SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c

   1 /** @file
   2   Implement authentication services for the authenticated variable
   3   service in UEFI2.2.
   4
   5   Caution: This module requires additional review when modified.
   6   This driver will have external input - variable data. It may be input in SMM mode.
   7   This external input must be validated carefully to avoid security issue like
   8   buffer overflow, integer overflow.
   9   Variable attribute should also be checked to avoid authentication bypass.
  10      The whole SMM authentication variable design relies on the integrity of flash part and SMM.
  11   which is assumed to be protected by platform.  All variable code and metadata in flash/SMM Memory
  12   may not be modified without authorization. If platform fails to protect these resources,
  13   the authentication service provided in this driver will be broken, and the behavior is undefined.
  14
  15   ProcessVarWithPk(), ProcessVarWithKek() and ProcessVariable() are the function to do
  16   variable authentication.
  17
  18   VerifyTimeBasedPayload() and VerifyCounterBasedPayload() are sub function to do verification.
  19   They will do basic validation for authentication data structure, then call crypto library
  20   to verify the signature.
  21
  22 Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>
  23 This program and the accompanying materials
  24 are licensed and made available under the terms and conditions of the BSD License
  25 which accompanies this distribution.  The full text of the license may be found at
  26 http://opensource.org/licenses/bsd-license.php
  27
  28 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  29 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  30
  31 **/
  32
  33 #include "Variable.h"
  34 #include "AuthService.h"
  35
  36 ///
  37 /// Global database array for scratch
  38 ///
  39 UINT8    *mPubKeyStore;
  40 UINT32   mPubKeyNumber;
  41 UINT32   mMaxKeyNumber;
  42 UINT32   mMaxKeyDbSize;
  43 UINT8    *mCertDbStore;
  44 UINT32   mMaxCertDbSize;
  45 UINT32   mPlatformMode;
  46 UINT8    mVendorKeyState;
  47
  48 EFI_GUID mSignatureSupport[] = {EFI_CERT_SHA1_GUID, EFI_CERT_SHA256_GUID, EFI_CERT_RSA2048_GUID, EFI_CERT_X509_GUID};
  49 //
  50 // Public Exponent of RSA Key.
  51 //
  52 CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };
  53 //
  54 // Hash context pointer
  55 //
  56 VOID  *mHashCtx = NULL;
  57
  58 //
  59 // Requirement for different signature type which have been defined in UEFI spec.
  60 // These data are used to peform SignatureList format check while setting PK/KEK variable.
  61 //
  62 EFI_SIGNATURE_ITEM mSupportSigItem[] = {
  63 //{SigType,                       SigHeaderSize,   SigDataSize  }
  64   {EFI_CERT_SHA256_GUID,          0,               32           },
  65   {EFI_CERT_RSA2048_GUID,         0,               256          },
  66   {EFI_CERT_RSA2048_SHA256_GUID,  0,               256          },
  67   {EFI_CERT_SHA1_GUID,            0,               20           },
  68   {EFI_CERT_RSA2048_SHA1_GUID,    0,               256          },
  69   {EFI_CERT_X509_GUID,            0,               ((UINT32) ~0)},
  70   {EFI_CERT_SHA224_GUID,          0,               28           },
  71   {EFI_CERT_SHA384_GUID,          0,               48           },
  72   {EFI_CERT_SHA512_GUID,          0,               64           },
  73   {EFI_CERT_X509_SHA256_GUID,     0,               48           },
  74   {EFI_CERT_X509_SHA384_GUID,     0,               64           },
  75   {EFI_CERT_X509_SHA512_GUID,     0,               80           }
  76 };
  77
  78 /**
  79   Determine whether this operation needs a physical present user.
  80
  81   @param[in]      VariableName            Name of the Variable.
  82   @param[in]      VendorGuid              GUID of the Variable.
  83
  84   @retval TRUE      This variable is protected, only a physical present user could set this variable.
  85   @retval FALSE     This variable is not protected.
  86
  87 **/
  88 BOOLEAN
  89 NeedPhysicallyPresent(
  90   IN     CHAR16         *VariableName,
  91   IN     EFI_GUID       *VendorGuid
  92   )
  93 {
  94   if ((CompareGuid (VendorGuid, &gEfiSecureBootEnableDisableGuid) && (StrCmp (VariableName, EFI_SECURE_BOOT_ENABLE_NAME) == 0))
  95     || (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (VariableName, EFI_CUSTOM_MODE_NAME) == 0))) {
  96     return TRUE;
  97   }
  98
  99   return FALSE;
 100 }
 101
 102 /**
 103   Determine whether the platform is operating in Custom Secure Boot mode.
 104
 105   @retval TRUE           The platform is operating in Custom mode.
 106   @retval FALSE          The platform is operating in Standard mode.
 107
 108 **/
 109 BOOLEAN
 110 InCustomMode (
 111   VOID
 112   )
 113 {
 114   VARIABLE_POINTER_TRACK  Variable;
 115
 116   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 117   if (Variable.CurrPtr != NULL && *(GetVariableDataPtr (Variable.CurrPtr)) == CUSTOM_SECURE_BOOT_MODE) {
 118     return TRUE;
 119   }
 120
 121   return FALSE;
 122 }
 123
 124 /**
 125   Initializes for authenticated varibale service.
 126
 127   @retval EFI_SUCCESS           Function successfully executed.
 128   @retval EFI_OUT_OF_RESOURCES  Fail to allocate enough memory resources.
 129
 130 **/
 131 EFI_STATUS
 132 AutenticatedVariableServiceInitialize (
 133   VOID
 134   )
 135 {
 136   EFI_STATUS              Status;
 137   VARIABLE_POINTER_TRACK  Variable;
 138   VARIABLE_POINTER_TRACK  PkVariable;
 139   UINT8                   VarValue;
 140   UINT32                  VarAttr;
 141   UINT8                   *Data;
 142   UINTN                   DataSize;
 143   UINTN                   CtxSize;
 144   UINT8                   SecureBootMode;
 145   UINT8                   SecureBootEnable;
 146   UINT8                   CustomMode;
 147   UINT32                  ListSize;
 148
 149   //
 150   // Initialize hash context.
 151   //
 152   CtxSize   = Sha256GetContextSize ();
 153   mHashCtx  = AllocateRuntimePool (CtxSize);
 154   if (mHashCtx == NULL) {
 155     return EFI_OUT_OF_RESOURCES;
 156   }
 157
 158   //
 159   // Reserve runtime buffer for public key database. The size excludes variable header and name size.
 160   //
 161   mMaxKeyDbSize = PcdGet32 (PcdMaxVariableSize) - sizeof (VARIABLE_HEADER) - sizeof (AUTHVAR_KEYDB_NAME);
 162   mMaxKeyNumber = mMaxKeyDbSize / EFI_CERT_TYPE_RSA2048_SIZE;
 163   mPubKeyStore  = AllocateRuntimePool (mMaxKeyDbSize);
 164   if (mPubKeyStore == NULL) {
 165     return EFI_OUT_OF_RESOURCES;
 166   }
 167
 168   //
 169   // Reserve runtime buffer for certificate database. The size excludes variable header and name size.
 170   //
 171   mMaxCertDbSize = PcdGet32 (PcdMaxVariableSize) - sizeof (VARIABLE_HEADER) - sizeof (EFI_CERT_DB_NAME);
 172   mCertDbStore   = AllocateRuntimePool (mMaxCertDbSize);
 173   if (mCertDbStore == NULL) {
 174     return EFI_OUT_OF_RESOURCES;
 175   }
 176
 177   //
 178   // Check "AuthVarKeyDatabase" variable's existence.
 179   // If it doesn't exist, create a new one with initial value of 0 and EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
 180   //
 181   Status = FindVariable (
 182              AUTHVAR_KEYDB_NAME,
 183              &gEfiAuthenticatedVariableGuid,
 184              &Variable,
 185              &mVariableModuleGlobal->VariableGlobal,
 186              FALSE
 187              );
 188
 189   if (Variable.CurrPtr == NULL) {
 190     VarAttr       = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 191     VarValue      = 0;
 192     mPubKeyNumber = 0;
 193     Status        = UpdateVariable (
 194                       AUTHVAR_KEYDB_NAME,
 195                       &gEfiAuthenticatedVariableGuid,
 196                       &VarValue,
 197                       sizeof(UINT8),
 198                       VarAttr,
 199                       0,
 200                       0,
 201                       &Variable,
 202                       NULL
 203                       );
 204     if (EFI_ERROR (Status)) {
 205       return Status;
 206     }
 207   } else {
 208     //
 209     // Load database in global variable for cache.
 210     //
 211     DataSize  = DataSizeOfVariable (Variable.CurrPtr);
 212     Data      = GetVariableDataPtr (Variable.CurrPtr);
 213     ASSERT ((DataSize != 0) && (Data != NULL));
 214     //
 215     // "AuthVarKeyDatabase" is an internal variable. Its DataSize is always ensured not to exceed mPubKeyStore buffer size(See definition before)
 216     //  Therefore, there is no memory overflow in underlying CopyMem.
 217     //
 218     CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
 219     mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
 220   }
 221
 222   FindVariable (EFI_PLATFORM_KEY_NAME, &gEfiGlobalVariableGuid, &PkVariable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 223   if (PkVariable.CurrPtr == NULL) {
 224     DEBUG ((EFI_D_INFO, "Variable %s does not exist.\n", EFI_PLATFORM_KEY_NAME));
 225   } else {
 226     DEBUG ((EFI_D_INFO, "Variable %s exists.\n", EFI_PLATFORM_KEY_NAME));
 227   }
 228
 229   //
 230   // Create "SetupMode" variable with BS+RT attribute set.
 231   //
 232   FindVariable (EFI_SETUP_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 233   if (PkVariable.CurrPtr == NULL) {
 234     mPlatformMode = SETUP_MODE;
 235   } else {
 236     mPlatformMode = USER_MODE;
 237   }
 238   Status = UpdateVariable (
 239              EFI_SETUP_MODE_NAME,
 240              &gEfiGlobalVariableGuid,
 241              &mPlatformMode,
 242              sizeof(UINT8),
 243              EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 244              0,
 245              0,
 246              &Variable,
 247              NULL
 248              );
 249   if (EFI_ERROR (Status)) {
 250     return Status;
 251   }
 252
 253   //
 254   // Create "SignatureSupport" variable with BS+RT attribute set.
 255   //
 256   FindVariable (EFI_SIGNATURE_SUPPORT_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 257   Status  = UpdateVariable (
 258               EFI_SIGNATURE_SUPPORT_NAME,
 259               &gEfiGlobalVariableGuid,
 260               mSignatureSupport,
 261               sizeof(mSignatureSupport),
 262               EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 263               0,
 264               0,
 265               &Variable,
 266               NULL
 267               );
 268   if (EFI_ERROR (Status)) {
 269     return Status;
 270   }
 271
 272   //
 273   // If "SecureBootEnable" variable exists, then update "SecureBoot" variable.
 274   // If "SecureBootEnable" variable is SECURE_BOOT_ENABLE and in USER_MODE, Set "SecureBoot" variable to SECURE_BOOT_MODE_ENABLE.
