SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c

   1 /** @file
   2   Implement authentication services for the authenticated variable
   3   service in UEFI2.2.
   4
   5   Caution: This module requires additional review when modified.
   6   This driver will have external input - variable data. It may be input in SMM mode.
   7   This external input must be validated carefully to avoid security issue like
   8   buffer overflow, integer overflow.
   9   Variable attribute should also be checked to avoid authentication bypass.
  10
  11   ProcessVarWithPk(), ProcessVarWithKek() and ProcessVariable() are the function to do
  12   variable authentication.
  13
  14   VerifyTimeBasedPayload() and VerifyCounterBasedPayload() are sub function to do verification.
  15   They will do basic validation for authentication data structure, then call crypto library
  16   to verify the signature.
  17
  18 Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>
  19 This program and the accompanying materials
  20 are licensed and made available under the terms and conditions of the BSD License
  21 which accompanies this distribution.  The full text of the license may be found at
  22 http://opensource.org/licenses/bsd-license.php
  23
  24 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  25 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  26
  27 **/
  28
  29 #include "Variable.h"
  30 #include "AuthService.h"
  31
  32 ///
  33 /// Global database array for scratch
  34 ///
  35 UINT8    mPubKeyStore[MAX_KEYDB_SIZE];
  36 UINT32   mPubKeyNumber;
  37 UINT32   mPlatformMode;
  38 EFI_GUID mSignatureSupport[] = {EFI_CERT_SHA1_GUID, EFI_CERT_SHA256_GUID, EFI_CERT_RSA2048_GUID, EFI_CERT_X509_GUID};
  39 //
  40 // Public Exponent of RSA Key.
  41 //
  42 CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };
  43 //
  44 // Hash context pointer
  45 //
  46 VOID  *mHashCtx = NULL;
  47
  48 //
  49 // Pointer to runtime buffer.
  50 // For "Append" operation to an existing variable, a read/modify/write operation
  51 // is supported by firmware internally. Reserve runtime buffer to cache previous
  52 // variable data in runtime phase because memory allocation is forbidden in virtual mode.
  53 //
  54 VOID  *mStorageArea = NULL;
  55
  56 //
  57 // The serialization of the values of the VariableName, VendorGuid and Attributes
  58 // parameters of the SetVariable() call and the TimeStamp component of the
  59 // EFI_VARIABLE_AUTHENTICATION_2 descriptor followed by the variable's new value
  60 // i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data)
  61 //
  62 UINT8 *mSerializationRuntimeBuffer = NULL;
  63
  64 //
  65 // Requirement for different signature type which have been defined in UEFI spec.
  66 // These data are used to peform SignatureList format check while setting PK/KEK variable.
  67 //
  68 EFI_SIGNATURE_ITEM mSupportSigItem[] = {
  69 //{SigType,                       SigHeaderSize,   SigDataSize  }
  70   {EFI_CERT_SHA256_GUID,          0,               32           },
  71   {EFI_CERT_RSA2048_GUID,         0,               256          },
  72   {EFI_CERT_RSA2048_SHA256_GUID,  0,               256          },
  73   {EFI_CERT_SHA1_GUID,            0,               20           },
  74   {EFI_CERT_RSA2048_SHA1_GUID,    0,               256          },
  75   {EFI_CERT_X509_GUID,            0,               ((UINT32) ~0)},
  76   {EFI_CERT_SHA224_GUID,          0,               28           },
  77   {EFI_CERT_SHA384_GUID,          0,               48           },
  78   {EFI_CERT_SHA512_GUID,          0,               64           }
  79 };
  80
  81 /**
  82   Determine whether this operation needs a physical present user.
  83
  84   @param[in]      VariableName            Name of the Variable.
  85   @param[in]      VendorGuid              GUID of the Variable.
  86
  87   @retval TRUE      This variable is protected, only a physical present user could set this variable.
  88   @retval FALSE     This variable is not protected.
  89
  90 **/
  91 BOOLEAN
  92 NeedPhysicallyPresent(
  93   IN     CHAR16         *VariableName,
  94   IN     EFI_GUID       *VendorGuid
  95   )
  96 {
  97   if ((CompareGuid (VendorGuid, &gEfiSecureBootEnableDisableGuid) && (StrCmp (VariableName, EFI_SECURE_BOOT_ENABLE_NAME) == 0))
  98     || (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (VariableName, EFI_CUSTOM_MODE_NAME) == 0))) {
  99     return TRUE;
 100   }
 101
 102   return FALSE;
 103 }
 104
 105 /**
 106   Determine whether the platform is operating in Custom Secure Boot mode.
 107
 108   @retval TRUE           The platform is operating in Custom mode.
 109   @retval FALSE          The platform is operating in Standard mode.
 110
 111 **/
 112 BOOLEAN
 113 InCustomMode (
 114   VOID
 115   )
 116 {
 117   VARIABLE_POINTER_TRACK  Variable;
 118
 119   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 120   if (Variable.CurrPtr != NULL && *(GetVariableDataPtr (Variable.CurrPtr)) == CUSTOM_SECURE_BOOT_MODE) {
 121     return TRUE;
 122   }
 123
 124   return FALSE;
 125 }
 126
 127
 128 /**
 129   Internal function to delete a Variable given its name and GUID, no authentication
 130   required.
 131
 132   @param[in]      VariableName            Name of the Variable.
 133   @param[in]      VendorGuid              GUID of the Variable.
 134
 135   @retval EFI_SUCCESS              Variable deleted successfully.
 136   @retval Others                   The driver failded to start the device.
 137
 138 **/
 139 EFI_STATUS
 140 DeleteVariable (
 141   IN  CHAR16                    *VariableName,
 142   IN  EFI_GUID                  *VendorGuid
 143   )
 144 {
 145   EFI_STATUS              Status;
 146   VARIABLE_POINTER_TRACK  Variable;
 147
 148   Status = FindVariable (VariableName, VendorGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 149   if (EFI_ERROR (Status)) {
 150     return EFI_SUCCESS;
 151   }
 152
 153   ASSERT (Variable.CurrPtr != NULL);
 154   return UpdateVariable (VariableName, VendorGuid, NULL, 0, 0, 0, 0, &Variable, NULL);
 155 }
 156
 157 /**
 158   Initializes for authenticated varibale service.
 159
 160   @retval EFI_SUCCESS           Function successfully executed.
 161   @retval EFI_OUT_OF_RESOURCES  Fail to allocate enough memory resources.
 162
 163 **/
 164 EFI_STATUS
 165 AutenticatedVariableServiceInitialize (
 166   VOID
 167   )
 168 {
 169   EFI_STATUS              Status;
 170   VARIABLE_POINTER_TRACK  Variable;
 171   VARIABLE_POINTER_TRACK  PkVariable;
 172   UINT8                   VarValue;
 173   UINT32                  VarAttr;
 174   UINT8                   *Data;
 175   UINTN                   DataSize;
 176   UINTN                   CtxSize;
 177   UINT8                   SecureBootMode;
 178   UINT8                   SecureBootEnable;
 179   UINT8                   CustomMode;
 180   UINT32                  ListSize;
 181
 182   //
 183   // Initialize hash context.
 184   //
 185   CtxSize   = Sha256GetContextSize ();
 186   mHashCtx  = AllocateRuntimePool (CtxSize);
 187   if (mHashCtx == NULL) {
 188     return EFI_OUT_OF_RESOURCES;
 189   }
 190
 191   //
 192   // Reserved runtime buffer for "Append" operation in virtual mode.
 193   //
 194   mStorageArea  = AllocateRuntimePool (PcdGet32 (PcdMaxVariableSize));
 195   if (mStorageArea == NULL) {
 196     return EFI_OUT_OF_RESOURCES;
 197   }
 198
 199   //
 200   // Prepare runtime buffer for serialized data of time-based authenticated
 201   // Variable, i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data).
 202   //
 203   mSerializationRuntimeBuffer = AllocateRuntimePool (PcdGet32 (PcdMaxVariableSize) + sizeof (EFI_GUID) + sizeof (UINT32) + sizeof (EFI_TIME));
 204   if (mSerializationRuntimeBuffer == NULL) {
 205     return EFI_OUT_OF_RESOURCES;
 206   }
 207
 208   //
 209   // Check "AuthVarKeyDatabase" variable's existence.
 210   // If it doesn't exist, create a new one with initial value of 0 and EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
 211   //
 212   Status = FindVariable (
 213              AUTHVAR_KEYDB_NAME,
 214              &gEfiAuthenticatedVariableGuid,
 215              &Variable,
 216              &mVariableModuleGlobal->VariableGlobal,
 217              FALSE
 218              );
 219
 220   if (Variable.CurrPtr == NULL) {
 221     VarAttr       = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 222     VarValue      = 0;
 223     mPubKeyNumber = 0;
 224     Status        = UpdateVariable (
 225                       AUTHVAR_KEYDB_NAME,
 226                       &gEfiAuthenticatedVariableGuid,
 227                       &VarValue,
 228                       sizeof(UINT8),
 229                       VarAttr,
 230                       0,
 231                       0,
 232                       &Variable,
 233                       NULL
 234                       );
 235     if (EFI_ERROR (Status)) {
 236       return Status;
 237     }
 238   } else {
 239     //
 240     // Load database in global variable for cache.
