SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c

   1 /** @file
   2   Implement authentication services for the authenticated variable
   3   service in UEFI2.2.
   4
   5   Caution: This module requires additional review when modified.
   6   This driver will have external input - variable data. It may be input in SMM mode.
   7   This external input must be validated carefully to avoid security issue like
   8   buffer overflow, integer overflow.
   9   Variable attribute should also be checked to avoid authentication bypass.
  10
  11   ProcessVarWithPk(), ProcessVarWithKek() and ProcessVariable() are the function to do
  12   variable authentication.
  13
  14   VerifyTimeBasedPayload() and VerifyCounterBasedPayload() are sub function to do verification.
  15   They will do basic validation for authentication data structure, then call crypto library
  16   to verify the signature.
  17
  18 Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>
  19 This program and the accompanying materials
  20 are licensed and made available under the terms and conditions of the BSD License
  21 which accompanies this distribution.  The full text of the license may be found at
  22 http://opensource.org/licenses/bsd-license.php
  23
  24 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  25 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  26
  27 **/
  28
  29 #include "Variable.h"
  30 #include "AuthService.h"
  31
  32 ///
  33 /// Global database array for scratch
  34 ///
  35 UINT8    mPubKeyStore[MAX_KEYDB_SIZE];
  36 UINT32   mPubKeyNumber;
  37 UINT8    mCertDbStore[MAX_CERTDB_SIZE];
  38 UINT32   mPlatformMode;
  39 EFI_GUID mSignatureSupport[] = {EFI_CERT_SHA1_GUID, EFI_CERT_SHA256_GUID, EFI_CERT_RSA2048_GUID, EFI_CERT_X509_GUID};
  40 //
  41 // Public Exponent of RSA Key.
  42 //
  43 CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };
  44 //
  45 // Hash context pointer
  46 //
  47 VOID  *mHashCtx = NULL;
  48
  49 //
  50 // Pointer to runtime buffer.
  51 // For "Append" operation to an existing variable, a read/modify/write operation
  52 // is supported by firmware internally. Reserve runtime buffer to cache previous
  53 // variable data in runtime phase because memory allocation is forbidden in virtual mode.
  54 //
  55 VOID  *mStorageArea = NULL;
  56
  57 //
  58 // The serialization of the values of the VariableName, VendorGuid and Attributes
  59 // parameters of the SetVariable() call and the TimeStamp component of the
  60 // EFI_VARIABLE_AUTHENTICATION_2 descriptor followed by the variable's new value
  61 // i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data)
  62 //
  63 UINT8 *mSerializationRuntimeBuffer = NULL;
  64
  65 //
  66 // Requirement for different signature type which have been defined in UEFI spec.
  67 // These data are used to peform SignatureList format check while setting PK/KEK variable.
  68 //
  69 EFI_SIGNATURE_ITEM mSupportSigItem[] = {
  70 //{SigType,                       SigHeaderSize,   SigDataSize  }
  71   {EFI_CERT_SHA256_GUID,          0,               32           },
  72   {EFI_CERT_RSA2048_GUID,         0,               256          },
  73   {EFI_CERT_RSA2048_SHA256_GUID,  0,               256          },
  74   {EFI_CERT_SHA1_GUID,            0,               20           },
  75   {EFI_CERT_RSA2048_SHA1_GUID,    0,               256          },
  76   {EFI_CERT_X509_GUID,            0,               ((UINT32) ~0)},
  77   {EFI_CERT_SHA224_GUID,          0,               28           },
  78   {EFI_CERT_SHA384_GUID,          0,               48           },
  79   {EFI_CERT_SHA512_GUID,          0,               64           }
  80 };
  81
  82 /**
  83   Determine whether this operation needs a physical present user.
  84
  85   @param[in]      VariableName            Name of the Variable.
  86   @param[in]      VendorGuid              GUID of the Variable.
  87
  88   @retval TRUE      This variable is protected, only a physical present user could set this variable.
  89   @retval FALSE     This variable is not protected.
  90
  91 **/
  92 BOOLEAN
  93 NeedPhysicallyPresent(
  94   IN     CHAR16         *VariableName,
  95   IN     EFI_GUID       *VendorGuid
  96   )
  97 {
  98   if ((CompareGuid (VendorGuid, &gEfiSecureBootEnableDisableGuid) && (StrCmp (VariableName, EFI_SECURE_BOOT_ENABLE_NAME) == 0))
  99     || (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (VariableName, EFI_CUSTOM_MODE_NAME) == 0))) {
 100     return TRUE;
 101   }
 102
 103   return FALSE;
 104 }
 105
 106 /**
 107   Determine whether the platform is operating in Custom Secure Boot mode.
 108
 109   @retval TRUE           The platform is operating in Custom mode.
 110   @retval FALSE          The platform is operating in Standard mode.
 111
 112 **/
 113 BOOLEAN
 114 InCustomMode (
 115   VOID
 116   )
 117 {
 118   VARIABLE_POINTER_TRACK  Variable;
 119
 120   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 121   if (Variable.CurrPtr != NULL && *(GetVariableDataPtr (Variable.CurrPtr)) == CUSTOM_SECURE_BOOT_MODE) {
 122     return TRUE;
 123   }
 124
 125   return FALSE;
 126 }
 127
 128
 129 /**
 130   Internal function to delete a Variable given its name and GUID, no authentication
 131   required.
 132
 133   @param[in]      VariableName            Name of the Variable.
 134   @param[in]      VendorGuid              GUID of the Variable.
 135
 136   @retval EFI_SUCCESS              Variable deleted successfully.
 137   @retval Others                   The driver failded to start the device.
 138
 139 **/
 140 EFI_STATUS
 141 DeleteVariable (
 142   IN  CHAR16                    *VariableName,
 143   IN  EFI_GUID                  *VendorGuid
 144   )
 145 {
 146   EFI_STATUS              Status;
 147   VARIABLE_POINTER_TRACK  Variable;
 148
 149   Status = FindVariable (VariableName, VendorGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 150   if (EFI_ERROR (Status)) {
 151     return EFI_SUCCESS;
 152   }
 153
 154   ASSERT (Variable.CurrPtr != NULL);
 155   return UpdateVariable (VariableName, VendorGuid, NULL, 0, 0, 0, 0, &Variable, NULL);
 156 }
 157
 158 /**
 159   Initializes for authenticated varibale service.
 160
 161   @retval EFI_SUCCESS           Function successfully executed.
 162   @retval EFI_OUT_OF_RESOURCES  Fail to allocate enough memory resources.
 163
 164 **/
 165 EFI_STATUS
 166 AutenticatedVariableServiceInitialize (
 167   VOID
 168   )
 169 {
 170   EFI_STATUS              Status;
 171   VARIABLE_POINTER_TRACK  Variable;
 172   VARIABLE_POINTER_TRACK  PkVariable;
 173   UINT8                   VarValue;
 174   UINT32                  VarAttr;
 175   UINT8                   *Data;
 176   UINTN                   DataSize;
 177   UINTN                   CtxSize;
 178   UINT8                   SecureBootMode;
 179   UINT8                   SecureBootEnable;
 180   UINT8                   CustomMode;
 181   UINT32                  ListSize;
 182
 183   //
 184   // Initialize hash context.
 185   //
 186   CtxSize   = Sha256GetContextSize ();
 187   mHashCtx  = AllocateRuntimePool (CtxSize);
 188   if (mHashCtx == NULL) {
 189     return EFI_OUT_OF_RESOURCES;
 190   }
 191
 192   //
 193   // Reserved runtime buffer for "Append" operation in virtual mode.
 194   //
 195   mStorageArea  = AllocateRuntimePool (PcdGet32 (PcdMaxVariableSize));
 196   if (mStorageArea == NULL) {
 197     return EFI_OUT_OF_RESOURCES;
 198   }
 199
 200   //
 201   // Prepare runtime buffer for serialized data of time-based authenticated
 202   // Variable, i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data).
 203   //
 204   mSerializationRuntimeBuffer = AllocateRuntimePool (PcdGet32 (PcdMaxVariableSize) + sizeof (EFI_GUID) + sizeof (UINT32) + sizeof (EFI_TIME));
 205   if (mSerializationRuntimeBuffer == NULL) {
 206     return EFI_OUT_OF_RESOURCES;
 207   }
 208
 209   //
 210   // Check "AuthVarKeyDatabase" variable's existence.
 211   // If it doesn't exist, create a new one with initial value of 0 and EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
 212   //
 213   Status = FindVariable (
 214              AUTHVAR_KEYDB_NAME,
 215              &gEfiAuthenticatedVariableGuid,
 216              &Variable,
 217              &mVariableModuleGlobal->VariableGlobal,
 218              FALSE
 219              );
 220
 221   if (Variable.CurrPtr == NULL) {
 222     VarAttr       = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 223     VarValue      = 0;
 224     mPubKeyNumber = 0;
 225     Status        = UpdateVariable (
 226                       AUTHVAR_KEYDB_NAME,
 227                       &gEfiAuthenticatedVariableGuid,
 228                       &VarValue,
 229                       sizeof(UINT8),
 230                       VarAttr,
 231                       0,
 232                       0,
 233                       &Variable,
 234                       NULL
 235                       );
 236     if (EFI_ERROR (Status)) {
 237       return Status;
 238     }
 239   } else {
 240     //
 241     // Load database in global variable for cache.
 242     //
 243     DataSize  = DataSizeOfVariable (Variable.CurrPtr);
 244     Data      = GetVariableDataPtr (Variable.CurrPtr);
 245     ASSERT ((DataSize != 0) && (Data != NULL));
 246     CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
 247     mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
 248   }
 249
 250   FindVariable (EFI_PLATFORM_KEY_NAME, &gEfiGlobalVariableGuid, &PkVariable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 251   if (PkVariable.CurrPtr == NULL) {
 252     DEBUG ((EFI_D_INFO, "Variable %s does not exist.\n", EFI_PLATFORM_KEY_NAME));
 253   } else {
 254     DEBUG ((EFI_D_INFO, "Variable %s exists.\n", EFI_PLATFORM_KEY_NAME));
 255   }
 256
 257   //
 258   // Create "SetupMode" varable with BS+RT attribute set.