 275   // If "SecureBootEnable" variable is SECURE_BOOT_DISABLE, Set "SecureBoot" variable to SECURE_BOOT_MODE_DISABLE.
 276   //
 277   SecureBootEnable = SECURE_BOOT_DISABLE;
 278   FindVariable (EFI_SECURE_BOOT_ENABLE_NAME, &gEfiSecureBootEnableDisableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 279   if (Variable.CurrPtr != NULL) {
 280     SecureBootEnable = *(GetVariableDataPtr (Variable.CurrPtr));
 281   } else if (mPlatformMode == USER_MODE) {
 282     //
 283     // "SecureBootEnable" not exist, initialize it in USER_MODE.
 284     //
 285     SecureBootEnable = SECURE_BOOT_ENABLE;
 286     Status = UpdateVariable (
 287                EFI_SECURE_BOOT_ENABLE_NAME,
 288                &gEfiSecureBootEnableDisableGuid,
 289                &SecureBootEnable,
 290                sizeof (UINT8),
 291                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 292                0,
 293                0,
 294                &Variable,
 295                NULL
 296                );
 297     if (EFI_ERROR (Status)) {
 298       return Status;
 299     }
 300   }
 301
 302   //
 303   // Create "SecureBoot" variable with BS+RT attribute set.
 304   //
 305   if (SecureBootEnable == SECURE_BOOT_ENABLE && mPlatformMode == USER_MODE) {
 306     SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 307   } else {
 308     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 309   }
 310   FindVariable (EFI_SECURE_BOOT_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 311   Status = UpdateVariable (
 312              EFI_SECURE_BOOT_MODE_NAME,
 313              &gEfiGlobalVariableGuid,
 314              &SecureBootMode,
 315              sizeof (UINT8),
 316              EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 317              0,
 318              0,
 319              &Variable,
 320              NULL
 321              );
 322   if (EFI_ERROR (Status)) {
 323     return Status;
 324   }
 325
 326   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SETUP_MODE_NAME, mPlatformMode));
 327   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_MODE_NAME, SecureBootMode));
 328   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_ENABLE_NAME, SecureBootEnable));
 329
 330   //
 331   // Initialize "CustomMode" in STANDARD_SECURE_BOOT_MODE state.
 332   //
 333   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 334   CustomMode = STANDARD_SECURE_BOOT_MODE;
 335   Status = UpdateVariable (
 336              EFI_CUSTOM_MODE_NAME,
 337              &gEfiCustomModeEnableGuid,
 338              &CustomMode,
 339              sizeof (UINT8),
 340              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 341              0,
 342              0,
 343              &Variable,
 344              NULL
 345              );
 346   if (EFI_ERROR (Status)) {
 347     return Status;
 348   }
 349
 350   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_CUSTOM_MODE_NAME, CustomMode));
 351
 352   //
 353   // Check "certdb" variable's existence.
 354   // If it doesn't exist, then create a new one with
 355   // EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.
 356   //
 357   Status = FindVariable (
 358              EFI_CERT_DB_NAME,
 359              &gEfiCertDbGuid,
 360              &Variable,
 361              &mVariableModuleGlobal->VariableGlobal,
 362              FALSE
 363              );
 364
 365   if (Variable.CurrPtr == NULL) {
 366     VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
 367     ListSize = sizeof (UINT32);
 368     Status   = UpdateVariable (
 369                  EFI_CERT_DB_NAME,
 370                  &gEfiCertDbGuid,
 371                  &ListSize,
 372                  sizeof (UINT32),
 373                  VarAttr,
 374                  0,
 375                  0,
 376                  &Variable,
 377                  NULL
 378                  );
 379     if (EFI_ERROR (Status)) {
 380       return Status;
 381     }
 382   }
 383
 384   //
 385   // Check "VendorKeysNv" variable's existence and create "VendorKeys" variable accordingly.
 386   //
 387   FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 388   if (Variable.CurrPtr != NULL) {
 389     mVendorKeyState = *(GetVariableDataPtr (Variable.CurrPtr));
 390   } else {
 391     //
 392     // "VendorKeysNv" not exist, initialize it in VENDOR_KEYS_VALID state.
 393     //
 394     mVendorKeyState = VENDOR_KEYS_VALID;
 395     Status = UpdateVariable (
 396                EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
 397                &gEfiVendorKeysNvGuid,
 398                &mVendorKeyState,
 399                sizeof (UINT8),
 400                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS,
 401                0,
 402                0,
 403                &Variable,
 404                NULL
 405                );
 406     if (EFI_ERROR (Status)) {
 407       return Status;
 408     }
 409   }
 410
 411   //
 412   // Create "VendorKeys" variable with BS+RT attribute set.
 413   //
 414   FindVariable (EFI_VENDOR_KEYS_VARIABLE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 415   Status = UpdateVariable (
 416              EFI_VENDOR_KEYS_VARIABLE_NAME,
 417              &gEfiGlobalVariableGuid,
 418              &mVendorKeyState,
 419              sizeof (UINT8),
 420              EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 421              0,
 422              0,
 423              &Variable,
 424              NULL
 425              );
 426   if (EFI_ERROR (Status)) {
 427     return Status;
 428   }
 429
 430   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_VENDOR_KEYS_VARIABLE_NAME, mVendorKeyState));
 431
 432   return Status;
 433 }
 434
 435 /**
 436   Add public key in store and return its index.
 437
 438   @param[in]  PubKey                  Input pointer to Public Key data
 439   @param[in]  VariableDataEntry       The variable data entry
 440
 441   @return                             Index of new added item
 442
 443 **/
 444 UINT32
 445 AddPubKeyInStore (
 446   IN  UINT8                        *PubKey,
 447   IN  VARIABLE_ENTRY_CONSISTENCY   *VariableDataEntry
 448   )
 449 {
 450   EFI_STATUS                       Status;
 451   BOOLEAN                          IsFound;
 452   UINT32                           Index;
 453   VARIABLE_POINTER_TRACK           Variable;
 454   UINT8                            *Ptr;
 455   UINT8                            *Data;
 456   UINTN                            DataSize;
 457   VARIABLE_ENTRY_CONSISTENCY       PublicKeyEntry;
 458   UINT32                           Attributes;
 459
 460   if (PubKey == NULL) {
 461     return 0;
 462   }
 463
 464   Status = FindVariable (
 465              AUTHVAR_KEYDB_NAME,
 466              &gEfiAuthenticatedVariableGuid,
 467              &Variable,
 468              &mVariableModuleGlobal->VariableGlobal,
 469              FALSE
 470              );
 471   if (EFI_ERROR (Status)) {
 472     DEBUG ((EFI_D_ERROR, "Get public key database variable failure, Status = %r\n", Status));
 473     return 0;
 474   }
 475
 476   //
 477   // Check whether the public key entry does exist.
 478   //
 479   IsFound = FALSE;
 480   for (Ptr = mPubKeyStore, Index = 1; Index <= mPubKeyNumber; Index++) {
 481     if (CompareMem (Ptr, PubKey, EFI_CERT_TYPE_RSA2048_SIZE) == 0) {
 482       IsFound = TRUE;
 483       break;
 484     }
 485     Ptr += EFI_CERT_TYPE_RSA2048_SIZE;
 486   }
 487
 488   if (!IsFound) {
 489     //
 490     // Add public key in database.
 491     //
 492     if (mPubKeyNumber == mMaxKeyNumber) {
 493       //
 494       // Public key dadatase is full, try to reclaim invalid key.
 495       //
 496       if (AtRuntime ()) {
 497         //
 498         // NV storage can't reclaim at runtime.
 499         //
 500         return 0;
 501       }
 502
 503       Status = Reclaim (
 504                  mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase,
 505                  &mVariableModuleGlobal->NonVolatileLastVariableOffset,
 506                  FALSE,
 507                  NULL,
 508                  NULL,
 509                  0,
 510                  TRUE
 511                  );
 512       if (EFI_ERROR (Status)) {
 513         return 0;
 514       }
 515
 516       Status = FindVariable (
 517                  AUTHVAR_KEYDB_NAME,
 518                  &gEfiAuthenticatedVariableGuid,
 519                  &Variable,
 520                  &mVariableModuleGlobal->VariableGlobal,
 521                  FALSE
 522                  );
 523       if (EFI_ERROR (Status)) {
 524         DEBUG ((EFI_D_ERROR, "Get public key database variable failure, Status = %r\n", Status));
 525         return 0;
 526       }
 527
 528       DataSize  = DataSizeOfVariable (Variable.CurrPtr);
 529       Data      = GetVariableDataPtr (Variable.CurrPtr);
 530       ASSERT ((DataSize != 0) && (Data != NULL));
 531       //
 532       // "AuthVarKeyDatabase" is an internal used variable. Its DataSize is always ensured not to exceed mPubKeyStore buffer size(See definition before)
 533       //  Therefore, there is no memory overflow in underlying CopyMem.
 534       //
 535       CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
 536       mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
 537
 538       if (mPubKeyNumber == mMaxKeyNumber) {
 539         return 0;
 540       }
 541     }
 542
 543     //
 544     // Check the variable space for both public key and variable data.
 545     //
 546     PublicKeyEntry.VariableSize = (mPubKeyNumber + 1) * EFI_CERT_TYPE_RSA2048_SIZE;
 547     PublicKeyEntry.Guid         = &gEfiAuthenticatedVariableGuid;
 548     PublicKeyEntry.Name         = AUTHVAR_KEYDB_NAME;
 549     Attributes = VARIABLE_ATTRIBUTE_NV_BS_RT | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 550
 551     if (!CheckRemainingSpaceForConsistency (Attributes, &PublicKeyEntry, VariableDataEntry, NULL)) {
 552       //
 553       // No enough variable space.
 554       //
 555       return 0;
 556     }
 557
 558     CopyMem (mPubKeyStore + mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 559     Index = ++mPubKeyNumber;
 560     //
 561     // Update public key database variable.
 562     //
 563     Status = UpdateVariable (
 564                AUTHVAR_KEYDB_NAME,
 565                &gEfiAuthenticatedVariableGuid,
 566                mPubKeyStore,
 567                mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE,
 568                Attributes,
 569                0,
 570                0,
 571                &Variable,
 572                NULL
 573                );
 574     if (EFI_ERROR (Status)) {
 575       DEBUG ((EFI_D_ERROR, "Update public key database variable failure, Status = %r\n", Status));
 576       return 0;
 577     }
 578   }
 579
 580   return Index;
 581 }
 582
 583 /**
 584   Verify data payload with AuthInfo in EFI_CERT_TYPE_RSA2048_SHA256_GUID type.
 585   Follow the steps in UEFI2.2.
 586
 587   Caution: This function may receive untrusted input.
 588   This function may be invoked in SMM mode, and datasize and data are external input.
 589   This function will do basic validation, before parse the data.
 590   This function will parse the authentication carefully to avoid security issues, like
 591   buffer overflow, integer overflow.
 592
 593   @param[in]      Data                    Pointer to data with AuthInfo.
 594   @param[in]      DataSize                Size of Data.
 595   @param[in]      PubKey                  Public key used for verification.
 596
 597   @retval EFI_INVALID_PARAMETER       Invalid parameter.
 598   @retval EFI_SECURITY_VIOLATION      If authentication failed.
 599   @retval EFI_SUCCESS                 Authentication successful.
