SecurityPkg: AuthVariableLib & SecureBootConfigDxe: Fix SecureBootEnable & PK inconsi...
[mirror_edk2.git] / SecurityPkg / Library / AuthVariableLib / AuthService.c
1 /** @file
2 Implement authentication services for the authenticated variables.
3
4 Caution: This module requires additional review when modified.
5 This driver will have external input - variable data. It may be input in SMM mode.
6 This external input must be validated carefully to avoid security issue like
7 buffer overflow, integer overflow.
8 Variable attribute should also be checked to avoid authentication bypass.
9 The whole SMM authentication variable design relies on the integrity of flash part and SMM.
10 which is assumed to be protected by platform. All variable code and metadata in flash/SMM Memory
11 may not be modified without authorization. If platform fails to protect these resources,
12 the authentication service provided in this driver will be broken, and the behavior is undefined.
13
14 ProcessVarWithPk(), ProcessVarWithKek() and ProcessVariable() are the function to do
15 variable authentication.
16
17 VerifyTimeBasedPayloadAndUpdate() and VerifyCounterBasedPayload() are sub function to do verification.
18 They will do basic validation for authentication data structure, then call crypto library
19 to verify the signature.
20
21 Copyright (c) 2009 - 2016, Intel Corporation. All rights reserved.<BR>
22 This program and the accompanying materials
23 are licensed and made available under the terms and conditions of the BSD License
24 which accompanies this distribution. The full text of the license may be found at
25 http://opensource.org/licenses/bsd-license.php
26
27 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
28 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
29
30 **/
31
32 #include "AuthServiceInternal.h"
33
34 //
35 // Public Exponent of RSA Key.
36 //
37 CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };
38
39 //
40 // Requirement for different signature type which have been defined in UEFI spec.
41 // These data are used to perform SignatureList format check while setting PK/KEK variable.
42 //
43 EFI_SIGNATURE_ITEM mSupportSigItem[] = {
44 //{SigType, SigHeaderSize, SigDataSize }
45 {EFI_CERT_SHA256_GUID, 0, 32 },
46 {EFI_CERT_RSA2048_GUID, 0, 256 },
47 {EFI_CERT_RSA2048_SHA256_GUID, 0, 256 },
48 {EFI_CERT_SHA1_GUID, 0, 20 },
49 {EFI_CERT_RSA2048_SHA1_GUID, 0, 256 },
50 {EFI_CERT_X509_GUID, 0, ((UINT32) ~0)},
51 {EFI_CERT_SHA224_GUID, 0, 28 },
52 {EFI_CERT_SHA384_GUID, 0, 48 },
53 {EFI_CERT_SHA512_GUID, 0, 64 },
54 {EFI_CERT_X509_SHA256_GUID, 0, 48 },
55 {EFI_CERT_X509_SHA384_GUID, 0, 64 },
56 {EFI_CERT_X509_SHA512_GUID, 0, 80 }
57 };
58
59 //
60 // Secure Boot Mode state machine
61 //
62 SECURE_BOOT_MODE mSecureBootState[SecureBootModeTypeMax] = {
63 // USER MODE
64 {
65 AUDIT_MODE_DISABLE, // AuditMode
66 FALSE, // IsAuditModeRO, AuditMode is RW
67 DEPLOYED_MODE_DISABLE, // DeployedMode
68 FALSE, // IsDeployedModeRO, DeployedMode is RW
69 SETUP_MODE_DISABLE, // SetupMode
70 // SetupMode is always RO
71 SECURE_BOOT_MODE_ENABLE // SecureBoot
72 },
73 // SETUP MODE
74 {
75 AUDIT_MODE_DISABLE, // AuditMode
76 FALSE, // IsAuditModeRO, AuditMode is RW
77 DEPLOYED_MODE_DISABLE, // DeployedMode
78 TRUE, // IsDeployedModeRO, DeployedMode is RO
79 SETUP_MODE_ENABLE, // SetupMode
80 // SetupMode is always RO
81 SECURE_BOOT_MODE_DISABLE // SecureBoot
82 },
83 // AUDIT MODE
84 {
85 AUDIT_MODE_ENABLE, // AuditMode
86 TRUE, // AuditModeValAttr RO, AuditMode is RO
87 DEPLOYED_MODE_DISABLE, // DeployedMode
88 TRUE, // DeployedModeValAttr RO, DeployedMode is RO
89 SETUP_MODE_ENABLE, // SetupMode
90 // SetupMode is always RO
91 SECURE_BOOT_MODE_DISABLE // SecureBoot
92 },
93 // DEPLOYED MODE
94 {
95 AUDIT_MODE_DISABLE, // AuditMode, AuditMode is RO
96 TRUE, // AuditModeValAttr RO
97 DEPLOYED_MODE_ENABLE, // DeployedMode
98 TRUE, // DeployedModeValAttr RO, DeployedMode is RO
99 SETUP_MODE_DISABLE, // SetupMode
100 // SetupMode is always RO
101 SECURE_BOOT_MODE_ENABLE // SecureBoot
102 }
103 };
104
105 SECURE_BOOT_MODE_TYPE mSecureBootMode;
106
107 /**
108 Finds variable in storage blocks of volatile and non-volatile storage areas.
109
110 This code finds variable in storage blocks of volatile and non-volatile storage areas.
111 If VariableName is an empty string, then we just return the first
112 qualified variable without comparing VariableName and VendorGuid.
113
114 @param[in] VariableName Name of the variable to be found.
115 @param[in] VendorGuid Variable vendor GUID to be found.
116 @param[out] Data Pointer to data address.
117 @param[out] DataSize Pointer to data size.
118
119 @retval EFI_INVALID_PARAMETER If VariableName is not an empty string,
120 while VendorGuid is NULL.
121 @retval EFI_SUCCESS Variable successfully found.
122 @retval EFI_NOT_FOUND Variable not found
123
124 **/
125 EFI_STATUS
126 AuthServiceInternalFindVariable (
127 IN CHAR16 *VariableName,
128 IN EFI_GUID *VendorGuid,
129 OUT VOID **Data,
130 OUT UINTN *DataSize
131 )
132 {
133 EFI_STATUS Status;
134 AUTH_VARIABLE_INFO AuthVariableInfo;
135
136 ZeroMem (&AuthVariableInfo, sizeof (AuthVariableInfo));
137 Status = mAuthVarLibContextIn->FindVariable (
138 VariableName,
139 VendorGuid,
140 &AuthVariableInfo
141 );
142 *Data = AuthVariableInfo.Data;
143 *DataSize = AuthVariableInfo.DataSize;
144 return Status;
145 }
146
147 /**
148 Update the variable region with Variable information.
149
150 @param[in] VariableName Name of variable.
151 @param[in] VendorGuid Guid of variable.
152 @param[in] Data Data pointer.
153 @param[in] DataSize Size of Data.
154 @param[in] Attributes Attribute value of the variable.
155
156 @retval EFI_SUCCESS The update operation is success.
157 @retval EFI_INVALID_PARAMETER Invalid parameter.
158 @retval EFI_WRITE_PROTECTED Variable is write-protected.
159 @retval EFI_OUT_OF_RESOURCES There is not enough resource.
160
161 **/
162 EFI_STATUS
163 AuthServiceInternalUpdateVariable (
164 IN CHAR16 *VariableName,
165 IN EFI_GUID *VendorGuid,
166 IN VOID *Data,
167 IN UINTN DataSize,
168 IN UINT32 Attributes
169 )
170 {
171 AUTH_VARIABLE_INFO AuthVariableInfo;
172
173 ZeroMem (&AuthVariableInfo, sizeof (AuthVariableInfo));
174 AuthVariableInfo.VariableName = VariableName;
175 AuthVariableInfo.VendorGuid = VendorGuid;
176 AuthVariableInfo.Data = Data;
177 AuthVariableInfo.DataSize = DataSize;
178 AuthVariableInfo.Attributes = Attributes;
179
180 return mAuthVarLibContextIn->UpdateVariable (
181 &AuthVariableInfo
182 );
183 }
184
185 /**
186 Update the variable region with Variable information.
187
188 @param[in] VariableName Name of variable.
189 @param[in] VendorGuid Guid of variable.
190 @param[in] Data Data pointer.
191 @param[in] DataSize Size of Data.
192 @param[in] Attributes Attribute value of the variable.
193 @param[in] KeyIndex Index of associated public key.
194 @param[in] MonotonicCount Value of associated monotonic count.
195
196 @retval EFI_SUCCESS The update operation is success.
197 @retval EFI_INVALID_PARAMETER Invalid parameter.
198 @retval EFI_WRITE_PROTECTED Variable is write-protected.
199 @retval EFI_OUT_OF_RESOURCES There is not enough resource.
200
201 **/
202 EFI_STATUS
203 AuthServiceInternalUpdateVariableWithMonotonicCount (
204 IN CHAR16 *VariableName,
205 IN EFI_GUID *VendorGuid,
206 IN VOID *Data,
207 IN UINTN DataSize,
208 IN UINT32 Attributes,
209 IN UINT32 KeyIndex,
210 IN UINT64 MonotonicCount
211 )
212 {
213 AUTH_VARIABLE_INFO AuthVariableInfo;
214
215 ZeroMem (&AuthVariableInfo, sizeof (AuthVariableInfo));
216 AuthVariableInfo.VariableName = VariableName;
217 AuthVariableInfo.VendorGuid = VendorGuid;
218 AuthVariableInfo.Data = Data;
219 AuthVariableInfo.DataSize = DataSize;
220 AuthVariableInfo.Attributes = Attributes;
221 AuthVariableInfo.PubKeyIndex = KeyIndex;
222 AuthVariableInfo.MonotonicCount = MonotonicCount;
223
224 return mAuthVarLibContextIn->UpdateVariable (
225 &AuthVariableInfo
226 );
227 }
228
229 /**
230 Update the variable region with Variable information.
231
232 @param[in] VariableName Name of variable.
233 @param[in] VendorGuid Guid of variable.
234 @param[in] Data Data pointer.
235 @param[in] DataSize Size of Data.
236 @param[in] Attributes Attribute value of the variable.
237 @param[in] TimeStamp Value of associated TimeStamp.
238
239 @retval EFI_SUCCESS The update operation is success.
240 @retval EFI_INVALID_PARAMETER Invalid parameter.
241 @retval EFI_WRITE_PROTECTED Variable is write-protected.
242 @retval EFI_OUT_OF_RESOURCES There is not enough resource.
243
244 **/
245 EFI_STATUS
246 AuthServiceInternalUpdateVariableWithTimeStamp (
247 IN CHAR16 *VariableName,
248 IN EFI_GUID *VendorGuid,
249 IN VOID *Data,
250 IN UINTN DataSize,
251 IN UINT32 Attributes,
252 IN EFI_TIME *TimeStamp
253 )
254 {
255 EFI_STATUS FindStatus;
256 VOID *OrgData;
257 UINTN OrgDataSize;
258 AUTH_VARIABLE_INFO AuthVariableInfo;
259
260 FindStatus = AuthServiceInternalFindVariable (
261 VariableName,
262 VendorGuid,
263 &OrgData,
264 &OrgDataSize
265 );
266
267 //
268 // EFI_VARIABLE_APPEND_WRITE attribute only effects for existing variable
269 //
270 if (!EFI_ERROR (FindStatus) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) != 0)) {
271 if ((CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&
272 ((StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0) || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0) ||
273 (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0))) ||
274 (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0))) {
275 //
276 // For variables with formatted as EFI_SIGNATURE_LIST, the driver shall not perform an append of
277 // EFI_SIGNATURE_DATA values that are already part of the existing variable value.
278 //
279 FilterSignatureList (
280 OrgData,
281 OrgDataSize,
282 Data,
283 &DataSize
284 );
285 }
286 }
287
288 ZeroMem (&AuthVariableInfo, sizeof (AuthVariableInfo));
289 AuthVariableInfo.VariableName = VariableName;
290 AuthVariableInfo.VendorGuid = VendorGuid;
291 AuthVariableInfo.Data = Data;
292 AuthVariableInfo.DataSize = DataSize;
293 AuthVariableInfo.Attributes = Attributes;
294 AuthVariableInfo.TimeStamp = TimeStamp;
295 return mAuthVarLibContextIn->UpdateVariable (
296 &AuthVariableInfo
297 );
298 }
299
300 /**
301 Initialize Secure Boot variables.
302
303 @retval EFI_SUCCESS The initialization operation is successful.
304 @retval EFI_OUT_OF_RESOURCES There is not enough resource.
305
306 **/
307 EFI_STATUS
308 InitSecureBootVariables (
309 VOID
310 )
311 {
312 EFI_STATUS Status;
313 UINT8 *Data;
314 UINTN DataSize;
315 UINT32 SecureBoot;
316 UINT8 SecureBootEnable;
317 SECURE_BOOT_MODE_TYPE SecureBootMode;
318 BOOLEAN IsPkPresent;
319
320 //
321 // Find "PK" variable
322 //
323 Status = AuthServiceInternalFindVariable (EFI_PLATFORM_KEY_NAME, &gEfiGlobalVariableGuid, (VOID **) &Data, &DataSize);
324 if (EFI_ERROR (Status)) {
325 IsPkPresent = FALSE;
326 DEBUG ((EFI_D_INFO, "Variable %s does not exist.\n", EFI_PLATFORM_KEY_NAME));
327 } else {
328 IsPkPresent = TRUE;
329 DEBUG ((EFI_D_INFO, "Variable %s exists.\n", EFI_PLATFORM_KEY_NAME));
330 }
331
332 //
333 // Init "SecureBootMode" variable.
