SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c

   1 /** @file
   2   Implement authentication services for the authenticated variable
   3   service in UEFI2.2.
   4
   5   Caution: This module requires additional review when modified.
   6   This driver will have external input - variable data. It may be input in SMM mode.
   7   This external input must be validated carefully to avoid security issue like
   8   buffer overflow, integer overflow.
   9   Variable attribute should also be checked to avoid authentication bypass.
  10
  11   ProcessVarWithPk(), ProcessVarWithKek() and ProcessVariable() are the function to do
  12   variable authentication.
  13
  14   VerifyTimeBasedPayload() and VerifyCounterBasedPayload() are sub function to do verification.
  15   They will do basic validation for authentication data structure, then call crypto library
  16   to verify the signature.
  17
  18 Copyright (c) 2009 - 2012, Intel Corporation. All rights reserved.<BR>
  19 This program and the accompanying materials
  20 are licensed and made available under the terms and conditions of the BSD License
  21 which accompanies this distribution.  The full text of the license may be found at
  22 http://opensource.org/licenses/bsd-license.php
  23
  24 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  25 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  26
  27 **/
  28
  29 #include "Variable.h"
  30 #include "AuthService.h"
  31
  32 ///
  33 /// Global database array for scratch
  34 ///
  35 UINT8    mPubKeyStore[MAX_KEYDB_SIZE];
  36 UINT32   mPubKeyNumber;
  37 UINT32   mPlatformMode;
  38 EFI_GUID mSignatureSupport[] = {EFI_CERT_SHA1_GUID, EFI_CERT_SHA256_GUID, EFI_CERT_RSA2048_GUID, EFI_CERT_X509_GUID};
  39 //
  40 // Public Exponent of RSA Key.
  41 //
  42 CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };
  43 //
  44 // Hash context pointer
  45 //
  46 VOID  *mHashCtx = NULL;
  47
  48 //
  49 // Pointer to runtime buffer.
  50 // For "Append" operation to an existing variable, a read/modify/write operation
  51 // is supported by firmware internally. Reserve runtime buffer to cache previous
  52 // variable data in runtime phase because memory allocation is forbidden in virtual mode.
  53 //
  54 VOID  *mStorageArea = NULL;
  55
  56 //
  57 // The serialization of the values of the VariableName, VendorGuid and Attributes
  58 // parameters of the SetVariable() call and the TimeStamp component of the
  59 // EFI_VARIABLE_AUTHENTICATION_2 descriptor followed by the variable's new value
  60 // i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data)
  61 //
  62 UINT8 *mSerializationRuntimeBuffer = NULL;
  63
  64 //
  65 // Requirement for different signature type which have been defined in UEFI spec.
  66 // These data are used to peform SignatureList format check while setting PK/KEK variable.
  67 //
  68 EFI_SIGNATURE_ITEM mSupportSigItem[] = {
  69 //{SigType,                       SigHeaderSize,   SigDataSize  }
  70   {EFI_CERT_SHA256_GUID,          0,               32           },
  71   {EFI_CERT_RSA2048_GUID,         0,               256          },
  72   {EFI_CERT_RSA2048_SHA256_GUID,  0,               256          },
  73   {EFI_CERT_SHA1_GUID,            0,               20           },
  74   {EFI_CERT_RSA2048_SHA1_GUID,    0,               256          },
  75   {EFI_CERT_X509_GUID,            0,               ((UINT32) ~0)},
  76   {EFI_CERT_SHA224_GUID,          0,               28           },
  77   {EFI_CERT_SHA384_GUID,          0,               48           },
  78   {EFI_CERT_SHA512_GUID,          0,               64           }
  79 };
  80
  81 /**
  82   Determine whether this operation needs a physical present user.
  83
  84   @param[in]      VariableName            Name of the Variable.
  85   @param[in]      VendorGuid              GUID of the Variable.
  86
  87   @retval TRUE      This variable is protected, only a physical present user could set this variable.
  88   @retval FALSE     This variable is not protected.
  89
  90 **/
  91 BOOLEAN
  92 NeedPhysicallyPresent(
  93   IN     CHAR16         *VariableName,
  94   IN     EFI_GUID       *VendorGuid
  95   )
  96 {
  97   if ((CompareGuid (VendorGuid, &gEfiSecureBootEnableDisableGuid) && (StrCmp (VariableName, EFI_SECURE_BOOT_ENABLE_NAME) == 0))
  98     || (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (VariableName, EFI_CUSTOM_MODE_NAME) == 0))) {
  99     return TRUE;
 100   }
 101
 102   return FALSE;
 103 }
 104
 105 /**
 106   Determine whether the platform is operating in Custom Secure Boot mode.
 107
 108   @retval TRUE           The platform is operating in Custom mode.
 109   @retval FALSE          The platform is operating in Standard mode.
 110
 111 **/
 112 BOOLEAN
 113 InCustomMode (
 114   VOID
 115   )
 116 {
 117   VARIABLE_POINTER_TRACK  Variable;
 118
 119   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 120   if (Variable.CurrPtr != NULL && *(GetVariableDataPtr (Variable.CurrPtr)) == CUSTOM_SECURE_BOOT_MODE) {
 121     return TRUE;
 122   }
 123
 124   return FALSE;
 125 }
 126
 127
 128 /**
 129   Internal function to delete a Variable given its name and GUID, no authentication
 130   required.
 131
 132   @param[in]      VariableName            Name of the Variable.
 133   @param[in]      VendorGuid              GUID of the Variable.
 134
 135   @retval EFI_SUCCESS              Variable deleted successfully.
 136   @retval Others                   The driver failded to start the device.
 137
 138 **/
 139 EFI_STATUS
 140 DeleteVariable (
 141   IN  CHAR16                    *VariableName,
 142   IN  EFI_GUID                  *VendorGuid
 143   )
 144 {
 145   EFI_STATUS              Status;
 146   VARIABLE_POINTER_TRACK  Variable;
 147
 148   Status = FindVariable (VariableName, VendorGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 149   if (EFI_ERROR (Status)) {
 150     return EFI_SUCCESS;
 151   }
 152
 153   ASSERT (Variable.CurrPtr != NULL);
 154   return UpdateVariable (VariableName, VendorGuid, NULL, 0, 0, 0, 0, &Variable, NULL);
 155 }
 156
 157 /**
 158   Initializes for authenticated varibale service.
 159
 160   @retval EFI_SUCCESS           Function successfully executed.
 161   @retval EFI_OUT_OF_RESOURCES  Fail to allocate enough memory resources.
 162
 163 **/
 164 EFI_STATUS
 165 AutenticatedVariableServiceInitialize (
 166   VOID
 167   )
 168 {
 169   EFI_STATUS              Status;
 170   VARIABLE_POINTER_TRACK  Variable;
 171   VARIABLE_POINTER_TRACK  PkVariable;
 172   UINT8                   VarValue;
 173   UINT32                  VarAttr;
 174   UINT8                   *Data;
 175   UINTN                   DataSize;
 176   UINTN                   CtxSize;
 177   UINT8                   SecureBootMode;
 178   UINT8                   SecureBootEnable;
 179   UINT8                   CustomMode;
 180   UINT32                  ListSize;
 181
 182   //
 183   // Initialize hash context.
 184   //
 185   CtxSize   = Sha256GetContextSize ();
 186   mHashCtx  = AllocateRuntimePool (CtxSize);
 187   if (mHashCtx == NULL) {
 188     return EFI_OUT_OF_RESOURCES;
 189   }
 190
 191   //
 192   // Reserved runtime buffer for "Append" operation in virtual mode.
 193   //
 194   mStorageArea  = AllocateRuntimePool (PcdGet32 (PcdMaxVariableSize));
 195   if (mStorageArea == NULL) {
 196     return EFI_OUT_OF_RESOURCES;
 197   }
 198
 199   //
 200   // Prepare runtime buffer for serialized data of time-based authenticated
 201   // Variable, i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data).
 202   //
 203   mSerializationRuntimeBuffer = AllocateRuntimePool (PcdGet32 (PcdMaxVariableSize) + sizeof (EFI_GUID) + sizeof (UINT32) + sizeof (EFI_TIME));
 204   if (mSerializationRuntimeBuffer == NULL) {
 205     return EFI_OUT_OF_RESOURCES;
 206   }
 207
 208   //
 209   // Check "AuthVarKeyDatabase" variable's existence.
 210   // If it doesn't exist, create a new one with initial value of 0 and EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
 211   //
 212   Status = FindVariable (
 213              AUTHVAR_KEYDB_NAME,
 214              &gEfiAuthenticatedVariableGuid,
 215              &Variable,
 216              &mVariableModuleGlobal->VariableGlobal,
 217              FALSE
 218              );
 219
 220   if (Variable.CurrPtr == NULL) {
 221     VarAttr       = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 222     VarValue      = 0;
 223     mPubKeyNumber = 0;
 224     Status        = UpdateVariable (
 225                       AUTHVAR_KEYDB_NAME,
 226                       &gEfiAuthenticatedVariableGuid,
 227                       &VarValue,
 228                       sizeof(UINT8),
 229                       VarAttr,
 230                       0,
 231                       0,
 232                       &Variable,
 233                       NULL
 234                       );
 235     if (EFI_ERROR (Status)) {
 236       return Status;
 237     }
 238   } else {
 239     //
 240     // Load database in global variable for cache.