 259   //
 260   FindVariable (EFI_SETUP_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 261   if (PkVariable.CurrPtr == NULL) {
 262     mPlatformMode = SETUP_MODE;
 263   } else {
 264     mPlatformMode = USER_MODE;
 265   }
 266   Status = UpdateVariable (
 267              EFI_SETUP_MODE_NAME,
 268              &gEfiGlobalVariableGuid,
 269              &mPlatformMode,
 270              sizeof(UINT8),
 271              EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 272              0,
 273              0,
 274              &Variable,
 275              NULL
 276              );
 277   if (EFI_ERROR (Status)) {
 278     return Status;
 279   }
 280
 281   //
 282   // Create "SignatureSupport" varable with BS+RT attribute set.
 283   //
 284   FindVariable (EFI_SIGNATURE_SUPPORT_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 285   Status  = UpdateVariable (
 286               EFI_SIGNATURE_SUPPORT_NAME,
 287               &gEfiGlobalVariableGuid,
 288               mSignatureSupport,
 289               sizeof(mSignatureSupport),
 290               EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 291               0,
 292               0,
 293               &Variable,
 294               NULL
 295               );
 296   if (EFI_ERROR (Status)) {
 297     return Status;
 298   }
 299
 300   //
 301   // If "SecureBootEnable" variable exists, then update "SecureBoot" variable.
 302   // If "SecureBootEnable" variable is SECURE_BOOT_ENABLE and in USER_MODE, Set "SecureBoot" variable to SECURE_BOOT_MODE_ENABLE.
 303   // If "SecureBootEnable" variable is SECURE_BOOT_DISABLE, Set "SecureBoot" variable to SECURE_BOOT_MODE_DISABLE.
 304   //
 305   SecureBootEnable = SECURE_BOOT_DISABLE;
 306   FindVariable (EFI_SECURE_BOOT_ENABLE_NAME, &gEfiSecureBootEnableDisableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 307   if (Variable.CurrPtr != NULL) {
 308     SecureBootEnable = *(GetVariableDataPtr (Variable.CurrPtr));
 309   } else if (mPlatformMode == USER_MODE) {
 310     //
 311     // "SecureBootEnable" not exist, initialize it in USER_MODE.
 312     //
 313     SecureBootEnable = SECURE_BOOT_ENABLE;
 314     Status = UpdateVariable (
 315                EFI_SECURE_BOOT_ENABLE_NAME,
 316                &gEfiSecureBootEnableDisableGuid,
 317                &SecureBootEnable,
 318                sizeof (UINT8),
 319                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 320                0,
 321                0,
 322                &Variable,
 323                NULL
 324                );
 325     if (EFI_ERROR (Status)) {
 326       return Status;
 327     }
 328   }
 329
 330   //
 331   // Create "SecureBoot" varable with BS+RT attribute set.
 332   //
 333   if (SecureBootEnable == SECURE_BOOT_ENABLE && mPlatformMode == USER_MODE) {
 334     SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 335   } else {
 336     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 337   }
 338   FindVariable (EFI_SECURE_BOOT_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 339   Status = UpdateVariable (
 340              EFI_SECURE_BOOT_MODE_NAME,
 341              &gEfiGlobalVariableGuid,
 342              &SecureBootMode,
 343              sizeof (UINT8),
 344              EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 345              0,
 346              0,
 347              &Variable,
 348              NULL
 349              );
 350   if (EFI_ERROR (Status)) {
 351     return Status;
 352   }
 353
 354   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SETUP_MODE_NAME, mPlatformMode));
 355   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_MODE_NAME, SecureBootMode));
 356   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_ENABLE_NAME, SecureBootEnable));
 357
 358   //
 359   // Check "CustomMode" variable's existence.
 360   //
 361   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 362   if (Variable.CurrPtr != NULL) {
 363     CustomMode = *(GetVariableDataPtr (Variable.CurrPtr));
 364   } else {
 365     //
 366     // "CustomMode" not exist, initialize it in STANDARD_SECURE_BOOT_MODE.
 367     //
 368     CustomMode = STANDARD_SECURE_BOOT_MODE;
 369     Status = UpdateVariable (
 370                EFI_CUSTOM_MODE_NAME,
 371                &gEfiCustomModeEnableGuid,
 372                &CustomMode,
 373                sizeof (UINT8),
 374                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 375                0,
 376                0,
 377                &Variable,
 378                NULL
 379                );
 380     if (EFI_ERROR (Status)) {
 381       return Status;
 382     }
 383   }
 384
 385   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_CUSTOM_MODE_NAME, CustomMode));
 386
 387   //
 388   // Check "certdb" variable's existence.
 389   // If it doesn't exist, then create a new one with
 390   // EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.
 391   //
 392   Status = FindVariable (
 393              EFI_CERT_DB_NAME,
 394              &gEfiCertDbGuid,
 395              &Variable,
 396              &mVariableModuleGlobal->VariableGlobal,
 397              FALSE
 398              );
 399
 400   if (Variable.CurrPtr == NULL) {
 401     VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
 402     ListSize = sizeof (UINT32);
 403     Status   = UpdateVariable (
 404                  EFI_CERT_DB_NAME,
 405                  &gEfiCertDbGuid,
 406                  &ListSize,
 407                  sizeof (UINT32),
 408                  VarAttr,
 409                  0,
 410                  0,
 411                  &Variable,
 412                  NULL
 413                  );
 414     if (EFI_ERROR (Status)) {
 415       return Status;
 416     }
 417   }
 418
 419   return Status;
 420 }
 421
 422 /**
 423   Add public key in store and return its index.
 424
 425   @param[in]  PubKey                  Input pointer to Public Key data
 426
 427   @return                             Index of new added item
 428
 429 **/
 430 UINT32
 431 AddPubKeyInStore (
 432   IN  UINT8               *PubKey
 433   )
 434 {
 435   EFI_STATUS              Status;
 436   BOOLEAN                 IsFound;
 437   UINT32                  Index;
 438   VARIABLE_POINTER_TRACK  Variable;
 439   UINT8                   *Ptr;
 440
 441   if (PubKey == NULL) {
 442     return 0;
 443   }
 444
 445   Status = FindVariable (
 446              AUTHVAR_KEYDB_NAME,
 447              &gEfiAuthenticatedVariableGuid,
 448              &Variable,
 449              &mVariableModuleGlobal->VariableGlobal,
 450              FALSE
 451              );
 452   ASSERT_EFI_ERROR (Status);
 453   //
 454   // Check whether the public key entry does exist.
 455   //
 456   IsFound = FALSE;
 457   for (Ptr = mPubKeyStore, Index = 1; Index <= mPubKeyNumber; Index++) {
 458     if (CompareMem (Ptr, PubKey, EFI_CERT_TYPE_RSA2048_SIZE) == 0) {
 459       IsFound = TRUE;
 460       break;
 461     }
 462     Ptr += EFI_CERT_TYPE_RSA2048_SIZE;
 463   }
 464
 465   if (!IsFound) {
 466     //
 467     // Add public key in database.
 468     //
 469     if (mPubKeyNumber == MAX_KEY_NUM) {
 470       //
 471       // Notes: Database is full, need enhancement here, currently just return 0.
 472       //
 473       return 0;
 474     }
 475
 476     CopyMem (mPubKeyStore + mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 477     Index = ++mPubKeyNumber;
 478     //
 479     // Update public key database variable.
 480     //
 481     Status = UpdateVariable (
 482                AUTHVAR_KEYDB_NAME,
 483                &gEfiAuthenticatedVariableGuid,
 484                mPubKeyStore,
 485                mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE,
 486                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS,
 487                0,
 488                0,
 489                &Variable,
 490                NULL
 491                );
 492     ASSERT_EFI_ERROR (Status);
 493   }
 494
 495   return Index;
 496 }
 497
 498 /**
 499   Verify data payload with AuthInfo in EFI_CERT_TYPE_RSA2048_SHA256_GUID type.
 500   Follow the steps in UEFI2.2.
 501
 502   Caution: This function may receive untrusted input.
 503   This function may be invoked in SMM mode, and datasize and data are external input.
 504   This function will do basic validation, before parse the data.
 505   This function will parse the authentication carefully to avoid security issues, like
 506   buffer overflow, integer overflow.
 507
 508   @param[in]      Data                    Pointer to data with AuthInfo.
 509   @param[in]      DataSize                Size of Data.
 510   @param[in]      PubKey                  Public key used for verification.
 511
 512   @retval EFI_INVALID_PARAMETER       Invalid parameter.
 513   @retval EFI_SECURITY_VIOLATION      If authentication failed.
 514   @retval EFI_SUCCESS                 Authentication successful.
 515
 516 **/
 517 EFI_STATUS
 518 VerifyCounterBasedPayload (
 519   IN     UINT8          *Data,
 520   IN     UINTN          DataSize,
 521   IN     UINT8          *PubKey
 522   )
 523 {
 524   BOOLEAN                         Status;
 525   EFI_VARIABLE_AUTHENTICATION     *CertData;
 526   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
 527   UINT8                           Digest[SHA256_DIGEST_SIZE];
 528   VOID                            *Rsa;
 529
 530   Rsa         = NULL;
 531   CertData    = NULL;
 532   CertBlock   = NULL;
 533
 534   if (Data == NULL || PubKey == NULL) {
 535     return EFI_INVALID_PARAMETER;
 536   }
 537
 538   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
 539   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
 540
 541   //
 542   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
 543   // Cert type should be EFI_CERT_TYPE_RSA2048_SHA256_GUID.
