SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c

   1 /** @file
   2   Implement authentication services for the authenticated variable
   3   service in UEFI2.2.
   4
   5   Caution: This module requires additional review when modified.
   6   This driver will have external input - variable data. It may be input in SMM mode.
   7   This external input must be validated carefully to avoid security issue like
   8   buffer overflow, integer overflow.
   9   Variable attribute should also be checked to avoid authentication bypass.
  10
  11   ProcessVarWithPk(), ProcessVarWithKek() and ProcessVariable() are the function to do
  12   variable authentication.
  13
  14   VerifyTimeBasedPayload() and VerifyCounterBasedPayload() are sub function to do verification.
  15   They will do basic validation for authentication data structure, then call crypto library
  16   to verify the signature.
  17
  18 Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
  19 This program and the accompanying materials
  20 are licensed and made available under the terms and conditions of the BSD License
  21 which accompanies this distribution.  The full text of the license may be found at
  22 http://opensource.org/licenses/bsd-license.php
  23
  24 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  25 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  26
  27 **/
  28
  29 #include "Variable.h"
  30 #include "AuthService.h"
  31
  32 ///
  33 /// Global database array for scratch
  34 ///
  35 UINT8    mPubKeyStore[MAX_KEYDB_SIZE];
  36 UINT32   mPubKeyNumber;
  37 UINT8    mCertDbStore[MAX_CERTDB_SIZE];
  38 UINT32   mPlatformMode;
  39 UINT8    mVendorKeyState;
  40
  41 EFI_GUID mSignatureSupport[] = {EFI_CERT_SHA1_GUID, EFI_CERT_SHA256_GUID, EFI_CERT_RSA2048_GUID, EFI_CERT_X509_GUID};
  42 //
  43 // Public Exponent of RSA Key.
  44 //
  45 CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };
  46 //
  47 // Hash context pointer
  48 //
  49 VOID  *mHashCtx = NULL;
  50
  51 //
  52 // The serialization of the values of the VariableName, VendorGuid and Attributes
  53 // parameters of the SetVariable() call and the TimeStamp component of the
  54 // EFI_VARIABLE_AUTHENTICATION_2 descriptor followed by the variable's new value
  55 // i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data)
  56 //
  57 UINT8 *mSerializationRuntimeBuffer = NULL;
  58
  59 //
  60 // Requirement for different signature type which have been defined in UEFI spec.
  61 // These data are used to peform SignatureList format check while setting PK/KEK variable.
  62 //
  63 EFI_SIGNATURE_ITEM mSupportSigItem[] = {
  64 //{SigType,                       SigHeaderSize,   SigDataSize  }
  65   {EFI_CERT_SHA256_GUID,          0,               32           },
  66   {EFI_CERT_RSA2048_GUID,         0,               256          },
  67   {EFI_CERT_RSA2048_SHA256_GUID,  0,               256          },
  68   {EFI_CERT_SHA1_GUID,            0,               20           },
  69   {EFI_CERT_RSA2048_SHA1_GUID,    0,               256          },
  70   {EFI_CERT_X509_GUID,            0,               ((UINT32) ~0)},
  71   {EFI_CERT_SHA224_GUID,          0,               28           },
  72   {EFI_CERT_SHA384_GUID,          0,               48           },
  73   {EFI_CERT_SHA512_GUID,          0,               64           }
  74 };
  75
  76 /**
  77   Determine whether this operation needs a physical present user.
  78
  79   @param[in]      VariableName            Name of the Variable.
  80   @param[in]      VendorGuid              GUID of the Variable.
  81
  82   @retval TRUE      This variable is protected, only a physical present user could set this variable.
  83   @retval FALSE     This variable is not protected.
  84
  85 **/
  86 BOOLEAN
  87 NeedPhysicallyPresent(
  88   IN     CHAR16         *VariableName,
  89   IN     EFI_GUID       *VendorGuid
  90   )
  91 {
  92   if ((CompareGuid (VendorGuid, &gEfiSecureBootEnableDisableGuid) && (StrCmp (VariableName, EFI_SECURE_BOOT_ENABLE_NAME) == 0))
  93     || (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (VariableName, EFI_CUSTOM_MODE_NAME) == 0))) {
  94     return TRUE;
  95   }
  96
  97   return FALSE;
  98 }
  99
 100 /**
 101   Determine whether the platform is operating in Custom Secure Boot mode.
 102
 103   @retval TRUE           The platform is operating in Custom mode.
 104   @retval FALSE          The platform is operating in Standard mode.
 105
 106 **/
 107 BOOLEAN
 108 InCustomMode (
 109   VOID
 110   )
 111 {
 112   VARIABLE_POINTER_TRACK  Variable;
 113
 114   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 115   if (Variable.CurrPtr != NULL && *(GetVariableDataPtr (Variable.CurrPtr)) == CUSTOM_SECURE_BOOT_MODE) {
 116     return TRUE;
 117   }
 118
 119   return FALSE;
 120 }
 121
 122
 123 /**
 124   Internal function to delete a Variable given its name and GUID, no authentication
 125   required.
 126
 127   @param[in]      VariableName            Name of the Variable.
 128   @param[in]      VendorGuid              GUID of the Variable.
 129
 130   @retval EFI_SUCCESS              Variable deleted successfully.
 131   @retval Others                   The driver failded to start the device.
 132
 133 **/
 134 EFI_STATUS
 135 DeleteVariable (
 136   IN  CHAR16                    *VariableName,
 137   IN  EFI_GUID                  *VendorGuid
 138   )
 139 {
 140   EFI_STATUS              Status;
 141   VARIABLE_POINTER_TRACK  Variable;
 142
 143   Status = FindVariable (VariableName, VendorGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 144   if (EFI_ERROR (Status)) {
 145     return EFI_SUCCESS;
 146   }
 147
 148   ASSERT (Variable.CurrPtr != NULL);
 149   return UpdateVariable (VariableName, VendorGuid, NULL, 0, 0, 0, 0, &Variable, NULL);
 150 }
 151
 152 /**
 153   Initializes for authenticated varibale service.
 154
 155   @retval EFI_SUCCESS           Function successfully executed.
 156   @retval EFI_OUT_OF_RESOURCES  Fail to allocate enough memory resources.
 157
 158 **/
 159 EFI_STATUS
 160 AutenticatedVariableServiceInitialize (
 161   VOID
 162   )
 163 {
 164   EFI_STATUS              Status;
 165   VARIABLE_POINTER_TRACK  Variable;
 166   VARIABLE_POINTER_TRACK  PkVariable;
 167   UINT8                   VarValue;
 168   UINT32                  VarAttr;
 169   UINT8                   *Data;
 170   UINTN                   DataSize;
 171   UINTN                   CtxSize;
 172   UINT8                   SecureBootMode;
 173   UINT8                   SecureBootEnable;
 174   UINT8                   CustomMode;
 175   UINT32                  ListSize;
 176
 177   //
 178   // Initialize hash context.
 179   //
 180   CtxSize   = Sha256GetContextSize ();
 181   mHashCtx  = AllocateRuntimePool (CtxSize);
 182   if (mHashCtx == NULL) {
 183     return EFI_OUT_OF_RESOURCES;
 184   }
 185
 186   //
 187   // Prepare runtime buffer for serialized data of time-based authenticated
 188   // Variable, i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data).
 189   //
 190   mSerializationRuntimeBuffer = AllocateRuntimePool (PcdGet32 (PcdMaxVariableSize) + sizeof (EFI_GUID) + sizeof (UINT32) + sizeof (EFI_TIME));
 191   if (mSerializationRuntimeBuffer == NULL) {
 192     return EFI_OUT_OF_RESOURCES;
 193   }
 194
 195   //
 196   // Check "AuthVarKeyDatabase" variable's existence.
 197   // If it doesn't exist, create a new one with initial value of 0 and EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
 198   //
 199   Status = FindVariable (
 200              AUTHVAR_KEYDB_NAME,
 201              &gEfiAuthenticatedVariableGuid,
 202              &Variable,
 203              &mVariableModuleGlobal->VariableGlobal,
 204              FALSE
 205              );
 206
 207   if (Variable.CurrPtr == NULL) {
 208     VarAttr       = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 209     VarValue      = 0;
 210     mPubKeyNumber = 0;
 211     Status        = UpdateVariable (
 212                       AUTHVAR_KEYDB_NAME,
 213                       &gEfiAuthenticatedVariableGuid,
 214                       &VarValue,
 215                       sizeof(UINT8),
 216                       VarAttr,
 217                       0,
 218                       0,
 219                       &Variable,
 220                       NULL
 221                       );
 222     if (EFI_ERROR (Status)) {
 223       return Status;
 224     }
 225   } else {
 226     //
 227     // Load database in global variable for cache.