 241     //
 242     DataSize  = DataSizeOfVariable (Variable.CurrPtr);
 243     Data      = GetVariableDataPtr (Variable.CurrPtr);
 244     ASSERT ((DataSize != 0) && (Data != NULL));
 245     CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
 246     mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
 247   }
 248
 249   FindVariable (EFI_PLATFORM_KEY_NAME, &gEfiGlobalVariableGuid, &PkVariable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 250   if (PkVariable.CurrPtr == NULL) {
 251     DEBUG ((EFI_D_INFO, "Variable %s does not exist.\n", EFI_PLATFORM_KEY_NAME));
 252   } else {
 253     DEBUG ((EFI_D_INFO, "Variable %s exists.\n", EFI_PLATFORM_KEY_NAME));
 254   }
 255
 256   //
 257   // Check "SetupMode" variable's existence.
 258   // If it doesn't exist, check PK database's existence to determine the value.
 259   // Then create a new one with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
 260   //
 261   Status = FindVariable (
 262              EFI_SETUP_MODE_NAME,
 263              &gEfiGlobalVariableGuid,
 264              &Variable,
 265              &mVariableModuleGlobal->VariableGlobal,
 266              FALSE
 267              );
 268
 269   if (Variable.CurrPtr == NULL) {
 270     if (PkVariable.CurrPtr == NULL) {
 271       mPlatformMode = SETUP_MODE;
 272     } else {
 273       mPlatformMode = USER_MODE;
 274     }
 275
 276     VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 277     Status  = UpdateVariable (
 278                 EFI_SETUP_MODE_NAME,
 279                 &gEfiGlobalVariableGuid,
 280                 &mPlatformMode,
 281                 sizeof(UINT8),
 282                 VarAttr,
 283                 0,
 284                 0,
 285                 &Variable,
 286                 NULL
 287                 );
 288     if (EFI_ERROR (Status)) {
 289       return Status;
 290     }
 291   } else {
 292     mPlatformMode = *(GetVariableDataPtr (Variable.CurrPtr));
 293   }
 294   //
 295   // Check "SignatureSupport" variable's existence.
 296   // If it doesn't exist, then create a new one with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
 297   //
 298   Status = FindVariable (
 299              EFI_SIGNATURE_SUPPORT_NAME,
 300              &gEfiGlobalVariableGuid,
 301              &Variable,
 302              &mVariableModuleGlobal->VariableGlobal,
 303              FALSE
 304              );
 305
 306   if (Variable.CurrPtr == NULL) {
 307     VarAttr = EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 308     Status  = UpdateVariable (
 309                 EFI_SIGNATURE_SUPPORT_NAME,
 310                 &gEfiGlobalVariableGuid,
 311                 mSignatureSupport,
 312                 sizeof(mSignatureSupport),
 313                 VarAttr,
 314                 0,
 315                 0,
 316                 &Variable,
 317                 NULL
 318                 );
 319   }
 320
 321   //
 322   // If "SecureBootEnable" variable exists, then update "SecureBoot" variable.
 323   // If "SecureBootEnable" variable is SECURE_BOOT_ENABLE and in USER_MODE, Set "SecureBoot" variable to SECURE_BOOT_MODE_ENABLE.
 324   // If "SecureBootEnable" variable is SECURE_BOOT_DISABLE, Set "SecureBoot" variable to SECURE_BOOT_MODE_DISABLE.
 325   //
 326   SecureBootEnable = SECURE_BOOT_DISABLE;
 327   FindVariable (EFI_SECURE_BOOT_ENABLE_NAME, &gEfiSecureBootEnableDisableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 328   if (Variable.CurrPtr != NULL) {
 329     SecureBootEnable = *(GetVariableDataPtr (Variable.CurrPtr));
 330   } else if (mPlatformMode == USER_MODE) {
 331     //
 332     // "SecureBootEnable" not exist, initialize it in USER_MODE.
 333     //
 334     SecureBootEnable = SECURE_BOOT_ENABLE;
 335     Status = UpdateVariable (
 336                EFI_SECURE_BOOT_ENABLE_NAME,
 337                &gEfiSecureBootEnableDisableGuid,
 338                &SecureBootEnable,
 339                sizeof (UINT8),
 340                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 341                0,
 342                0,
 343                &Variable,
 344                NULL
 345                );
 346     if (EFI_ERROR (Status)) {
 347       return Status;
 348     }
 349   }
 350
 351   if (SecureBootEnable == SECURE_BOOT_ENABLE && mPlatformMode == USER_MODE) {
 352     SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 353   } else {
 354     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 355   }
 356   FindVariable (EFI_SECURE_BOOT_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 357   Status = UpdateVariable (
 358              EFI_SECURE_BOOT_MODE_NAME,
 359              &gEfiGlobalVariableGuid,
 360              &SecureBootMode,
 361              sizeof (UINT8),
 362              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS,
 363              0,
 364              0,
 365              &Variable,
 366              NULL
 367              );
 368   if (EFI_ERROR (Status)) {
 369     return Status;
 370   }
 371
 372   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SETUP_MODE_NAME, mPlatformMode));
 373   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_MODE_NAME, SecureBootMode));
 374   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_ENABLE_NAME, SecureBootEnable));
 375
 376   //
 377   // Check "CustomMode" variable's existence.
 378   //
 379   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 380   if (Variable.CurrPtr != NULL) {
 381     CustomMode = *(GetVariableDataPtr (Variable.CurrPtr));
 382   } else {
 383     //
 384     // "CustomMode" not exist, initialize it in STANDARD_SECURE_BOOT_MODE.
 385     //
 386     CustomMode = STANDARD_SECURE_BOOT_MODE;
 387     Status = UpdateVariable (
 388                EFI_CUSTOM_MODE_NAME,
 389                &gEfiCustomModeEnableGuid,
 390                &CustomMode,
 391                sizeof (UINT8),
 392                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 393                0,
 394                0,
 395                &Variable,
 396                NULL
 397                );
 398     if (EFI_ERROR (Status)) {
 399       return Status;
 400     }
 401   }
 402
 403   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_CUSTOM_MODE_NAME, CustomMode));
 404
 405   //
 406   // Check "certdb" variable's existence.
 407   // If it doesn't exist, then create a new one with
 408   // EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.
 409   //
 410   Status = FindVariable (
 411              EFI_CERT_DB_NAME,
 412              &gEfiCertDbGuid,
 413              &Variable,
 414              &mVariableModuleGlobal->VariableGlobal,
 415              FALSE
 416              );
 417
 418   if (Variable.CurrPtr == NULL) {
 419     VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
 420     ListSize = 0;
 421     Status   = UpdateVariable (
 422                  EFI_CERT_DB_NAME,
 423                  &gEfiCertDbGuid,
 424                  &ListSize,
 425                  sizeof (UINT32),
 426                  VarAttr,
 427                  0,
 428                  0,
 429                  &Variable,
 430                  NULL
 431                  );
 432
 433   }
 434
 435   return Status;
 436 }
 437
 438 /**
 439   Add public key in store and return its index.
 440
 441   @param[in]  PubKey                  Input pointer to Public Key data
 442
 443   @return                             Index of new added item
 444
 445 **/
 446 UINT32
 447 AddPubKeyInStore (
 448   IN  UINT8               *PubKey
 449   )
 450 {
 451   EFI_STATUS              Status;
 452   BOOLEAN                 IsFound;
 453   UINT32                  Index;
 454   VARIABLE_POINTER_TRACK  Variable;
 455   UINT8                   *Ptr;
 456
 457   if (PubKey == NULL) {
 458     return 0;
 459   }
 460
 461   Status = FindVariable (
 462              AUTHVAR_KEYDB_NAME,
 463              &gEfiAuthenticatedVariableGuid,
 464              &Variable,
 465              &mVariableModuleGlobal->VariableGlobal,
 466              FALSE
 467              );
 468   ASSERT_EFI_ERROR (Status);
 469   //
 470   // Check whether the public key entry does exist.
 471   //
 472   IsFound = FALSE;
 473   for (Ptr = mPubKeyStore, Index = 1; Index <= mPubKeyNumber; Index++) {
 474     if (CompareMem (Ptr, PubKey, EFI_CERT_TYPE_RSA2048_SIZE) == 0) {
 475       IsFound = TRUE;
 476       break;
 477     }
 478     Ptr += EFI_CERT_TYPE_RSA2048_SIZE;
 479   }
 480
 481   if (!IsFound) {
 482     //
 483     // Add public key in database.
 484     //
 485     if (mPubKeyNumber == MAX_KEY_NUM) {
 486       //
 487       // Notes: Database is full, need enhancement here, currently just return 0.
 488       //
 489       return 0;
 490     }
 491
 492     CopyMem (mPubKeyStore + mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 493     Index = ++mPubKeyNumber;
 494     //
 495     // Update public key database variable.
 496     //
 497     Status = UpdateVariable (
 498                AUTHVAR_KEYDB_NAME,
 499                &gEfiAuthenticatedVariableGuid,
 500                mPubKeyStore,
 501                mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE,
 502                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS,
 503                0,
 504                0,
 505                &Variable,
 506                NULL
 507                );
 508     ASSERT_EFI_ERROR (Status);
 509   }
 510
 511   return Index;
 512 }
 513
 514 /**
 515   Verify data payload with AuthInfo in EFI_CERT_TYPE_RSA2048_SHA256_GUID type.
 516   Follow the steps in UEFI2.2.
 517
 518   Caution: This function may receive untrusted input.
 519   This function may be invoked in SMM mode, and datasize and data are external input.
 520   This function will do basic validation, before parse the data.
 521   This function will parse the authentication carefully to avoid security issues, like
 522   buffer overflow, integer overflow.
 523
 524   @param[in]      Data                    Pointer to data with AuthInfo.
 525   @param[in]      DataSize                Size of Data.
 526   @param[in]      PubKey                  Public key used for verification.
 527
 528   @retval EFI_INVALID_PARAMETER       Invalid parameter.
 529   @retval EFI_SECURITY_VIOLATION      If authentication failed.
