SecurityPkg Variable: Reuse scratch data area(at the end of volatile variable store)

as serialization runtime buffer to reduce SMRAM consumption for SMM variable driver.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Guo Dong <guo.dong@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@17059 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c b/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c
index 9b8f63f089322fbc80c28d75826e2a2eb037dde0..1e9e1907c00426fe02ed358571e49ac2bcc36f18 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c
+++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c
@@ -55,14 +55,6 @@ CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };
 //\r
 VOID  *mHashCtx = NULL;\r
 \r
 //\r
 VOID  *mHashCtx = NULL;\r
 \r

-//\r
-// The serialization of the values of the VariableName, VendorGuid and Attributes\r
-// parameters of the SetVariable() call and the TimeStamp component of the\r
-// EFI_VARIABLE_AUTHENTICATION_2 descriptor followed by the variable's new value\r
-// i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data)\r
-//\r
-UINT8 *mSerializationRuntimeBuffer = NULL;\r
-\r

 //\r
 // Requirement for different signature type which have been defined in UEFI spec.\r
 // These data are used to peform SignatureList format check while setting PK/KEK variable.\r
 //\r
 // Requirement for different signature type which have been defined in UEFI spec.\r
 // These data are used to peform SignatureList format check while setting PK/KEK variable.\r


@@ -182,15 +174,6 @@ AutenticatedVariableServiceInitialize (
     return EFI_OUT_OF_RESOURCES;\r
   }\r
 \r
     return EFI_OUT_OF_RESOURCES;\r
   }\r
 \r

-  //\r
-  // Prepare runtime buffer for serialized data of time-based authenticated\r
-  // Variable, i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data).\r
-  //\r
-  mSerializationRuntimeBuffer = AllocateRuntimePool (PcdGet32 (PcdMaxVariableSize) + sizeof (EFI_GUID) + sizeof (UINT32) + sizeof (EFI_TIME));\r
-  if (mSerializationRuntimeBuffer == NULL) {\r
-    return EFI_OUT_OF_RESOURCES;\r
-  }\r
-\r

   //\r
   // Check "AuthVarKeyDatabase" variable's existence.\r
   // If it doesn't exist, create a new one with initial value of 0 and EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.\r
   //\r
   // Check "AuthVarKeyDatabase" variable's existence.\r
   // If it doesn't exist, create a new one with initial value of 0 and EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.\r


@@ -2267,11 +2250,21 @@ VerifyTimeBasedPayload (
   PayloadSize = DataSize - OFFSET_OF_AUTHINFO2_CERT_DATA - (UINTN) SigDataSize;\r
 \r
   //\r
   PayloadSize = DataSize - OFFSET_OF_AUTHINFO2_CERT_DATA - (UINTN) SigDataSize;\r
 \r
   //\r

-  // Construct a buffer to fill with (VariableName, VendorGuid, Attributes, TimeStamp, Data).\r
+  // Construct a serialization buffer of the values of the VariableName, VendorGuid and Attributes\r
+  // parameters of the SetVariable() call and the TimeStamp component of the\r
+  // EFI_VARIABLE_AUTHENTICATION_2 descriptor followed by the variable's new value\r
+  // i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data)\r

   //\r
   NewDataSize = PayloadSize + sizeof (EFI_TIME) + sizeof (UINT32) +\r
                 sizeof (EFI_GUID) + StrSize (VariableName) - sizeof (CHAR16);\r
   //\r
   NewDataSize = PayloadSize + sizeof (EFI_TIME) + sizeof (UINT32) +\r
                 sizeof (EFI_GUID) + StrSize (VariableName) - sizeof (CHAR16);\r

