SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c

   1 /** @file
   2   Implement authentication services for the authenticated variable
   3   service in UEFI2.2.
   4
   5   Caution: This module requires additional review when modified.
   6   This driver will have external input - variable data. It may be input in SMM mode.
   7   This external input must be validated carefully to avoid security issue like
   8   buffer overflow, integer overflow.
   9   Variable attribute should also be checked to avoid authentication bypass.
  10
  11   ProcessVarWithPk(), ProcessVarWithKek() and ProcessVariable() are the function to do
  12   variable authentication.
  13
  14   VerifyTimeBasedPayload() and VerifyCounterBasedPayload() are sub function to do verification.
  15   They will do basic validation for authentication data structure, then call crypto library
  16   to verify the signature.
  17
  18 Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>
  19 This program and the accompanying materials
  20 are licensed and made available under the terms and conditions of the BSD License
  21 which accompanies this distribution.  The full text of the license may be found at
  22 http://opensource.org/licenses/bsd-license.php
  23
  24 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  25 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  26
  27 **/
  28
  29 #include "Variable.h"
  30 #include "AuthService.h"
  31
  32 ///
  33 /// Global database array for scratch
  34 ///
  35 UINT8    mPubKeyStore[MAX_KEYDB_SIZE];
  36 UINT32   mPubKeyNumber;
  37 UINT8    mCertDbStore[MAX_CERTDB_SIZE];
  38 UINT32   mPlatformMode;
  39 EFI_GUID mSignatureSupport[] = {EFI_CERT_SHA1_GUID, EFI_CERT_SHA256_GUID, EFI_CERT_RSA2048_GUID, EFI_CERT_X509_GUID};
  40 //
  41 // Public Exponent of RSA Key.
  42 //
  43 CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };
  44 //
  45 // Hash context pointer
  46 //
  47 VOID  *mHashCtx = NULL;
  48
  49 //
  50 // Pointer to runtime buffer.
  51 // For "Append" operation to an existing variable, a read/modify/write operation
  52 // is supported by firmware internally. Reserve runtime buffer to cache previous
  53 // variable data in runtime phase because memory allocation is forbidden in virtual mode.
  54 //
  55 VOID  *mStorageArea = NULL;
  56
  57 //
  58 // The serialization of the values of the VariableName, VendorGuid and Attributes
  59 // parameters of the SetVariable() call and the TimeStamp component of the
  60 // EFI_VARIABLE_AUTHENTICATION_2 descriptor followed by the variable's new value
  61 // i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data)
  62 //
  63 UINT8 *mSerializationRuntimeBuffer = NULL;
  64
  65 //
  66 // Requirement for different signature type which have been defined in UEFI spec.
  67 // These data are used to peform SignatureList format check while setting PK/KEK variable.
  68 //
  69 EFI_SIGNATURE_ITEM mSupportSigItem[] = {
  70 //{SigType,                       SigHeaderSize,   SigDataSize  }
  71   {EFI_CERT_SHA256_GUID,          0,               32           },
  72   {EFI_CERT_RSA2048_GUID,         0,               256          },
  73   {EFI_CERT_RSA2048_SHA256_GUID,  0,               256          },
  74   {EFI_CERT_SHA1_GUID,            0,               20           },
  75   {EFI_CERT_RSA2048_SHA1_GUID,    0,               256          },
  76   {EFI_CERT_X509_GUID,            0,               ((UINT32) ~0)},
  77   {EFI_CERT_SHA224_GUID,          0,               28           },
  78   {EFI_CERT_SHA384_GUID,          0,               48           },
  79   {EFI_CERT_SHA512_GUID,          0,               64           }
  80 };
  81
  82 /**
  83   Determine whether this operation needs a physical present user.
  84
  85   @param[in]      VariableName            Name of the Variable.
  86   @param[in]      VendorGuid              GUID of the Variable.
  87
  88   @retval TRUE      This variable is protected, only a physical present user could set this variable.
  89   @retval FALSE     This variable is not protected.
  90
  91 **/
  92 BOOLEAN
  93 NeedPhysicallyPresent(
  94   IN     CHAR16         *VariableName,
  95   IN     EFI_GUID       *VendorGuid
  96   )
  97 {
  98   if ((CompareGuid (VendorGuid, &gEfiSecureBootEnableDisableGuid) && (StrCmp (VariableName, EFI_SECURE_BOOT_ENABLE_NAME) == 0))
  99     || (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (VariableName, EFI_CUSTOM_MODE_NAME) == 0))) {
 100     return TRUE;
 101   }
 102
 103   return FALSE;
 104 }
 105
 106 /**
 107   Determine whether the platform is operating in Custom Secure Boot mode.
 108
 109   @retval TRUE           The platform is operating in Custom mode.
 110   @retval FALSE          The platform is operating in Standard mode.
 111
 112 **/
 113 BOOLEAN
 114 InCustomMode (
 115   VOID
 116   )
 117 {
 118   VARIABLE_POINTER_TRACK  Variable;
 119
 120   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 121   if (Variable.CurrPtr != NULL && *(GetVariableDataPtr (Variable.CurrPtr)) == CUSTOM_SECURE_BOOT_MODE) {
 122     return TRUE;
 123   }
 124
 125   return FALSE;
 126 }
 127
 128
 129 /**
 130   Internal function to delete a Variable given its name and GUID, no authentication
 131   required.
 132
 133   @param[in]      VariableName            Name of the Variable.
 134   @param[in]      VendorGuid              GUID of the Variable.
 135
 136   @retval EFI_SUCCESS              Variable deleted successfully.
 137   @retval Others                   The driver failded to start the device.
 138
 139 **/
 140 EFI_STATUS
 141 DeleteVariable (
 142   IN  CHAR16                    *VariableName,
 143   IN  EFI_GUID                  *VendorGuid
 144   )
 145 {
 146   EFI_STATUS              Status;
 147   VARIABLE_POINTER_TRACK  Variable;
 148
 149   Status = FindVariable (VariableName, VendorGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 150   if (EFI_ERROR (Status)) {
 151     return EFI_SUCCESS;
 152   }
 153
 154   ASSERT (Variable.CurrPtr != NULL);
 155   return UpdateVariable (VariableName, VendorGuid, NULL, 0, 0, 0, 0, &Variable, NULL);
 156 }
 157
 158 /**
 159   Initializes for authenticated varibale service.
 160
 161   @retval EFI_SUCCESS           Function successfully executed.
 162   @retval EFI_OUT_OF_RESOURCES  Fail to allocate enough memory resources.
 163
 164 **/
 165 EFI_STATUS
 166 AutenticatedVariableServiceInitialize (
 167   VOID
 168   )
 169 {
 170   EFI_STATUS              Status;
 171   VARIABLE_POINTER_TRACK  Variable;
 172   VARIABLE_POINTER_TRACK  PkVariable;
 173   UINT8                   VarValue;
 174   UINT32                  VarAttr;
 175   UINT8                   *Data;
 176   UINTN                   DataSize;
 177   UINTN                   CtxSize;
 178   UINT8                   SecureBootMode;
 179   UINT8                   SecureBootEnable;
 180   UINT8                   CustomMode;
 181   UINT32                  ListSize;
 182
 183   //
 184   // Initialize hash context.
 185   //
 186   CtxSize   = Sha256GetContextSize ();
 187   mHashCtx  = AllocateRuntimePool (CtxSize);
 188   if (mHashCtx == NULL) {
 189     return EFI_OUT_OF_RESOURCES;
 190   }
 191
 192   //
 193   // Reserved runtime buffer for "Append" operation in virtual mode.
 194   //
 195   mStorageArea  = AllocateRuntimePool (PcdGet32 (PcdMaxVariableSize));
 196   if (mStorageArea == NULL) {
 197     return EFI_OUT_OF_RESOURCES;
 198   }
 199
 200   //
 201   // Prepare runtime buffer for serialized data of time-based authenticated
 202   // Variable, i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data).
 203   //
 204   mSerializationRuntimeBuffer = AllocateRuntimePool (PcdGet32 (PcdMaxVariableSize) + sizeof (EFI_GUID) + sizeof (UINT32) + sizeof (EFI_TIME));
 205   if (mSerializationRuntimeBuffer == NULL) {
 206     return EFI_OUT_OF_RESOURCES;
 207   }
 208
 209   //
 210   // Check "AuthVarKeyDatabase" variable's existence.
 211   // If it doesn't exist, create a new one with initial value of 0 and EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
 212   //
 213   Status = FindVariable (
 214              AUTHVAR_KEYDB_NAME,
 215              &gEfiAuthenticatedVariableGuid,
 216              &Variable,
 217              &mVariableModuleGlobal->VariableGlobal,
 218              FALSE
 219              );
 220
 221   if (Variable.CurrPtr == NULL) {
 222     VarAttr       = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 223     VarValue      = 0;
 224     mPubKeyNumber = 0;
 225     Status        = UpdateVariable (
 226                       AUTHVAR_KEYDB_NAME,
 227                       &gEfiAuthenticatedVariableGuid,
 228                       &VarValue,
 229                       sizeof(UINT8),
 230                       VarAttr,
 231                       0,
 232                       0,
 233                       &Variable,
 234                       NULL
 235                       );
 236     if (EFI_ERROR (Status)) {
 237       return Status;
 238     }
 239   } else {
 240     //
 241     // Load database in global variable for cache.
 242     //
 243     DataSize  = DataSizeOfVariable (Variable.CurrPtr);
 244     Data      = GetVariableDataPtr (Variable.CurrPtr);
 245     ASSERT ((DataSize != 0) && (Data != NULL));
 246     CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
 247     mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
 248   }
 249
 250   FindVariable (EFI_PLATFORM_KEY_NAME, &gEfiGlobalVariableGuid, &PkVariable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 251   if (PkVariable.CurrPtr == NULL) {
 252     DEBUG ((EFI_D_INFO, "Variable %s does not exist.\n", EFI_PLATFORM_KEY_NAME));
 253   } else {
 254     DEBUG ((EFI_D_INFO, "Variable %s exists.\n", EFI_PLATFORM_KEY_NAME));
 255   }
 256
 257   //
 258   // Create "SetupMode" varable with BS+RT attribute set.