 544   //
 545   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
 546       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertTypeRsa2048Sha256Guid)
 547         ) {
 548     //
 549     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
 550     //
 551     return EFI_SECURITY_VIOLATION;
 552   }
 553   //
 554   // Hash data payload with SHA256.
 555   //
 556   ZeroMem (Digest, SHA256_DIGEST_SIZE);
 557   Status  = Sha256Init (mHashCtx);
 558   if (!Status) {
 559     goto Done;
 560   }
 561   Status  = Sha256Update (mHashCtx, Data + AUTHINFO_SIZE, (UINTN) (DataSize - AUTHINFO_SIZE));
 562   if (!Status) {
 563     goto Done;
 564   }
 565   //
 566   // Hash Monotonic Count.
 567   //
 568   Status  = Sha256Update (mHashCtx, &CertData->MonotonicCount, sizeof (UINT64));
 569   if (!Status) {
 570     goto Done;
 571   }
 572   Status  = Sha256Final (mHashCtx, Digest);
 573   if (!Status) {
 574     goto Done;
 575   }
 576   //
 577   // Generate & Initialize RSA Context.
 578   //
 579   Rsa = RsaNew ();
 580   ASSERT (Rsa != NULL);
 581   //
 582   // Set RSA Key Components.
 583   // NOTE: Only N and E are needed to be set as RSA public key for signature verification.
 584   //
 585   Status = RsaSetKey (Rsa, RsaKeyN, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 586   if (!Status) {
 587     goto Done;
 588   }
 589   Status = RsaSetKey (Rsa, RsaKeyE, mRsaE, sizeof (mRsaE));
 590   if (!Status) {
 591     goto Done;
 592   }
 593   //
 594   // Verify the signature.
 595   //
 596   Status = RsaPkcs1Verify (
 597              Rsa,
 598              Digest,
 599              SHA256_DIGEST_SIZE,
 600              CertBlock->Signature,
 601              EFI_CERT_TYPE_RSA2048_SHA256_SIZE
 602              );
 603
 604 Done:
 605   if (Rsa != NULL) {
 606     RsaFree (Rsa);
 607   }
 608   if (Status) {
 609     return EFI_SUCCESS;
 610   } else {
 611     return EFI_SECURITY_VIOLATION;
 612   }
 613 }
 614
 615 /**
 616   Update platform mode.
 617
 618   @param[in]      Mode                    SETUP_MODE or USER_MODE.
 619
 620   @return EFI_INVALID_PARAMETER           Invalid parameter.
 621   @return EFI_SUCCESS                     Update platform mode successfully.
 622
 623 **/
 624 EFI_STATUS
 625 UpdatePlatformMode (
 626   IN  UINT32                    Mode
 627   )
 628 {
 629   EFI_STATUS              Status;
 630   VARIABLE_POINTER_TRACK  Variable;
 631   UINT32                  VarAttr;
 632   UINT8                   SecureBootMode;
 633   UINT8                   SecureBootEnable;
 634   UINTN                   VariableDataSize;
 635
 636   Status = FindVariable (
 637              EFI_SETUP_MODE_NAME,
 638              &gEfiGlobalVariableGuid,
 639              &Variable,
 640              &mVariableModuleGlobal->VariableGlobal,
 641              FALSE
 642              );
 643   if (EFI_ERROR (Status)) {
 644     return Status;
 645   }
 646
 647   //
 648   // Update the value of SetupMode variable by a simple mem copy, this could avoid possible
 649   // variable storage reclaim at runtime.
 650   //
 651   mPlatformMode = (UINT8) Mode;
 652   CopyMem (GetVariableDataPtr (Variable.CurrPtr), &mPlatformMode, sizeof(UINT8));
 653
 654   if (AtRuntime ()) {
 655     //
 656     // SecureBoot Variable indicates whether the platform firmware is operating
 657     // in Secure boot mode (1) or not (0), so we should not change SecureBoot
 658     // Variable in runtime.
 659     //
 660     return Status;
 661   }
 662
 663   //
 664   // Check "SecureBoot" variable's existence.
 665   // If it doesn't exist, firmware has no capability to perform driver signing verification,
 666   // then set "SecureBoot" to 0.
 667   //
 668   Status = FindVariable (
 669              EFI_SECURE_BOOT_MODE_NAME,
 670              &gEfiGlobalVariableGuid,
 671              &Variable,
 672              &mVariableModuleGlobal->VariableGlobal,
 673              FALSE
 674              );
 675   //
 676   // If "SecureBoot" variable exists, then check "SetupMode" variable update.
 677   // If "SetupMode" variable is USER_MODE, "SecureBoot" variable is set to 1.
 678   // If "SetupMode" variable is SETUP_MODE, "SecureBoot" variable is set to 0.
 679   //
 680   if (Variable.CurrPtr == NULL) {
 681     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 682   } else {
 683     if (mPlatformMode == USER_MODE) {
 684       SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 685     } else if (mPlatformMode == SETUP_MODE) {
 686       SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 687     } else {
 688       return EFI_NOT_FOUND;
 689     }
 690   }
 691
 692   VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 693   Status  = UpdateVariable (
 694               EFI_SECURE_BOOT_MODE_NAME,
 695               &gEfiGlobalVariableGuid,
 696               &SecureBootMode,
 697               sizeof(UINT8),
 698               VarAttr,
 699               0,
 700               0,
 701               &Variable,
 702               NULL
 703               );
 704   if (EFI_ERROR (Status)) {
 705     return Status;
 706   }
 707
 708   //
 709   // Check "SecureBootEnable" variable's existence. It can enable/disable secure boot feature.
 710   //
 711   Status = FindVariable (
 712              EFI_SECURE_BOOT_ENABLE_NAME,
 713              &gEfiSecureBootEnableDisableGuid,
 714              &Variable,
 715              &mVariableModuleGlobal->VariableGlobal,
 716              FALSE
 717              );
 718
 719   if (SecureBootMode == SECURE_BOOT_MODE_ENABLE) {
 720     //
 721     // Create the "SecureBootEnable" variable as secure boot is enabled.
 722     //
 723     SecureBootEnable = SECURE_BOOT_ENABLE;
 724     VariableDataSize = sizeof (SecureBootEnable);
 725   } else {
 726     //
 727     // Delete the "SecureBootEnable" variable if this variable exist as "SecureBoot"
 728     // variable is not in secure boot state.
 729     //
 730     if (Variable.CurrPtr == NULL || EFI_ERROR (Status)) {
 731       return EFI_SUCCESS;
 732     }
 733     SecureBootEnable = SECURE_BOOT_DISABLE;
 734     VariableDataSize = 0;
 735   }
 736
 737   Status = UpdateVariable (
 738              EFI_SECURE_BOOT_ENABLE_NAME,
 739              &gEfiSecureBootEnableDisableGuid,
 740              &SecureBootEnable,
 741              VariableDataSize,
 742              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 743              0,
 744              0,
 745              &Variable,
 746              NULL
 747              );
 748   return Status;
 749 }
 750
 751 /**
 752   Check input data form to make sure it is a valid EFI_SIGNATURE_LIST for PK/KEK/db/dbx variable.
 753
 754   @param[in]  VariableName                Name of Variable to be check.
 755   @param[in]  VendorGuid                  Variable vendor GUID.
 756   @param[in]  Data                        Point to the variable data to be checked.
 757   @param[in]  DataSize                    Size of Data.
 758
 759   @return EFI_INVALID_PARAMETER           Invalid signature list format.
 760   @return EFI_SUCCESS                     Passed signature list format check successfully.
 761
 762 **/
 763 EFI_STATUS
 764 CheckSignatureListFormat(
 765   IN  CHAR16                    *VariableName,
 766   IN  EFI_GUID                  *VendorGuid,
 767   IN  VOID                      *Data,
 768   IN  UINTN                     DataSize
 769   )
 770 {
 771   EFI_SIGNATURE_LIST     *SigList;
 772   UINTN                  SigDataSize;
 773   UINT32                 Index;
 774   UINT32                 SigCount;
 775   BOOLEAN                IsPk;
 776   VOID                   *RsaContext;
 777   EFI_SIGNATURE_DATA     *CertData;
 778   UINTN                  CertLen;
 779
 780   if (DataSize == 0) {
 781     return EFI_SUCCESS;
 782   }
 783
 784   ASSERT (VariableName != NULL && VendorGuid != NULL && Data != NULL);
 785
 786   if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_PLATFORM_KEY_NAME) == 0)){
 787     IsPk = TRUE;
 788   } else if ((CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0) ||
 789              (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&
 790               (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0 || StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0))){
 791     IsPk = FALSE;
 792   } else {
 793     return EFI_SUCCESS;
 794   }
 795
 796   SigCount = 0;
 797   SigList  = (EFI_SIGNATURE_LIST *) Data;
 798   SigDataSize  = DataSize;
 799   RsaContext = NULL;
 800
 801   //
 802   // Walk throuth the input signature list and check the data format.
 803   // If any signature is incorrectly formed, the whole check will fail.
 804   //
 805   while ((SigDataSize > 0) && (SigDataSize >= SigList->SignatureListSize)) {
 806     for (Index = 0; Index < (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM)); Index++ ) {
 807       if (CompareGuid (&SigList->SignatureType, &mSupportSigItem[Index].SigType)) {
 808         //
 809         // The value of SignatureSize should always be 16 (size of SignatureOwner
 810         // component) add the data length according to signature type.