334 // Initial case
335 // SecureBootMode doesn't exist. Init it with PK state
336 // 3 inconsistency cases need to sync
337 // 1.1 Add PK -> system break -> update SecureBootMode Var
338 // 1.2 Delete PK -> system break -> update SecureBootMode Var
339 // 1.3 Set AuditMode ->Delete PK -> system break -> Update SecureBootMode Var
340 //
341 Status = AuthServiceInternalFindVariable (EDKII_SECURE_BOOT_MODE_NAME, &gEdkiiSecureBootModeGuid, (VOID **)&Data, &DataSize);
342 if (EFI_ERROR(Status)) {
343 //
344 // Variable driver Initial Case
345 //
346 if (IsPkPresent) {
347 SecureBootMode = SecureBootModeTypeUserMode;
348 } else {
349 SecureBootMode = SecureBootModeTypeSetupMode;
350 }
351 } else {
352 //
353 // 3 inconsistency cases need to sync
354 //
355 SecureBootMode = (SECURE_BOOT_MODE_TYPE)*Data;
356 ASSERT(SecureBootMode < SecureBootModeTypeMax);
357
358 if (IsPkPresent) {
359 //
360 // 3.1 Add PK -> system break -> update SecureBootMode Var
361 //
362 if (SecureBootMode == SecureBootModeTypeSetupMode) {
363 SecureBootMode = SecureBootModeTypeUserMode;
364 } else if (SecureBootMode == SecureBootModeTypeAuditMode) {
365 SecureBootMode = SecureBootModeTypeDeployedMode;
366 }
367 } else {
368 //
369 // 3.2 Delete PK -> system break -> update SecureBootMode Var
370 // 3.3 Set AuditMode ->Delete PK -> system break -> Update SecureBootMode Var. Reinit to be SetupMode
371 //
372 if ((SecureBootMode == SecureBootModeTypeUserMode) || (SecureBootMode == SecureBootModeTypeDeployedMode)) {
373 SecureBootMode = SecureBootModeTypeSetupMode;
374 }
375 }
376 }
377
378 if (EFI_ERROR(Status) || (SecureBootMode != (SECURE_BOOT_MODE_TYPE)*Data)) {
379 //
380 // Update SecureBootMode Var
381 //
382 Status = AuthServiceInternalUpdateVariable (
383 EDKII_SECURE_BOOT_MODE_NAME,
384 &gEdkiiSecureBootModeGuid,
385 &SecureBootMode,
386 sizeof (UINT8),
387 EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS
388 );
389 if (EFI_ERROR(Status)) {
390 return Status;
391 }
392 }
393
394 //
395 // Init "AuditMode"
396 //
397 Status = AuthServiceInternalUpdateVariable (
398 EFI_AUDIT_MODE_NAME,
399 &gEfiGlobalVariableGuid,
400 &mSecureBootState[SecureBootMode].AuditMode,
401 sizeof(UINT8),
402 EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS
403 );
404 if (EFI_ERROR(Status)) {
405 return Status;
406 }
407
408 //
409 // Init "DeployedMode"
410 //
411 Status = AuthServiceInternalUpdateVariable (
412 EFI_DEPLOYED_MODE_NAME,
413 &gEfiGlobalVariableGuid,
414 &mSecureBootState[SecureBootMode].DeployedMode,
415 sizeof(UINT8),
416 EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS
417 );
418 if (EFI_ERROR(Status)) {
419 return Status;
420 }
421
422 //
423 // Init "SetupMode"
424 //
425 Status = AuthServiceInternalUpdateVariable (
426 EFI_SETUP_MODE_NAME,
427 &gEfiGlobalVariableGuid,
428 &mSecureBootState[SecureBootMode].SetupMode,
429 sizeof(UINT8),
430 EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS
431 );
432 if (EFI_ERROR(Status)) {
433 return Status;
434 }
435
436 //
437 // If "SecureBootEnable" variable exists, then update "SecureBoot" variable.
438 // If "SecureBootEnable" variable is SECURE_BOOT_ENABLE and in User Mode or Deployed Mode, Set "SecureBoot" variable to SECURE_BOOT_MODE_ENABLE.
439 // If "SecureBootEnable" variable is SECURE_BOOT_DISABLE, Set "SecureBoot" variable to SECURE_BOOT_MODE_DISABLE.
440 //
441 SecureBootEnable = SECURE_BOOT_DISABLE;
442 Status = AuthServiceInternalFindVariable (EFI_SECURE_BOOT_ENABLE_NAME, &gEfiSecureBootEnableDisableGuid, (VOID **)&Data, &DataSize);
443 if (!EFI_ERROR(Status)) {
444 if (IsPkPresent) {
445 SecureBootEnable = *Data;
446 }
447 } else if ((SecureBootMode == SecureBootModeTypeUserMode) || (SecureBootMode == SecureBootModeTypeDeployedMode)) {
448 //
449 // "SecureBootEnable" not exist, initialize it in User Mode or Deployed Mode.
450 //
451 SecureBootEnable = SECURE_BOOT_ENABLE;
452 Status = AuthServiceInternalUpdateVariable (
453 EFI_SECURE_BOOT_ENABLE_NAME,
454 &gEfiSecureBootEnableDisableGuid,
455 &SecureBootEnable,
456 sizeof (UINT8),
457 EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS
458 );
459 if (EFI_ERROR (Status)) {
460 return Status;
461 }
462 }
463
464 //
465 // Create "SecureBoot" variable with BS+RT attribute set.
466 //
467 if ((SecureBootEnable == SECURE_BOOT_ENABLE)
468 && ((SecureBootMode == SecureBootModeTypeUserMode) || (SecureBootMode == SecureBootModeTypeDeployedMode))) {
469 SecureBoot = SECURE_BOOT_MODE_ENABLE;
470 } else {
471 SecureBoot = SECURE_BOOT_MODE_DISABLE;
472 }
473 Status = AuthServiceInternalUpdateVariable (
474 EFI_SECURE_BOOT_MODE_NAME,
475 &gEfiGlobalVariableGuid,
476 &SecureBoot,
477 sizeof (UINT8),
478 EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS
479 );
480
481 DEBUG ((EFI_D_INFO, "SecureBootMode is %x\n", SecureBootMode));
482 DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_MODE_NAME, SecureBoot));
483 DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_ENABLE_NAME, SecureBootEnable));
484
485 //
486 // Save SecureBootMode in global space
487 //
488 mSecureBootMode = SecureBootMode;
489
490 return Status;
491 }
492
493 /**
494 Update SecureBootMode variable.
495
496 @param[in] NewMode New Secure Boot Mode.
497
498 @retval EFI_SUCCESS The initialization operation is successful.
499 @retval EFI_OUT_OF_RESOURCES There is not enough resource.
500
501 **/
502 EFI_STATUS
503 UpdateSecureBootMode(
504 IN SECURE_BOOT_MODE_TYPE NewMode
505 )
506 {
507 EFI_STATUS Status;
508
509 //
510 // Update "SecureBootMode" variable to new Secure Boot Mode
511 //
512 Status = AuthServiceInternalUpdateVariable (
513 EDKII_SECURE_BOOT_MODE_NAME,
514 &gEdkiiSecureBootModeGuid,
515 &NewMode,
516 sizeof (UINT8),
517 EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS
518 );
519
520 if (!EFI_ERROR(Status)) {
521 DEBUG((EFI_D_INFO, "SecureBootMode Update to %x\n", NewMode));
522 mSecureBootMode = NewMode;
523 } else {
524 DEBUG((EFI_D_ERROR, "SecureBootMode Update failure %x\n", Status));
525 }
526
527 return Status;
528 }
529
530 /**
531 Current secure boot mode is AuditMode. This function performs secure boot mode transition
532 to a new mode.
533
534 @param[in] NewMode New Secure Boot Mode.
535
536 @retval EFI_SUCCESS The initialization operation is successful.
537 @retval EFI_OUT_OF_RESOURCES There is not enough resource.
538
539 **/
540 EFI_STATUS
541 TransitionFromAuditMode(
542 IN SECURE_BOOT_MODE_TYPE NewMode
543 )
544 {
545 EFI_STATUS Status;
546 VOID *AuditVarData;
547 VOID *DeployedVarData;
548 VOID *SetupVarData;
549 VOID *SecureBootVarData;
550 UINT8 SecureBootEnable;
551 UINTN DataSize;
552
553 //
554 // AuditMode/DeployedMode/SetupMode/SecureBoot are all NON_NV variable maintained by Variable driver
555 // they can be RW. but can't be deleted. so they can always be found.
556 //
557 Status = AuthServiceInternalFindVariable (
558 EFI_AUDIT_MODE_NAME,
559 &gEfiGlobalVariableGuid,
560 &AuditVarData,
561 &DataSize
562 );
563 if (EFI_ERROR (Status)) {
564 ASSERT(FALSE);
565 }
566
567 Status = AuthServiceInternalFindVariable (
568 EFI_DEPLOYED_MODE_NAME,
569 &gEfiGlobalVariableGuid,
570 &DeployedVarData,
571 &DataSize
572 );
573 if (EFI_ERROR (Status)) {
574 ASSERT(FALSE);
575 }
576
577 Status = AuthServiceInternalFindVariable (
578 EFI_SETUP_MODE_NAME,
579 &gEfiGlobalVariableGuid,
580 &SetupVarData,
581 &DataSize
582 );
583 if (EFI_ERROR (Status)) {
584 ASSERT(FALSE);
585 }
586
587 Status = AuthServiceInternalFindVariable (
588 EFI_SECURE_BOOT_MODE_NAME,
589 &gEfiGlobalVariableGuid,
590 &SecureBootVarData,
591 &DataSize
592 );
593 if (EFI_ERROR (Status)) {
594 ASSERT(FALSE);
595 }
596
597 //
598 // Make Secure Boot Mode transition ATOMIC
599 // Update Private NV SecureBootMode Variable first, because it may fail due to NV range overflow.
600 // other tranisition logic are all memory operations.
601 //
602 Status = UpdateSecureBootMode(NewMode);
603 if (EFI_ERROR(Status)) {
604 DEBUG((EFI_D_ERROR, "Update SecureBootMode Variable fail %x\n", Status));
605 }
606
607 if (NewMode == SecureBootModeTypeDeployedMode) {
608 //
609 // Since PK is enrolled, can't rollback, always update SecureBootMode in memory
610 //
611 mSecureBootMode = NewMode;
612 Status = EFI_SUCCESS;
613
614 //
615 // AuditMode ----> DeployedMode
616 // Side Effects
617 // AuditMode =: 0 / DeployedMode := 1 / SetupMode := 0
618 //
619 // Update the value of AuditMode variable by a simple mem copy, this could avoid possible
620 // variable storage reclaim at runtime.
621 //
622 CopyMem (AuditVarData, &mSecureBootState[NewMode].AuditMode, sizeof(UINT8));
623 //
624 // Update the value of DeployedMode variable by a simple mem copy, this could avoid possible
625 // variable storage reclaim at runtime.
626 //
627 CopyMem (DeployedVarData, &mSecureBootState[NewMode].DeployedMode, sizeof(UINT8));
628 //
629 // Update the value of SetupMode variable by a simple mem copy, this could avoid possible
630 // variable storage reclaim at runtime.
631 //
632 CopyMem (SetupVarData, &mSecureBootState[NewMode].SetupMode, sizeof(UINT8));
633
634 if (mAuthVarLibContextIn->AtRuntime ()) {
635 //
636 // SecureBoot Variable indicates whether the platform firmware is operating
637 // in Secure boot mode (1) or not (0), so we should not change SecureBoot
638 // Variable in runtime.
639 //
640 return Status;
641 }
642
643 //
644 // Update the value of SecureBoot variable by a simple mem copy, this could avoid possible
645 // variable storage reclaim at runtime.
646 //
647 CopyMem (SecureBootVarData, &mSecureBootState[NewMode].SecureBoot, sizeof(UINT8));
648
649 //
650 // Create "SecureBootEnable" variable as secure boot is enabled.
651 //
652 SecureBootEnable = SECURE_BOOT_ENABLE;
653 AuthServiceInternalUpdateVariable (
654 EFI_SECURE_BOOT_ENABLE_NAME,
655 &gEfiSecureBootEnableDisableGuid,
656 &SecureBootEnable,
657 sizeof (SecureBootEnable),
658 EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS
659 );
660 } else {
661 DEBUG((EFI_D_ERROR, "Invalid state tranition from %x to %x\n", SecureBootModeTypeAuditMode, NewMode));
662 ASSERT(FALSE);
663 }
664
665 return Status;
666 }
667
668 /**
669 Current secure boot mode is DeployedMode. This function performs secure boot mode transition
670 to a new mode.
671
672 @param[in] NewMode New Secure Boot Mode.
673
674 @retval EFI_SUCCESS The initialization operation is successful.
675 @retval EFI_OUT_OF_RESOURCES There is not enough resource.
676
677 **/
678 EFI_STATUS
679 TransitionFromDeployedMode(
680 IN SECURE_BOOT_MODE_TYPE NewMode
681 )
682 {
683 EFI_STATUS Status;
684 VOID *DeployedVarData;
685 VOID *SetupVarData;
686 VOID *SecureBootVarData;
687 UINT8 SecureBootEnable;
688 UINTN DataSize;
689
690 //
691 // AuditMode/DeployedMode/SetupMode/SecureBoot are all NON_NV variable maintained by Variable driver
692 // they can be RW. but can't be deleted. so they can always be found.
693 //
694 Status = AuthServiceInternalFindVariable (
695 EFI_DEPLOYED_MODE_NAME,
696 &gEfiGlobalVariableGuid,
697 &DeployedVarData,
698 &DataSize
699 );
700 if (EFI_ERROR (Status)) {
701 ASSERT(FALSE);
702 }
703
704 Status = AuthServiceInternalFindVariable (
705 EFI_SETUP_MODE_NAME,
706 &gEfiGlobalVariableGuid,
707 &SetupVarData,
708 &DataSize
709 );
710 if (EFI_ERROR (Status)) {
711 ASSERT(FALSE);
712 }
713
714 Status = AuthServiceInternalFindVariable (
715 EFI_SECURE_BOOT_MODE_NAME,
716 &gEfiGlobalVariableGuid,
717 &SecureBootVarData,
718 &DataSize
719 );
720 if (EFI_ERROR (Status)) {
721 ASSERT(FALSE);
722 }
723
724 //
725 // Make Secure Boot Mode transition ATOMIC
726 // Update Private NV SecureBootMode Variable first, because it may fail due to NV range overflow.
727 // other tranisition logic are all memory operations.
728 //
729 Status = UpdateSecureBootMode(NewMode);
730 if (EFI_ERROR(Status)) {
731 DEBUG((EFI_D_ERROR, "Update SecureBootMode Variable fail %x\n", Status));
732 }
733
734 switch(NewMode) {
735 case SecureBootModeTypeUserMode:
736 //
737 // DeployedMode ----> UserMode
738 // Side Effects
739 // DeployedMode := 0
740 //
741 // Platform Specific DeployedMode clear. UpdateSecureBootMode fails and no other variables are updated before. rollback this transition
742 //
743 if (EFI_ERROR(Status)) {
744 return Status;
745 }
746 CopyMem (DeployedVarData, &mSecureBootState[NewMode].DeployedMode, sizeof(UINT8));
747
748 break;
749
750 case SecureBootModeTypeSetupMode:
751 //
752 // Since PK is processed before, can't rollback, still update SecureBootMode in memory
753 //
754 mSecureBootMode = NewMode;
755 Status = EFI_SUCCESS;
756
757 //
758 // DeployedMode ----> SetupMode
759 //
760 // Platform Specific PKpub clear or Delete Pkpub
761 // Side Effects
762 // DeployedMode := 0 / SetupMode := 1 / SecureBoot := 0
763 //
764 // Update the value of DeployedMode variable by a simple mem copy, this could avoid possible
765 // variable storage reclaim at runtime.
766 //
767 CopyMem (DeployedVarData, &mSecureBootState[NewMode].DeployedMode, sizeof(UINT8));
768 //
769 // Update the value of SetupMode variable by a simple mem copy, this could avoid possible
770 // variable storage reclaim at runtime.
771 //
772 CopyMem (SetupVarData, &mSecureBootState[NewMode].SetupMode, sizeof(UINT8));
773
774 if (mAuthVarLibContextIn->AtRuntime ()) {
775 //
776 // SecureBoot Variable indicates whether the platform firmware is operating
777 // in Secure boot mode (1) or not (0), so we should not change SecureBoot
778 // Variable in runtime.
