SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c

   1 /** @file
   2   Implement authentication services for the authenticated variable
   3   service in UEFI2.2.
   4
   5   Caution: This module requires additional review when modified.
   6   This driver will have external input - variable data. It may be input in SMM mode.
   7   This external input must be validated carefully to avoid security issue like
   8   buffer overflow, integer overflow.
   9   Variable attribute should also be checked to avoid authentication bypass.
  10
  11   ProcessVarWithPk(), ProcessVarWithKek() and ProcessVariable() are the function to do
  12   variable authentication.
  13
  14   VerifyTimeBasedPayload() and VerifyCounterBasedPayload() are sub function to do verification.
  15   They will do basic validation for authentication data structure, then call crypto library
  16   to verify the signature.
  17
  18 Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>
  19 This program and the accompanying materials
  20 are licensed and made available under the terms and conditions of the BSD License
  21 which accompanies this distribution.  The full text of the license may be found at
  22 http://opensource.org/licenses/bsd-license.php
  23
  24 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  25 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  26
  27 **/
  28
  29 #include "Variable.h"
  30 #include "AuthService.h"
  31
  32 ///
  33 /// Global database array for scratch
  34 ///
  35 UINT8    mPubKeyStore[MAX_KEYDB_SIZE];
  36 UINT32   mPubKeyNumber;
  37 UINT32   mPlatformMode;
  38 EFI_GUID mSignatureSupport[] = {EFI_CERT_SHA1_GUID, EFI_CERT_SHA256_GUID, EFI_CERT_RSA2048_GUID, EFI_CERT_X509_GUID};
  39 //
  40 // Public Exponent of RSA Key.
  41 //
  42 CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };
  43 //
  44 // Hash context pointer
  45 //
  46 VOID  *mHashCtx = NULL;
  47
  48 //
  49 // Pointer to runtime buffer.
  50 // For "Append" operation to an existing variable, a read/modify/write operation
  51 // is supported by firmware internally. Reserve runtime buffer to cache previous
  52 // variable data in runtime phase because memory allocation is forbidden in virtual mode.
  53 //
  54 VOID  *mStorageArea = NULL;
  55
  56 //
  57 // The serialization of the values of the VariableName, VendorGuid and Attributes
  58 // parameters of the SetVariable() call and the TimeStamp component of the
  59 // EFI_VARIABLE_AUTHENTICATION_2 descriptor followed by the variable's new value
  60 // i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data)
  61 //
  62 UINT8 *mSerializationRuntimeBuffer = NULL;
  63
  64 //
  65 // Requirement for different signature type which have been defined in UEFI spec.
  66 // These data are used to peform SignatureList format check while setting PK/KEK variable.
  67 //
  68 EFI_SIGNATURE_ITEM mSupportSigItem[] = {
  69 //{SigType,                       SigHeaderSize,   SigDataSize  }
  70   {EFI_CERT_SHA256_GUID,          0,               32           },
  71   {EFI_CERT_RSA2048_GUID,         0,               256          },
  72   {EFI_CERT_RSA2048_SHA256_GUID,  0,               256          },
  73   {EFI_CERT_SHA1_GUID,            0,               20           },
  74   {EFI_CERT_RSA2048_SHA1_GUID,    0,               256          },
  75   {EFI_CERT_X509_GUID,            0,               ((UINT32) ~0)},
  76   {EFI_CERT_SHA224_GUID,          0,               28           },
  77   {EFI_CERT_SHA384_GUID,          0,               48           },
  78   {EFI_CERT_SHA512_GUID,          0,               64           }
  79 };
  80
  81 /**
  82   Determine whether this operation needs a physical present user.
  83
  84   @param[in]      VariableName            Name of the Variable.
  85   @param[in]      VendorGuid              GUID of the Variable.
  86
  87   @retval TRUE      This variable is protected, only a physical present user could set this variable.
  88   @retval FALSE     This variable is not protected.
  89
  90 **/
  91 BOOLEAN
  92 NeedPhysicallyPresent(
  93   IN     CHAR16         *VariableName,
  94   IN     EFI_GUID       *VendorGuid
  95   )
  96 {
  97   if ((CompareGuid (VendorGuid, &gEfiSecureBootEnableDisableGuid) && (StrCmp (VariableName, EFI_SECURE_BOOT_ENABLE_NAME) == 0))
  98     || (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (VariableName, EFI_CUSTOM_MODE_NAME) == 0))) {
  99     return TRUE;
 100   }
 101
 102   return FALSE;
 103 }
 104
 105 /**
 106   Determine whether the platform is operating in Custom Secure Boot mode.
 107
 108   @retval TRUE           The platform is operating in Custom mode.
 109   @retval FALSE          The platform is operating in Standard mode.
 110
 111 **/
 112 BOOLEAN
 113 InCustomMode (
 114   VOID
 115   )
 116 {
 117   VARIABLE_POINTER_TRACK  Variable;
 118
 119   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 120   if (Variable.CurrPtr != NULL && *(GetVariableDataPtr (Variable.CurrPtr)) == CUSTOM_SECURE_BOOT_MODE) {
 121     return TRUE;
 122   }
 123
 124   return FALSE;
 125 }
 126
 127
 128 /**
 129   Internal function to delete a Variable given its name and GUID, no authentication
 130   required.
 131
 132   @param[in]      VariableName            Name of the Variable.
 133   @param[in]      VendorGuid              GUID of the Variable.
 134
 135   @retval EFI_SUCCESS              Variable deleted successfully.
 136   @retval Others                   The driver failded to start the device.
 137
 138 **/
 139 EFI_STATUS
 140 DeleteVariable (
 141   IN  CHAR16                    *VariableName,
 142   IN  EFI_GUID                  *VendorGuid
 143   )
 144 {
 145   EFI_STATUS              Status;
 146   VARIABLE_POINTER_TRACK  Variable;
 147
 148   Status = FindVariable (VariableName, VendorGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 149   if (EFI_ERROR (Status)) {
 150     return EFI_SUCCESS;
 151   }
 152
 153   ASSERT (Variable.CurrPtr != NULL);
 154   return UpdateVariable (VariableName, VendorGuid, NULL, 0, 0, 0, 0, &Variable, NULL);
 155 }
 156
 157 /**
 158   Initializes for authenticated varibale service.
 159
 160   @retval EFI_SUCCESS           Function successfully executed.
 161   @retval EFI_OUT_OF_RESOURCES  Fail to allocate enough memory resources.
 162
 163 **/
 164 EFI_STATUS
 165 AutenticatedVariableServiceInitialize (
 166   VOID
 167   )
 168 {
 169   EFI_STATUS              Status;
 170   VARIABLE_POINTER_TRACK  Variable;
 171   VARIABLE_POINTER_TRACK  PkVariable;
 172   UINT8                   VarValue;
 173   UINT32                  VarAttr;
 174   UINT8                   *Data;
 175   UINTN                   DataSize;
 176   UINTN                   CtxSize;
 177   UINT8                   SecureBootMode;
 178   UINT8                   SecureBootEnable;
 179   UINT8                   CustomMode;
 180   UINT32                  ListSize;
 181
 182   //
 183   // Initialize hash context.
 184   //
 185   CtxSize   = Sha256GetContextSize ();
 186   mHashCtx  = AllocateRuntimePool (CtxSize);
 187   if (mHashCtx == NULL) {
 188     return EFI_OUT_OF_RESOURCES;
 189   }
 190
 191   //
 192   // Reserved runtime buffer for "Append" operation in virtual mode.
 193   //
 194   mStorageArea  = AllocateRuntimePool (PcdGet32 (PcdMaxVariableSize));
 195   if (mStorageArea == NULL) {
 196     return EFI_OUT_OF_RESOURCES;
 197   }
 198
 199   //
 200   // Prepare runtime buffer for serialized data of time-based authenticated
 201   // Variable, i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data).
 202   //
 203   mSerializationRuntimeBuffer = AllocateRuntimePool (PcdGet32 (PcdMaxVariableSize) + sizeof (EFI_GUID) + sizeof (UINT32) + sizeof (EFI_TIME));
 204   if (mSerializationRuntimeBuffer == NULL) {
 205     return EFI_OUT_OF_RESOURCES;
 206   }
 207
 208   //
 209   // Check "AuthVarKeyDatabase" variable's existence.
 210   // If it doesn't exist, create a new one with initial value of 0 and EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
 211   //
 212   Status = FindVariable (
 213              AUTHVAR_KEYDB_NAME,
 214              &gEfiAuthenticatedVariableGuid,
 215              &Variable,
 216              &mVariableModuleGlobal->VariableGlobal,
 217              FALSE
 218              );
 219
 220   if (Variable.CurrPtr == NULL) {
 221     VarAttr       = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 222     VarValue      = 0;
 223     mPubKeyNumber = 0;
 224     Status        = UpdateVariable (
 225                       AUTHVAR_KEYDB_NAME,
 226                       &gEfiAuthenticatedVariableGuid,
 227                       &VarValue,
 228                       sizeof(UINT8),
 229                       VarAttr,
 230                       0,
 231                       0,
 232                       &Variable,
 233                       NULL
 234                       );
 235     if (EFI_ERROR (Status)) {
 236       return Status;
 237     }
 238   } else {
 239     //
 240     // Load database in global variable for cache.
 241     //
 242     DataSize  = DataSizeOfVariable (Variable.CurrPtr);
 243     Data      = GetVariableDataPtr (Variable.CurrPtr);
 244     ASSERT ((DataSize != 0) && (Data != NULL));
 245     CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
 246     mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
 247   }
 248
 249   FindVariable (EFI_PLATFORM_KEY_NAME, &gEfiGlobalVariableGuid, &PkVariable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 250   if (PkVariable.CurrPtr == NULL) {
 251     DEBUG ((EFI_D_INFO, "Variable %s does not exist.\n", EFI_PLATFORM_KEY_NAME));
 252   } else {
 253     DEBUG ((EFI_D_INFO, "Variable %s exists.\n", EFI_PLATFORM_KEY_NAME));
 254   }
 255
 256   //
 257   // Create "SetupMode" varable with BS+RT attribute set.