 228     //
 229     DataSize  = DataSizeOfVariable (Variable.CurrPtr);
 230     Data      = GetVariableDataPtr (Variable.CurrPtr);
 231     ASSERT ((DataSize != 0) && (Data != NULL));
 232     CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
 233     mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
 234   }
 235
 236   FindVariable (EFI_PLATFORM_KEY_NAME, &gEfiGlobalVariableGuid, &PkVariable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 237   if (PkVariable.CurrPtr == NULL) {
 238     DEBUG ((EFI_D_INFO, "Variable %s does not exist.\n", EFI_PLATFORM_KEY_NAME));
 239   } else {
 240     DEBUG ((EFI_D_INFO, "Variable %s exists.\n", EFI_PLATFORM_KEY_NAME));
 241   }
 242
 243   //
 244   // Create "SetupMode" variable with BS+RT attribute set.
 245   //
 246   FindVariable (EFI_SETUP_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 247   if (PkVariable.CurrPtr == NULL) {
 248     mPlatformMode = SETUP_MODE;
 249   } else {
 250     mPlatformMode = USER_MODE;
 251   }
 252   Status = UpdateVariable (
 253              EFI_SETUP_MODE_NAME,
 254              &gEfiGlobalVariableGuid,
 255              &mPlatformMode,
 256              sizeof(UINT8),
 257              EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 258              0,
 259              0,
 260              &Variable,
 261              NULL
 262              );
 263   if (EFI_ERROR (Status)) {
 264     return Status;
 265   }
 266
 267   //
 268   // Create "SignatureSupport" variable with BS+RT attribute set.
 269   //
 270   FindVariable (EFI_SIGNATURE_SUPPORT_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 271   Status  = UpdateVariable (
 272               EFI_SIGNATURE_SUPPORT_NAME,
 273               &gEfiGlobalVariableGuid,
 274               mSignatureSupport,
 275               sizeof(mSignatureSupport),
 276               EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 277               0,
 278               0,
 279               &Variable,
 280               NULL
 281               );
 282   if (EFI_ERROR (Status)) {
 283     return Status;
 284   }
 285
 286   //
 287   // If "SecureBootEnable" variable exists, then update "SecureBoot" variable.
 288   // If "SecureBootEnable" variable is SECURE_BOOT_ENABLE and in USER_MODE, Set "SecureBoot" variable to SECURE_BOOT_MODE_ENABLE.
 289   // If "SecureBootEnable" variable is SECURE_BOOT_DISABLE, Set "SecureBoot" variable to SECURE_BOOT_MODE_DISABLE.
 290   //
 291   SecureBootEnable = SECURE_BOOT_DISABLE;
 292   FindVariable (EFI_SECURE_BOOT_ENABLE_NAME, &gEfiSecureBootEnableDisableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 293   if (Variable.CurrPtr != NULL) {
 294     SecureBootEnable = *(GetVariableDataPtr (Variable.CurrPtr));
 295   } else if (mPlatformMode == USER_MODE) {
 296     //
 297     // "SecureBootEnable" not exist, initialize it in USER_MODE.
 298     //
 299     SecureBootEnable = SECURE_BOOT_ENABLE;
 300     Status = UpdateVariable (
 301                EFI_SECURE_BOOT_ENABLE_NAME,
 302                &gEfiSecureBootEnableDisableGuid,
 303                &SecureBootEnable,
 304                sizeof (UINT8),
 305                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 306                0,
 307                0,
 308                &Variable,
 309                NULL
 310                );
 311     if (EFI_ERROR (Status)) {
 312       return Status;
 313     }
 314   }
 315
 316   //
 317   // Create "SecureBoot" variable with BS+RT attribute set.
 318   //
 319   if (SecureBootEnable == SECURE_BOOT_ENABLE && mPlatformMode == USER_MODE) {
 320     SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 321   } else {
 322     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 323   }
 324   FindVariable (EFI_SECURE_BOOT_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 325   Status = UpdateVariable (
 326              EFI_SECURE_BOOT_MODE_NAME,
 327              &gEfiGlobalVariableGuid,
 328              &SecureBootMode,
 329              sizeof (UINT8),
 330              EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 331              0,
 332              0,
 333              &Variable,
 334              NULL
 335              );
 336   if (EFI_ERROR (Status)) {
 337     return Status;
 338   }
 339
 340   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SETUP_MODE_NAME, mPlatformMode));
 341   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_MODE_NAME, SecureBootMode));
 342   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_ENABLE_NAME, SecureBootEnable));
 343
 344   //
 345   // Initialize "CustomMode" in STANDARD_SECURE_BOOT_MODE state.
 346   //
 347   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 348   CustomMode = STANDARD_SECURE_BOOT_MODE;
 349   Status = UpdateVariable (
 350              EFI_CUSTOM_MODE_NAME,
 351              &gEfiCustomModeEnableGuid,
 352              &CustomMode,
 353              sizeof (UINT8),
 354              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 355              0,
 356              0,
 357              &Variable,
 358              NULL
 359              );
 360   if (EFI_ERROR (Status)) {
 361     return Status;
 362   }
 363
 364   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_CUSTOM_MODE_NAME, CustomMode));
 365
 366   //
 367   // Check "certdb" variable's existence.
 368   // If it doesn't exist, then create a new one with
 369   // EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.
 370   //
 371   Status = FindVariable (
 372              EFI_CERT_DB_NAME,
 373              &gEfiCertDbGuid,
 374              &Variable,
 375              &mVariableModuleGlobal->VariableGlobal,
 376              FALSE
 377              );
 378
 379   if (Variable.CurrPtr == NULL) {
 380     VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
 381     ListSize = sizeof (UINT32);
 382     Status   = UpdateVariable (
 383                  EFI_CERT_DB_NAME,
 384                  &gEfiCertDbGuid,
 385                  &ListSize,
 386                  sizeof (UINT32),
 387                  VarAttr,
 388                  0,
 389                  0,
 390                  &Variable,
 391                  NULL
 392                  );
 393     if (EFI_ERROR (Status)) {
 394       return Status;
 395     }
 396   }
 397
 398   //
 399   // Check "VendorKeysNv" variable's existence and create "VendorKeys" variable accordingly.
 400   //
 401   FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 402   if (Variable.CurrPtr != NULL) {
 403     mVendorKeyState = *(GetVariableDataPtr (Variable.CurrPtr));
 404   } else {
 405     //
 406     // "VendorKeysNv" not exist, initialize it in VENDOR_KEYS_VALID state.
 407     //
 408     mVendorKeyState = VENDOR_KEYS_VALID;
 409     Status = UpdateVariable (
 410                EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
 411                &gEfiVendorKeysNvGuid,
 412                &mVendorKeyState,
 413                sizeof (UINT8),
 414                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS,
 415                0,
 416                0,
 417                &Variable,
 418                NULL
 419                );
 420     if (EFI_ERROR (Status)) {
 421       return Status;
 422     }
 423   }
 424
 425   //
 426   // Create "VendorKeys" variable with BS+RT attribute set.