779 //
780 return Status;
781 }
782
783 //
784 // Update the value of SecureBoot variable by a simple mem copy, this could avoid possible
785 // variable storage reclaim at runtime.
786 //
787 CopyMem (SecureBootVarData, &mSecureBootState[NewMode].SecureBoot, sizeof(UINT8));
788
789 //
790 // Delete the "SecureBootEnable" variable as secure boot is Disabled.
791 //
792 SecureBootEnable = SECURE_BOOT_DISABLE;
793 AuthServiceInternalUpdateVariable (
794 EFI_SECURE_BOOT_ENABLE_NAME,
795 &gEfiSecureBootEnableDisableGuid,
796 &SecureBootEnable,
797 0,
798 EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS
799 );
800 break;
801
802 default:
803 DEBUG((EFI_D_ERROR, "Invalid state tranition from %x to %x\n", SecureBootModeTypeDeployedMode, NewMode));
804 ASSERT(FALSE);
805 }
806
807 return Status;
808 }
809
810 /**
811 Current secure boot mode is UserMode. This function performs secure boot mode transition
812 to a new mode.
813
814 @param[in] NewMode New Secure Boot Mode.
815
816 @retval EFI_SUCCESS The initialization operation is successful.
817 @retval EFI_OUT_OF_RESOURCES There is not enough resource.
818
819 **/
820 EFI_STATUS
821 TransitionFromUserMode(
822 IN SECURE_BOOT_MODE_TYPE NewMode
823 )
824 {
825 EFI_STATUS Status;
826 VOID *AuditVarData;
827 VOID *DeployedVarData;
828 VOID *SetupVarData;
829 VOID *PkVarData;
830 VOID *SecureBootVarData;
831 UINT8 SecureBootEnable;
832 UINTN DataSize;
833 VARIABLE_ENTRY_CONSISTENCY VariableEntry;
834
835 //
836 // AuditMode/DeployedMode/SetupMode/SecureBoot are all NON_NV variable maintained by Variable driver
837 // they can be RW. but can't be deleted. so they can always be found.
838 //
839 Status = AuthServiceInternalFindVariable (
840 EFI_AUDIT_MODE_NAME,
841 &gEfiGlobalVariableGuid,
842 &AuditVarData,
843 &DataSize
844 );
845 if (EFI_ERROR (Status)) {
846 ASSERT(FALSE);
847 }
848
849 Status = AuthServiceInternalFindVariable (
850 EFI_DEPLOYED_MODE_NAME,
851 &gEfiGlobalVariableGuid,
852 &DeployedVarData,
853 &DataSize
854 );
855 if (EFI_ERROR (Status)) {
856 ASSERT(FALSE);
857 }
858
859 Status = AuthServiceInternalFindVariable (
860 EFI_SETUP_MODE_NAME,
861 &gEfiGlobalVariableGuid,
862 &SetupVarData,
863 &DataSize
864 );
865 if (EFI_ERROR (Status)) {
866 ASSERT(FALSE);
867 }
868
869 Status = AuthServiceInternalFindVariable (
870 EFI_SECURE_BOOT_MODE_NAME,
871 &gEfiGlobalVariableGuid,
872 &SecureBootVarData,
873 &DataSize
874 );
875 if (EFI_ERROR (Status)) {
876 ASSERT(FALSE);
877 }
878
879 //
880 // Make Secure Boot Mode transition ATOMIC
881 // Update Private NV SecureBootMode Variable first, because it may fail due to NV range overflow.
882 // Other tranisition logic are all memory operations and PK delete is assumed to be always successful.
883 //
884 if (NewMode != SecureBootModeTypeAuditMode) {
885 Status = UpdateSecureBootMode(NewMode);
886 if (EFI_ERROR(Status)) {
887 DEBUG((EFI_D_ERROR, "Update SecureBootMode Variable fail %x\n", Status));
888 }
889 } else {
890 //
891 // UserMode -----> AuditMode. Check RemainingSpace for SecureBootMode var first.
892 // Will update SecureBootMode after DeletePK logic
893 //
894 VariableEntry.VariableSize = sizeof(UINT8);
895 VariableEntry.Guid = &gEdkiiSecureBootModeGuid;
896 VariableEntry.Name = EDKII_SECURE_BOOT_MODE_NAME;
897 if (!mAuthVarLibContextIn->CheckRemainingSpaceForConsistency (VARIABLE_ATTRIBUTE_NV_BS_RT, &VariableEntry, NULL)) {
898 return EFI_OUT_OF_RESOURCES;
899 }
900 }
901
902 switch(NewMode) {
903 case SecureBootModeTypeDeployedMode:
904 //
905 // UpdateSecureBootMode fails and no other variables are updated before. rollback this transition
906 //
907 if (EFI_ERROR(Status)) {
908 return Status;
909 }
910
911 //
912 // UserMode ----> DeployedMode
913 // Side Effects
914 // DeployedMode := 1
915 //
916 CopyMem (DeployedVarData, &mSecureBootState[NewMode].DeployedMode, sizeof(UINT8));
917 break;
918
919 case SecureBootModeTypeAuditMode:
920 //
921 // UserMode ----> AuditMode
922 // Side Effects
923 // Delete PKpub / SetupMode := 1 / SecureBoot := 0
924 //
925 // Delete PKpub without verification. Should always succeed.
926 //
927 PkVarData = NULL;
928 Status = AuthServiceInternalUpdateVariable (
929 EFI_PLATFORM_KEY_NAME,
930 &gEfiGlobalVariableGuid,
931 PkVarData,
932 0,
933 EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS
934 );
935 if (EFI_ERROR(Status)) {
936 DEBUG((EFI_D_ERROR, "UserMode -> AuditMode. Delete PK fail %x\n", Status));
937 ASSERT(FALSE);
938 }
939
940 //
941 // Update Private NV SecureBootMode Variable
942 //
943 Status = UpdateSecureBootMode(NewMode);
944 if (EFI_ERROR(Status)) {
945 //
946 // Since PK is deleted successfully, Doesn't break, continue to update other variable.
947 //
948 DEBUG((EFI_D_ERROR, "Update SecureBootMode Variable fail %x\n", Status));
949 }
950 CopyMem (AuditVarData, &mSecureBootState[NewMode].AuditMode, sizeof(UINT8));
951
952 //
953 // Fall into SetupMode logic
954 //
955 case SecureBootModeTypeSetupMode:
956 //
957 // Since PK is deleted before , can't rollback, still update SecureBootMode in memory
958 //
959 mSecureBootMode = NewMode;
960 Status = EFI_SUCCESS;
961
962 //
963 // UserMode ----> SetupMode
964 // Side Effects
965 // DeployedMode :=0 / SetupMode :=1 / SecureBoot :=0
966 //
967 // Update the value of SetupMode variable by a simple mem copy, this could avoid possible
968 // variable storage reclaim at runtime.
969 //
970 CopyMem (SetupVarData, &mSecureBootState[NewMode].SetupMode, sizeof(UINT8));
971
972 if (mAuthVarLibContextIn->AtRuntime ()) {
973 //
974 // SecureBoot Variable indicates whether the platform firmware is operating
975 // in Secure boot mode (1) or not (0), so we should not change SecureBoot
976 // Variable in runtime.
977 //
978 return Status;
979 }
980
981 //
982 // Update the value of SecureBoot variable by a simple mem copy, this could avoid possible
983 // variable storage reclaim at runtime.
984 //
985 CopyMem (SecureBootVarData, &mSecureBootState[NewMode].SecureBoot, sizeof(UINT8));
986
987 //
988 // Delete the "SecureBootEnable" variable as secure boot is Disabled.
989 //
990 SecureBootEnable = SECURE_BOOT_DISABLE;
991 AuthServiceInternalUpdateVariable (
992 EFI_SECURE_BOOT_ENABLE_NAME,
993 &gEfiSecureBootEnableDisableGuid,
994 &SecureBootEnable,
995 0,
996 EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS
997 );
998
999 break;
1000
1001 default:
1002 DEBUG((EFI_D_ERROR, "Invalid state tranition from %x to %x\n", SecureBootModeTypeUserMode, NewMode));
1003 ASSERT(FALSE);
1004 }
1005
1006 return Status;
1007 }
1008
1009 /**
1010 Current secure boot mode is SetupMode. This function performs secure boot mode transition
1011 to a new mode.
1012
1013 @param[in] NewMode New Secure Boot Mode.
1014
1015 @retval EFI_SUCCESS The initialization operation is successful.
1016 @retval EFI_OUT_OF_RESOURCES There is not enough resource.
1017
1018 **/
1019 EFI_STATUS
1020 TransitionFromSetupMode(
1021 IN SECURE_BOOT_MODE_TYPE NewMode
1022 )
1023 {
1024 EFI_STATUS Status;
1025 VOID *AuditVarData;
1026 VOID *SetupVarData;
1027 VOID *SecureBootVarData;
1028 UINT8 SecureBootEnable;
1029 UINTN DataSize;
1030
1031 //
1032 // AuditMode/DeployedMode/SetupMode/SecureBoot are all NON_NV variable maintained by Variable driver
1033 // they can be RW. but can't be deleted. so they can always be found.
1034 //
1035 Status = AuthServiceInternalFindVariable (
1036 EFI_AUDIT_MODE_NAME,
1037 &gEfiGlobalVariableGuid,
1038 &AuditVarData,
1039 &DataSize
1040 );
1041 if (EFI_ERROR (Status)) {
1042 ASSERT(FALSE);
1043 }
1044
1045 Status = AuthServiceInternalFindVariable (
1046 EFI_SETUP_MODE_NAME,
1047 &gEfiGlobalVariableGuid,
1048 &SetupVarData,
1049 &DataSize
1050 );
1051 if (EFI_ERROR (Status)) {
1052 ASSERT(FALSE);
1053 }
1054
1055 Status = AuthServiceInternalFindVariable (
1056 EFI_SECURE_BOOT_MODE_NAME,
1057 &gEfiGlobalVariableGuid,
1058 &SecureBootVarData,
1059 &DataSize
1060 );
1061 if (EFI_ERROR (Status)) {
1062 ASSERT(FALSE);
1063 }
1064
1065 //
1066 // Make Secure Boot Mode transition ATOMIC
1067 // Update Private NV SecureBootMode Variable first, because it may fail due to NV range overflow.
1068 // Other tranisition logic are all memory operations and PK delete is assumed to be always successful.
1069 //
1070 Status = UpdateSecureBootMode(NewMode);
1071 if (EFI_ERROR(Status)) {
1072 DEBUG((EFI_D_ERROR, "Update SecureBootMode Variable fail %x\n", Status));
1073 }
1074
1075 switch(NewMode) {
1076 case SecureBootModeTypeAuditMode:
1077 //
1078 // UpdateSecureBootMode fails and no other variables are updated before. rollback this transition
1079 //
1080 if (EFI_ERROR(Status)) {
1081 return Status;
1082 }
1083
1084 //
1085 // SetupMode ----> AuditMode
1086 // Side Effects
1087 // AuditMode := 1
1088 //
1089 // Update the value of AuditMode variable by a simple mem copy, this could avoid possible
1090 // variable storage reclaim at runtime.
1091 //
1092 CopyMem (AuditVarData, &mSecureBootState[NewMode].AuditMode, sizeof(UINT8));
1093 break;
1094
1095 case SecureBootModeTypeUserMode:
1096 //
1097 // Since PK is enrolled before, can't rollback, still update SecureBootMode in memory
1098 //
1099 mSecureBootMode = NewMode;
1100 Status = EFI_SUCCESS;
1101
1102 //
1103 // SetupMode ----> UserMode
1104 // Side Effects
1105 // SetupMode := 0 / SecureBoot := 1
1106 //
1107 // Update the value of AuditMode variable by a simple mem copy, this could avoid possible
1108 // variable storage reclaim at runtime.
1109 //
1110 CopyMem (SetupVarData, &mSecureBootState[NewMode].SetupMode, sizeof(UINT8));
1111
1112 if (mAuthVarLibContextIn->AtRuntime ()) {
1113 //
1114 // SecureBoot Variable indicates whether the platform firmware is operating
1115 // in Secure boot mode (1) or not (0), so we should not change SecureBoot
1116 // Variable in runtime.
1117 //
1118 return Status;
1119 }
1120
1121 //
1122 // Update the value of SecureBoot variable by a simple mem copy, this could avoid possible
1123 // variable storage reclaim at runtime.
1124 //
1125 CopyMem (SecureBootVarData, &mSecureBootState[NewMode].SecureBoot, sizeof(UINT8));
1126
1127 //
1128 // Create the "SecureBootEnable" variable as secure boot is enabled.
1129 //
1130 SecureBootEnable = SECURE_BOOT_ENABLE;
1131 AuthServiceInternalUpdateVariable (
1132 EFI_SECURE_BOOT_ENABLE_NAME,
1133 &gEfiSecureBootEnableDisableGuid,
1134 &SecureBootEnable,
1135 sizeof (SecureBootEnable),
1136 EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS
1137 );
1138 break;
1139
1140 default:
1141 DEBUG((EFI_D_ERROR, "Invalid state tranition from %x to %x\n", SecureBootModeTypeSetupMode, NewMode));
1142 ASSERT(FALSE);
1143 }
1144
1145 return Status;
1146 }
1147
1148 /**
1149 This function performs main secure boot mode transition logic.
1150
1151 @param[in] CurMode Current Secure Boot Mode.
1152 @param[in] NewMode New Secure Boot Mode.
1153
1154 @retval EFI_SUCCESS The initialization operation is successful.
1155 @retval EFI_OUT_OF_RESOURCES There is not enough resource.
1156 @retval EFI_INVALID_PARAMETER The Current Secure Boot Mode is wrong.
1157
1158 **/
1159 EFI_STATUS
1160 SecureBootModeTransition(
1161 IN SECURE_BOOT_MODE_TYPE CurMode,
1162 IN SECURE_BOOT_MODE_TYPE NewMode
1163 )
1164 {
1165 EFI_STATUS Status;
1166
1167 //
1168 // SecureBootMode transition
1169 //
1170 switch (CurMode) {
1171 case SecureBootModeTypeUserMode:
1172 Status = TransitionFromUserMode(NewMode);
1173 break;
1174
1175 case SecureBootModeTypeSetupMode:
1176 Status = TransitionFromSetupMode(NewMode);
1177 break;
1178
1179 case SecureBootModeTypeAuditMode:
1180 Status = TransitionFromAuditMode(NewMode);
1181 break;
1182
1183 case SecureBootModeTypeDeployedMode:
1184 Status = TransitionFromDeployedMode(NewMode);
1185 break;
1186
1187 default:
1188 Status = EFI_INVALID_PARAMETER;
1189 ASSERT(FALSE);
1190 }
1191
1192 return Status;
1193
1194 }
1195
1196 /**
1197 Determine whether this operation needs a physical present user.
1198
1199 @param[in] VariableName Name of the Variable.