 258   //
 259   FindVariable (EFI_SETUP_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 260   if (PkVariable.CurrPtr == NULL) {
 261     mPlatformMode = SETUP_MODE;
 262   } else {
 263     mPlatformMode = USER_MODE;
 264   }
 265   Status = UpdateVariable (
 266              EFI_SETUP_MODE_NAME,
 267              &gEfiGlobalVariableGuid,
 268              &mPlatformMode,
 269              sizeof(UINT8),
 270              EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 271              0,
 272              0,
 273              &Variable,
 274              NULL
 275              );
 276   if (EFI_ERROR (Status)) {
 277     return Status;
 278   }
 279
 280   //
 281   // Create "SignatureSupport" varable with BS+RT attribute set.
 282   //
 283   FindVariable (EFI_SIGNATURE_SUPPORT_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 284   Status  = UpdateVariable (
 285               EFI_SIGNATURE_SUPPORT_NAME,
 286               &gEfiGlobalVariableGuid,
 287               mSignatureSupport,
 288               sizeof(mSignatureSupport),
 289               EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 290               0,
 291               0,
 292               &Variable,
 293               NULL
 294               );
 295   if (EFI_ERROR (Status)) {
 296     return Status;
 297   }
 298
 299   //
 300   // If "SecureBootEnable" variable exists, then update "SecureBoot" variable.
 301   // If "SecureBootEnable" variable is SECURE_BOOT_ENABLE and in USER_MODE, Set "SecureBoot" variable to SECURE_BOOT_MODE_ENABLE.
 302   // If "SecureBootEnable" variable is SECURE_BOOT_DISABLE, Set "SecureBoot" variable to SECURE_BOOT_MODE_DISABLE.
 303   //
 304   SecureBootEnable = SECURE_BOOT_DISABLE;
 305   FindVariable (EFI_SECURE_BOOT_ENABLE_NAME, &gEfiSecureBootEnableDisableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 306   if (Variable.CurrPtr != NULL) {
 307     SecureBootEnable = *(GetVariableDataPtr (Variable.CurrPtr));
 308   } else if (mPlatformMode == USER_MODE) {
 309     //
 310     // "SecureBootEnable" not exist, initialize it in USER_MODE.
 311     //
 312     SecureBootEnable = SECURE_BOOT_ENABLE;
 313     Status = UpdateVariable (
 314                EFI_SECURE_BOOT_ENABLE_NAME,
 315                &gEfiSecureBootEnableDisableGuid,
 316                &SecureBootEnable,
 317                sizeof (UINT8),
 318                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 319                0,
 320                0,
 321                &Variable,
 322                NULL
 323                );
 324     if (EFI_ERROR (Status)) {
 325       return Status;
 326     }
 327   }
 328
 329   //
 330   // Create "SecureBoot" varable with BS+RT attribute set.
 331   //
 332   if (SecureBootEnable == SECURE_BOOT_ENABLE && mPlatformMode == USER_MODE) {
 333     SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 334   } else {
 335     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 336   }
 337   FindVariable (EFI_SECURE_BOOT_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 338   Status = UpdateVariable (
 339              EFI_SECURE_BOOT_MODE_NAME,
 340              &gEfiGlobalVariableGuid,
 341              &SecureBootMode,
 342              sizeof (UINT8),
 343              EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 344              0,
 345              0,
 346              &Variable,
 347              NULL
 348              );
 349   if (EFI_ERROR (Status)) {
 350     return Status;
 351   }
 352
 353   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SETUP_MODE_NAME, mPlatformMode));
 354   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_MODE_NAME, SecureBootMode));
 355   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_ENABLE_NAME, SecureBootEnable));
 356
 357   //
 358   // Check "CustomMode" variable's existence.
 359   //
 360   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 361   if (Variable.CurrPtr != NULL) {
 362     CustomMode = *(GetVariableDataPtr (Variable.CurrPtr));
 363   } else {
 364     //
 365     // "CustomMode" not exist, initialize it in STANDARD_SECURE_BOOT_MODE.
 366     //
 367     CustomMode = STANDARD_SECURE_BOOT_MODE;
 368     Status = UpdateVariable (
 369                EFI_CUSTOM_MODE_NAME,
 370                &gEfiCustomModeEnableGuid,
 371                &CustomMode,
 372                sizeof (UINT8),
 373                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 374                0,
 375                0,
 376                &Variable,
 377                NULL
 378                );
 379     if (EFI_ERROR (Status)) {
 380       return Status;
 381     }
 382   }
 383
 384   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_CUSTOM_MODE_NAME, CustomMode));
 385
 386   //
 387   // Check "certdb" variable's existence.
 388   // If it doesn't exist, then create a new one with
 389   // EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.
 390   //
 391   Status = FindVariable (
 392              EFI_CERT_DB_NAME,
 393              &gEfiCertDbGuid,
 394              &Variable,
 395              &mVariableModuleGlobal->VariableGlobal,
 396              FALSE
 397              );
 398
 399   if (Variable.CurrPtr == NULL) {
 400     VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
 401     ListSize = 0;
 402     Status   = UpdateVariable (
 403                  EFI_CERT_DB_NAME,
 404                  &gEfiCertDbGuid,
 405                  &ListSize,
 406                  sizeof (UINT32),
 407                  VarAttr,
 408                  0,
 409                  0,
 410                  &Variable,
 411                  NULL
 412                  );
 413
 414   }
 415
 416   return Status;
 417 }
 418
 419 /**
 420   Add public key in store and return its index.
 421
 422   @param[in]  PubKey                  Input pointer to Public Key data
 423
 424   @return                             Index of new added item
 425
 426 **/
 427 UINT32
 428 AddPubKeyInStore (
 429   IN  UINT8               *PubKey
 430   )
 431 {
 432   EFI_STATUS              Status;
 433   BOOLEAN                 IsFound;
 434   UINT32                  Index;
 435   VARIABLE_POINTER_TRACK  Variable;
 436   UINT8                   *Ptr;
 437
 438   if (PubKey == NULL) {
 439     return 0;
 440   }
 441
 442   Status = FindVariable (
 443              AUTHVAR_KEYDB_NAME,
 444              &gEfiAuthenticatedVariableGuid,
 445              &Variable,
 446              &mVariableModuleGlobal->VariableGlobal,
 447              FALSE
 448              );
 449   ASSERT_EFI_ERROR (Status);
 450   //
 451   // Check whether the public key entry does exist.
 452   //
 453   IsFound = FALSE;
 454   for (Ptr = mPubKeyStore, Index = 1; Index <= mPubKeyNumber; Index++) {
 455     if (CompareMem (Ptr, PubKey, EFI_CERT_TYPE_RSA2048_SIZE) == 0) {
 456       IsFound = TRUE;
 457       break;
 458     }
 459     Ptr += EFI_CERT_TYPE_RSA2048_SIZE;
 460   }
 461
 462   if (!IsFound) {
 463     //
 464     // Add public key in database.
 465     //
 466     if (mPubKeyNumber == MAX_KEY_NUM) {
 467       //
 468       // Notes: Database is full, need enhancement here, currently just return 0.
 469       //
 470       return 0;
 471     }
 472
 473     CopyMem (mPubKeyStore + mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 474     Index = ++mPubKeyNumber;
 475     //
 476     // Update public key database variable.
 477     //
 478     Status = UpdateVariable (
 479                AUTHVAR_KEYDB_NAME,
 480                &gEfiAuthenticatedVariableGuid,
 481                mPubKeyStore,
 482                mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE,
 483                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS,
 484                0,
 485                0,
 486                &Variable,
 487                NULL
 488                );
 489     ASSERT_EFI_ERROR (Status);
 490   }
 491
 492   return Index;
 493 }
 494
 495 /**
 496   Verify data payload with AuthInfo in EFI_CERT_TYPE_RSA2048_SHA256_GUID type.
 497   Follow the steps in UEFI2.2.
 498
 499   Caution: This function may receive untrusted input.
 500   This function may be invoked in SMM mode, and datasize and data are external input.
 501   This function will do basic validation, before parse the data.
 502   This function will parse the authentication carefully to avoid security issues, like
 503   buffer overflow, integer overflow.
 504
 505   @param[in]      Data                    Pointer to data with AuthInfo.
 506   @param[in]      DataSize                Size of Data.
 507   @param[in]      PubKey                  Public key used for verification.
 508
 509   @retval EFI_INVALID_PARAMETER       Invalid parameter.
 510   @retval EFI_SECURITY_VIOLATION      If authentication failed.
 511   @retval EFI_SUCCESS                 Authentication successful.
 512
 513 **/
 514 EFI_STATUS
 515 VerifyCounterBasedPayload (
 516   IN     UINT8          *Data,
 517   IN     UINTN          DataSize,
 518   IN     UINT8          *PubKey
 519   )
 520 {
 521   BOOLEAN                         Status;
 522   EFI_VARIABLE_AUTHENTICATION     *CertData;
 523   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
 524   UINT8                           Digest[SHA256_DIGEST_SIZE];
 525   VOID                            *Rsa;
 526
 527   Rsa         = NULL;
 528   CertData    = NULL;
 529   CertBlock   = NULL;
 530
 531   if (Data == NULL || PubKey == NULL) {
 532     return EFI_INVALID_PARAMETER;
 533   }
 534
 535   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
 536   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
 537
 538   //
 539   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
 540   // Cert type should be EFI_CERT_TYPE_RSA2048_SHA256_GUID.