 427   //
 428   FindVariable (EFI_VENDOR_KEYS_VARIABLE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 429   Status = UpdateVariable (
 430              EFI_VENDOR_KEYS_VARIABLE_NAME,
 431              &gEfiGlobalVariableGuid,
 432              &mVendorKeyState,
 433              sizeof (UINT8),
 434              EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 435              0,
 436              0,
 437              &Variable,
 438              NULL
 439              );
 440   if (EFI_ERROR (Status)) {
 441     return Status;
 442   }
 443
 444   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_VENDOR_KEYS_VARIABLE_NAME, mVendorKeyState));
 445
 446   return Status;
 447 }
 448
 449 /**
 450   Add public key in store and return its index.
 451
 452   @param[in]  PubKey                  Input pointer to Public Key data
 453
 454   @return                             Index of new added item
 455
 456 **/
 457 UINT32
 458 AddPubKeyInStore (
 459   IN  UINT8                        *PubKey,
 460   IN  VARIABLE_ENTRY_CONSISTENCY   *VariableDataEntry
 461   )
 462 {
 463   EFI_STATUS                       Status;
 464   BOOLEAN                          IsFound;
 465   UINT32                           Index;
 466   VARIABLE_POINTER_TRACK           Variable;
 467   UINT8                            *Ptr;
 468   UINT8                            *Data;
 469   UINTN                            DataSize;
 470   VARIABLE_ENTRY_CONSISTENCY       PublicKeyEntry;
 471   UINT32                           Attributes;
 472
 473   if (PubKey == NULL) {
 474     return 0;
 475   }
 476
 477   Status = FindVariable (
 478              AUTHVAR_KEYDB_NAME,
 479              &gEfiAuthenticatedVariableGuid,
 480              &Variable,
 481              &mVariableModuleGlobal->VariableGlobal,
 482              FALSE
 483              );
 484   if (EFI_ERROR (Status)) {
 485     DEBUG ((EFI_D_ERROR, "Get public key database variable failure, Status = %r\n", Status));
 486     return 0;
 487   }
 488
 489   //
 490   // Check whether the public key entry does exist.
 491   //
 492   IsFound = FALSE;
 493   for (Ptr = mPubKeyStore, Index = 1; Index <= mPubKeyNumber; Index++) {
 494     if (CompareMem (Ptr, PubKey, EFI_CERT_TYPE_RSA2048_SIZE) == 0) {
 495       IsFound = TRUE;
 496       break;
 497     }
 498     Ptr += EFI_CERT_TYPE_RSA2048_SIZE;
 499   }
 500
 501   if (!IsFound) {
 502     //
 503     // Add public key in database.
 504     //
 505     if (mPubKeyNumber == MAX_KEY_NUM) {
 506       //
 507       // Public key dadatase is full, try to reclaim invalid key.
 508       //
 509       if (AtRuntime ()) {
 510         //
 511         // NV storage can't reclaim at runtime.
 512         //
 513         return 0;
 514       }
 515
 516       Status = Reclaim (
 517                  mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase,
 518                  &mVariableModuleGlobal->NonVolatileLastVariableOffset,
 519                  FALSE,
 520                  NULL,
 521                  NULL,
 522                  0,
 523                  TRUE
 524                  );
 525       if (EFI_ERROR (Status)) {
 526         return 0;
 527       }
 528
 529       Status = FindVariable (
 530                  AUTHVAR_KEYDB_NAME,
 531                  &gEfiAuthenticatedVariableGuid,
 532                  &Variable,
 533                  &mVariableModuleGlobal->VariableGlobal,
 534                  FALSE
 535                  );
 536       if (EFI_ERROR (Status)) {
 537         DEBUG ((EFI_D_ERROR, "Get public key database variable failure, Status = %r\n", Status));
 538         return 0;
 539       }
 540
 541       DataSize  = DataSizeOfVariable (Variable.CurrPtr);
 542       Data      = GetVariableDataPtr (Variable.CurrPtr);
 543       ASSERT ((DataSize != 0) && (Data != NULL));
 544       CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
 545       mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
 546
 547       if (mPubKeyNumber == MAX_KEY_NUM) {
 548         return 0;
 549       }
 550     }
 551
 552     //
 553     // Check the variable space for both public key and variable data.
 554     //
 555     PublicKeyEntry.VariableSize = (mPubKeyNumber + 1) * EFI_CERT_TYPE_RSA2048_SIZE;
 556     PublicKeyEntry.Guid         = &gEfiAuthenticatedVariableGuid;
 557     PublicKeyEntry.Name         = AUTHVAR_KEYDB_NAME;
 558     Attributes = VARIABLE_ATTRIBUTE_NV_BS_RT | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 559
 560     if (!CheckRemainingSpaceForConsistency (Attributes, &PublicKeyEntry, VariableDataEntry, NULL)) {
 561       //
 562       // No enough variable space.
 563       //
 564       return 0;
 565     }
 566
 567     CopyMem (mPubKeyStore + mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 568     Index = ++mPubKeyNumber;
 569     //
 570     // Update public key database variable.
 571     //
 572     Status = UpdateVariable (
 573                AUTHVAR_KEYDB_NAME,
 574                &gEfiAuthenticatedVariableGuid,
 575                mPubKeyStore,
 576                mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE,
 577                Attributes,
 578                0,
 579                0,
 580                &Variable,
 581                NULL
 582                );
 583     if (EFI_ERROR (Status)) {
 584       DEBUG ((EFI_D_ERROR, "Update public key database variable failure, Status = %r\n", Status));
 585       return 0;
 586     }
 587   }
 588
 589   return Index;
 590 }
 591
 592 /**
 593   Verify data payload with AuthInfo in EFI_CERT_TYPE_RSA2048_SHA256_GUID type.
 594   Follow the steps in UEFI2.2.
 595
 596   Caution: This function may receive untrusted input.
 597   This function may be invoked in SMM mode, and datasize and data are external input.
 598   This function will do basic validation, before parse the data.
 599   This function will parse the authentication carefully to avoid security issues, like
 600   buffer overflow, integer overflow.
 601
 602   @param[in]      Data                    Pointer to data with AuthInfo.
 603   @param[in]      DataSize                Size of Data.
 604   @param[in]      PubKey                  Public key used for verification.
 605
 606   @retval EFI_INVALID_PARAMETER       Invalid parameter.
 607   @retval EFI_SECURITY_VIOLATION      If authentication failed.
 608   @retval EFI_SUCCESS                 Authentication successful.
 609
 610 **/
 611 EFI_STATUS
 612 VerifyCounterBasedPayload (
 613   IN     UINT8          *Data,
 614   IN     UINTN          DataSize,
 615   IN     UINT8          *PubKey
 616   )
 617 {
 618   BOOLEAN                         Status;
 619   EFI_VARIABLE_AUTHENTICATION     *CertData;
 620   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
 621   UINT8                           Digest[SHA256_DIGEST_SIZE];
 622   VOID                            *Rsa;
 623   UINTN                           PayloadSize;
 624
 625   PayloadSize = DataSize - AUTHINFO_SIZE;
 626   Rsa         = NULL;
 627   CertData    = NULL;
 628   CertBlock   = NULL;
 629
 630   if (Data == NULL || PubKey == NULL) {
 631     return EFI_INVALID_PARAMETER;
 632   }
 633
 634   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
 635   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
 636
 637   //
 638   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
 639   // Cert type should be EFI_CERT_TYPE_RSA2048_SHA256_GUID.
 640   //
 641   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
 642       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertTypeRsa2048Sha256Guid)
 643         ) {
 644     //
 645     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
 646     //
 647     return EFI_SECURITY_VIOLATION;
 648   }
 649   //
 650   // Hash data payload with SHA256.
 651   //
 652   ZeroMem (Digest, SHA256_DIGEST_SIZE);
 653   Status  = Sha256Init (mHashCtx);
 654   if (!Status) {
 655     goto Done;
 656   }
 657   Status  = Sha256Update (mHashCtx, Data + AUTHINFO_SIZE, PayloadSize);
 658   if (!Status) {
 659     goto Done;
 660   }
 661   //
 662   // Hash Size.
 663   //
 664   Status  = Sha256Update (mHashCtx, &PayloadSize, sizeof (UINTN));
 665   if (!Status) {
 666     goto Done;
 667   }
 668   //
 669   // Hash Monotonic Count.
 670   //
 671   Status  = Sha256Update (mHashCtx, &CertData->MonotonicCount, sizeof (UINT64));
 672   if (!Status) {
 673     goto Done;
 674   }
 675   Status  = Sha256Final (mHashCtx, Digest);
 676   if (!Status) {
 677     goto Done;
 678   }
 679   //
 680   // Generate & Initialize RSA Context.
 681   //
 682   Rsa = RsaNew ();
 683   ASSERT (Rsa != NULL);
 684   //
 685   // Set RSA Key Components.
 686   // NOTE: Only N and E are needed to be set as RSA public key for signature verification.
 687   //
 688   Status = RsaSetKey (Rsa, RsaKeyN, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 689   if (!Status) {
 690     goto Done;
 691   }
 692   Status = RsaSetKey (Rsa, RsaKeyE, mRsaE, sizeof (mRsaE));
 693   if (!Status) {
 694     goto Done;
 695   }
 696   //
 697   // Verify the signature.