1200 @param[in] VendorGuid GUID of the Variable.
1201
1202 @retval TRUE This variable is protected, only a physical present user could set this variable.
1203 @retval FALSE This variable is not protected.
1204
1205 **/
1206 BOOLEAN
1207 NeedPhysicallyPresent(
1208 IN CHAR16 *VariableName,
1209 IN EFI_GUID *VendorGuid
1210 )
1211 {
1212 if ((CompareGuid (VendorGuid, &gEfiSecureBootEnableDisableGuid) && (StrCmp (VariableName, EFI_SECURE_BOOT_ENABLE_NAME) == 0))
1213 || (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (VariableName, EFI_CUSTOM_MODE_NAME) == 0))) {
1214 return TRUE;
1215 }
1216
1217 return FALSE;
1218 }
1219
1220 /**
1221 Determine whether the platform is operating in Custom Secure Boot mode.
1222
1223 @retval TRUE The platform is operating in Custom mode.
1224 @retval FALSE The platform is operating in Standard mode.
1225
1226 **/
1227 BOOLEAN
1228 InCustomMode (
1229 VOID
1230 )
1231 {
1232 EFI_STATUS Status;
1233 VOID *Data;
1234 UINTN DataSize;
1235
1236 Status = AuthServiceInternalFindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Data, &DataSize);
1237 if (!EFI_ERROR (Status) && (*(UINT8 *) Data == CUSTOM_SECURE_BOOT_MODE)) {
1238 return TRUE;
1239 }
1240
1241 return FALSE;
1242 }
1243
1244 /**
1245 Get available public key index.
1246
1247 @param[in] PubKey Pointer to Public Key data.
1248
1249 @return Public key index, 0 if no any public key index available.
1250
1251 **/
1252 UINT32
1253 GetAvailableKeyIndex (
1254 IN UINT8 *PubKey
1255 )
1256 {
1257 EFI_STATUS Status;
1258 UINT8 *Data;
1259 UINTN DataSize;
1260 UINT8 *Ptr;
1261 UINT32 Index;
1262 BOOLEAN IsFound;
1263 EFI_GUID VendorGuid;
1264 CHAR16 Name[1];
1265 AUTH_VARIABLE_INFO AuthVariableInfo;
1266 UINT32 KeyIndex;
1267
1268 Status = AuthServiceInternalFindVariable (
1269 AUTHVAR_KEYDB_NAME,
1270 &gEfiAuthenticatedVariableGuid,
1271 (VOID **) &Data,
1272 &DataSize
1273 );
1274 if (EFI_ERROR (Status)) {
1275 DEBUG ((EFI_D_ERROR, "Get public key database variable failure, Status = %r\n", Status));
1276 return 0;
1277 }
1278
1279 if (mPubKeyNumber == mMaxKeyNumber) {
1280 Name[0] = 0;
1281 AuthVariableInfo.VariableName = Name;
1282 ZeroMem (&VendorGuid, sizeof (VendorGuid));
1283 AuthVariableInfo.VendorGuid = &VendorGuid;
1284 mPubKeyNumber = 0;
1285 //
1286 // Collect valid key data.
1287 //
1288 do {
1289 Status = mAuthVarLibContextIn->FindNextVariable (AuthVariableInfo.VariableName, AuthVariableInfo.VendorGuid, &AuthVariableInfo);
1290 if (!EFI_ERROR (Status)) {
1291 if (AuthVariableInfo.PubKeyIndex != 0) {
1292 for (Ptr = Data; Ptr < (Data + DataSize); Ptr += sizeof (AUTHVAR_KEY_DB_DATA)) {
1293 if (ReadUnaligned32 (&(((AUTHVAR_KEY_DB_DATA *) Ptr)->KeyIndex)) == AuthVariableInfo.PubKeyIndex) {
1294 //
1295 // Check if the key data has been collected.
1296 //
1297 for (Index = 0; Index < mPubKeyNumber; Index++) {
1298 if (ReadUnaligned32 (&(((AUTHVAR_KEY_DB_DATA *) mPubKeyStore + Index)->KeyIndex)) == AuthVariableInfo.PubKeyIndex) {
1299 break;
1300 }
1301 }
1302 if (Index == mPubKeyNumber) {
1303 //
1304 // New key data.
1305 //
1306 CopyMem ((AUTHVAR_KEY_DB_DATA *) mPubKeyStore + mPubKeyNumber, Ptr, sizeof (AUTHVAR_KEY_DB_DATA));
1307 mPubKeyNumber++;
1308 }
1309 break;
1310 }
1311 }
1312 }
1313 }
1314 } while (Status != EFI_NOT_FOUND);
1315
1316 //
1317 // No available space to add new public key.
1318 //
1319 if (mPubKeyNumber == mMaxKeyNumber) {
1320 return 0;
1321 }
1322 }
1323
1324 //
1325 // Find available public key index.
1326 //
1327 for (KeyIndex = 1; KeyIndex <= mMaxKeyNumber; KeyIndex++) {
1328 IsFound = FALSE;
1329 for (Ptr = mPubKeyStore; Ptr < (mPubKeyStore + mPubKeyNumber * sizeof (AUTHVAR_KEY_DB_DATA)); Ptr += sizeof (AUTHVAR_KEY_DB_DATA)) {
1330 if (ReadUnaligned32 (&(((AUTHVAR_KEY_DB_DATA *) Ptr)->KeyIndex)) == KeyIndex) {
1331 IsFound = TRUE;
1332 break;
1333 }
1334 }
1335 if (!IsFound) {
1336 break;
1337 }
1338 }
1339
1340 return KeyIndex;
1341 }
1342
1343 /**
1344 Add public key in store and return its index.
1345
1346 @param[in] PubKey Input pointer to Public Key data.
1347 @param[in] VariableDataEntry The variable data entry.
1348
1349 @return Index of new added public key.
1350
1351 **/
1352 UINT32
1353 AddPubKeyInStore (
1354 IN UINT8 *PubKey,
1355 IN VARIABLE_ENTRY_CONSISTENCY *VariableDataEntry
1356 )
1357 {
1358 EFI_STATUS Status;
1359 UINT32 Index;
1360 VARIABLE_ENTRY_CONSISTENCY PublicKeyEntry;
1361 UINT32 Attributes;
1362 UINT32 KeyIndex;
1363
1364 if (PubKey == NULL) {
1365 return 0;
1366 }
1367
1368 //
1369 // Check whether the public key entry does exist.
1370 //
1371 for (Index = 0; Index < mPubKeyNumber; Index++) {
1372 if (CompareMem (((AUTHVAR_KEY_DB_DATA *) mPubKeyStore + Index)->KeyData, PubKey, EFI_CERT_TYPE_RSA2048_SIZE) == 0) {
1373 return ReadUnaligned32 (&(((AUTHVAR_KEY_DB_DATA *) mPubKeyStore + Index)->KeyIndex));
1374 }
1375 }
1376
1377 KeyIndex = GetAvailableKeyIndex (PubKey);
1378 if (KeyIndex == 0) {
1379 return 0;
1380 }
1381
1382 //
1383 // Check the variable space for both public key and variable data.
1384 //
1385 PublicKeyEntry.VariableSize = (mPubKeyNumber + 1) * sizeof (AUTHVAR_KEY_DB_DATA);
1386 PublicKeyEntry.Guid = &gEfiAuthenticatedVariableGuid;
1387 PublicKeyEntry.Name = AUTHVAR_KEYDB_NAME;
1388 Attributes = VARIABLE_ATTRIBUTE_NV_BS_RT | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
1389
1390 if (!mAuthVarLibContextIn->CheckRemainingSpaceForConsistency (Attributes, &PublicKeyEntry, VariableDataEntry, NULL)) {
1391 //
1392 // No enough variable space.
1393 //
1394 return 0;
1395 }
1396
1397 WriteUnaligned32 (&(((AUTHVAR_KEY_DB_DATA *) mPubKeyStore + mPubKeyNumber)->KeyIndex), KeyIndex);
1398 CopyMem (((AUTHVAR_KEY_DB_DATA *) mPubKeyStore + mPubKeyNumber)->KeyData, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
1399 mPubKeyNumber++;
1400
1401 //
1402 // Update public key database variable.
1403 //
1404 Status = AuthServiceInternalUpdateVariable (
1405 AUTHVAR_KEYDB_NAME,
1406 &gEfiAuthenticatedVariableGuid,
1407 mPubKeyStore,
1408 mPubKeyNumber * sizeof (AUTHVAR_KEY_DB_DATA),
1409 Attributes
1410 );
1411 if (EFI_ERROR (Status)) {
1412 DEBUG ((EFI_D_ERROR, "Update public key database variable failure, Status = %r\n", Status));
1413 return 0;
1414 }
1415
1416 return KeyIndex;
1417 }
1418
1419 /**
1420 Verify data payload with AuthInfo in EFI_CERT_TYPE_RSA2048_SHA256_GUID type.
1421 Follow the steps in UEFI2.2.
1422
1423 Caution: This function may receive untrusted input.
1424 This function may be invoked in SMM mode, and datasize and data are external input.
1425 This function will do basic validation, before parse the data.
1426 This function will parse the authentication carefully to avoid security issues, like
1427 buffer overflow, integer overflow.
1428
1429 @param[in] Data Pointer to data with AuthInfo.
1430 @param[in] DataSize Size of Data.
1431 @param[in] PubKey Public key used for verification.
1432
1433 @retval EFI_INVALID_PARAMETER Invalid parameter.
1434 @retval EFI_SECURITY_VIOLATION If authentication failed.
1435 @retval EFI_SUCCESS Authentication successful.
1436
1437 **/
1438 EFI_STATUS
1439 VerifyCounterBasedPayload (
1440 IN UINT8 *Data,
1441 IN UINTN DataSize,
1442 IN UINT8 *PubKey
1443 )
1444 {
1445 BOOLEAN Status;
1446 EFI_VARIABLE_AUTHENTICATION *CertData;
1447 EFI_CERT_BLOCK_RSA_2048_SHA256 *CertBlock;
1448 UINT8 Digest[SHA256_DIGEST_SIZE];
1449 VOID *Rsa;
1450 UINTN PayloadSize;
1451
1452 PayloadSize = DataSize - AUTHINFO_SIZE;
1453 Rsa = NULL;
1454 CertData = NULL;
1455 CertBlock = NULL;
1456
1457 if (Data == NULL || PubKey == NULL) {
1458 return EFI_INVALID_PARAMETER;
1459 }
1460
1461 CertData = (EFI_VARIABLE_AUTHENTICATION *) Data;
1462 CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
1463
1464 //
1465 // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
1466 // Cert type should be EFI_CERT_TYPE_RSA2048_SHA256_GUID.
1467 //
1468 if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
1469 !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertTypeRsa2048Sha256Guid)) {
1470 //
1471 // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
1472 //
1473 return EFI_SECURITY_VIOLATION;
1474 }
1475 //
1476 // Hash data payload with SHA256.
1477 //
1478 ZeroMem (Digest, SHA256_DIGEST_SIZE);
1479 Status = Sha256Init (mHashCtx);
1480 if (!Status) {
1481 goto Done;
1482 }
1483 Status = Sha256Update (mHashCtx, Data + AUTHINFO_SIZE, PayloadSize);
1484 if (!Status) {
1485 goto Done;
1486 }
1487 //
1488 // Hash Size.
1489 //
1490 Status = Sha256Update (mHashCtx, &PayloadSize, sizeof (UINTN));
1491 if (!Status) {
1492 goto Done;
1493 }
1494 //
1495 // Hash Monotonic Count.
1496 //
1497 Status = Sha256Update (mHashCtx, &CertData->MonotonicCount, sizeof (UINT64));
1498 if (!Status) {
1499 goto Done;
1500 }
1501 Status = Sha256Final (mHashCtx, Digest);
1502 if (!Status) {
1503 goto Done;
1504 }
1505 //
1506 // Generate & Initialize RSA Context.
1507 //
1508 Rsa = RsaNew ();
1509 ASSERT (Rsa != NULL);
1510 //
1511 // Set RSA Key Components.
1512 // NOTE: Only N and E are needed to be set as RSA public key for signature verification.
1513 //
1514 Status = RsaSetKey (Rsa, RsaKeyN, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
1515 if (!Status) {
1516 goto Done;
1517 }
1518 Status = RsaSetKey (Rsa, RsaKeyE, mRsaE, sizeof (mRsaE));
1519 if (!Status) {
1520 goto Done;
1521 }
1522 //
1523 // Verify the signature.
1524 //
1525 Status = RsaPkcs1Verify (
1526 Rsa,
1527 Digest,
1528 SHA256_DIGEST_SIZE,
1529 CertBlock->Signature,
1530 EFI_CERT_TYPE_RSA2048_SHA256_SIZE
1531 );
1532
1533 Done:
1534 if (Rsa != NULL) {
1535 RsaFree (Rsa);
1536 }
1537 if (Status) {
1538 return EFI_SUCCESS;
1539 } else {
1540 return EFI_SECURITY_VIOLATION;
1541 }
1542 }
1543
1544
1545 /**
1546 Check input data form to make sure it is a valid EFI_SIGNATURE_LIST for PK/KEK/db/dbx/dbt variable.
1547
1548 @param[in] VariableName Name of Variable to be check.
1549 @param[in] VendorGuid Variable vendor GUID.
1550 @param[in] Data Point to the variable data to be checked.
1551 @param[in] DataSize Size of Data.
1552
1553 @return EFI_INVALID_PARAMETER Invalid signature list format.
1554 @return EFI_SUCCESS Passed signature list format check successfully.
1555
1556 **/
1557 EFI_STATUS
1558 CheckSignatureListFormat(
1559 IN CHAR16 *VariableName,
1560 IN EFI_GUID *VendorGuid,
1561 IN VOID *Data,
1562 IN UINTN DataSize
1563 )
1564 {
1565 EFI_SIGNATURE_LIST *SigList;
1566 UINTN SigDataSize;
1567 UINT32 Index;
1568 UINT32 SigCount;
1569 BOOLEAN IsPk;
1570 VOID *RsaContext;
1571 EFI_SIGNATURE_DATA *CertData;
1572 UINTN CertLen;
1573
1574 if (DataSize == 0) {
1575 return EFI_SUCCESS;
1576 }
1577
1578 ASSERT (VariableName != NULL && VendorGuid != NULL && Data != NULL);
1579
1580 if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_PLATFORM_KEY_NAME) == 0)){
1581 IsPk = TRUE;
1582 } else if ((CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0)) ||
1583 (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&
1584 ((StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0) || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0) ||
1585 (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0)))) {
1586 IsPk = FALSE;
1587 } else {
1588 return EFI_SUCCESS;
1589 }
1590
1591 SigCount = 0;
1592 SigList = (EFI_SIGNATURE_LIST *) Data;
1593 SigDataSize = DataSize;
1594 RsaContext = NULL;
1595
1596 //
1597 // Walk throuth the input signature list and check the data format.
