1) Update code to use PcdFixedUsbCredentialProviderTokenFileName and PcdMaxVaria...

2)      Correct a typo in file comments of Tpm12Ownership.c

Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Dong, Guo <guo.dong@intel.com>
Reviewed-by: Gao, Liming <liming.gao@intel.com>
Reviewed-by: Yao, Jiewen <jiewen.yao@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@15811 6f19259b-4bc3-4df7-8a09-765794883524

diff --git a/SecurityPkg/Library/Tpm12CommandLib/Tpm12Ownership.c b/SecurityPkg/Library/Tpm12CommandLib/Tpm12Ownership.c
index 63cc174a8c5e99a54b2656036f6735196525adb5..5ca1323c30f02feb5a9deaa9d9a643ff8fe71157 100644 (file)
--- a/SecurityPkg/Library/Tpm12CommandLib/Tpm12Ownership.c
+++ b/SecurityPkg/Library/Tpm12CommandLib/Tpm12Ownership.c
@@ -1,7 +1,7 @@
 /** @file\r
-  Implement TPM1.2 Startup related command.\r
+  Implement TPM1.2 Ownership related command.\r
 \r
-Copyright (c) 2013, Intel Corporation. All rights reserved. <BR>\r
+Copyright (c) 2013 - 2014, Intel Corporation. All rights reserved. <BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r

diff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec
index 68ac464ac61fded2c668ab11cab83cd377801c33..1d44095af46f62bdd2ea8db1e1ba0fa862f26802 100644 (file)
--- a/SecurityPkg/SecurityPkg.dec
+++ b/SecurityPkg/SecurityPkg.dec
@@ -216,10 +216,6 @@
   # IMAGE_FROM_FIXED_MEDIA                0x00000010\r
   gEfiSecurityPkgTokenSpaceGuid.PcdDeferImageLoadPolicy|0x0000001F|UINT32|0x0000004\r
   \r
-  ## The token file name used to save credential in USB credential provider driver.\r
-  #  The specified file should be saved at the root directory of USB storage disk.\r
-  gEfiSecurityPkgTokenSpaceGuid.PcdFixedUsbCredentialProviderTokenFileName|L"Token.bin"|VOID*|0x00000005\r
-\r
   ## The size of Append variable buffer. This buffer is reserved for runtime use, OS can append data into one existing variable.\r
   gEfiSecurityPkgTokenSpaceGuid.PcdMaxAppendVariableSize|0x2000|UINT32|0x30000005  \r
 \r
@@ -229,6 +225,12 @@
   #  If 1, TCG platform type is server.\r
   gEfiSecurityPkgTokenSpaceGuid.PcdTpmPlatformClass|0|UINT8|0x00000006\r
 \r
+[PcdsFixedAtBuild, PcdsPatchableInModule]\r
+  ## Null-terminated Unicode string of the file name that is the default name to save USB credential.\r
+  #  The specified file should be saved at the root directory of USB storage disk.\r
+  # @Prompt File name to save credential.\r
+  gEfiSecurityPkgTokenSpaceGuid.PcdFixedUsbCredentialProviderTokenFileName|L"Token.bin"|VOID*|0x00000005\r
+  \r
 [PcdsFixedAtBuild, PcdsPatchableInModule, PcdsDynamic, PcdsDynamicEx]\r
   ## This PCD indicates the presence or absence of the platform operator.\r
   gEfiSecurityPkgTokenSpaceGuid.PcdTpmPhysicalPresence|TRUE|BOOLEAN|0x00010001\r

diff --git a/SecurityPkg/UserIdentification/UsbCredentialProviderDxe/UsbCredentialProvider.c b/SecurityPkg/UserIdentification/UsbCredentialProviderDxe/UsbCredentialProvider.c
index 046a50052d78df90aca61b48bd14b96141bbd6dc..f623f48304d1e0ae250a5c8ce5ef48243df44fb8 100644 (file)
--- a/SecurityPkg/UserIdentification/UsbCredentialProviderDxe/UsbCredentialProvider.c
+++ b/SecurityPkg/UserIdentification/UsbCredentialProviderDxe/UsbCredentialProvider.c
@@ -478,7 +478,7 @@ GetToken (
 \r
   BufSize = 0;\r
   Buffer  = NULL;\r
-  TokenFile = FixedPcdGetPtr (PcdFixedUsbCredentialProviderTokenFileName);\r
+  TokenFile = PcdGetPtr (PcdFixedUsbCredentialProviderTokenFileName);\r
   Status = GetFileData (TokenFile, (VOID *)&Buffer, &BufSize);\r
   if (EFI_ERROR (Status)) {\r
     DEBUG ((DEBUG_ERROR, "Read file %s from USB error! Status=(%r)\n", TokenFile, Status));\r

diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c b/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c
index 2663dbe0631ad4e09bda3d028c96511b275545d9..96b1f403c363f0005431a1a7f9404986022c783c 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c
+++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c
@@ -32,9 +32,12 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 ///\r
 /// Global database array for scratch\r
 ///\r
-UINT8    mPubKeyStore[MAX_KEYDB_SIZE];\r
+UINT8    *mPubKeyStore;\r
 UINT32   mPubKeyNumber;\r
-UINT8    mCertDbStore[MAX_CERTDB_SIZE];\r
+UINT32   mMaxKeyNumber;\r
+UINT32   mMaxKeyDbSize;\r
+UINT8    *mCertDbStore;\r
+UINT32   mMaxCertDbSize;\r
 UINT32   mPlatformMode;\r
 UINT8    mVendorKeyState;\r
 \r
@@ -183,6 +186,25 @@ AutenticatedVariableServiceInitialize (
     return EFI_OUT_OF_RESOURCES;\r
   }\r
 \r
+  //\r
+  // Reserve runtime buffer for public key database. The size excludes variable header and name size.\r
+  //\r
+  mMaxKeyDbSize = PcdGet32 (PcdMaxVariableSize) - sizeof (VARIABLE_HEADER) - sizeof (AUTHVAR_KEYDB_NAME);\r
+  mMaxKeyNumber = mMaxKeyDbSize / EFI_CERT_TYPE_RSA2048_SIZE;\r
+  mPubKeyStore  = AllocateRuntimePool (mMaxKeyDbSize);\r
+  if (mPubKeyStore == NULL) {\r
+    return EFI_OUT_OF_RESOURCES;\r
+  }\r
+\r
+  //\r
+  // Reserve runtime buffer for certificate database. The size excludes variable header and name size.\r
+  //\r
+  mMaxCertDbSize = PcdGet32 (PcdMaxVariableSize) - sizeof (VARIABLE_HEADER) - sizeof (EFI_CERT_DB_NAME);\r
+  mCertDbStore   = AllocateRuntimePool (mMaxCertDbSize);\r
+  if (mCertDbStore == NULL) {\r
+    return EFI_OUT_OF_RESOURCES;\r
+  }\r
+\r
   //\r
   // Prepare runtime buffer for serialized data of time-based authenticated\r
   // Variable, i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data).\r
@@ -503,7 +525,7 @@ AddPubKeyInStore (
     //\r
     // Add public key in database.\r
     //\r
-    if (mPubKeyNumber == MAX_KEY_NUM) {\r
+    if (mPubKeyNumber == mMaxKeyNumber) {\r
       //\r
       // Public key dadatase is full, try to reclaim invalid key.\r
       //\r
@@ -545,7 +567,7 @@ AddPubKeyInStore (
       CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);\r
       mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);\r
 \r
-      if (mPubKeyNumber == MAX_KEY_NUM) {\r
+      if (mPubKeyNumber == mMaxKeyNumber) {\r
         return 0;\r
       }     \r
     }\r
@@ -1996,7 +2018,7 @@ InsertCertsToDb (
   NameSize      = (UINT32) StrLen (VariableName);\r
   CertNodeSize  = sizeof (AUTH_CERT_DB_DATA) + (UINT32) CertDataSize + NameSize * sizeof (CHAR16); \r
   NewCertDbSize = (UINT32) DataSize + CertNodeSize;\r
-  if (NewCertDbSize > MAX_CERTDB_SIZE) {\r
+  if (NewCertDbSize > mMaxCertDbSize) {\r
     return EFI_OUT_OF_RESOURCES;\r
   }\r
   NewCertDb     = (UINT8*) mCertDbStore;\r

diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.h b/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.h
index 745e3c7d8fbd9f640e73c9b81492d52ab34681df..6ebc777075626f989348d58c8b1e20f515ff5e3b 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.h
+++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.h
@@ -2,7 +2,7 @@
   The internal header file includes the common header files, defines\r
   internal structure and functions used by AuthService module.\r
 \r
-Copyright (c) 2009 - 2013, Intel Corporation. All rights reserved.<BR>\r
+Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>\r
 This program and the accompanying materials\r
 are licensed and made available under the terms and conditions of the BSD License\r
 which accompanies this distribution.  The full text of the license may be found at\r
@@ -37,19 +37,12 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 ///\r
 #define AUTHVAR_KEYDB_NAME      L"AuthVarKeyDatabase"\r
 \r
-///\r
-/// Max size of public key database, restricted by max individal EFI varible size, exclude variable header and name size.\r
-///\r
-#define MAX_KEYDB_SIZE  (FixedPcdGet32 (PcdMaxVariableSize) - sizeof (VARIABLE_HEADER) - sizeof (AUTHVAR_KEYDB_NAME))\r
-#define MAX_KEY_NUM     (MAX_KEYDB_SIZE / EFI_CERT_TYPE_RSA2048_SIZE)\r
-\r
 ///\r
 /// "certdb" variable stores the signer's certificates for non PK/KEK/DB/DBX\r
 /// variables with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.\r
 /// \r
 ///\r
 #define EFI_CERT_DB_NAME        L"certdb"\r
-#define MAX_CERTDB_SIZE (FixedPcdGet32 (PcdMaxVariableSize) - sizeof (VARIABLE_HEADER) - sizeof (EFI_CERT_DB_NAME))\r
 \r
 ///\r
 /// Struct to record signature requirement defined by UEFI spec.\r
@@ -326,7 +319,8 @@ VerifyTimeBasedPayload (
   OUT    BOOLEAN                            *VarDel\r
   );\r
 \r
-extern UINT8  mPubKeyStore[MAX_KEYDB_SIZE];\r
+extern UINT8  *mPubKeyStore;\r
+extern UINT8  *mCertDbStore;\r
 extern UINT32 mPubKeyNumber;\r
 extern VOID   *mHashCtx;\r
 extern UINT8  *mSerializationRuntimeBuffer;\r

diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableDxe.c b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableDxe.c
index 949fb64248bf99acdab98e8924e43ec0402122dc..d8910b76f80fb4cd4ea6e4992bc0248cfa99aa45 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableDxe.c
+++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableDxe.c
@@ -243,6 +243,8 @@ VariableClassAddressChangeEvent (
   EfiConvertPointer (0x0, (VOID **) &mHashCtx);\r
   EfiConvertPointer (0x0, (VOID **) &mSerializationRuntimeBuffer);\r
   EfiConvertPointer (0x0, (VOID **) &mNvVariableCache);\r
+  EfiConvertPointer (0x0, (VOID **) &mPubKeyStore);\r
+  EfiConvertPointer (0x0, (VOID **) &mCertDbStore);\r
 \r
   //\r
   // in the list of locked variables, convert the name pointers first\r