 811         //
 812         if (mSupportSigItem[Index].SigDataSize != ((UINT32) ~0) &&
 813           (SigList->SignatureSize - sizeof (EFI_GUID)) != mSupportSigItem[Index].SigDataSize) {
 814           return EFI_INVALID_PARAMETER;
 815         }
 816         if (mSupportSigItem[Index].SigHeaderSize != ((UINTN) ~0) &&
 817           SigList->SignatureHeaderSize != mSupportSigItem[Index].SigHeaderSize) {
 818           return EFI_INVALID_PARAMETER;
 819         }
 820         break;
 821       }
 822     }
 823
 824     if (Index == (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM))) {
 825       //
 826       // Undefined signature type.
 827       //
 828       return EFI_INVALID_PARAMETER;
 829     }
 830
 831     if (CompareGuid (&SigList->SignatureType, &gEfiCertX509Guid)) {
 832       //
 833       // Try to retrieve the RSA public key from the X.509 certificate.
 834       // If this operation fails, it's not a valid certificate.
 835       //
 836       RsaContext = RsaNew ();
 837       if (RsaContext == NULL) {
 838         return EFI_INVALID_PARAMETER;
 839       }
 840       CertData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigList + sizeof (EFI_SIGNATURE_LIST) + SigList->SignatureHeaderSize);
 841       CertLen = SigList->SignatureSize - sizeof (EFI_GUID);
 842       if (!RsaGetPublicKeyFromX509 (CertData->SignatureData, CertLen, &RsaContext)) {
 843         RsaFree (RsaContext);
 844         return EFI_INVALID_PARAMETER;
 845       }
 846       RsaFree (RsaContext);
 847     }
 848
 849     if ((SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) % SigList->SignatureSize != 0) {
 850       return EFI_INVALID_PARAMETER;
 851     }
 852     SigCount += (SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) / SigList->SignatureSize;
 853
 854     SigDataSize -= SigList->SignatureListSize;
 855     SigList = (EFI_SIGNATURE_LIST *) ((UINT8 *) SigList + SigList->SignatureListSize);
 856   }
 857
 858   if (((UINTN) SigList - (UINTN) Data) != DataSize) {
 859     return EFI_INVALID_PARAMETER;
 860   }
 861
 862   if (IsPk && SigCount > 1) {
 863     return EFI_INVALID_PARAMETER;
 864   }
 865
 866   return EFI_SUCCESS;
 867 }
 868
 869 /**
 870   Process variable with platform key for verification.
 871
 872   Caution: This function may receive untrusted input.
 873   This function may be invoked in SMM mode, and datasize and data are external input.
 874   This function will do basic validation, before parse the data.
 875   This function will parse the authentication carefully to avoid security issues, like
 876   buffer overflow, integer overflow.
 877   This function will check attribute carefully to avoid authentication bypass.
 878
 879   @param[in]  VariableName                Name of Variable to be found.
 880   @param[in]  VendorGuid                  Variable vendor GUID.
 881   @param[in]  Data                        Data pointer.
 882   @param[in]  DataSize                    Size of Data found. If size is less than the
 883                                           data, this value contains the required size.
 884   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
 885   @param[in]  Attributes                  Attribute value of the variable
 886   @param[in]  IsPk                        Indicate whether it is to process pk.
 887
 888   @return EFI_INVALID_PARAMETER           Invalid parameter.
 889   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation.
 890                                           check carried out by the firmware.
 891   @return EFI_SUCCESS                     Variable passed validation successfully.
 892
 893 **/
 894 EFI_STATUS
 895 ProcessVarWithPk (
 896   IN  CHAR16                    *VariableName,
 897   IN  EFI_GUID                  *VendorGuid,
 898   IN  VOID                      *Data,
 899   IN  UINTN                     DataSize,
 900   IN  VARIABLE_POINTER_TRACK    *Variable,
 901   IN  UINT32                    Attributes OPTIONAL,
 902   IN  BOOLEAN                   IsPk
 903   )
 904 {
 905   EFI_STATUS                  Status;
 906   BOOLEAN                     Del;
 907   UINT8                       *Payload;
 908   UINTN                       PayloadSize;
 909
 910   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
 911       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
 912     //
 913     // PK, KEK and db/dbx should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
 914     // authenticated variable.
 915     //
 916     return EFI_INVALID_PARAMETER;
 917   }
 918
 919   Del = FALSE;
 920   if ((InCustomMode() && UserPhysicalPresent()) || (mPlatformMode == SETUP_MODE && !IsPk)) {
 921     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
 922     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
 923     if (PayloadSize == 0) {
 924       Del = TRUE;
 925     }
 926
 927     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
 928     if (EFI_ERROR (Status)) {
 929       return Status;
 930     }
 931
 932     Status = UpdateVariable (
 933                VariableName,
 934                VendorGuid,
 935                Payload,
 936                PayloadSize,
 937                Attributes,
 938                0,
 939                0,
 940                Variable,
 941                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
 942                );
 943   } else if (mPlatformMode == USER_MODE) {
 944     //
 945     // Verify against X509 Cert in PK database.
 946     //
 947     Status = VerifyTimeBasedPayload (
 948                VariableName,
 949                VendorGuid,
 950                Data,
 951                DataSize,
 952                Variable,
 953                Attributes,
 954                AuthVarTypePk,
 955                &Del
 956                );
 957   } else {
 958     //
 959     // Verify against the certificate in data payload.
 960     //
 961     Status = VerifyTimeBasedPayload (
 962                VariableName,
 963                VendorGuid,
 964                Data,
 965                DataSize,
 966                Variable,
 967                Attributes,
 968                AuthVarTypePayload,
 969                &Del
 970                );
 971   }
 972
 973   if (!EFI_ERROR(Status) && IsPk) {
 974     if (mPlatformMode == SETUP_MODE && !Del) {
 975       //
 976       // If enroll PK in setup mode, need change to user mode.
 977       //
 978       Status = UpdatePlatformMode (USER_MODE);
 979     } else if (mPlatformMode == USER_MODE && Del){
 980       //
 981       // If delete PK in user mode, need change to setup mode.
 982       //
 983       Status = UpdatePlatformMode (SETUP_MODE);
 984     }
 985   }
 986
 987   return Status;
 988 }
 989
 990 /**
 991   Process variable with key exchange key for verification.
 992
 993   Caution: This function may receive untrusted input.
 994   This function may be invoked in SMM mode, and datasize and data are external input.
 995   This function will do basic validation, before parse the data.
 996   This function will parse the authentication carefully to avoid security issues, like
 997   buffer overflow, integer overflow.
 998   This function will check attribute carefully to avoid authentication bypass.
 999
1000   @param[in]  VariableName                Name of Variable to be found.
1001   @param[in]  VendorGuid                  Variable vendor GUID.
1002   @param[in]  Data                        Data pointer.
1003   @param[in]  DataSize                    Size of Data found. If size is less than the
1004                                           data, this value contains the required size.
1005   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1006   @param[in]  Attributes                  Attribute value of the variable.
1007
1008   @return EFI_INVALID_PARAMETER           Invalid parameter.
1009   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
1010                                           check carried out by the firmware.
1011   @return EFI_SUCCESS                     Variable pass validation successfully.
1012
1013 **/
1014 EFI_STATUS
1015 ProcessVarWithKek (
1016   IN  CHAR16                               *VariableName,
1017   IN  EFI_GUID                             *VendorGuid,
1018   IN  VOID                                 *Data,
1019   IN  UINTN                                DataSize,
1020   IN  VARIABLE_POINTER_TRACK               *Variable,
1021   IN  UINT32                               Attributes OPTIONAL
1022   )
1023 {
1024   EFI_STATUS                      Status;
1025   UINT8                           *Payload;
1026   UINTN                           PayloadSize;
1027
1028   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1029       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1030     //
1031     // DB and DBX should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1032     // authenticated variable.
1033     //
1034     return EFI_INVALID_PARAMETER;
1035   }
1036
1037   Status = EFI_SUCCESS;
1038   if (mPlatformMode == USER_MODE && !(InCustomMode() && UserPhysicalPresent())) {
1039     //
1040     // Time-based, verify against X509 Cert KEK.
1041     //
1042     return VerifyTimeBasedPayload (
1043              VariableName,
1044              VendorGuid,
1045              Data,
1046              DataSize,
1047              Variable,
1048              Attributes,
1049              AuthVarTypeKek,
1050              NULL
1051              );
1052   } else {
1053     //
1054     // If in setup mode or custom secure boot mode, no authentication needed.
1055     //
1056     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1057     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1058
1059     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
1060     if (EFI_ERROR (Status)) {
1061       return Status;
1062     }
1063
1064     Status = UpdateVariable (
1065                VariableName,
1066                VendorGuid,
1067                Payload,
1068                PayloadSize,
1069                Attributes,
1070                0,
1071                0,
1072                Variable,
1073                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1074                );
1075   }
1076
1077   return Status;
1078 }
1079
1080 /**
1081   Process variable with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS/EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
1082
1083   Caution: This function may receive untrusted input.
1084   This function may be invoked in SMM mode, and datasize and data are external input.
1085   This function will do basic validation, before parse the data.
1086   This function will parse the authentication carefully to avoid security issues, like
1087   buffer overflow, integer overflow.
1088   This function will check attribute carefully to avoid authentication bypass.
1089
1090   @param[in]  VariableName                Name of Variable to be found.
1091   @param[in]  VendorGuid                  Variable vendor GUID.
1092
1093   @param[in]  Data                        Data pointer.
1094   @param[in]  DataSize                    Size of Data found. If size is less than the
1095                                           data, this value contains the required size.
1096   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1097   @param[in]  Attributes                  Attribute value of the variable.
1098
1099   @return EFI_INVALID_PARAMETER           Invalid parameter.
1100   @return EFI_WRITE_PROTECTED             Variable is write-protected and needs authentication with
1101                                           EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1102   @return EFI_SECURITY_VIOLATION          The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
1103                                           set, but the AuthInfo does NOT pass the validation
1104                                           check carried out by the firmware.
1105   @return EFI_SUCCESS                     Variable is not write-protected or pass validation successfully.