1598 // If any signature is incorrectly formed, the whole check will fail.
1599 //
1600 while ((SigDataSize > 0) && (SigDataSize >= SigList->SignatureListSize)) {
1601 for (Index = 0; Index < (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM)); Index++ ) {
1602 if (CompareGuid (&SigList->SignatureType, &mSupportSigItem[Index].SigType)) {
1603 //
1604 // The value of SignatureSize should always be 16 (size of SignatureOwner
1605 // component) add the data length according to signature type.
1606 //
1607 if (mSupportSigItem[Index].SigDataSize != ((UINT32) ~0) &&
1608 (SigList->SignatureSize - sizeof (EFI_GUID)) != mSupportSigItem[Index].SigDataSize) {
1609 return EFI_INVALID_PARAMETER;
1610 }
1611 if (mSupportSigItem[Index].SigHeaderSize != ((UINT32) ~0) &&
1612 SigList->SignatureHeaderSize != mSupportSigItem[Index].SigHeaderSize) {
1613 return EFI_INVALID_PARAMETER;
1614 }
1615 break;
1616 }
1617 }
1618
1619 if (Index == (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM))) {
1620 //
1621 // Undefined signature type.
1622 //
1623 return EFI_INVALID_PARAMETER;
1624 }
1625
1626 if (CompareGuid (&SigList->SignatureType, &gEfiCertX509Guid)) {
1627 //
1628 // Try to retrieve the RSA public key from the X.509 certificate.
1629 // If this operation fails, it's not a valid certificate.
1630 //
1631 RsaContext = RsaNew ();
1632 if (RsaContext == NULL) {
1633 return EFI_INVALID_PARAMETER;
1634 }
1635 CertData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigList + sizeof (EFI_SIGNATURE_LIST) + SigList->SignatureHeaderSize);
1636 CertLen = SigList->SignatureSize - sizeof (EFI_GUID);
1637 if (!RsaGetPublicKeyFromX509 (CertData->SignatureData, CertLen, &RsaContext)) {
1638 RsaFree (RsaContext);
1639 return EFI_INVALID_PARAMETER;
1640 }
1641 RsaFree (RsaContext);
1642 }
1643
1644 if ((SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) % SigList->SignatureSize != 0) {
1645 return EFI_INVALID_PARAMETER;
1646 }
1647 SigCount += (SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) / SigList->SignatureSize;
1648
1649 SigDataSize -= SigList->SignatureListSize;
1650 SigList = (EFI_SIGNATURE_LIST *) ((UINT8 *) SigList + SigList->SignatureListSize);
1651 }
1652
1653 if (((UINTN) SigList - (UINTN) Data) != DataSize) {
1654 return EFI_INVALID_PARAMETER;
1655 }
1656
1657 if (IsPk && SigCount > 1) {
1658 return EFI_INVALID_PARAMETER;
1659 }
1660
1661 return EFI_SUCCESS;
1662 }
1663
1664 /**
1665 Update "VendorKeys" variable to record the out of band secure boot key modification.
1666
1667 @return EFI_SUCCESS Variable is updated successfully.
1668 @return Others Failed to update variable.
1669
1670 **/
1671 EFI_STATUS
1672 VendorKeyIsModified (
1673 VOID
1674 )
1675 {
1676 EFI_STATUS Status;
1677
1678 if (mVendorKeyState == VENDOR_KEYS_MODIFIED) {
1679 return EFI_SUCCESS;
1680 }
1681 mVendorKeyState = VENDOR_KEYS_MODIFIED;
1682
1683 Status = AuthServiceInternalUpdateVariable (
1684 EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
1685 &gEfiVendorKeysNvGuid,
1686 &mVendorKeyState,
1687 sizeof (UINT8),
1688 EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS
1689 );
1690 if (EFI_ERROR (Status)) {
1691 return Status;
1692 }
1693
1694 return AuthServiceInternalUpdateVariable (
1695 EFI_VENDOR_KEYS_VARIABLE_NAME,
1696 &gEfiGlobalVariableGuid,
1697 &mVendorKeyState,
1698 sizeof (UINT8),
1699 EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS
1700 );
1701 }
1702
1703 /**
1704 Process Secure Boot Mode variable.
1705
1706 Caution: This function may receive untrusted input.
1707 This function may be invoked in SMM mode, and datasize and data are external input.
1708 This function will do basic validation, before parse the data.
1709 This function will parse the authentication carefully to avoid security issues, like
1710 buffer overflow, integer overflow.
1711 This function will check attribute carefully to avoid authentication bypass.
1712
1713 @param[in] VariableName Name of Variable to be found.
1714 @param[in] VendorGuid Variable vendor GUID.
1715 @param[in] Data Data pointer.
1716 @param[in] DataSize Size of Data found. If size is less than the
1717 data, this value contains the required size.
1718 @param[in] Attributes Attribute value of the variable
1719
1720 @return EFI_INVALID_PARAMETER Invalid parameter
1721 @return EFI_SECURITY_VIOLATION The variable does NOT pass the validation
1722 check carried out by the firmware.
1723 @return EFI_WRITE_PROTECTED Variable is Read-Only.
1724 @return EFI_SUCCESS Variable passed validation successfully.
1725
1726 **/
1727 EFI_STATUS
1728 ProcessSecureBootModeVar (
1729 IN CHAR16 *VariableName,
1730 IN EFI_GUID *VendorGuid,
1731 IN VOID *Data,
1732 IN UINTN DataSize,
1733 IN UINT32 Attributes OPTIONAL
1734 )
1735 {
1736 EFI_STATUS Status;
1737 VOID *VarData;
1738 UINTN VarDataSize;
1739
1740 //
1741 // Check "AuditMode", "DeployedMode" Variable ReadWrite Attributes
1742 // if in Runtime, Always RO
1743 // if in Boottime, Depends on current Secure Boot Mode
1744 //
1745 if (mAuthVarLibContextIn->AtRuntime()) {
1746 return EFI_WRITE_PROTECTED;
1747 }
1748
1749 //
1750 // Delete not OK
1751 //
1752 if ((DataSize != sizeof(UINT8)) || (Attributes == 0)) {
1753 return EFI_INVALID_PARAMETER;
1754 }
1755
1756 if (StrCmp (VariableName, EFI_AUDIT_MODE_NAME) == 0) {
1757 if(mSecureBootState[mSecureBootMode].IsAuditModeRO) {
1758 return EFI_WRITE_PROTECTED;
1759 }
1760 } else {
1761 //
1762 // Platform specific deployedMode clear. Set DeployedMode = RW
1763 //
1764 if (!InCustomMode() || !UserPhysicalPresent() || mSecureBootMode != SecureBootModeTypeDeployedMode) {
1765 if(mSecureBootState[mSecureBootMode].IsDeployedModeRO) {
1766 return EFI_WRITE_PROTECTED;
1767 }
1768 }
1769 }
1770
1771 if (*(UINT8 *)Data != 0 && *(UINT8 *)Data != 1) {
1772 return EFI_INVALID_PARAMETER;
1773 }
1774
1775 //
1776 // AuditMode/DeployedMode/SetupMode/SecureBoot are all NON_NV variable maintained by Variable driver
1777 // they can be RW. but can't be deleted. so they can always be found.
1778 //
1779 Status = AuthServiceInternalFindVariable (
1780 VariableName,
1781 VendorGuid,
1782 &VarData,
1783 &VarDataSize
1784 );
1785 if (EFI_ERROR(Status)) {
1786 ASSERT(FALSE);
1787 }
1788
1789 //
1790 // If AuditMode/DeployedMode is assigned same value. Simply return EFI_SUCCESS
1791 //
1792 if (*(UINT8 *)VarData == *(UINT8 *)Data) {
1793 return EFI_SUCCESS;
1794 }
1795
1796 //
1797 // Perform SecureBootMode transition
1798 //
1799 if (StrCmp (VariableName, EFI_AUDIT_MODE_NAME) == 0) {
1800 DEBUG((EFI_D_INFO, "Current SecureBootMode %x Transfer to SecureBootMode %x\n", mSecureBootMode, SecureBootModeTypeAuditMode));
1801 return SecureBootModeTransition(mSecureBootMode, SecureBootModeTypeAuditMode);
1802 } else if (StrCmp (VariableName, EFI_DEPLOYED_MODE_NAME) == 0) {
1803 if (mSecureBootMode == SecureBootModeTypeDeployedMode) {
1804 //
1805 // Platform specific DeployedMode clear. InCustomMode() && UserPhysicalPresent() is checked before
1806 //
1807 DEBUG((EFI_D_INFO, "Current SecureBootMode %x. Transfer to SecureBootMode %x\n", mSecureBootMode, SecureBootModeTypeUserMode));
1808 return SecureBootModeTransition(mSecureBootMode, SecureBootModeTypeUserMode);
1809 } else {
1810 DEBUG((EFI_D_INFO, "Current SecureBootMode %x. Transfer to SecureBootMode %x\n", mSecureBootMode, SecureBootModeTypeDeployedMode));
1811 return SecureBootModeTransition(mSecureBootMode, SecureBootModeTypeDeployedMode);
1812 }
1813 }
1814
1815 return EFI_INVALID_PARAMETER;
1816 }
1817
1818 /**
1819 Process variable with platform key for verification.
1820
1821 Caution: This function may receive untrusted input.
1822 This function may be invoked in SMM mode, and datasize and data are external input.
1823 This function will do basic validation, before parse the data.
1824 This function will parse the authentication carefully to avoid security issues, like
1825 buffer overflow, integer overflow.
1826 This function will check attribute carefully to avoid authentication bypass.
1827
1828 @param[in] VariableName Name of Variable to be found.
1829 @param[in] VendorGuid Variable vendor GUID.
1830 @param[in] Data Data pointer.
1831 @param[in] DataSize Size of Data found. If size is less than the
1832 data, this value contains the required size.
1833 @param[in] Attributes Attribute value of the variable
1834 @param[in] IsPk Indicate whether it is to process pk.
1835
1836 @return EFI_INVALID_PARAMETER Invalid parameter.
1837 @return EFI_SECURITY_VIOLATION The variable does NOT pass the validation.
1838 check carried out by the firmware.
1839 @return EFI_SUCCESS Variable passed validation successfully.
1840
1841 **/
1842 EFI_STATUS
1843 ProcessVarWithPk (
1844 IN CHAR16 *VariableName,
1845 IN EFI_GUID *VendorGuid,
1846 IN VOID *Data,
1847 IN UINTN DataSize,
1848 IN UINT32 Attributes OPTIONAL,
1849 IN BOOLEAN IsPk
1850 )
1851 {
1852 EFI_STATUS Status;
1853 BOOLEAN Del;
1854 UINT8 *Payload;
1855 UINTN PayloadSize;
1856 VARIABLE_ENTRY_CONSISTENCY VariableEntry[2];
1857
1858 if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1859 (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1860 //
1861 // PK, KEK and db/dbx/dbt should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1862 // authenticated variable.
1863 //
1864 return EFI_INVALID_PARAMETER;
1865 }
1866
1867 //
1868 // Init state of Del. State may change due to secure check
1869 //
1870 Del = FALSE;
1871 Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1872 PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1873 if (PayloadSize == 0) {
1874 Del = TRUE;
1875 }
1876
1877 //
1878 // Check the variable space for both PKpub and SecureBootMode variable.
1879 //
1880 VariableEntry[0].VariableSize = PayloadSize;
1881 VariableEntry[0].Guid = &gEfiGlobalVariableGuid;
1882 VariableEntry[0].Name = EFI_PLATFORM_KEY_NAME;
1883
1884 VariableEntry[1].VariableSize = sizeof(UINT8);
1885 VariableEntry[1].Guid = &gEdkiiSecureBootModeGuid;
1886 VariableEntry[1].Name = EDKII_SECURE_BOOT_MODE_NAME;
1887
1888 if ((InCustomMode() && UserPhysicalPresent()) ||
1889 (((mSecureBootMode == SecureBootModeTypeSetupMode) || (mSecureBootMode == SecureBootModeTypeAuditMode)) && !IsPk)) {
1890
1891 Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
1892 if (EFI_ERROR (Status)) {
1893 return Status;
1894 }
1895
1896 //
1897 // If delete PKpub, only check for "SecureBootMode" only
1898 // if update / add PKpub, check both NewPKpub & "SecureBootMode"
1899 //
1900 if (IsPk) {
1901 //
1902 // Delete PKpub
1903 //
1904 if (Del && ((mSecureBootMode == SecureBootModeTypeUserMode) || (mSecureBootMode == SecureBootModeTypeDeployedMode))
1905 && !mAuthVarLibContextIn->CheckRemainingSpaceForConsistency (VARIABLE_ATTRIBUTE_NV_BS_RT, &VariableEntry[1], NULL)){
1906 return EFI_OUT_OF_RESOURCES;
1907 //
1908 // Add PKpub
1909 //
1910 } else if (!Del && ((mSecureBootMode == SecureBootModeTypeSetupMode) || (mSecureBootMode == SecureBootModeTypeAuditMode))
1911 && !mAuthVarLibContextIn->CheckRemainingSpaceForConsistency (VARIABLE_ATTRIBUTE_NV_BS_RT, &VariableEntry[0], &VariableEntry[1], NULL)) {
1912 return EFI_OUT_OF_RESOURCES;
1913 }
1914 }
1915
1916 Status = AuthServiceInternalUpdateVariableWithTimeStamp (
1917 VariableName,
1918 VendorGuid,
1919 Payload,
1920 PayloadSize,
1921 Attributes,
1922 &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1923 );
1924 if (EFI_ERROR(Status)) {
1925 return Status;
1926 }
1927
1928 if (((mSecureBootMode != SecureBootModeTypeSetupMode) && (mSecureBootMode != SecureBootModeTypeAuditMode)) || IsPk) {
1929 Status = VendorKeyIsModified ();
1930 }
1931 } else if (mSecureBootMode == SecureBootModeTypeUserMode || mSecureBootMode == SecureBootModeTypeDeployedMode) {
1932 //
1933 // If delete PKpub, check "SecureBootMode" only
1934 //
1935 if (IsPk && Del && !mAuthVarLibContextIn->CheckRemainingSpaceForConsistency (VARIABLE_ATTRIBUTE_NV_BS_RT, &VariableEntry[1], NULL)){
1936 return EFI_OUT_OF_RESOURCES;
1937 }
1938
1939 //
1940 // Verify against X509 Cert in PK database.
1941 //
1942 Status = VerifyTimeBasedPayloadAndUpdate (
1943 VariableName,
1944 VendorGuid,
1945 Data,
1946 DataSize,
1947 Attributes,
1948 AuthVarTypePk,
1949 &Del
1950 );
1951 } else {
1952 //
1953 // SetupMode or AuditMode to add PK
1954 // Verify against the certificate in data payload.
1955 //
1956 //
1957 // Check PKpub & SecureBootMode variable space consistency
1958 //
1959 if (!mAuthVarLibContextIn->CheckRemainingSpaceForConsistency (VARIABLE_ATTRIBUTE_NV_BS_RT, &VariableEntry[0], &VariableEntry[1], NULL)) {
1960 //
1961 // No enough variable space to set PK successfully.