 698   //
 699   Status = RsaPkcs1Verify (
 700              Rsa,
 701              Digest,
 702              SHA256_DIGEST_SIZE,
 703              CertBlock->Signature,
 704              EFI_CERT_TYPE_RSA2048_SHA256_SIZE
 705              );
 706
 707 Done:
 708   if (Rsa != NULL) {
 709     RsaFree (Rsa);
 710   }
 711   if (Status) {
 712     return EFI_SUCCESS;
 713   } else {
 714     return EFI_SECURITY_VIOLATION;
 715   }
 716 }
 717
 718 /**
 719   Update platform mode.
 720
 721   @param[in]      Mode                    SETUP_MODE or USER_MODE.
 722
 723   @return EFI_INVALID_PARAMETER           Invalid parameter.
 724   @return EFI_SUCCESS                     Update platform mode successfully.
 725
 726 **/
 727 EFI_STATUS
 728 UpdatePlatformMode (
 729   IN  UINT32                    Mode
 730   )
 731 {
 732   EFI_STATUS              Status;
 733   VARIABLE_POINTER_TRACK  Variable;
 734   UINT8                   SecureBootMode;
 735   UINT8                   SecureBootEnable;
 736   UINTN                   VariableDataSize;
 737
 738   Status = FindVariable (
 739              EFI_SETUP_MODE_NAME,
 740              &gEfiGlobalVariableGuid,
 741              &Variable,
 742              &mVariableModuleGlobal->VariableGlobal,
 743              FALSE
 744              );
 745   if (EFI_ERROR (Status)) {
 746     return Status;
 747   }
 748
 749   //
 750   // Update the value of SetupMode variable by a simple mem copy, this could avoid possible
 751   // variable storage reclaim at runtime.
 752   //
 753   mPlatformMode = (UINT8) Mode;
 754   CopyMem (GetVariableDataPtr (Variable.CurrPtr), &mPlatformMode, sizeof(UINT8));
 755
 756   if (AtRuntime ()) {
 757     //
 758     // SecureBoot Variable indicates whether the platform firmware is operating
 759     // in Secure boot mode (1) or not (0), so we should not change SecureBoot
 760     // Variable in runtime.
 761     //
 762     return Status;
 763   }
 764
 765   //
 766   // Check "SecureBoot" variable's existence.
 767   // If it doesn't exist, firmware has no capability to perform driver signing verification,
 768   // then set "SecureBoot" to 0.
 769   //
 770   Status = FindVariable (
 771              EFI_SECURE_BOOT_MODE_NAME,
 772              &gEfiGlobalVariableGuid,
 773              &Variable,
 774              &mVariableModuleGlobal->VariableGlobal,
 775              FALSE
 776              );
 777   //
 778   // If "SecureBoot" variable exists, then check "SetupMode" variable update.
 779   // If "SetupMode" variable is USER_MODE, "SecureBoot" variable is set to 1.
 780   // If "SetupMode" variable is SETUP_MODE, "SecureBoot" variable is set to 0.
 781   //
 782   if (Variable.CurrPtr == NULL) {
 783     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 784   } else {
 785     if (mPlatformMode == USER_MODE) {
 786       SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 787     } else if (mPlatformMode == SETUP_MODE) {
 788       SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 789     } else {
 790       return EFI_NOT_FOUND;
 791     }
 792   }
 793
 794   Status  = UpdateVariable (
 795               EFI_SECURE_BOOT_MODE_NAME,
 796               &gEfiGlobalVariableGuid,
 797               &SecureBootMode,
 798               sizeof(UINT8),
 799               EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 800               0,
 801               0,
 802               &Variable,
 803               NULL
 804               );
 805   if (EFI_ERROR (Status)) {
 806     return Status;
 807   }
 808
 809   //
 810   // Check "SecureBootEnable" variable's existence. It can enable/disable secure boot feature.
 811   //
 812   Status = FindVariable (
 813              EFI_SECURE_BOOT_ENABLE_NAME,
 814              &gEfiSecureBootEnableDisableGuid,
 815              &Variable,
 816              &mVariableModuleGlobal->VariableGlobal,
 817              FALSE
 818              );
 819
 820   if (SecureBootMode == SECURE_BOOT_MODE_ENABLE) {
 821     //
 822     // Create the "SecureBootEnable" variable as secure boot is enabled.
 823     //
 824     SecureBootEnable = SECURE_BOOT_ENABLE;
 825     VariableDataSize = sizeof (SecureBootEnable);
 826   } else {
 827     //
 828     // Delete the "SecureBootEnable" variable if this variable exist as "SecureBoot"
 829     // variable is not in secure boot state.
 830     //
 831     if (Variable.CurrPtr == NULL || EFI_ERROR (Status)) {
 832       return EFI_SUCCESS;
 833     }
 834     SecureBootEnable = SECURE_BOOT_DISABLE;
 835     VariableDataSize = 0;
 836   }
 837
 838   Status = UpdateVariable (
 839              EFI_SECURE_BOOT_ENABLE_NAME,
 840              &gEfiSecureBootEnableDisableGuid,
 841              &SecureBootEnable,
 842              VariableDataSize,
 843              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 844              0,
 845              0,
 846              &Variable,
 847              NULL
 848              );
 849   return Status;
 850 }
 851
 852 /**
 853   Check input data form to make sure it is a valid EFI_SIGNATURE_LIST for PK/KEK/db/dbx variable.
 854
 855   @param[in]  VariableName                Name of Variable to be check.
 856   @param[in]  VendorGuid                  Variable vendor GUID.
 857   @param[in]  Data                        Point to the variable data to be checked.
 858   @param[in]  DataSize                    Size of Data.
 859
 860   @return EFI_INVALID_PARAMETER           Invalid signature list format.
 861   @return EFI_SUCCESS                     Passed signature list format check successfully.
 862
 863 **/
 864 EFI_STATUS
 865 CheckSignatureListFormat(
 866   IN  CHAR16                    *VariableName,
 867   IN  EFI_GUID                  *VendorGuid,
 868   IN  VOID                      *Data,
 869   IN  UINTN                     DataSize
 870   )
 871 {
 872   EFI_SIGNATURE_LIST     *SigList;
 873   UINTN                  SigDataSize;
 874   UINT32                 Index;
 875   UINT32                 SigCount;
 876   BOOLEAN                IsPk;
 877   VOID                   *RsaContext;
 878   EFI_SIGNATURE_DATA     *CertData;
 879   UINTN                  CertLen;
 880
 881   if (DataSize == 0) {
 882     return EFI_SUCCESS;
 883   }
 884
 885   ASSERT (VariableName != NULL && VendorGuid != NULL && Data != NULL);
 886
 887   if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_PLATFORM_KEY_NAME) == 0)){
 888     IsPk = TRUE;
 889   } else if ((CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0) ||
 890              (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&
 891               (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0 || StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0))){
 892     IsPk = FALSE;
 893   } else {
 894     return EFI_SUCCESS;
 895   }
 896
 897   SigCount = 0;
 898   SigList  = (EFI_SIGNATURE_LIST *) Data;
 899   SigDataSize  = DataSize;
 900   RsaContext = NULL;
 901
 902   //
 903   // Walk throuth the input signature list and check the data format.
 904   // If any signature is incorrectly formed, the whole check will fail.
 905   //
 906   while ((SigDataSize > 0) && (SigDataSize >= SigList->SignatureListSize)) {
 907     for (Index = 0; Index < (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM)); Index++ ) {
 908       if (CompareGuid (&SigList->SignatureType, &mSupportSigItem[Index].SigType)) {
 909         //
 910         // The value of SignatureSize should always be 16 (size of SignatureOwner
 911         // component) add the data length according to signature type.
 912         //
 913         if (mSupportSigItem[Index].SigDataSize != ((UINT32) ~0) &&
 914           (SigList->SignatureSize - sizeof (EFI_GUID)) != mSupportSigItem[Index].SigDataSize) {
 915           return EFI_INVALID_PARAMETER;
 916         }
 917         if (mSupportSigItem[Index].SigHeaderSize != ((UINTN) ~0) &&
 918           SigList->SignatureHeaderSize != mSupportSigItem[Index].SigHeaderSize) {
 919           return EFI_INVALID_PARAMETER;
 920         }
 921         break;
 922       }
 923     }
 924
 925     if (Index == (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM))) {
 926       //
 927       // Undefined signature type.