 530   @retval EFI_SUCCESS                 Authentication successful.
 531
 532 **/
 533 EFI_STATUS
 534 VerifyCounterBasedPayload (
 535   IN     UINT8          *Data,
 536   IN     UINTN          DataSize,
 537   IN     UINT8          *PubKey
 538   )
 539 {
 540   BOOLEAN                         Status;
 541   EFI_VARIABLE_AUTHENTICATION     *CertData;
 542   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
 543   UINT8                           Digest[SHA256_DIGEST_SIZE];
 544   VOID                            *Rsa;
 545
 546   Rsa         = NULL;
 547   CertData    = NULL;
 548   CertBlock   = NULL;
 549
 550   if (Data == NULL || PubKey == NULL) {
 551     return EFI_INVALID_PARAMETER;
 552   }
 553
 554   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
 555   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
 556
 557   //
 558   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
 559   // Cert type should be EFI_CERT_TYPE_RSA2048_SHA256_GUID.
 560   //
 561   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
 562       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertTypeRsa2048Sha256Guid)
 563         ) {
 564     //
 565     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
 566     //
 567     return EFI_SECURITY_VIOLATION;
 568   }
 569   //
 570   // Hash data payload with SHA256.
 571   //
 572   ZeroMem (Digest, SHA256_DIGEST_SIZE);
 573   Status  = Sha256Init (mHashCtx);
 574   if (!Status) {
 575     goto Done;
 576   }
 577   Status  = Sha256Update (mHashCtx, Data + AUTHINFO_SIZE, (UINTN) (DataSize - AUTHINFO_SIZE));
 578   if (!Status) {
 579     goto Done;
 580   }
 581   //
 582   // Hash Monotonic Count.
 583   //
 584   Status  = Sha256Update (mHashCtx, &CertData->MonotonicCount, sizeof (UINT64));
 585   if (!Status) {
 586     goto Done;
 587   }
 588   Status  = Sha256Final (mHashCtx, Digest);
 589   if (!Status) {
 590     goto Done;
 591   }
 592   //
 593   // Generate & Initialize RSA Context.
 594   //
 595   Rsa = RsaNew ();
 596   ASSERT (Rsa != NULL);
 597   //
 598   // Set RSA Key Components.
 599   // NOTE: Only N and E are needed to be set as RSA public key for signature verification.
 600   //
 601   Status = RsaSetKey (Rsa, RsaKeyN, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 602   if (!Status) {
 603     goto Done;
 604   }
 605   Status = RsaSetKey (Rsa, RsaKeyE, mRsaE, sizeof (mRsaE));
 606   if (!Status) {
 607     goto Done;
 608   }
 609   //
 610   // Verify the signature.
 611   //
 612   Status = RsaPkcs1Verify (
 613              Rsa,
 614              Digest,
 615              SHA256_DIGEST_SIZE,
 616              CertBlock->Signature,
 617              EFI_CERT_TYPE_RSA2048_SHA256_SIZE
 618              );
 619
 620 Done:
 621   if (Rsa != NULL) {
 622     RsaFree (Rsa);
 623   }
 624   if (Status) {
 625     return EFI_SUCCESS;
 626   } else {
 627     return EFI_SECURITY_VIOLATION;
 628   }
 629 }
 630
 631 /**
 632   Update platform mode.
 633
 634   @param[in]      Mode                    SETUP_MODE or USER_MODE.
 635
 636   @return EFI_INVALID_PARAMETER           Invalid parameter.
 637   @return EFI_SUCCESS                     Update platform mode successfully.
 638
 639 **/
 640 EFI_STATUS
 641 UpdatePlatformMode (
 642   IN  UINT32                    Mode
 643   )
 644 {
 645   EFI_STATUS              Status;
 646   VARIABLE_POINTER_TRACK  Variable;
 647   UINT32                  VarAttr;
 648   UINT8                   SecureBootMode;
 649   UINT8                   SecureBootEnable;
 650   UINTN                   VariableDataSize;
 651
 652   Status = FindVariable (
 653              EFI_SETUP_MODE_NAME,
 654              &gEfiGlobalVariableGuid,
 655              &Variable,
 656              &mVariableModuleGlobal->VariableGlobal,
 657              FALSE
 658              );
 659   if (EFI_ERROR (Status)) {
 660     return Status;
 661   }
 662
 663   mPlatformMode  = Mode;
 664   VarAttr        = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 665   Status         = UpdateVariable (
 666                      EFI_SETUP_MODE_NAME,
 667                      &gEfiGlobalVariableGuid,
 668                      &mPlatformMode,
 669                      sizeof(UINT8),
 670                      VarAttr,
 671                      0,
 672                      0,
 673                      &Variable,
 674                      NULL
 675                      );
 676   if (EFI_ERROR (Status)) {
 677     return Status;
 678   }
 679
 680   if (AtRuntime ()) {
 681     //
 682     // SecureBoot Variable indicates whether the platform firmware is operating
 683     // in Secure boot mode (1) or not (0), so we should not change SecureBoot
 684     // Variable in runtime.
 685     //
 686     return Status;
 687   }
 688
 689   //
 690   // Check "SecureBoot" variable's existence.
 691   // If it doesn't exist, firmware has no capability to perform driver signing verification,
 692   // then set "SecureBoot" to 0.
 693   //
 694   Status = FindVariable (
 695              EFI_SECURE_BOOT_MODE_NAME,
 696              &gEfiGlobalVariableGuid,
 697              &Variable,
 698              &mVariableModuleGlobal->VariableGlobal,
 699              FALSE
 700              );
 701   //
 702   // If "SecureBoot" variable exists, then check "SetupMode" variable update.
 703   // If "SetupMode" variable is USER_MODE, "SecureBoot" variable is set to 1.
 704   // If "SetupMode" variable is SETUP_MODE, "SecureBoot" variable is set to 0.
 705   //
 706   if (Variable.CurrPtr == NULL) {
 707     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 708   } else {
 709     if (mPlatformMode == USER_MODE) {
 710       SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 711     } else if (mPlatformMode == SETUP_MODE) {
 712       SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 713     } else {
 714       return EFI_NOT_FOUND;
 715     }
 716   }
 717
 718   VarAttr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 719   Status  = UpdateVariable (
 720               EFI_SECURE_BOOT_MODE_NAME,
 721               &gEfiGlobalVariableGuid,
 722               &SecureBootMode,
 723               sizeof(UINT8),
 724               VarAttr,
 725               0,
 726               0,
 727               &Variable,
 728               NULL
 729               );
 730   if (EFI_ERROR (Status)) {
 731     return Status;
 732   }
 733
 734   //
 735   // Check "SecureBootEnable" variable's existence. It can enable/disable secure boot feature.
 736   //
 737   Status = FindVariable (
 738              EFI_SECURE_BOOT_ENABLE_NAME,
 739              &gEfiSecureBootEnableDisableGuid,
 740              &Variable,
 741              &mVariableModuleGlobal->VariableGlobal,
 742              FALSE
 743              );
 744
 745   if (SecureBootMode == SECURE_BOOT_MODE_ENABLE) {
 746     //
 747     // Create the "SecureBootEnable" variable as secure boot is enabled.
 748     //
 749     SecureBootEnable = SECURE_BOOT_ENABLE;
 750     VariableDataSize = sizeof (SecureBootEnable);
 751   } else {
 752     //
 753     // Delete the "SecureBootEnable" variable if this variable exist as "SecureBoot"
 754     // variable is not in secure boot state.
 755     //
 756     if (Variable.CurrPtr == NULL || EFI_ERROR (Status)) {
 757       return EFI_SUCCESS;
 758     }
 759     SecureBootEnable = SECURE_BOOT_DISABLE;
 760     VariableDataSize = 0;
 761   }
 762
 763   Status = UpdateVariable (
 764              EFI_SECURE_BOOT_ENABLE_NAME,
 765              &gEfiSecureBootEnableDisableGuid,
 766              &SecureBootEnable,
 767              VariableDataSize,
 768              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 769              0,
 770              0,
 771              &Variable,
 772              NULL
 773              );
 774   return Status;
 775 }
 776
 777 /**
 778   Check input data form to make sure it is a valid EFI_SIGNATURE_LIST for PK/KEK variable.
 779
 780   @param[in]  VariableName                Name of Variable to be check.
 781   @param[in]  VendorGuid                  Variable vendor GUID.
 782   @param[in]  Data                        Point to the variable data to be checked.
 783   @param[in]  DataSize                    Size of Data.
 784
 785   @return EFI_INVALID_PARAMETER           Invalid signature list format.
 786   @return EFI_SUCCESS                     Passed signature list format check successfully.
 787
 788 **/
 789 EFI_STATUS
 790 CheckSignatureListFormat(
 791   IN  CHAR16                    *VariableName,
 792   IN  EFI_GUID                  *VendorGuid,
 793   IN  VOID                      *Data,
 794   IN  UINTN                     DataSize
 795   )
 796 {
 797   EFI_SIGNATURE_LIST     *SigList;
 798   UINTN                  SigDataSize;
 799   UINT32                 Index;
 800   UINT32                 SigCount;
 801   BOOLEAN                IsPk;
 802
 803   if (DataSize == 0) {
 804     return EFI_SUCCESS;
 805   }
 806
 807   ASSERT (VariableName != NULL && VendorGuid != NULL && Data != NULL);
 808
 809   if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_PLATFORM_KEY_NAME) == 0)){
 810     IsPk = TRUE;
 811   } else if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0)) {
 812     IsPk = FALSE;
 813   } else {
 814     return EFI_SUCCESS;
 815   }
 816
 817   SigCount = 0;
 818   SigList  = (EFI_SIGNATURE_LIST *) Data;
 819   SigDataSize  = DataSize;
 820
 821   //
 822   // Walk throuth the input signature list and check the data format.
