol
# into BS protocol database, which can be used to notify the SMM Runtime
# Dxe driver that the SMM variable service is ready.
-# This module should be used with SMM Runtime DXE module together. The
-# SMM Runtime DXE module would install variable arch protocol and variable
+# This module should be used with SMM Runtime DXE module together. The
+# SMM Runtime DXE module would install variable arch protocol and variable
# write arch protocol based on SMM variable module.
#
# Copyright (c) 2010 - 2011, Intel Corporation. All rights reserved.<BR>
@@ -60,7 +60,7 @@ DebugLib
DxeServicesTableLib
BaseCryptLib
- PlatformSecureLib
+ PlatformSecureLib
HobLib
[Protocols]
@@ -69,9 +69,9 @@ gEfiSmmFaultTolerantWriteProtocolGuid ## SOMETIMES_CONSUMES
[Guids]
- gEfiAuthenticatedVariableGuid ## PRODUCES ## Configuration Table Guid
+ gEfiAuthenticatedVariableGuid ## PRODUCES ## Configuration Table Guid
gEfiGlobalVariableGuid ## PRODUCES ## Variable Guid
- gSmmVariableWriteGuid ## PRODUCES ## SMM Variable Write Guid
+ gSmmVariableWriteGuid ## PRODUCES ## SMM Variable Write Guid
gEfiCertRsa2048Sha256Guid
gEfiImageSecurityDatabaseGuid
gEfiCertX509Guid
@@ -87,12 +87,11 @@ gEfiMdeModulePkgTokenSpaceGuid.PcdMaxHardwareErrorVariableSize
gEfiMdeModulePkgTokenSpaceGuid.PcdVariableStoreSize
gEfiMdeModulePkgTokenSpaceGuid.PcdHwErrStorageSize
- gEfiSecurityPkgTokenSpaceGuid.PcdMaxAppendVariableSize
-
+
[FeaturePcd]
gEfiMdeModulePkgTokenSpaceGuid.PcdVariableCollectStatistics ## SOMETIME_CONSUMES (statistic the information of variable.)
[Depex]
- TRUE
+ TRUE
+
-
|