 259   //
 260   FindVariable (EFI_SETUP_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 261   if (PkVariable.CurrPtr == NULL) {
 262     mPlatformMode = SETUP_MODE;
 263   } else {
 264     mPlatformMode = USER_MODE;
 265   }
 266   Status = UpdateVariable (
 267              EFI_SETUP_MODE_NAME,
 268              &gEfiGlobalVariableGuid,
 269              &mPlatformMode,
 270              sizeof(UINT8),
 271              EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 272              0,
 273              0,
 274              &Variable,
 275              NULL
 276              );
 277   if (EFI_ERROR (Status)) {
 278     return Status;
 279   }
 280
 281   //
 282   // Create "SignatureSupport" varable with BS+RT attribute set.
 283   //
 284   FindVariable (EFI_SIGNATURE_SUPPORT_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 285   Status  = UpdateVariable (
 286               EFI_SIGNATURE_SUPPORT_NAME,
 287               &gEfiGlobalVariableGuid,
 288               mSignatureSupport,
 289               sizeof(mSignatureSupport),
 290               EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 291               0,
 292               0,
 293               &Variable,
 294               NULL
 295               );
 296   if (EFI_ERROR (Status)) {
 297     return Status;
 298   }
 299
 300   //
 301   // If "SecureBootEnable" variable exists, then update "SecureBoot" variable.
 302   // If "SecureBootEnable" variable is SECURE_BOOT_ENABLE and in USER_MODE, Set "SecureBoot" variable to SECURE_BOOT_MODE_ENABLE.
 303   // If "SecureBootEnable" variable is SECURE_BOOT_DISABLE, Set "SecureBoot" variable to SECURE_BOOT_MODE_DISABLE.
 304   //
 305   SecureBootEnable = SECURE_BOOT_DISABLE;
 306   FindVariable (EFI_SECURE_BOOT_ENABLE_NAME, &gEfiSecureBootEnableDisableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 307   if (Variable.CurrPtr != NULL) {
 308     SecureBootEnable = *(GetVariableDataPtr (Variable.CurrPtr));
 309   } else if (mPlatformMode == USER_MODE) {
 310     //
 311     // "SecureBootEnable" not exist, initialize it in USER_MODE.
 312     //
 313     SecureBootEnable = SECURE_BOOT_ENABLE;
 314     Status = UpdateVariable (
 315                EFI_SECURE_BOOT_ENABLE_NAME,
 316                &gEfiSecureBootEnableDisableGuid,
 317                &SecureBootEnable,
 318                sizeof (UINT8),
 319                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 320                0,
 321                0,
 322                &Variable,
 323                NULL
 324                );
 325     if (EFI_ERROR (Status)) {
 326       return Status;
 327     }
 328   }
 329
 330   //
 331   // Create "SecureBoot" varable with BS+RT attribute set.
 332   //
 333   if (SecureBootEnable == SECURE_BOOT_ENABLE && mPlatformMode == USER_MODE) {
 334     SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 335   } else {
 336     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 337   }
 338   FindVariable (EFI_SECURE_BOOT_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 339   Status = UpdateVariable (
 340              EFI_SECURE_BOOT_MODE_NAME,
 341              &gEfiGlobalVariableGuid,
 342              &SecureBootMode,
 343              sizeof (UINT8),
 344              EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 345              0,
 346              0,
 347              &Variable,
 348              NULL
 349              );
 350   if (EFI_ERROR (Status)) {
 351     return Status;
 352   }
 353
 354   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SETUP_MODE_NAME, mPlatformMode));
 355   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_MODE_NAME, SecureBootMode));
 356   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_ENABLE_NAME, SecureBootEnable));
 357
 358   //
 359   // Check "CustomMode" variable's existence.
 360   //
 361   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 362   if (Variable.CurrPtr != NULL) {
 363     CustomMode = *(GetVariableDataPtr (Variable.CurrPtr));
 364   } else {
 365     //
 366     // "CustomMode" not exist, initialize it in STANDARD_SECURE_BOOT_MODE.
 367     //
 368     CustomMode = STANDARD_SECURE_BOOT_MODE;
 369     Status = UpdateVariable (
 370                EFI_CUSTOM_MODE_NAME,
 371                &gEfiCustomModeEnableGuid,
 372                &CustomMode,
 373                sizeof (UINT8),
 374                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 375                0,
 376                0,
 377                &Variable,
 378                NULL
 379                );
 380     if (EFI_ERROR (Status)) {
 381       return Status;
 382     }
 383   }
 384
 385   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_CUSTOM_MODE_NAME, CustomMode));
 386
 387   //
 388   // Check "certdb" variable's existence.
 389   // If it doesn't exist, then create a new one with
 390   // EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.
 391   //
 392   Status = FindVariable (
 393              EFI_CERT_DB_NAME,
 394              &gEfiCertDbGuid,
 395              &Variable,
 396              &mVariableModuleGlobal->VariableGlobal,
 397              FALSE
 398              );
 399
 400   if (Variable.CurrPtr == NULL) {
 401     VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
 402     ListSize = sizeof (UINT32);
 403     Status   = UpdateVariable (
 404                  EFI_CERT_DB_NAME,
 405                  &gEfiCertDbGuid,
 406                  &ListSize,
 407                  sizeof (UINT32),
 408                  VarAttr,
 409                  0,
 410                  0,
 411                  &Variable,
 412                  NULL
 413                  );
 414     if (EFI_ERROR (Status)) {
 415       return Status;
 416     }
 417   }
 418
 419   return Status;
 420 }
 421
 422 /**
 423   Add public key in store and return its index.
 424
 425   @param[in]  PubKey                  Input pointer to Public Key data
 426
 427   @return                             Index of new added item
 428
 429 **/
 430 UINT32
 431 AddPubKeyInStore (
 432   IN  UINT8               *PubKey
 433   )
 434 {
 435   EFI_STATUS              Status;
 436   BOOLEAN                 IsFound;
 437   UINT32                  Index;
 438   VARIABLE_POINTER_TRACK  Variable;
 439   UINT8                   *Ptr;
 440
 441   if (PubKey == NULL) {
 442     return 0;
 443   }
 444
 445   Status = FindVariable (
 446              AUTHVAR_KEYDB_NAME,
 447              &gEfiAuthenticatedVariableGuid,
 448              &Variable,
 449              &mVariableModuleGlobal->VariableGlobal,
 450              FALSE
 451              );
 452   ASSERT_EFI_ERROR (Status);
 453   //
 454   // Check whether the public key entry does exist.
 455   //
 456   IsFound = FALSE;
 457   for (Ptr = mPubKeyStore, Index = 1; Index <= mPubKeyNumber; Index++) {
 458     if (CompareMem (Ptr, PubKey, EFI_CERT_TYPE_RSA2048_SIZE) == 0) {
 459       IsFound = TRUE;
 460       break;
 461     }
 462     Ptr += EFI_CERT_TYPE_RSA2048_SIZE;
 463   }
 464
 465   if (!IsFound) {
 466     //
 467     // Add public key in database.
 468     //
 469     if (mPubKeyNumber == MAX_KEY_NUM) {
 470       //
 471       // Notes: Database is full, need enhancement here, currently just return 0.
 472       //
 473       return 0;
 474     }
 475
 476     CopyMem (mPubKeyStore + mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 477     Index = ++mPubKeyNumber;
 478     //
 479     // Update public key database variable.
 480     //
 481     Status = UpdateVariable (
 482                AUTHVAR_KEYDB_NAME,
 483                &gEfiAuthenticatedVariableGuid,
 484                mPubKeyStore,
 485                mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE,
 486                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS,
 487                0,
 488                0,
 489                &Variable,
 490                NULL
 491                );
 492     ASSERT_EFI_ERROR (Status);
 493   }
 494
 495   return Index;
 496 }
 497
 498 /**
 499   Verify data payload with AuthInfo in EFI_CERT_TYPE_RSA2048_SHA256_GUID type.
 500   Follow the steps in UEFI2.2.
 501
 502   Caution: This function may receive untrusted input.
 503   This function may be invoked in SMM mode, and datasize and data are external input.
 504   This function will do basic validation, before parse the data.
 505   This function will parse the authentication carefully to avoid security issues, like
 506   buffer overflow, integer overflow.
 507
 508   @param[in]      Data                    Pointer to data with AuthInfo.
 509   @param[in]      DataSize                Size of Data.
 510   @param[in]      PubKey                  Public key used for verification.
 511
 512   @retval EFI_INVALID_PARAMETER       Invalid parameter.
 513   @retval EFI_SECURITY_VIOLATION      If authentication failed.
 514   @retval EFI_SUCCESS                 Authentication successful.
 515
 516 **/
 517 EFI_STATUS
 518 VerifyCounterBasedPayload (
 519   IN     UINT8          *Data,
 520   IN     UINTN          DataSize,
 521   IN     UINT8          *PubKey
 522   )
 523 {
 524   BOOLEAN                         Status;
 525   EFI_VARIABLE_AUTHENTICATION     *CertData;
 526   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
 527   UINT8                           Digest[SHA256_DIGEST_SIZE];
 528   VOID                            *Rsa;
 529
 530   Rsa         = NULL;
 531   CertData    = NULL;
 532   CertBlock   = NULL;
 533
 534   if (Data == NULL || PubKey == NULL) {
 535     return EFI_INVALID_PARAMETER;
 536   }
 537
 538   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
 539   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
 540
 541   //
 542   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
 543   // Cert type should be EFI_CERT_TYPE_RSA2048_SHA256_GUID.