 541   //
 542   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
 543       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertTypeRsa2048Sha256Guid)
 544         ) {
 545     //
 546     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
 547     //
 548     return EFI_SECURITY_VIOLATION;
 549   }
 550   //
 551   // Hash data payload with SHA256.
 552   //
 553   ZeroMem (Digest, SHA256_DIGEST_SIZE);
 554   Status  = Sha256Init (mHashCtx);
 555   if (!Status) {
 556     goto Done;
 557   }
 558   Status  = Sha256Update (mHashCtx, Data + AUTHINFO_SIZE, (UINTN) (DataSize - AUTHINFO_SIZE));
 559   if (!Status) {
 560     goto Done;
 561   }
 562   //
 563   // Hash Monotonic Count.
 564   //
 565   Status  = Sha256Update (mHashCtx, &CertData->MonotonicCount, sizeof (UINT64));
 566   if (!Status) {
 567     goto Done;
 568   }
 569   Status  = Sha256Final (mHashCtx, Digest);
 570   if (!Status) {
 571     goto Done;
 572   }
 573   //
 574   // Generate & Initialize RSA Context.
 575   //
 576   Rsa = RsaNew ();
 577   ASSERT (Rsa != NULL);
 578   //
 579   // Set RSA Key Components.
 580   // NOTE: Only N and E are needed to be set as RSA public key for signature verification.
 581   //
 582   Status = RsaSetKey (Rsa, RsaKeyN, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 583   if (!Status) {
 584     goto Done;
 585   }
 586   Status = RsaSetKey (Rsa, RsaKeyE, mRsaE, sizeof (mRsaE));
 587   if (!Status) {
 588     goto Done;
 589   }
 590   //
 591   // Verify the signature.
 592   //
 593   Status = RsaPkcs1Verify (
 594              Rsa,
 595              Digest,
 596              SHA256_DIGEST_SIZE,
 597              CertBlock->Signature,
 598              EFI_CERT_TYPE_RSA2048_SHA256_SIZE
 599              );
 600
 601 Done:
 602   if (Rsa != NULL) {
 603     RsaFree (Rsa);
 604   }
 605   if (Status) {
 606     return EFI_SUCCESS;
 607   } else {
 608     return EFI_SECURITY_VIOLATION;
 609   }
 610 }
 611
 612 /**
 613   Update platform mode.
 614
 615   @param[in]      Mode                    SETUP_MODE or USER_MODE.
 616
 617   @return EFI_INVALID_PARAMETER           Invalid parameter.
 618   @return EFI_SUCCESS                     Update platform mode successfully.
 619
 620 **/
 621 EFI_STATUS
 622 UpdatePlatformMode (
 623   IN  UINT32                    Mode
 624   )
 625 {
 626   EFI_STATUS              Status;
 627   VARIABLE_POINTER_TRACK  Variable;
 628   UINT32                  VarAttr;
 629   UINT8                   SecureBootMode;
 630   UINT8                   SecureBootEnable;
 631   UINTN                   VariableDataSize;
 632
 633   Status = FindVariable (
 634              EFI_SETUP_MODE_NAME,
 635              &gEfiGlobalVariableGuid,
 636              &Variable,
 637              &mVariableModuleGlobal->VariableGlobal,
 638              FALSE
 639              );
 640   if (EFI_ERROR (Status)) {
 641     return Status;
 642   }
 643
 644   //
 645   // Update the value of SetupMode variable by a simple mem copy, this could avoid possible
 646   // variable storage reclaim at runtime.
 647   //
 648   mPlatformMode = (UINT8) Mode;
 649   CopyMem (GetVariableDataPtr (Variable.CurrPtr), &mPlatformMode, sizeof(UINT8));
 650
 651   if (AtRuntime ()) {
 652     //
 653     // SecureBoot Variable indicates whether the platform firmware is operating
 654     // in Secure boot mode (1) or not (0), so we should not change SecureBoot
 655     // Variable in runtime.
 656     //
 657     return Status;
 658   }
 659
 660   //
 661   // Check "SecureBoot" variable's existence.
 662   // If it doesn't exist, firmware has no capability to perform driver signing verification,
 663   // then set "SecureBoot" to 0.
 664   //
 665   Status = FindVariable (
 666              EFI_SECURE_BOOT_MODE_NAME,
 667              &gEfiGlobalVariableGuid,
 668              &Variable,
 669              &mVariableModuleGlobal->VariableGlobal,
 670              FALSE
 671              );
 672   //
 673   // If "SecureBoot" variable exists, then check "SetupMode" variable update.
 674   // If "SetupMode" variable is USER_MODE, "SecureBoot" variable is set to 1.
 675   // If "SetupMode" variable is SETUP_MODE, "SecureBoot" variable is set to 0.
 676   //
 677   if (Variable.CurrPtr == NULL) {
 678     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 679   } else {
 680     if (mPlatformMode == USER_MODE) {
 681       SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 682     } else if (mPlatformMode == SETUP_MODE) {
 683       SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 684     } else {
 685       return EFI_NOT_FOUND;
 686     }
 687   }
 688
 689   VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 690   Status  = UpdateVariable (
 691               EFI_SECURE_BOOT_MODE_NAME,
 692               &gEfiGlobalVariableGuid,
 693               &SecureBootMode,
 694               sizeof(UINT8),
 695               VarAttr,
 696               0,
 697               0,
 698               &Variable,
 699               NULL
 700               );
 701   if (EFI_ERROR (Status)) {
 702     return Status;
 703   }
 704
 705   //
 706   // Check "SecureBootEnable" variable's existence. It can enable/disable secure boot feature.
 707   //
 708   Status = FindVariable (
 709              EFI_SECURE_BOOT_ENABLE_NAME,
 710              &gEfiSecureBootEnableDisableGuid,
 711              &Variable,
 712              &mVariableModuleGlobal->VariableGlobal,
 713              FALSE
 714              );
 715
 716   if (SecureBootMode == SECURE_BOOT_MODE_ENABLE) {
 717     //
 718     // Create the "SecureBootEnable" variable as secure boot is enabled.
 719     //
 720     SecureBootEnable = SECURE_BOOT_ENABLE;
 721     VariableDataSize = sizeof (SecureBootEnable);
 722   } else {
 723     //
 724     // Delete the "SecureBootEnable" variable if this variable exist as "SecureBoot"
 725     // variable is not in secure boot state.
 726     //
 727     if (Variable.CurrPtr == NULL || EFI_ERROR (Status)) {
 728       return EFI_SUCCESS;
 729     }
 730     SecureBootEnable = SECURE_BOOT_DISABLE;
 731     VariableDataSize = 0;
 732   }
 733
 734   Status = UpdateVariable (
 735              EFI_SECURE_BOOT_ENABLE_NAME,
 736              &gEfiSecureBootEnableDisableGuid,
 737              &SecureBootEnable,
 738              VariableDataSize,
 739              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 740              0,
 741              0,
 742              &Variable,
 743              NULL
 744              );
 745   return Status;
 746 }
 747
 748 /**
 749   Check input data form to make sure it is a valid EFI_SIGNATURE_LIST for PK/KEK/db/dbx variable.
 750
 751   @param[in]  VariableName                Name of Variable to be check.
 752   @param[in]  VendorGuid                  Variable vendor GUID.
 753   @param[in]  Data                        Point to the variable data to be checked.
 754   @param[in]  DataSize                    Size of Data.
 755
 756   @return EFI_INVALID_PARAMETER           Invalid signature list format.
 757   @return EFI_SUCCESS                     Passed signature list format check successfully.
 758
 759 **/
 760 EFI_STATUS
 761 CheckSignatureListFormat(
 762   IN  CHAR16                    *VariableName,
 763   IN  EFI_GUID                  *VendorGuid,
 764   IN  VOID                      *Data,
 765   IN  UINTN                     DataSize
 766   )
 767 {
 768   EFI_SIGNATURE_LIST     *SigList;
 769   UINTN                  SigDataSize;
 770   UINT32                 Index;
 771   UINT32                 SigCount;
 772   BOOLEAN                IsPk;
 773   VOID                   *RsaContext;
 774   EFI_SIGNATURE_DATA     *CertData;
 775   UINTN                  CertLen;
 776
 777   if (DataSize == 0) {
 778     return EFI_SUCCESS;
 779   }
 780
 781   ASSERT (VariableName != NULL && VendorGuid != NULL && Data != NULL);
 782
 783   if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_PLATFORM_KEY_NAME) == 0)){
 784     IsPk = TRUE;
 785   } else if ((CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0) ||
 786              (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&
 787               (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0 || StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0))){
 788     IsPk = FALSE;
 789   } else {
 790     return EFI_SUCCESS;
 791   }
 792
 793   SigCount = 0;
 794   SigList  = (EFI_SIGNATURE_LIST *) Data;
 795   SigDataSize  = DataSize;
 796   RsaContext = NULL;
 797
 798   //
 799   // Walk throuth the input signature list and check the data format.
 800   // If any signature is incorrectly formed, the whole check will fail.
 801   //
 802   while ((SigDataSize > 0) && (SigDataSize >= SigList->SignatureListSize)) {
 803     for (Index = 0; Index < (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM)); Index++ ) {
 804       if (CompareGuid (&SigList->SignatureType, &mSupportSigItem[Index].SigType)) {
 805         //
 806         // The value of SignatureSize should always be 16 (size of SignatureOwner
 807         // component) add the data length according to signature type.
 808         //
 809         if (mSupportSigItem[Index].SigDataSize != ((UINT32) ~0) &&
 810           (SigList->SignatureSize - sizeof (EFI_GUID)) != mSupportSigItem[Index].SigDataSize) {
 811           return EFI_INVALID_PARAMETER;
 812         }
 813         if (mSupportSigItem[Index].SigHeaderSize != ((UINTN) ~0) &&
 814           SigList->SignatureHeaderSize != mSupportSigItem[Index].SigHeaderSize) {
 815           return EFI_INVALID_PARAMETER;
 816         }
 817         break;
 818       }
 819     }
 820
 821     if (Index == (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM))) {
 822       //
 823       // Undefined signature type.