 600
 601 **/
 602 EFI_STATUS
 603 VerifyCounterBasedPayload (
 604   IN     UINT8          *Data,
 605   IN     UINTN          DataSize,
 606   IN     UINT8          *PubKey
 607   )
 608 {
 609   BOOLEAN                         Status;
 610   EFI_VARIABLE_AUTHENTICATION     *CertData;
 611   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
 612   UINT8                           Digest[SHA256_DIGEST_SIZE];
 613   VOID                            *Rsa;
 614   UINTN                           PayloadSize;
 615
 616   PayloadSize = DataSize - AUTHINFO_SIZE;
 617   Rsa         = NULL;
 618   CertData    = NULL;
 619   CertBlock   = NULL;
 620
 621   if (Data == NULL || PubKey == NULL) {
 622     return EFI_INVALID_PARAMETER;
 623   }
 624
 625   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
 626   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
 627
 628   //
 629   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
 630   // Cert type should be EFI_CERT_TYPE_RSA2048_SHA256_GUID.
 631   //
 632   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
 633       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertTypeRsa2048Sha256Guid)
 634         ) {
 635     //
 636     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
 637     //
 638     return EFI_SECURITY_VIOLATION;
 639   }
 640   //
 641   // Hash data payload with SHA256.
 642   //
 643   ZeroMem (Digest, SHA256_DIGEST_SIZE);
 644   Status  = Sha256Init (mHashCtx);
 645   if (!Status) {
 646     goto Done;
 647   }
 648   Status  = Sha256Update (mHashCtx, Data + AUTHINFO_SIZE, PayloadSize);
 649   if (!Status) {
 650     goto Done;
 651   }
 652   //
 653   // Hash Size.
 654   //
 655   Status  = Sha256Update (mHashCtx, &PayloadSize, sizeof (UINTN));
 656   if (!Status) {
 657     goto Done;
 658   }
 659   //
 660   // Hash Monotonic Count.
 661   //
 662   Status  = Sha256Update (mHashCtx, &CertData->MonotonicCount, sizeof (UINT64));
 663   if (!Status) {
 664     goto Done;
 665   }
 666   Status  = Sha256Final (mHashCtx, Digest);
 667   if (!Status) {
 668     goto Done;
 669   }
 670   //
 671   // Generate & Initialize RSA Context.
 672   //
 673   Rsa = RsaNew ();
 674   ASSERT (Rsa != NULL);
 675   //
 676   // Set RSA Key Components.
 677   // NOTE: Only N and E are needed to be set as RSA public key for signature verification.
 678   //
 679   Status = RsaSetKey (Rsa, RsaKeyN, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 680   if (!Status) {
 681     goto Done;
 682   }
 683   Status = RsaSetKey (Rsa, RsaKeyE, mRsaE, sizeof (mRsaE));
 684   if (!Status) {
 685     goto Done;
 686   }
 687   //
 688   // Verify the signature.
 689   //
 690   Status = RsaPkcs1Verify (
 691              Rsa,
 692              Digest,
 693              SHA256_DIGEST_SIZE,
 694              CertBlock->Signature,
 695              EFI_CERT_TYPE_RSA2048_SHA256_SIZE
 696              );
 697
 698 Done:
 699   if (Rsa != NULL) {
 700     RsaFree (Rsa);
 701   }
 702   if (Status) {
 703     return EFI_SUCCESS;
 704   } else {
 705     return EFI_SECURITY_VIOLATION;
 706   }
 707 }
 708
 709 /**
 710   Update platform mode.
 711
 712   @param[in]      Mode                    SETUP_MODE or USER_MODE.
 713
 714   @return EFI_INVALID_PARAMETER           Invalid parameter.
 715   @return EFI_SUCCESS                     Update platform mode successfully.
 716
 717 **/
 718 EFI_STATUS
 719 UpdatePlatformMode (
 720   IN  UINT32                    Mode
 721   )
 722 {
 723   EFI_STATUS              Status;
 724   VARIABLE_POINTER_TRACK  Variable;
 725   UINT8                   SecureBootMode;
 726   UINT8                   SecureBootEnable;
 727   UINTN                   VariableDataSize;
 728
 729   Status = FindVariable (
 730              EFI_SETUP_MODE_NAME,
 731              &gEfiGlobalVariableGuid,
 732              &Variable,
 733              &mVariableModuleGlobal->VariableGlobal,
 734              FALSE
 735              );
 736   if (EFI_ERROR (Status)) {
 737     return Status;
 738   }
 739
 740   //
 741   // Update the value of SetupMode variable by a simple mem copy, this could avoid possible
 742   // variable storage reclaim at runtime.
 743   //
 744   mPlatformMode = (UINT8) Mode;
 745   CopyMem (GetVariableDataPtr (Variable.CurrPtr), &mPlatformMode, sizeof(UINT8));
 746
 747   if (AtRuntime ()) {
 748     //
 749     // SecureBoot Variable indicates whether the platform firmware is operating
 750     // in Secure boot mode (1) or not (0), so we should not change SecureBoot
 751     // Variable in runtime.
 752     //
 753     return Status;
 754   }
 755
 756   //
 757   // Check "SecureBoot" variable's existence.
 758   // If it doesn't exist, firmware has no capability to perform driver signing verification,
 759   // then set "SecureBoot" to 0.
 760   //
 761   Status = FindVariable (
 762              EFI_SECURE_BOOT_MODE_NAME,
 763              &gEfiGlobalVariableGuid,
 764              &Variable,
 765              &mVariableModuleGlobal->VariableGlobal,
 766              FALSE
 767              );
 768   //
 769   // If "SecureBoot" variable exists, then check "SetupMode" variable update.
 770   // If "SetupMode" variable is USER_MODE, "SecureBoot" variable is set to 1.
 771   // If "SetupMode" variable is SETUP_MODE, "SecureBoot" variable is set to 0.
 772   //
 773   if (Variable.CurrPtr == NULL) {
 774     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 775   } else {
 776     if (mPlatformMode == USER_MODE) {
 777       SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 778     } else if (mPlatformMode == SETUP_MODE) {
 779       SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 780     } else {
 781       return EFI_NOT_FOUND;
 782     }
 783   }
 784
 785   Status  = UpdateVariable (
 786               EFI_SECURE_BOOT_MODE_NAME,
 787               &gEfiGlobalVariableGuid,
 788               &SecureBootMode,
 789               sizeof(UINT8),
 790               EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 791               0,
 792               0,
 793               &Variable,
 794               NULL
 795               );
 796   if (EFI_ERROR (Status)) {
 797     return Status;
 798   }
 799
 800   //
 801   // Check "SecureBootEnable" variable's existence. It can enable/disable secure boot feature.
 802   //
 803   Status = FindVariable (
 804              EFI_SECURE_BOOT_ENABLE_NAME,
 805              &gEfiSecureBootEnableDisableGuid,
 806              &Variable,
 807              &mVariableModuleGlobal->VariableGlobal,
 808              FALSE
 809              );
 810
 811   if (SecureBootMode == SECURE_BOOT_MODE_ENABLE) {
 812     //
 813     // Create the "SecureBootEnable" variable as secure boot is enabled.
 814     //
 815     SecureBootEnable = SECURE_BOOT_ENABLE;
 816     VariableDataSize = sizeof (SecureBootEnable);
 817   } else {
 818     //
 819     // Delete the "SecureBootEnable" variable if this variable exist as "SecureBoot"
 820     // variable is not in secure boot state.
 821     //
 822     if (Variable.CurrPtr == NULL || EFI_ERROR (Status)) {
 823       return EFI_SUCCESS;
 824     }
 825     SecureBootEnable = SECURE_BOOT_DISABLE;
 826     VariableDataSize = 0;
 827   }
 828
 829   Status = UpdateVariable (
 830              EFI_SECURE_BOOT_ENABLE_NAME,
 831              &gEfiSecureBootEnableDisableGuid,
 832              &SecureBootEnable,
 833              VariableDataSize,
 834              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 835              0,
 836              0,
 837              &Variable,
 838              NULL
 839              );
 840   return Status;
 841 }
 842
 843 /**
 844   Check input data form to make sure it is a valid EFI_SIGNATURE_LIST for PK/KEK/db/dbx/dbt variable.
 845
 846   @param[in]  VariableName                Name of Variable to be check.
 847   @param[in]  VendorGuid                  Variable vendor GUID.
 848   @param[in]  Data                        Point to the variable data to be checked.
 849   @param[in]  DataSize                    Size of Data.
 850
 851   @return EFI_INVALID_PARAMETER           Invalid signature list format.
 852   @return EFI_SUCCESS                     Passed signature list format check successfully.
 853
 854 **/
 855 EFI_STATUS
 856 CheckSignatureListFormat(
 857   IN  CHAR16                    *VariableName,
 858   IN  EFI_GUID                  *VendorGuid,
 859   IN  VOID                      *Data,
 860   IN  UINTN                     DataSize
 861   )
 862 {
 863   EFI_SIGNATURE_LIST     *SigList;
 864   UINTN                  SigDataSize;
 865   UINT32                 Index;
 866   UINT32                 SigCount;
 867   BOOLEAN                IsPk;
 868   VOID                   *RsaContext;
 869   EFI_SIGNATURE_DATA     *CertData;
 870   UINTN                  CertLen;
 871
 872   if (DataSize == 0) {
 873     return EFI_SUCCESS;
 874   }
 875
 876   ASSERT (VariableName != NULL && VendorGuid != NULL && Data != NULL);
 877
 878   if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_PLATFORM_KEY_NAME) == 0)){
 879     IsPk = TRUE;
 880   } else if ((CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0)) ||
 881              (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&
 882              ((StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0) || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0) ||
 883               (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0)))) {
 884     IsPk = FALSE;
 885   } else {
 886     return EFI_SUCCESS;
 887   }
 888
 889   SigCount = 0;
 890   SigList  = (EFI_SIGNATURE_LIST *) Data;
 891   SigDataSize  = DataSize;
 892   RsaContext = NULL;
 893
 894   //
 895   // Walk throuth the input signature list and check the data format.
 896   // If any signature is incorrectly formed, the whole check will fail.
 897   //
 898   while ((SigDataSize > 0) && (SigDataSize >= SigList->SignatureListSize)) {
 899     for (Index = 0; Index < (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM)); Index++ ) {
 900       if (CompareGuid (&SigList->SignatureType, &mSupportSigItem[Index].SigType)) {
 901         //
 902         // The value of SignatureSize should always be 16 (size of SignatureOwner
 903         // component) add the data length according to signature type.
 904         //
 905         if (mSupportSigItem[Index].SigDataSize != ((UINT32) ~0) &&
 906           (SigList->SignatureSize - sizeof (EFI_GUID)) != mSupportSigItem[Index].SigDataSize) {
 907           return EFI_INVALID_PARAMETER;
 908         }
 909         if (mSupportSigItem[Index].SigHeaderSize != ((UINTN) ~0) &&
 910           SigList->SignatureHeaderSize != mSupportSigItem[Index].SigHeaderSize) {
 911           return EFI_INVALID_PARAMETER;
 912         }
 913         break;
 914       }
 915     }
 916
 917     if (Index == (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM))) {
 918       //
 919       // Undefined signature type.