1106
1107 **/
1108 EFI_STATUS
1109 ProcessVariable (
1110   IN     CHAR16                             *VariableName,
1111   IN     EFI_GUID                           *VendorGuid,
1112   IN     VOID                               *Data,
1113   IN     UINTN                              DataSize,
1114   IN     VARIABLE_POINTER_TRACK             *Variable,
1115   IN     UINT32                             Attributes
1116   )
1117 {
1118   EFI_STATUS                      Status;
1119   BOOLEAN                         IsDeletion;
1120   BOOLEAN                         IsFirstTime;
1121   UINT8                           *PubKey;
1122   EFI_VARIABLE_AUTHENTICATION     *CertData;
1123   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
1124   UINT32                          KeyIndex;
1125   UINT64                          MonotonicCount;
1126
1127   KeyIndex    = 0;
1128   CertData    = NULL;
1129   CertBlock   = NULL;
1130   PubKey      = NULL;
1131   IsDeletion  = FALSE;
1132
1133   if (NeedPhysicallyPresent(VariableName, VendorGuid) && !UserPhysicalPresent()) {
1134     //
1135     // This variable is protected, only physical present user could modify its value.
1136     //
1137     return EFI_SECURITY_VIOLATION;
1138   }
1139
1140   //
1141   // Process Time-based Authenticated variable.
1142   //
1143   if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1144     return VerifyTimeBasedPayload (
1145              VariableName,
1146              VendorGuid,
1147              Data,
1148              DataSize,
1149              Variable,
1150              Attributes,
1151              AuthVarTypePriv,
1152              NULL
1153              );
1154   }
1155
1156   //
1157   // Determine if first time SetVariable with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS.
1158   //
1159   if ((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) {
1160     //
1161     // Determine current operation type.
1162     //
1163     if (DataSize == AUTHINFO_SIZE) {
1164       IsDeletion = TRUE;
1165     }
1166     //
1167     // Determine whether this is the first time with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1168     //
1169     if (Variable->CurrPtr == NULL) {
1170       IsFirstTime = TRUE;
1171     } else if ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) == 0) {
1172       IsFirstTime = TRUE;
1173     } else {
1174       KeyIndex   = Variable->CurrPtr->PubKeyIndex;
1175       IsFirstTime = FALSE;
1176     }
1177   } else if ((Variable->CurrPtr != NULL) &&
1178              ((Variable->CurrPtr->Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)
1179             ) {
1180     //
1181     // If the variable is already write-protected, it always needs authentication before update.
1182     //
1183     return EFI_WRITE_PROTECTED;
1184   } else {
1185     //
1186     // If without EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS, set and attributes collision.
1187     // That means it is not authenticated variable, just update variable as usual.
1188     //
1189     Status = UpdateVariable (VariableName, VendorGuid, Data, DataSize, Attributes, 0, 0, Variable, NULL);
1190     return Status;
1191   }
1192
1193   //
1194   // Get PubKey and check Monotonic Count value corresponding to the variable.
1195   //
1196   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
1197   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
1198   PubKey    = CertBlock->PublicKey;
1199
1200   //
1201   // Update Monotonic Count value.
1202   //
1203   MonotonicCount = CertData->MonotonicCount;
1204
1205   if (!IsFirstTime) {
1206     //
1207     // Check input PubKey.
1208     //
1209     if (CompareMem (PubKey, mPubKeyStore + (KeyIndex - 1) * EFI_CERT_TYPE_RSA2048_SIZE, EFI_CERT_TYPE_RSA2048_SIZE) != 0) {
1210       return EFI_SECURITY_VIOLATION;
1211     }
1212     //
1213     // Compare the current monotonic count and ensure that it is greater than the last SetVariable
1214     // operation with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS attribute set.
1215     //
1216     if (CertData->MonotonicCount <= Variable->CurrPtr->MonotonicCount) {
1217       //
1218       // Monotonic count check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
1219       //
1220       return EFI_SECURITY_VIOLATION;
1221     }
1222   }
1223   //
1224   // Verify the certificate in Data payload.
1225   //
1226   Status = VerifyCounterBasedPayload (Data, DataSize, PubKey);
1227   if (EFI_ERROR (Status)) {
1228     return Status;
1229   }
1230
1231   //
1232   // Now, the signature has been verified!
1233   //
1234   if (IsFirstTime && !IsDeletion) {
1235     //
1236     // Update public key database variable if need.
1237     //
1238     KeyIndex = AddPubKeyInStore (PubKey);
1239     if (KeyIndex == 0) {
1240       return EFI_SECURITY_VIOLATION;
1241     }
1242   }
1243
1244   //
1245   // Verification pass.
1246   //
1247   return UpdateVariable (VariableName, VendorGuid, (UINT8*)Data + AUTHINFO_SIZE, DataSize - AUTHINFO_SIZE, Attributes, KeyIndex, MonotonicCount, Variable, NULL);
1248 }
1249
1250 /**
1251   Merge two buffers which formatted as EFI_SIGNATURE_LIST. Only the new EFI_SIGNATURE_DATA
1252   will be appended to the original EFI_SIGNATURE_LIST, duplicate EFI_SIGNATURE_DATA
1253   will be ignored.
1254
1255   @param[in, out]  Data            Pointer to original EFI_SIGNATURE_LIST.
1256   @param[in]       DataSize        Size of Data buffer.
1257   @param[in]       NewData         Pointer to new EFI_SIGNATURE_LIST to be appended.
1258   @param[in]       NewDataSize     Size of NewData buffer.
1259
1260   @return Size of the merged buffer.
1261
1262 **/
1263 UINTN
1264 AppendSignatureList (
1265   IN  OUT VOID            *Data,
1266   IN  UINTN               DataSize,
1267   IN  VOID                *NewData,
1268   IN  UINTN               NewDataSize
1269   )
1270 {
1271   EFI_SIGNATURE_LIST  *CertList;
1272   EFI_SIGNATURE_DATA  *Cert;
1273   UINTN               CertCount;
1274   EFI_SIGNATURE_LIST  *NewCertList;
1275   EFI_SIGNATURE_DATA  *NewCert;
1276   UINTN               NewCertCount;
1277   UINTN               Index;
1278   UINTN               Index2;
1279   UINTN               Size;
1280   UINT8               *Tail;
1281   UINTN               CopiedCount;
1282   UINTN               SignatureListSize;
1283   BOOLEAN             IsNewCert;
1284
1285   Tail = (UINT8 *) Data + DataSize;
1286
1287   NewCertList = (EFI_SIGNATURE_LIST *) NewData;
1288   while ((NewDataSize > 0) && (NewDataSize >= NewCertList->SignatureListSize)) {
1289     NewCert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCertList + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1290     NewCertCount = (NewCertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - NewCertList->SignatureHeaderSize) / NewCertList->SignatureSize;
1291
1292     CopiedCount = 0;
1293     for (Index = 0; Index < NewCertCount; Index++) {
1294       IsNewCert = TRUE;
1295
1296       Size = DataSize;
1297       CertList = (EFI_SIGNATURE_LIST *) Data;
1298       while ((Size > 0) && (Size >= CertList->SignatureListSize)) {
1299         if (CompareGuid (&CertList->SignatureType, &NewCertList->SignatureType) &&
1300            (CertList->SignatureSize == NewCertList->SignatureSize)) {
1301           Cert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
1302           CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
1303           for (Index2 = 0; Index2 < CertCount; Index2++) {
1304             //
1305             // Iterate each Signature Data in this Signature List.
1306             //
1307             if (CompareMem (NewCert, Cert, CertList->SignatureSize) == 0) {
1308               IsNewCert = FALSE;
1309               break;
1310             }
1311             Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
1312           }
1313         }
1314
1315         if (!IsNewCert) {
1316           break;
1317         }
1318         Size -= CertList->SignatureListSize;
1319         CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
1320       }
1321
1322       if (IsNewCert) {
1323         //
1324         // New EFI_SIGNATURE_DATA, append it.
1325         //
1326         if (CopiedCount == 0) {
1327           //
1328           // Copy EFI_SIGNATURE_LIST header for only once.
1329           //
1330           CopyMem (Tail, NewCertList, sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1331           Tail = Tail + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1332         }
1333
1334         CopyMem (Tail, NewCert, NewCertList->SignatureSize);
1335         Tail += NewCertList->SignatureSize;
1336         CopiedCount++;
1337       }
1338
1339       NewCert = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCert + NewCertList->SignatureSize);
1340     }
1341
1342     //
1343     // Update SignatureListSize in newly appended EFI_SIGNATURE_LIST.
1344     //
1345     if (CopiedCount != 0) {
1346       SignatureListSize = sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize + (CopiedCount * NewCertList->SignatureSize);
1347       CertList = (EFI_SIGNATURE_LIST *) (Tail - SignatureListSize);
1348       CertList->SignatureListSize = (UINT32) SignatureListSize;
1349     }
1350
1351     NewDataSize -= NewCertList->SignatureListSize;
1352     NewCertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) NewCertList + NewCertList->SignatureListSize);
1353   }
1354
1355   return (Tail - (UINT8 *) Data);
1356 }
1357
1358 /**
1359   Compare two EFI_TIME data.
1360
1361
1362   @param FirstTime           A pointer to the first EFI_TIME data.
1363   @param SecondTime          A pointer to the second EFI_TIME data.
1364
1365   @retval  TRUE              The FirstTime is not later than the SecondTime.
1366   @retval  FALSE             The FirstTime is later than the SecondTime.