 823   // If any signature is incorrectly formed, the whole check will fail.
 824   //
 825   while ((SigDataSize > 0) && (SigDataSize >= SigList->SignatureListSize)) {
 826     for (Index = 0; Index < (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM)); Index++ ) {
 827       if (CompareGuid (&SigList->SignatureType, &mSupportSigItem[Index].SigType)) {
 828         //
 829         // The value of SignatureSize should always be 16 (size of SignatureOwner
 830         // component) add the data length according to signature type.
 831         //
 832         if (mSupportSigItem[Index].SigDataSize != ((UINT32) ~0) &&
 833           (SigList->SignatureSize - sizeof (EFI_GUID)) != mSupportSigItem[Index].SigDataSize) {
 834           return EFI_INVALID_PARAMETER;
 835         }
 836         if (mSupportSigItem[Index].SigHeaderSize != ((UINTN) ~0) &&
 837           SigList->SignatureHeaderSize != mSupportSigItem[Index].SigHeaderSize) {
 838           return EFI_INVALID_PARAMETER;
 839         }
 840         break;
 841       }
 842     }
 843
 844     if (Index == (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM))) {
 845       //
 846       // Undefined signature type.
 847       //
 848       return EFI_INVALID_PARAMETER;
 849     }
 850
 851     if ((SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) % SigList->SignatureSize != 0) {
 852       return EFI_INVALID_PARAMETER;
 853     }
 854     SigCount += (SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) / SigList->SignatureSize;
 855
 856     SigDataSize -= SigList->SignatureListSize;
 857     SigList = (EFI_SIGNATURE_LIST *) ((UINT8 *) SigList + SigList->SignatureListSize);
 858   }
 859
 860   if (((UINTN) SigList - (UINTN) Data) != DataSize) {
 861     return EFI_INVALID_PARAMETER;
 862   }
 863
 864   if (IsPk && SigCount > 1) {
 865     return EFI_INVALID_PARAMETER;
 866   }
 867
 868   return EFI_SUCCESS;
 869 }
 870
 871 /**
 872   Process variable with platform key for verification.
 873
 874   Caution: This function may receive untrusted input.
 875   This function may be invoked in SMM mode, and datasize and data are external input.
 876   This function will do basic validation, before parse the data.
 877   This function will parse the authentication carefully to avoid security issues, like
 878   buffer overflow, integer overflow.
 879   This function will check attribute carefully to avoid authentication bypass.
 880
 881   @param[in]  VariableName                Name of Variable to be found.
 882   @param[in]  VendorGuid                  Variable vendor GUID.
 883   @param[in]  Data                        Data pointer.
 884   @param[in]  DataSize                    Size of Data found. If size is less than the
 885                                           data, this value contains the required size.
 886   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
 887   @param[in]  Attributes                  Attribute value of the variable
 888   @param[in]  IsPk                        Indicate whether it is to process pk.
 889
 890   @return EFI_INVALID_PARAMETER           Invalid parameter.
 891   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation.
 892                                           check carried out by the firmware.
 893   @return EFI_SUCCESS                     Variable passed validation successfully.
 894
 895 **/
 896 EFI_STATUS
 897 ProcessVarWithPk (
 898   IN  CHAR16                    *VariableName,
 899   IN  EFI_GUID                  *VendorGuid,
 900   IN  VOID                      *Data,
 901   IN  UINTN                     DataSize,
 902   IN  VARIABLE_POINTER_TRACK    *Variable,
 903   IN  UINT32                    Attributes OPTIONAL,
 904   IN  BOOLEAN                   IsPk
 905   )
 906 {
 907   EFI_STATUS                  Status;
 908   BOOLEAN                     Del;
 909   UINT8                       *Payload;
 910   UINTN                       PayloadSize;
 911
 912   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
 913       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
 914     //
 915     // PK and KEK should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
 916     // authenticated variable.
 917     //
 918     return EFI_INVALID_PARAMETER;
 919   }
 920
 921   if (mPlatformMode == USER_MODE && !(InCustomMode() && UserPhysicalPresent())) {
 922     //
 923     // Verify against X509 Cert PK.
 924     //
 925     Del    = FALSE;
 926     Status = VerifyTimeBasedPayload (
 927                VariableName,
 928                VendorGuid,
 929                Data,
 930                DataSize,
 931                Variable,
 932                Attributes,
 933                AuthVarTypePk,
 934                &Del
 935                );
 936     if (!EFI_ERROR (Status)) {
 937       //
 938       // If delete PK in user mode, need change to setup mode.
 939       //
 940       if (Del && IsPk) {
 941         Status = UpdatePlatformMode (SETUP_MODE);
 942       }
 943     }
 944     return Status;
 945   } else {
 946     //
 947     // Process PK or KEK in Setup mode or Custom Secure Boot mode.
 948     //
 949     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
 950     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
 951
 952     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
 953     if (EFI_ERROR (Status)) {
 954       return Status;
 955     }
 956
 957     Status = UpdateVariable (
 958                VariableName,
 959                VendorGuid,
 960                Payload,
 961                PayloadSize,
 962                Attributes,
 963                0,
 964                0,
 965                Variable,
 966                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
 967                );
 968
 969     if (IsPk) {
 970       if (PayloadSize != 0) {
 971         //
 972         // If enroll PK in setup mode, need change to user mode.
 973         //
 974         Status = UpdatePlatformMode (USER_MODE);
 975       } else {
 976         //
 977         // If delete PK in custom mode, need change to setup mode.
 978         //
 979         UpdatePlatformMode (SETUP_MODE);
 980       }
 981     }
 982   }
 983
 984   return Status;
 985 }
 986
 987 /**
 988   Process variable with key exchange key for verification.
 989
 990   Caution: This function may receive untrusted input.
 991   This function may be invoked in SMM mode, and datasize and data are external input.
 992   This function will do basic validation, before parse the data.
 993   This function will parse the authentication carefully to avoid security issues, like
 994   buffer overflow, integer overflow.
 995   This function will check attribute carefully to avoid authentication bypass.
 996
 997   @param[in]  VariableName                Name of Variable to be found.
 998   @param[in]  VendorGuid                  Variable vendor GUID.
 999   @param[in]  Data                        Data pointer.
1000   @param[in]  DataSize                    Size of Data found. If size is less than the
1001                                           data, this value contains the required size.
1002   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1003   @param[in]  Attributes                  Attribute value of the variable.
1004
1005   @return EFI_INVALID_PARAMETER           Invalid parameter.
1006   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
1007                                           check carried out by the firmware.
1008   @return EFI_SUCCESS                     Variable pass validation successfully.
1009
1010 **/
1011 EFI_STATUS
1012 ProcessVarWithKek (
1013   IN  CHAR16                               *VariableName,
1014   IN  EFI_GUID                             *VendorGuid,
1015   IN  VOID                                 *Data,
1016   IN  UINTN                                DataSize,
1017   IN  VARIABLE_POINTER_TRACK               *Variable,
1018   IN  UINT32                               Attributes OPTIONAL
1019   )
1020 {
1021   EFI_STATUS                      Status;
1022   UINT8                           *Payload;
1023   UINTN                           PayloadSize;
1024
1025   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1026       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1027     //
1028     // DB and DBX should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1029     // authenticated variable.
1030     //
1031     return EFI_INVALID_PARAMETER;
1032   }
1033
1034   Status = EFI_SUCCESS;
1035   if (mPlatformMode == USER_MODE && !(InCustomMode() && UserPhysicalPresent())) {
1036     //
1037     // Time-based, verify against X509 Cert KEK.
1038     //
1039     return VerifyTimeBasedPayload (
1040              VariableName,
1041              VendorGuid,
1042              Data,
1043              DataSize,
1044              Variable,
1045              Attributes,
1046              AuthVarTypeKek,
1047              NULL
1048              );
1049   } else {
1050     //
1051     // If in setup mode or custom secure boot mode, no authentication needed.
1052     //
1053     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1054     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1055
1056     Status = UpdateVariable (
1057                VariableName,
1058                VendorGuid,
1059                Payload,
1060                PayloadSize,
1061                Attributes,
1062                0,
1063                0,
1064                Variable,
1065                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1066                );
1067   }
1068
1069   return Status;
1070 }
1071
1072 /**
1073   Process variable with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS/EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
1074
1075   Caution: This function may receive untrusted input.
1076   This function may be invoked in SMM mode, and datasize and data are external input.
1077   This function will do basic validation, before parse the data.
1078   This function will parse the authentication carefully to avoid security issues, like
1079   buffer overflow, integer overflow.
1080   This function will check attribute carefully to avoid authentication bypass.
1081
1082   @param[in]  VariableName                Name of Variable to be found.
1083   @param[in]  VendorGuid                  Variable vendor GUID.
1084
1085   @param[in]  Data                        Data pointer.
1086   @param[in]  DataSize                    Size of Data found. If size is less than the
1087                                           data, this value contains the required size.
1088   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1089   @param[in]  Attributes                  Attribute value of the variable.
1090
1091   @return EFI_INVALID_PARAMETER           Invalid parameter.
1092   @return EFI_WRITE_PROTECTED             Variable is write-protected and needs authentication with
1093                                           EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1094   @return EFI_SECURITY_VIOLATION          The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
1095                                           set, but the AuthInfo does NOT pass the validation
1096                                           check carried out by the firmware.
1097   @return EFI_SUCCESS                     Variable is not write-protected or pass validation successfully.