 544   //
 545   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
 546       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertTypeRsa2048Sha256Guid)
 547         ) {
 548     //
 549     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
 550     //
 551     return EFI_SECURITY_VIOLATION;
 552   }
 553   //
 554   // Hash data payload with SHA256.
 555   //
 556   ZeroMem (Digest, SHA256_DIGEST_SIZE);
 557   Status  = Sha256Init (mHashCtx);
 558   if (!Status) {
 559     goto Done;
 560   }
 561   Status  = Sha256Update (mHashCtx, Data + AUTHINFO_SIZE, (UINTN) (DataSize - AUTHINFO_SIZE));
 562   if (!Status) {
 563     goto Done;
 564   }
 565   //
 566   // Hash Monotonic Count.
 567   //
 568   Status  = Sha256Update (mHashCtx, &CertData->MonotonicCount, sizeof (UINT64));
 569   if (!Status) {
 570     goto Done;
 571   }
 572   Status  = Sha256Final (mHashCtx, Digest);
 573   if (!Status) {
 574     goto Done;
 575   }
 576   //
 577   // Generate & Initialize RSA Context.
 578   //
 579   Rsa = RsaNew ();
 580   ASSERT (Rsa != NULL);
 581   //
 582   // Set RSA Key Components.
 583   // NOTE: Only N and E are needed to be set as RSA public key for signature verification.
 584   //
 585   Status = RsaSetKey (Rsa, RsaKeyN, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 586   if (!Status) {
 587     goto Done;
 588   }
 589   Status = RsaSetKey (Rsa, RsaKeyE, mRsaE, sizeof (mRsaE));
 590   if (!Status) {
 591     goto Done;
 592   }
 593   //
 594   // Verify the signature.
 595   //
 596   Status = RsaPkcs1Verify (
 597              Rsa,
 598              Digest,
 599              SHA256_DIGEST_SIZE,
 600              CertBlock->Signature,
 601              EFI_CERT_TYPE_RSA2048_SHA256_SIZE
 602              );
 603
 604 Done:
 605   if (Rsa != NULL) {
 606     RsaFree (Rsa);
 607   }
 608   if (Status) {
 609     return EFI_SUCCESS;
 610   } else {
 611     return EFI_SECURITY_VIOLATION;
 612   }
 613 }
 614
 615 /**
 616   Update platform mode.
 617
 618   @param[in]      Mode                    SETUP_MODE or USER_MODE.
 619
 620   @return EFI_INVALID_PARAMETER           Invalid parameter.
 621   @return EFI_SUCCESS                     Update platform mode successfully.
 622
 623 **/
 624 EFI_STATUS
 625 UpdatePlatformMode (
 626   IN  UINT32                    Mode
 627   )
 628 {
 629   EFI_STATUS              Status;
 630   VARIABLE_POINTER_TRACK  Variable;
 631   UINT32                  VarAttr;
 632   UINT8                   SecureBootMode;
 633   UINT8                   SecureBootEnable;
 634   UINTN                   VariableDataSize;
 635
 636   Status = FindVariable (
 637              EFI_SETUP_MODE_NAME,
 638              &gEfiGlobalVariableGuid,
 639              &Variable,
 640              &mVariableModuleGlobal->VariableGlobal,
 641              FALSE
 642              );
 643   if (EFI_ERROR (Status)) {
 644     return Status;
 645   }
 646
 647   //
 648   // Update the value of SetupMode variable by a simple mem copy, this could avoid possible
 649   // variable storage reclaim at runtime.
 650   //
 651   mPlatformMode = (UINT8) Mode;
 652   CopyMem (GetVariableDataPtr (Variable.CurrPtr), &mPlatformMode, sizeof(UINT8));
 653
 654   if (AtRuntime ()) {
 655     //
 656     // SecureBoot Variable indicates whether the platform firmware is operating
 657     // in Secure boot mode (1) or not (0), so we should not change SecureBoot
 658     // Variable in runtime.
 659     //
 660     return Status;
 661   }
 662
 663   //
 664   // Check "SecureBoot" variable's existence.
 665   // If it doesn't exist, firmware has no capability to perform driver signing verification,
 666   // then set "SecureBoot" to 0.
 667   //
 668   Status = FindVariable (
 669              EFI_SECURE_BOOT_MODE_NAME,
 670              &gEfiGlobalVariableGuid,
 671              &Variable,
 672              &mVariableModuleGlobal->VariableGlobal,
 673              FALSE
 674              );
 675   //
 676   // If "SecureBoot" variable exists, then check "SetupMode" variable update.
 677   // If "SetupMode" variable is USER_MODE, "SecureBoot" variable is set to 1.
 678   // If "SetupMode" variable is SETUP_MODE, "SecureBoot" variable is set to 0.
 679   //
 680   if (Variable.CurrPtr == NULL) {
 681     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 682   } else {
 683     if (mPlatformMode == USER_MODE) {
 684       SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 685     } else if (mPlatformMode == SETUP_MODE) {
 686       SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 687     } else {
 688       return EFI_NOT_FOUND;
 689     }
 690   }
 691
 692   VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 693   Status  = UpdateVariable (
 694               EFI_SECURE_BOOT_MODE_NAME,
 695               &gEfiGlobalVariableGuid,
 696               &SecureBootMode,
 697               sizeof(UINT8),
 698               VarAttr,
 699               0,
 700               0,
 701               &Variable,
 702               NULL
 703               );
 704   if (EFI_ERROR (Status)) {
 705     return Status;
 706   }
 707
 708   //
 709   // Check "SecureBootEnable" variable's existence. It can enable/disable secure boot feature.
 710   //
 711   Status = FindVariable (
 712              EFI_SECURE_BOOT_ENABLE_NAME,
 713              &gEfiSecureBootEnableDisableGuid,
 714              &Variable,
 715              &mVariableModuleGlobal->VariableGlobal,
 716              FALSE
 717              );
 718
 719   if (SecureBootMode == SECURE_BOOT_MODE_ENABLE) {
 720     //
 721     // Create the "SecureBootEnable" variable as secure boot is enabled.
 722     //
 723     SecureBootEnable = SECURE_BOOT_ENABLE;
 724     VariableDataSize = sizeof (SecureBootEnable);
 725   } else {
 726     //
 727     // Delete the "SecureBootEnable" variable if this variable exist as "SecureBoot"
 728     // variable is not in secure boot state.
 729     //
 730     if (Variable.CurrPtr == NULL || EFI_ERROR (Status)) {
 731       return EFI_SUCCESS;
 732     }
 733     SecureBootEnable = SECURE_BOOT_DISABLE;
 734     VariableDataSize = 0;
 735   }
 736
 737   Status = UpdateVariable (
 738              EFI_SECURE_BOOT_ENABLE_NAME,
 739              &gEfiSecureBootEnableDisableGuid,
 740              &SecureBootEnable,
 741              VariableDataSize,
 742              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 743              0,
 744              0,
 745              &Variable,
 746              NULL
 747              );
 748   return Status;
 749 }
 750
 751 /**
 752   Check input data form to make sure it is a valid EFI_SIGNATURE_LIST for PK/KEK/db/dbx variable.
 753
 754   @param[in]  VariableName                Name of Variable to be check.
 755   @param[in]  VendorGuid                  Variable vendor GUID.
 756   @param[in]  Data                        Point to the variable data to be checked.
 757   @param[in]  DataSize                    Size of Data.
 758
 759   @return EFI_INVALID_PARAMETER           Invalid signature list format.
 760   @return EFI_SUCCESS                     Passed signature list format check successfully.
 761
 762 **/
 763 EFI_STATUS
 764 CheckSignatureListFormat(
 765   IN  CHAR16                    *VariableName,
 766   IN  EFI_GUID                  *VendorGuid,
 767   IN  VOID                      *Data,
 768   IN  UINTN                     DataSize
 769   )
 770 {
 771   EFI_SIGNATURE_LIST     *SigList;
 772   UINTN                  SigDataSize;
 773   UINT32                 Index;
 774   UINT32                 SigCount;
 775   BOOLEAN                IsPk;
 776   VOID                   *RsaContext;
 777   EFI_SIGNATURE_DATA     *CertData;
 778   UINTN                  CertLen;
 779
 780   if (DataSize == 0) {
 781     return EFI_SUCCESS;
 782   }
 783
 784   ASSERT (VariableName != NULL && VendorGuid != NULL && Data != NULL);
 785
 786   if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_PLATFORM_KEY_NAME) == 0)){
 787     IsPk = TRUE;
 788   } else if ((CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0) ||
 789              (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&
 790               (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0 || StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0))){
 791     IsPk = FALSE;
 792   } else {
 793     return EFI_SUCCESS;
 794   }
 795
 796   SigCount = 0;
 797   SigList  = (EFI_SIGNATURE_LIST *) Data;
 798   SigDataSize  = DataSize;
 799   RsaContext = NULL;
 800
 801   //
 802   // Walk throuth the input signature list and check the data format.
 803   // If any signature is incorrectly formed, the whole check will fail.
 804   //
 805   while ((SigDataSize > 0) && (SigDataSize >= SigList->SignatureListSize)) {
 806     for (Index = 0; Index < (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM)); Index++ ) {
 807       if (CompareGuid (&SigList->SignatureType, &mSupportSigItem[Index].SigType)) {
 808         //
 809         // The value of SignatureSize should always be 16 (size of SignatureOwner
 810         // component) add the data length according to signature type.
 811         //
 812         if (mSupportSigItem[Index].SigDataSize != ((UINT32) ~0) &&
 813           (SigList->SignatureSize - sizeof (EFI_GUID)) != mSupportSigItem[Index].SigDataSize) {
 814           return EFI_INVALID_PARAMETER;
 815         }
 816         if (mSupportSigItem[Index].SigHeaderSize != ((UINTN) ~0) &&
 817           SigList->SignatureHeaderSize != mSupportSigItem[Index].SigHeaderSize) {
 818           return EFI_INVALID_PARAMETER;
 819         }
 820         break;
 821       }
 822     }
 823
 824     if (Index == (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM))) {
 825       //
 826       // Undefined signature type.
