SecurityPkg: AuthVariableLib: Add new cert database for volatile time based Auth...

Add a new cert data base "certdbv" to store signer certs for volatile time based
Auth variable.

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Fu Siyuan <siyuan.fu@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19786 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/SecurityPkg/Library/AuthVariableLib/AuthService.c b/SecurityPkg/Library/AuthVariableLib/AuthService.c
index 1c5c2f32da02e5ffcb65627b903f799b9178c0c6..f11b86827a8569e030e48e49ef29a73e902bf4b5 100644 (file)
--- a/SecurityPkg/Library/AuthVariableLib/AuthService.c
+++ b/SecurityPkg/Library/AuthVariableLib/AuthService.c
@@ -18,7 +18,7 @@
   They will do basic validation for authentication data structure, then call crypto library\r
   to verify the signature.\r
 \r
-Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2009 - 2016, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -2190,7 +2190,7 @@ ProcessVariable (
   IN     EFI_GUID                           *VendorGuid,\r
   IN     VOID                               *Data,\r
   IN     UINTN                              DataSize,\r
-  IN     UINT32                             Attributes OPTIONAL\r
+  IN     UINT32                             Attributes\r
   )\r
 {\r
   EFI_STATUS                      Status;\r
@@ -2231,7 +2231,7 @@ ProcessVariable (
               0\r
               );\r
     if (!EFI_ERROR (Status) && ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0)) {\r
-      Status = DeleteCertsFromDb (VariableName, VendorGuid);\r
+      Status = DeleteCertsFromDb (VariableName, VendorGuid, Attributes);\r
     }\r
 \r
     return Status;\r
@@ -2544,9 +2544,9 @@ AuthServiceInternalCompareTimeStamp (
 \r
 /**\r
   Find matching signer's certificates for common authenticated variable\r
-  by corresponding VariableName and VendorGuid from "certdb".\r
+  by corresponding VariableName and VendorGuid from "certdb" or "certdbv".\r
 \r
-  The data format of "certdb":\r
+  The data format of "certdb" or "certdbv":\r
   //\r
   //     UINT32 CertDbListSize;\r
   // /// AUTH_CERT_DB_DATA Certs1[];\r
@@ -2557,8 +2557,8 @@ AuthServiceInternalCompareTimeStamp (
 \r
   @param[in]  VariableName   Name of authenticated Variable.\r
   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.\r
-  @param[in]  Data           Pointer to variable "certdb".\r
-  @param[in]  DataSize       Size of variable "certdb".\r
+  @param[in]  Data           Pointer to variable "certdb" or "certdbv".\r
+  @param[in]  DataSize       Size of variable "certdb" or "certdbv".\r
   @param[out] CertOffset     Offset of matching CertData, from starting of Data.\r
   @param[out] CertDataSize   Length of CertData in bytes.\r
   @param[out] CertNodeOffset Offset of matching AUTH_CERT_DB_DATA , from\r
@@ -2665,15 +2665,17 @@ FindCertsFromDb (
 \r
 /**\r
   Retrieve signer's certificates for common authenticated variable\r
-  by corresponding VariableName and VendorGuid from "certdb".\r
+  by corresponding VariableName and VendorGuid from "certdb"\r
+  or "certdbv" according to authenticated variable attributes.\r
 \r
   @param[in]  VariableName   Name of authenticated Variable.\r
   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.\r
+  @param[in]  Attributes        Attributes of authenticated variable.\r
   @param[out] CertData       Pointer to signer's certificates.\r
   @param[out] CertDataSize   Length of CertData in bytes.\r
 \r
   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.\r
-  @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.\r
+  @retval  EFI_NOT_FOUND         Fail to find "certdb"/"certdbv" or matching certs.\r
   @retval  EFI_SUCCESS           Get signer's certificates successfully.\r