 824       //
 825       return EFI_INVALID_PARAMETER;
 826     }
 827
 828     if (CompareGuid (&SigList->SignatureType, &gEfiCertX509Guid)) {
 829       //
 830       // Try to retrieve the RSA public key from the X.509 certificate.
 831       // If this operation fails, it's not a valid certificate.
 832       //
 833       RsaContext = RsaNew ();
 834       if (RsaContext == NULL) {
 835         return EFI_INVALID_PARAMETER;
 836       }
 837       CertData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigList + sizeof (EFI_SIGNATURE_LIST) + SigList->SignatureHeaderSize);
 838       CertLen = SigList->SignatureSize - sizeof (EFI_GUID);
 839       if (!RsaGetPublicKeyFromX509 (CertData->SignatureData, CertLen, &RsaContext)) {
 840         RsaFree (RsaContext);
 841         return EFI_INVALID_PARAMETER;
 842       }
 843       RsaFree (RsaContext);
 844     }
 845
 846     if ((SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) % SigList->SignatureSize != 0) {
 847       return EFI_INVALID_PARAMETER;
 848     }
 849     SigCount += (SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) / SigList->SignatureSize;
 850
 851     SigDataSize -= SigList->SignatureListSize;
 852     SigList = (EFI_SIGNATURE_LIST *) ((UINT8 *) SigList + SigList->SignatureListSize);
 853   }
 854
 855   if (((UINTN) SigList - (UINTN) Data) != DataSize) {
 856     return EFI_INVALID_PARAMETER;
 857   }
 858
 859   if (IsPk && SigCount > 1) {
 860     return EFI_INVALID_PARAMETER;
 861   }
 862
 863   return EFI_SUCCESS;
 864 }
 865
 866 /**
 867   Process variable with platform key for verification.
 868
 869   Caution: This function may receive untrusted input.
 870   This function may be invoked in SMM mode, and datasize and data are external input.
 871   This function will do basic validation, before parse the data.
 872   This function will parse the authentication carefully to avoid security issues, like
 873   buffer overflow, integer overflow.
 874   This function will check attribute carefully to avoid authentication bypass.
 875
 876   @param[in]  VariableName                Name of Variable to be found.
 877   @param[in]  VendorGuid                  Variable vendor GUID.
 878   @param[in]  Data                        Data pointer.
 879   @param[in]  DataSize                    Size of Data found. If size is less than the
 880                                           data, this value contains the required size.
 881   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
 882   @param[in]  Attributes                  Attribute value of the variable
 883   @param[in]  IsPk                        Indicate whether it is to process pk.
 884
 885   @return EFI_INVALID_PARAMETER           Invalid parameter.
 886   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation.
 887                                           check carried out by the firmware.
 888   @return EFI_SUCCESS                     Variable passed validation successfully.
 889
 890 **/
 891 EFI_STATUS
 892 ProcessVarWithPk (
 893   IN  CHAR16                    *VariableName,
 894   IN  EFI_GUID                  *VendorGuid,
 895   IN  VOID                      *Data,
 896   IN  UINTN                     DataSize,
 897   IN  VARIABLE_POINTER_TRACK    *Variable,
 898   IN  UINT32                    Attributes OPTIONAL,
 899   IN  BOOLEAN                   IsPk
 900   )
 901 {
 902   EFI_STATUS                  Status;
 903   BOOLEAN                     Del;
 904   UINT8                       *Payload;
 905   UINTN                       PayloadSize;
 906
 907   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
 908       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
 909     //
 910     // PK, KEK and db/dbx should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
 911     // authenticated variable.
 912     //
 913     return EFI_INVALID_PARAMETER;
 914   }
 915
 916   Del = FALSE;
 917   if ((InCustomMode() && UserPhysicalPresent()) || (mPlatformMode == SETUP_MODE && !IsPk)) {
 918     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
 919     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
 920     if (PayloadSize == 0) {
 921       Del = TRUE;
 922     }
 923
 924     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
 925     if (EFI_ERROR (Status)) {
 926       return Status;
 927     }
 928
 929     Status = UpdateVariable (
 930                VariableName,
 931                VendorGuid,
 932                Payload,
 933                PayloadSize,
 934                Attributes,
 935                0,
 936                0,
 937                Variable,
 938                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
 939                );
 940   } else if (mPlatformMode == USER_MODE) {
 941     //
 942     // Verify against X509 Cert in PK database.
 943     //
 944     Status = VerifyTimeBasedPayload (
 945                VariableName,
 946                VendorGuid,
 947                Data,
 948                DataSize,
 949                Variable,
 950                Attributes,
 951                AuthVarTypePk,
 952                &Del
 953                );
 954   } else {
 955     //
 956     // Verify against the certificate in data payload.
 957     //
 958     Status = VerifyTimeBasedPayload (
 959                VariableName,
 960                VendorGuid,
 961                Data,
 962                DataSize,
 963                Variable,
 964                Attributes,
 965                AuthVarTypePayload,
 966                &Del
 967                );
 968   }
 969
 970   if (!EFI_ERROR(Status) && IsPk) {
 971     if (mPlatformMode == SETUP_MODE && !Del) {
 972       //
 973       // If enroll PK in setup mode, need change to user mode.
 974       //
 975       Status = UpdatePlatformMode (USER_MODE);
 976     } else if (mPlatformMode == USER_MODE && Del){
 977       //
 978       // If delete PK in user mode, need change to setup mode.
 979       //
 980       Status = UpdatePlatformMode (SETUP_MODE);
 981     }
 982   }
 983
 984   return Status;
 985 }
 986
 987 /**
 988   Process variable with key exchange key for verification.
 989
 990   Caution: This function may receive untrusted input.
 991   This function may be invoked in SMM mode, and datasize and data are external input.
 992   This function will do basic validation, before parse the data.
 993   This function will parse the authentication carefully to avoid security issues, like
 994   buffer overflow, integer overflow.
 995   This function will check attribute carefully to avoid authentication bypass.
 996
 997   @param[in]  VariableName                Name of Variable to be found.
 998   @param[in]  VendorGuid                  Variable vendor GUID.
 999   @param[in]  Data                        Data pointer.
1000   @param[in]  DataSize                    Size of Data found. If size is less than the
1001                                           data, this value contains the required size.
1002   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1003   @param[in]  Attributes                  Attribute value of the variable.
1004
1005   @return EFI_INVALID_PARAMETER           Invalid parameter.
1006   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
1007                                           check carried out by the firmware.
1008   @return EFI_SUCCESS                     Variable pass validation successfully.
1009
1010 **/
1011 EFI_STATUS
1012 ProcessVarWithKek (
1013   IN  CHAR16                               *VariableName,
1014   IN  EFI_GUID                             *VendorGuid,
1015   IN  VOID                                 *Data,
1016   IN  UINTN                                DataSize,
1017   IN  VARIABLE_POINTER_TRACK               *Variable,
1018   IN  UINT32                               Attributes OPTIONAL
1019   )
1020 {
1021   EFI_STATUS                      Status;
1022   UINT8                           *Payload;
1023   UINTN                           PayloadSize;
1024
1025   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1026       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1027     //
1028     // DB and DBX should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1029     // authenticated variable.
1030     //
1031     return EFI_INVALID_PARAMETER;
1032   }
1033
1034   Status = EFI_SUCCESS;
1035   if (mPlatformMode == USER_MODE && !(InCustomMode() && UserPhysicalPresent())) {
1036     //
1037     // Time-based, verify against X509 Cert KEK.
1038     //
1039     return VerifyTimeBasedPayload (
1040              VariableName,
1041              VendorGuid,
1042              Data,
1043              DataSize,
1044              Variable,
1045              Attributes,
1046              AuthVarTypeKek,
1047              NULL
1048              );
1049   } else {
1050     //
1051     // If in setup mode or custom secure boot mode, no authentication needed.
1052     //
1053     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1054     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1055
1056     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
1057     if (EFI_ERROR (Status)) {
1058       return Status;
1059     }
1060
1061     Status = UpdateVariable (
1062                VariableName,
1063                VendorGuid,
1064                Payload,
1065                PayloadSize,
1066                Attributes,
1067                0,
1068                0,
1069                Variable,
1070                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1071                );
1072   }
1073
1074   return Status;
1075 }
1076
1077 /**
1078   Process variable with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS/EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
1079
1080   Caution: This function may receive untrusted input.
1081   This function may be invoked in SMM mode, and datasize and data are external input.
1082   This function will do basic validation, before parse the data.
1083   This function will parse the authentication carefully to avoid security issues, like
1084   buffer overflow, integer overflow.
1085   This function will check attribute carefully to avoid authentication bypass.
1086
1087   @param[in]  VariableName                Name of Variable to be found.
1088   @param[in]  VendorGuid                  Variable vendor GUID.
1089
1090   @param[in]  Data                        Data pointer.
1091   @param[in]  DataSize                    Size of Data found. If size is less than the
1092                                           data, this value contains the required size.
1093   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1094   @param[in]  Attributes                  Attribute value of the variable.
1095
1096   @return EFI_INVALID_PARAMETER           Invalid parameter.
1097   @return EFI_WRITE_PROTECTED             Variable is write-protected and needs authentication with
1098                                           EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1099   @return EFI_SECURITY_VIOLATION          The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
1100                                           set, but the AuthInfo does NOT pass the validation
1101                                           check carried out by the firmware.
1102   @return EFI_SUCCESS                     Variable is not write-protected or pass validation successfully.