 827       //
 828       return EFI_INVALID_PARAMETER;
 829     }
 830
 831     if (CompareGuid (&SigList->SignatureType, &gEfiCertX509Guid)) {
 832       //
 833       // Try to retrieve the RSA public key from the X.509 certificate.
 834       // If this operation fails, it's not a valid certificate.
 835       //
 836       RsaContext = RsaNew ();
 837       if (RsaContext == NULL) {
 838         return EFI_INVALID_PARAMETER;
 839       }
 840       CertData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigList + sizeof (EFI_SIGNATURE_LIST) + SigList->SignatureHeaderSize);
 841       CertLen = SigList->SignatureSize - sizeof (EFI_GUID);
 842       if (!RsaGetPublicKeyFromX509 (CertData->SignatureData, CertLen, &RsaContext)) {
 843         RsaFree (RsaContext);
 844         return EFI_INVALID_PARAMETER;
 845       }
 846       RsaFree (RsaContext);
 847     }
 848
 849     if ((SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) % SigList->SignatureSize != 0) {
 850       return EFI_INVALID_PARAMETER;
 851     }
 852     SigCount += (SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) / SigList->SignatureSize;
 853
 854     SigDataSize -= SigList->SignatureListSize;
 855     SigList = (EFI_SIGNATURE_LIST *) ((UINT8 *) SigList + SigList->SignatureListSize);
 856   }
 857
 858   if (((UINTN) SigList - (UINTN) Data) != DataSize) {
 859     return EFI_INVALID_PARAMETER;
 860   }
 861
 862   if (IsPk && SigCount > 1) {
 863     return EFI_INVALID_PARAMETER;
 864   }
 865
 866   return EFI_SUCCESS;
 867 }
 868
 869 /**
 870   Process variable with platform key for verification.
 871
 872   Caution: This function may receive untrusted input.
 873   This function may be invoked in SMM mode, and datasize and data are external input.
 874   This function will do basic validation, before parse the data.
 875   This function will parse the authentication carefully to avoid security issues, like
 876   buffer overflow, integer overflow.
 877   This function will check attribute carefully to avoid authentication bypass.
 878
 879   @param[in]  VariableName                Name of Variable to be found.
 880   @param[in]  VendorGuid                  Variable vendor GUID.
 881   @param[in]  Data                        Data pointer.
 882   @param[in]  DataSize                    Size of Data found. If size is less than the
 883                                           data, this value contains the required size.
 884   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
 885   @param[in]  Attributes                  Attribute value of the variable
 886   @param[in]  IsPk                        Indicate whether it is to process pk.
 887
 888   @return EFI_INVALID_PARAMETER           Invalid parameter.
 889   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation.
 890                                           check carried out by the firmware.
 891   @return EFI_SUCCESS                     Variable passed validation successfully.
 892
 893 **/
 894 EFI_STATUS
 895 ProcessVarWithPk (
 896   IN  CHAR16                    *VariableName,
 897   IN  EFI_GUID                  *VendorGuid,
 898   IN  VOID                      *Data,
 899   IN  UINTN                     DataSize,
 900   IN  VARIABLE_POINTER_TRACK    *Variable,
 901   IN  UINT32                    Attributes OPTIONAL,
 902   IN  BOOLEAN                   IsPk
 903   )
 904 {
 905   EFI_STATUS                  Status;
 906   BOOLEAN                     Del;
 907   UINT8                       *Payload;
 908   UINTN                       PayloadSize;
 909
 910   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
 911       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
 912     //
 913     // PK, KEK and db/dbx should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
 914     // authenticated variable.
 915     //
 916     return EFI_INVALID_PARAMETER;
 917   }
 918
 919   Del = FALSE;
 920   if ((InCustomMode() && UserPhysicalPresent()) || (mPlatformMode == SETUP_MODE && !IsPk)) {
 921     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
 922     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
 923     if (PayloadSize == 0) {
 924       Del = TRUE;
 925     }
 926
 927     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
 928     if (EFI_ERROR (Status)) {
 929       return Status;
 930     }
 931
 932     Status = UpdateVariable (
 933                VariableName,
 934                VendorGuid,
 935                Payload,
 936                PayloadSize,
 937                Attributes,
 938                0,
 939                0,
 940                Variable,
 941                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
 942                );
 943   } else if (mPlatformMode == USER_MODE) {
 944     //
 945     // Verify against X509 Cert in PK database.
 946     //
 947     Status = VerifyTimeBasedPayload (
 948                VariableName,
 949                VendorGuid,
 950                Data,
 951                DataSize,
 952                Variable,
 953                Attributes,
 954                AuthVarTypePk,
 955                &Del
 956                );
 957   } else {
 958     //
 959     // Verify against the certificate in data payload.
 960     //
 961     Status = VerifyTimeBasedPayload (
 962                VariableName,
 963                VendorGuid,
 964                Data,
 965                DataSize,
 966                Variable,
 967                Attributes,
 968                AuthVarTypePayload,
 969                &Del
 970                );
 971   }
 972
 973   if (!EFI_ERROR(Status) && IsPk) {
 974     if (mPlatformMode == SETUP_MODE && !Del) {
 975       //
 976       // If enroll PK in setup mode, need change to user mode.
 977       //
 978       Status = UpdatePlatformMode (USER_MODE);
 979     } else if (mPlatformMode == USER_MODE && Del){
 980       //
 981       // If delete PK in user mode, need change to setup mode.
 982       //
 983       Status = UpdatePlatformMode (SETUP_MODE);
 984     }
 985   }
 986
 987   return Status;
 988 }
 989
 990 /**
 991   Process variable with key exchange key for verification.
 992
 993   Caution: This function may receive untrusted input.
 994   This function may be invoked in SMM mode, and datasize and data are external input.
 995   This function will do basic validation, before parse the data.
 996   This function will parse the authentication carefully to avoid security issues, like
 997   buffer overflow, integer overflow.
 998   This function will check attribute carefully to avoid authentication bypass.
 999
1000   @param[in]  VariableName                Name of Variable to be found.
1001   @param[in]  VendorGuid                  Variable vendor GUID.
1002   @param[in]  Data                        Data pointer.
1003   @param[in]  DataSize                    Size of Data found. If size is less than the
1004                                           data, this value contains the required size.
1005   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1006   @param[in]  Attributes                  Attribute value of the variable.
1007
1008   @return EFI_INVALID_PARAMETER           Invalid parameter.
1009   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
1010                                           check carried out by the firmware.
1011   @return EFI_SUCCESS                     Variable pass validation successfully.
1012
1013 **/
1014 EFI_STATUS
1015 ProcessVarWithKek (
1016   IN  CHAR16                               *VariableName,
1017   IN  EFI_GUID                             *VendorGuid,
1018   IN  VOID                                 *Data,
1019   IN  UINTN                                DataSize,
1020   IN  VARIABLE_POINTER_TRACK               *Variable,
1021   IN  UINT32                               Attributes OPTIONAL
1022   )
1023 {
1024   EFI_STATUS                      Status;
1025   UINT8                           *Payload;
1026   UINTN                           PayloadSize;
1027
1028   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1029       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1030     //
1031     // DB and DBX should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1032     // authenticated variable.
1033     //
1034     return EFI_INVALID_PARAMETER;
1035   }
1036
1037   Status = EFI_SUCCESS;
1038   if (mPlatformMode == USER_MODE && !(InCustomMode() && UserPhysicalPresent())) {
1039     //
1040     // Time-based, verify against X509 Cert KEK.
1041     //
1042     return VerifyTimeBasedPayload (
1043              VariableName,
1044              VendorGuid,
1045              Data,
1046              DataSize,
1047              Variable,
1048              Attributes,
1049              AuthVarTypeKek,
1050              NULL
1051              );
1052   } else {
1053     //
1054     // If in setup mode or custom secure boot mode, no authentication needed.
1055     //
1056     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1057     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1058
1059     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
1060     if (EFI_ERROR (Status)) {
1061       return Status;
1062     }
1063
1064     Status = UpdateVariable (
1065                VariableName,
1066                VendorGuid,
1067                Payload,
1068                PayloadSize,
1069                Attributes,
1070                0,
1071                0,
1072                Variable,
1073                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1074                );
1075   }
1076
1077   return Status;
1078 }
1079
1080 /**
1081   Process variable with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS/EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
1082
1083   Caution: This function may receive untrusted input.
1084   This function may be invoked in SMM mode, and datasize and data are external input.
1085   This function will do basic validation, before parse the data.
1086   This function will parse the authentication carefully to avoid security issues, like
1087   buffer overflow, integer overflow.
1088   This function will check attribute carefully to avoid authentication bypass.
1089
1090   @param[in]  VariableName                Name of Variable to be found.
1091   @param[in]  VendorGuid                  Variable vendor GUID.
1092
1093   @param[in]  Data                        Data pointer.
1094   @param[in]  DataSize                    Size of Data found. If size is less than the
1095                                           data, this value contains the required size.
1096   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1097   @param[in]  Attributes                  Attribute value of the variable.
1098
1099   @return EFI_INVALID_PARAMETER           Invalid parameter.
1100   @return EFI_WRITE_PROTECTED             Variable is write-protected and needs authentication with
1101                                           EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1102   @return EFI_SECURITY_VIOLATION          The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
1103                                           set, but the AuthInfo does NOT pass the validation
1104                                           check carried out by the firmware.
1105   @return EFI_SUCCESS                     Variable is not write-protected or pass validation successfully.