-  NewData = mSerializationRuntimeBuffer;\r
+  //\r
+  // Here is to reuse scratch data area(at the end of volatile variable store)\r
+  // to reduce SMRAM consumption for SMM variable driver.\r
+  // The scratch buffer is enough to hold the serialized data and safe to use,\r
+  // because it will be used at here to do verification only first\r
+  // and then used in UpdateVariable() for a time based auth variable set.\r
+  //\r
+  NewData = (UINT8 *) GetEndPointer ((VARIABLE_STORE_HEADER *) ((UINTN) mVariableModuleGlobal->VariableGlobal.VolatileVariableBase));\r

 \r
   Buffer = NewData;\r
   Length = StrLen (VariableName) * sizeof (CHAR16);\r
 \r
   Buffer = NewData;\r
   Length = StrLen (VariableName) * sizeof (CHAR16);\r

diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.h b/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.h
index e0804f4e3415665f060b0cd7dce5863a9887ccfd..f28c82578e3d73aacd467e933de75aa1bdc62362 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.h
+++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.h
@@ -351,6 +351,5 @@ extern UINT8  *mPubKeyStore;
 extern UINT8  *mCertDbStore;\r
 extern UINT32 mPubKeyNumber;\r
 extern VOID   *mHashCtx;\r
 extern UINT8  *mCertDbStore;\r
 extern UINT32 mPubKeyNumber;\r
 extern VOID   *mHashCtx;\r

-extern UINT8  *mSerializationRuntimeBuffer;\r

 \r
 #endif\r
 \r
 #endif\r

diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.h b/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.h
index f86b202fda40208a8deaad4971001bcb6a419e6c..fd4dab2429ab0c9af046f3b19177a97326efff0d 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.h
+++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.h
@@ -194,6 +194,23 @@ FindVariable (
   IN  BOOLEAN                 IgnoreRtCheck\r
   );\r
 \r
   IN  BOOLEAN                 IgnoreRtCheck\r
   );\r
 \r

+/**\r
+\r
+  Gets the pointer to the end of the variable storage area.\r
+\r
+  This function gets pointer to the end of the variable storage\r
+  area, according to the input variable store header.\r
+\r
+  @param VarStoreHeader  Pointer to the Variable Store Header.\r
+\r
+  @return Pointer to the end of the variable storage area.\r
+\r
+**/\r
+VARIABLE_HEADER *\r
+GetEndPointer (\r
+  IN VARIABLE_STORE_HEADER       *VarStoreHeader\r
+  );\r
+\r

 /**\r
 \r
   This code gets the pointer to the variable data.\r
 /**\r
 \r
   This code gets the pointer to the variable data.\r

diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableDxe.c b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableDxe.c
index 05a90fa8fcd1d91ac0ebf8f9f38552aff0c87f82..f5bb9963e068dd311e8a3955ae7a9cb6c0566264 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableDxe.c
+++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableDxe.c
@@ -247,7 +247,6 @@ VariableClassAddressChangeEvent (
   EfiConvertPointer (0x0, (VOID **) &mVariableModuleGlobal->VariableGlobal.HobVariableBase);\r
   EfiConvertPointer (0x0, (VOID **) &mVariableModuleGlobal);\r
   EfiConvertPointer (0x0, (VOID **) &mHashCtx);\r
   EfiConvertPointer (0x0, (VOID **) &mVariableModuleGlobal->VariableGlobal.HobVariableBase);\r
   EfiConvertPointer (0x0, (VOID **) &mVariableModuleGlobal);\r
   EfiConvertPointer (0x0, (VOID **) &mHashCtx);\r

-  EfiConvertPointer (0x0, (VOID **) &mSerializationRuntimeBuffer);\r

   EfiConvertPointer (0x0, (VOID **) &mNvVariableCache);\r
   EfiConvertPointer (0x0, (VOID **) &mPubKeyStore);\r
   EfiConvertPointer (0x0, (VOID **) &mCertDbStore);\r
   EfiConvertPointer (0x0, (VOID **) &mNvVariableCache);\r
   EfiConvertPointer (0x0, (VOID **) &mPubKeyStore);\r
   EfiConvertPointer (0x0, (VOID **) &mCertDbStore);\r