 \r
 **/\r
@@ -2681,6 +2683,7 @@ EFI_STATUS
 GetCertsFromDb (\r
   IN     CHAR16           *VariableName,\r
   IN     EFI_GUID         *VendorGuid,\r
+  IN     UINT32           Attributes,\r
   OUT    UINT8            **CertData,\r
   OUT    UINT32           *CertDataSize\r
   )\r
@@ -2689,16 +2692,30 @@ GetCertsFromDb (
   UINT8                   *Data;\r
   UINTN                   DataSize;\r
   UINT32                  CertOffset;\r
+  CHAR16                  *DbName;\r
 \r
   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL) || (CertDataSize == NULL)) {\r
     return EFI_INVALID_PARAMETER;\r
   }\r
 \r
+  \r
+  if ((Attributes & EFI_VARIABLE_NON_VOLATILE) != 0) {\r
+    //\r
+    // Get variable "certdb".\r
+    //\r
+    DbName = EFI_CERT_DB_NAME;\r
+  } else {\r
+    //\r
+    // Get variable "certdbv".\r
+    //\r
+    DbName = EFI_CERT_DB_VOLATILE_NAME;\r
+  }\r
+\r
   //\r
-  // Get variable "certdb".\r
+  // Get variable "certdb" or "certdbv".\r
   //\r
   Status = AuthServiceInternalFindVariable (\r
-             EFI_CERT_DB_NAME,\r
+             DbName,\r
              &gEfiCertDbGuid,\r
              (VOID **) &Data,\r
              &DataSize\r
@@ -2733,13 +2750,15 @@ GetCertsFromDb (
 \r
 /**\r
   Delete matching signer's certificates when deleting common authenticated\r
-  variable by corresponding VariableName and VendorGuid from "certdb".\r
+  variable by corresponding VariableName and VendorGuid from "certdb" or \r
+  "certdbv" according to authenticated variable attributes.\r
 \r
   @param[in]  VariableName   Name of authenticated Variable.\r
   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.\r
+  @param[in]  Attributes        Attributes of authenticated variable.\r
 \r
   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.\r
-  @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.\r
+  @retval  EFI_NOT_FOUND         Fail to find "certdb"/"certdbv" or matching certs.\r
   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.\r
   @retval  EFI_SUCCESS           The operation is completed successfully.\r
 \r
@@ -2747,7 +2766,8 @@ GetCertsFromDb (
 EFI_STATUS\r
 DeleteCertsFromDb (\r
   IN     CHAR16           *VariableName,\r
-  IN     EFI_GUID         *VendorGuid\r
+  IN     EFI_GUID         *VendorGuid,\r
+  IN     UINT32           Attributes\r
   )\r
 {\r
   EFI_STATUS              Status;\r
@@ -2758,20 +2778,33 @@ DeleteCertsFromDb (
   UINT32                  CertNodeSize;\r
   UINT8                   *NewCertDb;\r
   UINT32                  NewCertDbSize;\r
+  CHAR16                  *DbName;\r
 \r
   if ((VariableName == NULL) || (VendorGuid == NULL)) {\r
     return EFI_INVALID_PARAMETER;\r
   }\r
 \r
-  //\r
-  // Get variable "certdb".\r
-  //\r
+  if ((Attributes & EFI_VARIABLE_NON_VOLATILE) != 0) {\r
+    //\r
+    // Get variable "certdb".\r
+    //\r
+    DbName = EFI_CERT_DB_NAME;\r
+    VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r
+  } else {\r
+    //\r
+    // Get variable "certdbv".\r
+    //\r
+    DbName = EFI_CERT_DB_VOLATILE_NAME;\r
+    VarAttr = EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r
+  }\r
+\r
   Status = AuthServiceInternalFindVariable (\r
-             EFI_CERT_DB_NAME,\r
+             DbName,\r
              &gEfiCertDbGuid,\r
              (VOID **) &Data,\r
              &DataSize\r
              );\r
+\r
   if (EFI_ERROR (Status)) {\r
     return Status;\r
   }\r
@@ -2783,13 +2816,13 @@ DeleteCertsFromDb (
 \r
   if (DataSize == sizeof (UINT32)) {\r
     //\r
-    // There is no certs in certdb.\r
+    // There is no certs in "certdb" or "certdbv".\r
     //\r
     return EFI_SUCCESS;\r
   }\r
 \r
   //\r
-  // Get corresponding cert node from certdb.\r