1106
1107 **/
1108 EFI_STATUS
1109 ProcessVariable (
1110   IN     CHAR16                             *VariableName,
1111   IN     EFI_GUID                           *VendorGuid,
1112   IN     VOID                               *Data,
1113   IN     UINTN                              DataSize,
1114   IN     VARIABLE_POINTER_TRACK             *Variable,
1115   IN     UINT32                             Attributes
1116   )
1117 {
1118   EFI_STATUS                      Status;
1119   BOOLEAN                         IsDeletion;
1120   BOOLEAN                         IsFirstTime;
1121   UINT8                           *PubKey;
1122   EFI_VARIABLE_AUTHENTICATION     *CertData;
1123   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
1124   UINT32                          KeyIndex;
1125   UINT64                          MonotonicCount;
1126
1127   KeyIndex    = 0;
1128   CertData    = NULL;
1129   CertBlock   = NULL;
1130   PubKey      = NULL;
1131   IsDeletion  = FALSE;
1132
1133   if (NeedPhysicallyPresent(VariableName, VendorGuid) && !UserPhysicalPresent()) {
1134     //
1135     // This variable is protected, only physical present user could modify its value.
1136     //
1137     return EFI_SECURITY_VIOLATION;
1138   }
1139
1140   //
1141   // A time-based authenticated variable and a count-based authenticated variable
1142   // can't be updated by each other.
1143   //
1144   if (Variable->CurrPtr != NULL) {
1145     if (((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) &&
1146         ((Variable->CurrPtr->Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0)) {
1147       return EFI_SECURITY_VIOLATION;
1148     }
1149
1150     if (((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) &&
1151         ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0)) {
1152       return EFI_SECURITY_VIOLATION;
1153     }
1154   }
1155
1156   //
1157   // Process Time-based Authenticated variable.
1158   //
1159   if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1160     return VerifyTimeBasedPayload (
1161              VariableName,
1162              VendorGuid,
1163              Data,
1164              DataSize,
1165              Variable,
1166              Attributes,
1167              AuthVarTypePriv,
1168              NULL
1169              );
1170   }
1171
1172   //
1173   // Determine if first time SetVariable with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS.
1174   //
1175   if ((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) {
1176     //
1177     // Determine current operation type.
1178     //
1179     if (DataSize == AUTHINFO_SIZE) {
1180       IsDeletion = TRUE;
1181     }
1182     //
1183     // Determine whether this is the first time with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1184     //
1185     if (Variable->CurrPtr == NULL) {
1186       IsFirstTime = TRUE;
1187     } else if ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) == 0) {
1188       IsFirstTime = TRUE;
1189     } else {
1190       KeyIndex   = Variable->CurrPtr->PubKeyIndex;
1191       IsFirstTime = FALSE;
1192     }
1193   } else if ((Variable->CurrPtr != NULL) &&
1194              ((Variable->CurrPtr->Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)
1195             ) {
1196     //
1197     // If the variable is already write-protected, it always needs authentication before update.
1198     //
1199     return EFI_WRITE_PROTECTED;
1200   } else {
1201     //
1202     // If without EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS, set and attributes collision.
1203     // That means it is not authenticated variable, just update variable as usual.
1204     //
1205     Status = UpdateVariable (VariableName, VendorGuid, Data, DataSize, Attributes, 0, 0, Variable, NULL);
1206     return Status;
1207   }
1208
1209   //
1210   // Get PubKey and check Monotonic Count value corresponding to the variable.
1211   //
1212   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
1213   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
1214   PubKey    = CertBlock->PublicKey;
1215
1216   //
1217   // Update Monotonic Count value.
1218   //
1219   MonotonicCount = CertData->MonotonicCount;
1220
1221   if (!IsFirstTime) {
1222     //
1223     // Check input PubKey.
1224     //
1225     if (CompareMem (PubKey, mPubKeyStore + (KeyIndex - 1) * EFI_CERT_TYPE_RSA2048_SIZE, EFI_CERT_TYPE_RSA2048_SIZE) != 0) {
1226       return EFI_SECURITY_VIOLATION;
1227     }
1228     //
1229     // Compare the current monotonic count and ensure that it is greater than the last SetVariable
1230     // operation with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS attribute set.
1231     //
1232     if (CertData->MonotonicCount <= Variable->CurrPtr->MonotonicCount) {
1233       //
1234       // Monotonic count check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
1235       //
1236       return EFI_SECURITY_VIOLATION;
1237     }
1238   }
1239   //
1240   // Verify the certificate in Data payload.
1241   //
1242   Status = VerifyCounterBasedPayload (Data, DataSize, PubKey);
1243   if (EFI_ERROR (Status)) {
1244     return Status;
1245   }
1246
1247   //
1248   // Now, the signature has been verified!
1249   //
1250   if (IsFirstTime && !IsDeletion) {
1251     //
1252     // Update public key database variable if need.
1253     //
1254     KeyIndex = AddPubKeyInStore (PubKey);
1255     if (KeyIndex == 0) {
1256       return EFI_SECURITY_VIOLATION;
1257     }
1258   }
1259
1260   //
1261   // Verification pass.
1262   //
1263   return UpdateVariable (VariableName, VendorGuid, (UINT8*)Data + AUTHINFO_SIZE, DataSize - AUTHINFO_SIZE, Attributes, KeyIndex, MonotonicCount, Variable, NULL);
1264 }
1265
1266 /**
1267   Merge two buffers which formatted as EFI_SIGNATURE_LIST. Only the new EFI_SIGNATURE_DATA
1268   will be appended to the original EFI_SIGNATURE_LIST, duplicate EFI_SIGNATURE_DATA
1269   will be ignored.
1270
1271   @param[in, out]  Data            Pointer to original EFI_SIGNATURE_LIST.
1272   @param[in]       DataSize        Size of Data buffer.
1273   @param[in]       NewData         Pointer to new EFI_SIGNATURE_LIST to be appended.
1274   @param[in]       NewDataSize     Size of NewData buffer.
1275
1276   @return Size of the merged buffer.
1277
1278 **/
1279 UINTN
1280 AppendSignatureList (
1281   IN  OUT VOID            *Data,
1282   IN  UINTN               DataSize,
1283   IN  VOID                *NewData,
1284   IN  UINTN               NewDataSize
1285   )
1286 {
1287   EFI_SIGNATURE_LIST  *CertList;
1288   EFI_SIGNATURE_DATA  *Cert;
1289   UINTN               CertCount;
1290   EFI_SIGNATURE_LIST  *NewCertList;
1291   EFI_SIGNATURE_DATA  *NewCert;
1292   UINTN               NewCertCount;
1293   UINTN               Index;
1294   UINTN               Index2;
1295   UINTN               Size;
1296   UINT8               *Tail;
1297   UINTN               CopiedCount;
1298   UINTN               SignatureListSize;
1299   BOOLEAN             IsNewCert;
1300
1301   Tail = (UINT8 *) Data + DataSize;
1302
1303   NewCertList = (EFI_SIGNATURE_LIST *) NewData;
1304   while ((NewDataSize > 0) && (NewDataSize >= NewCertList->SignatureListSize)) {
1305     NewCert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCertList + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1306     NewCertCount = (NewCertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - NewCertList->SignatureHeaderSize) / NewCertList->SignatureSize;
1307
1308     CopiedCount = 0;
1309     for (Index = 0; Index < NewCertCount; Index++) {
1310       IsNewCert = TRUE;
1311
1312       Size = DataSize;
1313       CertList = (EFI_SIGNATURE_LIST *) Data;
1314       while ((Size > 0) && (Size >= CertList->SignatureListSize)) {
1315         if (CompareGuid (&CertList->SignatureType, &NewCertList->SignatureType) &&
1316            (CertList->SignatureSize == NewCertList->SignatureSize)) {
1317           Cert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
1318           CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
1319           for (Index2 = 0; Index2 < CertCount; Index2++) {
1320             //
1321             // Iterate each Signature Data in this Signature List.
1322             //
1323             if (CompareMem (NewCert, Cert, CertList->SignatureSize) == 0) {
1324               IsNewCert = FALSE;
1325               break;
1326             }
1327             Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
1328           }
1329         }
1330
1331         if (!IsNewCert) {
1332           break;
1333         }
1334         Size -= CertList->SignatureListSize;
1335         CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
1336       }
1337
1338       if (IsNewCert) {
1339         //
1340         // New EFI_SIGNATURE_DATA, append it.
1341         //
1342         if (CopiedCount == 0) {
1343           //
1344           // Copy EFI_SIGNATURE_LIST header for only once.
1345           //
1346           CopyMem (Tail, NewCertList, sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1347           Tail = Tail + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1348         }
1349
1350         CopyMem (Tail, NewCert, NewCertList->SignatureSize);
1351         Tail += NewCertList->SignatureSize;
1352         CopiedCount++;
1353       }
1354
1355       NewCert = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCert + NewCertList->SignatureSize);
1356     }
1357
1358     //
1359     // Update SignatureListSize in newly appended EFI_SIGNATURE_LIST.
1360     //
1361     if (CopiedCount != 0) {
1362       SignatureListSize = sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize + (CopiedCount * NewCertList->SignatureSize);
1363       CertList = (EFI_SIGNATURE_LIST *) (Tail - SignatureListSize);
1364       CertList->SignatureListSize = (UINT32) SignatureListSize;
1365     }
1366
1367     NewDataSize -= NewCertList->SignatureListSize;
1368     NewCertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) NewCertList + NewCertList->SignatureListSize);
1369   }
1370
1371   return (Tail - (UINT8 *) Data);
1372 }
1373
1374 /**
1375   Compare two EFI_TIME data.
1376
1377
1378   @param FirstTime           A pointer to the first EFI_TIME data.
1379   @param SecondTime          A pointer to the second EFI_TIME data.
1380
1381   @retval  TRUE              The FirstTime is not later than the SecondTime.
1382   @retval  FALSE             The FirstTime is later than the SecondTime.