1098
1099 **/
1100 EFI_STATUS
1101 ProcessVariable (
1102   IN     CHAR16                             *VariableName,
1103   IN     EFI_GUID                           *VendorGuid,
1104   IN     VOID                               *Data,
1105   IN     UINTN                              DataSize,
1106   IN     VARIABLE_POINTER_TRACK             *Variable,
1107   IN     UINT32                             Attributes
1108   )
1109 {
1110   EFI_STATUS                      Status;
1111   BOOLEAN                         IsDeletion;
1112   BOOLEAN                         IsFirstTime;
1113   UINT8                           *PubKey;
1114   EFI_VARIABLE_AUTHENTICATION     *CertData;
1115   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
1116   UINT32                          KeyIndex;
1117   UINT64                          MonotonicCount;
1118
1119   KeyIndex    = 0;
1120   CertData    = NULL;
1121   CertBlock   = NULL;
1122   PubKey      = NULL;
1123   IsDeletion  = FALSE;
1124
1125   if (NeedPhysicallyPresent(VariableName, VendorGuid) && !UserPhysicalPresent()) {
1126     //
1127     // This variable is protected, only physical present user could modify its value.
1128     //
1129     return EFI_SECURITY_VIOLATION;
1130   }
1131
1132   //
1133   // Process Time-based Authenticated variable.
1134   //
1135   if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1136     return VerifyTimeBasedPayload (
1137              VariableName,
1138              VendorGuid,
1139              Data,
1140              DataSize,
1141              Variable,
1142              Attributes,
1143              AuthVarTypePriv,
1144              NULL
1145              );
1146   }
1147
1148   //
1149   // Determine if first time SetVariable with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS.
1150   //
1151   if ((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) {
1152     //
1153     // Determine current operation type.
1154     //
1155     if (DataSize == AUTHINFO_SIZE) {
1156       IsDeletion = TRUE;
1157     }
1158     //
1159     // Determine whether this is the first time with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1160     //
1161     if (Variable->CurrPtr == NULL) {
1162       IsFirstTime = TRUE;
1163     } else if ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) == 0) {
1164       IsFirstTime = TRUE;
1165     } else {
1166       KeyIndex   = Variable->CurrPtr->PubKeyIndex;
1167       IsFirstTime = FALSE;
1168     }
1169   } else if ((Variable->CurrPtr != NULL) &&
1170              ((Variable->CurrPtr->Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)
1171             ) {
1172     //
1173     // If the variable is already write-protected, it always needs authentication before update.
1174     //
1175     return EFI_WRITE_PROTECTED;
1176   } else {
1177     //
1178     // If without EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS, set and attributes collision.
1179     // That means it is not authenticated variable, just update variable as usual.
1180     //
1181     Status = UpdateVariable (VariableName, VendorGuid, Data, DataSize, Attributes, 0, 0, Variable, NULL);
1182     return Status;
1183   }
1184
1185   //
1186   // Get PubKey and check Monotonic Count value corresponding to the variable.
1187   //
1188   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
1189   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
1190   PubKey    = CertBlock->PublicKey;
1191
1192   //
1193   // Update Monotonic Count value.
1194   //
1195   MonotonicCount = CertData->MonotonicCount;
1196
1197   if (!IsFirstTime) {
1198     //
1199     // Check input PubKey.
1200     //
1201     if (CompareMem (PubKey, mPubKeyStore + (KeyIndex - 1) * EFI_CERT_TYPE_RSA2048_SIZE, EFI_CERT_TYPE_RSA2048_SIZE) != 0) {
1202       return EFI_SECURITY_VIOLATION;
1203     }
1204     //
1205     // Compare the current monotonic count and ensure that it is greater than the last SetVariable
1206     // operation with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS attribute set.
1207     //
1208     if (CertData->MonotonicCount <= Variable->CurrPtr->MonotonicCount) {
1209       //
1210       // Monotonic count check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
1211       //
1212       return EFI_SECURITY_VIOLATION;
1213     }
1214   }
1215   //
1216   // Verify the certificate in Data payload.
1217   //
1218   Status = VerifyCounterBasedPayload (Data, DataSize, PubKey);
1219   if (EFI_ERROR (Status)) {
1220     return Status;
1221   }
1222
1223   //
1224   // Now, the signature has been verified!
1225   //
1226   if (IsFirstTime && !IsDeletion) {
1227     //
1228     // Update public key database variable if need.
1229     //
1230     KeyIndex = AddPubKeyInStore (PubKey);
1231     if (KeyIndex == 0) {
1232       return EFI_SECURITY_VIOLATION;
1233     }
1234   }
1235
1236   //
1237   // Verification pass.
1238   //
1239   return UpdateVariable (VariableName, VendorGuid, (UINT8*)Data + AUTHINFO_SIZE, DataSize - AUTHINFO_SIZE, Attributes, KeyIndex, MonotonicCount, Variable, NULL);
1240 }
1241
1242 /**
1243   Merge two buffers which formatted as EFI_SIGNATURE_LIST. Only the new EFI_SIGNATURE_DATA
1244   will be appended to the original EFI_SIGNATURE_LIST, duplicate EFI_SIGNATURE_DATA
1245   will be ignored.
1246
1247   @param[in, out]  Data            Pointer to original EFI_SIGNATURE_LIST.
1248   @param[in]       DataSize        Size of Data buffer.
1249   @param[in]       NewData         Pointer to new EFI_SIGNATURE_LIST to be appended.
1250   @param[in]       NewDataSize     Size of NewData buffer.
1251
1252   @return Size of the merged buffer.
1253
1254 **/
1255 UINTN
1256 AppendSignatureList (
1257   IN  OUT VOID            *Data,
1258   IN  UINTN               DataSize,
1259   IN  VOID                *NewData,
1260   IN  UINTN               NewDataSize
1261   )
1262 {
1263   EFI_SIGNATURE_LIST  *CertList;
1264   EFI_SIGNATURE_DATA  *Cert;
1265   UINTN               CertCount;
1266   EFI_SIGNATURE_LIST  *NewCertList;
1267   EFI_SIGNATURE_DATA  *NewCert;
1268   UINTN               NewCertCount;
1269   UINTN               Index;
1270   UINTN               Index2;
1271   UINTN               Size;
1272   UINT8               *Tail;
1273   UINTN               CopiedCount;
1274   UINTN               SignatureListSize;
1275   BOOLEAN             IsNewCert;
1276
1277   Tail = (UINT8 *) Data + DataSize;
1278
1279   NewCertList = (EFI_SIGNATURE_LIST *) NewData;
1280   while ((NewDataSize > 0) && (NewDataSize >= NewCertList->SignatureListSize)) {
1281     NewCert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCertList + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1282     NewCertCount = (NewCertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - NewCertList->SignatureHeaderSize) / NewCertList->SignatureSize;
1283
1284     CopiedCount = 0;
1285     for (Index = 0; Index < NewCertCount; Index++) {
1286       IsNewCert = TRUE;
1287
1288       Size = DataSize;
1289       CertList = (EFI_SIGNATURE_LIST *) Data;
1290       while ((Size > 0) && (Size >= CertList->SignatureListSize)) {
1291         if (CompareGuid (&CertList->SignatureType, &NewCertList->SignatureType) &&
1292            (CertList->SignatureSize == NewCertList->SignatureSize)) {
1293           Cert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
1294           CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
1295           for (Index2 = 0; Index2 < CertCount; Index2++) {
1296             //
1297             // Iterate each Signature Data in this Signature List.
1298             //
1299             if (CompareMem (NewCert, Cert, CertList->SignatureSize) == 0) {
1300               IsNewCert = FALSE;
1301               break;
1302             }
1303             Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
1304           }
1305         }
1306
1307         if (!IsNewCert) {
1308           break;
1309         }
1310         Size -= CertList->SignatureListSize;
1311         CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
1312       }
1313
1314       if (IsNewCert) {
1315         //
1316         // New EFI_SIGNATURE_DATA, append it.
1317         //
1318         if (CopiedCount == 0) {
1319           //
1320           // Copy EFI_SIGNATURE_LIST header for only once.
1321           //
1322           CopyMem (Tail, NewCertList, sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1323           Tail = Tail + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1324         }
1325
1326         CopyMem (Tail, NewCert, NewCertList->SignatureSize);
1327         Tail += NewCertList->SignatureSize;
1328         CopiedCount++;
1329       }
1330
1331       NewCert = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCert + NewCertList->SignatureSize);
1332     }
1333
1334     //
1335     // Update SignatureListSize in newly appended EFI_SIGNATURE_LIST.
1336     //
1337     if (CopiedCount != 0) {
1338       SignatureListSize = sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize + (CopiedCount * NewCertList->SignatureSize);
1339       CertList = (EFI_SIGNATURE_LIST *) (Tail - SignatureListSize);
1340       CertList->SignatureListSize = (UINT32) SignatureListSize;
1341     }
1342
1343     NewDataSize -= NewCertList->SignatureListSize;
1344     NewCertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) NewCertList + NewCertList->SignatureListSize);
1345   }
1346
1347   return (Tail - (UINT8 *) Data);
1348 }
1349
1350 /**
1351   Compare two EFI_TIME data.
1352
1353
1354   @param FirstTime           A pointer to the first EFI_TIME data.
1355   @param SecondTime          A pointer to the second EFI_TIME data.
1356
1357   @retval  TRUE              The FirstTime is not later than the SecondTime.
1358   @retval  FALSE             The FirstTime is later than the SecondTime.