 920       //
 921       return EFI_INVALID_PARAMETER;
 922     }
 923
 924     if (CompareGuid (&SigList->SignatureType, &gEfiCertX509Guid)) {
 925       //
 926       // Try to retrieve the RSA public key from the X.509 certificate.
 927       // If this operation fails, it's not a valid certificate.
 928       //
 929       RsaContext = RsaNew ();
 930       if (RsaContext == NULL) {
 931         return EFI_INVALID_PARAMETER;
 932       }
 933       CertData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigList + sizeof (EFI_SIGNATURE_LIST) + SigList->SignatureHeaderSize);
 934       CertLen = SigList->SignatureSize - sizeof (EFI_GUID);
 935       if (!RsaGetPublicKeyFromX509 (CertData->SignatureData, CertLen, &RsaContext)) {
 936         RsaFree (RsaContext);
 937         return EFI_INVALID_PARAMETER;
 938       }
 939       RsaFree (RsaContext);
 940     }
 941
 942     if ((SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) % SigList->SignatureSize != 0) {
 943       return EFI_INVALID_PARAMETER;
 944     }
 945     SigCount += (SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) / SigList->SignatureSize;
 946
 947     SigDataSize -= SigList->SignatureListSize;
 948     SigList = (EFI_SIGNATURE_LIST *) ((UINT8 *) SigList + SigList->SignatureListSize);
 949   }
 950
 951   if (((UINTN) SigList - (UINTN) Data) != DataSize) {
 952     return EFI_INVALID_PARAMETER;
 953   }
 954
 955   if (IsPk && SigCount > 1) {
 956     return EFI_INVALID_PARAMETER;
 957   }
 958
 959   return EFI_SUCCESS;
 960 }
 961
 962 /**
 963   Update "VendorKeys" variable to record the out of band secure boot key modification.
 964
 965   @return EFI_SUCCESS           Variable is updated successfully.
 966   @return Others                Failed to update variable.
 967
 968 **/
 969 EFI_STATUS
 970 VendorKeyIsModified (
 971   VOID
 972   )
 973 {
 974   EFI_STATUS              Status;
 975   VARIABLE_POINTER_TRACK  Variable;
 976
 977   if (mVendorKeyState == VENDOR_KEYS_MODIFIED) {
 978     return EFI_SUCCESS;
 979   }
 980   mVendorKeyState = VENDOR_KEYS_MODIFIED;
 981
 982   FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 983   Status = UpdateVariable (
 984              EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
 985              &gEfiVendorKeysNvGuid,
 986              &mVendorKeyState,
 987              sizeof (UINT8),
 988              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS,
 989              0,
 990              0,
 991              &Variable,
 992              NULL
 993              );
 994   if (EFI_ERROR (Status)) {
 995     return Status;
 996   }
 997
 998   FindVariable (EFI_VENDOR_KEYS_VARIABLE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 999   return UpdateVariable (
1000            EFI_VENDOR_KEYS_VARIABLE_NAME,
1001            &gEfiGlobalVariableGuid,
1002            &mVendorKeyState,
1003            sizeof (UINT8),
1004            EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
1005            0,
1006            0,
1007            &Variable,
1008            NULL
1009            );
1010 }
1011
1012 /**
1013   Process variable with platform key for verification.
1014
1015   Caution: This function may receive untrusted input.
1016   This function may be invoked in SMM mode, and datasize and data are external input.
1017   This function will do basic validation, before parse the data.
1018   This function will parse the authentication carefully to avoid security issues, like
1019   buffer overflow, integer overflow.
1020   This function will check attribute carefully to avoid authentication bypass.
1021
1022   @param[in]  VariableName                Name of Variable to be found.
1023   @param[in]  VendorGuid                  Variable vendor GUID.
1024   @param[in]  Data                        Data pointer.
1025   @param[in]  DataSize                    Size of Data found. If size is less than the
1026                                           data, this value contains the required size.
1027   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1028   @param[in]  Attributes                  Attribute value of the variable
1029   @param[in]  IsPk                        Indicate whether it is to process pk.
1030
1031   @return EFI_INVALID_PARAMETER           Invalid parameter.
1032   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation.
1033                                           check carried out by the firmware.
1034   @return EFI_SUCCESS                     Variable passed validation successfully.
1035
1036 **/
1037 EFI_STATUS
1038 ProcessVarWithPk (
1039   IN  CHAR16                    *VariableName,
1040   IN  EFI_GUID                  *VendorGuid,
1041   IN  VOID                      *Data,
1042   IN  UINTN                     DataSize,
1043   IN  VARIABLE_POINTER_TRACK    *Variable,
1044   IN  UINT32                    Attributes OPTIONAL,
1045   IN  BOOLEAN                   IsPk
1046   )
1047 {
1048   EFI_STATUS                  Status;
1049   BOOLEAN                     Del;
1050   UINT8                       *Payload;
1051   UINTN                       PayloadSize;
1052
1053   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1054       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1055     //
1056     // PK, KEK and db/dbx/dbt should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1057     // authenticated variable.
1058     //
1059     return EFI_INVALID_PARAMETER;
1060   }
1061
1062   Del = FALSE;
1063   if ((InCustomMode() && UserPhysicalPresent()) || (mPlatformMode == SETUP_MODE && !IsPk)) {
1064     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1065     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1066     if (PayloadSize == 0) {
1067       Del = TRUE;
1068     }
1069
1070     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
1071     if (EFI_ERROR (Status)) {
1072       return Status;
1073     }
1074
1075     Status = UpdateVariable (
1076                VariableName,
1077                VendorGuid,
1078                Payload,
1079                PayloadSize,
1080                Attributes,
1081                0,
1082                0,
1083                Variable,
1084                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1085                );
1086     if (EFI_ERROR(Status)) {
1087       return Status;
1088     }
1089
1090     if ((mPlatformMode != SETUP_MODE) || IsPk) {
1091       Status = VendorKeyIsModified ();
1092     }
1093   } else if (mPlatformMode == USER_MODE) {
1094     //
1095     // Verify against X509 Cert in PK database.
1096     //
1097     Status = VerifyTimeBasedPayload (
1098                VariableName,
1099                VendorGuid,
1100                Data,
1101                DataSize,
1102                Variable,
1103                Attributes,
1104                AuthVarTypePk,
1105                &Del
1106                );
1107   } else {
1108     //
1109     // Verify against the certificate in data payload.
1110     //
1111     Status = VerifyTimeBasedPayload (
1112                VariableName,
1113                VendorGuid,
1114                Data,
1115                DataSize,
1116                Variable,
1117                Attributes,
1118                AuthVarTypePayload,
1119                &Del
1120                );
1121   }
1122
1123   if (!EFI_ERROR(Status) && IsPk) {
1124     if (mPlatformMode == SETUP_MODE && !Del) {
1125       //
1126       // If enroll PK in setup mode, need change to user mode.
1127       //
1128       Status = UpdatePlatformMode (USER_MODE);
1129     } else if (mPlatformMode == USER_MODE && Del){
1130       //
1131       // If delete PK in user mode, need change to setup mode.
1132       //
1133       Status = UpdatePlatformMode (SETUP_MODE);
1134     }
1135   }
1136
1137   return Status;
1138 }
1139
1140 /**
1141   Process variable with key exchange key for verification.
1142
1143   Caution: This function may receive untrusted input.
1144   This function may be invoked in SMM mode, and datasize and data are external input.
1145   This function will do basic validation, before parse the data.
1146   This function will parse the authentication carefully to avoid security issues, like
1147   buffer overflow, integer overflow.
1148   This function will check attribute carefully to avoid authentication bypass.
1149
1150   @param[in]  VariableName                Name of Variable to be found.
1151   @param[in]  VendorGuid                  Variable vendor GUID.
1152   @param[in]  Data                        Data pointer.
1153   @param[in]  DataSize                    Size of Data found. If size is less than the
1154                                           data, this value contains the required size.
1155   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1156   @param[in]  Attributes                  Attribute value of the variable.
1157
1158   @return EFI_INVALID_PARAMETER           Invalid parameter.
1159   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
1160                                           check carried out by the firmware.
1161   @return EFI_SUCCESS                     Variable pass validation successfully.
1162
1163 **/
1164 EFI_STATUS
1165 ProcessVarWithKek (
1166   IN  CHAR16                               *VariableName,
1167   IN  EFI_GUID                             *VendorGuid,
1168   IN  VOID                                 *Data,
1169   IN  UINTN                                DataSize,
1170   IN  VARIABLE_POINTER_TRACK               *Variable,
1171   IN  UINT32                               Attributes OPTIONAL
1172   )
1173 {
1174   EFI_STATUS                      Status;
1175   UINT8                           *Payload;
1176   UINTN                           PayloadSize;
1177
1178   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1179       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1180     //
1181     // DB, DBX and DBT should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1182     // authenticated variable.
1183     //
1184     return EFI_INVALID_PARAMETER;
1185   }
1186
1187   Status = EFI_SUCCESS;
1188   if (mPlatformMode == USER_MODE && !(InCustomMode() && UserPhysicalPresent())) {
1189     //
1190     // Time-based, verify against X509 Cert KEK.
1191     //
1192     return VerifyTimeBasedPayload (
1193              VariableName,
1194              VendorGuid,
1195              Data,
1196              DataSize,
1197              Variable,
1198              Attributes,
1199              AuthVarTypeKek,
1200              NULL
1201              );
1202   } else {
1203     //
1204     // If in setup mode or custom secure boot mode, no authentication needed.
1205     //
1206     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1207     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1208
1209     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
1210     if (EFI_ERROR (Status)) {
1211       return Status;
1212     }
1213
1214     Status = UpdateVariable (
1215                VariableName,
1216                VendorGuid,
1217                Payload,
1218                PayloadSize,
1219                Attributes,
1220                0,
1221                0,
1222                Variable,
1223                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1224                );
1225     if (EFI_ERROR (Status)) {
1226       return Status;
1227     }
1228
1229     if (mPlatformMode != SETUP_MODE) {
1230       Status = VendorKeyIsModified ();
1231     }
1232   }
1233
1234   return Status;
1235 }
1236
1237 /**
1238   Check if it is to delete auth variable.
1239
1240   @param[in] Data               Data pointer.
1241   @param[in] DataSize           Size of Data.
1242   @param[in] Variable           The variable information which is used to keep track of variable usage.
1243   @param[in] Attributes         Attribute value of the variable.
1244
1245   @retval TRUE                  It is to delete auth variable.
1246   @retval FALSE                 It is not to delete auth variable.
1247
1248 **/
1249 BOOLEAN
1250 IsDeleteAuthVariable (
1251   IN  VOID                      *Data,
1252   IN  UINTN                     DataSize,
1253   IN  VARIABLE_POINTER_TRACK    *Variable,
1254   IN  UINT32                    Attributes
1255   )
1256 {
1257   BOOLEAN                       Del;
1258   UINT8                         *Payload;
1259   UINTN                         PayloadSize;
1260
1261   Del = FALSE;
1262
1263   //
1264   // To delete a variable created with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
1265   // or the EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS attribute,
1266   // SetVariable must be used with attributes matching the existing variable
1267   // and the DataSize set to the size of the AuthInfo descriptor.