1367
1368 **/
1369 BOOLEAN
1370 CompareTimeStamp (
1371   IN EFI_TIME               *FirstTime,
1372   IN EFI_TIME               *SecondTime
1373   )
1374 {
1375   if (FirstTime->Year != SecondTime->Year) {
1376     return (BOOLEAN) (FirstTime->Year < SecondTime->Year);
1377   } else if (FirstTime->Month != SecondTime->Month) {
1378     return (BOOLEAN) (FirstTime->Month < SecondTime->Month);
1379   } else if (FirstTime->Day != SecondTime->Day) {
1380     return (BOOLEAN) (FirstTime->Day < SecondTime->Day);
1381   } else if (FirstTime->Hour != SecondTime->Hour) {
1382     return (BOOLEAN) (FirstTime->Hour < SecondTime->Hour);
1383   } else if (FirstTime->Minute != SecondTime->Minute) {
1384     return (BOOLEAN) (FirstTime->Minute < SecondTime->Minute);
1385   }
1386
1387   return (BOOLEAN) (FirstTime->Second <= SecondTime->Second);
1388 }
1389
1390 /**
1391   Find matching signer's certificates for common authenticated variable
1392   by corresponding VariableName and VendorGuid from "certdb".
1393
1394   The data format of "certdb":
1395   //
1396   //     UINT32 CertDbListSize;
1397   // /// AUTH_CERT_DB_DATA Certs1[];
1398   // /// AUTH_CERT_DB_DATA Certs2[];
1399   // /// ...
1400   // /// AUTH_CERT_DB_DATA Certsn[];
1401   //
1402
1403   @param[in]  VariableName   Name of authenticated Variable.
1404   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1405   @param[in]  Data           Pointer to variable "certdb".
1406   @param[in]  DataSize       Size of variable "certdb".
1407   @param[out] CertOffset     Offset of matching CertData, from starting of Data.
1408   @param[out] CertDataSize   Length of CertData in bytes.
1409   @param[out] CertNodeOffset Offset of matching AUTH_CERT_DB_DATA , from
1410                              starting of Data.
1411   @param[out] CertNodeSize   Length of AUTH_CERT_DB_DATA in bytes.
1412
1413   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1414   @retval  EFI_NOT_FOUND         Fail to find matching certs.
1415   @retval  EFI_SUCCESS           Find matching certs and output parameters.
1416
1417 **/
1418 EFI_STATUS
1419 FindCertsFromDb (
1420   IN     CHAR16           *VariableName,
1421   IN     EFI_GUID         *VendorGuid,
1422   IN     UINT8            *Data,
1423   IN     UINTN            DataSize,
1424   OUT    UINT32           *CertOffset,    OPTIONAL
1425   OUT    UINT32           *CertDataSize,  OPTIONAL
1426   OUT    UINT32           *CertNodeOffset,OPTIONAL
1427   OUT    UINT32           *CertNodeSize   OPTIONAL
1428   )
1429 {
1430   UINT32                  Offset;
1431   AUTH_CERT_DB_DATA       *Ptr;
1432   UINT32                  CertSize;
1433   UINT32                  NameSize;
1434   UINT32                  NodeSize;
1435   UINT32                  CertDbListSize;
1436
1437   if ((VariableName == NULL) || (VendorGuid == NULL) || (Data == NULL)) {
1438     return EFI_INVALID_PARAMETER;
1439   }
1440
1441   //
1442   // Check whether DataSize matches recorded CertDbListSize.
1443   //
1444   if (DataSize < sizeof (UINT32)) {
1445     return EFI_INVALID_PARAMETER;
1446   }
1447
1448   CertDbListSize = ReadUnaligned32 ((UINT32 *) Data);
1449
1450   if (CertDbListSize != (UINT32) DataSize) {
1451     return EFI_INVALID_PARAMETER;
1452   }
1453
1454   Offset = sizeof (UINT32);
1455
1456   //
1457   // Get corresponding certificates by VendorGuid and VariableName.
1458   //
1459   while (Offset < (UINT32) DataSize) {
1460     Ptr = (AUTH_CERT_DB_DATA *) (Data + Offset);
1461     //
1462     // Check whether VendorGuid matches.
1463     //
1464     if (CompareGuid (&Ptr->VendorGuid, VendorGuid)) {
1465       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1466       NameSize = ReadUnaligned32 (&Ptr->NameSize);
1467       CertSize = ReadUnaligned32 (&Ptr->CertDataSize);
1468
1469       if (NodeSize != sizeof (EFI_GUID) + sizeof (UINT32) * 3 + CertSize +
1470           sizeof (CHAR16) * NameSize) {
1471         return EFI_INVALID_PARAMETER;
1472       }
1473
1474       Offset = Offset + sizeof (EFI_GUID) + sizeof (UINT32) * 3;
1475       //
1476       // Check whether VariableName matches.
1477       //
1478       if ((NameSize == StrLen (VariableName)) &&
1479           (CompareMem (Data + Offset, VariableName, NameSize * sizeof (CHAR16)) == 0)) {
1480         Offset = Offset + NameSize * sizeof (CHAR16);
1481
1482         if (CertOffset != NULL) {
1483           *CertOffset = Offset;
1484         }
1485
1486         if (CertDataSize != NULL) {
1487           *CertDataSize = CertSize;
1488         }
1489
1490         if (CertNodeOffset != NULL) {
1491           *CertNodeOffset = (UINT32) ((UINT8 *) Ptr - Data);
1492         }
1493
1494         if (CertNodeSize != NULL) {
1495           *CertNodeSize = NodeSize;
1496         }
1497
1498         return EFI_SUCCESS;
1499       } else {
1500         Offset = Offset + NameSize * sizeof (CHAR16) + CertSize;
1501       }
1502     } else {
1503       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1504       Offset   = Offset + NodeSize;
1505     }
1506   }
1507
1508   return EFI_NOT_FOUND;
1509 }
1510
1511 /**
1512   Retrieve signer's certificates for common authenticated variable
1513   by corresponding VariableName and VendorGuid from "certdb".
1514
1515   @param[in]  VariableName   Name of authenticated Variable.
1516   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1517   @param[out] CertData       Pointer to signer's certificates.
1518   @param[out] CertDataSize   Length of CertData in bytes.
1519
1520   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1521   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1522   @retval  EFI_SUCCESS           Get signer's certificates successfully.
1523
1524 **/
1525 EFI_STATUS
1526 GetCertsFromDb (
1527   IN     CHAR16           *VariableName,
1528   IN     EFI_GUID         *VendorGuid,
1529   OUT    UINT8            **CertData,
1530   OUT    UINT32           *CertDataSize
1531   )
1532 {
1533   VARIABLE_POINTER_TRACK  CertDbVariable;
1534   EFI_STATUS              Status;
1535   UINT8                   *Data;
1536   UINTN                   DataSize;
1537   UINT32                  CertOffset;
1538
1539   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL) || (CertDataSize == NULL)) {
1540     return EFI_INVALID_PARAMETER;
1541   }
1542
1543   //
1544   // Get variable "certdb".
1545   //
1546   Status = FindVariable (
1547              EFI_CERT_DB_NAME,
1548              &gEfiCertDbGuid,
1549              &CertDbVariable,
1550              &mVariableModuleGlobal->VariableGlobal,
1551              FALSE
1552              );
1553   if (EFI_ERROR (Status)) {
1554     return Status;
1555   }
1556
1557   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1558   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1559   if ((DataSize == 0) || (Data == NULL)) {
1560     ASSERT (FALSE);
1561     return EFI_NOT_FOUND;
1562   }
1563
1564   Status = FindCertsFromDb (
1565              VariableName,
1566              VendorGuid,
1567              Data,
1568              DataSize,
1569              &CertOffset,
1570              CertDataSize,
1571              NULL,
1572              NULL
1573              );
1574
1575   if (EFI_ERROR (Status)) {
1576     return Status;
1577   }
1578
1579   *CertData = Data + CertOffset;
1580   return EFI_SUCCESS;
1581 }
1582
1583 /**
1584   Delete matching signer's certificates when deleting common authenticated
1585   variable by corresponding VariableName and VendorGuid from "certdb".
1586
1587   @param[in]  VariableName   Name of authenticated Variable.
1588   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1589
1590   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1591   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1592   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
1593   @retval  EFI_SUCCESS           The operation is completed successfully.
1594
1595 **/
1596 EFI_STATUS
1597 DeleteCertsFromDb (
1598   IN     CHAR16           *VariableName,
1599   IN     EFI_GUID         *VendorGuid
1600   )
1601 {
1602   VARIABLE_POINTER_TRACK  CertDbVariable;
1603   EFI_STATUS              Status;
1604   UINT8                   *Data;
1605   UINTN                   DataSize;
1606   UINT32                  VarAttr;
1607   UINT32                  CertNodeOffset;
1608   UINT32                  CertNodeSize;
1609   UINT8                   *NewCertDb;
1610   UINT32                  NewCertDbSize;
1611
1612   if ((VariableName == NULL) || (VendorGuid == NULL)) {
1613     return EFI_INVALID_PARAMETER;
1614   }
1615
1616   //
1617   // Get variable "certdb".
1618   //
1619   Status = FindVariable (
1620              EFI_CERT_DB_NAME,
1621              &gEfiCertDbGuid,
1622              &CertDbVariable,
1623              &mVariableModuleGlobal->VariableGlobal,
1624              FALSE
1625              );
1626   if (EFI_ERROR (Status)) {
1627     return Status;
1628   }
1629
1630   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1631   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1632   if ((DataSize == 0) || (Data == NULL)) {
1633     ASSERT (FALSE);
1634     return EFI_NOT_FOUND;
1635   }
1636
1637   if (DataSize == sizeof (UINT32)) {
1638     //
1639     // There is no certs in certdb.
1640     //
1641     return EFI_SUCCESS;
1642   }
1643
1644   //
1645   // Get corresponding cert node from certdb.