1103
1104 **/
1105 EFI_STATUS
1106 ProcessVariable (
1107   IN     CHAR16                             *VariableName,
1108   IN     EFI_GUID                           *VendorGuid,
1109   IN     VOID                               *Data,
1110   IN     UINTN                              DataSize,
1111   IN     VARIABLE_POINTER_TRACK             *Variable,
1112   IN     UINT32                             Attributes
1113   )
1114 {
1115   EFI_STATUS                      Status;
1116   BOOLEAN                         IsDeletion;
1117   BOOLEAN                         IsFirstTime;
1118   UINT8                           *PubKey;
1119   EFI_VARIABLE_AUTHENTICATION     *CertData;
1120   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
1121   UINT32                          KeyIndex;
1122   UINT64                          MonotonicCount;
1123
1124   KeyIndex    = 0;
1125   CertData    = NULL;
1126   CertBlock   = NULL;
1127   PubKey      = NULL;
1128   IsDeletion  = FALSE;
1129
1130   if (NeedPhysicallyPresent(VariableName, VendorGuid) && !UserPhysicalPresent()) {
1131     //
1132     // This variable is protected, only physical present user could modify its value.
1133     //
1134     return EFI_SECURITY_VIOLATION;
1135   }
1136
1137   //
1138   // Process Time-based Authenticated variable.
1139   //
1140   if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1141     return VerifyTimeBasedPayload (
1142              VariableName,
1143              VendorGuid,
1144              Data,
1145              DataSize,
1146              Variable,
1147              Attributes,
1148              AuthVarTypePriv,
1149              NULL
1150              );
1151   }
1152
1153   //
1154   // Determine if first time SetVariable with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS.
1155   //
1156   if ((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) {
1157     //
1158     // Determine current operation type.
1159     //
1160     if (DataSize == AUTHINFO_SIZE) {
1161       IsDeletion = TRUE;
1162     }
1163     //
1164     // Determine whether this is the first time with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1165     //
1166     if (Variable->CurrPtr == NULL) {
1167       IsFirstTime = TRUE;
1168     } else if ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) == 0) {
1169       IsFirstTime = TRUE;
1170     } else {
1171       KeyIndex   = Variable->CurrPtr->PubKeyIndex;
1172       IsFirstTime = FALSE;
1173     }
1174   } else if ((Variable->CurrPtr != NULL) &&
1175              ((Variable->CurrPtr->Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)
1176             ) {
1177     //
1178     // If the variable is already write-protected, it always needs authentication before update.
1179     //
1180     return EFI_WRITE_PROTECTED;
1181   } else {
1182     //
1183     // If without EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS, set and attributes collision.
1184     // That means it is not authenticated variable, just update variable as usual.
1185     //
1186     Status = UpdateVariable (VariableName, VendorGuid, Data, DataSize, Attributes, 0, 0, Variable, NULL);
1187     return Status;
1188   }
1189
1190   //
1191   // Get PubKey and check Monotonic Count value corresponding to the variable.
1192   //
1193   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
1194   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
1195   PubKey    = CertBlock->PublicKey;
1196
1197   //
1198   // Update Monotonic Count value.
1199   //
1200   MonotonicCount = CertData->MonotonicCount;
1201
1202   if (!IsFirstTime) {
1203     //
1204     // Check input PubKey.
1205     //
1206     if (CompareMem (PubKey, mPubKeyStore + (KeyIndex - 1) * EFI_CERT_TYPE_RSA2048_SIZE, EFI_CERT_TYPE_RSA2048_SIZE) != 0) {
1207       return EFI_SECURITY_VIOLATION;
1208     }
1209     //
1210     // Compare the current monotonic count and ensure that it is greater than the last SetVariable
1211     // operation with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS attribute set.
1212     //
1213     if (CertData->MonotonicCount <= Variable->CurrPtr->MonotonicCount) {
1214       //
1215       // Monotonic count check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
1216       //
1217       return EFI_SECURITY_VIOLATION;
1218     }
1219   }
1220   //
1221   // Verify the certificate in Data payload.
1222   //
1223   Status = VerifyCounterBasedPayload (Data, DataSize, PubKey);
1224   if (EFI_ERROR (Status)) {
1225     return Status;
1226   }
1227
1228   //
1229   // Now, the signature has been verified!
1230   //
1231   if (IsFirstTime && !IsDeletion) {
1232     //
1233     // Update public key database variable if need.
1234     //
1235     KeyIndex = AddPubKeyInStore (PubKey);
1236     if (KeyIndex == 0) {
1237       return EFI_SECURITY_VIOLATION;
1238     }
1239   }
1240
1241   //
1242   // Verification pass.
1243   //
1244   return UpdateVariable (VariableName, VendorGuid, (UINT8*)Data + AUTHINFO_SIZE, DataSize - AUTHINFO_SIZE, Attributes, KeyIndex, MonotonicCount, Variable, NULL);
1245 }
1246
1247 /**
1248   Merge two buffers which formatted as EFI_SIGNATURE_LIST. Only the new EFI_SIGNATURE_DATA
1249   will be appended to the original EFI_SIGNATURE_LIST, duplicate EFI_SIGNATURE_DATA
1250   will be ignored.
1251
1252   @param[in, out]  Data            Pointer to original EFI_SIGNATURE_LIST.
1253   @param[in]       DataSize        Size of Data buffer.
1254   @param[in]       NewData         Pointer to new EFI_SIGNATURE_LIST to be appended.
1255   @param[in]       NewDataSize     Size of NewData buffer.
1256
1257   @return Size of the merged buffer.
1258
1259 **/
1260 UINTN
1261 AppendSignatureList (
1262   IN  OUT VOID            *Data,
1263   IN  UINTN               DataSize,
1264   IN  VOID                *NewData,
1265   IN  UINTN               NewDataSize
1266   )
1267 {
1268   EFI_SIGNATURE_LIST  *CertList;
1269   EFI_SIGNATURE_DATA  *Cert;
1270   UINTN               CertCount;
1271   EFI_SIGNATURE_LIST  *NewCertList;
1272   EFI_SIGNATURE_DATA  *NewCert;
1273   UINTN               NewCertCount;
1274   UINTN               Index;
1275   UINTN               Index2;
1276   UINTN               Size;
1277   UINT8               *Tail;
1278   UINTN               CopiedCount;
1279   UINTN               SignatureListSize;
1280   BOOLEAN             IsNewCert;
1281
1282   Tail = (UINT8 *) Data + DataSize;
1283
1284   NewCertList = (EFI_SIGNATURE_LIST *) NewData;
1285   while ((NewDataSize > 0) && (NewDataSize >= NewCertList->SignatureListSize)) {
1286     NewCert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCertList + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1287     NewCertCount = (NewCertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - NewCertList->SignatureHeaderSize) / NewCertList->SignatureSize;
1288
1289     CopiedCount = 0;
1290     for (Index = 0; Index < NewCertCount; Index++) {
1291       IsNewCert = TRUE;
1292
1293       Size = DataSize;
1294       CertList = (EFI_SIGNATURE_LIST *) Data;
1295       while ((Size > 0) && (Size >= CertList->SignatureListSize)) {
1296         if (CompareGuid (&CertList->SignatureType, &NewCertList->SignatureType) &&
1297            (CertList->SignatureSize == NewCertList->SignatureSize)) {
1298           Cert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
1299           CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
1300           for (Index2 = 0; Index2 < CertCount; Index2++) {
1301             //
1302             // Iterate each Signature Data in this Signature List.
1303             //
1304             if (CompareMem (NewCert, Cert, CertList->SignatureSize) == 0) {
1305               IsNewCert = FALSE;
1306               break;
1307             }
1308             Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
1309           }
1310         }
1311
1312         if (!IsNewCert) {
1313           break;
1314         }
1315         Size -= CertList->SignatureListSize;
1316         CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
1317       }
1318
1319       if (IsNewCert) {
1320         //
1321         // New EFI_SIGNATURE_DATA, append it.
1322         //
1323         if (CopiedCount == 0) {
1324           //
1325           // Copy EFI_SIGNATURE_LIST header for only once.
1326           //
1327           CopyMem (Tail, NewCertList, sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1328           Tail = Tail + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1329         }
1330
1331         CopyMem (Tail, NewCert, NewCertList->SignatureSize);
1332         Tail += NewCertList->SignatureSize;
1333         CopiedCount++;
1334       }
1335
1336       NewCert = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCert + NewCertList->SignatureSize);
1337     }
1338
1339     //
1340     // Update SignatureListSize in newly appended EFI_SIGNATURE_LIST.
1341     //
1342     if (CopiedCount != 0) {
1343       SignatureListSize = sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize + (CopiedCount * NewCertList->SignatureSize);
1344       CertList = (EFI_SIGNATURE_LIST *) (Tail - SignatureListSize);
1345       CertList->SignatureListSize = (UINT32) SignatureListSize;
1346     }
1347
1348     NewDataSize -= NewCertList->SignatureListSize;
1349     NewCertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) NewCertList + NewCertList->SignatureListSize);
1350   }
1351
1352   return (Tail - (UINT8 *) Data);
1353 }
1354
1355 /**
1356   Compare two EFI_TIME data.
1357
1358
1359   @param FirstTime           A pointer to the first EFI_TIME data.
1360   @param SecondTime          A pointer to the second EFI_TIME data.
1361
1362   @retval  TRUE              The FirstTime is not later than the SecondTime.
1363   @retval  FALSE             The FirstTime is later than the SecondTime.