 241     //
 242     DataSize  = DataSizeOfVariable (Variable.CurrPtr);
 243     Data      = GetVariableDataPtr (Variable.CurrPtr);
 244     ASSERT ((DataSize != 0) && (Data != NULL));
 245     CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
 246     mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
 247   }
 248
 249   FindVariable (EFI_PLATFORM_KEY_NAME, &gEfiGlobalVariableGuid, &PkVariable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 250   if (PkVariable.CurrPtr == NULL) {
 251     DEBUG ((EFI_D_INFO, "Variable %s does not exist.\n", EFI_PLATFORM_KEY_NAME));
 252   } else {
 253     DEBUG ((EFI_D_INFO, "Variable %s exists.\n", EFI_PLATFORM_KEY_NAME));
 254   }
 255
 256   //
 257   // Create "SetupMode" varable with BS+RT attribute set.
 258   //
 259   FindVariable (EFI_SETUP_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 260   if (PkVariable.CurrPtr == NULL) {
 261     mPlatformMode = SETUP_MODE;
 262   } else {
 263     mPlatformMode = USER_MODE;
 264   }
 265   Status = UpdateVariable (
 266              EFI_SETUP_MODE_NAME,
 267              &gEfiGlobalVariableGuid,
 268              &mPlatformMode,
 269              sizeof(UINT8),
 270              EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 271              0,
 272              0,
 273              &Variable,
 274              NULL
 275              );
 276   if (EFI_ERROR (Status)) {
 277     return Status;
 278   }
 279
 280   //
 281   // Create "SignatureSupport" varable with BS+RT attribute set.
 282   //
 283   FindVariable (EFI_SIGNATURE_SUPPORT_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 284   Status  = UpdateVariable (
 285               EFI_SIGNATURE_SUPPORT_NAME,
 286               &gEfiGlobalVariableGuid,
 287               mSignatureSupport,
 288               sizeof(mSignatureSupport),
 289               EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 290               0,
 291               0,
 292               &Variable,
 293               NULL
 294               );
 295   if (EFI_ERROR (Status)) {
 296     return Status;
 297   }
 298
 299   //
 300   // If "SecureBootEnable" variable exists, then update "SecureBoot" variable.
 301   // If "SecureBootEnable" variable is SECURE_BOOT_ENABLE and in USER_MODE, Set "SecureBoot" variable to SECURE_BOOT_MODE_ENABLE.
 302   // If "SecureBootEnable" variable is SECURE_BOOT_DISABLE, Set "SecureBoot" variable to SECURE_BOOT_MODE_DISABLE.
 303   //
 304   SecureBootEnable = SECURE_BOOT_DISABLE;
 305   FindVariable (EFI_SECURE_BOOT_ENABLE_NAME, &gEfiSecureBootEnableDisableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 306   if (Variable.CurrPtr != NULL) {
 307     SecureBootEnable = *(GetVariableDataPtr (Variable.CurrPtr));
 308   } else if (mPlatformMode == USER_MODE) {
 309     //
 310     // "SecureBootEnable" not exist, initialize it in USER_MODE.
 311     //
 312     SecureBootEnable = SECURE_BOOT_ENABLE;
 313     Status = UpdateVariable (
 314                EFI_SECURE_BOOT_ENABLE_NAME,
 315                &gEfiSecureBootEnableDisableGuid,
 316                &SecureBootEnable,
 317                sizeof (UINT8),
 318                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 319                0,
 320                0,
 321                &Variable,
 322                NULL
 323                );
 324     if (EFI_ERROR (Status)) {
 325       return Status;
 326     }
 327   }
 328
 329   //
 330   // Create "SecureBoot" varable with BS+RT attribute set.
 331   //
 332   if (SecureBootEnable == SECURE_BOOT_ENABLE && mPlatformMode == USER_MODE) {
 333     SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 334   } else {
 335     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 336   }
 337   FindVariable (EFI_SECURE_BOOT_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 338   Status = UpdateVariable (
 339              EFI_SECURE_BOOT_MODE_NAME,
 340              &gEfiGlobalVariableGuid,
 341              &SecureBootMode,
 342              sizeof (UINT8),
 343              EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 344              0,
 345              0,
 346              &Variable,
 347              NULL
 348              );
 349   if (EFI_ERROR (Status)) {
 350     return Status;
 351   }
 352
 353   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SETUP_MODE_NAME, mPlatformMode));
 354   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_MODE_NAME, SecureBootMode));
 355   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_ENABLE_NAME, SecureBootEnable));
 356
 357   //
 358   // Check "CustomMode" variable's existence.
 359   //
 360   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 361   if (Variable.CurrPtr != NULL) {
 362     CustomMode = *(GetVariableDataPtr (Variable.CurrPtr));
 363   } else {
 364     //
 365     // "CustomMode" not exist, initialize it in STANDARD_SECURE_BOOT_MODE.
 366     //
 367     CustomMode = STANDARD_SECURE_BOOT_MODE;
 368     Status = UpdateVariable (
 369                EFI_CUSTOM_MODE_NAME,
 370                &gEfiCustomModeEnableGuid,
 371                &CustomMode,
 372                sizeof (UINT8),
 373                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 374                0,
 375                0,
 376                &Variable,
 377                NULL
 378                );
 379     if (EFI_ERROR (Status)) {
 380       return Status;
 381     }
 382   }
 383
 384   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_CUSTOM_MODE_NAME, CustomMode));
 385
 386   //
 387   // Check "certdb" variable's existence.
 388   // If it doesn't exist, then create a new one with
 389   // EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.
 390   //
 391   Status = FindVariable (
 392              EFI_CERT_DB_NAME,
 393              &gEfiCertDbGuid,
 394              &Variable,
 395              &mVariableModuleGlobal->VariableGlobal,
 396              FALSE
 397              );
 398
 399   if (Variable.CurrPtr == NULL) {
 400     VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
 401     ListSize = 0;
 402     Status   = UpdateVariable (
 403                  EFI_CERT_DB_NAME,
 404                  &gEfiCertDbGuid,
 405                  &ListSize,
 406                  sizeof (UINT32),
 407                  VarAttr,
 408                  0,
 409                  0,
 410                  &Variable,
 411                  NULL
 412                  );
 413
 414   }
 415
 416   return Status;
 417 }
 418
 419 /**
 420   Add public key in store and return its index.
 421
 422   @param[in]  PubKey                  Input pointer to Public Key data
 423
 424   @return                             Index of new added item
 425
 426 **/
 427 UINT32
 428 AddPubKeyInStore (
 429   IN  UINT8               *PubKey
 430   )
 431 {
 432   EFI_STATUS              Status;
 433   BOOLEAN                 IsFound;
 434   UINT32                  Index;
 435   VARIABLE_POINTER_TRACK  Variable;
 436   UINT8                   *Ptr;
 437
 438   if (PubKey == NULL) {
 439     return 0;
 440   }
 441
 442   Status = FindVariable (
 443              AUTHVAR_KEYDB_NAME,
 444              &gEfiAuthenticatedVariableGuid,
 445              &Variable,
 446              &mVariableModuleGlobal->VariableGlobal,
 447              FALSE
 448              );
 449   ASSERT_EFI_ERROR (Status);
 450   //
 451   // Check whether the public key entry does exist.
 452   //
 453   IsFound = FALSE;
 454   for (Ptr = mPubKeyStore, Index = 1; Index <= mPubKeyNumber; Index++) {
 455     if (CompareMem (Ptr, PubKey, EFI_CERT_TYPE_RSA2048_SIZE) == 0) {
 456       IsFound = TRUE;
 457       break;
 458     }
 459     Ptr += EFI_CERT_TYPE_RSA2048_SIZE;
 460   }
 461
 462   if (!IsFound) {
 463     //
 464     // Add public key in database.
 465     //
 466     if (mPubKeyNumber == MAX_KEY_NUM) {
 467       //
 468       // Notes: Database is full, need enhancement here, currently just return 0.
 469       //
 470       return 0;
 471     }
 472
 473     CopyMem (mPubKeyStore + mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 474     Index = ++mPubKeyNumber;
 475     //
 476     // Update public key database variable.
 477     //
 478     Status = UpdateVariable (
 479                AUTHVAR_KEYDB_NAME,
 480                &gEfiAuthenticatedVariableGuid,
 481                mPubKeyStore,
 482                mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE,
 483                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS,
 484                0,
 485                0,
 486                &Variable,
 487                NULL
 488                );
 489     ASSERT_EFI_ERROR (Status);
 490   }
 491
 492   return Index;
 493 }
 494
 495 /**
 496   Verify data payload with AuthInfo in EFI_CERT_TYPE_RSA2048_SHA256_GUID type.
 497   Follow the steps in UEFI2.2.
 498
 499   Caution: This function may receive untrusted input.
 500   This function may be invoked in SMM mode, and datasize and data are external input.
 501   This function will do basic validation, before parse the data.
 502   This function will parse the authentication carefully to avoid security issues, like
 503   buffer overflow, integer overflow.
 504
 505   @param[in]      Data                    Pointer to data with AuthInfo.
 506   @param[in]      DataSize                Size of Data.
 507   @param[in]      PubKey                  Public key used for verification.
 508
 509   @retval EFI_INVALID_PARAMETER       Invalid parameter.
 510   @retval EFI_SECURITY_VIOLATION      If authentication failed.
 511   @retval EFI_SUCCESS                 Authentication successful.
 512
 513 **/
 514 EFI_STATUS
 515 VerifyCounterBasedPayload (
 516   IN     UINT8          *Data,
 517   IN     UINTN          DataSize,
 518   IN     UINT8          *PubKey
 519   )
 520 {
 521   BOOLEAN                         Status;
 522   EFI_VARIABLE_AUTHENTICATION     *CertData;
 523   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
 524   UINT8                           Digest[SHA256_DIGEST_SIZE];
 525   VOID                            *Rsa;
 526
 527   Rsa         = NULL;
 528   CertData    = NULL;
 529   CertBlock   = NULL;
 530
 531   if (Data == NULL || PubKey == NULL) {
 532     return EFI_INVALID_PARAMETER;
 533   }
 534
 535   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
 536   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
 537
 538   //
 539   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
 540   // Cert type should be EFI_CERT_TYPE_RSA2048_SHA256_GUID.