1646   //
1647   Status = FindCertsFromDb (
1648              VariableName,
1649              VendorGuid,
1650              Data,
1651              DataSize,
1652              NULL,
1653              NULL,
1654              &CertNodeOffset,
1655              &CertNodeSize
1656              );
1657
1658   if (EFI_ERROR (Status)) {
1659     return Status;
1660   }
1661
1662   if (DataSize < (CertNodeOffset + CertNodeSize)) {
1663     return EFI_NOT_FOUND;
1664   }
1665
1666   //
1667   // Construct new data content of variable "certdb".
1668   //
1669   NewCertDbSize = (UINT32) DataSize - CertNodeSize;
1670   NewCertDb     = (UINT8*) mCertDbStore;
1671
1672   //
1673   // Copy the DB entries before deleting node.
1674   //
1675   CopyMem (NewCertDb, Data, CertNodeOffset);
1676   //
1677   // Update CertDbListSize.
1678   //
1679   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
1680   //
1681   // Copy the DB entries after deleting node.
1682   //
1683   if (DataSize > (CertNodeOffset + CertNodeSize)) {
1684     CopyMem (
1685       NewCertDb + CertNodeOffset,
1686       Data + CertNodeOffset + CertNodeSize,
1687       DataSize - CertNodeOffset - CertNodeSize
1688       );
1689   }
1690
1691   //
1692   // Set "certdb".
1693   //
1694   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
1695   Status   = UpdateVariable (
1696                EFI_CERT_DB_NAME,
1697                &gEfiCertDbGuid,
1698                NewCertDb,
1699                NewCertDbSize,
1700                VarAttr,
1701                0,
1702                0,
1703                &CertDbVariable,
1704                NULL
1705                );
1706
1707   return Status;
1708 }
1709
1710 /**
1711   Insert signer's certificates for common authenticated variable with VariableName
1712   and VendorGuid in AUTH_CERT_DB_DATA to "certdb".
1713
1714   @param[in]  VariableName   Name of authenticated Variable.
1715   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1716   @param[in]  CertData       Pointer to signer's certificates.
1717   @param[in]  CertDataSize   Length of CertData in bytes.
1718
1719   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1720   @retval  EFI_ACCESS_DENIED     An AUTH_CERT_DB_DATA entry with same VariableName
1721                                  and VendorGuid already exists.
1722   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
1723   @retval  EFI_SUCCESS           Insert an AUTH_CERT_DB_DATA entry to "certdb"
1724
1725 **/
1726 EFI_STATUS
1727 InsertCertsToDb (
1728   IN     CHAR16           *VariableName,
1729   IN     EFI_GUID         *VendorGuid,
1730   IN     UINT8            *CertData,
1731   IN     UINTN            CertDataSize
1732   )
1733 {
1734   VARIABLE_POINTER_TRACK  CertDbVariable;
1735   EFI_STATUS              Status;
1736   UINT8                   *Data;
1737   UINTN                   DataSize;
1738   UINT32                  VarAttr;
1739   UINT8                   *NewCertDb;
1740   UINT32                  NewCertDbSize;
1741   UINT32                  CertNodeSize;
1742   UINT32                  NameSize;
1743   AUTH_CERT_DB_DATA       *Ptr;
1744
1745   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL)) {
1746     return EFI_INVALID_PARAMETER;
1747   }
1748
1749   //
1750   // Get variable "certdb".
1751   //
1752   Status = FindVariable (
1753              EFI_CERT_DB_NAME,
1754              &gEfiCertDbGuid,
1755              &CertDbVariable,
1756              &mVariableModuleGlobal->VariableGlobal,
1757              FALSE
1758              );
1759   if (EFI_ERROR (Status)) {
1760     return Status;
1761   }
1762
1763   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1764   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1765   if ((DataSize == 0) || (Data == NULL)) {
1766     ASSERT (FALSE);
1767     return EFI_NOT_FOUND;
1768   }
1769
1770   //
1771   // Find whether matching cert node already exists in "certdb".
1772   // If yes return error.
1773   //
1774   Status = FindCertsFromDb (
1775              VariableName,
1776              VendorGuid,
1777              Data,
1778              DataSize,
1779              NULL,
1780              NULL,
1781              NULL,
1782              NULL
1783              );
1784
1785   if (!EFI_ERROR (Status)) {
1786     ASSERT (FALSE);
1787     return EFI_ACCESS_DENIED;
1788   }
1789
1790   //
1791   // Construct new data content of variable "certdb".
1792   //
1793   NameSize      = (UINT32) StrLen (VariableName);
1794   CertNodeSize  = sizeof (AUTH_CERT_DB_DATA) + (UINT32) CertDataSize + NameSize * sizeof (CHAR16);
1795   NewCertDbSize = (UINT32) DataSize + CertNodeSize;
1796   if (NewCertDbSize > MAX_CERTDB_SIZE) {
1797     return EFI_OUT_OF_RESOURCES;
1798   }
1799   NewCertDb     = (UINT8*) mCertDbStore;
1800
1801   //
1802   // Copy the DB entries before deleting node.
1803   //
1804   CopyMem (NewCertDb, Data, DataSize);
1805   //
1806   // Update CertDbListSize.
1807   //
1808   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
1809   //
1810   // Construct new cert node.
1811   //
1812   Ptr = (AUTH_CERT_DB_DATA *) (NewCertDb + DataSize);
1813   CopyGuid (&Ptr->VendorGuid, VendorGuid);
1814   CopyMem (&Ptr->CertNodeSize, &CertNodeSize, sizeof (UINT32));
1815   CopyMem (&Ptr->NameSize, &NameSize, sizeof (UINT32));
1816   CopyMem (&Ptr->CertDataSize, &CertDataSize, sizeof (UINT32));
1817
1818   CopyMem (
1819     (UINT8 *) Ptr + sizeof (AUTH_CERT_DB_DATA),
1820     VariableName,
1821     NameSize * sizeof (CHAR16)
1822     );
1823
1824   CopyMem (
1825     (UINT8 *) Ptr +  sizeof (AUTH_CERT_DB_DATA) + NameSize * sizeof (CHAR16),
1826     CertData,
1827     CertDataSize
1828     );
1829
1830   //
1831   // Set "certdb".
1832   //
1833   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
1834   Status   = UpdateVariable (
1835                EFI_CERT_DB_NAME,
1836                &gEfiCertDbGuid,
1837                NewCertDb,
1838                NewCertDbSize,
1839                VarAttr,
1840                0,
1841                0,
1842                &CertDbVariable,
1843                NULL
1844                );
1845
1846   return Status;
1847 }
1848
1849 /**
1850   Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
1851
1852   Caution: This function may receive untrusted input.
1853   This function may be invoked in SMM mode, and datasize and data are external input.
1854   This function will do basic validation, before parse the data.
1855   This function will parse the authentication carefully to avoid security issues, like
1856   buffer overflow, integer overflow.
1857
1858   @param[in]  VariableName                Name of Variable to be found.
1859   @param[in]  VendorGuid                  Variable vendor GUID.
1860   @param[in]  Data                        Data pointer.
1861   @param[in]  DataSize                    Size of Data found. If size is less than the
1862                                           data, this value contains the required size.
1863   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1864   @param[in]  Attributes                  Attribute value of the variable.
1865   @param[in]  AuthVarType                 Verify against PK, KEK database, private database or certificate in data payload.
1866   @param[out] VarDel                      Delete the variable or not.
1867
1868   @retval EFI_INVALID_PARAMETER           Invalid parameter.
1869   @retval EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
1870                                           check carried out by the firmware.
1871   @retval EFI_OUT_OF_RESOURCES            Failed to process variable due to lack
1872                                           of resources.
1873   @retval EFI_SUCCESS                     Variable pass validation successfully.
1874
1875 **/
1876 EFI_STATUS
1877 VerifyTimeBasedPayload (
1878   IN     CHAR16                             *VariableName,
1879   IN     EFI_GUID                           *VendorGuid,
1880   IN     VOID                               *Data,
1881   IN     UINTN                              DataSize,
1882   IN     VARIABLE_POINTER_TRACK             *Variable,
1883   IN     UINT32                             Attributes,
1884   IN     AUTHVAR_TYPE                       AuthVarType,
1885   OUT    BOOLEAN                            *VarDel
1886   )
1887 {
1888   UINT8                            *RootCert;
1889   UINT8                            *SigData;
1890   UINT8                            *PayloadPtr;
1891   UINTN                            RootCertSize;
1892   UINTN                            Index;
1893   UINTN                            CertCount;
1894   UINTN                            PayloadSize;
1895   UINT32                           Attr;
1896   UINT32                           SigDataSize;
1897   UINT32                           KekDataSize;
1898   BOOLEAN                          VerifyStatus;
1899   EFI_STATUS                       Status;
1900   EFI_SIGNATURE_LIST               *CertList;
1901   EFI_SIGNATURE_DATA               *Cert;
1902   VARIABLE_POINTER_TRACK           KekVariable;
1903   EFI_VARIABLE_AUTHENTICATION_2    *CertData;
1904   UINT8                            *NewData;
1905   UINTN                            NewDataSize;
1906   VARIABLE_POINTER_TRACK           PkVariable;
1907   UINT8                            *Buffer;
1908   UINTN                            Length;
1909   UINT8                            *SignerCerts;
1910   UINT8                            *WrapSigData;
1911   UINTN                            CertStackSize;
1912   UINT8                            *CertsInCertDb;
1913   UINT32                           CertsSizeinDb;
1914
1915   VerifyStatus           = FALSE;
1916   CertData               = NULL;
1917   NewData                = NULL;
1918   Attr                   = Attributes;
1919   WrapSigData            = NULL;
1920   SignerCerts            = NULL;
1921   RootCert               = NULL;
1922
1923   //
1924   // When the attribute EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS is
1925   // set, then the Data buffer shall begin with an instance of a complete (and serialized)
1926   // EFI_VARIABLE_AUTHENTICATION_2 descriptor. The descriptor shall be followed by the new
1927   // variable value and DataSize shall reflect the combined size of the descriptor and the new
1928   // variable value. The authentication descriptor is not part of the variable data and is not
1929   // returned by subsequent calls to GetVariable().