1383
1384 **/
1385 BOOLEAN
1386 CompareTimeStamp (
1387   IN EFI_TIME               *FirstTime,
1388   IN EFI_TIME               *SecondTime
1389   )
1390 {
1391   if (FirstTime->Year != SecondTime->Year) {
1392     return (BOOLEAN) (FirstTime->Year < SecondTime->Year);
1393   } else if (FirstTime->Month != SecondTime->Month) {
1394     return (BOOLEAN) (FirstTime->Month < SecondTime->Month);
1395   } else if (FirstTime->Day != SecondTime->Day) {
1396     return (BOOLEAN) (FirstTime->Day < SecondTime->Day);
1397   } else if (FirstTime->Hour != SecondTime->Hour) {
1398     return (BOOLEAN) (FirstTime->Hour < SecondTime->Hour);
1399   } else if (FirstTime->Minute != SecondTime->Minute) {
1400     return (BOOLEAN) (FirstTime->Minute < SecondTime->Minute);
1401   }
1402
1403   return (BOOLEAN) (FirstTime->Second <= SecondTime->Second);
1404 }
1405
1406 /**
1407   Find matching signer's certificates for common authenticated variable
1408   by corresponding VariableName and VendorGuid from "certdb".
1409
1410   The data format of "certdb":
1411   //
1412   //     UINT32 CertDbListSize;
1413   // /// AUTH_CERT_DB_DATA Certs1[];
1414   // /// AUTH_CERT_DB_DATA Certs2[];
1415   // /// ...
1416   // /// AUTH_CERT_DB_DATA Certsn[];
1417   //
1418
1419   @param[in]  VariableName   Name of authenticated Variable.
1420   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1421   @param[in]  Data           Pointer to variable "certdb".
1422   @param[in]  DataSize       Size of variable "certdb".
1423   @param[out] CertOffset     Offset of matching CertData, from starting of Data.
1424   @param[out] CertDataSize   Length of CertData in bytes.
1425   @param[out] CertNodeOffset Offset of matching AUTH_CERT_DB_DATA , from
1426                              starting of Data.
1427   @param[out] CertNodeSize   Length of AUTH_CERT_DB_DATA in bytes.
1428
1429   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1430   @retval  EFI_NOT_FOUND         Fail to find matching certs.
1431   @retval  EFI_SUCCESS           Find matching certs and output parameters.
1432
1433 **/
1434 EFI_STATUS
1435 FindCertsFromDb (
1436   IN     CHAR16           *VariableName,
1437   IN     EFI_GUID         *VendorGuid,
1438   IN     UINT8            *Data,
1439   IN     UINTN            DataSize,
1440   OUT    UINT32           *CertOffset,    OPTIONAL
1441   OUT    UINT32           *CertDataSize,  OPTIONAL
1442   OUT    UINT32           *CertNodeOffset,OPTIONAL
1443   OUT    UINT32           *CertNodeSize   OPTIONAL
1444   )
1445 {
1446   UINT32                  Offset;
1447   AUTH_CERT_DB_DATA       *Ptr;
1448   UINT32                  CertSize;
1449   UINT32                  NameSize;
1450   UINT32                  NodeSize;
1451   UINT32                  CertDbListSize;
1452
1453   if ((VariableName == NULL) || (VendorGuid == NULL) || (Data == NULL)) {
1454     return EFI_INVALID_PARAMETER;
1455   }
1456
1457   //
1458   // Check whether DataSize matches recorded CertDbListSize.
1459   //
1460   if (DataSize < sizeof (UINT32)) {
1461     return EFI_INVALID_PARAMETER;
1462   }
1463
1464   CertDbListSize = ReadUnaligned32 ((UINT32 *) Data);
1465
1466   if (CertDbListSize != (UINT32) DataSize) {
1467     return EFI_INVALID_PARAMETER;
1468   }
1469
1470   Offset = sizeof (UINT32);
1471
1472   //
1473   // Get corresponding certificates by VendorGuid and VariableName.
1474   //
1475   while (Offset < (UINT32) DataSize) {
1476     Ptr = (AUTH_CERT_DB_DATA *) (Data + Offset);
1477     //
1478     // Check whether VendorGuid matches.
1479     //
1480     if (CompareGuid (&Ptr->VendorGuid, VendorGuid)) {
1481       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1482       NameSize = ReadUnaligned32 (&Ptr->NameSize);
1483       CertSize = ReadUnaligned32 (&Ptr->CertDataSize);
1484
1485       if (NodeSize != sizeof (EFI_GUID) + sizeof (UINT32) * 3 + CertSize +
1486           sizeof (CHAR16) * NameSize) {
1487         return EFI_INVALID_PARAMETER;
1488       }
1489
1490       Offset = Offset + sizeof (EFI_GUID) + sizeof (UINT32) * 3;
1491       //
1492       // Check whether VariableName matches.
1493       //
1494       if ((NameSize == StrLen (VariableName)) &&
1495           (CompareMem (Data + Offset, VariableName, NameSize * sizeof (CHAR16)) == 0)) {
1496         Offset = Offset + NameSize * sizeof (CHAR16);
1497
1498         if (CertOffset != NULL) {
1499           *CertOffset = Offset;
1500         }
1501
1502         if (CertDataSize != NULL) {
1503           *CertDataSize = CertSize;
1504         }
1505
1506         if (CertNodeOffset != NULL) {
1507           *CertNodeOffset = (UINT32) ((UINT8 *) Ptr - Data);
1508         }
1509
1510         if (CertNodeSize != NULL) {
1511           *CertNodeSize = NodeSize;
1512         }
1513
1514         return EFI_SUCCESS;
1515       } else {
1516         Offset = Offset + NameSize * sizeof (CHAR16) + CertSize;
1517       }
1518     } else {
1519       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1520       Offset   = Offset + NodeSize;
1521     }
1522   }
1523
1524   return EFI_NOT_FOUND;
1525 }
1526
1527 /**
1528   Retrieve signer's certificates for common authenticated variable
1529   by corresponding VariableName and VendorGuid from "certdb".
1530
1531   @param[in]  VariableName   Name of authenticated Variable.
1532   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1533   @param[out] CertData       Pointer to signer's certificates.
1534   @param[out] CertDataSize   Length of CertData in bytes.
1535
1536   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1537   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1538   @retval  EFI_SUCCESS           Get signer's certificates successfully.
1539
1540 **/
1541 EFI_STATUS
1542 GetCertsFromDb (
1543   IN     CHAR16           *VariableName,
1544   IN     EFI_GUID         *VendorGuid,
1545   OUT    UINT8            **CertData,
1546   OUT    UINT32           *CertDataSize
1547   )
1548 {
1549   VARIABLE_POINTER_TRACK  CertDbVariable;
1550   EFI_STATUS              Status;
1551   UINT8                   *Data;
1552   UINTN                   DataSize;
1553   UINT32                  CertOffset;
1554
1555   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL) || (CertDataSize == NULL)) {
1556     return EFI_INVALID_PARAMETER;
1557   }
1558
1559   //
1560   // Get variable "certdb".
1561   //
1562   Status = FindVariable (
1563              EFI_CERT_DB_NAME,
1564              &gEfiCertDbGuid,
1565              &CertDbVariable,
1566              &mVariableModuleGlobal->VariableGlobal,
1567              FALSE
1568              );
1569   if (EFI_ERROR (Status)) {
1570     return Status;
1571   }
1572
1573   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1574   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1575   if ((DataSize == 0) || (Data == NULL)) {
1576     ASSERT (FALSE);
1577     return EFI_NOT_FOUND;
1578   }
1579
1580   Status = FindCertsFromDb (
1581              VariableName,
1582              VendorGuid,
1583              Data,
1584              DataSize,
1585              &CertOffset,
1586              CertDataSize,
1587              NULL,
1588              NULL
1589              );
1590
1591   if (EFI_ERROR (Status)) {
1592     return Status;
1593   }
1594
1595   *CertData = Data + CertOffset;
1596   return EFI_SUCCESS;
1597 }
1598
1599 /**
1600   Delete matching signer's certificates when deleting common authenticated
1601   variable by corresponding VariableName and VendorGuid from "certdb".
1602
1603   @param[in]  VariableName   Name of authenticated Variable.
1604   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1605
1606   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1607   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1608   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
1609   @retval  EFI_SUCCESS           The operation is completed successfully.
1610
1611 **/
1612 EFI_STATUS
1613 DeleteCertsFromDb (
1614   IN     CHAR16           *VariableName,
1615   IN     EFI_GUID         *VendorGuid
1616   )
1617 {
1618   VARIABLE_POINTER_TRACK  CertDbVariable;
1619   EFI_STATUS              Status;
1620   UINT8                   *Data;
1621   UINTN                   DataSize;
1622   UINT32                  VarAttr;
1623   UINT32                  CertNodeOffset;
1624   UINT32                  CertNodeSize;
1625   UINT8                   *NewCertDb;
1626   UINT32                  NewCertDbSize;
1627
1628   if ((VariableName == NULL) || (VendorGuid == NULL)) {
1629     return EFI_INVALID_PARAMETER;
1630   }
1631
1632   //
1633   // Get variable "certdb".
1634   //
1635   Status = FindVariable (
1636              EFI_CERT_DB_NAME,
1637              &gEfiCertDbGuid,
1638              &CertDbVariable,
1639              &mVariableModuleGlobal->VariableGlobal,
1640              FALSE
1641              );
1642   if (EFI_ERROR (Status)) {
1643     return Status;
1644   }
1645
1646   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1647   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1648   if ((DataSize == 0) || (Data == NULL)) {
1649     ASSERT (FALSE);
1650     return EFI_NOT_FOUND;
1651   }
1652
1653   if (DataSize == sizeof (UINT32)) {
1654     //
1655     // There is no certs in certdb.
1656     //
1657     return EFI_SUCCESS;
1658   }
1659
1660   //
1661   // Get corresponding cert node from certdb.