+  // Get corresponding cert node from "certdb" or "certdbv".\r
   //\r
   Status = FindCertsFromDb (\r
              VariableName,\r
@@ -2811,7 +2844,7 @@ DeleteCertsFromDb (
   }\r
 \r
   //\r
-  // Construct new data content of variable "certdb".\r
+  // Construct new data content of variable "certdb" or "certdbv".\r
   //\r
   NewCertDbSize = (UINT32) DataSize - CertNodeSize;\r
   NewCertDb     = (UINT8*) mCertDbStore;\r
@@ -2836,11 +2869,10 @@ DeleteCertsFromDb (
   }\r
 \r
   //\r
-  // Set "certdb".\r
+  // Set "certdb" or "certdbv".\r
   //\r
-  VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r
   Status   = AuthServiceInternalUpdateVariable (\r
-               EFI_CERT_DB_NAME,\r
+               DbName,\r
                &gEfiCertDbGuid,\r
                NewCertDb,\r
                NewCertDbSize,\r
@@ -2852,10 +2884,12 @@ DeleteCertsFromDb (
 \r
 /**\r
   Insert signer's certificates for common authenticated variable with VariableName\r
-  and VendorGuid in AUTH_CERT_DB_DATA to "certdb".\r
+  and VendorGuid in AUTH_CERT_DB_DATA to "certdb" or "certdbv" according to\r
+  time based authenticated variable attributes.\r
 \r
   @param[in]  VariableName   Name of authenticated Variable.\r
   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.\r
+  @param[in]  Attributes     Attributes of authenticated variable.\r
   @param[in]  CertData       Pointer to signer's certificates.\r
   @param[in]  CertDataSize   Length of CertData in bytes.\r
 \r
@@ -2863,13 +2897,14 @@ DeleteCertsFromDb (
   @retval  EFI_ACCESS_DENIED     An AUTH_CERT_DB_DATA entry with same VariableName\r
                                  and VendorGuid already exists.\r
   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.\r
-  @retval  EFI_SUCCESS           Insert an AUTH_CERT_DB_DATA entry to "certdb"\r
+  @retval  EFI_SUCCESS           Insert an AUTH_CERT_DB_DATA entry to "certdb" or "certdbv"\r
 \r
 **/\r
 EFI_STATUS\r
 InsertCertsToDb (\r
   IN     CHAR16           *VariableName,\r
   IN     EFI_GUID         *VendorGuid,\r
+  IN     UINT32           Attributes,\r
   IN     UINT8            *CertData,\r
   IN     UINTN            CertDataSize\r
   )\r
@@ -2883,16 +2918,31 @@ InsertCertsToDb (
   UINT32                  CertNodeSize;\r
   UINT32                  NameSize;\r
   AUTH_CERT_DB_DATA       *Ptr;\r
+  CHAR16                  *DbName;\r
 \r
   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL)) {\r
     return EFI_INVALID_PARAMETER;\r
   }\r
 \r
+  if ((Attributes & EFI_VARIABLE_NON_VOLATILE) != 0) {\r
+    //\r
+    // Get variable "certdb".\r
+    //\r
+    DbName = EFI_CERT_DB_NAME;\r
+    VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r
+  } else {\r
+    //\r
+    // Get variable "certdbv".\r
+    //\r
+    DbName = EFI_CERT_DB_VOLATILE_NAME;\r
+    VarAttr = EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r
+  }\r
+\r
   //\r
-  // Get variable "certdb".\r
+  // Get variable "certdb" or "certdbv".\r
   //\r
   Status = AuthServiceInternalFindVariable (\r
-             EFI_CERT_DB_NAME,\r
+             DbName,\r
              &gEfiCertDbGuid,\r
              (VOID **) &Data,\r
              &DataSize\r
@@ -2907,7 +2957,7 @@ InsertCertsToDb (
   }\r
 \r
   //\r
-  // Find whether matching cert node already exists in "certdb".\r
+  // Find whether matching cert node already exists in "certdb" or "certdbv".\r
   // If yes return error.\r
   //\r
   Status = FindCertsFromDb (\r
@@ -2927,7 +2977,7 @@ InsertCertsToDb (
   }\r
 \r
   //\r
-  // Construct new data content of variable "certdb".\r
+  // Construct new data content of variable "certdb" or "certdbv".\r
   //\r
   NameSize      = (UINT32) StrLen (VariableName);\r