 928       //
 929       return EFI_INVALID_PARAMETER;
 930     }
 931
 932     if (CompareGuid (&SigList->SignatureType, &gEfiCertX509Guid)) {
 933       //
 934       // Try to retrieve the RSA public key from the X.509 certificate.
 935       // If this operation fails, it's not a valid certificate.
 936       //
 937       RsaContext = RsaNew ();
 938       if (RsaContext == NULL) {
 939         return EFI_INVALID_PARAMETER;
 940       }
 941       CertData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigList + sizeof (EFI_SIGNATURE_LIST) + SigList->SignatureHeaderSize);
 942       CertLen = SigList->SignatureSize - sizeof (EFI_GUID);
 943       if (!RsaGetPublicKeyFromX509 (CertData->SignatureData, CertLen, &RsaContext)) {
 944         RsaFree (RsaContext);
 945         return EFI_INVALID_PARAMETER;
 946       }
 947       RsaFree (RsaContext);
 948     }
 949
 950     if ((SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) % SigList->SignatureSize != 0) {
 951       return EFI_INVALID_PARAMETER;
 952     }
 953     SigCount += (SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) / SigList->SignatureSize;
 954
 955     SigDataSize -= SigList->SignatureListSize;
 956     SigList = (EFI_SIGNATURE_LIST *) ((UINT8 *) SigList + SigList->SignatureListSize);
 957   }
 958
 959   if (((UINTN) SigList - (UINTN) Data) != DataSize) {
 960     return EFI_INVALID_PARAMETER;
 961   }
 962
 963   if (IsPk && SigCount > 1) {
 964     return EFI_INVALID_PARAMETER;
 965   }
 966
 967   return EFI_SUCCESS;
 968 }
 969
 970 /**
 971   Update "VendorKeys" variable to record the out of band secure boot key modification.
 972
 973   @return EFI_SUCCESS           Variable is updated successfully.
 974   @return Others                Failed to update variable.
 975
 976 **/
 977 EFI_STATUS
 978 VendorKeyIsModified (
 979   VOID
 980   )
 981 {
 982   EFI_STATUS              Status;
 983   VARIABLE_POINTER_TRACK  Variable;
 984
 985   if (mVendorKeyState == VENDOR_KEYS_MODIFIED) {
 986     return EFI_SUCCESS;
 987   }
 988   mVendorKeyState = VENDOR_KEYS_MODIFIED;
 989
 990   FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 991   Status = UpdateVariable (
 992              EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
 993              &gEfiVendorKeysNvGuid,
 994              &mVendorKeyState,
 995              sizeof (UINT8),
 996              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS,
 997              0,
 998              0,
 999              &Variable,
1000              NULL
1001              );
1002   if (EFI_ERROR (Status)) {
1003     return Status;
1004   }
1005
1006   FindVariable (EFI_VENDOR_KEYS_VARIABLE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
1007   return UpdateVariable (
1008            EFI_VENDOR_KEYS_VARIABLE_NAME,
1009            &gEfiGlobalVariableGuid,
1010            &mVendorKeyState,
1011            sizeof (UINT8),
1012            EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
1013            0,
1014            0,
1015            &Variable,
1016            NULL
1017            );
1018 }
1019
1020 /**
1021   Process variable with platform key for verification.
1022
1023   Caution: This function may receive untrusted input.
1024   This function may be invoked in SMM mode, and datasize and data are external input.
1025   This function will do basic validation, before parse the data.
1026   This function will parse the authentication carefully to avoid security issues, like
1027   buffer overflow, integer overflow.
1028   This function will check attribute carefully to avoid authentication bypass.
1029
1030   @param[in]  VariableName                Name of Variable to be found.
1031   @param[in]  VendorGuid                  Variable vendor GUID.
1032   @param[in]  Data                        Data pointer.
1033   @param[in]  DataSize                    Size of Data found. If size is less than the
1034                                           data, this value contains the required size.
1035   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1036   @param[in]  Attributes                  Attribute value of the variable
1037   @param[in]  IsPk                        Indicate whether it is to process pk.
1038
1039   @return EFI_INVALID_PARAMETER           Invalid parameter.
1040   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation.
1041                                           check carried out by the firmware.
1042   @return EFI_SUCCESS                     Variable passed validation successfully.
1043
1044 **/
1045 EFI_STATUS
1046 ProcessVarWithPk (
1047   IN  CHAR16                    *VariableName,
1048   IN  EFI_GUID                  *VendorGuid,
1049   IN  VOID                      *Data,
1050   IN  UINTN                     DataSize,
1051   IN  VARIABLE_POINTER_TRACK    *Variable,
1052   IN  UINT32                    Attributes OPTIONAL,
1053   IN  BOOLEAN                   IsPk
1054   )
1055 {
1056   EFI_STATUS                  Status;
1057   BOOLEAN                     Del;
1058   UINT8                       *Payload;
1059   UINTN                       PayloadSize;
1060
1061   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1062       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1063     //
1064     // PK, KEK and db/dbx should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1065     // authenticated variable.
1066     //
1067     return EFI_INVALID_PARAMETER;
1068   }
1069
1070   Del = FALSE;
1071   if ((InCustomMode() && UserPhysicalPresent()) || (mPlatformMode == SETUP_MODE && !IsPk)) {
1072     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1073     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1074     if (PayloadSize == 0) {
1075       Del = TRUE;
1076     }
1077
1078     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
1079     if (EFI_ERROR (Status)) {
1080       return Status;
1081     }
1082
1083     Status = UpdateVariable (
1084                VariableName,
1085                VendorGuid,
1086                Payload,
1087                PayloadSize,
1088                Attributes,
1089                0,
1090                0,
1091                Variable,
1092                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1093                );
1094     if (EFI_ERROR(Status)) {
1095       return Status;
1096     }
1097
1098     if ((mPlatformMode != SETUP_MODE) || IsPk) {
1099       Status = VendorKeyIsModified ();
1100     }
1101   } else if (mPlatformMode == USER_MODE) {
1102     //
1103     // Verify against X509 Cert in PK database.
1104     //
1105     Status = VerifyTimeBasedPayload (
1106                VariableName,
1107                VendorGuid,
1108                Data,
1109                DataSize,
1110                Variable,
1111                Attributes,
1112                AuthVarTypePk,
1113                &Del
1114                );
1115   } else {
1116     //
1117     // Verify against the certificate in data payload.
1118     //
1119     Status = VerifyTimeBasedPayload (
1120                VariableName,
1121                VendorGuid,
1122                Data,
1123                DataSize,
1124                Variable,
1125                Attributes,
1126                AuthVarTypePayload,
1127                &Del
1128                );
1129   }
1130
1131   if (!EFI_ERROR(Status) && IsPk) {
1132     if (mPlatformMode == SETUP_MODE && !Del) {
1133       //
1134       // If enroll PK in setup mode, need change to user mode.
1135       //
1136       Status = UpdatePlatformMode (USER_MODE);
1137     } else if (mPlatformMode == USER_MODE && Del){
1138       //
1139       // If delete PK in user mode, need change to setup mode.
1140       //
1141       Status = UpdatePlatformMode (SETUP_MODE);
1142     }
1143   }
1144
1145   return Status;
1146 }
1147
1148 /**
1149   Process variable with key exchange key for verification.
1150
1151   Caution: This function may receive untrusted input.
1152   This function may be invoked in SMM mode, and datasize and data are external input.
1153   This function will do basic validation, before parse the data.
1154   This function will parse the authentication carefully to avoid security issues, like
1155   buffer overflow, integer overflow.
1156   This function will check attribute carefully to avoid authentication bypass.
1157
1158   @param[in]  VariableName                Name of Variable to be found.
1159   @param[in]  VendorGuid                  Variable vendor GUID.
1160   @param[in]  Data                        Data pointer.
1161   @param[in]  DataSize                    Size of Data found. If size is less than the
1162                                           data, this value contains the required size.
1163   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1164   @param[in]  Attributes                  Attribute value of the variable.
1165
1166   @return EFI_INVALID_PARAMETER           Invalid parameter.
1167   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
1168                                           check carried out by the firmware.
