1. Initialize certdb variable with correct value of list size.

2. Use gloable database array instead of calling AllocateZeroPool in SetVariable.

Signed-off-by: Fu Siyuan <siyuan.fu@intel.com>
Reviewed-by: Ye Ting  <ting.ye@intel.com>
Reviewed-by: Dong Guo <guo.dong@intel.com>
git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@13671 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/SecurityPkg/Include/Guid/AuthenticatedVariableFormat.h b/SecurityPkg/Include/Guid/AuthenticatedVariableFormat.h
index da71e774efea8a89e60e38dd91bdf25e34cadde4..46420406a7ae97c83d82cd5314e96098c9966f64 100644 (file)
--- a/SecurityPkg/Include/Guid/AuthenticatedVariableFormat.h
+++ b/SecurityPkg/Include/Guid/AuthenticatedVariableFormat.h
@@ -51,15 +51,6 @@ extern EFI_GUID gEfiCustomModeEnableGuid;
 #define CUSTOM_SECURE_BOOT_MODE       1\r
 #define STANDARD_SECURE_BOOT_MODE     0\r
 \r
-///\r
-/// "certdb" variable stores the signer's certificates for non PK/KEK/DB/DBX\r
-/// variables with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.\r
-/// \r
-///\r
-#define EFI_CERT_DB_NAME L"certdb"\r
-\r
-extern EFI_GUID gEfiCertDbGuid;\r
-\r
 ///\r
 /// Alignment of variable name and data, according to the architecture:\r
 /// * For IA-32 and Intel(R) 64 architectures: 1.\r

diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c b/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c
index 09c58db985928a44c5351a70c9b5fd9e4b243847..fd5bf12bba253d7e3c1c8f41cbcb3df69ff5f05d 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c
+++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c
@@ -34,6 +34,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 ///\r
 UINT8    mPubKeyStore[MAX_KEYDB_SIZE];\r
 UINT32   mPubKeyNumber;\r
+UINT8    mCertDbStore[MAX_CERTDB_SIZE];\r
 UINT32   mPlatformMode;\r
 EFI_GUID mSignatureSupport[] = {EFI_CERT_SHA1_GUID, EFI_CERT_SHA256_GUID, EFI_CERT_RSA2048_GUID, EFI_CERT_X509_GUID};\r
 //\r
@@ -398,7 +399,7 @@ AutenticatedVariableServiceInitialize (
 \r
   if (Variable.CurrPtr == NULL) {\r
     VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r
-    ListSize = 0;\r
+    ListSize = sizeof (UINT32);\r
     Status   = UpdateVariable (\r
                  EFI_CERT_DB_NAME,\r
                  &gEfiCertDbGuid,\r
@@ -410,7 +411,9 @@ AutenticatedVariableServiceInitialize (
                  &Variable,\r
                  NULL\r
                  );\r
-\r
+    if (EFI_ERROR (Status)) {\r
+      return Status;\r
+    }\r
   }  \r
 \r
   return Status;\r
@@ -1664,10 +1667,7 @@ DeleteCertsFromDb (
   // Construct new data content of variable "certdb".\r
   //\r
   NewCertDbSize = (UINT32) DataSize - CertNodeSize;\r
-  NewCertDb     = AllocateZeroPool (NewCertDbSize);\r
-  if (NewCertDb == NULL) {\r
-    return EFI_OUT_OF_RESOURCES;\r
-  }\r
+  NewCertDb     = (UINT8*) mCertDbStore;\r
 \r
   //\r
   // Copy the DB entries before deleting node.\r
@@ -1704,7 +1704,6 @@ DeleteCertsFromDb (
                NULL\r
                );\r
 \r
-  FreePool (NewCertDb);\r
   return Status;\r
 }\r
 \r
@@ -1793,11 +1792,11 @@ InsertCertsToDb (
   //\r
   NameSize      = (UINT32) StrLen (VariableName);\r
   CertNodeSize  = sizeof (AUTH_CERT_DB_DATA) + (UINT32) CertDataSize + NameSize * sizeof (CHAR16); \r
-  NewCertDbSize = (UINT32) DataSize + CertNodeSize;                  \r
-  NewCertDb     = AllocateZeroPool (NewCertDbSize);\r
-  if (NewCertDb == NULL) {\r
+  NewCertDbSize = (UINT32) DataSize + CertNodeSize;\r
+  if (NewCertDbSize > MAX_CERTDB_SIZE) {\r
     return EFI_OUT_OF_RESOURCES;\r
   }\r
+  NewCertDb     = (UINT8*) mCertDbStore;\r
 \r
   //\r
   // Copy the DB entries before deleting node.\r
@@ -1844,7 +1843,6 @@ InsertCertsToDb (
                NULL\r
                );\r
 \r
-  FreePool (NewCertDb);\r
   return Status;\r
 }\r
 \r

diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.h b/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.h
index e7a9a1f556be0940f61dbf01c5474a0f94470b8f..1f62383aed622e4456ae52d419b84289d4b83c13 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.h
+++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.h
@@ -36,14 +36,23 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 /// "AuthVarKeyDatabase" variable for the Public Key store.\r
 ///\r
 #define AUTHVAR_KEYDB_NAME      L"AuthVarKeyDatabase"\r
-#define AUTHVAR_KEYDB_NAME_SIZE 38\r
 \r
 ///\r
 /// Max size of public key database, restricted by max individal EFI varible size, exclude variable header and name size.\r
 ///\r
-#define MAX_KEYDB_SIZE  (FixedPcdGet32 (PcdMaxVariableSize) - sizeof (VARIABLE_HEADER) - AUTHVAR_KEYDB_NAME_SIZE)\r
+#define MAX_KEYDB_SIZE  (FixedPcdGet32 (PcdMaxVariableSize) - sizeof (VARIABLE_HEADER) - sizeof (AUTHVAR_KEYDB_NAME))\r
 #define MAX_KEY_NUM     (MAX_KEYDB_SIZE / EFI_CERT_TYPE_RSA2048_SIZE)\r
 \r
+///\r
+/// "certdb" variable stores the signer's certificates for non PK/KEK/DB/DBX\r
+/// variables with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.\r
+/// \r
+///\r
+#define EFI_CERT_DB_NAME        L"certdb"\r
+#define MAX_CERTDB_SIZE (FixedPcdGet32 (PcdMaxVariableSize) - sizeof (VARIABLE_HEADER) - sizeof (EFI_CERT_DB_NAME))\r
+\r
+extern  EFI_GUID gEfiCertDbGuid;\r
+\r
 ///\r
 /// Struct to record signature requirement defined by UEFI spec.\r
 /// For SigHeaderSize and SigDataSize, ((UINT32) ~0) means NO exact length requirement for this field.\r