1364
1365 **/
1366 BOOLEAN
1367 CompareTimeStamp (
1368   IN EFI_TIME               *FirstTime,
1369   IN EFI_TIME               *SecondTime
1370   )
1371 {
1372   if (FirstTime->Year != SecondTime->Year) {
1373     return (BOOLEAN) (FirstTime->Year < SecondTime->Year);
1374   } else if (FirstTime->Month != SecondTime->Month) {
1375     return (BOOLEAN) (FirstTime->Month < SecondTime->Month);
1376   } else if (FirstTime->Day != SecondTime->Day) {
1377     return (BOOLEAN) (FirstTime->Day < SecondTime->Day);
1378   } else if (FirstTime->Hour != SecondTime->Hour) {
1379     return (BOOLEAN) (FirstTime->Hour < SecondTime->Hour);
1380   } else if (FirstTime->Minute != SecondTime->Minute) {
1381     return (BOOLEAN) (FirstTime->Minute < FirstTime->Minute);
1382   }
1383
1384   return (BOOLEAN) (FirstTime->Second <= SecondTime->Second);
1385 }
1386
1387 /**
1388   Find matching signer's certificates for common authenticated variable
1389   by corresponding VariableName and VendorGuid from "certdb".
1390
1391   The data format of "certdb":
1392   //
1393   //     UINT32 CertDbListSize;
1394   // /// AUTH_CERT_DB_DATA Certs1[];
1395   // /// AUTH_CERT_DB_DATA Certs2[];
1396   // /// ...
1397   // /// AUTH_CERT_DB_DATA Certsn[];
1398   //
1399
1400   @param[in]  VariableName   Name of authenticated Variable.
1401   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1402   @param[in]  Data           Pointer to variable "certdb".
1403   @param[in]  DataSize       Size of variable "certdb".
1404   @param[out] CertOffset     Offset of matching CertData, from starting of Data.
1405   @param[out] CertDataSize   Length of CertData in bytes.
1406   @param[out] CertNodeOffset Offset of matching AUTH_CERT_DB_DATA , from
1407                              starting of Data.
1408   @param[out] CertNodeSize   Length of AUTH_CERT_DB_DATA in bytes.
1409
1410   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1411   @retval  EFI_NOT_FOUND         Fail to find matching certs.
1412   @retval  EFI_SUCCESS           Find matching certs and output parameters.
1413
1414 **/
1415 EFI_STATUS
1416 FindCertsFromDb (
1417   IN     CHAR16           *VariableName,
1418   IN     EFI_GUID         *VendorGuid,
1419   IN     UINT8            *Data,
1420   IN     UINTN            DataSize,
1421   OUT    UINT32           *CertOffset,    OPTIONAL
1422   OUT    UINT32           *CertDataSize,  OPTIONAL
1423   OUT    UINT32           *CertNodeOffset,OPTIONAL
1424   OUT    UINT32           *CertNodeSize   OPTIONAL
1425   )
1426 {
1427   UINT32                  Offset;
1428   AUTH_CERT_DB_DATA       *Ptr;
1429   UINT32                  CertSize;
1430   UINT32                  NameSize;
1431   UINT32                  NodeSize;
1432   UINT32                  CertDbListSize;
1433
1434   if ((VariableName == NULL) || (VendorGuid == NULL) || (Data == NULL)) {
1435     return EFI_INVALID_PARAMETER;
1436   }
1437
1438   //
1439   // Check whether DataSize matches recorded CertDbListSize.
1440   //
1441   if (DataSize < sizeof (UINT32)) {
1442     return EFI_INVALID_PARAMETER;
1443   }
1444
1445   CertDbListSize = ReadUnaligned32 ((UINT32 *) Data);
1446
1447   if (CertDbListSize != (UINT32) DataSize) {
1448     return EFI_INVALID_PARAMETER;
1449   }
1450
1451   Offset = sizeof (UINT32);
1452
1453   //
1454   // Get corresponding certificates by VendorGuid and VariableName.
1455   //
1456   while (Offset < (UINT32) DataSize) {
1457     Ptr = (AUTH_CERT_DB_DATA *) (Data + Offset);
1458     //
1459     // Check whether VendorGuid matches.
1460     //
1461     if (CompareGuid (&Ptr->VendorGuid, VendorGuid)) {
1462       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1463       NameSize = ReadUnaligned32 (&Ptr->NameSize);
1464       CertSize = ReadUnaligned32 (&Ptr->CertDataSize);
1465
1466       if (NodeSize != sizeof (EFI_GUID) + sizeof (UINT32) * 3 + CertSize +
1467           sizeof (CHAR16) * NameSize) {
1468         return EFI_INVALID_PARAMETER;
1469       }
1470
1471       Offset = Offset + sizeof (EFI_GUID) + sizeof (UINT32) * 3;
1472       //
1473       // Check whether VariableName matches.
1474       //
1475       if ((NameSize == StrLen (VariableName)) &&
1476           (CompareMem (Data + Offset, VariableName, NameSize * sizeof (CHAR16)) == 0)) {
1477         Offset = Offset + NameSize * sizeof (CHAR16);
1478
1479         if (CertOffset != NULL) {
1480           *CertOffset = Offset;
1481         }
1482
1483         if (CertDataSize != NULL) {
1484           *CertDataSize = CertSize;
1485         }
1486
1487         if (CertNodeOffset != NULL) {
1488           *CertNodeOffset = (UINT32) ((UINT8 *) Ptr - Data);
1489         }
1490
1491         if (CertNodeSize != NULL) {
1492           *CertNodeSize = NodeSize;
1493         }
1494
1495         return EFI_SUCCESS;
1496       } else {
1497         Offset = Offset + NameSize * sizeof (CHAR16) + CertSize;
1498       }
1499     } else {
1500       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1501       Offset   = Offset + NodeSize;
1502     }
1503   }
1504
1505   return EFI_NOT_FOUND;
1506 }
1507
1508 /**
1509   Retrieve signer's certificates for common authenticated variable
1510   by corresponding VariableName and VendorGuid from "certdb".
1511
1512   @param[in]  VariableName   Name of authenticated Variable.
1513   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1514   @param[out] CertData       Pointer to signer's certificates.
1515   @param[out] CertDataSize   Length of CertData in bytes.
1516
1517   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1518   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1519   @retval  EFI_SUCCESS           Get signer's certificates successfully.
1520
1521 **/
1522 EFI_STATUS
1523 GetCertsFromDb (
1524   IN     CHAR16           *VariableName,
1525   IN     EFI_GUID         *VendorGuid,
1526   OUT    UINT8            **CertData,
1527   OUT    UINT32           *CertDataSize
1528   )
1529 {
1530   VARIABLE_POINTER_TRACK  CertDbVariable;
1531   EFI_STATUS              Status;
1532   UINT8                   *Data;
1533   UINTN                   DataSize;
1534   UINT32                  CertOffset;
1535
1536   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL) || (CertDataSize == NULL)) {
1537     return EFI_INVALID_PARAMETER;
1538   }
1539
1540   //
1541   // Get variable "certdb".
1542   //
1543   Status = FindVariable (
1544              EFI_CERT_DB_NAME,
1545              &gEfiCertDbGuid,
1546              &CertDbVariable,
1547              &mVariableModuleGlobal->VariableGlobal,
1548              FALSE
1549              );
1550   if (EFI_ERROR (Status)) {
1551     return Status;
1552   }
1553
1554   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1555   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1556   if ((DataSize == 0) || (Data == NULL)) {
1557     ASSERT (FALSE);
1558     return EFI_NOT_FOUND;
1559   }
1560
1561   Status = FindCertsFromDb (
1562              VariableName,
1563              VendorGuid,
1564              Data,
1565              DataSize,
1566              &CertOffset,
1567              CertDataSize,
1568              NULL,
1569              NULL
1570              );
1571
1572   if (EFI_ERROR (Status)) {
1573     return Status;
1574   }
1575
1576   *CertData = Data + CertOffset;
1577   return EFI_SUCCESS;
1578 }
1579
1580 /**
1581   Delete matching signer's certificates when deleting common authenticated
1582   variable by corresponding VariableName and VendorGuid from "certdb".
1583
1584   @param[in]  VariableName   Name of authenticated Variable.
1585   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1586
1587   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1588   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1589   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
1590   @retval  EFI_SUCCESS           The operation is completed successfully.
1591
1592 **/
1593 EFI_STATUS
1594 DeleteCertsFromDb (
1595   IN     CHAR16           *VariableName,
1596   IN     EFI_GUID         *VendorGuid
1597   )
1598 {
1599   VARIABLE_POINTER_TRACK  CertDbVariable;
1600   EFI_STATUS              Status;
1601   UINT8                   *Data;
1602   UINTN                   DataSize;
1603   UINT32                  VarAttr;
1604   UINT32                  CertNodeOffset;
1605   UINT32                  CertNodeSize;
1606   UINT8                   *NewCertDb;
1607   UINT32                  NewCertDbSize;
1608
1609   if ((VariableName == NULL) || (VendorGuid == NULL)) {
1610     return EFI_INVALID_PARAMETER;
1611   }
1612
1613   //
1614   // Get variable "certdb".
1615   //
1616   Status = FindVariable (
1617              EFI_CERT_DB_NAME,
1618              &gEfiCertDbGuid,
1619              &CertDbVariable,
1620              &mVariableModuleGlobal->VariableGlobal,
1621              FALSE
1622              );
1623   if (EFI_ERROR (Status)) {
1624     return Status;
1625   }
1626
1627   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1628   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1629   if ((DataSize == 0) || (Data == NULL)) {
1630     ASSERT (FALSE);
1631     return EFI_NOT_FOUND;
1632   }
1633
1634   if (DataSize == sizeof (UINT32)) {
1635     //
1636     // There is no certs in certdb.
1637     //
1638     return EFI_SUCCESS;
1639   }
1640
1641   //
1642   // Get corresponding cert node from certdb.
1643   //
1644   Status = FindCertsFromDb (
1645              VariableName,
1646              VendorGuid,
1647              Data,
1648              DataSize,
1649              NULL,
1650              NULL,
1651              &CertNodeOffset,
1652              &CertNodeSize
1653              );
1654
1655   if (EFI_ERROR (Status)) {
1656     return Status;
1657   }
1658
1659   if (DataSize < (CertNodeOffset + CertNodeSize)) {
1660     return EFI_NOT_FOUND;
1661   }
1662
1663   //
1664   // Construct new data content of variable "certdb".