 541   //
 542   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
 543       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertTypeRsa2048Sha256Guid)
 544         ) {
 545     //
 546     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
 547     //
 548     return EFI_SECURITY_VIOLATION;
 549   }
 550   //
 551   // Hash data payload with SHA256.
 552   //
 553   ZeroMem (Digest, SHA256_DIGEST_SIZE);
 554   Status  = Sha256Init (mHashCtx);
 555   if (!Status) {
 556     goto Done;
 557   }
 558   Status  = Sha256Update (mHashCtx, Data + AUTHINFO_SIZE, (UINTN) (DataSize - AUTHINFO_SIZE));
 559   if (!Status) {
 560     goto Done;
 561   }
 562   //
 563   // Hash Monotonic Count.
 564   //
 565   Status  = Sha256Update (mHashCtx, &CertData->MonotonicCount, sizeof (UINT64));
 566   if (!Status) {
 567     goto Done;
 568   }
 569   Status  = Sha256Final (mHashCtx, Digest);
 570   if (!Status) {
 571     goto Done;
 572   }
 573   //
 574   // Generate & Initialize RSA Context.
 575   //
 576   Rsa = RsaNew ();
 577   ASSERT (Rsa != NULL);
 578   //
 579   // Set RSA Key Components.
 580   // NOTE: Only N and E are needed to be set as RSA public key for signature verification.
 581   //
 582   Status = RsaSetKey (Rsa, RsaKeyN, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 583   if (!Status) {
 584     goto Done;
 585   }
 586   Status = RsaSetKey (Rsa, RsaKeyE, mRsaE, sizeof (mRsaE));
 587   if (!Status) {
 588     goto Done;
 589   }
 590   //
 591   // Verify the signature.
 592   //
 593   Status = RsaPkcs1Verify (
 594              Rsa,
 595              Digest,
 596              SHA256_DIGEST_SIZE,
 597              CertBlock->Signature,
 598              EFI_CERT_TYPE_RSA2048_SHA256_SIZE
 599              );
 600
 601 Done:
 602   if (Rsa != NULL) {
 603     RsaFree (Rsa);
 604   }
 605   if (Status) {
 606     return EFI_SUCCESS;
 607   } else {
 608     return EFI_SECURITY_VIOLATION;
 609   }
 610 }
 611
 612 /**
 613   Update platform mode.
 614
 615   @param[in]      Mode                    SETUP_MODE or USER_MODE.
 616
 617   @return EFI_INVALID_PARAMETER           Invalid parameter.
 618   @return EFI_SUCCESS                     Update platform mode successfully.
 619
 620 **/
 621 EFI_STATUS
 622 UpdatePlatformMode (
 623   IN  UINT32                    Mode
 624   )
 625 {
 626   EFI_STATUS              Status;
 627   VARIABLE_POINTER_TRACK  Variable;
 628   UINT32                  VarAttr;
 629   UINT8                   SecureBootMode;
 630   UINT8                   SecureBootEnable;
 631   UINTN                   VariableDataSize;
 632
 633   Status = FindVariable (
 634              EFI_SETUP_MODE_NAME,
 635              &gEfiGlobalVariableGuid,
 636              &Variable,
 637              &mVariableModuleGlobal->VariableGlobal,
 638              FALSE
 639              );
 640   if (EFI_ERROR (Status)) {
 641     return Status;
 642   }
 643
 644   //
 645   // Update the value of SetupMode variable by a simple mem copy, this could avoid possible
 646   // variable storage reclaim at runtime.
 647   //
 648   mPlatformMode = (UINT8) Mode;
 649   CopyMem (GetVariableDataPtr (Variable.CurrPtr), &mPlatformMode, sizeof(UINT8));
 650
 651   if (AtRuntime ()) {
 652     //
 653     // SecureBoot Variable indicates whether the platform firmware is operating
 654     // in Secure boot mode (1) or not (0), so we should not change SecureBoot
 655     // Variable in runtime.
 656     //
 657     return Status;
 658   }
 659
 660   //
 661   // Check "SecureBoot" variable's existence.
 662   // If it doesn't exist, firmware has no capability to perform driver signing verification,
 663   // then set "SecureBoot" to 0.
 664   //
 665   Status = FindVariable (
 666              EFI_SECURE_BOOT_MODE_NAME,
 667              &gEfiGlobalVariableGuid,
 668              &Variable,
 669              &mVariableModuleGlobal->VariableGlobal,
 670              FALSE
 671              );
 672   //
 673   // If "SecureBoot" variable exists, then check "SetupMode" variable update.
 674   // If "SetupMode" variable is USER_MODE, "SecureBoot" variable is set to 1.
 675   // If "SetupMode" variable is SETUP_MODE, "SecureBoot" variable is set to 0.
 676   //
 677   if (Variable.CurrPtr == NULL) {
 678     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 679   } else {
 680     if (mPlatformMode == USER_MODE) {
 681       SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 682     } else if (mPlatformMode == SETUP_MODE) {
 683       SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 684     } else {
 685       return EFI_NOT_FOUND;
 686     }
 687   }
 688
 689   VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 690   Status  = UpdateVariable (
 691               EFI_SECURE_BOOT_MODE_NAME,
 692               &gEfiGlobalVariableGuid,
 693               &SecureBootMode,
 694               sizeof(UINT8),
 695               VarAttr,
 696               0,
 697               0,
 698               &Variable,
 699               NULL
 700               );
 701   if (EFI_ERROR (Status)) {
 702     return Status;
 703   }
 704
 705   //
 706   // Check "SecureBootEnable" variable's existence. It can enable/disable secure boot feature.
 707   //
 708   Status = FindVariable (
 709              EFI_SECURE_BOOT_ENABLE_NAME,
 710              &gEfiSecureBootEnableDisableGuid,
 711              &Variable,
 712              &mVariableModuleGlobal->VariableGlobal,
 713              FALSE
 714              );
 715
 716   if (SecureBootMode == SECURE_BOOT_MODE_ENABLE) {
 717     //
 718     // Create the "SecureBootEnable" variable as secure boot is enabled.
 719     //
 720     SecureBootEnable = SECURE_BOOT_ENABLE;
 721     VariableDataSize = sizeof (SecureBootEnable);
 722   } else {
 723     //
 724     // Delete the "SecureBootEnable" variable if this variable exist as "SecureBoot"
 725     // variable is not in secure boot state.
 726     //
 727     if (Variable.CurrPtr == NULL || EFI_ERROR (Status)) {
 728       return EFI_SUCCESS;
 729     }
 730     SecureBootEnable = SECURE_BOOT_DISABLE;
 731     VariableDataSize = 0;
 732   }
 733
 734   Status = UpdateVariable (
 735              EFI_SECURE_BOOT_ENABLE_NAME,
 736              &gEfiSecureBootEnableDisableGuid,
 737              &SecureBootEnable,
 738              VariableDataSize,
 739              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 740              0,
 741              0,
 742              &Variable,
 743              NULL
 744              );
 745   return Status;
 746 }
 747
 748 /**
 749   Check input data form to make sure it is a valid EFI_SIGNATURE_LIST for PK/KEK variable.
 750
 751   @param[in]  VariableName                Name of Variable to be check.
 752   @param[in]  VendorGuid                  Variable vendor GUID.
 753   @param[in]  Data                        Point to the variable data to be checked.
 754   @param[in]  DataSize                    Size of Data.
 755
 756   @return EFI_INVALID_PARAMETER           Invalid signature list format.
 757   @return EFI_SUCCESS                     Passed signature list format check successfully.
 758
 759 **/
 760 EFI_STATUS
 761 CheckSignatureListFormat(
 762   IN  CHAR16                    *VariableName,
 763   IN  EFI_GUID                  *VendorGuid,
 764   IN  VOID                      *Data,
 765   IN  UINTN                     DataSize
 766   )
 767 {
 768   EFI_SIGNATURE_LIST     *SigList;
 769   UINTN                  SigDataSize;
 770   UINT32                 Index;
 771   UINT32                 SigCount;
 772   BOOLEAN                IsPk;
 773
 774   if (DataSize == 0) {
 775     return EFI_SUCCESS;
 776   }
 777
 778   ASSERT (VariableName != NULL && VendorGuid != NULL && Data != NULL);
 779
 780   if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_PLATFORM_KEY_NAME) == 0)){
 781     IsPk = TRUE;
 782   } else if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0)) {
 783     IsPk = FALSE;
 784   } else {
 785     return EFI_SUCCESS;
 786   }
 787
 788   SigCount = 0;
 789   SigList  = (EFI_SIGNATURE_LIST *) Data;
 790   SigDataSize  = DataSize;
 791
 792   //
 793   // Walk throuth the input signature list and check the data format.
 794   // If any signature is incorrectly formed, the whole check will fail.
 795   //
 796   while ((SigDataSize > 0) && (SigDataSize >= SigList->SignatureListSize)) {
 797     for (Index = 0; Index < (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM)); Index++ ) {
 798       if (CompareGuid (&SigList->SignatureType, &mSupportSigItem[Index].SigType)) {
 799         //
 800         // The value of SignatureSize should always be 16 (size of SignatureOwner
 801         // component) add the data length according to signature type.