1359
1360 **/
1361 BOOLEAN
1362 CompareTimeStamp (
1363   IN EFI_TIME               *FirstTime,
1364   IN EFI_TIME               *SecondTime
1365   )
1366 {
1367   if (FirstTime->Year != SecondTime->Year) {
1368     return (BOOLEAN) (FirstTime->Year < SecondTime->Year);
1369   } else if (FirstTime->Month != SecondTime->Month) {
1370     return (BOOLEAN) (FirstTime->Month < SecondTime->Month);
1371   } else if (FirstTime->Day != SecondTime->Day) {
1372     return (BOOLEAN) (FirstTime->Day < SecondTime->Day);
1373   } else if (FirstTime->Hour != SecondTime->Hour) {
1374     return (BOOLEAN) (FirstTime->Hour < SecondTime->Hour);
1375   } else if (FirstTime->Minute != SecondTime->Minute) {
1376     return (BOOLEAN) (FirstTime->Minute < FirstTime->Minute);
1377   }
1378
1379   return (BOOLEAN) (FirstTime->Second <= SecondTime->Second);
1380 }
1381
1382 /**
1383   Find matching signer's certificates for common authenticated variable
1384   by corresponding VariableName and VendorGuid from "certdb".
1385
1386   The data format of "certdb":
1387   //
1388   //     UINT32 CertDbListSize;
1389   // /// AUTH_CERT_DB_DATA Certs1[];
1390   // /// AUTH_CERT_DB_DATA Certs2[];
1391   // /// ...
1392   // /// AUTH_CERT_DB_DATA Certsn[];
1393   //
1394
1395   @param[in]  VariableName   Name of authenticated Variable.
1396   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1397   @param[in]  Data           Pointer to variable "certdb".
1398   @param[in]  DataSize       Size of variable "certdb".
1399   @param[out] CertOffset     Offset of matching CertData, from starting of Data.
1400   @param[out] CertDataSize   Length of CertData in bytes.
1401   @param[out] CertNodeOffset Offset of matching AUTH_CERT_DB_DATA , from
1402                              starting of Data.
1403   @param[out] CertNodeSize   Length of AUTH_CERT_DB_DATA in bytes.
1404
1405   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1406   @retval  EFI_NOT_FOUND         Fail to find matching certs.
1407   @retval  EFI_SUCCESS           Find matching certs and output parameters.
1408
1409 **/
1410 EFI_STATUS
1411 FindCertsFromDb (
1412   IN     CHAR16           *VariableName,
1413   IN     EFI_GUID         *VendorGuid,
1414   IN     UINT8            *Data,
1415   IN     UINTN            DataSize,
1416   OUT    UINT32           *CertOffset,    OPTIONAL
1417   OUT    UINT32           *CertDataSize,  OPTIONAL
1418   OUT    UINT32           *CertNodeOffset,OPTIONAL
1419   OUT    UINT32           *CertNodeSize   OPTIONAL
1420   )
1421 {
1422   UINT32                  Offset;
1423   AUTH_CERT_DB_DATA       *Ptr;
1424   UINT32                  CertSize;
1425   UINT32                  NameSize;
1426   UINT32                  NodeSize;
1427   UINT32                  CertDbListSize;
1428
1429   if ((VariableName == NULL) || (VendorGuid == NULL) || (Data == NULL)) {
1430     return EFI_INVALID_PARAMETER;
1431   }
1432
1433   //
1434   // Check whether DataSize matches recorded CertDbListSize.
1435   //
1436   if (DataSize < sizeof (UINT32)) {
1437     return EFI_INVALID_PARAMETER;
1438   }
1439
1440   CertDbListSize = ReadUnaligned32 ((UINT32 *) Data);
1441
1442   if (CertDbListSize != (UINT32) DataSize) {
1443     return EFI_INVALID_PARAMETER;
1444   }
1445
1446   Offset = sizeof (UINT32);
1447
1448   //
1449   // Get corresponding certificates by VendorGuid and VariableName.
1450   //
1451   while (Offset < (UINT32) DataSize) {
1452     Ptr = (AUTH_CERT_DB_DATA *) (Data + Offset);
1453     //
1454     // Check whether VendorGuid matches.
1455     //
1456     if (CompareGuid (&Ptr->VendorGuid, VendorGuid)) {
1457       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1458       NameSize = ReadUnaligned32 (&Ptr->NameSize);
1459       CertSize = ReadUnaligned32 (&Ptr->CertDataSize);
1460
1461       if (NodeSize != sizeof (EFI_GUID) + sizeof (UINT32) * 3 + CertSize +
1462           sizeof (CHAR16) * NameSize) {
1463         return EFI_INVALID_PARAMETER;
1464       }
1465
1466       Offset = Offset + sizeof (EFI_GUID) + sizeof (UINT32) * 3;
1467       //
1468       // Check whether VariableName matches.
1469       //
1470       if ((NameSize == StrLen (VariableName)) &&
1471           (CompareMem (Data + Offset, VariableName, NameSize * sizeof (CHAR16)) == 0)) {
1472         Offset = Offset + NameSize * sizeof (CHAR16);
1473
1474         if (CertOffset != NULL) {
1475           *CertOffset = Offset;
1476         }
1477
1478         if (CertDataSize != NULL) {
1479           *CertDataSize = CertSize;
1480         }
1481
1482         if (CertNodeOffset != NULL) {
1483           *CertNodeOffset = (UINT32) ((UINT8 *) Ptr - Data);
1484         }
1485
1486         if (CertNodeSize != NULL) {
1487           *CertNodeSize = NodeSize;
1488         }
1489
1490         return EFI_SUCCESS;
1491       } else {
1492         Offset = Offset + NameSize * sizeof (CHAR16) + CertSize;
1493       }
1494     } else {
1495       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1496       Offset   = Offset + NodeSize;
1497     }
1498   }
1499
1500   return EFI_NOT_FOUND;
1501 }
1502
1503 /**
1504   Retrieve signer's certificates for common authenticated variable
1505   by corresponding VariableName and VendorGuid from "certdb".
1506
1507   @param[in]  VariableName   Name of authenticated Variable.
1508   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1509   @param[out] CertData       Pointer to signer's certificates.
1510   @param[out] CertDataSize   Length of CertData in bytes.
1511
1512   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1513   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1514   @retval  EFI_SUCCESS           Get signer's certificates successfully.
1515
1516 **/
1517 EFI_STATUS
1518 GetCertsFromDb (
1519   IN     CHAR16           *VariableName,
1520   IN     EFI_GUID         *VendorGuid,
1521   OUT    UINT8            **CertData,
1522   OUT    UINT32           *CertDataSize
1523   )
1524 {
1525   VARIABLE_POINTER_TRACK  CertDbVariable;
1526   EFI_STATUS              Status;
1527   UINT8                   *Data;
1528   UINTN                   DataSize;
1529   UINT32                  CertOffset;
1530
1531   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL) || (CertDataSize == NULL)) {
1532     return EFI_INVALID_PARAMETER;
1533   }
1534
1535   //
1536   // Get variable "certdb".
1537   //
1538   Status = FindVariable (
1539              EFI_CERT_DB_NAME,
1540              &gEfiCertDbGuid,
1541              &CertDbVariable,
1542              &mVariableModuleGlobal->VariableGlobal,
1543              FALSE
1544              );
1545   if (EFI_ERROR (Status)) {
1546     return Status;
1547   }
1548
1549   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1550   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1551   if ((DataSize == 0) || (Data == NULL)) {
1552     ASSERT (FALSE);
1553     return EFI_NOT_FOUND;
1554   }
1555
1556   Status = FindCertsFromDb (
1557              VariableName,
1558              VendorGuid,
1559              Data,
1560              DataSize,
1561              &CertOffset,
1562              CertDataSize,
1563              NULL,
1564              NULL
1565              );
1566
1567   if (EFI_ERROR (Status)) {
1568     return Status;
1569   }
1570
1571   *CertData = Data + CertOffset;
1572   return EFI_SUCCESS;
1573 }
1574
1575 /**
1576   Delete matching signer's certificates when deleting common authenticated
1577   variable by corresponding VariableName and VendorGuid from "certdb".
1578
1579   @param[in]  VariableName   Name of authenticated Variable.
1580   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1581
1582   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1583   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1584   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
1585   @retval  EFI_SUCCESS           The operation is completed successfully.
1586
1587 **/
1588 EFI_STATUS
1589 DeleteCertsFromDb (
1590   IN     CHAR16           *VariableName,
1591   IN     EFI_GUID         *VendorGuid
1592   )
1593 {
1594   VARIABLE_POINTER_TRACK  CertDbVariable;
1595   EFI_STATUS              Status;
1596   UINT8                   *Data;
1597   UINTN                   DataSize;
1598   UINT32                  VarAttr;
1599   UINT32                  CertNodeOffset;
1600   UINT32                  CertNodeSize;
1601   UINT8                   *NewCertDb;
1602   UINT32                  NewCertDbSize;
1603
1604   if ((VariableName == NULL) || (VendorGuid == NULL)) {
1605     return EFI_INVALID_PARAMETER;
1606   }
1607
1608   //
1609   // Get variable "certdb".
1610   //
1611   Status = FindVariable (
1612              EFI_CERT_DB_NAME,
1613              &gEfiCertDbGuid,
1614              &CertDbVariable,
1615              &mVariableModuleGlobal->VariableGlobal,
1616              FALSE
1617              );
1618   if (EFI_ERROR (Status)) {
1619     return Status;
1620   }
1621
1622   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1623   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1624   if ((DataSize == 0) || (Data == NULL)) {
1625     ASSERT (FALSE);
1626     return EFI_NOT_FOUND;
1627   }
1628
1629   if (DataSize == sizeof (UINT32)) {
1630     //
1631     // There is no certs in certdb.
1632     //
1633     return EFI_SUCCESS;
1634   }
1635
1636   //
1637   // Get corresponding cert node from certdb.