1962 //
1963 return EFI_OUT_OF_RESOURCES;
1964 }
1965
1966 Status = VerifyTimeBasedPayloadAndUpdate (
1967 VariableName,
1968 VendorGuid,
1969 Data,
1970 DataSize,
1971 Attributes,
1972 AuthVarTypePayload,
1973 &Del
1974 );
1975 }
1976
1977 if (!EFI_ERROR(Status) && IsPk) {
1978 //
1979 // Delete or Enroll PK causes SecureBootMode change
1980 //
1981 if (!Del) {
1982 if (mSecureBootMode == SecureBootModeTypeSetupMode) {
1983 //
1984 // If enroll PK in setup mode, change to user mode.
1985 //
1986 Status = SecureBootModeTransition (mSecureBootMode, SecureBootModeTypeUserMode);
1987 } else if (mSecureBootMode == SecureBootModeTypeAuditMode) {
1988 //
1989 // If enroll PK in Audit mode, change to Deployed mode.
1990 //
1991 Status = SecureBootModeTransition (mSecureBootMode, SecureBootModeTypeDeployedMode);
1992 } else {
1993 DEBUG((EFI_D_INFO, "PK is updated in %x mode. No SecureBootMode change.\n", mSecureBootMode));
1994 }
1995 } else {
1996 if ((mSecureBootMode == SecureBootModeTypeUserMode) || (mSecureBootMode == SecureBootModeTypeDeployedMode)) {
1997 //
1998 // If delete PK in User Mode or DeployedMode, change to Setup Mode.
1999 //
2000 Status = SecureBootModeTransition (mSecureBootMode, SecureBootModeTypeSetupMode);
2001 }
2002 }
2003 }
2004
2005 return Status;
2006 }
2007
2008 /**
2009 Process variable with key exchange key for verification.
2010
2011 Caution: This function may receive untrusted input.
2012 This function may be invoked in SMM mode, and datasize and data are external input.
2013 This function will do basic validation, before parse the data.
2014 This function will parse the authentication carefully to avoid security issues, like
2015 buffer overflow, integer overflow.
2016 This function will check attribute carefully to avoid authentication bypass.
2017
2018 @param[in] VariableName Name of Variable to be found.
2019 @param[in] VendorGuid Variable vendor GUID.
2020 @param[in] Data Data pointer.
2021 @param[in] DataSize Size of Data found. If size is less than the
2022 data, this value contains the required size.
2023 @param[in] Attributes Attribute value of the variable.
2024
2025 @return EFI_INVALID_PARAMETER Invalid parameter.
2026 @return EFI_SECURITY_VIOLATION The variable does NOT pass the validation
2027 check carried out by the firmware.
2028 @return EFI_SUCCESS Variable pass validation successfully.
2029
2030 **/
2031 EFI_STATUS
2032 ProcessVarWithKek (
2033 IN CHAR16 *VariableName,
2034 IN EFI_GUID *VendorGuid,
2035 IN VOID *Data,
2036 IN UINTN DataSize,
2037 IN UINT32 Attributes OPTIONAL
2038 )
2039 {
2040 EFI_STATUS Status;
2041 UINT8 *Payload;
2042 UINTN PayloadSize;
2043
2044 if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
2045 (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
2046 //
2047 // DB, DBX and DBT should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
2048 // authenticated variable.
2049 //
2050 return EFI_INVALID_PARAMETER;
2051 }
2052
2053 Status = EFI_SUCCESS;
2054 if ((mSecureBootMode == SecureBootModeTypeUserMode || mSecureBootMode == SecureBootModeTypeDeployedMode)
2055 && !(InCustomMode() && UserPhysicalPresent())) {
2056 //
2057 // Time-based, verify against X509 Cert KEK.
2058 //
2059 return VerifyTimeBasedPayloadAndUpdate (
2060 VariableName,
2061 VendorGuid,
2062 Data,
2063 DataSize,
2064 Attributes,
2065 AuthVarTypeKek,
2066 NULL
2067 );
2068 } else {
2069 //
2070 // If in setup mode or custom secure boot mode, no authentication needed.
2071 //
2072 Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
2073 PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
2074
2075 Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
2076 if (EFI_ERROR (Status)) {
2077 return Status;
2078 }
2079
2080 Status = AuthServiceInternalUpdateVariableWithTimeStamp (
2081 VariableName,
2082 VendorGuid,
2083 Payload,
2084 PayloadSize,
2085 Attributes,
2086 &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
2087 );
2088 if (EFI_ERROR (Status)) {
2089 return Status;
2090 }
2091
2092 if ((mSecureBootMode != SecureBootModeTypeSetupMode) && (mSecureBootMode != SecureBootModeTypeAuditMode)) {
2093 Status = VendorKeyIsModified ();
2094 }
2095 }
2096
2097 return Status;
2098 }
2099
2100 /**
2101 Check if it is to delete auth variable.
2102
2103 @param[in] OrgAttributes Original attribute value of the variable.
2104 @param[in] Data Data pointer.
2105 @param[in] DataSize Size of Data.
2106 @param[in] Attributes Attribute value of the variable.
2107
2108 @retval TRUE It is to delete auth variable.
2109 @retval FALSE It is not to delete auth variable.
2110
2111 **/
2112 BOOLEAN
2113 IsDeleteAuthVariable (
2114 IN UINT32 OrgAttributes,
2115 IN VOID *Data,
2116 IN UINTN DataSize,
2117 IN UINT32 Attributes
2118 )
2119 {
2120 BOOLEAN Del;
2121 UINTN PayloadSize;
2122
2123 Del = FALSE;
2124
2125 //
2126 // To delete a variable created with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
2127 // or the EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS attribute,
2128 // SetVariable must be used with attributes matching the existing variable
2129 // and the DataSize set to the size of the AuthInfo descriptor.
2130 //
2131 if ((Attributes == OrgAttributes) &&
2132 ((Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)) {
2133 if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
2134 PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
2135 if (PayloadSize == 0) {
2136 Del = TRUE;
2137 }
2138 } else {
2139 PayloadSize = DataSize - AUTHINFO_SIZE;
2140 if (PayloadSize == 0) {
2141 Del = TRUE;
2142 }
2143 }
2144 }
2145
2146 return Del;
2147 }
2148
2149 /**
2150 Process variable with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS/EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
2151
2152 Caution: This function may receive untrusted input.
2153 This function may be invoked in SMM mode, and datasize and data are external input.
2154 This function will do basic validation, before parse the data.
2155 This function will parse the authentication carefully to avoid security issues, like
2156 buffer overflow, integer overflow.
2157 This function will check attribute carefully to avoid authentication bypass.
2158
2159 @param[in] VariableName Name of the variable.
2160 @param[in] VendorGuid Variable vendor GUID.
2161 @param[in] Data Data pointer.
2162 @param[in] DataSize Size of Data.
2163 @param[in] Attributes Attribute value of the variable.
2164
2165 @return EFI_INVALID_PARAMETER Invalid parameter.
2166 @return EFI_WRITE_PROTECTED Variable is write-protected and needs authentication with
2167 EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
2168 @return EFI_OUT_OF_RESOURCES The Database to save the public key is full.
2169 @return EFI_SECURITY_VIOLATION The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
2170 set, but the AuthInfo does NOT pass the validation
2171 check carried out by the firmware.
2172 @return EFI_SUCCESS Variable is not write-protected or pass validation successfully.
2173
2174 **/
2175 EFI_STATUS
2176 ProcessVariable (
2177 IN CHAR16 *VariableName,
2178 IN EFI_GUID *VendorGuid,
2179 IN VOID *Data,
2180 IN UINTN DataSize,
2181 IN UINT32 Attributes
2182 )
2183 {
2184 EFI_STATUS Status;
2185 BOOLEAN IsDeletion;
2186 BOOLEAN IsFirstTime;
2187 UINT8 *PubKey;
2188 EFI_VARIABLE_AUTHENTICATION *CertData;
2189 EFI_CERT_BLOCK_RSA_2048_SHA256 *CertBlock;
2190 UINT32 KeyIndex;
2191 UINT64 MonotonicCount;
2192 VARIABLE_ENTRY_CONSISTENCY VariableDataEntry;
2193 UINT32 Index;
2194 AUTH_VARIABLE_INFO OrgVariableInfo;
2195
2196 KeyIndex = 0;
2197 CertData = NULL;
2198 CertBlock = NULL;
2199 PubKey = NULL;
2200 IsDeletion = FALSE;
2201 Status = EFI_SUCCESS;
2202
2203 ZeroMem (&OrgVariableInfo, sizeof (OrgVariableInfo));
2204 Status = mAuthVarLibContextIn->FindVariable (
2205 VariableName,
2206 VendorGuid,
2207 &OrgVariableInfo
2208 );
2209
2210 if ((!EFI_ERROR (Status)) && IsDeleteAuthVariable (OrgVariableInfo.Attributes, Data, DataSize, Attributes) && UserPhysicalPresent()) {
2211 //
2212 // Allow the delete operation of common authenticated variable at user physical presence.
2213 //
2214 Status = AuthServiceInternalUpdateVariable (
2215 VariableName,
2216 VendorGuid,
2217 NULL,
2218 0,
2219 0
2220 );
2221 if (!EFI_ERROR (Status) && ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0)) {
2222 Status = DeleteCertsFromDb (VariableName, VendorGuid, Attributes);
2223 }
2224
2225 return Status;
2226 }
2227
2228 if (NeedPhysicallyPresent (VariableName, VendorGuid) && !UserPhysicalPresent()) {
2229 //
2230 // This variable is protected, only physical present user could modify its value.
2231 //
2232 return EFI_SECURITY_VIOLATION;
2233 }
2234
2235 //
2236 // A time-based authenticated variable and a count-based authenticated variable
2237 // can't be updated by each other.
2238 //
2239 if (OrgVariableInfo.Data != NULL) {
2240 if (((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) &&
2241 ((OrgVariableInfo.Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0)) {
2242 return EFI_SECURITY_VIOLATION;
2243 }
2244
2245 if (((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) &&
2246 ((OrgVariableInfo.Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0)) {
2247 return EFI_SECURITY_VIOLATION;
2248 }
2249 }
2250
2251 //
2252 // Process Time-based Authenticated variable.
2253 //
2254 if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
2255 return VerifyTimeBasedPayloadAndUpdate (
2256 VariableName,
2257 VendorGuid,
2258 Data,
2259 DataSize,
2260 Attributes,
2261 AuthVarTypePriv,
2262 NULL
2263 );
2264 }
2265
2266 //
2267 // Determine if first time SetVariable with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS.
2268 //
2269 if ((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) {
2270 //
2271 // Determine current operation type.
2272 //
2273 if (DataSize == AUTHINFO_SIZE) {
2274 IsDeletion = TRUE;
2275 }
2276 //
2277 // Determine whether this is the first time with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
2278 //
2279 if (OrgVariableInfo.Data == NULL) {
2280 IsFirstTime = TRUE;
2281 } else if ((OrgVariableInfo.Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) == 0) {
2282 IsFirstTime = TRUE;
2283 } else {
2284 KeyIndex = OrgVariableInfo.PubKeyIndex;
2285 IsFirstTime = FALSE;
2286 }
2287 } else if ((OrgVariableInfo.Data != NULL) &&
2288 ((OrgVariableInfo.Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)
2289 ) {
2290 //
2291 // If the variable is already write-protected, it always needs authentication before update.
2292 //
2293 return EFI_WRITE_PROTECTED;
2294 } else {
2295 //
2296 // If without EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS, set and attributes collision.
2297 // That means it is not authenticated variable, just update variable as usual.
2298 //
2299 Status = AuthServiceInternalUpdateVariable (VariableName, VendorGuid, Data, DataSize, Attributes);
2300 return Status;
2301 }
2302
2303 //
2304 // Get PubKey and check Monotonic Count value corresponding to the variable.
2305 //
2306 CertData = (EFI_VARIABLE_AUTHENTICATION *) Data;
2307 CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
2308 PubKey = CertBlock->PublicKey;
2309
2310 //
2311 // Update Monotonic Count value.
2312 //
2313 MonotonicCount = CertData->MonotonicCount;
2314
2315 if (!IsFirstTime) {
2316 //
2317 // 2 cases need to check here
2318 // 1. Internal PubKey variable. PubKeyIndex is always 0
2319 // 2. Other counter-based AuthVariable. Check input PubKey.
2320 //
2321 if (KeyIndex == 0) {
2322 return EFI_SECURITY_VIOLATION;
2323 }
2324 for (Index = 0; Index < mPubKeyNumber; Index++) {
2325 if (ReadUnaligned32 (&(((AUTHVAR_KEY_DB_DATA *) mPubKeyStore + Index)->KeyIndex)) == KeyIndex) {
2326 if (CompareMem (((AUTHVAR_KEY_DB_DATA *) mPubKeyStore + Index)->KeyData, PubKey, EFI_CERT_TYPE_RSA2048_SIZE) == 0) {
2327 break;
2328 } else {
2329 return EFI_SECURITY_VIOLATION;
2330 }
2331 }
2332 }
2333 if (Index == mPubKeyNumber) {
2334 return EFI_SECURITY_VIOLATION;
2335 }
2336
2337 //
2338 // Compare the current monotonic count and ensure that it is greater than the last SetVariable
2339 // operation with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS attribute set.
2340 //
2341 if (MonotonicCount <= OrgVariableInfo.MonotonicCount) {
2342 //
2343 // Monotonic count check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
2344 //
2345 return EFI_SECURITY_VIOLATION;
2346 }
2347 }
2348 //
2349 // Verify the certificate in Data payload.
2350 //
2351 Status = VerifyCounterBasedPayload (Data, DataSize, PubKey);
2352 if (EFI_ERROR (Status)) {
2353 return Status;
2354 }
2355
2356 //
2357 // Now, the signature has been verified!
2358 //
2359 if (IsFirstTime && !IsDeletion) {
2360 VariableDataEntry.VariableSize = DataSize - AUTHINFO_SIZE;
2361 VariableDataEntry.Guid = VendorGuid;
2362 VariableDataEntry.Name = VariableName;
2363
2364 //
2365 // Update public key database variable if need.
2366 //
2367 KeyIndex = AddPubKeyInStore (PubKey, &VariableDataEntry);
2368 if (KeyIndex == 0) {
2369 return EFI_OUT_OF_RESOURCES;
2370 }
2371 }
2372
2373 //
2374 // Verification pass.
2375 //
2376 return AuthServiceInternalUpdateVariableWithMonotonicCount (VariableName, VendorGuid, (UINT8*)Data + AUTHINFO_SIZE, DataSize - AUTHINFO_SIZE, Attributes, KeyIndex, MonotonicCount);
2377 }
2378
2379 /**
2380 Filter out the duplicated EFI_SIGNATURE_DATA from the new data by comparing to the original data.
2381
2382 @param[in] Data Pointer to original EFI_SIGNATURE_LIST.