   CertNodeSize  = sizeof (AUTH_CERT_DB_DATA) + (UINT32) CertDataSize + NameSize * sizeof (CHAR16);\r
@@ -2967,11 +3017,10 @@ InsertCertsToDb (
     );\r
 \r
   //\r
-  // Set "certdb".\r
+  // Set "certdb" or "certdbv".\r
   //\r
-  VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r
   Status   = AuthServiceInternalUpdateVariable (\r
-               EFI_CERT_DB_NAME,\r
+               DbName,\r
                &gEfiCertDbGuid,\r
                NewCertDb,\r
                NewCertDbSize,\r
@@ -3007,9 +3056,8 @@ CleanCertsFromDb (
   BOOLEAN                 CertCleaned;\r
   UINT8                   *Data;\r
   UINTN                   DataSize;\r
-  UINT8                   *AuthVarData;\r
-  UINTN                   AuthVarDataSize;\r
   EFI_GUID                AuthVarGuid;\r
+  AUTH_VARIABLE_INFO      AuthVariableInfo;\r
 \r
   Status = EFI_SUCCESS;\r
 \r
@@ -3060,15 +3108,19 @@ CleanCertsFromDb (
       //\r
       // Find corresponding time auth variable\r
       //\r
-      Status = AuthServiceInternalFindVariable (\r
-                 VariableName,\r
-                 &AuthVarGuid,\r
-                 (VOID **) &AuthVarData,\r
-                 &AuthVarDataSize\r
-                 );\r
+      ZeroMem (&AuthVariableInfo, sizeof (AuthVariableInfo));\r
+      Status = mAuthVarLibContextIn->FindVariable (\r
+                                       VariableName,\r
+                                       &AuthVarGuid,\r
+                                       &AuthVariableInfo\r
+                                       );\r
 \r
       if (EFI_ERROR(Status)) {\r
-        Status      = DeleteCertsFromDb(VariableName, &AuthVarGuid);\r
+        Status      = DeleteCertsFromDb(\r
+                        VariableName,\r
+                        &AuthVarGuid,\r
+                        AuthVariableInfo.Attributes\r
+                        );\r
         CertCleaned = TRUE;\r
         DEBUG((EFI_D_INFO, "Recovery!! Cert for Auth Variable %s Guid %g is removed for consistency\n", VariableName, &AuthVarGuid));\r
         FreePool(VariableName);\r
@@ -3374,14 +3426,14 @@ VerifyTimeBasedPayload (
     }\r
 \r
     //\r
-    // Get previously stored signer's certificates from certdb for existing\r
+    // Get previously stored signer's certificates from certdb or certdbv for existing\r
     // variable. Check whether they are identical with signer's certificates\r
     // in SignedData. If not, return error immediately.\r
     //\r
     if (OrgTimeStamp != NULL) {\r
       VerifyStatus = FALSE;\r
 \r
-      Status = GetCertsFromDb (VariableName, VendorGuid, &CertsInCertDb, &CertsSizeinDb);\r
+      Status = GetCertsFromDb (VariableName, VendorGuid, Attributes, &CertsInCertDb, &CertsSizeinDb);\r
       if (EFI_ERROR (Status)) {\r
         goto Exit;\r
       }\r
@@ -3408,7 +3460,7 @@ VerifyTimeBasedPayload (
       //\r
       // Insert signer's certificates when adding a new common authenticated variable.\r
       //\r
-      Status = InsertCertsToDb (VariableName, VendorGuid, SignerCerts, CertStackSize);\r
+      Status = InsertCertsToDb (VariableName, VendorGuid, Attributes, SignerCerts, CertStackSize);\r
       if (EFI_ERROR (Status)) {\r
         VerifyStatus = FALSE;\r
         goto Exit;\r
@@ -3549,7 +3601,7 @@ VerifyTimeBasedPayloadAndUpdate (
   // Delete signer's certificates when delete the common authenticated variable.\r
   //\r
   if (IsDel && AuthVarType == AuthVarTypePriv && !EFI_ERROR(Status) ) {\r
-    Status = DeleteCertsFromDb (VariableName, VendorGuid);\r
+    Status = DeleteCertsFromDb (VariableName, VendorGuid, Attributes);\r
   }\r
 \r
   if (VarDel != NULL) {\r

diff --git a/SecurityPkg/Library/AuthVariableLib/AuthServiceInternal.h b/SecurityPkg/Library/AuthVariableLib/AuthServiceInternal.h