1638   //
1639   Status = FindCertsFromDb (
1640              VariableName,
1641              VendorGuid,
1642              Data,
1643              DataSize,
1644              NULL,
1645              NULL,
1646              &CertNodeOffset,
1647              &CertNodeSize
1648              );
1649
1650   if (EFI_ERROR (Status)) {
1651     return Status;
1652   }
1653
1654   if (DataSize < (CertNodeOffset + CertNodeSize)) {
1655     return EFI_NOT_FOUND;
1656   }
1657
1658   //
1659   // Construct new data content of variable "certdb".
1660   //
1661   NewCertDbSize = (UINT32) DataSize - CertNodeSize;
1662   NewCertDb     = AllocateZeroPool (NewCertDbSize);
1663   if (NewCertDb == NULL) {
1664     return EFI_OUT_OF_RESOURCES;
1665   }
1666
1667   //
1668   // Copy the DB entries before deleting node.
1669   //
1670   CopyMem (NewCertDb, Data, CertNodeOffset);
1671   //
1672   // Update CertDbListSize.
1673   //
1674   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
1675   //
1676   // Copy the DB entries after deleting node.
1677   //
1678   if (DataSize > (CertNodeOffset + CertNodeSize)) {
1679     CopyMem (
1680       NewCertDb + CertNodeOffset,
1681       Data + CertNodeOffset + CertNodeSize,
1682       DataSize - CertNodeOffset - CertNodeSize
1683       );
1684   }
1685
1686   //
1687   // Set "certdb".
1688   //
1689   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
1690   Status   = UpdateVariable (
1691                EFI_CERT_DB_NAME,
1692                &gEfiCertDbGuid,
1693                NewCertDb,
1694                NewCertDbSize,
1695                VarAttr,
1696                0,
1697                0,
1698                &CertDbVariable,
1699                NULL
1700                );
1701
1702   FreePool (NewCertDb);
1703   return Status;
1704 }
1705
1706 /**
1707   Insert signer's certificates for common authenticated variable with VariableName
1708   and VendorGuid in AUTH_CERT_DB_DATA to "certdb".
1709
1710   @param[in]  VariableName   Name of authenticated Variable.
1711   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1712   @param[in]  CertData       Pointer to signer's certificates.
1713   @param[in]  CertDataSize   Length of CertData in bytes.
1714
1715   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1716   @retval  EFI_ACCESS_DENIED     An AUTH_CERT_DB_DATA entry with same VariableName
1717                                  and VendorGuid already exists.
1718   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
1719   @retval  EFI_SUCCESS           Insert an AUTH_CERT_DB_DATA entry to "certdb"
1720
1721 **/
1722 EFI_STATUS
1723 InsertCertsToDb (
1724   IN     CHAR16           *VariableName,
1725   IN     EFI_GUID         *VendorGuid,
1726   IN     UINT8            *CertData,
1727   IN     UINTN            CertDataSize
1728   )
1729 {
1730   VARIABLE_POINTER_TRACK  CertDbVariable;
1731   EFI_STATUS              Status;
1732   UINT8                   *Data;
1733   UINTN                   DataSize;
1734   UINT32                  VarAttr;
1735   UINT8                   *NewCertDb;
1736   UINT32                  NewCertDbSize;
1737   UINT32                  CertNodeSize;
1738   UINT32                  NameSize;
1739   AUTH_CERT_DB_DATA       *Ptr;
1740
1741   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL)) {
1742     return EFI_INVALID_PARAMETER;
1743   }
1744
1745   //
1746   // Get variable "certdb".
1747   //
1748   Status = FindVariable (
1749              EFI_CERT_DB_NAME,
1750              &gEfiCertDbGuid,
1751              &CertDbVariable,
1752              &mVariableModuleGlobal->VariableGlobal,
1753              FALSE
1754              );
1755   if (EFI_ERROR (Status)) {
1756     return Status;
1757   }
1758
1759   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1760   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1761   if ((DataSize == 0) || (Data == NULL)) {
1762     ASSERT (FALSE);
1763     return EFI_NOT_FOUND;
1764   }
1765
1766   //
1767   // Find whether matching cert node already exists in "certdb".
1768   // If yes return error.
1769   //
1770   Status = FindCertsFromDb (
1771              VariableName,
1772              VendorGuid,
1773              Data,
1774              DataSize,
1775              NULL,
1776              NULL,
1777              NULL,
1778              NULL
1779              );
1780
1781   if (!EFI_ERROR (Status)) {
1782     ASSERT (FALSE);
1783     return EFI_ACCESS_DENIED;
1784   }
1785
1786   //
1787   // Construct new data content of variable "certdb".
1788   //
1789   NameSize      = (UINT32) StrLen (VariableName);
1790   CertNodeSize  = sizeof (AUTH_CERT_DB_DATA) + (UINT32) CertDataSize + NameSize * sizeof (CHAR16);
1791   NewCertDbSize = (UINT32) DataSize + CertNodeSize;
1792   NewCertDb     = AllocateZeroPool (NewCertDbSize);
1793   if (NewCertDb == NULL) {
1794     return EFI_OUT_OF_RESOURCES;
1795   }
1796
1797   //
1798   // Copy the DB entries before deleting node.
1799   //
1800   CopyMem (NewCertDb, Data, DataSize);
1801   //
1802   // Update CertDbListSize.
1803   //
1804   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
1805   //
1806   // Construct new cert node.
1807   //
1808   Ptr = (AUTH_CERT_DB_DATA *) (NewCertDb + DataSize);
1809   CopyGuid (&Ptr->VendorGuid, VendorGuid);
1810   CopyMem (&Ptr->CertNodeSize, &CertNodeSize, sizeof (UINT32));
1811   CopyMem (&Ptr->NameSize, &NameSize, sizeof (UINT32));
1812   CopyMem (&Ptr->CertDataSize, &CertDataSize, sizeof (UINT32));
1813
1814   CopyMem (
1815     (UINT8 *) Ptr + sizeof (AUTH_CERT_DB_DATA),
1816     VariableName,
1817     NameSize * sizeof (CHAR16)
1818     );
1819
1820   CopyMem (
1821     (UINT8 *) Ptr +  sizeof (AUTH_CERT_DB_DATA) + NameSize * sizeof (CHAR16),
1822     CertData,
1823     CertDataSize
1824     );
1825
1826   //
1827   // Set "certdb".
1828   //
1829   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
1830   Status   = UpdateVariable (
1831                EFI_CERT_DB_NAME,
1832                &gEfiCertDbGuid,
1833                NewCertDb,
1834                NewCertDbSize,
1835                VarAttr,
1836                0,
1837                0,
1838                &CertDbVariable,
1839                NULL
1840                );
1841
1842   FreePool (NewCertDb);
1843   return Status;
1844 }
1845
1846 /**
1847   Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
1848
1849   Caution: This function may receive untrusted input.
1850   This function may be invoked in SMM mode, and datasize and data are external input.
1851   This function will do basic validation, before parse the data.
1852   This function will parse the authentication carefully to avoid security issues, like
1853   buffer overflow, integer overflow.
1854
1855   @param[in]  VariableName                Name of Variable to be found.
1856   @param[in]  VendorGuid                  Variable vendor GUID.
1857   @param[in]  Data                        Data pointer.
1858   @param[in]  DataSize                    Size of Data found. If size is less than the
1859                                           data, this value contains the required size.
1860   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1861   @param[in]  Attributes                  Attribute value of the variable.
1862   @param[in]  AuthVarType                 Verify against PK or KEK database or private database.
1863   @param[out] VarDel                      Delete the variable or not.
1864
1865   @retval EFI_INVALID_PARAMETER           Invalid parameter.
1866   @retval EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
1867                                           check carried out by the firmware.
1868   @retval EFI_OUT_OF_RESOURCES            Failed to process variable due to lack
1869                                           of resources.
1870   @retval EFI_SUCCESS                     Variable pass validation successfully.
1871
1872 **/
1873 EFI_STATUS
1874 VerifyTimeBasedPayload (
1875   IN     CHAR16                             *VariableName,
1876   IN     EFI_GUID                           *VendorGuid,
1877   IN     VOID                               *Data,
1878   IN     UINTN                              DataSize,
1879   IN     VARIABLE_POINTER_TRACK             *Variable,
1880   IN     UINT32                             Attributes,
1881   IN     AUTHVAR_TYPE                       AuthVarType,
1882   OUT    BOOLEAN                            *VarDel
1883   )
1884 {
1885   UINT8                            *RootCert;
1886   UINT8                            *SigData;
1887   UINT8                            *PayloadPtr;
1888   UINTN                            RootCertSize;
1889   UINTN                            Index;
1890   UINTN                            CertCount;
1891   UINTN                            PayloadSize;
1892   UINT32                           Attr;
1893   UINT32                           SigDataSize;
1894   UINT32                           KekDataSize;
1895   BOOLEAN                          VerifyStatus;
1896   EFI_STATUS                       Status;
1897   EFI_SIGNATURE_LIST               *CertList;
1898   EFI_SIGNATURE_DATA               *Cert;
1899   VARIABLE_POINTER_TRACK           KekVariable;
1900   EFI_VARIABLE_AUTHENTICATION_2    *CertData;
1901   UINT8                            *NewData;
1902   UINTN                            NewDataSize;
1903   VARIABLE_POINTER_TRACK           PkVariable;
1904   UINT8                            *Buffer;
1905   UINTN                            Length;
1906   UINT8                            *SignerCerts;
1907   UINT8                            *WrapSigData;
1908   UINTN                            CertStackSize;
1909   UINT8                            *CertsInCertDb;
1910   UINT32                           CertsSizeinDb;
1911
1912   VerifyStatus           = FALSE;
1913   CertData               = NULL;
1914   NewData                = NULL;
1915   Attr                   = Attributes;
1916   WrapSigData            = NULL;
1917   SignerCerts            = NULL;
1918   RootCert               = NULL;
1919
1920   //
1921   // When the attribute EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS is
1922   // set, then the Data buffer shall begin with an instance of a complete (and serialized)
1923   // EFI_VARIABLE_AUTHENTICATION_2 descriptor. The descriptor shall be followed by the new
1924   // variable value and DataSize shall reflect the combined size of the descriptor and the new
1925   // variable value. The authentication descriptor is not part of the variable data and is not
1926   // returned by subsequent calls to GetVariable().