1268   //
1269   if ((Variable->CurrPtr != NULL) &&
1270       (Attributes == Variable->CurrPtr->Attributes) &&
1271       ((Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)) {
1272     if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1273       Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1274       PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1275       if (PayloadSize == 0) {
1276         Del = TRUE;
1277       }
1278     } else {
1279       Payload = (UINT8 *) Data + AUTHINFO_SIZE;
1280       PayloadSize = DataSize - AUTHINFO_SIZE;
1281       if (PayloadSize == 0) {
1282         Del = TRUE;
1283       }
1284     }
1285   }
1286
1287   return Del;
1288 }
1289
1290 /**
1291   Process variable with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS/EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
1292
1293   Caution: This function may receive untrusted input.
1294   This function may be invoked in SMM mode, and datasize and data are external input.
1295   This function will do basic validation, before parse the data.
1296   This function will parse the authentication carefully to avoid security issues, like
1297   buffer overflow, integer overflow.
1298   This function will check attribute carefully to avoid authentication bypass.
1299
1300   @param[in]  VariableName                Name of Variable to be found.
1301   @param[in]  VendorGuid                  Variable vendor GUID.
1302
1303   @param[in]  Data                        Data pointer.
1304   @param[in]  DataSize                    Size of Data.
1305   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1306   @param[in]  Attributes                  Attribute value of the variable.
1307
1308   @return EFI_INVALID_PARAMETER           Invalid parameter.
1309   @return EFI_WRITE_PROTECTED             Variable is write-protected and needs authentication with
1310                                           EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1311   @return EFI_OUT_OF_RESOURCES            The Database to save the public key is full.
1312   @return EFI_SECURITY_VIOLATION          The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
1313                                           set, but the AuthInfo does NOT pass the validation
1314                                           check carried out by the firmware.
1315   @return EFI_SUCCESS                     Variable is not write-protected or pass validation successfully.
1316
1317 **/
1318 EFI_STATUS
1319 ProcessVariable (
1320   IN     CHAR16                             *VariableName,
1321   IN     EFI_GUID                           *VendorGuid,
1322   IN     VOID                               *Data,
1323   IN     UINTN                              DataSize,
1324   IN     VARIABLE_POINTER_TRACK             *Variable,
1325   IN     UINT32                             Attributes
1326   )
1327 {
1328   EFI_STATUS                      Status;
1329   BOOLEAN                         IsDeletion;
1330   BOOLEAN                         IsFirstTime;
1331   UINT8                           *PubKey;
1332   EFI_VARIABLE_AUTHENTICATION     *CertData;
1333   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
1334   UINT32                          KeyIndex;
1335   UINT64                          MonotonicCount;
1336   VARIABLE_ENTRY_CONSISTENCY      VariableDataEntry;
1337
1338   KeyIndex    = 0;
1339   CertData    = NULL;
1340   CertBlock   = NULL;
1341   PubKey      = NULL;
1342   IsDeletion  = FALSE;
1343   Status      = EFI_SUCCESS;
1344
1345   if (IsDeleteAuthVariable (Data, DataSize, Variable, Attributes) && UserPhysicalPresent()) {
1346     //
1347     // Allow the delete operation of common authenticated variable at user physical presence.
1348     //
1349     if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1350       Status = DeleteCertsFromDb (VariableName, VendorGuid);
1351     }
1352     if (!EFI_ERROR (Status)) {
1353       Status = UpdateVariable (
1354                  VariableName,
1355                  VendorGuid,
1356                  NULL,
1357                  0,
1358                  0,
1359                  0,
1360                  0,
1361                  Variable,
1362                  NULL
1363                  );
1364     }
1365     return Status;
1366   }
1367
1368   if (NeedPhysicallyPresent (VariableName, VendorGuid) && !UserPhysicalPresent()) {
1369     //
1370     // This variable is protected, only physical present user could modify its value.
1371     //
1372     return EFI_SECURITY_VIOLATION;
1373   }
1374
1375   //
1376   // A time-based authenticated variable and a count-based authenticated variable
1377   // can't be updated by each other.
1378   //
1379   if (Variable->CurrPtr != NULL) {
1380     if (((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) &&
1381         ((Variable->CurrPtr->Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0)) {
1382       return EFI_SECURITY_VIOLATION;
1383     }
1384
1385     if (((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) &&
1386         ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0)) {
1387       return EFI_SECURITY_VIOLATION;
1388     }
1389   }
1390
1391   //
1392   // Process Time-based Authenticated variable.
1393   //
1394   if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1395     return VerifyTimeBasedPayload (
1396              VariableName,
1397              VendorGuid,
1398              Data,
1399              DataSize,
1400              Variable,
1401              Attributes,
1402              AuthVarTypePriv,
1403              NULL
1404              );
1405   }
1406
1407   //
1408   // Determine if first time SetVariable with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS.
1409   //
1410   if ((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) {
1411     //
1412     // Determine current operation type.
1413     //
1414     if (DataSize == AUTHINFO_SIZE) {
1415       IsDeletion = TRUE;
1416     }
1417     //
1418     // Determine whether this is the first time with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1419     //
1420     if (Variable->CurrPtr == NULL) {
1421       IsFirstTime = TRUE;
1422     } else if ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) == 0) {
1423       IsFirstTime = TRUE;
1424     } else {
1425       KeyIndex   = Variable->CurrPtr->PubKeyIndex;
1426       IsFirstTime = FALSE;
1427     }
1428   } else if ((Variable->CurrPtr != NULL) &&
1429              ((Variable->CurrPtr->Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)
1430             ) {
1431     //
1432     // If the variable is already write-protected, it always needs authentication before update.
1433     //
1434     return EFI_WRITE_PROTECTED;
1435   } else {
1436     //
1437     // If without EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS, set and attributes collision.
1438     // That means it is not authenticated variable, just update variable as usual.
1439     //
1440     Status = UpdateVariable (VariableName, VendorGuid, Data, DataSize, Attributes, 0, 0, Variable, NULL);
1441     return Status;
1442   }
1443
1444   //
1445   // Get PubKey and check Monotonic Count value corresponding to the variable.
1446   //
1447   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
1448   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
1449   PubKey    = CertBlock->PublicKey;
1450
1451   //
1452   // Update Monotonic Count value.
1453   //
1454   MonotonicCount = CertData->MonotonicCount;
1455
1456   if (!IsFirstTime) {
1457     //
1458     // 2 cases need to check here
1459     //   1. Internal PubKey variable. PubKeyIndex is always 0
1460     //   2. Other counter-based AuthVariable. Check input PubKey.
1461     //
1462     if (KeyIndex == 0 || CompareMem (PubKey, mPubKeyStore + (KeyIndex - 1) * EFI_CERT_TYPE_RSA2048_SIZE, EFI_CERT_TYPE_RSA2048_SIZE) != 0) {
1463       return EFI_SECURITY_VIOLATION;
1464     }
1465     //
1466     // Compare the current monotonic count and ensure that it is greater than the last SetVariable
1467     // operation with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS attribute set.
1468     //
1469     if (CertData->MonotonicCount <= Variable->CurrPtr->MonotonicCount) {
1470       //
1471       // Monotonic count check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
1472       //
1473       return EFI_SECURITY_VIOLATION;
1474     }
1475   }
1476   //
1477   // Verify the certificate in Data payload.
1478   //
1479   Status = VerifyCounterBasedPayload (Data, DataSize, PubKey);
1480   if (EFI_ERROR (Status)) {
1481     return Status;
1482   }
1483
1484   //
1485   // Now, the signature has been verified!
1486   //
1487   if (IsFirstTime && !IsDeletion) {
1488     VariableDataEntry.VariableSize = DataSize - AUTHINFO_SIZE;
1489     VariableDataEntry.Guid         = VendorGuid;
1490     VariableDataEntry.Name         = VariableName;
1491
1492     //
1493     // Update public key database variable if need.
1494     //
1495     KeyIndex = AddPubKeyInStore (PubKey, &VariableDataEntry);
1496     if (KeyIndex == 0) {
1497       return EFI_OUT_OF_RESOURCES;
1498     }
1499   }
1500
1501   //
1502   // Verification pass.
1503   //
1504   return UpdateVariable (VariableName, VendorGuid, (UINT8*)Data + AUTHINFO_SIZE, DataSize - AUTHINFO_SIZE, Attributes, KeyIndex, MonotonicCount, Variable, NULL);
1505 }
1506
1507 /**
1508   Merge two buffers which formatted as EFI_SIGNATURE_LIST. Only the new EFI_SIGNATURE_DATA
1509   will be appended to the original EFI_SIGNATURE_LIST, duplicate EFI_SIGNATURE_DATA
1510   will be ignored.
1511
1512   @param[in, out]  Data              Pointer to original EFI_SIGNATURE_LIST.
1513   @param[in]       DataSize          Size of Data buffer.
1514   @param[in]       FreeBufSize       Size of free data buffer
1515   @param[in]       NewData           Pointer to new EFI_SIGNATURE_LIST to be appended.
1516   @param[in]       NewDataSize       Size of NewData buffer.
1517   @param[out]      MergedBufSize     Size of the merged buffer
1518
1519   @return EFI_BUFFER_TOO_SMALL if input Data buffer overflowed
1520
1521 **/
1522 EFI_STATUS
1523 AppendSignatureList (
1524   IN  OUT VOID            *Data,
1525   IN  UINTN               DataSize,
1526   IN  UINTN               FreeBufSize,
1527   IN  VOID                *NewData,
1528   IN  UINTN               NewDataSize,
1529   OUT UINTN               *MergedBufSize
1530   )
1531 {
1532   EFI_SIGNATURE_LIST  *CertList;
1533   EFI_SIGNATURE_DATA  *Cert;
1534   UINTN               CertCount;
1535   EFI_SIGNATURE_LIST  *NewCertList;
1536   EFI_SIGNATURE_DATA  *NewCert;
1537   UINTN               NewCertCount;
1538   UINTN               Index;
1539   UINTN               Index2;
1540   UINTN               Size;
1541   UINT8               *Tail;
1542   UINTN               CopiedCount;
1543   UINTN               SignatureListSize;
1544   BOOLEAN             IsNewCert;
1545
1546   Tail = (UINT8 *) Data + DataSize;
1547
1548   NewCertList = (EFI_SIGNATURE_LIST *) NewData;
1549   while ((NewDataSize > 0) && (NewDataSize >= NewCertList->SignatureListSize)) {
1550     NewCert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCertList + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1551     NewCertCount = (NewCertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - NewCertList->SignatureHeaderSize) / NewCertList->SignatureSize;
1552
1553     CopiedCount = 0;
1554     for (Index = 0; Index < NewCertCount; Index++) {
1555       IsNewCert = TRUE;
1556
1557       Size = DataSize;
1558       CertList = (EFI_SIGNATURE_LIST *) Data;
1559       while ((Size > 0) && (Size >= CertList->SignatureListSize)) {
1560         if (CompareGuid (&CertList->SignatureType, &NewCertList->SignatureType) &&
1561            (CertList->SignatureSize == NewCertList->SignatureSize)) {
1562           Cert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
1563           CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
1564           for (Index2 = 0; Index2 < CertCount; Index2++) {
1565             //
1566             // Iterate each Signature Data in this Signature List.