index ec4b3d97f59f0141e2ef1d04d53fb8f27741386d..83b0f23624b444d7996cc3e68afcfa982803b613 100644 (file)
--- a/SecurityPkg/Library/AuthVariableLib/AuthServiceInternal.h
+++ b/SecurityPkg/Library/AuthVariableLib/AuthServiceInternal.h
@@ -12,7 +12,7 @@
   may not be modified without authorization. If platform fails to protect these resources,\r
   the authentication service provided in this driver will be broken, and the behavior is undefined.\r
 \r
-Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2009 - 2016, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -86,8 +86,10 @@ typedef struct {
 #pragma pack()\r
 \r
 ///\r
-/// "certdb" variable stores the signer's certificates for non PK/KEK/DB/DBX\r
-/// variables with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.\r
+///  "certdb" variable stores the signer's certificates for non PK/KEK/DB/DBX\r
+/// variables with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS|EFI_VARIABLE_NON_VOLATILE set.\r
+///  "certdbv" variable stores the signer's certificates for non PK/KEK/DB/DBX\r
+/// variables with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set\r
 ///\r
 /// GUID: gEfiCertDbGuid\r
 ///\r
@@ -104,7 +106,8 @@ typedef struct {
 /// | AUTH_CERT_DB_DATA          | <-- Last CERT\r
 /// +----------------------------+\r
 ///\r
-#define EFI_CERT_DB_NAME        L"certdb"\r
+#define EFI_CERT_DB_NAME                 L"certdb"\r
+#define EFI_CERT_DB_VOLATILE_NAME        L"certdbv"\r
 \r
 #pragma pack(1)\r
 typedef struct {\r
@@ -229,13 +232,15 @@ VerifyTimeBasedPayloadAndUpdate (
 \r
 /**\r
   Delete matching signer's certificates when deleting common authenticated\r
-  variable by corresponding VariableName and VendorGuid from "certdb".\r
+  variable by corresponding VariableName and VendorGuid from "certdb" or \r
+  "certdbv" according to authenticated variable attributes.\r
 \r
   @param[in]  VariableName   Name of authenticated Variable.\r
   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.\r
+  @param[in]  Attributes        Attributes of authenticated variable.\r
 \r
   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.\r
-  @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.\r
+  @retval  EFI_NOT_FOUND         Fail to find "certdb"/"certdbv" or matching certs.\r
   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.\r
   @retval  EFI_SUCCESS           The operation is completed successfully.\r
 \r
@@ -243,7 +248,8 @@ VerifyTimeBasedPayloadAndUpdate (
 EFI_STATUS\r
 DeleteCertsFromDb (\r
   IN     CHAR16           *VariableName,\r
-  IN     EFI_GUID         *VendorGuid\r
+  IN     EFI_GUID         *VendorGuid,\r
+  IN     UINT32           Attributes\r
   );\r
 \r
 /**\r
@@ -410,7 +416,7 @@ ProcessVariable (
   IN     EFI_GUID                           *VendorGuid,\r
   IN     VOID                               *Data,\r
   IN     UINTN                              DataSize,\r
-  IN     UINT32                             Attributes OPTIONAL\r
+  IN     UINT32                             Attributes\r
   );\r
 \r
 /**\r

diff --git a/SecurityPkg/Library/AuthVariableLib/AuthVariableLib.c b/SecurityPkg/Library/AuthVariableLib/AuthVariableLib.c
index bf60bf54e5cb97936f0573829ecd4aa4c608f7cf..6467c0695c6cdaf476b16d7832ef1c44a98007de 100644 (file)
--- a/SecurityPkg/Library/AuthVariableLib/AuthVariableLib.c
+++ b/SecurityPkg/Library/AuthVariableLib/AuthVariableLib.c
@@ -11,7 +11,7 @@
   may not be modified without authorization. If platform fails to protect these resources,\r
   the authentication service provided in this driver will be broken, and the behavior is undefined.\r
 \r