1169   @return EFI_SUCCESS                     Variable pass validation successfully.
1170
1171 **/
1172 EFI_STATUS
1173 ProcessVarWithKek (
1174   IN  CHAR16                               *VariableName,
1175   IN  EFI_GUID                             *VendorGuid,
1176   IN  VOID                                 *Data,
1177   IN  UINTN                                DataSize,
1178   IN  VARIABLE_POINTER_TRACK               *Variable,
1179   IN  UINT32                               Attributes OPTIONAL
1180   )
1181 {
1182   EFI_STATUS                      Status;
1183   UINT8                           *Payload;
1184   UINTN                           PayloadSize;
1185
1186   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1187       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1188     //
1189     // DB and DBX should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1190     // authenticated variable.
1191     //
1192     return EFI_INVALID_PARAMETER;
1193   }
1194
1195   Status = EFI_SUCCESS;
1196   if (mPlatformMode == USER_MODE && !(InCustomMode() && UserPhysicalPresent())) {
1197     //
1198     // Time-based, verify against X509 Cert KEK.
1199     //
1200     return VerifyTimeBasedPayload (
1201              VariableName,
1202              VendorGuid,
1203              Data,
1204              DataSize,
1205              Variable,
1206              Attributes,
1207              AuthVarTypeKek,
1208              NULL
1209              );
1210   } else {
1211     //
1212     // If in setup mode or custom secure boot mode, no authentication needed.
1213     //
1214     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1215     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1216
1217     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
1218     if (EFI_ERROR (Status)) {
1219       return Status;
1220     }
1221
1222     Status = UpdateVariable (
1223                VariableName,
1224                VendorGuid,
1225                Payload,
1226                PayloadSize,
1227                Attributes,
1228                0,
1229                0,
1230                Variable,
1231                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1232                );
1233     if (EFI_ERROR (Status)) {
1234       return Status;
1235     }
1236
1237     if (mPlatformMode != SETUP_MODE) {
1238       Status = VendorKeyIsModified ();
1239     }
1240   }
1241
1242   return Status;
1243 }
1244
1245 /**
1246   Process variable with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS/EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
1247
1248   Caution: This function may receive untrusted input.
1249   This function may be invoked in SMM mode, and datasize and data are external input.
1250   This function will do basic validation, before parse the data.
1251   This function will parse the authentication carefully to avoid security issues, like
1252   buffer overflow, integer overflow.
1253   This function will check attribute carefully to avoid authentication bypass.
1254
1255   @param[in]  VariableName                Name of Variable to be found.
1256   @param[in]  VendorGuid                  Variable vendor GUID.
1257
1258   @param[in]  Data                        Data pointer.
1259   @param[in]  DataSize                    Size of Data found. If size is less than the
1260                                           data, this value contains the required size.
1261   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1262   @param[in]  Attributes                  Attribute value of the variable.
1263
1264   @return EFI_INVALID_PARAMETER           Invalid parameter.
1265   @return EFI_WRITE_PROTECTED             Variable is write-protected and needs authentication with
1266                                           EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1267   @return EFI_OUT_OF_RESOURCES            The Database to save the public key is full.
1268   @return EFI_SECURITY_VIOLATION          The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
1269                                           set, but the AuthInfo does NOT pass the validation
1270                                           check carried out by the firmware.
1271   @return EFI_SUCCESS                     Variable is not write-protected or pass validation successfully.
1272
1273 **/
1274 EFI_STATUS
1275 ProcessVariable (
1276   IN     CHAR16                             *VariableName,
1277   IN     EFI_GUID                           *VendorGuid,
1278   IN     VOID                               *Data,
1279   IN     UINTN                              DataSize,
1280   IN     VARIABLE_POINTER_TRACK             *Variable,
1281   IN     UINT32                             Attributes
1282   )
1283 {
1284   EFI_STATUS                      Status;
1285   BOOLEAN                         IsDeletion;
1286   BOOLEAN                         IsFirstTime;
1287   UINT8                           *PubKey;
1288   EFI_VARIABLE_AUTHENTICATION     *CertData;
1289   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
1290   UINT32                          KeyIndex;
1291   UINT64                          MonotonicCount;
1292   VARIABLE_ENTRY_CONSISTENCY      VariableDataEntry;
1293
1294   KeyIndex    = 0;
1295   CertData    = NULL;
1296   CertBlock   = NULL;
1297   PubKey      = NULL;
1298   IsDeletion  = FALSE;
1299
1300   if (NeedPhysicallyPresent(VariableName, VendorGuid) && !UserPhysicalPresent()) {
1301     //
1302     // This variable is protected, only physical present user could modify its value.
1303     //
1304     return EFI_SECURITY_VIOLATION;
1305   }
1306
1307   //
1308   // A time-based authenticated variable and a count-based authenticated variable
1309   // can't be updated by each other.
1310   //
1311   if (Variable->CurrPtr != NULL) {
1312     if (((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) &&
1313         ((Variable->CurrPtr->Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0)) {
1314       return EFI_SECURITY_VIOLATION;
1315     }
1316
1317     if (((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) &&
1318         ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0)) {
1319       return EFI_SECURITY_VIOLATION;
1320     }
1321   }
1322
1323   //
1324   // Process Time-based Authenticated variable.
1325   //
1326   if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1327     return VerifyTimeBasedPayload (
1328              VariableName,
1329              VendorGuid,
1330              Data,
1331              DataSize,
1332              Variable,
1333              Attributes,
1334              AuthVarTypePriv,
1335              NULL
1336              );
1337   }
1338
1339   //
1340   // Determine if first time SetVariable with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS.
1341   //
1342   if ((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) {
1343     //
1344     // Determine current operation type.
1345     //
1346     if (DataSize == AUTHINFO_SIZE) {
1347       IsDeletion = TRUE;
1348     }
1349     //
1350     // Determine whether this is the first time with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1351     //
1352     if (Variable->CurrPtr == NULL) {
1353       IsFirstTime = TRUE;
1354     } else if ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) == 0) {
1355       IsFirstTime = TRUE;
1356     } else {
1357       KeyIndex   = Variable->CurrPtr->PubKeyIndex;
1358       IsFirstTime = FALSE;
1359     }
1360   } else if ((Variable->CurrPtr != NULL) &&
1361              ((Variable->CurrPtr->Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)
1362             ) {
1363     //
1364     // If the variable is already write-protected, it always needs authentication before update.
1365     //
1366     return EFI_WRITE_PROTECTED;
1367   } else {
1368     //
1369     // If without EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS, set and attributes collision.
1370     // That means it is not authenticated variable, just update variable as usual.
1371     //
1372     Status = UpdateVariable (VariableName, VendorGuid, Data, DataSize, Attributes, 0, 0, Variable, NULL);
1373     return Status;
1374   }
1375
1376   //
1377   // Get PubKey and check Monotonic Count value corresponding to the variable.
1378   //
1379   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
1380   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
1381   PubKey    = CertBlock->PublicKey;
1382
1383   //
1384   // Update Monotonic Count value.
1385   //
1386   MonotonicCount = CertData->MonotonicCount;
1387
1388   if (!IsFirstTime) {
1389     //
1390     // Check input PubKey.
1391     //
1392     if (CompareMem (PubKey, mPubKeyStore + (KeyIndex - 1) * EFI_CERT_TYPE_RSA2048_SIZE, EFI_CERT_TYPE_RSA2048_SIZE) != 0) {
1393       return EFI_SECURITY_VIOLATION;
1394     }
1395     //
1396     // Compare the current monotonic count and ensure that it is greater than the last SetVariable
1397     // operation with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS attribute set.
1398     //
1399     if (CertData->MonotonicCount <= Variable->CurrPtr->MonotonicCount) {
1400       //
1401       // Monotonic count check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
1402       //
1403       return EFI_SECURITY_VIOLATION;
1404     }
1405   }
1406   //
1407   // Verify the certificate in Data payload.
1408   //
1409   Status = VerifyCounterBasedPayload (Data, DataSize, PubKey);
1410   if (EFI_ERROR (Status)) {
1411     return Status;
1412   }
1413
1414   //
1415   // Now, the signature has been verified!
1416   //
1417   if (IsFirstTime && !IsDeletion) {
1418     VariableDataEntry.VariableSize = DataSize - AUTHINFO_SIZE;
1419     VariableDataEntry.Guid         = VendorGuid;
1420     VariableDataEntry.Name         = VariableName;
1421
1422     //
1423     // Update public key database variable if need.