1567             //
1568             if (CompareMem (NewCert, Cert, CertList->SignatureSize) == 0) {
1569               IsNewCert = FALSE;
1570               break;
1571             }
1572             Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
1573           }
1574         }
1575
1576         if (!IsNewCert) {
1577           break;
1578         }
1579         Size -= CertList->SignatureListSize;
1580         CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
1581       }
1582
1583       if (IsNewCert) {
1584         //
1585         // New EFI_SIGNATURE_DATA, append it.
1586         //
1587         if (CopiedCount == 0) {
1588           if (FreeBufSize < sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize) {
1589             return EFI_BUFFER_TOO_SMALL;
1590           }
1591
1592           //
1593           // Copy EFI_SIGNATURE_LIST header for only once.
1594           //
1595
1596           CopyMem (Tail, NewCertList, sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1597           Tail = Tail + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1598           FreeBufSize -= sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1599         }
1600
1601         if (FreeBufSize < NewCertList->SignatureSize) {
1602           return EFI_BUFFER_TOO_SMALL;
1603         }
1604         CopyMem (Tail, NewCert, NewCertList->SignatureSize);
1605         Tail += NewCertList->SignatureSize;
1606         FreeBufSize -= NewCertList->SignatureSize;
1607         CopiedCount++;
1608       }
1609
1610       NewCert = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCert + NewCertList->SignatureSize);
1611     }
1612
1613     //
1614     // Update SignatureListSize in newly appended EFI_SIGNATURE_LIST.
1615     //
1616     if (CopiedCount != 0) {
1617       SignatureListSize = sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize + (CopiedCount * NewCertList->SignatureSize);
1618       CertList = (EFI_SIGNATURE_LIST *) (Tail - SignatureListSize);
1619       CertList->SignatureListSize = (UINT32) SignatureListSize;
1620     }
1621
1622     NewDataSize -= NewCertList->SignatureListSize;
1623     NewCertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) NewCertList + NewCertList->SignatureListSize);
1624   }
1625
1626   *MergedBufSize = (Tail - (UINT8 *) Data);
1627   return EFI_SUCCESS;
1628 }
1629
1630 /**
1631   Compare two EFI_TIME data.
1632
1633
1634   @param FirstTime           A pointer to the first EFI_TIME data.
1635   @param SecondTime          A pointer to the second EFI_TIME data.
1636
1637   @retval  TRUE              The FirstTime is not later than the SecondTime.
1638   @retval  FALSE             The FirstTime is later than the SecondTime.
1639
1640 **/
1641 BOOLEAN
1642 CompareTimeStamp (
1643   IN EFI_TIME               *FirstTime,
1644   IN EFI_TIME               *SecondTime
1645   )
1646 {
1647   if (FirstTime->Year != SecondTime->Year) {
1648     return (BOOLEAN) (FirstTime->Year < SecondTime->Year);
1649   } else if (FirstTime->Month != SecondTime->Month) {
1650     return (BOOLEAN) (FirstTime->Month < SecondTime->Month);
1651   } else if (FirstTime->Day != SecondTime->Day) {
1652     return (BOOLEAN) (FirstTime->Day < SecondTime->Day);
1653   } else if (FirstTime->Hour != SecondTime->Hour) {
1654     return (BOOLEAN) (FirstTime->Hour < SecondTime->Hour);
1655   } else if (FirstTime->Minute != SecondTime->Minute) {
1656     return (BOOLEAN) (FirstTime->Minute < SecondTime->Minute);
1657   }
1658
1659   return (BOOLEAN) (FirstTime->Second <= SecondTime->Second);
1660 }
1661
1662 /**
1663   Find matching signer's certificates for common authenticated variable
1664   by corresponding VariableName and VendorGuid from "certdb".
1665
1666   The data format of "certdb":
1667   //
1668   //     UINT32 CertDbListSize;
1669   // /// AUTH_CERT_DB_DATA Certs1[];
1670   // /// AUTH_CERT_DB_DATA Certs2[];
1671   // /// ...
1672   // /// AUTH_CERT_DB_DATA Certsn[];
1673   //
1674
1675   @param[in]  VariableName   Name of authenticated Variable.
1676   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1677   @param[in]  Data           Pointer to variable "certdb".
1678   @param[in]  DataSize       Size of variable "certdb".
1679   @param[out] CertOffset     Offset of matching CertData, from starting of Data.
1680   @param[out] CertDataSize   Length of CertData in bytes.
1681   @param[out] CertNodeOffset Offset of matching AUTH_CERT_DB_DATA , from
1682                              starting of Data.
1683   @param[out] CertNodeSize   Length of AUTH_CERT_DB_DATA in bytes.
1684
1685   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1686   @retval  EFI_NOT_FOUND         Fail to find matching certs.
1687   @retval  EFI_SUCCESS           Find matching certs and output parameters.
1688
1689 **/
1690 EFI_STATUS
1691 FindCertsFromDb (
1692   IN     CHAR16           *VariableName,
1693   IN     EFI_GUID         *VendorGuid,
1694   IN     UINT8            *Data,
1695   IN     UINTN            DataSize,
1696   OUT    UINT32           *CertOffset,    OPTIONAL
1697   OUT    UINT32           *CertDataSize,  OPTIONAL
1698   OUT    UINT32           *CertNodeOffset,OPTIONAL
1699   OUT    UINT32           *CertNodeSize   OPTIONAL
1700   )
1701 {
1702   UINT32                  Offset;
1703   AUTH_CERT_DB_DATA       *Ptr;
1704   UINT32                  CertSize;
1705   UINT32                  NameSize;
1706   UINT32                  NodeSize;
1707   UINT32                  CertDbListSize;
1708
1709   if ((VariableName == NULL) || (VendorGuid == NULL) || (Data == NULL)) {
1710     return EFI_INVALID_PARAMETER;
1711   }
1712
1713   //
1714   // Check whether DataSize matches recorded CertDbListSize.
1715   //
1716   if (DataSize < sizeof (UINT32)) {
1717     return EFI_INVALID_PARAMETER;
1718   }
1719
1720   CertDbListSize = ReadUnaligned32 ((UINT32 *) Data);
1721
1722   if (CertDbListSize != (UINT32) DataSize) {
1723     return EFI_INVALID_PARAMETER;
1724   }
1725
1726   Offset = sizeof (UINT32);
1727
1728   //
1729   // Get corresponding certificates by VendorGuid and VariableName.
1730   //
1731   while (Offset < (UINT32) DataSize) {
1732     Ptr = (AUTH_CERT_DB_DATA *) (Data + Offset);
1733     //
1734     // Check whether VendorGuid matches.
1735     //
1736     if (CompareGuid (&Ptr->VendorGuid, VendorGuid)) {
1737       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1738       NameSize = ReadUnaligned32 (&Ptr->NameSize);
1739       CertSize = ReadUnaligned32 (&Ptr->CertDataSize);
1740
1741       if (NodeSize != sizeof (EFI_GUID) + sizeof (UINT32) * 3 + CertSize +
1742           sizeof (CHAR16) * NameSize) {
1743         return EFI_INVALID_PARAMETER;
1744       }
1745
1746       Offset = Offset + sizeof (EFI_GUID) + sizeof (UINT32) * 3;
1747       //
1748       // Check whether VariableName matches.
1749       //
1750       if ((NameSize == StrLen (VariableName)) &&
1751           (CompareMem (Data + Offset, VariableName, NameSize * sizeof (CHAR16)) == 0)) {
1752         Offset = Offset + NameSize * sizeof (CHAR16);
1753
1754         if (CertOffset != NULL) {
1755           *CertOffset = Offset;
1756         }
1757
1758         if (CertDataSize != NULL) {
1759           *CertDataSize = CertSize;
1760         }
1761
1762         if (CertNodeOffset != NULL) {
1763           *CertNodeOffset = (UINT32) ((UINT8 *) Ptr - Data);
1764         }
1765
1766         if (CertNodeSize != NULL) {
1767           *CertNodeSize = NodeSize;
1768         }
1769
1770         return EFI_SUCCESS;
1771       } else {
1772         Offset = Offset + NameSize * sizeof (CHAR16) + CertSize;
1773       }
1774     } else {
1775       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1776       Offset   = Offset + NodeSize;
1777     }
1778   }
1779
1780   return EFI_NOT_FOUND;
1781 }
1782
1783 /**
1784   Retrieve signer's certificates for common authenticated variable
1785   by corresponding VariableName and VendorGuid from "certdb".
1786
1787   @param[in]  VariableName   Name of authenticated Variable.
1788   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1789   @param[out] CertData       Pointer to signer's certificates.
1790   @param[out] CertDataSize   Length of CertData in bytes.
1791
1792   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1793   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1794   @retval  EFI_SUCCESS           Get signer's certificates successfully.
1795
1796 **/
1797 EFI_STATUS
1798 GetCertsFromDb (
1799   IN     CHAR16           *VariableName,
1800   IN     EFI_GUID         *VendorGuid,
1801   OUT    UINT8            **CertData,
1802   OUT    UINT32           *CertDataSize
1803   )
1804 {
1805   VARIABLE_POINTER_TRACK  CertDbVariable;
1806   EFI_STATUS              Status;
1807   UINT8                   *Data;
1808   UINTN                   DataSize;
1809   UINT32                  CertOffset;
1810
1811   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL) || (CertDataSize == NULL)) {
1812     return EFI_INVALID_PARAMETER;
1813   }
1814
1815   //
1816   // Get variable "certdb".
1817   //
1818   Status = FindVariable (
1819              EFI_CERT_DB_NAME,
1820              &gEfiCertDbGuid,
1821              &CertDbVariable,
1822              &mVariableModuleGlobal->VariableGlobal,
1823              FALSE
1824              );
1825   if (EFI_ERROR (Status)) {
1826     return Status;
1827   }
1828
1829   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1830   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1831   if ((DataSize == 0) || (Data == NULL)) {
1832     ASSERT (FALSE);
1833     return EFI_NOT_FOUND;
1834   }
1835
1836   Status = FindCertsFromDb (
1837              VariableName,
1838              VendorGuid,
1839              Data,
1840              DataSize,
1841              &CertOffset,
1842              CertDataSize,
1843              NULL,
1844              NULL
1845              );
1846
1847   if (EFI_ERROR (Status)) {
1848     return Status;
1849   }
1850
1851   *CertData = Data + CertOffset;
1852   return EFI_SUCCESS;
1853 }
1854
1855 /**
1856   Delete matching signer's certificates when deleting common authenticated
1857   variable by corresponding VariableName and VendorGuid from "certdb".
1858
1859   @param[in]  VariableName   Name of authenticated Variable.
1860   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1861
1862   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1863   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1864   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
1865   @retval  EFI_SUCCESS           The operation is completed successfully.
1866
1867 **/
1868 EFI_STATUS
1869 DeleteCertsFromDb (
1870   IN     CHAR16           *VariableName,
1871   IN     EFI_GUID         *VendorGuid
1872   )
1873 {
1874   VARIABLE_POINTER_TRACK  CertDbVariable;
1875   EFI_STATUS              Status;
1876   UINT8                   *Data;
1877   UINTN                   DataSize;
1878   UINT32                  VarAttr;
1879   UINT32                  CertNodeOffset;
1880   UINT32                  CertNodeSize;
1881   UINT8                   *NewCertDb;
1882   UINT32                  NewCertDbSize;
1883
1884   if ((VariableName == NULL) || (VendorGuid == NULL)) {
1885     return EFI_INVALID_PARAMETER;
1886   }
1887
1888   //
1889   // Get variable "certdb".