1665   //
1666   NewCertDbSize = (UINT32) DataSize - CertNodeSize;
1667   NewCertDb     = AllocateZeroPool (NewCertDbSize);
1668   if (NewCertDb == NULL) {
1669     return EFI_OUT_OF_RESOURCES;
1670   }
1671
1672   //
1673   // Copy the DB entries before deleting node.
1674   //
1675   CopyMem (NewCertDb, Data, CertNodeOffset);
1676   //
1677   // Update CertDbListSize.
1678   //
1679   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
1680   //
1681   // Copy the DB entries after deleting node.
1682   //
1683   if (DataSize > (CertNodeOffset + CertNodeSize)) {
1684     CopyMem (
1685       NewCertDb + CertNodeOffset,
1686       Data + CertNodeOffset + CertNodeSize,
1687       DataSize - CertNodeOffset - CertNodeSize
1688       );
1689   }
1690
1691   //
1692   // Set "certdb".
1693   //
1694   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
1695   Status   = UpdateVariable (
1696                EFI_CERT_DB_NAME,
1697                &gEfiCertDbGuid,
1698                NewCertDb,
1699                NewCertDbSize,
1700                VarAttr,
1701                0,
1702                0,
1703                &CertDbVariable,
1704                NULL
1705                );
1706
1707   FreePool (NewCertDb);
1708   return Status;
1709 }
1710
1711 /**
1712   Insert signer's certificates for common authenticated variable with VariableName
1713   and VendorGuid in AUTH_CERT_DB_DATA to "certdb".
1714
1715   @param[in]  VariableName   Name of authenticated Variable.
1716   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1717   @param[in]  CertData       Pointer to signer's certificates.
1718   @param[in]  CertDataSize   Length of CertData in bytes.
1719
1720   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1721   @retval  EFI_ACCESS_DENIED     An AUTH_CERT_DB_DATA entry with same VariableName
1722                                  and VendorGuid already exists.
1723   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
1724   @retval  EFI_SUCCESS           Insert an AUTH_CERT_DB_DATA entry to "certdb"
1725
1726 **/
1727 EFI_STATUS
1728 InsertCertsToDb (
1729   IN     CHAR16           *VariableName,
1730   IN     EFI_GUID         *VendorGuid,
1731   IN     UINT8            *CertData,
1732   IN     UINTN            CertDataSize
1733   )
1734 {
1735   VARIABLE_POINTER_TRACK  CertDbVariable;
1736   EFI_STATUS              Status;
1737   UINT8                   *Data;
1738   UINTN                   DataSize;
1739   UINT32                  VarAttr;
1740   UINT8                   *NewCertDb;
1741   UINT32                  NewCertDbSize;
1742   UINT32                  CertNodeSize;
1743   UINT32                  NameSize;
1744   AUTH_CERT_DB_DATA       *Ptr;
1745
1746   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL)) {
1747     return EFI_INVALID_PARAMETER;
1748   }
1749
1750   //
1751   // Get variable "certdb".
1752   //
1753   Status = FindVariable (
1754              EFI_CERT_DB_NAME,
1755              &gEfiCertDbGuid,
1756              &CertDbVariable,
1757              &mVariableModuleGlobal->VariableGlobal,
1758              FALSE
1759              );
1760   if (EFI_ERROR (Status)) {
1761     return Status;
1762   }
1763
1764   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1765   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1766   if ((DataSize == 0) || (Data == NULL)) {
1767     ASSERT (FALSE);
1768     return EFI_NOT_FOUND;
1769   }
1770
1771   //
1772   // Find whether matching cert node already exists in "certdb".
1773   // If yes return error.
1774   //
1775   Status = FindCertsFromDb (
1776              VariableName,
1777              VendorGuid,
1778              Data,
1779              DataSize,
1780              NULL,
1781              NULL,
1782              NULL,
1783              NULL
1784              );
1785
1786   if (!EFI_ERROR (Status)) {
1787     ASSERT (FALSE);
1788     return EFI_ACCESS_DENIED;
1789   }
1790
1791   //
1792   // Construct new data content of variable "certdb".
1793   //
1794   NameSize      = (UINT32) StrLen (VariableName);
1795   CertNodeSize  = sizeof (AUTH_CERT_DB_DATA) + (UINT32) CertDataSize + NameSize * sizeof (CHAR16);
1796   NewCertDbSize = (UINT32) DataSize + CertNodeSize;
1797   NewCertDb     = AllocateZeroPool (NewCertDbSize);
1798   if (NewCertDb == NULL) {
1799     return EFI_OUT_OF_RESOURCES;
1800   }
1801
1802   //
1803   // Copy the DB entries before deleting node.
1804   //
1805   CopyMem (NewCertDb, Data, DataSize);
1806   //
1807   // Update CertDbListSize.
1808   //
1809   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
1810   //
1811   // Construct new cert node.
1812   //
1813   Ptr = (AUTH_CERT_DB_DATA *) (NewCertDb + DataSize);
1814   CopyGuid (&Ptr->VendorGuid, VendorGuid);
1815   CopyMem (&Ptr->CertNodeSize, &CertNodeSize, sizeof (UINT32));
1816   CopyMem (&Ptr->NameSize, &NameSize, sizeof (UINT32));
1817   CopyMem (&Ptr->CertDataSize, &CertDataSize, sizeof (UINT32));
1818
1819   CopyMem (
1820     (UINT8 *) Ptr + sizeof (AUTH_CERT_DB_DATA),
1821     VariableName,
1822     NameSize * sizeof (CHAR16)
1823     );
1824
1825   CopyMem (
1826     (UINT8 *) Ptr +  sizeof (AUTH_CERT_DB_DATA) + NameSize * sizeof (CHAR16),
1827     CertData,
1828     CertDataSize
1829     );
1830
1831   //
1832   // Set "certdb".
1833   //
1834   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
1835   Status   = UpdateVariable (
1836                EFI_CERT_DB_NAME,
1837                &gEfiCertDbGuid,
1838                NewCertDb,
1839                NewCertDbSize,
1840                VarAttr,
1841                0,
1842                0,
1843                &CertDbVariable,
1844                NULL
1845                );
1846
1847   FreePool (NewCertDb);
1848   return Status;
1849 }
1850
1851 /**
1852   Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
1853
1854   Caution: This function may receive untrusted input.
1855   This function may be invoked in SMM mode, and datasize and data are external input.
1856   This function will do basic validation, before parse the data.
1857   This function will parse the authentication carefully to avoid security issues, like
1858   buffer overflow, integer overflow.
1859
1860   @param[in]  VariableName                Name of Variable to be found.
1861   @param[in]  VendorGuid                  Variable vendor GUID.
1862   @param[in]  Data                        Data pointer.
1863   @param[in]  DataSize                    Size of Data found. If size is less than the
1864                                           data, this value contains the required size.
1865   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1866   @param[in]  Attributes                  Attribute value of the variable.
1867   @param[in]  AuthVarType                 Verify against PK, KEK database, private database or certificate in data payload.
1868   @param[out] VarDel                      Delete the variable or not.
1869
1870   @retval EFI_INVALID_PARAMETER           Invalid parameter.
1871   @retval EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
1872                                           check carried out by the firmware.
1873   @retval EFI_OUT_OF_RESOURCES            Failed to process variable due to lack
1874                                           of resources.
1875   @retval EFI_SUCCESS                     Variable pass validation successfully.
1876
1877 **/
1878 EFI_STATUS
1879 VerifyTimeBasedPayload (
1880   IN     CHAR16                             *VariableName,
1881   IN     EFI_GUID                           *VendorGuid,
1882   IN     VOID                               *Data,
1883   IN     UINTN                              DataSize,
1884   IN     VARIABLE_POINTER_TRACK             *Variable,
1885   IN     UINT32                             Attributes,
1886   IN     AUTHVAR_TYPE                       AuthVarType,
1887   OUT    BOOLEAN                            *VarDel
1888   )
1889 {
1890   UINT8                            *RootCert;
1891   UINT8                            *SigData;
1892   UINT8                            *PayloadPtr;
1893   UINTN                            RootCertSize;
1894   UINTN                            Index;
1895   UINTN                            CertCount;
1896   UINTN                            PayloadSize;
1897   UINT32                           Attr;
1898   UINT32                           SigDataSize;
1899   UINT32                           KekDataSize;
1900   BOOLEAN                          VerifyStatus;
1901   EFI_STATUS                       Status;
1902   EFI_SIGNATURE_LIST               *CertList;
1903   EFI_SIGNATURE_DATA               *Cert;
1904   VARIABLE_POINTER_TRACK           KekVariable;
1905   EFI_VARIABLE_AUTHENTICATION_2    *CertData;
1906   UINT8                            *NewData;
1907   UINTN                            NewDataSize;
1908   VARIABLE_POINTER_TRACK           PkVariable;
1909   UINT8                            *Buffer;
1910   UINTN                            Length;
1911   UINT8                            *SignerCerts;
1912   UINT8                            *WrapSigData;
1913   UINTN                            CertStackSize;
1914   UINT8                            *CertsInCertDb;
1915   UINT32                           CertsSizeinDb;
1916
1917   VerifyStatus           = FALSE;
1918   CertData               = NULL;
1919   NewData                = NULL;
1920   Attr                   = Attributes;
1921   WrapSigData            = NULL;
1922   SignerCerts            = NULL;
1923   RootCert               = NULL;
1924
1925   //
1926   // When the attribute EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS is
1927   // set, then the Data buffer shall begin with an instance of a complete (and serialized)
1928   // EFI_VARIABLE_AUTHENTICATION_2 descriptor. The descriptor shall be followed by the new
1929   // variable value and DataSize shall reflect the combined size of the descriptor and the new
1930   // variable value. The authentication descriptor is not part of the variable data and is not
1931   // returned by subsequent calls to GetVariable().