 802         //
 803         if (mSupportSigItem[Index].SigDataSize != ((UINT32) ~0) &&
 804           (SigList->SignatureSize - sizeof (EFI_GUID)) != mSupportSigItem[Index].SigDataSize) {
 805           return EFI_INVALID_PARAMETER;
 806         }
 807         if (mSupportSigItem[Index].SigHeaderSize != ((UINTN) ~0) &&
 808           SigList->SignatureHeaderSize != mSupportSigItem[Index].SigHeaderSize) {
 809           return EFI_INVALID_PARAMETER;
 810         }
 811         break;
 812       }
 813     }
 814
 815     if (Index == (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM))) {
 816       //
 817       // Undefined signature type.
 818       //
 819       return EFI_INVALID_PARAMETER;
 820     }
 821
 822     if ((SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) % SigList->SignatureSize != 0) {
 823       return EFI_INVALID_PARAMETER;
 824     }
 825     SigCount += (SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) / SigList->SignatureSize;
 826
 827     SigDataSize -= SigList->SignatureListSize;
 828     SigList = (EFI_SIGNATURE_LIST *) ((UINT8 *) SigList + SigList->SignatureListSize);
 829   }
 830
 831   if (((UINTN) SigList - (UINTN) Data) != DataSize) {
 832     return EFI_INVALID_PARAMETER;
 833   }
 834
 835   if (IsPk && SigCount > 1) {
 836     return EFI_INVALID_PARAMETER;
 837   }
 838
 839   return EFI_SUCCESS;
 840 }
 841
 842 /**
 843   Process variable with platform key for verification.
 844
 845   Caution: This function may receive untrusted input.
 846   This function may be invoked in SMM mode, and datasize and data are external input.
 847   This function will do basic validation, before parse the data.
 848   This function will parse the authentication carefully to avoid security issues, like
 849   buffer overflow, integer overflow.
 850   This function will check attribute carefully to avoid authentication bypass.
 851
 852   @param[in]  VariableName                Name of Variable to be found.
 853   @param[in]  VendorGuid                  Variable vendor GUID.
 854   @param[in]  Data                        Data pointer.
 855   @param[in]  DataSize                    Size of Data found. If size is less than the
 856                                           data, this value contains the required size.
 857   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
 858   @param[in]  Attributes                  Attribute value of the variable
 859   @param[in]  IsPk                        Indicate whether it is to process pk.
 860
 861   @return EFI_INVALID_PARAMETER           Invalid parameter.
 862   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation.
 863                                           check carried out by the firmware.
 864   @return EFI_SUCCESS                     Variable passed validation successfully.
 865
 866 **/
 867 EFI_STATUS
 868 ProcessVarWithPk (
 869   IN  CHAR16                    *VariableName,
 870   IN  EFI_GUID                  *VendorGuid,
 871   IN  VOID                      *Data,
 872   IN  UINTN                     DataSize,
 873   IN  VARIABLE_POINTER_TRACK    *Variable,
 874   IN  UINT32                    Attributes OPTIONAL,
 875   IN  BOOLEAN                   IsPk
 876   )
 877 {
 878   EFI_STATUS                  Status;
 879   BOOLEAN                     Del;
 880   UINT8                       *Payload;
 881   UINTN                       PayloadSize;
 882
 883   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
 884       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
 885     //
 886     // PK, KEK and db/dbx should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
 887     // authenticated variable.
 888     //
 889     return EFI_INVALID_PARAMETER;
 890   }
 891
 892   Del = FALSE;
 893   if ((InCustomMode() && UserPhysicalPresent()) || (mPlatformMode == SETUP_MODE && !IsPk)) {
 894     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
 895     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
 896     if (PayloadSize == 0) {
 897       Del = TRUE;
 898     }
 899
 900     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
 901     if (EFI_ERROR (Status)) {
 902       return Status;
 903     }
 904
 905     Status = UpdateVariable (
 906                VariableName,
 907                VendorGuid,
 908                Payload,
 909                PayloadSize,
 910                Attributes,
 911                0,
 912                0,
 913                Variable,
 914                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
 915                );
 916   } else if (mPlatformMode == USER_MODE) {
 917     //
 918     // Verify against X509 Cert in PK database.
 919     //
 920     Status = VerifyTimeBasedPayload (
 921                VariableName,
 922                VendorGuid,
 923                Data,
 924                DataSize,
 925                Variable,
 926                Attributes,
 927                AuthVarTypePk,
 928                &Del
 929                );
 930   } else {
 931     //
 932     // Verify against the certificate in data payload.
 933     //
 934     Status = VerifyTimeBasedPayload (
 935                VariableName,
 936                VendorGuid,
 937                Data,
 938                DataSize,
 939                Variable,
 940                Attributes,
 941                AuthVarTypePayload,
 942                &Del
 943                );
 944   }
 945
 946   if (!EFI_ERROR(Status) && IsPk) {
 947     if (mPlatformMode == SETUP_MODE && !Del) {
 948       //
 949       // If enroll PK in setup mode, need change to user mode.
 950       //
 951       Status = UpdatePlatformMode (USER_MODE);
 952     } else if (mPlatformMode == USER_MODE && Del){
 953       //
 954       // If delete PK in user mode, need change to setup mode.
 955       //
 956       Status = UpdatePlatformMode (SETUP_MODE);
 957     }
 958   }
 959
 960   return Status;
 961 }
 962
 963 /**
 964   Process variable with key exchange key for verification.
 965
 966   Caution: This function may receive untrusted input.
 967   This function may be invoked in SMM mode, and datasize and data are external input.
 968   This function will do basic validation, before parse the data.
 969   This function will parse the authentication carefully to avoid security issues, like
 970   buffer overflow, integer overflow.
 971   This function will check attribute carefully to avoid authentication bypass.
 972
 973   @param[in]  VariableName                Name of Variable to be found.
 974   @param[in]  VendorGuid                  Variable vendor GUID.
 975   @param[in]  Data                        Data pointer.
 976   @param[in]  DataSize                    Size of Data found. If size is less than the
 977                                           data, this value contains the required size.
 978   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
 979   @param[in]  Attributes                  Attribute value of the variable.
 980
 981   @return EFI_INVALID_PARAMETER           Invalid parameter.
 982   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
 983                                           check carried out by the firmware.
 984   @return EFI_SUCCESS                     Variable pass validation successfully.
 985
 986 **/
 987 EFI_STATUS
 988 ProcessVarWithKek (
 989   IN  CHAR16                               *VariableName,
 990   IN  EFI_GUID                             *VendorGuid,
 991   IN  VOID                                 *Data,
 992   IN  UINTN                                DataSize,
 993   IN  VARIABLE_POINTER_TRACK               *Variable,
 994   IN  UINT32                               Attributes OPTIONAL
 995   )
 996 {
 997   EFI_STATUS                      Status;
 998   UINT8                           *Payload;
 999   UINTN                           PayloadSize;
1000
1001   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1002       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1003     //
1004     // DB and DBX should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1005     // authenticated variable.
1006     //
1007     return EFI_INVALID_PARAMETER;
1008   }
1009
1010   Status = EFI_SUCCESS;
1011   if (mPlatformMode == USER_MODE && !(InCustomMode() && UserPhysicalPresent())) {
1012     //
1013     // Time-based, verify against X509 Cert KEK.
1014     //
1015     return VerifyTimeBasedPayload (
1016              VariableName,
1017              VendorGuid,
1018              Data,
1019              DataSize,
1020              Variable,
1021              Attributes,
1022              AuthVarTypeKek,
1023              NULL
1024              );
1025   } else {
1026     //
1027     // If in setup mode or custom secure boot mode, no authentication needed.
1028     //
1029     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1030     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1031
1032     Status = UpdateVariable (
1033                VariableName,
1034                VendorGuid,
1035                Payload,
1036                PayloadSize,
1037                Attributes,
1038                0,
1039                0,
1040                Variable,
1041                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1042                );
1043   }
1044
1045   return Status;
1046 }
1047
1048 /**
1049   Process variable with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS/EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
1050
1051   Caution: This function may receive untrusted input.
1052   This function may be invoked in SMM mode, and datasize and data are external input.
1053   This function will do basic validation, before parse the data.
1054   This function will parse the authentication carefully to avoid security issues, like
1055   buffer overflow, integer overflow.
1056   This function will check attribute carefully to avoid authentication bypass.
1057
1058   @param[in]  VariableName                Name of Variable to be found.
1059   @param[in]  VendorGuid                  Variable vendor GUID.
1060
1061   @param[in]  Data                        Data pointer.
1062   @param[in]  DataSize                    Size of Data found. If size is less than the
1063                                           data, this value contains the required size.
1064   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1065   @param[in]  Attributes                  Attribute value of the variable.
1066
1067   @return EFI_INVALID_PARAMETER           Invalid parameter.
1068   @return EFI_WRITE_PROTECTED             Variable is write-protected and needs authentication with
1069                                           EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1070   @return EFI_SECURITY_VIOLATION          The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
1071                                           set, but the AuthInfo does NOT pass the validation
1072                                           check carried out by the firmware.
1073   @return EFI_SUCCESS                     Variable is not write-protected or pass validation successfully.
1074
1075 **/
1076 EFI_STATUS
1077 ProcessVariable (
1078   IN     CHAR16                             *VariableName,
1079   IN     EFI_GUID                           *VendorGuid,
1080   IN     VOID                               *Data,
1081   IN     UINTN                              DataSize,
1082   IN     VARIABLE_POINTER_TRACK             *Variable,
1083   IN     UINT32                             Attributes
1084   )
1085 {
1086   EFI_STATUS                      Status;
1087   BOOLEAN                         IsDeletion;
1088   BOOLEAN                         IsFirstTime;
1089   UINT8                           *PubKey;
1090   EFI_VARIABLE_AUTHENTICATION     *CertData;
1091   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
1092   UINT32                          KeyIndex;
1093   UINT64                          MonotonicCount;
1094
1095   KeyIndex    = 0;
1096   CertData    = NULL;
1097   CertBlock   = NULL;
1098   PubKey      = NULL;
1099   IsDeletion  = FALSE;
1100
1101   if (NeedPhysicallyPresent(VariableName, VendorGuid) && !UserPhysicalPresent()) {
1102     //
1103     // This variable is protected, only physical present user could modify its value.