1927   //
1928   CertData = (EFI_VARIABLE_AUTHENTICATION_2 *) Data;
1929
1930   //
1931   // Verify that Pad1, Nanosecond, TimeZone, Daylight and Pad2 components of the
1932   // TimeStamp value are set to zero.
1933   //
1934   if ((CertData->TimeStamp.Pad1 != 0) ||
1935       (CertData->TimeStamp.Nanosecond != 0) ||
1936       (CertData->TimeStamp.TimeZone != 0) ||
1937       (CertData->TimeStamp.Daylight != 0) ||
1938       (CertData->TimeStamp.Pad2 != 0)) {
1939     return EFI_SECURITY_VIOLATION;
1940   }
1941
1942   if ((Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
1943     if (CompareTimeStamp (&CertData->TimeStamp, &Variable->CurrPtr->TimeStamp)) {
1944       //
1945       // TimeStamp check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
1946       //
1947       return EFI_SECURITY_VIOLATION;
1948     }
1949   }
1950
1951   //
1952   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
1953   // Cert type should be EFI_CERT_TYPE_PKCS7_GUID.
1954   //
1955   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
1956       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertPkcs7Guid)) {
1957     //
1958     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
1959     //
1960     return EFI_SECURITY_VIOLATION;
1961   }
1962
1963   //
1964   // Find out Pkcs7 SignedData which follows the EFI_VARIABLE_AUTHENTICATION_2 descriptor.
1965   // AuthInfo.Hdr.dwLength is the length of the entire certificate, including the length of the header.
1966   //
1967   SigData = CertData->AuthInfo.CertData;
1968   SigDataSize = CertData->AuthInfo.Hdr.dwLength - (UINT32) (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData));
1969
1970   //
1971   // Find out the new data payload which follows Pkcs7 SignedData directly.
1972   //
1973   PayloadPtr = SigData + SigDataSize;
1974   PayloadSize = DataSize - OFFSET_OF_AUTHINFO2_CERT_DATA - (UINTN) SigDataSize;
1975
1976   //
1977   // Construct a buffer to fill with (VariableName, VendorGuid, Attributes, TimeStamp, Data).
1978   //
1979   NewDataSize = PayloadSize + sizeof (EFI_TIME) + sizeof (UINT32) +
1980                 sizeof (EFI_GUID) + StrSize (VariableName) - sizeof (CHAR16);
1981   NewData = mSerializationRuntimeBuffer;
1982
1983   Buffer = NewData;
1984   Length = StrLen (VariableName) * sizeof (CHAR16);
1985   CopyMem (Buffer, VariableName, Length);
1986   Buffer += Length;
1987
1988   Length = sizeof (EFI_GUID);
1989   CopyMem (Buffer, VendorGuid, Length);
1990   Buffer += Length;
1991
1992   Length = sizeof (UINT32);
1993   CopyMem (Buffer, &Attr, Length);
1994   Buffer += Length;
1995
1996   Length = sizeof (EFI_TIME);
1997   CopyMem (Buffer, &CertData->TimeStamp, Length);
1998   Buffer += Length;
1999
2000   CopyMem (Buffer, PayloadPtr, PayloadSize);
2001
2002   if (AuthVarType == AuthVarTypePk) {
2003     //
2004     // Get platform key from variable.
2005     //
2006     Status = FindVariable (
2007                EFI_PLATFORM_KEY_NAME,
2008                &gEfiGlobalVariableGuid,
2009                &PkVariable,
2010                &mVariableModuleGlobal->VariableGlobal,
2011                FALSE
2012                );
2013     if (EFI_ERROR (Status)) {
2014       return Status;
2015     }
2016
2017     CertList = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (PkVariable.CurrPtr);
2018     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2019     RootCert      = Cert->SignatureData;
2020     RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2021
2022
2023     //
2024     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2025     //
2026     VerifyStatus = Pkcs7Verify (
2027                      SigData,
2028                      SigDataSize,
2029                      RootCert,
2030                      RootCertSize,
2031                      NewData,
2032                      NewDataSize
2033                      );
2034
2035   } else if (AuthVarType == AuthVarTypeKek) {
2036
2037     //
2038     // Get KEK database from variable.
2039     //
2040     Status = FindVariable (
2041                EFI_KEY_EXCHANGE_KEY_NAME,
2042                &gEfiGlobalVariableGuid,
2043                &KekVariable,
2044                &mVariableModuleGlobal->VariableGlobal,
2045                FALSE
2046                );
2047     if (EFI_ERROR (Status)) {
2048       return Status;
2049     }
2050
2051     //
2052     // Ready to verify Pkcs7 SignedData. Go through KEK Signature Database to find out X.509 CertList.
2053     //
2054     KekDataSize      = KekVariable.CurrPtr->DataSize;
2055     CertList         = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (KekVariable.CurrPtr);
2056     while ((KekDataSize > 0) && (KekDataSize >= CertList->SignatureListSize)) {
2057       if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {
2058         Cert       = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2059         CertCount  = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
2060         for (Index = 0; Index < CertCount; Index++) {
2061           //
2062           // Iterate each Signature Data Node within this CertList for a verify
2063           //
2064           RootCert      = Cert->SignatureData;
2065           RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2066
2067           //
2068           // Verify Pkcs7 SignedData via Pkcs7Verify library.
2069           //
2070           VerifyStatus = Pkcs7Verify (
2071                            SigData,
2072                            SigDataSize,
2073                            RootCert,
2074                            RootCertSize,
2075                            NewData,
2076                            NewDataSize
2077                            );
2078           if (VerifyStatus) {
2079             goto Exit;
2080           }
2081           Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
2082         }
2083       }
2084       KekDataSize -= CertList->SignatureListSize;
2085       CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
2086     }
2087   } else if (AuthVarType == AuthVarTypePriv) {
2088
2089     //
2090     // Process common authenticated variable except PK/KEK/DB/DBX.
2091     // Get signer's certificates from SignedData.
2092     //
2093     VerifyStatus = Pkcs7GetSigners (
2094                      SigData,
2095                      SigDataSize,
2096                      &SignerCerts,
2097                      &CertStackSize,
2098                      &RootCert,
2099                      &RootCertSize
2100                      );
2101     if (!VerifyStatus) {
2102       goto Exit;
2103     }
2104
2105     //
2106     // Get previously stored signer's certificates from certdb for existing
2107     // variable. Check whether they are identical with signer's certificates
2108     // in SignedData. If not, return error immediately.
2109     //
2110     if ((Variable->CurrPtr != NULL)) {
2111       VerifyStatus = FALSE;
2112
2113       Status = GetCertsFromDb (VariableName, VendorGuid, &CertsInCertDb, &CertsSizeinDb);
2114       if (EFI_ERROR (Status)) {
2115         goto Exit;
2116       }
2117
2118       if ((CertStackSize != CertsSizeinDb) ||
2119           (CompareMem (SignerCerts, CertsInCertDb, CertsSizeinDb) != 0)) {
2120         goto Exit;
2121       }
2122     }
2123
2124     VerifyStatus = Pkcs7Verify (
2125                      SigData,
2126                      SigDataSize,
2127                      RootCert,
2128                      RootCertSize,
2129                      NewData,
2130                      NewDataSize
2131                      );
2132     if (!VerifyStatus) {
2133       goto Exit;
2134     }
2135
2136     //
2137     // Delete signer's certificates when delete the common authenticated variable.
2138     //
2139     if ((PayloadSize == 0) && (Variable->CurrPtr != NULL)) {
2140       Status = DeleteCertsFromDb (VariableName, VendorGuid);
2141       if (EFI_ERROR (Status)) {
2142         VerifyStatus = FALSE;
2143         goto Exit;
2144       }
2145     } else if (Variable->CurrPtr == NULL) {
2146       //
2147       // Insert signer's certificates when adding a new common authenticated variable.
2148       //
2149       Status = InsertCertsToDb (VariableName, VendorGuid, SignerCerts, CertStackSize);
2150       if (EFI_ERROR (Status)) {
2151         VerifyStatus = FALSE;
2152         goto Exit;
2153       }
2154     }
2155   } else {
2156     return EFI_SECURITY_VIOLATION;
2157   }
2158
2159 Exit:
2160
2161   if (AuthVarType == AuthVarTypePriv) {
2162     Pkcs7FreeSigners (RootCert);
2163     Pkcs7FreeSigners (SignerCerts);
2164   }
2165
2166   if (!VerifyStatus) {
2167     return EFI_SECURITY_VIOLATION;
2168   }
2169
2170   Status = CheckSignatureListFormat(VariableName, VendorGuid, PayloadPtr, PayloadSize);
2171   if (EFI_ERROR (Status)) {
2172     return Status;
2173   }
2174
2175   if ((PayloadSize == 0) && (VarDel != NULL)) {
2176     *VarDel = TRUE;
2177   }
2178
2179   //
2180   // Final step: Update/Append Variable if it pass Pkcs7Verify
2181   //
2182   return UpdateVariable (
2183            VariableName,
2184            VendorGuid,
2185            PayloadPtr,
2186            PayloadSize,
2187            Attributes,
2188            0,
2189            0,
2190            Variable,
2191            &CertData->TimeStamp
2192            );
2193 }
2194