1890   //
1891   Status = FindVariable (
1892              EFI_CERT_DB_NAME,
1893              &gEfiCertDbGuid,
1894              &CertDbVariable,
1895              &mVariableModuleGlobal->VariableGlobal,
1896              FALSE
1897              );
1898   if (EFI_ERROR (Status)) {
1899     return Status;
1900   }
1901
1902   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1903   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1904   if ((DataSize == 0) || (Data == NULL)) {
1905     ASSERT (FALSE);
1906     return EFI_NOT_FOUND;
1907   }
1908
1909   if (DataSize == sizeof (UINT32)) {
1910     //
1911     // There is no certs in certdb.
1912     //
1913     return EFI_SUCCESS;
1914   }
1915
1916   //
1917   // Get corresponding cert node from certdb.
1918   //
1919   Status = FindCertsFromDb (
1920              VariableName,
1921              VendorGuid,
1922              Data,
1923              DataSize,
1924              NULL,
1925              NULL,
1926              &CertNodeOffset,
1927              &CertNodeSize
1928              );
1929
1930   if (EFI_ERROR (Status)) {
1931     return Status;
1932   }
1933
1934   if (DataSize < (CertNodeOffset + CertNodeSize)) {
1935     return EFI_NOT_FOUND;
1936   }
1937
1938   //
1939   // Construct new data content of variable "certdb".
1940   //
1941   NewCertDbSize = (UINT32) DataSize - CertNodeSize;
1942   NewCertDb     = (UINT8*) mCertDbStore;
1943
1944   //
1945   // Copy the DB entries before deleting node.
1946   //
1947   CopyMem (NewCertDb, Data, CertNodeOffset);
1948   //
1949   // Update CertDbListSize.
1950   //
1951   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
1952   //
1953   // Copy the DB entries after deleting node.
1954   //
1955   if (DataSize > (CertNodeOffset + CertNodeSize)) {
1956     CopyMem (
1957       NewCertDb + CertNodeOffset,
1958       Data + CertNodeOffset + CertNodeSize,
1959       DataSize - CertNodeOffset - CertNodeSize
1960       );
1961   }
1962
1963   //
1964   // Set "certdb".
1965   //
1966   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
1967   Status   = UpdateVariable (
1968                EFI_CERT_DB_NAME,
1969                &gEfiCertDbGuid,
1970                NewCertDb,
1971                NewCertDbSize,
1972                VarAttr,
1973                0,
1974                0,
1975                &CertDbVariable,
1976                NULL
1977                );
1978
1979   return Status;
1980 }
1981
1982 /**
1983   Insert signer's certificates for common authenticated variable with VariableName
1984   and VendorGuid in AUTH_CERT_DB_DATA to "certdb".
1985
1986   @param[in]  VariableName   Name of authenticated Variable.
1987   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1988   @param[in]  CertData       Pointer to signer's certificates.
1989   @param[in]  CertDataSize   Length of CertData in bytes.
1990
1991   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1992   @retval  EFI_ACCESS_DENIED     An AUTH_CERT_DB_DATA entry with same VariableName
1993                                  and VendorGuid already exists.
1994   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
1995   @retval  EFI_SUCCESS           Insert an AUTH_CERT_DB_DATA entry to "certdb"
1996
1997 **/
1998 EFI_STATUS
1999 InsertCertsToDb (
2000   IN     CHAR16           *VariableName,
2001   IN     EFI_GUID         *VendorGuid,
2002   IN     UINT8            *CertData,
2003   IN     UINTN            CertDataSize
2004   )
2005 {
2006   VARIABLE_POINTER_TRACK  CertDbVariable;
2007   EFI_STATUS              Status;
2008   UINT8                   *Data;
2009   UINTN                   DataSize;
2010   UINT32                  VarAttr;
2011   UINT8                   *NewCertDb;
2012   UINT32                  NewCertDbSize;
2013   UINT32                  CertNodeSize;
2014   UINT32                  NameSize;
2015   AUTH_CERT_DB_DATA       *Ptr;
2016
2017   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL)) {
2018     return EFI_INVALID_PARAMETER;
2019   }
2020
2021   //
2022   // Get variable "certdb".
2023   //
2024   Status = FindVariable (
2025              EFI_CERT_DB_NAME,
2026              &gEfiCertDbGuid,
2027              &CertDbVariable,
2028              &mVariableModuleGlobal->VariableGlobal,
2029              FALSE
2030              );
2031   if (EFI_ERROR (Status)) {
2032     return Status;
2033   }
2034
2035   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
2036   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
2037   if ((DataSize == 0) || (Data == NULL)) {
2038     ASSERT (FALSE);
2039     return EFI_NOT_FOUND;
2040   }
2041
2042   //
2043   // Find whether matching cert node already exists in "certdb".
2044   // If yes return error.
2045   //
2046   Status = FindCertsFromDb (
2047              VariableName,
2048              VendorGuid,
2049              Data,
2050              DataSize,
2051              NULL,
2052              NULL,
2053              NULL,
2054              NULL
2055              );
2056
2057   if (!EFI_ERROR (Status)) {
2058     ASSERT (FALSE);
2059     return EFI_ACCESS_DENIED;
2060   }
2061
2062   //
2063   // Construct new data content of variable "certdb".
2064   //
2065   NameSize      = (UINT32) StrLen (VariableName);
2066   CertNodeSize  = sizeof (AUTH_CERT_DB_DATA) + (UINT32) CertDataSize + NameSize * sizeof (CHAR16);
2067   NewCertDbSize = (UINT32) DataSize + CertNodeSize;
2068   if (NewCertDbSize > mMaxCertDbSize) {
2069     return EFI_OUT_OF_RESOURCES;
2070   }
2071   NewCertDb     = (UINT8*) mCertDbStore;
2072
2073   //
2074   // Copy the DB entries before deleting node.
2075   //
2076   CopyMem (NewCertDb, Data, DataSize);
2077   //
2078   // Update CertDbListSize.
2079   //
2080   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
2081   //
2082   // Construct new cert node.
2083   //
2084   Ptr = (AUTH_CERT_DB_DATA *) (NewCertDb + DataSize);
2085   CopyGuid (&Ptr->VendorGuid, VendorGuid);
2086   CopyMem (&Ptr->CertNodeSize, &CertNodeSize, sizeof (UINT32));
2087   CopyMem (&Ptr->NameSize, &NameSize, sizeof (UINT32));
2088   CopyMem (&Ptr->CertDataSize, &CertDataSize, sizeof (UINT32));
2089
2090   CopyMem (
2091     (UINT8 *) Ptr + sizeof (AUTH_CERT_DB_DATA),
2092     VariableName,
2093     NameSize * sizeof (CHAR16)
2094     );
2095
2096   CopyMem (
2097     (UINT8 *) Ptr +  sizeof (AUTH_CERT_DB_DATA) + NameSize * sizeof (CHAR16),
2098     CertData,
2099     CertDataSize
2100     );
2101
2102   //
2103   // Set "certdb".
2104   //
2105   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
2106   Status   = UpdateVariable (
2107                EFI_CERT_DB_NAME,
2108                &gEfiCertDbGuid,
2109                NewCertDb,
2110                NewCertDbSize,
2111                VarAttr,
2112                0,
2113                0,
2114                &CertDbVariable,
2115                NULL
2116                );
2117
2118   return Status;
2119 }
2120
2121 /**
2122   Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
2123
2124   Caution: This function may receive untrusted input.
2125   This function may be invoked in SMM mode, and datasize and data are external input.
2126   This function will do basic validation, before parse the data.
2127   This function will parse the authentication carefully to avoid security issues, like
2128   buffer overflow, integer overflow.
2129
2130   @param[in]  VariableName                Name of Variable to be found.
2131   @param[in]  VendorGuid                  Variable vendor GUID.
2132   @param[in]  Data                        Data pointer.
2133   @param[in]  DataSize                    Size of Data found. If size is less than the
2134                                           data, this value contains the required size.
2135   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
2136   @param[in]  Attributes                  Attribute value of the variable.
2137   @param[in]  AuthVarType                 Verify against PK, KEK database, private database or certificate in data payload.
2138   @param[out] VarDel                      Delete the variable or not.
2139
2140   @retval EFI_INVALID_PARAMETER           Invalid parameter.
2141   @retval EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
2142                                           check carried out by the firmware.
2143   @retval EFI_OUT_OF_RESOURCES            Failed to process variable due to lack
2144                                           of resources.
2145   @retval EFI_SUCCESS                     Variable pass validation successfully.
2146
2147 **/
2148 EFI_STATUS
2149 VerifyTimeBasedPayload (
2150   IN     CHAR16                             *VariableName,
2151   IN     EFI_GUID                           *VendorGuid,
2152   IN     VOID                               *Data,
2153   IN     UINTN                              DataSize,
2154   IN     VARIABLE_POINTER_TRACK             *Variable,
2155   IN     UINT32                             Attributes,
2156   IN     AUTHVAR_TYPE                       AuthVarType,
2157   OUT    BOOLEAN                            *VarDel
2158   )
2159 {
2160   UINT8                            *RootCert;
2161   UINT8                            *SigData;
2162   UINT8                            *PayloadPtr;
2163   UINTN                            RootCertSize;
2164   UINTN                            Index;
2165   UINTN                            CertCount;
2166   UINTN                            PayloadSize;
2167   UINT32                           Attr;
2168   UINT32                           SigDataSize;
2169   UINT32                           KekDataSize;
2170   BOOLEAN                          VerifyStatus;
2171   EFI_STATUS                       Status;
2172   EFI_SIGNATURE_LIST               *CertList;
2173   EFI_SIGNATURE_DATA               *Cert;
2174   VARIABLE_POINTER_TRACK           KekVariable;
2175   EFI_VARIABLE_AUTHENTICATION_2    *CertData;
2176   UINT8                            *NewData;
2177   UINTN                            NewDataSize;
2178   VARIABLE_POINTER_TRACK           PkVariable;
2179   UINT8                            *Buffer;
2180   UINTN                            Length;
2181   UINT8                            *SignerCerts;
2182   UINT8                            *WrapSigData;
2183   UINTN                            CertStackSize;
2184   UINT8                            *CertsInCertDb;
2185   UINT32                           CertsSizeinDb;
2186
2187   VerifyStatus           = FALSE;
2188   CertData               = NULL;
2189   NewData                = NULL;
2190   Attr                   = Attributes;
2191   WrapSigData            = NULL;
2192   SignerCerts            = NULL;
2193   RootCert               = NULL;
2194   CertsInCertDb          = NULL;
2195
2196   //
2197   // When the attribute EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS is
2198   // set, then the Data buffer shall begin with an instance of a complete (and serialized)
2199   // EFI_VARIABLE_AUTHENTICATION_2 descriptor. The descriptor shall be followed by the new
2200   // variable value and DataSize shall reflect the combined size of the descriptor and the new
2201   // variable value. The authentication descriptor is not part of the variable data and is not
2202   // returned by subsequent calls to GetVariable().