1104     //
1105     return EFI_SECURITY_VIOLATION;
1106   }
1107
1108   //
1109   // Process Time-based Authenticated variable.
1110   //
1111   if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1112     return VerifyTimeBasedPayload (
1113              VariableName,
1114              VendorGuid,
1115              Data,
1116              DataSize,
1117              Variable,
1118              Attributes,
1119              AuthVarTypePriv,
1120              NULL
1121              );
1122   }
1123
1124   //
1125   // Determine if first time SetVariable with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS.
1126   //
1127   if ((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) {
1128     //
1129     // Determine current operation type.
1130     //
1131     if (DataSize == AUTHINFO_SIZE) {
1132       IsDeletion = TRUE;
1133     }
1134     //
1135     // Determine whether this is the first time with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1136     //
1137     if (Variable->CurrPtr == NULL) {
1138       IsFirstTime = TRUE;
1139     } else if ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) == 0) {
1140       IsFirstTime = TRUE;
1141     } else {
1142       KeyIndex   = Variable->CurrPtr->PubKeyIndex;
1143       IsFirstTime = FALSE;
1144     }
1145   } else if ((Variable->CurrPtr != NULL) &&
1146              ((Variable->CurrPtr->Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)
1147             ) {
1148     //
1149     // If the variable is already write-protected, it always needs authentication before update.
1150     //
1151     return EFI_WRITE_PROTECTED;
1152   } else {
1153     //
1154     // If without EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS, set and attributes collision.
1155     // That means it is not authenticated variable, just update variable as usual.
1156     //
1157     Status = UpdateVariable (VariableName, VendorGuid, Data, DataSize, Attributes, 0, 0, Variable, NULL);
1158     return Status;
1159   }
1160
1161   //
1162   // Get PubKey and check Monotonic Count value corresponding to the variable.
1163   //
1164   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
1165   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
1166   PubKey    = CertBlock->PublicKey;
1167
1168   //
1169   // Update Monotonic Count value.
1170   //
1171   MonotonicCount = CertData->MonotonicCount;
1172
1173   if (!IsFirstTime) {
1174     //
1175     // Check input PubKey.
1176     //
1177     if (CompareMem (PubKey, mPubKeyStore + (KeyIndex - 1) * EFI_CERT_TYPE_RSA2048_SIZE, EFI_CERT_TYPE_RSA2048_SIZE) != 0) {
1178       return EFI_SECURITY_VIOLATION;
1179     }
1180     //
1181     // Compare the current monotonic count and ensure that it is greater than the last SetVariable
1182     // operation with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS attribute set.
1183     //
1184     if (CertData->MonotonicCount <= Variable->CurrPtr->MonotonicCount) {
1185       //
1186       // Monotonic count check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
1187       //
1188       return EFI_SECURITY_VIOLATION;
1189     }
1190   }
1191   //
1192   // Verify the certificate in Data payload.
1193   //
1194   Status = VerifyCounterBasedPayload (Data, DataSize, PubKey);
1195   if (EFI_ERROR (Status)) {
1196     return Status;
1197   }
1198
1199   //
1200   // Now, the signature has been verified!
1201   //
1202   if (IsFirstTime && !IsDeletion) {
1203     //
1204     // Update public key database variable if need.
1205     //
1206     KeyIndex = AddPubKeyInStore (PubKey);
1207     if (KeyIndex == 0) {
1208       return EFI_SECURITY_VIOLATION;
1209     }
1210   }
1211
1212   //
1213   // Verification pass.
1214   //
1215   return UpdateVariable (VariableName, VendorGuid, (UINT8*)Data + AUTHINFO_SIZE, DataSize - AUTHINFO_SIZE, Attributes, KeyIndex, MonotonicCount, Variable, NULL);
1216 }
1217
1218 /**
1219   Merge two buffers which formatted as EFI_SIGNATURE_LIST. Only the new EFI_SIGNATURE_DATA
1220   will be appended to the original EFI_SIGNATURE_LIST, duplicate EFI_SIGNATURE_DATA
1221   will be ignored.
1222
1223   @param[in, out]  Data            Pointer to original EFI_SIGNATURE_LIST.
1224   @param[in]       DataSize        Size of Data buffer.
1225   @param[in]       NewData         Pointer to new EFI_SIGNATURE_LIST to be appended.
1226   @param[in]       NewDataSize     Size of NewData buffer.
1227
1228   @return Size of the merged buffer.
1229
1230 **/
1231 UINTN
1232 AppendSignatureList (
1233   IN  OUT VOID            *Data,
1234   IN  UINTN               DataSize,
1235   IN  VOID                *NewData,
1236   IN  UINTN               NewDataSize
1237   )
1238 {
1239   EFI_SIGNATURE_LIST  *CertList;
1240   EFI_SIGNATURE_DATA  *Cert;
1241   UINTN               CertCount;
1242   EFI_SIGNATURE_LIST  *NewCertList;
1243   EFI_SIGNATURE_DATA  *NewCert;
1244   UINTN               NewCertCount;
1245   UINTN               Index;
1246   UINTN               Index2;
1247   UINTN               Size;
1248   UINT8               *Tail;
1249   UINTN               CopiedCount;
1250   UINTN               SignatureListSize;
1251   BOOLEAN             IsNewCert;
1252
1253   Tail = (UINT8 *) Data + DataSize;
1254
1255   NewCertList = (EFI_SIGNATURE_LIST *) NewData;
1256   while ((NewDataSize > 0) && (NewDataSize >= NewCertList->SignatureListSize)) {
1257     NewCert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCertList + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1258     NewCertCount = (NewCertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - NewCertList->SignatureHeaderSize) / NewCertList->SignatureSize;
1259
1260     CopiedCount = 0;
1261     for (Index = 0; Index < NewCertCount; Index++) {
1262       IsNewCert = TRUE;
1263
1264       Size = DataSize;
1265       CertList = (EFI_SIGNATURE_LIST *) Data;
1266       while ((Size > 0) && (Size >= CertList->SignatureListSize)) {
1267         if (CompareGuid (&CertList->SignatureType, &NewCertList->SignatureType) &&
1268            (CertList->SignatureSize == NewCertList->SignatureSize)) {
1269           Cert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
1270           CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
1271           for (Index2 = 0; Index2 < CertCount; Index2++) {
1272             //
1273             // Iterate each Signature Data in this Signature List.
1274             //
1275             if (CompareMem (NewCert, Cert, CertList->SignatureSize) == 0) {
1276               IsNewCert = FALSE;
1277               break;
1278             }
1279             Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
1280           }
1281         }
1282
1283         if (!IsNewCert) {
1284           break;
1285         }
1286         Size -= CertList->SignatureListSize;
1287         CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
1288       }
1289
1290       if (IsNewCert) {
1291         //
1292         // New EFI_SIGNATURE_DATA, append it.
1293         //
1294         if (CopiedCount == 0) {
1295           //
1296           // Copy EFI_SIGNATURE_LIST header for only once.
1297           //
1298           CopyMem (Tail, NewCertList, sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1299           Tail = Tail + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1300         }
1301
1302         CopyMem (Tail, NewCert, NewCertList->SignatureSize);
1303         Tail += NewCertList->SignatureSize;
1304         CopiedCount++;
1305       }
1306
1307       NewCert = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCert + NewCertList->SignatureSize);
1308     }
1309
1310     //
1311     // Update SignatureListSize in newly appended EFI_SIGNATURE_LIST.
1312     //
1313     if (CopiedCount != 0) {
1314       SignatureListSize = sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize + (CopiedCount * NewCertList->SignatureSize);
1315       CertList = (EFI_SIGNATURE_LIST *) (Tail - SignatureListSize);
1316       CertList->SignatureListSize = (UINT32) SignatureListSize;
1317     }
1318
1319     NewDataSize -= NewCertList->SignatureListSize;
1320     NewCertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) NewCertList + NewCertList->SignatureListSize);
1321   }
1322
1323   return (Tail - (UINT8 *) Data);
1324 }
1325
1326 /**
1327   Compare two EFI_TIME data.
1328
1329
1330   @param FirstTime           A pointer to the first EFI_TIME data.
1331   @param SecondTime          A pointer to the second EFI_TIME data.
1332
1333   @retval  TRUE              The FirstTime is not later than the SecondTime.
1334   @retval  FALSE             The FirstTime is later than the SecondTime.
1335
1336 **/
1337 BOOLEAN
1338 CompareTimeStamp (
1339   IN EFI_TIME               *FirstTime,
1340   IN EFI_TIME               *SecondTime
1341   )
1342 {
1343   if (FirstTime->Year != SecondTime->Year) {
1344     return (BOOLEAN) (FirstTime->Year < SecondTime->Year);
1345   } else if (FirstTime->Month != SecondTime->Month) {
1346     return (BOOLEAN) (FirstTime->Month < SecondTime->Month);
1347   } else if (FirstTime->Day != SecondTime->Day) {
1348     return (BOOLEAN) (FirstTime->Day < SecondTime->Day);
1349   } else if (FirstTime->Hour != SecondTime->Hour) {
1350     return (BOOLEAN) (FirstTime->Hour < SecondTime->Hour);
1351   } else if (FirstTime->Minute != SecondTime->Minute) {
1352     return (BOOLEAN) (FirstTime->Minute < FirstTime->Minute);
1353   }
1354
1355   return (BOOLEAN) (FirstTime->Second <= SecondTime->Second);
1356 }
1357
1358 /**
1359   Find matching signer's certificates for common authenticated variable
1360   by corresponding VariableName and VendorGuid from "certdb".