-Copyright (c) 2015, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2015 - 2016, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -98,6 +98,17 @@ VARIABLE_ENTRY_PROPERTY mAuthVarEntry[] = {
       MAX_UINTN\r
     }\r
   },\r
+  {\r
+    &gEfiCertDbGuid,\r
+    EFI_CERT_DB_VOLATILE_NAME,\r
+    {\r
+      VAR_CHECK_VARIABLE_PROPERTY_REVISION,\r
+      VAR_CHECK_VARIABLE_PROPERTY_READ_ONLY,\r
+      VARIABLE_ATTRIBUTE_BS_RT_AT,\r
+      sizeof (UINT32),\r
+      MAX_UINTN\r
+    }\r
+  },\r
   {\r
     &gEdkiiSecureBootModeGuid,\r
     L"SecureBootMode",\r
@@ -172,8 +183,9 @@ AuthVariableLibInitialize (
 \r
   //\r
   // Reserve runtime buffer for certificate database. The size excludes variable header and name size.\r
+  // Use EFI_CERT_DB_VOLATILE_NAME size since it is longer.\r
   //\r
-  mMaxCertDbSize = (UINT32) (mAuthVarLibContextIn->MaxAuthVariableSize - sizeof (EFI_CERT_DB_NAME));\r
+  mMaxCertDbSize = (UINT32) (mAuthVarLibContextIn->MaxAuthVariableSize - sizeof (EFI_CERT_DB_VOLATILE_NAME));\r
   mCertDbStore   = AllocateRuntimePool (mMaxCertDbSize);\r
   if (mCertDbStore == NULL) {\r
     return EFI_OUT_OF_RESOURCES;\r
@@ -288,6 +300,22 @@ AuthVariableLibInitialize (
     }\r
   }\r
 \r
+  //\r
+  // Create "certdbv" variable with RT+BS+AT set.\r
+  //\r
+  VarAttr  = EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;\r
+  ListSize = sizeof (UINT32);\r
+  Status   = AuthServiceInternalUpdateVariable (\r
+               EFI_CERT_DB_VOLATILE_NAME,\r
+               &gEfiCertDbGuid,\r
+               &ListSize,\r
+               sizeof (UINT32),\r
+               VarAttr\r
+               );\r
+  if (EFI_ERROR (Status)) {\r
+    return Status;\r
+  }\r
+\r
   //\r
   // Check "VendorKeysNv" variable's existence and create "VendorKeys" variable accordingly.\r
   //\r

diff --git a/SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf b/SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
index 07a3ed541932dd0923d7f616790fdd6800c6811b..bf2c9f244d31a560673bfa39cdb3ce5a5b9be165 100644 (file)
--- a/SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
+++ b/SecurityPkg/Library/AuthVariableLib/AuthVariableLib.inf
@@ -1,7 +1,7 @@
 ## @file\r
 #  Provides authenticated variable services.\r
 #\r
-#  Copyright (c) 2015, Intel Corporation. All rights reserved.<BR>\r
+#  Copyright (c) 2015 - 2016, Intel Corporation. All rights reserved.<BR>\r
 #\r
 #  This program and the accompanying materials\r
 #  are licensed and made available under the terms and conditions\r
@@ -74,7 +74,9 @@
   gEfiCustomModeEnableGuid\r
 \r
   ## CONSUMES            ## Variable:L"certdb"\r
+  ## CONSUMES            ## Variable:L"certdbv"\r
   ## PRODUCES            ## Variable:L"certdb"\r
+  ## PRODUCES            ## Variable:L"certdbv"\r
   gEfiCertDbGuid\r
 \r
   ## CONSUMES            ## Variable:L"VendorKeysNv"\r

diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec
index b5f4eb75f2d147acc951fe5de5366140ee830e45..b432c4459ecfaaa094f4876968459a47a79a5e08 100644 (file)
--- a/SecurityPkg/SecurityPkg.dec
+++ b/SecurityPkg/SecurityPkg.dec
@@ -106,7 +106,7 @@
   #  Include/Guid/AuthenticatedVariableFormat.h\r
   gEfiVendorKeysNvGuid               = { 0x9073e4e0, 0x60ec, 0x4b6e, { 0x99, 0x3, 0x4c, 0x22, 0x3c, 0x26, 0xf, 0x3c } }\r
 \r
-  ## GUID used to "certdb" variable to store the signer's certificates for common variables with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS attribute.\r
+  ## GUID used to "certdb"/"certdbv" variable to store the signer's certificates for common variables with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS attribute.\r
   #  Include/Guid/AuthenticatedVariableFormat.h\r
   gEfiCertDbGuid                     = { 0xd9bee56e, 0x75dc, 0x49d9, { 0xb4, 0xd7, 0xb5, 0x34, 0x21, 0xf, 0x63, 0x7a } }\r
 \r