1662   //
1663   Status = FindCertsFromDb (
1664              VariableName,
1665              VendorGuid,
1666              Data,
1667              DataSize,
1668              NULL,
1669              NULL,
1670              &CertNodeOffset,
1671              &CertNodeSize
1672              );
1673
1674   if (EFI_ERROR (Status)) {
1675     return Status;
1676   }
1677
1678   if (DataSize < (CertNodeOffset + CertNodeSize)) {
1679     return EFI_NOT_FOUND;
1680   }
1681
1682   //
1683   // Construct new data content of variable "certdb".
1684   //
1685   NewCertDbSize = (UINT32) DataSize - CertNodeSize;
1686   NewCertDb     = (UINT8*) mCertDbStore;
1687
1688   //
1689   // Copy the DB entries before deleting node.
1690   //
1691   CopyMem (NewCertDb, Data, CertNodeOffset);
1692   //
1693   // Update CertDbListSize.
1694   //
1695   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
1696   //
1697   // Copy the DB entries after deleting node.
1698   //
1699   if (DataSize > (CertNodeOffset + CertNodeSize)) {
1700     CopyMem (
1701       NewCertDb + CertNodeOffset,
1702       Data + CertNodeOffset + CertNodeSize,
1703       DataSize - CertNodeOffset - CertNodeSize
1704       );
1705   }
1706
1707   //
1708   // Set "certdb".
1709   //
1710   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
1711   Status   = UpdateVariable (
1712                EFI_CERT_DB_NAME,
1713                &gEfiCertDbGuid,
1714                NewCertDb,
1715                NewCertDbSize,
1716                VarAttr,
1717                0,
1718                0,
1719                &CertDbVariable,
1720                NULL
1721                );
1722
1723   return Status;
1724 }
1725
1726 /**
1727   Insert signer's certificates for common authenticated variable with VariableName
1728   and VendorGuid in AUTH_CERT_DB_DATA to "certdb".
1729
1730   @param[in]  VariableName   Name of authenticated Variable.
1731   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1732   @param[in]  CertData       Pointer to signer's certificates.
1733   @param[in]  CertDataSize   Length of CertData in bytes.
1734
1735   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1736   @retval  EFI_ACCESS_DENIED     An AUTH_CERT_DB_DATA entry with same VariableName
1737                                  and VendorGuid already exists.
1738   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
1739   @retval  EFI_SUCCESS           Insert an AUTH_CERT_DB_DATA entry to "certdb"
1740
1741 **/
1742 EFI_STATUS
1743 InsertCertsToDb (
1744   IN     CHAR16           *VariableName,
1745   IN     EFI_GUID         *VendorGuid,
1746   IN     UINT8            *CertData,
1747   IN     UINTN            CertDataSize
1748   )
1749 {
1750   VARIABLE_POINTER_TRACK  CertDbVariable;
1751   EFI_STATUS              Status;
1752   UINT8                   *Data;
1753   UINTN                   DataSize;
1754   UINT32                  VarAttr;
1755   UINT8                   *NewCertDb;
1756   UINT32                  NewCertDbSize;
1757   UINT32                  CertNodeSize;
1758   UINT32                  NameSize;
1759   AUTH_CERT_DB_DATA       *Ptr;
1760
1761   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL)) {
1762     return EFI_INVALID_PARAMETER;
1763   }
1764
1765   //
1766   // Get variable "certdb".
1767   //
1768   Status = FindVariable (
1769              EFI_CERT_DB_NAME,
1770              &gEfiCertDbGuid,
1771              &CertDbVariable,
1772              &mVariableModuleGlobal->VariableGlobal,
1773              FALSE
1774              );
1775   if (EFI_ERROR (Status)) {
1776     return Status;
1777   }
1778
1779   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1780   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1781   if ((DataSize == 0) || (Data == NULL)) {
1782     ASSERT (FALSE);
1783     return EFI_NOT_FOUND;
1784   }
1785
1786   //
1787   // Find whether matching cert node already exists in "certdb".
1788   // If yes return error.
1789   //
1790   Status = FindCertsFromDb (
1791              VariableName,
1792              VendorGuid,
1793              Data,
1794              DataSize,
1795              NULL,
1796              NULL,
1797              NULL,
1798              NULL
1799              );
1800
1801   if (!EFI_ERROR (Status)) {
1802     ASSERT (FALSE);
1803     return EFI_ACCESS_DENIED;
1804   }
1805
1806   //
1807   // Construct new data content of variable "certdb".
1808   //
1809   NameSize      = (UINT32) StrLen (VariableName);
1810   CertNodeSize  = sizeof (AUTH_CERT_DB_DATA) + (UINT32) CertDataSize + NameSize * sizeof (CHAR16);
1811   NewCertDbSize = (UINT32) DataSize + CertNodeSize;
1812   if (NewCertDbSize > MAX_CERTDB_SIZE) {
1813     return EFI_OUT_OF_RESOURCES;
1814   }
1815   NewCertDb     = (UINT8*) mCertDbStore;
1816
1817   //
1818   // Copy the DB entries before deleting node.
1819   //
1820   CopyMem (NewCertDb, Data, DataSize);
1821   //
1822   // Update CertDbListSize.
1823   //
1824   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
1825   //
1826   // Construct new cert node.
1827   //
1828   Ptr = (AUTH_CERT_DB_DATA *) (NewCertDb + DataSize);
1829   CopyGuid (&Ptr->VendorGuid, VendorGuid);
1830   CopyMem (&Ptr->CertNodeSize, &CertNodeSize, sizeof (UINT32));
1831   CopyMem (&Ptr->NameSize, &NameSize, sizeof (UINT32));
1832   CopyMem (&Ptr->CertDataSize, &CertDataSize, sizeof (UINT32));
1833
1834   CopyMem (
1835     (UINT8 *) Ptr + sizeof (AUTH_CERT_DB_DATA),
1836     VariableName,
1837     NameSize * sizeof (CHAR16)
1838     );
1839
1840   CopyMem (
1841     (UINT8 *) Ptr +  sizeof (AUTH_CERT_DB_DATA) + NameSize * sizeof (CHAR16),
1842     CertData,
1843     CertDataSize
1844     );
1845
1846   //
1847   // Set "certdb".
1848   //
1849   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
1850   Status   = UpdateVariable (
1851                EFI_CERT_DB_NAME,
1852                &gEfiCertDbGuid,
1853                NewCertDb,
1854                NewCertDbSize,
1855                VarAttr,
1856                0,
1857                0,
1858                &CertDbVariable,
1859                NULL
1860                );
1861
1862   return Status;
1863 }
1864
1865 /**
1866   Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
1867
1868   Caution: This function may receive untrusted input.
1869   This function may be invoked in SMM mode, and datasize and data are external input.
1870   This function will do basic validation, before parse the data.
1871   This function will parse the authentication carefully to avoid security issues, like
1872   buffer overflow, integer overflow.
1873
1874   @param[in]  VariableName                Name of Variable to be found.
1875   @param[in]  VendorGuid                  Variable vendor GUID.
1876   @param[in]  Data                        Data pointer.
1877   @param[in]  DataSize                    Size of Data found. If size is less than the
1878                                           data, this value contains the required size.
1879   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1880   @param[in]  Attributes                  Attribute value of the variable.
1881   @param[in]  AuthVarType                 Verify against PK, KEK database, private database or certificate in data payload.
1882   @param[out] VarDel                      Delete the variable or not.
1883
1884   @retval EFI_INVALID_PARAMETER           Invalid parameter.
1885   @retval EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
1886                                           check carried out by the firmware.
1887   @retval EFI_OUT_OF_RESOURCES            Failed to process variable due to lack
1888                                           of resources.
1889   @retval EFI_SUCCESS                     Variable pass validation successfully.
1890
1891 **/
1892 EFI_STATUS
1893 VerifyTimeBasedPayload (
1894   IN     CHAR16                             *VariableName,
1895   IN     EFI_GUID                           *VendorGuid,
1896   IN     VOID                               *Data,
1897   IN     UINTN                              DataSize,
1898   IN     VARIABLE_POINTER_TRACK             *Variable,
1899   IN     UINT32                             Attributes,
1900   IN     AUTHVAR_TYPE                       AuthVarType,
1901   OUT    BOOLEAN                            *VarDel
1902   )
1903 {
1904   UINT8                            *RootCert;
1905   UINT8                            *SigData;
1906   UINT8                            *PayloadPtr;
1907   UINTN                            RootCertSize;
1908   UINTN                            Index;
1909   UINTN                            CertCount;
1910   UINTN                            PayloadSize;
1911   UINT32                           Attr;
1912   UINT32                           SigDataSize;
1913   UINT32                           KekDataSize;
1914   BOOLEAN                          VerifyStatus;
1915   EFI_STATUS                       Status;
1916   EFI_SIGNATURE_LIST               *CertList;
1917   EFI_SIGNATURE_DATA               *Cert;
1918   VARIABLE_POINTER_TRACK           KekVariable;
1919   EFI_VARIABLE_AUTHENTICATION_2    *CertData;
1920   UINT8                            *NewData;
1921   UINTN                            NewDataSize;
1922   VARIABLE_POINTER_TRACK           PkVariable;
1923   UINT8                            *Buffer;
1924   UINTN                            Length;
1925   UINT8                            *SignerCerts;
1926   UINT8                            *WrapSigData;
1927   UINTN                            CertStackSize;
1928   UINT8                            *CertsInCertDb;
1929   UINT32                           CertsSizeinDb;
1930
1931   VerifyStatus           = FALSE;
1932   CertData               = NULL;
1933   NewData                = NULL;
1934   Attr                   = Attributes;
1935   WrapSigData            = NULL;
1936   SignerCerts            = NULL;
1937   RootCert               = NULL;
1938
1939   //
1940   // When the attribute EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS is
1941   // set, then the Data buffer shall begin with an instance of a complete (and serialized)
1942   // EFI_VARIABLE_AUTHENTICATION_2 descriptor. The descriptor shall be followed by the new
1943   // variable value and DataSize shall reflect the combined size of the descriptor and the new
1944   // variable value. The authentication descriptor is not part of the variable data and is not
1945   // returned by subsequent calls to GetVariable().