2383 @param[in] DataSize Size of Data buffer.
2384 @param[in, out] NewData Pointer to new EFI_SIGNATURE_LIST.
2385 @param[in, out] NewDataSize Size of NewData buffer.
2386
2387 **/
2388 EFI_STATUS
2389 FilterSignatureList (
2390 IN VOID *Data,
2391 IN UINTN DataSize,
2392 IN OUT VOID *NewData,
2393 IN OUT UINTN *NewDataSize
2394 )
2395 {
2396 EFI_SIGNATURE_LIST *CertList;
2397 EFI_SIGNATURE_DATA *Cert;
2398 UINTN CertCount;
2399 EFI_SIGNATURE_LIST *NewCertList;
2400 EFI_SIGNATURE_DATA *NewCert;
2401 UINTN NewCertCount;
2402 UINTN Index;
2403 UINTN Index2;
2404 UINTN Size;
2405 UINT8 *Tail;
2406 UINTN CopiedCount;
2407 UINTN SignatureListSize;
2408 BOOLEAN IsNewCert;
2409 UINT8 *TempData;
2410 UINTN TempDataSize;
2411 EFI_STATUS Status;
2412
2413 if (*NewDataSize == 0) {
2414 return EFI_SUCCESS;
2415 }
2416
2417 TempDataSize = *NewDataSize;
2418 Status = mAuthVarLibContextIn->GetScratchBuffer (&TempDataSize, (VOID **) &TempData);
2419 if (EFI_ERROR (Status)) {
2420 return EFI_OUT_OF_RESOURCES;
2421 }
2422
2423 Tail = TempData;
2424
2425 NewCertList = (EFI_SIGNATURE_LIST *) NewData;
2426 while ((*NewDataSize > 0) && (*NewDataSize >= NewCertList->SignatureListSize)) {
2427 NewCert = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCertList + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
2428 NewCertCount = (NewCertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - NewCertList->SignatureHeaderSize) / NewCertList->SignatureSize;
2429
2430 CopiedCount = 0;
2431 for (Index = 0; Index < NewCertCount; Index++) {
2432 IsNewCert = TRUE;
2433
2434 Size = DataSize;
2435 CertList = (EFI_SIGNATURE_LIST *) Data;
2436 while ((Size > 0) && (Size >= CertList->SignatureListSize)) {
2437 if (CompareGuid (&CertList->SignatureType, &NewCertList->SignatureType) &&
2438 (CertList->SignatureSize == NewCertList->SignatureSize)) {
2439 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2440 CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
2441 for (Index2 = 0; Index2 < CertCount; Index2++) {
2442 //
2443 // Iterate each Signature Data in this Signature List.
2444 //
2445 if (CompareMem (NewCert, Cert, CertList->SignatureSize) == 0) {
2446 IsNewCert = FALSE;
2447 break;
2448 }
2449 Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
2450 }
2451 }
2452
2453 if (!IsNewCert) {
2454 break;
2455 }
2456 Size -= CertList->SignatureListSize;
2457 CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
2458 }
2459
2460 if (IsNewCert) {
2461 //
2462 // New EFI_SIGNATURE_DATA, keep it.
2463 //
2464 if (CopiedCount == 0) {
2465 //
2466 // Copy EFI_SIGNATURE_LIST header for only once.
2467 //
2468 CopyMem (Tail, NewCertList, sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
2469 Tail = Tail + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
2470 }
2471
2472 CopyMem (Tail, NewCert, NewCertList->SignatureSize);
2473 Tail += NewCertList->SignatureSize;
2474 CopiedCount++;
2475 }
2476
2477 NewCert = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCert + NewCertList->SignatureSize);
2478 }
2479
2480 //
2481 // Update SignatureListSize in the kept EFI_SIGNATURE_LIST.
2482 //
2483 if (CopiedCount != 0) {
2484 SignatureListSize = sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize + (CopiedCount * NewCertList->SignatureSize);
2485 CertList = (EFI_SIGNATURE_LIST *) (Tail - SignatureListSize);
2486 CertList->SignatureListSize = (UINT32) SignatureListSize;
2487 }
2488
2489 *NewDataSize -= NewCertList->SignatureListSize;
2490 NewCertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) NewCertList + NewCertList->SignatureListSize);
2491 }
2492
2493 TempDataSize = (Tail - (UINT8 *) TempData);
2494
2495 CopyMem (NewData, TempData, TempDataSize);
2496 *NewDataSize = TempDataSize;
2497
2498 return EFI_SUCCESS;
2499 }
2500
2501 /**
2502 Compare two EFI_TIME data.
2503
2504
2505 @param FirstTime A pointer to the first EFI_TIME data.
2506 @param SecondTime A pointer to the second EFI_TIME data.
2507
2508 @retval TRUE The FirstTime is not later than the SecondTime.
2509 @retval FALSE The FirstTime is later than the SecondTime.
2510
2511 **/
2512 BOOLEAN
2513 AuthServiceInternalCompareTimeStamp (
2514 IN EFI_TIME *FirstTime,
2515 IN EFI_TIME *SecondTime
2516 )
2517 {
2518 if (FirstTime->Year != SecondTime->Year) {
2519 return (BOOLEAN) (FirstTime->Year < SecondTime->Year);
2520 } else if (FirstTime->Month != SecondTime->Month) {
2521 return (BOOLEAN) (FirstTime->Month < SecondTime->Month);
2522 } else if (FirstTime->Day != SecondTime->Day) {
2523 return (BOOLEAN) (FirstTime->Day < SecondTime->Day);
2524 } else if (FirstTime->Hour != SecondTime->Hour) {
2525 return (BOOLEAN) (FirstTime->Hour < SecondTime->Hour);
2526 } else if (FirstTime->Minute != SecondTime->Minute) {
2527 return (BOOLEAN) (FirstTime->Minute < SecondTime->Minute);
2528 }
2529
2530 return (BOOLEAN) (FirstTime->Second <= SecondTime->Second);
2531 }
2532
2533 /**
2534 Find matching signer's certificates for common authenticated variable
2535 by corresponding VariableName and VendorGuid from "certdb" or "certdbv".
2536
2537 The data format of "certdb" or "certdbv":
2538 //
2539 // UINT32 CertDbListSize;
2540 // /// AUTH_CERT_DB_DATA Certs1[];
2541 // /// AUTH_CERT_DB_DATA Certs2[];
2542 // /// ...
2543 // /// AUTH_CERT_DB_DATA Certsn[];
2544 //
2545
2546 @param[in] VariableName Name of authenticated Variable.
2547 @param[in] VendorGuid Vendor GUID of authenticated Variable.
2548 @param[in] Data Pointer to variable "certdb" or "certdbv".
2549 @param[in] DataSize Size of variable "certdb" or "certdbv".
2550 @param[out] CertOffset Offset of matching CertData, from starting of Data.
2551 @param[out] CertDataSize Length of CertData in bytes.
2552 @param[out] CertNodeOffset Offset of matching AUTH_CERT_DB_DATA , from
2553 starting of Data.
2554 @param[out] CertNodeSize Length of AUTH_CERT_DB_DATA in bytes.
2555
2556 @retval EFI_INVALID_PARAMETER Any input parameter is invalid.
2557 @retval EFI_NOT_FOUND Fail to find matching certs.
2558 @retval EFI_SUCCESS Find matching certs and output parameters.
2559
2560 **/
2561 EFI_STATUS
2562 FindCertsFromDb (
2563 IN CHAR16 *VariableName,
2564 IN EFI_GUID *VendorGuid,
2565 IN UINT8 *Data,
2566 IN UINTN DataSize,
2567 OUT UINT32 *CertOffset, OPTIONAL
2568 OUT UINT32 *CertDataSize, OPTIONAL
2569 OUT UINT32 *CertNodeOffset,OPTIONAL
2570 OUT UINT32 *CertNodeSize OPTIONAL
2571 )
2572 {
2573 UINT32 Offset;
2574 AUTH_CERT_DB_DATA *Ptr;
2575 UINT32 CertSize;
2576 UINT32 NameSize;
2577 UINT32 NodeSize;
2578 UINT32 CertDbListSize;
2579
2580 if ((VariableName == NULL) || (VendorGuid == NULL) || (Data == NULL)) {
2581 return EFI_INVALID_PARAMETER;
2582 }
2583
2584 //
2585 // Check whether DataSize matches recorded CertDbListSize.
2586 //
2587 if (DataSize < sizeof (UINT32)) {
2588 return EFI_INVALID_PARAMETER;
2589 }
2590
2591 CertDbListSize = ReadUnaligned32 ((UINT32 *) Data);
2592
2593 if (CertDbListSize != (UINT32) DataSize) {
2594 return EFI_INVALID_PARAMETER;
2595 }
2596
2597 Offset = sizeof (UINT32);
2598
2599 //
2600 // Get corresponding certificates by VendorGuid and VariableName.
2601 //
2602 while (Offset < (UINT32) DataSize) {
2603 Ptr = (AUTH_CERT_DB_DATA *) (Data + Offset);
2604 //
2605 // Check whether VendorGuid matches.
2606 //
2607 if (CompareGuid (&Ptr->VendorGuid, VendorGuid)) {
2608 NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
2609 NameSize = ReadUnaligned32 (&Ptr->NameSize);
2610 CertSize = ReadUnaligned32 (&Ptr->CertDataSize);
2611
2612 if (NodeSize != sizeof (EFI_GUID) + sizeof (UINT32) * 3 + CertSize +
2613 sizeof (CHAR16) * NameSize) {
2614 return EFI_INVALID_PARAMETER;
2615 }
2616
2617 Offset = Offset + sizeof (EFI_GUID) + sizeof (UINT32) * 3;
2618 //
2619 // Check whether VariableName matches.
2620 //
2621 if ((NameSize == StrLen (VariableName)) &&
2622 (CompareMem (Data + Offset, VariableName, NameSize * sizeof (CHAR16)) == 0)) {
2623 Offset = Offset + NameSize * sizeof (CHAR16);
2624
2625 if (CertOffset != NULL) {
2626 *CertOffset = Offset;
2627 }
2628
2629 if (CertDataSize != NULL) {
2630 *CertDataSize = CertSize;
2631 }
2632
2633 if (CertNodeOffset != NULL) {
2634 *CertNodeOffset = (UINT32) ((UINT8 *) Ptr - Data);
2635 }
2636
2637 if (CertNodeSize != NULL) {
2638 *CertNodeSize = NodeSize;
2639 }
2640
2641 return EFI_SUCCESS;
2642 } else {
2643 Offset = Offset + NameSize * sizeof (CHAR16) + CertSize;
2644 }
2645 } else {
2646 NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
2647 Offset = Offset + NodeSize;
2648 }
2649 }
2650
2651 return EFI_NOT_FOUND;
2652 }
2653
2654 /**
2655 Retrieve signer's certificates for common authenticated variable
2656 by corresponding VariableName and VendorGuid from "certdb"
2657 or "certdbv" according to authenticated variable attributes.
2658
2659 @param[in] VariableName Name of authenticated Variable.
2660 @param[in] VendorGuid Vendor GUID of authenticated Variable.
2661 @param[in] Attributes Attributes of authenticated variable.
2662 @param[out] CertData Pointer to signer's certificates.
2663 @param[out] CertDataSize Length of CertData in bytes.
2664
2665 @retval EFI_INVALID_PARAMETER Any input parameter is invalid.
2666 @retval EFI_NOT_FOUND Fail to find "certdb"/"certdbv" or matching certs.
2667 @retval EFI_SUCCESS Get signer's certificates successfully.
2668
2669 **/
2670 EFI_STATUS
2671 GetCertsFromDb (
2672 IN CHAR16 *VariableName,
2673 IN EFI_GUID *VendorGuid,
2674 IN UINT32 Attributes,
2675 OUT UINT8 **CertData,
2676 OUT UINT32 *CertDataSize
2677 )
2678 {
2679 EFI_STATUS Status;
2680 UINT8 *Data;
2681 UINTN DataSize;
2682 UINT32 CertOffset;
2683 CHAR16 *DbName;
2684
2685 if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL) || (CertDataSize == NULL)) {
2686 return EFI_INVALID_PARAMETER;
2687 }
2688
2689
2690 if ((Attributes & EFI_VARIABLE_NON_VOLATILE) != 0) {
2691 //
2692 // Get variable "certdb".
2693 //
2694 DbName = EFI_CERT_DB_NAME;
2695 } else {
2696 //
2697 // Get variable "certdbv".
2698 //
2699 DbName = EFI_CERT_DB_VOLATILE_NAME;
2700 }
2701
2702 //
2703 // Get variable "certdb" or "certdbv".
2704 //
2705 Status = AuthServiceInternalFindVariable (
2706 DbName,
2707 &gEfiCertDbGuid,
2708 (VOID **) &Data,
2709 &DataSize
2710 );
2711 if (EFI_ERROR (Status)) {
2712 return Status;
2713 }
2714
2715 if ((DataSize == 0) || (Data == NULL)) {
2716 ASSERT (FALSE);
2717 return EFI_NOT_FOUND;
2718 }
2719
2720 Status = FindCertsFromDb (
2721 VariableName,
2722 VendorGuid,
2723 Data,
2724 DataSize,
2725 &CertOffset,
2726 CertDataSize,
2727 NULL,
2728 NULL
2729 );
2730
2731 if (EFI_ERROR (Status)) {
2732 return Status;
2733 }
2734
2735 *CertData = Data + CertOffset;
2736 return EFI_SUCCESS;
2737 }
2738
2739 /**
2740 Delete matching signer's certificates when deleting common authenticated
2741 variable by corresponding VariableName and VendorGuid from "certdb" or
2742 "certdbv" according to authenticated variable attributes.
2743
2744 @param[in] VariableName Name of authenticated Variable.
2745 @param[in] VendorGuid Vendor GUID of authenticated Variable.
2746 @param[in] Attributes Attributes of authenticated variable.
2747
2748 @retval EFI_INVALID_PARAMETER Any input parameter is invalid.
2749 @retval EFI_NOT_FOUND Fail to find "certdb"/"certdbv" or matching certs.
2750 @retval EFI_OUT_OF_RESOURCES The operation is failed due to lack of resources.
2751 @retval EFI_SUCCESS The operation is completed successfully.
2752
2753 **/
2754 EFI_STATUS
2755 DeleteCertsFromDb (
2756 IN CHAR16 *VariableName,
2757 IN EFI_GUID *VendorGuid,
2758 IN UINT32 Attributes
2759 )
2760 {
2761 EFI_STATUS Status;
2762 UINT8 *Data;
2763 UINTN DataSize;
2764 UINT32 VarAttr;
2765 UINT32 CertNodeOffset;
2766 UINT32 CertNodeSize;
2767 UINT8 *NewCertDb;
2768 UINT32 NewCertDbSize;
2769 CHAR16 *DbName;
2770
2771 if ((VariableName == NULL) || (VendorGuid == NULL)) {
2772 return EFI_INVALID_PARAMETER;
2773 }
2774
2775 if ((Attributes & EFI_VARIABLE_NON_VOLATILE) != 0) {
2776 //
2777 // Get variable "certdb".