1932   //
1933   CertData = (EFI_VARIABLE_AUTHENTICATION_2 *) Data;
1934
1935   //
1936   // Verify that Pad1, Nanosecond, TimeZone, Daylight and Pad2 components of the
1937   // TimeStamp value are set to zero.
1938   //
1939   if ((CertData->TimeStamp.Pad1 != 0) ||
1940       (CertData->TimeStamp.Nanosecond != 0) ||
1941       (CertData->TimeStamp.TimeZone != 0) ||
1942       (CertData->TimeStamp.Daylight != 0) ||
1943       (CertData->TimeStamp.Pad2 != 0)) {
1944     return EFI_SECURITY_VIOLATION;
1945   }
1946
1947   if ((Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
1948     if (CompareTimeStamp (&CertData->TimeStamp, &Variable->CurrPtr->TimeStamp)) {
1949       //
1950       // TimeStamp check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
1951       //
1952       return EFI_SECURITY_VIOLATION;
1953     }
1954   }
1955
1956   //
1957   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
1958   // Cert type should be EFI_CERT_TYPE_PKCS7_GUID.
1959   //
1960   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
1961       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertPkcs7Guid)) {
1962     //
1963     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
1964     //
1965     return EFI_SECURITY_VIOLATION;
1966   }
1967
1968   //
1969   // Find out Pkcs7 SignedData which follows the EFI_VARIABLE_AUTHENTICATION_2 descriptor.
1970   // AuthInfo.Hdr.dwLength is the length of the entire certificate, including the length of the header.
1971   //
1972   SigData = CertData->AuthInfo.CertData;
1973   SigDataSize = CertData->AuthInfo.Hdr.dwLength - (UINT32) (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData));
1974
1975   //
1976   // Find out the new data payload which follows Pkcs7 SignedData directly.
1977   //
1978   PayloadPtr = SigData + SigDataSize;
1979   PayloadSize = DataSize - OFFSET_OF_AUTHINFO2_CERT_DATA - (UINTN) SigDataSize;
1980
1981   //
1982   // Construct a buffer to fill with (VariableName, VendorGuid, Attributes, TimeStamp, Data).
1983   //
1984   NewDataSize = PayloadSize + sizeof (EFI_TIME) + sizeof (UINT32) +
1985                 sizeof (EFI_GUID) + StrSize (VariableName) - sizeof (CHAR16);
1986   NewData = mSerializationRuntimeBuffer;
1987
1988   Buffer = NewData;
1989   Length = StrLen (VariableName) * sizeof (CHAR16);
1990   CopyMem (Buffer, VariableName, Length);
1991   Buffer += Length;
1992
1993   Length = sizeof (EFI_GUID);
1994   CopyMem (Buffer, VendorGuid, Length);
1995   Buffer += Length;
1996
1997   Length = sizeof (UINT32);
1998   CopyMem (Buffer, &Attr, Length);
1999   Buffer += Length;
2000
2001   Length = sizeof (EFI_TIME);
2002   CopyMem (Buffer, &CertData->TimeStamp, Length);
2003   Buffer += Length;
2004
2005   CopyMem (Buffer, PayloadPtr, PayloadSize);
2006
2007   if (AuthVarType == AuthVarTypePk) {
2008     //
2009     // Get platform key from variable.
2010     //
2011     Status = FindVariable (
2012                EFI_PLATFORM_KEY_NAME,
2013                &gEfiGlobalVariableGuid,
2014                &PkVariable,
2015                &mVariableModuleGlobal->VariableGlobal,
2016                FALSE
2017                );
2018     if (EFI_ERROR (Status)) {
2019       return Status;
2020     }
2021
2022     CertList = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (PkVariable.CurrPtr);
2023     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2024     RootCert      = Cert->SignatureData;
2025     RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2026
2027
2028     //
2029     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2030     //
2031     VerifyStatus = Pkcs7Verify (
2032                      SigData,
2033                      SigDataSize,
2034                      RootCert,
2035                      RootCertSize,
2036                      NewData,
2037                      NewDataSize
2038                      );
2039
2040   } else if (AuthVarType == AuthVarTypeKek) {
2041
2042     //
2043     // Get KEK database from variable.
2044     //
2045     Status = FindVariable (
2046                EFI_KEY_EXCHANGE_KEY_NAME,
2047                &gEfiGlobalVariableGuid,
2048                &KekVariable,
2049                &mVariableModuleGlobal->VariableGlobal,
2050                FALSE
2051                );
2052     if (EFI_ERROR (Status)) {
2053       return Status;
2054     }
2055
2056     //
2057     // Ready to verify Pkcs7 SignedData. Go through KEK Signature Database to find out X.509 CertList.
2058     //
2059     KekDataSize      = KekVariable.CurrPtr->DataSize;
2060     CertList         = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (KekVariable.CurrPtr);
2061     while ((KekDataSize > 0) && (KekDataSize >= CertList->SignatureListSize)) {
2062       if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {
2063         Cert       = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2064         CertCount  = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
2065         for (Index = 0; Index < CertCount; Index++) {
2066           //
2067           // Iterate each Signature Data Node within this CertList for a verify
2068           //
2069           RootCert      = Cert->SignatureData;
2070           RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2071
2072           //
2073           // Verify Pkcs7 SignedData via Pkcs7Verify library.
2074           //
2075           VerifyStatus = Pkcs7Verify (
2076                            SigData,
2077                            SigDataSize,
2078                            RootCert,
2079                            RootCertSize,
2080                            NewData,
2081                            NewDataSize
2082                            );
2083           if (VerifyStatus) {
2084             goto Exit;
2085           }
2086           Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
2087         }
2088       }
2089       KekDataSize -= CertList->SignatureListSize;
2090       CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
2091     }
2092   } else if (AuthVarType == AuthVarTypePriv) {
2093
2094     //
2095     // Process common authenticated variable except PK/KEK/DB/DBX.
2096     // Get signer's certificates from SignedData.
2097     //
2098     VerifyStatus = Pkcs7GetSigners (
2099                      SigData,
2100                      SigDataSize,
2101                      &SignerCerts,
2102                      &CertStackSize,
2103                      &RootCert,
2104                      &RootCertSize
2105                      );
2106     if (!VerifyStatus) {
2107       goto Exit;
2108     }
2109
2110     //
2111     // Get previously stored signer's certificates from certdb for existing
2112     // variable. Check whether they are identical with signer's certificates
2113     // in SignedData. If not, return error immediately.
2114     //
2115     if ((Variable->CurrPtr != NULL)) {
2116       VerifyStatus = FALSE;
2117
2118       Status = GetCertsFromDb (VariableName, VendorGuid, &CertsInCertDb, &CertsSizeinDb);
2119       if (EFI_ERROR (Status)) {
2120         goto Exit;
2121       }
2122
2123       if ((CertStackSize != CertsSizeinDb) ||
2124           (CompareMem (SignerCerts, CertsInCertDb, CertsSizeinDb) != 0)) {
2125         goto Exit;
2126       }
2127     }
2128
2129     VerifyStatus = Pkcs7Verify (
2130                      SigData,
2131                      SigDataSize,
2132                      RootCert,
2133                      RootCertSize,
2134                      NewData,
2135                      NewDataSize
2136                      );
2137     if (!VerifyStatus) {
2138       goto Exit;
2139     }
2140
2141     //
2142     // Delete signer's certificates when delete the common authenticated variable.
2143     //
2144     if ((PayloadSize == 0) && (Variable->CurrPtr != NULL)) {
2145       Status = DeleteCertsFromDb (VariableName, VendorGuid);
2146       if (EFI_ERROR (Status)) {
2147         VerifyStatus = FALSE;
2148         goto Exit;
2149       }
2150     } else if (Variable->CurrPtr == NULL) {
2151       //
2152       // Insert signer's certificates when adding a new common authenticated variable.
2153       //
2154       Status = InsertCertsToDb (VariableName, VendorGuid, SignerCerts, CertStackSize);
2155       if (EFI_ERROR (Status)) {
2156         VerifyStatus = FALSE;
2157         goto Exit;
2158       }
2159     }
2160   } else if (AuthVarType == AuthVarTypePayload) {
2161     CertList = (EFI_SIGNATURE_LIST *) PayloadPtr;
2162     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2163     RootCert      = Cert->SignatureData;
2164     RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2165
2166     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2167     //
2168     VerifyStatus = Pkcs7Verify (
2169                      SigData,
2170                      SigDataSize,
2171                      RootCert,
2172                      RootCertSize,
2173                      NewData,
2174                      NewDataSize
2175                      );
2176   } else {
2177     return EFI_SECURITY_VIOLATION;
2178   }
2179
2180 Exit:
2181
2182   if (AuthVarType == AuthVarTypePriv) {
2183     Pkcs7FreeSigners (RootCert);
2184     Pkcs7FreeSigners (SignerCerts);
2185   }
2186
2187   if (!VerifyStatus) {
2188     return EFI_SECURITY_VIOLATION;
2189   }
2190
2191   Status = CheckSignatureListFormat(VariableName, VendorGuid, PayloadPtr, PayloadSize);
2192   if (EFI_ERROR (Status)) {
2193     return Status;
2194   }
2195
2196   if ((PayloadSize == 0) && (VarDel != NULL)) {
2197     *VarDel = TRUE;
2198   }
2199
2200   //
2201   // Final step: Update/Append Variable if it pass Pkcs7Verify
2202   //
2203   return UpdateVariable (
2204            VariableName,
2205            VendorGuid,
2206            PayloadPtr,
2207            PayloadSize,
2208            Attributes,
2209            0,
2210            0,
2211            Variable,
2212            &CertData->TimeStamp
2213            );
2214 }
2215