1361
1362   The data format of "certdb":
1363   //
1364   //     UINT32 CertDbListSize;
1365   // /// AUTH_CERT_DB_DATA Certs1[];
1366   // /// AUTH_CERT_DB_DATA Certs2[];
1367   // /// ...
1368   // /// AUTH_CERT_DB_DATA Certsn[];
1369   //
1370
1371   @param[in]  VariableName   Name of authenticated Variable.
1372   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1373   @param[in]  Data           Pointer to variable "certdb".
1374   @param[in]  DataSize       Size of variable "certdb".
1375   @param[out] CertOffset     Offset of matching CertData, from starting of Data.
1376   @param[out] CertDataSize   Length of CertData in bytes.
1377   @param[out] CertNodeOffset Offset of matching AUTH_CERT_DB_DATA , from
1378                              starting of Data.
1379   @param[out] CertNodeSize   Length of AUTH_CERT_DB_DATA in bytes.
1380
1381   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1382   @retval  EFI_NOT_FOUND         Fail to find matching certs.
1383   @retval  EFI_SUCCESS           Find matching certs and output parameters.
1384
1385 **/
1386 EFI_STATUS
1387 FindCertsFromDb (
1388   IN     CHAR16           *VariableName,
1389   IN     EFI_GUID         *VendorGuid,
1390   IN     UINT8            *Data,
1391   IN     UINTN            DataSize,
1392   OUT    UINT32           *CertOffset,    OPTIONAL
1393   OUT    UINT32           *CertDataSize,  OPTIONAL
1394   OUT    UINT32           *CertNodeOffset,OPTIONAL
1395   OUT    UINT32           *CertNodeSize   OPTIONAL
1396   )
1397 {
1398   UINT32                  Offset;
1399   AUTH_CERT_DB_DATA       *Ptr;
1400   UINT32                  CertSize;
1401   UINT32                  NameSize;
1402   UINT32                  NodeSize;
1403   UINT32                  CertDbListSize;
1404
1405   if ((VariableName == NULL) || (VendorGuid == NULL) || (Data == NULL)) {
1406     return EFI_INVALID_PARAMETER;
1407   }
1408
1409   //
1410   // Check whether DataSize matches recorded CertDbListSize.
1411   //
1412   if (DataSize < sizeof (UINT32)) {
1413     return EFI_INVALID_PARAMETER;
1414   }
1415
1416   CertDbListSize = ReadUnaligned32 ((UINT32 *) Data);
1417
1418   if (CertDbListSize != (UINT32) DataSize) {
1419     return EFI_INVALID_PARAMETER;
1420   }
1421
1422   Offset = sizeof (UINT32);
1423
1424   //
1425   // Get corresponding certificates by VendorGuid and VariableName.
1426   //
1427   while (Offset < (UINT32) DataSize) {
1428     Ptr = (AUTH_CERT_DB_DATA *) (Data + Offset);
1429     //
1430     // Check whether VendorGuid matches.
1431     //
1432     if (CompareGuid (&Ptr->VendorGuid, VendorGuid)) {
1433       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1434       NameSize = ReadUnaligned32 (&Ptr->NameSize);
1435       CertSize = ReadUnaligned32 (&Ptr->CertDataSize);
1436
1437       if (NodeSize != sizeof (EFI_GUID) + sizeof (UINT32) * 3 + CertSize +
1438           sizeof (CHAR16) * NameSize) {
1439         return EFI_INVALID_PARAMETER;
1440       }
1441
1442       Offset = Offset + sizeof (EFI_GUID) + sizeof (UINT32) * 3;
1443       //
1444       // Check whether VariableName matches.
1445       //
1446       if ((NameSize == StrLen (VariableName)) &&
1447           (CompareMem (Data + Offset, VariableName, NameSize * sizeof (CHAR16)) == 0)) {
1448         Offset = Offset + NameSize * sizeof (CHAR16);
1449
1450         if (CertOffset != NULL) {
1451           *CertOffset = Offset;
1452         }
1453
1454         if (CertDataSize != NULL) {
1455           *CertDataSize = CertSize;
1456         }
1457
1458         if (CertNodeOffset != NULL) {
1459           *CertNodeOffset = (UINT32) ((UINT8 *) Ptr - Data);
1460         }
1461
1462         if (CertNodeSize != NULL) {
1463           *CertNodeSize = NodeSize;
1464         }
1465
1466         return EFI_SUCCESS;
1467       } else {
1468         Offset = Offset + NameSize * sizeof (CHAR16) + CertSize;
1469       }
1470     } else {
1471       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1472       Offset   = Offset + NodeSize;
1473     }
1474   }
1475
1476   return EFI_NOT_FOUND;
1477 }
1478
1479 /**
1480   Retrieve signer's certificates for common authenticated variable
1481   by corresponding VariableName and VendorGuid from "certdb".
1482
1483   @param[in]  VariableName   Name of authenticated Variable.
1484   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1485   @param[out] CertData       Pointer to signer's certificates.
1486   @param[out] CertDataSize   Length of CertData in bytes.
1487
1488   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1489   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1490   @retval  EFI_SUCCESS           Get signer's certificates successfully.
1491
1492 **/
1493 EFI_STATUS
1494 GetCertsFromDb (
1495   IN     CHAR16           *VariableName,
1496   IN     EFI_GUID         *VendorGuid,
1497   OUT    UINT8            **CertData,
1498   OUT    UINT32           *CertDataSize
1499   )
1500 {
1501   VARIABLE_POINTER_TRACK  CertDbVariable;
1502   EFI_STATUS              Status;
1503   UINT8                   *Data;
1504   UINTN                   DataSize;
1505   UINT32                  CertOffset;
1506
1507   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL) || (CertDataSize == NULL)) {
1508     return EFI_INVALID_PARAMETER;
1509   }
1510
1511   //
1512   // Get variable "certdb".
1513   //
1514   Status = FindVariable (
1515              EFI_CERT_DB_NAME,
1516              &gEfiCertDbGuid,
1517              &CertDbVariable,
1518              &mVariableModuleGlobal->VariableGlobal,
1519              FALSE
1520              );
1521   if (EFI_ERROR (Status)) {
1522     return Status;
1523   }
1524
1525   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1526   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1527   if ((DataSize == 0) || (Data == NULL)) {
1528     ASSERT (FALSE);
1529     return EFI_NOT_FOUND;
1530   }
1531
1532   Status = FindCertsFromDb (
1533              VariableName,
1534              VendorGuid,
1535              Data,
1536              DataSize,
1537              &CertOffset,
1538              CertDataSize,
1539              NULL,
1540              NULL
1541              );
1542
1543   if (EFI_ERROR (Status)) {
1544     return Status;
1545   }
1546
1547   *CertData = Data + CertOffset;
1548   return EFI_SUCCESS;
1549 }
1550
1551 /**
1552   Delete matching signer's certificates when deleting common authenticated
1553   variable by corresponding VariableName and VendorGuid from "certdb".
1554
1555   @param[in]  VariableName   Name of authenticated Variable.
1556   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1557
1558   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1559   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1560   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
1561   @retval  EFI_SUCCESS           The operation is completed successfully.
1562
1563 **/
1564 EFI_STATUS
1565 DeleteCertsFromDb (
1566   IN     CHAR16           *VariableName,
1567   IN     EFI_GUID         *VendorGuid
1568   )
1569 {
1570   VARIABLE_POINTER_TRACK  CertDbVariable;
1571   EFI_STATUS              Status;
1572   UINT8                   *Data;
1573   UINTN                   DataSize;
1574   UINT32                  VarAttr;
1575   UINT32                  CertNodeOffset;
1576   UINT32                  CertNodeSize;
1577   UINT8                   *NewCertDb;
1578   UINT32                  NewCertDbSize;
1579
1580   if ((VariableName == NULL) || (VendorGuid == NULL)) {
1581     return EFI_INVALID_PARAMETER;
1582   }
1583
1584   //
1585   // Get variable "certdb".
1586   //
1587   Status = FindVariable (
1588              EFI_CERT_DB_NAME,
1589              &gEfiCertDbGuid,
1590              &CertDbVariable,
1591              &mVariableModuleGlobal->VariableGlobal,
1592              FALSE
1593              );
1594   if (EFI_ERROR (Status)) {
1595     return Status;
1596   }
1597
1598   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1599   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1600   if ((DataSize == 0) || (Data == NULL)) {
1601     ASSERT (FALSE);
1602     return EFI_NOT_FOUND;
1603   }
1604
1605   if (DataSize == sizeof (UINT32)) {
1606     //
1607     // There is no certs in certdb.
1608     //
1609     return EFI_SUCCESS;
1610   }
1611
1612   //
1613   // Get corresponding cert node from certdb.
1614   //
1615   Status = FindCertsFromDb (
1616              VariableName,
1617              VendorGuid,
1618              Data,
1619              DataSize,
1620              NULL,
1621              NULL,
1622              &CertNodeOffset,
1623              &CertNodeSize
1624              );
1625
1626   if (EFI_ERROR (Status)) {
1627     return Status;
1628   }
1629
1630   if (DataSize < (CertNodeOffset + CertNodeSize)) {
1631     return EFI_NOT_FOUND;
1632   }
1633
1634   //
1635   // Construct new data content of variable "certdb".