2203   //
2204   CertData = (EFI_VARIABLE_AUTHENTICATION_2 *) Data;
2205
2206   //
2207   // Verify that Pad1, Nanosecond, TimeZone, Daylight and Pad2 components of the
2208   // TimeStamp value are set to zero.
2209   //
2210   if ((CertData->TimeStamp.Pad1 != 0) ||
2211       (CertData->TimeStamp.Nanosecond != 0) ||
2212       (CertData->TimeStamp.TimeZone != 0) ||
2213       (CertData->TimeStamp.Daylight != 0) ||
2214       (CertData->TimeStamp.Pad2 != 0)) {
2215     return EFI_SECURITY_VIOLATION;
2216   }
2217
2218   if ((Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
2219     if (CompareTimeStamp (&CertData->TimeStamp, &Variable->CurrPtr->TimeStamp)) {
2220       //
2221       // TimeStamp check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
2222       //
2223       return EFI_SECURITY_VIOLATION;
2224     }
2225   }
2226
2227   //
2228   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
2229   // Cert type should be EFI_CERT_TYPE_PKCS7_GUID.
2230   //
2231   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
2232       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertPkcs7Guid)) {
2233     //
2234     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
2235     //
2236     return EFI_SECURITY_VIOLATION;
2237   }
2238
2239   //
2240   // Find out Pkcs7 SignedData which follows the EFI_VARIABLE_AUTHENTICATION_2 descriptor.
2241   // AuthInfo.Hdr.dwLength is the length of the entire certificate, including the length of the header.
2242   //
2243   SigData = CertData->AuthInfo.CertData;
2244   SigDataSize = CertData->AuthInfo.Hdr.dwLength - (UINT32) (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData));
2245
2246   //
2247   // Find out the new data payload which follows Pkcs7 SignedData directly.
2248   //
2249   PayloadPtr = SigData + SigDataSize;
2250   PayloadSize = DataSize - OFFSET_OF_AUTHINFO2_CERT_DATA - (UINTN) SigDataSize;
2251
2252   //
2253   // Construct a serialization buffer of the values of the VariableName, VendorGuid and Attributes
2254   // parameters of the SetVariable() call and the TimeStamp component of the
2255   // EFI_VARIABLE_AUTHENTICATION_2 descriptor followed by the variable's new value
2256   // i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data)
2257   //
2258   NewDataSize = PayloadSize + sizeof (EFI_TIME) + sizeof (UINT32) +
2259                 sizeof (EFI_GUID) + StrSize (VariableName) - sizeof (CHAR16);
2260   //
2261   // Here is to reuse scratch data area(at the end of volatile variable store)
2262   // to reduce SMRAM consumption for SMM variable driver.
2263   // The scratch buffer is enough to hold the serialized data and safe to use,
2264   // because it will be used at here to do verification only first
2265   // and then used in UpdateVariable() for a time based auth variable set.
2266   //
2267   NewData = (UINT8 *) GetEndPointer ((VARIABLE_STORE_HEADER *) ((UINTN) mVariableModuleGlobal->VariableGlobal.VolatileVariableBase));
2268
2269   Buffer = NewData;
2270   Length = StrLen (VariableName) * sizeof (CHAR16);
2271   CopyMem (Buffer, VariableName, Length);
2272   Buffer += Length;
2273
2274   Length = sizeof (EFI_GUID);
2275   CopyMem (Buffer, VendorGuid, Length);
2276   Buffer += Length;
2277
2278   Length = sizeof (UINT32);
2279   CopyMem (Buffer, &Attr, Length);
2280   Buffer += Length;
2281
2282   Length = sizeof (EFI_TIME);
2283   CopyMem (Buffer, &CertData->TimeStamp, Length);
2284   Buffer += Length;
2285
2286   CopyMem (Buffer, PayloadPtr, PayloadSize);
2287
2288   if (AuthVarType == AuthVarTypePk) {
2289     //
2290     // Verify that the signature has been made with the current Platform Key (no chaining for PK).
2291     // First, get signer's certificates from SignedData.
2292     //
2293     VerifyStatus = Pkcs7GetSigners (
2294                      SigData,
2295                      SigDataSize,
2296                      &SignerCerts,
2297                      &CertStackSize,
2298                      &RootCert,
2299                      &RootCertSize
2300                      );
2301     if (!VerifyStatus) {
2302       goto Exit;
2303     }
2304
2305     //
2306     // Second, get the current platform key from variable. Check whether it's identical with signer's certificates
2307     // in SignedData. If not, return error immediately.
2308     //
2309     Status = FindVariable (
2310                EFI_PLATFORM_KEY_NAME,
2311                &gEfiGlobalVariableGuid,
2312                &PkVariable,
2313                &mVariableModuleGlobal->VariableGlobal,
2314                FALSE
2315                );
2316     if (EFI_ERROR (Status)) {
2317       VerifyStatus = FALSE;
2318       goto Exit;
2319     }
2320     CertList = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (PkVariable.CurrPtr);
2321     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2322     if ((RootCertSize != (CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1))) ||
2323         (CompareMem (Cert->SignatureData, RootCert, RootCertSize) != 0)) {
2324       VerifyStatus = FALSE;
2325       goto Exit;
2326     }
2327
2328     //
2329     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2330     //
2331     VerifyStatus = Pkcs7Verify (
2332                      SigData,
2333                      SigDataSize,
2334                      RootCert,
2335                      RootCertSize,
2336                      NewData,
2337                      NewDataSize
2338                      );
2339
2340   } else if (AuthVarType == AuthVarTypeKek) {
2341
2342     //
2343     // Get KEK database from variable.
2344     //
2345     Status = FindVariable (
2346                EFI_KEY_EXCHANGE_KEY_NAME,
2347                &gEfiGlobalVariableGuid,
2348                &KekVariable,
2349                &mVariableModuleGlobal->VariableGlobal,
2350                FALSE
2351                );
2352     if (EFI_ERROR (Status)) {
2353       return Status;
2354     }
2355
2356     //
2357     // Ready to verify Pkcs7 SignedData. Go through KEK Signature Database to find out X.509 CertList.
2358     //
2359     KekDataSize      = KekVariable.CurrPtr->DataSize;
2360     CertList         = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (KekVariable.CurrPtr);
2361     while ((KekDataSize > 0) && (KekDataSize >= CertList->SignatureListSize)) {
2362       if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {
2363         Cert       = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2364         CertCount  = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
2365         for (Index = 0; Index < CertCount; Index++) {
2366           //
2367           // Iterate each Signature Data Node within this CertList for a verify
2368           //
2369           RootCert      = Cert->SignatureData;
2370           RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2371
2372           //
2373           // Verify Pkcs7 SignedData via Pkcs7Verify library.
2374           //
2375           VerifyStatus = Pkcs7Verify (
2376                            SigData,
2377                            SigDataSize,
2378                            RootCert,
2379                            RootCertSize,
2380                            NewData,
2381                            NewDataSize
2382                            );
2383           if (VerifyStatus) {
2384             goto Exit;
2385           }
2386           Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
2387         }
2388       }
2389       KekDataSize -= CertList->SignatureListSize;
2390       CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
2391     }
2392   } else if (AuthVarType == AuthVarTypePriv) {
2393
2394     //
2395     // Process common authenticated variable except PK/KEK/DB/DBX/DBT.
2396     // Get signer's certificates from SignedData.
2397     //
2398     VerifyStatus = Pkcs7GetSigners (
2399                      SigData,
2400                      SigDataSize,
2401                      &SignerCerts,
2402                      &CertStackSize,
2403                      &RootCert,
2404                      &RootCertSize
2405                      );
2406     if (!VerifyStatus) {
2407       goto Exit;
2408     }
2409
2410     //
2411     // Get previously stored signer's certificates from certdb for existing
2412     // variable. Check whether they are identical with signer's certificates
2413     // in SignedData. If not, return error immediately.
2414     //
2415     if ((Variable->CurrPtr != NULL)) {
2416       VerifyStatus = FALSE;
2417
2418       Status = GetCertsFromDb (VariableName, VendorGuid, &CertsInCertDb, &CertsSizeinDb);
2419       if (EFI_ERROR (Status)) {
2420         goto Exit;
2421       }
2422
2423       if ((CertStackSize != CertsSizeinDb) ||
2424           (CompareMem (SignerCerts, CertsInCertDb, CertsSizeinDb) != 0)) {
2425         goto Exit;
2426       }
2427     }
2428
2429     VerifyStatus = Pkcs7Verify (
2430                      SigData,
2431                      SigDataSize,
2432                      RootCert,
2433                      RootCertSize,
2434                      NewData,
2435                      NewDataSize
2436                      );
2437     if (!VerifyStatus) {
2438       goto Exit;
2439     }
2440
2441     //
2442     // Delete signer's certificates when delete the common authenticated variable.
2443     //
2444     if ((PayloadSize == 0) && (Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
2445       Status = DeleteCertsFromDb (VariableName, VendorGuid);
2446       if (EFI_ERROR (Status)) {
2447         VerifyStatus = FALSE;
2448         goto Exit;
2449       }
2450     } else if (Variable->CurrPtr == NULL && PayloadSize != 0) {
2451       //
2452       // Insert signer's certificates when adding a new common authenticated variable.
2453       //
2454       Status = InsertCertsToDb (VariableName, VendorGuid, SignerCerts, CertStackSize);
2455       if (EFI_ERROR (Status)) {
2456         VerifyStatus = FALSE;
2457         goto Exit;
2458       }
2459     }
2460   } else if (AuthVarType == AuthVarTypePayload) {
2461     CertList = (EFI_SIGNATURE_LIST *) PayloadPtr;
2462     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2463     RootCert      = Cert->SignatureData;
2464     RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2465
2466     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2467     //
2468     VerifyStatus = Pkcs7Verify (
2469                      SigData,
2470                      SigDataSize,
2471                      RootCert,
2472                      RootCertSize,
2473                      NewData,
2474                      NewDataSize
2475                      );
2476   } else {
2477     return EFI_SECURITY_VIOLATION;
2478   }
2479
2480 Exit:
2481
2482   if (AuthVarType == AuthVarTypePk || AuthVarType == AuthVarTypePriv) {
2483     Pkcs7FreeSigners (RootCert);
2484     Pkcs7FreeSigners (SignerCerts);
2485   }
2486
2487   if (!VerifyStatus) {
2488     return EFI_SECURITY_VIOLATION;
2489   }
2490
2491   Status = CheckSignatureListFormat(VariableName, VendorGuid, PayloadPtr, PayloadSize);
2492   if (EFI_ERROR (Status)) {
2493     return Status;
2494   }
2495
2496   if ((PayloadSize == 0) && (VarDel != NULL)) {
2497     *VarDel = TRUE;
2498   }
2499
2500   //
2501   // Final step: Update/Append Variable if it pass Pkcs7Verify
2502   //
2503   return UpdateVariable (
2504            VariableName,
2505            VendorGuid,
2506            PayloadPtr,
2507            PayloadSize,
2508            Attributes,
2509            0,
2510            0,
2511            Variable,
2512            &CertData->TimeStamp
2513            );
2514 }