1946   //
1947   CertData = (EFI_VARIABLE_AUTHENTICATION_2 *) Data;
1948
1949   //
1950   // Verify that Pad1, Nanosecond, TimeZone, Daylight and Pad2 components of the
1951   // TimeStamp value are set to zero.
1952   //
1953   if ((CertData->TimeStamp.Pad1 != 0) ||
1954       (CertData->TimeStamp.Nanosecond != 0) ||
1955       (CertData->TimeStamp.TimeZone != 0) ||
1956       (CertData->TimeStamp.Daylight != 0) ||
1957       (CertData->TimeStamp.Pad2 != 0)) {
1958     return EFI_SECURITY_VIOLATION;
1959   }
1960
1961   if ((Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
1962     if (CompareTimeStamp (&CertData->TimeStamp, &Variable->CurrPtr->TimeStamp)) {
1963       //
1964       // TimeStamp check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
1965       //
1966       return EFI_SECURITY_VIOLATION;
1967     }
1968   }
1969
1970   //
1971   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
1972   // Cert type should be EFI_CERT_TYPE_PKCS7_GUID.
1973   //
1974   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
1975       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertPkcs7Guid)) {
1976     //
1977     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
1978     //
1979     return EFI_SECURITY_VIOLATION;
1980   }
1981
1982   //
1983   // Find out Pkcs7 SignedData which follows the EFI_VARIABLE_AUTHENTICATION_2 descriptor.
1984   // AuthInfo.Hdr.dwLength is the length of the entire certificate, including the length of the header.
1985   //
1986   SigData = CertData->AuthInfo.CertData;
1987   SigDataSize = CertData->AuthInfo.Hdr.dwLength - (UINT32) (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData));
1988
1989   //
1990   // Find out the new data payload which follows Pkcs7 SignedData directly.
1991   //
1992   PayloadPtr = SigData + SigDataSize;
1993   PayloadSize = DataSize - OFFSET_OF_AUTHINFO2_CERT_DATA - (UINTN) SigDataSize;
1994
1995   //
1996   // Construct a buffer to fill with (VariableName, VendorGuid, Attributes, TimeStamp, Data).
1997   //
1998   NewDataSize = PayloadSize + sizeof (EFI_TIME) + sizeof (UINT32) +
1999                 sizeof (EFI_GUID) + StrSize (VariableName) - sizeof (CHAR16);
2000   NewData = mSerializationRuntimeBuffer;
2001
2002   Buffer = NewData;
2003   Length = StrLen (VariableName) * sizeof (CHAR16);
2004   CopyMem (Buffer, VariableName, Length);
2005   Buffer += Length;
2006
2007   Length = sizeof (EFI_GUID);
2008   CopyMem (Buffer, VendorGuid, Length);
2009   Buffer += Length;
2010
2011   Length = sizeof (UINT32);
2012   CopyMem (Buffer, &Attr, Length);
2013   Buffer += Length;
2014
2015   Length = sizeof (EFI_TIME);
2016   CopyMem (Buffer, &CertData->TimeStamp, Length);
2017   Buffer += Length;
2018
2019   CopyMem (Buffer, PayloadPtr, PayloadSize);
2020
2021   if (AuthVarType == AuthVarTypePk) {
2022     //
2023     // Get platform key from variable.
2024     //
2025     Status = FindVariable (
2026                EFI_PLATFORM_KEY_NAME,
2027                &gEfiGlobalVariableGuid,
2028                &PkVariable,
2029                &mVariableModuleGlobal->VariableGlobal,
2030                FALSE
2031                );
2032     if (EFI_ERROR (Status)) {
2033       return Status;
2034     }
2035
2036     CertList = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (PkVariable.CurrPtr);
2037     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2038     RootCert      = Cert->SignatureData;
2039     RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2040
2041
2042     //
2043     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2044     //
2045     VerifyStatus = Pkcs7Verify (
2046                      SigData,
2047                      SigDataSize,
2048                      RootCert,
2049                      RootCertSize,
2050                      NewData,
2051                      NewDataSize
2052                      );
2053
2054   } else if (AuthVarType == AuthVarTypeKek) {
2055
2056     //
2057     // Get KEK database from variable.
2058     //
2059     Status = FindVariable (
2060                EFI_KEY_EXCHANGE_KEY_NAME,
2061                &gEfiGlobalVariableGuid,
2062                &KekVariable,
2063                &mVariableModuleGlobal->VariableGlobal,
2064                FALSE
2065                );
2066     if (EFI_ERROR (Status)) {
2067       return Status;
2068     }
2069
2070     //
2071     // Ready to verify Pkcs7 SignedData. Go through KEK Signature Database to find out X.509 CertList.
2072     //
2073     KekDataSize      = KekVariable.CurrPtr->DataSize;
2074     CertList         = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (KekVariable.CurrPtr);
2075     while ((KekDataSize > 0) && (KekDataSize >= CertList->SignatureListSize)) {
2076       if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {
2077         Cert       = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2078         CertCount  = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
2079         for (Index = 0; Index < CertCount; Index++) {
2080           //
2081           // Iterate each Signature Data Node within this CertList for a verify
2082           //
2083           RootCert      = Cert->SignatureData;
2084           RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2085
2086           //
2087           // Verify Pkcs7 SignedData via Pkcs7Verify library.
2088           //
2089           VerifyStatus = Pkcs7Verify (
2090                            SigData,
2091                            SigDataSize,
2092                            RootCert,
2093                            RootCertSize,
2094                            NewData,
2095                            NewDataSize
2096                            );
2097           if (VerifyStatus) {
2098             goto Exit;
2099           }
2100           Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
2101         }
2102       }
2103       KekDataSize -= CertList->SignatureListSize;
2104       CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
2105     }
2106   } else if (AuthVarType == AuthVarTypePriv) {
2107
2108     //
2109     // Process common authenticated variable except PK/KEK/DB/DBX.
2110     // Get signer's certificates from SignedData.
2111     //
2112     VerifyStatus = Pkcs7GetSigners (
2113                      SigData,
2114                      SigDataSize,
2115                      &SignerCerts,
2116                      &CertStackSize,
2117                      &RootCert,
2118                      &RootCertSize
2119                      );
2120     if (!VerifyStatus) {
2121       goto Exit;
2122     }
2123
2124     //
2125     // Get previously stored signer's certificates from certdb for existing
2126     // variable. Check whether they are identical with signer's certificates
2127     // in SignedData. If not, return error immediately.
2128     //
2129     if ((Variable->CurrPtr != NULL)) {
2130       VerifyStatus = FALSE;
2131
2132       Status = GetCertsFromDb (VariableName, VendorGuid, &CertsInCertDb, &CertsSizeinDb);
2133       if (EFI_ERROR (Status)) {
2134         goto Exit;
2135       }
2136
2137       if ((CertStackSize != CertsSizeinDb) ||
2138           (CompareMem (SignerCerts, CertsInCertDb, CertsSizeinDb) != 0)) {
2139         goto Exit;
2140       }
2141     }
2142
2143     VerifyStatus = Pkcs7Verify (
2144                      SigData,
2145                      SigDataSize,
2146                      RootCert,
2147                      RootCertSize,
2148                      NewData,
2149                      NewDataSize
2150                      );
2151     if (!VerifyStatus) {
2152       goto Exit;
2153     }
2154
2155     //
2156     // Delete signer's certificates when delete the common authenticated variable.
2157     //
2158     if ((PayloadSize == 0) && (Variable->CurrPtr != NULL)) {
2159       Status = DeleteCertsFromDb (VariableName, VendorGuid);
2160       if (EFI_ERROR (Status)) {
2161         VerifyStatus = FALSE;
2162         goto Exit;
2163       }
2164     } else if (Variable->CurrPtr == NULL) {
2165       //
2166       // Insert signer's certificates when adding a new common authenticated variable.
2167       //
2168       Status = InsertCertsToDb (VariableName, VendorGuid, SignerCerts, CertStackSize);
2169       if (EFI_ERROR (Status)) {
2170         VerifyStatus = FALSE;
2171         goto Exit;
2172       }
2173     }
2174   } else if (AuthVarType == AuthVarTypePayload) {
2175     CertList = (EFI_SIGNATURE_LIST *) PayloadPtr;
2176     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2177     RootCert      = Cert->SignatureData;
2178     RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2179
2180     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2181     //
2182     VerifyStatus = Pkcs7Verify (
2183                      SigData,
2184                      SigDataSize,
2185                      RootCert,
2186                      RootCertSize,
2187                      NewData,
2188                      NewDataSize
2189                      );
2190   } else {
2191     return EFI_SECURITY_VIOLATION;
2192   }
2193
2194 Exit:
2195
2196   if (AuthVarType == AuthVarTypePriv) {
2197     Pkcs7FreeSigners (RootCert);
2198     Pkcs7FreeSigners (SignerCerts);
2199   }
2200
2201   if (!VerifyStatus) {
2202     return EFI_SECURITY_VIOLATION;
2203   }
2204
2205   Status = CheckSignatureListFormat(VariableName, VendorGuid, PayloadPtr, PayloadSize);
2206   if (EFI_ERROR (Status)) {
2207     return Status;
2208   }
2209
2210   if ((PayloadSize == 0) && (VarDel != NULL)) {
2211     *VarDel = TRUE;
2212   }
2213
2214   //
2215   // Final step: Update/Append Variable if it pass Pkcs7Verify
2216   //
2217   return UpdateVariable (
2218            VariableName,
2219            VendorGuid,
2220            PayloadPtr,
2221            PayloadSize,
2222            Attributes,
2223            0,
2224            0,
2225            Variable,
2226            &CertData->TimeStamp
2227            );
2228 }
2229