1636   //
1637   NewCertDbSize = (UINT32) DataSize - CertNodeSize;
1638   NewCertDb     = AllocateZeroPool (NewCertDbSize);
1639   if (NewCertDb == NULL) {
1640     return EFI_OUT_OF_RESOURCES;
1641   }
1642
1643   //
1644   // Copy the DB entries before deleting node.
1645   //
1646   CopyMem (NewCertDb, Data, CertNodeOffset);
1647   //
1648   // Update CertDbListSize.
1649   //
1650   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
1651   //
1652   // Copy the DB entries after deleting node.
1653   //
1654   if (DataSize > (CertNodeOffset + CertNodeSize)) {
1655     CopyMem (
1656       NewCertDb + CertNodeOffset,
1657       Data + CertNodeOffset + CertNodeSize,
1658       DataSize - CertNodeOffset - CertNodeSize
1659       );
1660   }
1661
1662   //
1663   // Set "certdb".
1664   //
1665   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
1666   Status   = UpdateVariable (
1667                EFI_CERT_DB_NAME,
1668                &gEfiCertDbGuid,
1669                NewCertDb,
1670                NewCertDbSize,
1671                VarAttr,
1672                0,
1673                0,
1674                &CertDbVariable,
1675                NULL
1676                );
1677
1678   FreePool (NewCertDb);
1679   return Status;
1680 }
1681
1682 /**
1683   Insert signer's certificates for common authenticated variable with VariableName
1684   and VendorGuid in AUTH_CERT_DB_DATA to "certdb".
1685
1686   @param[in]  VariableName   Name of authenticated Variable.
1687   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1688   @param[in]  CertData       Pointer to signer's certificates.
1689   @param[in]  CertDataSize   Length of CertData in bytes.
1690
1691   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1692   @retval  EFI_ACCESS_DENIED     An AUTH_CERT_DB_DATA entry with same VariableName
1693                                  and VendorGuid already exists.
1694   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
1695   @retval  EFI_SUCCESS           Insert an AUTH_CERT_DB_DATA entry to "certdb"
1696
1697 **/
1698 EFI_STATUS
1699 InsertCertsToDb (
1700   IN     CHAR16           *VariableName,
1701   IN     EFI_GUID         *VendorGuid,
1702   IN     UINT8            *CertData,
1703   IN     UINTN            CertDataSize
1704   )
1705 {
1706   VARIABLE_POINTER_TRACK  CertDbVariable;
1707   EFI_STATUS              Status;
1708   UINT8                   *Data;
1709   UINTN                   DataSize;
1710   UINT32                  VarAttr;
1711   UINT8                   *NewCertDb;
1712   UINT32                  NewCertDbSize;
1713   UINT32                  CertNodeSize;
1714   UINT32                  NameSize;
1715   AUTH_CERT_DB_DATA       *Ptr;
1716
1717   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL)) {
1718     return EFI_INVALID_PARAMETER;
1719   }
1720
1721   //
1722   // Get variable "certdb".
1723   //
1724   Status = FindVariable (
1725              EFI_CERT_DB_NAME,
1726              &gEfiCertDbGuid,
1727              &CertDbVariable,
1728              &mVariableModuleGlobal->VariableGlobal,
1729              FALSE
1730              );
1731   if (EFI_ERROR (Status)) {
1732     return Status;
1733   }
1734
1735   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1736   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1737   if ((DataSize == 0) || (Data == NULL)) {
1738     ASSERT (FALSE);
1739     return EFI_NOT_FOUND;
1740   }
1741
1742   //
1743   // Find whether matching cert node already exists in "certdb".
1744   // If yes return error.
1745   //
1746   Status = FindCertsFromDb (
1747              VariableName,
1748              VendorGuid,
1749              Data,
1750              DataSize,
1751              NULL,
1752              NULL,
1753              NULL,
1754              NULL
1755              );
1756
1757   if (!EFI_ERROR (Status)) {
1758     ASSERT (FALSE);
1759     return EFI_ACCESS_DENIED;
1760   }
1761
1762   //
1763   // Construct new data content of variable "certdb".
1764   //
1765   NameSize      = (UINT32) StrLen (VariableName);
1766   CertNodeSize  = sizeof (AUTH_CERT_DB_DATA) + (UINT32) CertDataSize + NameSize * sizeof (CHAR16);
1767   NewCertDbSize = (UINT32) DataSize + CertNodeSize;
1768   NewCertDb     = AllocateZeroPool (NewCertDbSize);
1769   if (NewCertDb == NULL) {
1770     return EFI_OUT_OF_RESOURCES;
1771   }
1772
1773   //
1774   // Copy the DB entries before deleting node.
1775   //
1776   CopyMem (NewCertDb, Data, DataSize);
1777   //
1778   // Update CertDbListSize.
1779   //
1780   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
1781   //
1782   // Construct new cert node.
1783   //
1784   Ptr = (AUTH_CERT_DB_DATA *) (NewCertDb + DataSize);
1785   CopyGuid (&Ptr->VendorGuid, VendorGuid);
1786   CopyMem (&Ptr->CertNodeSize, &CertNodeSize, sizeof (UINT32));
1787   CopyMem (&Ptr->NameSize, &NameSize, sizeof (UINT32));
1788   CopyMem (&Ptr->CertDataSize, &CertDataSize, sizeof (UINT32));
1789
1790   CopyMem (
1791     (UINT8 *) Ptr + sizeof (AUTH_CERT_DB_DATA),
1792     VariableName,
1793     NameSize * sizeof (CHAR16)
1794     );
1795
1796   CopyMem (
1797     (UINT8 *) Ptr +  sizeof (AUTH_CERT_DB_DATA) + NameSize * sizeof (CHAR16),
1798     CertData,
1799     CertDataSize
1800     );
1801
1802   //
1803   // Set "certdb".
1804   //
1805   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
1806   Status   = UpdateVariable (
1807                EFI_CERT_DB_NAME,
1808                &gEfiCertDbGuid,
1809                NewCertDb,
1810                NewCertDbSize,
1811                VarAttr,
1812                0,
1813                0,
1814                &CertDbVariable,
1815                NULL
1816                );
1817
1818   FreePool (NewCertDb);
1819   return Status;
1820 }
1821
1822 /**
1823   Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
1824
1825   Caution: This function may receive untrusted input.
1826   This function may be invoked in SMM mode, and datasize and data are external input.
1827   This function will do basic validation, before parse the data.
1828   This function will parse the authentication carefully to avoid security issues, like
1829   buffer overflow, integer overflow.
1830
1831   @param[in]  VariableName                Name of Variable to be found.
1832   @param[in]  VendorGuid                  Variable vendor GUID.
1833   @param[in]  Data                        Data pointer.
1834   @param[in]  DataSize                    Size of Data found. If size is less than the
1835                                           data, this value contains the required size.
1836   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1837   @param[in]  Attributes                  Attribute value of the variable.
1838   @param[in]  AuthVarType                 Verify against PK, KEK database, private database or certificate in data payload.
1839   @param[out] VarDel                      Delete the variable or not.
1840
1841   @retval EFI_INVALID_PARAMETER           Invalid parameter.
1842   @retval EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
1843                                           check carried out by the firmware.
1844   @retval EFI_OUT_OF_RESOURCES            Failed to process variable due to lack
1845                                           of resources.
1846   @retval EFI_SUCCESS                     Variable pass validation successfully.
1847
1848 **/
1849 EFI_STATUS
1850 VerifyTimeBasedPayload (
1851   IN     CHAR16                             *VariableName,
1852   IN     EFI_GUID                           *VendorGuid,
1853   IN     VOID                               *Data,
1854   IN     UINTN                              DataSize,
1855   IN     VARIABLE_POINTER_TRACK             *Variable,
1856   IN     UINT32                             Attributes,
1857   IN     AUTHVAR_TYPE                       AuthVarType,
1858   OUT    BOOLEAN                            *VarDel
1859   )
1860 {
1861   UINT8                            *RootCert;
1862   UINT8                            *SigData;
1863   UINT8                            *PayloadPtr;
1864   UINTN                            RootCertSize;
1865   UINTN                            Index;
1866   UINTN                            CertCount;
1867   UINTN                            PayloadSize;
1868   UINT32                           Attr;
1869   UINT32                           SigDataSize;
1870   UINT32                           KekDataSize;
1871   BOOLEAN                          VerifyStatus;
1872   EFI_STATUS                       Status;
1873   EFI_SIGNATURE_LIST               *CertList;
1874   EFI_SIGNATURE_DATA               *Cert;
1875   VARIABLE_POINTER_TRACK           KekVariable;
1876   EFI_VARIABLE_AUTHENTICATION_2    *CertData;
1877   UINT8                            *NewData;
1878   UINTN                            NewDataSize;
1879   VARIABLE_POINTER_TRACK           PkVariable;
1880   UINT8                            *Buffer;
1881   UINTN                            Length;
1882   UINT8                            *SignerCerts;
1883   UINT8                            *WrapSigData;
1884   UINTN                            CertStackSize;
1885   UINT8                            *CertsInCertDb;
1886   UINT32                           CertsSizeinDb;
1887
1888   VerifyStatus           = FALSE;
1889   CertData               = NULL;
1890   NewData                = NULL;
1891   Attr                   = Attributes;
1892   WrapSigData            = NULL;
1893   SignerCerts            = NULL;
1894   RootCert               = NULL;
1895
1896   //
1897   // When the attribute EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS is
1898   // set, then the Data buffer shall begin with an instance of a complete (and serialized)
1899   // EFI_VARIABLE_AUTHENTICATION_2 descriptor. The descriptor shall be followed by the new
1900   // variable value and DataSize shall reflect the combined size of the descriptor and the new
1901   // variable value. The authentication descriptor is not part of the variable data and is not
1902   // returned by subsequent calls to GetVariable().