2778 //
2779 DbName = EFI_CERT_DB_NAME;
2780 VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
2781 } else {
2782 //
2783 // Get variable "certdbv".
2784 //
2785 DbName = EFI_CERT_DB_VOLATILE_NAME;
2786 VarAttr = EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
2787 }
2788
2789 Status = AuthServiceInternalFindVariable (
2790 DbName,
2791 &gEfiCertDbGuid,
2792 (VOID **) &Data,
2793 &DataSize
2794 );
2795
2796 if (EFI_ERROR (Status)) {
2797 return Status;
2798 }
2799
2800 if ((DataSize == 0) || (Data == NULL)) {
2801 ASSERT (FALSE);
2802 return EFI_NOT_FOUND;
2803 }
2804
2805 if (DataSize == sizeof (UINT32)) {
2806 //
2807 // There is no certs in "certdb" or "certdbv".
2808 //
2809 return EFI_SUCCESS;
2810 }
2811
2812 //
2813 // Get corresponding cert node from "certdb" or "certdbv".
2814 //
2815 Status = FindCertsFromDb (
2816 VariableName,
2817 VendorGuid,
2818 Data,
2819 DataSize,
2820 NULL,
2821 NULL,
2822 &CertNodeOffset,
2823 &CertNodeSize
2824 );
2825
2826 if (EFI_ERROR (Status)) {
2827 return Status;
2828 }
2829
2830 if (DataSize < (CertNodeOffset + CertNodeSize)) {
2831 return EFI_NOT_FOUND;
2832 }
2833
2834 //
2835 // Construct new data content of variable "certdb" or "certdbv".
2836 //
2837 NewCertDbSize = (UINT32) DataSize - CertNodeSize;
2838 NewCertDb = (UINT8*) mCertDbStore;
2839
2840 //
2841 // Copy the DB entries before deleting node.
2842 //
2843 CopyMem (NewCertDb, Data, CertNodeOffset);
2844 //
2845 // Update CertDbListSize.
2846 //
2847 CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
2848 //
2849 // Copy the DB entries after deleting node.
2850 //
2851 if (DataSize > (CertNodeOffset + CertNodeSize)) {
2852 CopyMem (
2853 NewCertDb + CertNodeOffset,
2854 Data + CertNodeOffset + CertNodeSize,
2855 DataSize - CertNodeOffset - CertNodeSize
2856 );
2857 }
2858
2859 //
2860 // Set "certdb" or "certdbv".
2861 //
2862 Status = AuthServiceInternalUpdateVariable (
2863 DbName,
2864 &gEfiCertDbGuid,
2865 NewCertDb,
2866 NewCertDbSize,
2867 VarAttr
2868 );
2869
2870 return Status;
2871 }
2872
2873 /**
2874 Insert signer's certificates for common authenticated variable with VariableName
2875 and VendorGuid in AUTH_CERT_DB_DATA to "certdb" or "certdbv" according to
2876 time based authenticated variable attributes.
2877
2878 @param[in] VariableName Name of authenticated Variable.
2879 @param[in] VendorGuid Vendor GUID of authenticated Variable.
2880 @param[in] Attributes Attributes of authenticated variable.
2881 @param[in] CertData Pointer to signer's certificates.
2882 @param[in] CertDataSize Length of CertData in bytes.
2883
2884 @retval EFI_INVALID_PARAMETER Any input parameter is invalid.
2885 @retval EFI_ACCESS_DENIED An AUTH_CERT_DB_DATA entry with same VariableName
2886 and VendorGuid already exists.
2887 @retval EFI_OUT_OF_RESOURCES The operation is failed due to lack of resources.
2888 @retval EFI_SUCCESS Insert an AUTH_CERT_DB_DATA entry to "certdb" or "certdbv"
2889
2890 **/
2891 EFI_STATUS
2892 InsertCertsToDb (
2893 IN CHAR16 *VariableName,
2894 IN EFI_GUID *VendorGuid,
2895 IN UINT32 Attributes,
2896 IN UINT8 *CertData,
2897 IN UINTN CertDataSize
2898 )
2899 {
2900 EFI_STATUS Status;
2901 UINT8 *Data;
2902 UINTN DataSize;
2903 UINT32 VarAttr;
2904 UINT8 *NewCertDb;
2905 UINT32 NewCertDbSize;
2906 UINT32 CertNodeSize;
2907 UINT32 NameSize;
2908 AUTH_CERT_DB_DATA *Ptr;
2909 CHAR16 *DbName;
2910
2911 if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL)) {
2912 return EFI_INVALID_PARAMETER;
2913 }
2914
2915 if ((Attributes & EFI_VARIABLE_NON_VOLATILE) != 0) {
2916 //
2917 // Get variable "certdb".
2918 //
2919 DbName = EFI_CERT_DB_NAME;
2920 VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
2921 } else {
2922 //
2923 // Get variable "certdbv".
2924 //
2925 DbName = EFI_CERT_DB_VOLATILE_NAME;
2926 VarAttr = EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
2927 }
2928
2929 //
2930 // Get variable "certdb" or "certdbv".
2931 //
2932 Status = AuthServiceInternalFindVariable (
2933 DbName,
2934 &gEfiCertDbGuid,
2935 (VOID **) &Data,
2936 &DataSize
2937 );
2938 if (EFI_ERROR (Status)) {
2939 return Status;
2940 }
2941
2942 if ((DataSize == 0) || (Data == NULL)) {
2943 ASSERT (FALSE);
2944 return EFI_NOT_FOUND;
2945 }
2946
2947 //
2948 // Find whether matching cert node already exists in "certdb" or "certdbv".
2949 // If yes return error.
2950 //
2951 Status = FindCertsFromDb (
2952 VariableName,
2953 VendorGuid,
2954 Data,
2955 DataSize,
2956 NULL,
2957 NULL,
2958 NULL,
2959 NULL
2960 );
2961
2962 if (!EFI_ERROR (Status)) {
2963 ASSERT (FALSE);
2964 return EFI_ACCESS_DENIED;
2965 }
2966
2967 //
2968 // Construct new data content of variable "certdb" or "certdbv".
2969 //
2970 NameSize = (UINT32) StrLen (VariableName);
2971 CertNodeSize = sizeof (AUTH_CERT_DB_DATA) + (UINT32) CertDataSize + NameSize * sizeof (CHAR16);
2972 NewCertDbSize = (UINT32) DataSize + CertNodeSize;
2973 if (NewCertDbSize > mMaxCertDbSize) {
2974 return EFI_OUT_OF_RESOURCES;
2975 }
2976 NewCertDb = (UINT8*) mCertDbStore;
2977
2978 //
2979 // Copy the DB entries before inserting node.
2980 //
2981 CopyMem (NewCertDb, Data, DataSize);
2982 //
2983 // Update CertDbListSize.
2984 //
2985 CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
2986 //
2987 // Construct new cert node.
2988 //
2989 Ptr = (AUTH_CERT_DB_DATA *) (NewCertDb + DataSize);
2990 CopyGuid (&Ptr->VendorGuid, VendorGuid);
2991 CopyMem (&Ptr->CertNodeSize, &CertNodeSize, sizeof (UINT32));
2992 CopyMem (&Ptr->NameSize, &NameSize, sizeof (UINT32));
2993 CopyMem (&Ptr->CertDataSize, &CertDataSize, sizeof (UINT32));
2994
2995 CopyMem (
2996 (UINT8 *) Ptr + sizeof (AUTH_CERT_DB_DATA),
2997 VariableName,
2998 NameSize * sizeof (CHAR16)
2999 );
3000
3001 CopyMem (
3002 (UINT8 *) Ptr + sizeof (AUTH_CERT_DB_DATA) + NameSize * sizeof (CHAR16),
3003 CertData,
3004 CertDataSize
3005 );
3006
3007 //
3008 // Set "certdb" or "certdbv".
3009 //
3010 Status = AuthServiceInternalUpdateVariable (
3011 DbName,
3012 &gEfiCertDbGuid,
3013 NewCertDb,
3014 NewCertDbSize,
3015 VarAttr
3016 );
3017
3018 return Status;
3019 }
3020
3021 /**
3022 Clean up signer's certificates for common authenticated variable
3023 by corresponding VariableName and VendorGuid from "certdb".
3024 System may break down during Timebased Variable update & certdb update,
3025 make them inconsistent, this function is called in AuthVariable Init
3026 to ensure consistency.
3027
3028 @retval EFI_NOT_FOUND Fail to find variable "certdb".
3029 @retval EFI_OUT_OF_RESOURCES The operation is failed due to lack of resources.
3030 @retval EFI_SUCCESS The operation is completed successfully.
3031
3032 **/
3033 EFI_STATUS
3034 CleanCertsFromDb (
3035 VOID
3036 )
3037 {
3038 UINT32 Offset;
3039 AUTH_CERT_DB_DATA *Ptr;
3040 UINT32 NameSize;
3041 UINT32 NodeSize;
3042 CHAR16 *VariableName;
3043 EFI_STATUS Status;
3044 BOOLEAN CertCleaned;
3045 UINT8 *Data;
3046 UINTN DataSize;
3047 EFI_GUID AuthVarGuid;
3048 AUTH_VARIABLE_INFO AuthVariableInfo;
3049
3050 Status = EFI_SUCCESS;
3051
3052 //
3053 // Get corresponding certificates by VendorGuid and VariableName.
3054 //
3055 do {
3056 CertCleaned = FALSE;
3057
3058 //
3059 // Get latest variable "certdb"
3060 //
3061 Status = AuthServiceInternalFindVariable (
3062 EFI_CERT_DB_NAME,
3063 &gEfiCertDbGuid,
3064 (VOID **) &Data,
3065 &DataSize
3066 );
3067 if (EFI_ERROR (Status)) {
3068 return Status;
3069 }
3070
3071 if ((DataSize == 0) || (Data == NULL)) {
3072 ASSERT (FALSE);
3073 return EFI_NOT_FOUND;
3074 }
3075
3076 Offset = sizeof (UINT32);
3077
3078 while (Offset < (UINT32) DataSize) {
3079 Ptr = (AUTH_CERT_DB_DATA *) (Data + Offset);
3080 NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
3081 NameSize = ReadUnaligned32 (&Ptr->NameSize);
3082
3083 //
3084 // Get VarName tailed with '\0'
3085 //
3086 VariableName = AllocateZeroPool((NameSize + 1) * sizeof(CHAR16));
3087 if (VariableName == NULL) {
3088 return EFI_OUT_OF_RESOURCES;
3089 }
3090 CopyMem (VariableName, (UINT8 *) Ptr + sizeof (AUTH_CERT_DB_DATA), NameSize * sizeof(CHAR16));
3091 //
3092 // Keep VarGuid aligned
3093 //
3094 CopyMem (&AuthVarGuid, &Ptr->VendorGuid, sizeof(EFI_GUID));
3095
3096 //
3097 // Find corresponding time auth variable
3098 //
3099 ZeroMem (&AuthVariableInfo, sizeof (AuthVariableInfo));
3100 Status = mAuthVarLibContextIn->FindVariable (
3101 VariableName,
3102 &AuthVarGuid,
3103 &AuthVariableInfo
3104 );
3105
3106 if (EFI_ERROR(Status)) {
3107 Status = DeleteCertsFromDb(
3108 VariableName,
3109 &AuthVarGuid,
3110 AuthVariableInfo.Attributes
3111 );
3112 CertCleaned = TRUE;
3113 DEBUG((EFI_D_INFO, "Recovery!! Cert for Auth Variable %s Guid %g is removed for consistency\n", VariableName, &AuthVarGuid));
3114 FreePool(VariableName);
3115 break;
3116 }
3117
3118 FreePool(VariableName);
3119 Offset = Offset + NodeSize;
3120 }
3121 } while (CertCleaned);
3122
3123 return Status;
3124 }
3125
3126 /**
3127 Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
3128
3129 Caution: This function may receive untrusted input.
3130 This function may be invoked in SMM mode, and datasize and data are external input.
3131 This function will do basic validation, before parse the data.
3132 This function will parse the authentication carefully to avoid security issues, like
3133 buffer overflow, integer overflow.
3134
3135 @param[in] VariableName Name of Variable to be found.
3136 @param[in] VendorGuid Variable vendor GUID.
3137 @param[in] Data Data pointer.
3138 @param[in] DataSize Size of Data found. If size is less than the
3139 data, this value contains the required size.
3140 @param[in] Attributes Attribute value of the variable.
3141 @param[in] AuthVarType Verify against PK, KEK database, private database or certificate in data payload.
3142 @param[in] OrgTimeStamp Pointer to original time stamp,
3143 original variable is not found if NULL.
3144 @param[out] VarPayloadPtr Pointer to variable payload address.
3145 @param[out] VarPayloadSize Pointer to variable payload size.
3146
3147 @retval EFI_INVALID_PARAMETER Invalid parameter.
3148 @retval EFI_SECURITY_VIOLATION The variable does NOT pass the validation
3149 check carried out by the firmware.
3150 @retval EFI_OUT_OF_RESOURCES Failed to process variable due to lack
3151 of resources.
3152 @retval EFI_SUCCESS Variable pass validation successfully.
3153
3154 **/
3155 EFI_STATUS
3156 VerifyTimeBasedPayload (
3157 IN CHAR16 *VariableName,
3158 IN EFI_GUID *VendorGuid,
3159 IN VOID *Data,
3160 IN UINTN DataSize,
3161 IN UINT32 Attributes,
3162 IN AUTHVAR_TYPE AuthVarType,
3163 IN EFI_TIME *OrgTimeStamp,
3164 OUT UINT8 **VarPayloadPtr,
3165 OUT UINTN *VarPayloadSize
3166 )
3167 {
3168 EFI_VARIABLE_AUTHENTICATION_2 *CertData;
3169 UINT8 *SigData;
3170 UINT32 SigDataSize;
3171 UINT8 *PayloadPtr;
3172 UINTN PayloadSize;
3173 UINT32 Attr;
3174 BOOLEAN VerifyStatus;
3175 EFI_STATUS Status;
3176 EFI_SIGNATURE_LIST *CertList;
3177 EFI_SIGNATURE_DATA *Cert;
3178 UINTN Index;
3179 UINTN CertCount;
3180 UINT32 KekDataSize;
3181 UINT8 *NewData;
3182 UINTN NewDataSize;
3183 UINT8 *Buffer;
3184 UINTN Length;
3185 UINT8 *RootCert;
3186 UINTN RootCertSize;
3187 UINT8 *SignerCerts;
3188 UINTN CertStackSize;
3189 UINT8 *CertsInCertDb;
3190 UINT32 CertsSizeinDb;
3191
3192 VerifyStatus = FALSE;
3193 CertData = NULL;
3194 NewData = NULL;
3195 Attr = Attributes;
3196 SignerCerts = NULL;
3197 RootCert = NULL;
3198 CertsInCertDb