1424     //
1425     KeyIndex = AddPubKeyInStore (PubKey, &VariableDataEntry);
1426     if (KeyIndex == 0) {
1427       return EFI_OUT_OF_RESOURCES;
1428     }
1429   }
1430
1431   //
1432   // Verification pass.
1433   //
1434   return UpdateVariable (VariableName, VendorGuid, (UINT8*)Data + AUTHINFO_SIZE, DataSize - AUTHINFO_SIZE, Attributes, KeyIndex, MonotonicCount, Variable, NULL);
1435 }
1436
1437 /**
1438   Merge two buffers which formatted as EFI_SIGNATURE_LIST. Only the new EFI_SIGNATURE_DATA
1439   will be appended to the original EFI_SIGNATURE_LIST, duplicate EFI_SIGNATURE_DATA
1440   will be ignored.
1441
1442   @param[in, out]  Data              Pointer to original EFI_SIGNATURE_LIST.
1443   @param[in]       DataSize          Size of Data buffer.
1444   @param[in]       FreeBufSize       Size of free data buffer
1445   @param[in]       NewData           Pointer to new EFI_SIGNATURE_LIST to be appended.
1446   @param[in]       NewDataSize       Size of NewData buffer.
1447   @param[out]      MergedBufSize     Size of the merged buffer
1448
1449   @return EFI_BUFFER_TOO_SMALL if input Data buffer overflowed
1450
1451 **/
1452 EFI_STATUS
1453 AppendSignatureList (
1454   IN  OUT VOID            *Data,
1455   IN  UINTN               DataSize,
1456   IN  UINTN               FreeBufSize,
1457   IN  VOID                *NewData,
1458   IN  UINTN               NewDataSize,
1459   OUT UINTN               *MergedBufSize
1460   )
1461 {
1462   EFI_SIGNATURE_LIST  *CertList;
1463   EFI_SIGNATURE_DATA  *Cert;
1464   UINTN               CertCount;
1465   EFI_SIGNATURE_LIST  *NewCertList;
1466   EFI_SIGNATURE_DATA  *NewCert;
1467   UINTN               NewCertCount;
1468   UINTN               Index;
1469   UINTN               Index2;
1470   UINTN               Size;
1471   UINT8               *Tail;
1472   UINTN               CopiedCount;
1473   UINTN               SignatureListSize;
1474   BOOLEAN             IsNewCert;
1475
1476   Tail = (UINT8 *) Data + DataSize;
1477
1478   NewCertList = (EFI_SIGNATURE_LIST *) NewData;
1479   while ((NewDataSize > 0) && (NewDataSize >= NewCertList->SignatureListSize)) {
1480     NewCert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCertList + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1481     NewCertCount = (NewCertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - NewCertList->SignatureHeaderSize) / NewCertList->SignatureSize;
1482
1483     CopiedCount = 0;
1484     for (Index = 0; Index < NewCertCount; Index++) {
1485       IsNewCert = TRUE;
1486
1487       Size = DataSize;
1488       CertList = (EFI_SIGNATURE_LIST *) Data;
1489       while ((Size > 0) && (Size >= CertList->SignatureListSize)) {
1490         if (CompareGuid (&CertList->SignatureType, &NewCertList->SignatureType) &&
1491            (CertList->SignatureSize == NewCertList->SignatureSize)) {
1492           Cert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
1493           CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
1494           for (Index2 = 0; Index2 < CertCount; Index2++) {
1495             //
1496             // Iterate each Signature Data in this Signature List.
1497             //
1498             if (CompareMem (NewCert, Cert, CertList->SignatureSize) == 0) {
1499               IsNewCert = FALSE;
1500               break;
1501             }
1502             Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
1503           }
1504         }
1505
1506         if (!IsNewCert) {
1507           break;
1508         }
1509         Size -= CertList->SignatureListSize;
1510         CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
1511       }
1512
1513       if (IsNewCert) {
1514         //
1515         // New EFI_SIGNATURE_DATA, append it.
1516         //
1517         if (CopiedCount == 0) {
1518           if (FreeBufSize < sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize) {
1519             return EFI_BUFFER_TOO_SMALL;
1520           }
1521
1522           //
1523           // Copy EFI_SIGNATURE_LIST header for only once.
1524           //
1525
1526           CopyMem (Tail, NewCertList, sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1527           Tail = Tail + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1528           FreeBufSize -= sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1529         }
1530
1531         if (FreeBufSize < NewCertList->SignatureSize) {
1532           return EFI_BUFFER_TOO_SMALL;
1533         }
1534         CopyMem (Tail, NewCert, NewCertList->SignatureSize);
1535         Tail += NewCertList->SignatureSize;
1536         FreeBufSize -= NewCertList->SignatureSize;
1537         CopiedCount++;
1538       }
1539
1540       NewCert = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCert + NewCertList->SignatureSize);
1541     }
1542
1543     //
1544     // Update SignatureListSize in newly appended EFI_SIGNATURE_LIST.
1545     //
1546     if (CopiedCount != 0) {
1547       SignatureListSize = sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize + (CopiedCount * NewCertList->SignatureSize);
1548       CertList = (EFI_SIGNATURE_LIST *) (Tail - SignatureListSize);
1549       CertList->SignatureListSize = (UINT32) SignatureListSize;
1550     }
1551
1552     NewDataSize -= NewCertList->SignatureListSize;
1553     NewCertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) NewCertList + NewCertList->SignatureListSize);
1554   }
1555
1556   *MergedBufSize = (Tail - (UINT8 *) Data);
1557   return EFI_SUCCESS;
1558 }
1559
1560 /**
1561   Compare two EFI_TIME data.
1562
1563
1564   @param FirstTime           A pointer to the first EFI_TIME data.
1565   @param SecondTime          A pointer to the second EFI_TIME data.
1566
1567   @retval  TRUE              The FirstTime is not later than the SecondTime.
1568   @retval  FALSE             The FirstTime is later than the SecondTime.
1569
1570 **/
1571 BOOLEAN
1572 CompareTimeStamp (
1573   IN EFI_TIME               *FirstTime,
1574   IN EFI_TIME               *SecondTime
1575   )
1576 {
1577   if (FirstTime->Year != SecondTime->Year) {
1578     return (BOOLEAN) (FirstTime->Year < SecondTime->Year);
1579   } else if (FirstTime->Month != SecondTime->Month) {
1580     return (BOOLEAN) (FirstTime->Month < SecondTime->Month);
1581   } else if (FirstTime->Day != SecondTime->Day) {
1582     return (BOOLEAN) (FirstTime->Day < SecondTime->Day);
1583   } else if (FirstTime->Hour != SecondTime->Hour) {
1584     return (BOOLEAN) (FirstTime->Hour < SecondTime->Hour);
1585   } else if (FirstTime->Minute != SecondTime->Minute) {
1586     return (BOOLEAN) (FirstTime->Minute < SecondTime->Minute);
1587   }
1588
1589   return (BOOLEAN) (FirstTime->Second <= SecondTime->Second);
1590 }
1591
1592 /**
1593   Find matching signer's certificates for common authenticated variable
1594   by corresponding VariableName and VendorGuid from "certdb".
1595
1596   The data format of "certdb":
1597   //
1598   //     UINT32 CertDbListSize;
1599   // /// AUTH_CERT_DB_DATA Certs1[];
1600   // /// AUTH_CERT_DB_DATA Certs2[];
1601   // /// ...
1602   // /// AUTH_CERT_DB_DATA Certsn[];
1603   //
1604
1605   @param[in]  VariableName   Name of authenticated Variable.
1606   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1607   @param[in]  Data           Pointer to variable "certdb".
1608   @param[in]  DataSize       Size of variable "certdb".
1609   @param[out] CertOffset     Offset of matching CertData, from starting of Data.
1610   @param[out] CertDataSize   Length of CertData in bytes.
1611   @param[out] CertNodeOffset Offset of matching AUTH_CERT_DB_DATA , from
1612                              starting of Data.
1613   @param[out] CertNodeSize   Length of AUTH_CERT_DB_DATA in bytes.
1614
1615   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1616   @retval  EFI_NOT_FOUND         Fail to find matching certs.
1617   @retval  EFI_SUCCESS           Find matching certs and output parameters.