1903   //
1904   CertData = (EFI_VARIABLE_AUTHENTICATION_2 *) Data;
1905
1906   //
1907   // Verify that Pad1, Nanosecond, TimeZone, Daylight and Pad2 components of the
1908   // TimeStamp value are set to zero.
1909   //
1910   if ((CertData->TimeStamp.Pad1 != 0) ||
1911       (CertData->TimeStamp.Nanosecond != 0) ||
1912       (CertData->TimeStamp.TimeZone != 0) ||
1913       (CertData->TimeStamp.Daylight != 0) ||
1914       (CertData->TimeStamp.Pad2 != 0)) {
1915     return EFI_SECURITY_VIOLATION;
1916   }
1917
1918   if ((Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
1919     if (CompareTimeStamp (&CertData->TimeStamp, &Variable->CurrPtr->TimeStamp)) {
1920       //
1921       // TimeStamp check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
1922       //
1923       return EFI_SECURITY_VIOLATION;
1924     }
1925   }
1926
1927   //
1928   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
1929   // Cert type should be EFI_CERT_TYPE_PKCS7_GUID.
1930   //
1931   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
1932       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertPkcs7Guid)) {
1933     //
1934     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
1935     //
1936     return EFI_SECURITY_VIOLATION;
1937   }
1938
1939   //
1940   // Find out Pkcs7 SignedData which follows the EFI_VARIABLE_AUTHENTICATION_2 descriptor.
1941   // AuthInfo.Hdr.dwLength is the length of the entire certificate, including the length of the header.
1942   //
1943   SigData = CertData->AuthInfo.CertData;
1944   SigDataSize = CertData->AuthInfo.Hdr.dwLength - (UINT32) (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData));
1945
1946   //
1947   // Find out the new data payload which follows Pkcs7 SignedData directly.
1948   //
1949   PayloadPtr = SigData + SigDataSize;
1950   PayloadSize = DataSize - OFFSET_OF_AUTHINFO2_CERT_DATA - (UINTN) SigDataSize;
1951
1952   //
1953   // Construct a buffer to fill with (VariableName, VendorGuid, Attributes, TimeStamp, Data).
1954   //
1955   NewDataSize = PayloadSize + sizeof (EFI_TIME) + sizeof (UINT32) +
1956                 sizeof (EFI_GUID) + StrSize (VariableName) - sizeof (CHAR16);
1957   NewData = mSerializationRuntimeBuffer;
1958
1959   Buffer = NewData;
1960   Length = StrLen (VariableName) * sizeof (CHAR16);
1961   CopyMem (Buffer, VariableName, Length);
1962   Buffer += Length;
1963
1964   Length = sizeof (EFI_GUID);
1965   CopyMem (Buffer, VendorGuid, Length);
1966   Buffer += Length;
1967
1968   Length = sizeof (UINT32);
1969   CopyMem (Buffer, &Attr, Length);
1970   Buffer += Length;
1971
1972   Length = sizeof (EFI_TIME);
1973   CopyMem (Buffer, &CertData->TimeStamp, Length);
1974   Buffer += Length;
1975
1976   CopyMem (Buffer, PayloadPtr, PayloadSize);
1977
1978   if (AuthVarType == AuthVarTypePk) {
1979     //
1980     // Get platform key from variable.
1981     //
1982     Status = FindVariable (
1983                EFI_PLATFORM_KEY_NAME,
1984                &gEfiGlobalVariableGuid,
1985                &PkVariable,
1986                &mVariableModuleGlobal->VariableGlobal,
1987                FALSE
1988                );
1989     if (EFI_ERROR (Status)) {
1990       return Status;
1991     }
1992
1993     CertList = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (PkVariable.CurrPtr);
1994     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
1995     RootCert      = Cert->SignatureData;
1996     RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
1997
1998
1999     //
2000     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2001     //
2002     VerifyStatus = Pkcs7Verify (
2003                      SigData,
2004                      SigDataSize,
2005                      RootCert,
2006                      RootCertSize,
2007                      NewData,
2008                      NewDataSize
2009                      );
2010
2011   } else if (AuthVarType == AuthVarTypeKek) {
2012
2013     //
2014     // Get KEK database from variable.
2015     //
2016     Status = FindVariable (
2017                EFI_KEY_EXCHANGE_KEY_NAME,
2018                &gEfiGlobalVariableGuid,
2019                &KekVariable,
2020                &mVariableModuleGlobal->VariableGlobal,
2021                FALSE
2022                );
2023     if (EFI_ERROR (Status)) {
2024       return Status;
2025     }
2026
2027     //
2028     // Ready to verify Pkcs7 SignedData. Go through KEK Signature Database to find out X.509 CertList.
2029     //
2030     KekDataSize      = KekVariable.CurrPtr->DataSize;
2031     CertList         = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (KekVariable.CurrPtr);
2032     while ((KekDataSize > 0) && (KekDataSize >= CertList->SignatureListSize)) {
2033       if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {
2034         Cert       = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2035         CertCount  = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
2036         for (Index = 0; Index < CertCount; Index++) {
2037           //
2038           // Iterate each Signature Data Node within this CertList for a verify
2039           //
2040           RootCert      = Cert->SignatureData;
2041           RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2042
2043           //
2044           // Verify Pkcs7 SignedData via Pkcs7Verify library.
2045           //
2046           VerifyStatus = Pkcs7Verify (
2047                            SigData,
2048                            SigDataSize,
2049                            RootCert,
2050                            RootCertSize,
2051                            NewData,
2052                            NewDataSize
2053                            );
2054           if (VerifyStatus) {
2055             goto Exit;
2056           }
2057           Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
2058         }
2059       }
2060       KekDataSize -= CertList->SignatureListSize;
2061       CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
2062     }
2063   } else if (AuthVarType == AuthVarTypePriv) {
2064
2065     //
2066     // Process common authenticated variable except PK/KEK/DB/DBX.
2067     // Get signer's certificates from SignedData.
2068     //
2069     VerifyStatus = Pkcs7GetSigners (
2070                      SigData,
2071                      SigDataSize,
2072                      &SignerCerts,
2073                      &CertStackSize,
2074                      &RootCert,
2075                      &RootCertSize
2076                      );
2077     if (!VerifyStatus) {
2078       goto Exit;
2079     }
2080
2081     //
2082     // Get previously stored signer's certificates from certdb for existing
2083     // variable. Check whether they are identical with signer's certificates
2084     // in SignedData. If not, return error immediately.
2085     //
2086     if ((Variable->CurrPtr != NULL)) {
2087       VerifyStatus = FALSE;
2088
2089       Status = GetCertsFromDb (VariableName, VendorGuid, &CertsInCertDb, &CertsSizeinDb);
2090       if (EFI_ERROR (Status)) {
2091         goto Exit;
2092       }
2093
2094       if ((CertStackSize != CertsSizeinDb) ||
2095           (CompareMem (SignerCerts, CertsInCertDb, CertsSizeinDb) != 0)) {
2096         goto Exit;
2097       }
2098     }
2099
2100     VerifyStatus = Pkcs7Verify (
2101                      SigData,
2102                      SigDataSize,
2103                      RootCert,
2104                      RootCertSize,
2105                      NewData,
2106                      NewDataSize
2107                      );
2108     if (!VerifyStatus) {
2109       goto Exit;
2110     }
2111
2112     //
2113     // Delete signer's certificates when delete the common authenticated variable.
2114     //
2115     if ((PayloadSize == 0) && (Variable->CurrPtr != NULL)) {
2116       Status = DeleteCertsFromDb (VariableName, VendorGuid);
2117       if (EFI_ERROR (Status)) {
2118         VerifyStatus = FALSE;
2119         goto Exit;
2120       }
2121     } else if (Variable->CurrPtr == NULL) {
2122       //
2123       // Insert signer's certificates when adding a new common authenticated variable.
2124       //
2125       Status = InsertCertsToDb (VariableName, VendorGuid, SignerCerts, CertStackSize);
2126       if (EFI_ERROR (Status)) {
2127         VerifyStatus = FALSE;
2128         goto Exit;
2129       }
2130     }
2131   } else if (AuthVarType == AuthVarTypePayload) {
2132     CertList = (EFI_SIGNATURE_LIST *) PayloadPtr;
2133     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2134     RootCert      = Cert->SignatureData;
2135     RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2136
2137     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2138     //
2139     VerifyStatus = Pkcs7Verify (
2140                      SigData,
2141                      SigDataSize,
2142                      RootCert,
2143                      RootCertSize,
2144                      NewData,
2145                      NewDataSize
2146                      );
2147   } else {
2148     return EFI_SECURITY_VIOLATION;
2149   }
2150
2151 Exit:
2152
2153   if (AuthVarType == AuthVarTypePriv) {
2154     Pkcs7FreeSigners (RootCert);
2155     Pkcs7FreeSigners (SignerCerts);
2156   }
2157
2158   if (!VerifyStatus) {
2159     return EFI_SECURITY_VIOLATION;
2160   }
2161
2162   Status = CheckSignatureListFormat(VariableName, VendorGuid, PayloadPtr, PayloadSize);
2163   if (EFI_ERROR (Status)) {
2164     return Status;
2165   }
2166
2167   if ((PayloadSize == 0) && (VarDel != NULL)) {
2168     *VarDel = TRUE;
2169   }
2170
2171   //
2172   // Final step: Update/Append Variable if it pass Pkcs7Verify
2173   //
2174   return UpdateVariable (
2175            VariableName,
2176            VendorGuid,
2177            PayloadPtr,
2178            PayloadSize,
2179            Attributes,
2180            0,
2181            0,
2182            Variable,
2183            &CertData->TimeStamp
2184            );
2185 }
2186