1930   //
1931   CertData = (EFI_VARIABLE_AUTHENTICATION_2 *) Data;
1932
1933   //
1934   // Verify that Pad1, Nanosecond, TimeZone, Daylight and Pad2 components of the
1935   // TimeStamp value are set to zero.
1936   //
1937   if ((CertData->TimeStamp.Pad1 != 0) ||
1938       (CertData->TimeStamp.Nanosecond != 0) ||
1939       (CertData->TimeStamp.TimeZone != 0) ||
1940       (CertData->TimeStamp.Daylight != 0) ||
1941       (CertData->TimeStamp.Pad2 != 0)) {
1942     return EFI_SECURITY_VIOLATION;
1943   }
1944
1945   if ((Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
1946     if (CompareTimeStamp (&CertData->TimeStamp, &Variable->CurrPtr->TimeStamp)) {
1947       //
1948       // TimeStamp check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
1949       //
1950       return EFI_SECURITY_VIOLATION;
1951     }
1952   }
1953
1954   //
1955   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
1956   // Cert type should be EFI_CERT_TYPE_PKCS7_GUID.
1957   //
1958   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
1959       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertPkcs7Guid)) {
1960     //
1961     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
1962     //
1963     return EFI_SECURITY_VIOLATION;
1964   }
1965
1966   //
1967   // Find out Pkcs7 SignedData which follows the EFI_VARIABLE_AUTHENTICATION_2 descriptor.
1968   // AuthInfo.Hdr.dwLength is the length of the entire certificate, including the length of the header.
1969   //
1970   SigData = CertData->AuthInfo.CertData;
1971   SigDataSize = CertData->AuthInfo.Hdr.dwLength - (UINT32) (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData));
1972
1973   //
1974   // Find out the new data payload which follows Pkcs7 SignedData directly.
1975   //
1976   PayloadPtr = SigData + SigDataSize;
1977   PayloadSize = DataSize - OFFSET_OF_AUTHINFO2_CERT_DATA - (UINTN) SigDataSize;
1978
1979   //
1980   // Construct a buffer to fill with (VariableName, VendorGuid, Attributes, TimeStamp, Data).
1981   //
1982   NewDataSize = PayloadSize + sizeof (EFI_TIME) + sizeof (UINT32) +
1983                 sizeof (EFI_GUID) + StrSize (VariableName) - sizeof (CHAR16);
1984   NewData = mSerializationRuntimeBuffer;
1985
1986   Buffer = NewData;
1987   Length = StrLen (VariableName) * sizeof (CHAR16);
1988   CopyMem (Buffer, VariableName, Length);
1989   Buffer += Length;
1990
1991   Length = sizeof (EFI_GUID);
1992   CopyMem (Buffer, VendorGuid, Length);
1993   Buffer += Length;
1994
1995   Length = sizeof (UINT32);
1996   CopyMem (Buffer, &Attr, Length);
1997   Buffer += Length;
1998
1999   Length = sizeof (EFI_TIME);
2000   CopyMem (Buffer, &CertData->TimeStamp, Length);
2001   Buffer += Length;
2002
2003   CopyMem (Buffer, PayloadPtr, PayloadSize);
2004
2005   if (AuthVarType == AuthVarTypePk) {
2006     //
2007     // Get platform key from variable.
2008     //
2009     Status = FindVariable (
2010                EFI_PLATFORM_KEY_NAME,
2011                &gEfiGlobalVariableGuid,
2012                &PkVariable,
2013                &mVariableModuleGlobal->VariableGlobal,
2014                FALSE
2015                );
2016     if (EFI_ERROR (Status)) {
2017       return Status;
2018     }
2019
2020     CertList = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (PkVariable.CurrPtr);
2021     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2022     RootCert      = Cert->SignatureData;
2023     RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2024
2025
2026     //
2027     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2028     //
2029     VerifyStatus = Pkcs7Verify (
2030                      SigData,
2031                      SigDataSize,
2032                      RootCert,
2033                      RootCertSize,
2034                      NewData,
2035                      NewDataSize
2036                      );
2037
2038   } else if (AuthVarType == AuthVarTypeKek) {
2039
2040     //
2041     // Get KEK database from variable.
2042     //
2043     Status = FindVariable (
2044                EFI_KEY_EXCHANGE_KEY_NAME,
2045                &gEfiGlobalVariableGuid,
2046                &KekVariable,
2047                &mVariableModuleGlobal->VariableGlobal,
2048                FALSE
2049                );
2050     if (EFI_ERROR (Status)) {
2051       return Status;
2052     }
2053
2054     //
2055     // Ready to verify Pkcs7 SignedData. Go through KEK Signature Database to find out X.509 CertList.
2056     //
2057     KekDataSize      = KekVariable.CurrPtr->DataSize;
2058     CertList         = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (KekVariable.CurrPtr);
2059     while ((KekDataSize > 0) && (KekDataSize >= CertList->SignatureListSize)) {
2060       if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {
2061         Cert       = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2062         CertCount  = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
2063         for (Index = 0; Index < CertCount; Index++) {
2064           //
2065           // Iterate each Signature Data Node within this CertList for a verify
2066           //
2067           RootCert      = Cert->SignatureData;
2068           RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2069
2070           //
2071           // Verify Pkcs7 SignedData via Pkcs7Verify library.
2072           //
2073           VerifyStatus = Pkcs7Verify (
2074                            SigData,
2075                            SigDataSize,
2076                            RootCert,
2077                            RootCertSize,
2078                            NewData,
2079                            NewDataSize
2080                            );
2081           if (VerifyStatus) {
2082             goto Exit;
2083           }
2084           Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
2085         }
2086       }
2087       KekDataSize -= CertList->SignatureListSize;
2088       CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
2089     }
2090   } else if (AuthVarType == AuthVarTypePriv) {
2091
2092     //
2093     // Process common authenticated variable except PK/KEK/DB/DBX.
2094     // Get signer's certificates from SignedData.
2095     //
2096     VerifyStatus = Pkcs7GetSigners (
2097                      SigData,
2098                      SigDataSize,
2099                      &SignerCerts,
2100                      &CertStackSize,
2101                      &RootCert,
2102                      &RootCertSize
2103                      );
2104     if (!VerifyStatus) {
2105       goto Exit;
2106     }
2107
2108     //
2109     // Get previously stored signer's certificates from certdb for existing
2110     // variable. Check whether they are identical with signer's certificates
2111     // in SignedData. If not, return error immediately.
2112     //
2113     if ((Variable->CurrPtr != NULL)) {
2114       VerifyStatus = FALSE;
2115
2116       Status = GetCertsFromDb (VariableName, VendorGuid, &CertsInCertDb, &CertsSizeinDb);
2117       if (EFI_ERROR (Status)) {
2118         goto Exit;
2119       }
2120
2121       if ((CertStackSize != CertsSizeinDb) ||
2122           (CompareMem (SignerCerts, CertsInCertDb, CertsSizeinDb) != 0)) {
2123         goto Exit;
2124       }
2125     }
2126
2127     VerifyStatus = Pkcs7Verify (
2128                      SigData,
2129                      SigDataSize,
2130                      RootCert,
2131                      RootCertSize,
2132                      NewData,
2133                      NewDataSize
2134                      );
2135     if (!VerifyStatus) {
2136       goto Exit;
2137     }
2138
2139     //
2140     // Delete signer's certificates when delete the common authenticated variable.
2141     //
2142     if ((PayloadSize == 0) && (Variable->CurrPtr != NULL)) {
2143       Status = DeleteCertsFromDb (VariableName, VendorGuid);
2144       if (EFI_ERROR (Status)) {
2145         VerifyStatus = FALSE;
2146         goto Exit;
2147       }
2148     } else if (Variable->CurrPtr == NULL) {
2149       //
2150       // Insert signer's certificates when adding a new common authenticated variable.
2151       //
2152       Status = InsertCertsToDb (VariableName, VendorGuid, SignerCerts, CertStackSize);
2153       if (EFI_ERROR (Status)) {
2154         VerifyStatus = FALSE;
2155         goto Exit;
2156       }
2157     }
2158   } else if (AuthVarType == AuthVarTypePayload) {
2159     CertList = (EFI_SIGNATURE_LIST *) PayloadPtr;
2160     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2161     RootCert      = Cert->SignatureData;
2162     RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2163
2164     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2165     //
2166     VerifyStatus = Pkcs7Verify (
2167                      SigData,
2168                      SigDataSize,
2169                      RootCert,
2170                      RootCertSize,
2171                      NewData,
2172                      NewDataSize
2173                      );
2174   } else {
2175     return EFI_SECURITY_VIOLATION;
2176   }
2177
2178 Exit:
2179
2180   if (AuthVarType == AuthVarTypePriv) {
2181     Pkcs7FreeSigners (RootCert);
2182     Pkcs7FreeSigners (SignerCerts);
2183   }
2184
2185   if (!VerifyStatus) {
2186     return EFI_SECURITY_VIOLATION;
2187   }
2188
2189   Status = CheckSignatureListFormat(VariableName, VendorGuid, PayloadPtr, PayloadSize);
2190   if (EFI_ERROR (Status)) {
2191     return Status;
2192   }
2193
2194   if ((PayloadSize == 0) && (VarDel != NULL)) {
2195     *VarDel = TRUE;
2196   }
2197
2198   //
2199   // Final step: Update/Append Variable if it pass Pkcs7Verify
2200   //
2201   return UpdateVariable (
2202            VariableName,
2203            VendorGuid,
2204            PayloadPtr,
2205            PayloadSize,
2206            Attributes,
2207            0,
2208            0,
2209            Variable,
2210            &CertData->TimeStamp
2211            );
2212 }
2213