1618
1619 **/
1620 EFI_STATUS
1621 FindCertsFromDb (
1622   IN     CHAR16           *VariableName,
1623   IN     EFI_GUID         *VendorGuid,
1624   IN     UINT8            *Data,
1625   IN     UINTN            DataSize,
1626   OUT    UINT32           *CertOffset,    OPTIONAL
1627   OUT    UINT32           *CertDataSize,  OPTIONAL
1628   OUT    UINT32           *CertNodeOffset,OPTIONAL
1629   OUT    UINT32           *CertNodeSize   OPTIONAL
1630   )
1631 {
1632   UINT32                  Offset;
1633   AUTH_CERT_DB_DATA       *Ptr;
1634   UINT32                  CertSize;
1635   UINT32                  NameSize;
1636   UINT32                  NodeSize;
1637   UINT32                  CertDbListSize;
1638
1639   if ((VariableName == NULL) || (VendorGuid == NULL) || (Data == NULL)) {
1640     return EFI_INVALID_PARAMETER;
1641   }
1642
1643   //
1644   // Check whether DataSize matches recorded CertDbListSize.
1645   //
1646   if (DataSize < sizeof (UINT32)) {
1647     return EFI_INVALID_PARAMETER;
1648   }
1649
1650   CertDbListSize = ReadUnaligned32 ((UINT32 *) Data);
1651
1652   if (CertDbListSize != (UINT32) DataSize) {
1653     return EFI_INVALID_PARAMETER;
1654   }
1655
1656   Offset = sizeof (UINT32);
1657
1658   //
1659   // Get corresponding certificates by VendorGuid and VariableName.
1660   //
1661   while (Offset < (UINT32) DataSize) {
1662     Ptr = (AUTH_CERT_DB_DATA *) (Data + Offset);
1663     //
1664     // Check whether VendorGuid matches.
1665     //
1666     if (CompareGuid (&Ptr->VendorGuid, VendorGuid)) {
1667       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1668       NameSize = ReadUnaligned32 (&Ptr->NameSize);
1669       CertSize = ReadUnaligned32 (&Ptr->CertDataSize);
1670
1671       if (NodeSize != sizeof (EFI_GUID) + sizeof (UINT32) * 3 + CertSize +
1672           sizeof (CHAR16) * NameSize) {
1673         return EFI_INVALID_PARAMETER;
1674       }
1675
1676       Offset = Offset + sizeof (EFI_GUID) + sizeof (UINT32) * 3;
1677       //
1678       // Check whether VariableName matches.
1679       //
1680       if ((NameSize == StrLen (VariableName)) &&
1681           (CompareMem (Data + Offset, VariableName, NameSize * sizeof (CHAR16)) == 0)) {
1682         Offset = Offset + NameSize * sizeof (CHAR16);
1683
1684         if (CertOffset != NULL) {
1685           *CertOffset = Offset;
1686         }
1687
1688         if (CertDataSize != NULL) {
1689           *CertDataSize = CertSize;
1690         }
1691
1692         if (CertNodeOffset != NULL) {
1693           *CertNodeOffset = (UINT32) ((UINT8 *) Ptr - Data);
1694         }
1695
1696         if (CertNodeSize != NULL) {
1697           *CertNodeSize = NodeSize;
1698         }
1699
1700         return EFI_SUCCESS;
1701       } else {
1702         Offset = Offset + NameSize * sizeof (CHAR16) + CertSize;
1703       }
1704     } else {
1705       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1706       Offset   = Offset + NodeSize;
1707     }
1708   }
1709
1710   return EFI_NOT_FOUND;
1711 }
1712
1713 /**
1714   Retrieve signer's certificates for common authenticated variable
1715   by corresponding VariableName and VendorGuid from "certdb".
1716
1717   @param[in]  VariableName   Name of authenticated Variable.
1718   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1719   @param[out] CertData       Pointer to signer's certificates.
1720   @param[out] CertDataSize   Length of CertData in bytes.
1721
1722   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1723   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1724   @retval  EFI_SUCCESS           Get signer's certificates successfully.
1725
1726 **/
1727 EFI_STATUS
1728 GetCertsFromDb (
1729   IN     CHAR16           *VariableName,
1730   IN     EFI_GUID         *VendorGuid,
1731   OUT    UINT8            **CertData,
1732   OUT    UINT32           *CertDataSize
1733   )
1734 {
1735   VARIABLE_POINTER_TRACK  CertDbVariable;
1736   EFI_STATUS              Status;
1737   UINT8                   *Data;
1738   UINTN                   DataSize;
1739   UINT32                  CertOffset;
1740
1741   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL) || (CertDataSize == NULL)) {
1742     return EFI_INVALID_PARAMETER;
1743   }
1744
1745   //
1746   // Get variable "certdb".
1747   //
1748   Status = FindVariable (
1749              EFI_CERT_DB_NAME,
1750              &gEfiCertDbGuid,
1751              &CertDbVariable,
1752              &mVariableModuleGlobal->VariableGlobal,
1753              FALSE
1754              );
1755   if (EFI_ERROR (Status)) {
1756     return Status;
1757   }
1758
1759   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1760   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1761   if ((DataSize == 0) || (Data == NULL)) {
1762     ASSERT (FALSE);
1763     return EFI_NOT_FOUND;
1764   }
1765
1766   Status = FindCertsFromDb (
1767              VariableName,
1768              VendorGuid,
1769              Data,
1770              DataSize,
1771              &CertOffset,
1772              CertDataSize,
1773              NULL,
1774              NULL
1775              );
1776
1777   if (EFI_ERROR (Status)) {
1778     return Status;
1779   }
1780
1781   *CertData = Data + CertOffset;
1782   return EFI_SUCCESS;
1783 }
1784
1785 /**
1786   Delete matching signer's certificates when deleting common authenticated
1787   variable by corresponding VariableName and VendorGuid from "certdb".
1788
1789   @param[in]  VariableName   Name of authenticated Variable.
1790   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1791
1792   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1793   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1794   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
1795   @retval  EFI_SUCCESS           The operation is completed successfully.
1796
1797 **/
1798 EFI_STATUS
1799 DeleteCertsFromDb (
1800   IN     CHAR16           *VariableName,
1801   IN     EFI_GUID         *VendorGuid
1802   )
1803 {
1804   VARIABLE_POINTER_TRACK  CertDbVariable;
1805   EFI_STATUS              Status;
1806   UINT8                   *Data;
1807   UINTN                   DataSize;
1808   UINT32                  VarAttr;
1809   UINT32                  CertNodeOffset;
1810   UINT32                  CertNodeSize;
1811   UINT8                   *NewCertDb;
1812   UINT32                  NewCertDbSize;
1813
1814   if ((VariableName == NULL) || (VendorGuid == NULL)) {
1815     return EFI_INVALID_PARAMETER;
1816   }
1817
1818   //
1819   // Get variable "certdb".
1820   //
1821   Status = FindVariable (
1822              EFI_CERT_DB_NAME,
1823              &gEfiCertDbGuid,
1824              &CertDbVariable,
1825              &mVariableModuleGlobal->VariableGlobal,
1826              FALSE
1827              );
1828   if (EFI_ERROR (Status)) {
1829     return Status;
1830   }
1831
1832   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1833   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1834   if ((DataSize == 0) || (Data == NULL)) {
1835     ASSERT (FALSE);
1836     return EFI_NOT_FOUND;
1837   }
1838
1839   if (DataSize == sizeof (UINT32)) {
1840     //
1841     // There is no certs in certdb.
1842     //
1843     return EFI_SUCCESS;
1844   }
1845
1846   //
1847   // Get corresponding cert node from certdb.
1848   //
1849   Status = FindCertsFromDb (
1850              VariableName,
1851              VendorGuid,
1852              Data,
1853              DataSize,
1854              NULL,
1855              NULL,
1856              &CertNodeOffset,
1857              &CertNodeSize
1858              );
1859
1860   if (EFI_ERROR (Status)) {
1861     return Status;
1862   }
1863
1864   if (DataSize < (CertNodeOffset + CertNodeSize)) {
1865     return EFI_NOT_FOUND;
1866   }
1867
1868   //
1869   // Construct new data content of variable "certdb".
1870   //
1871   NewCertDbSize = (UINT32) DataSize - CertNodeSize;
1872   NewCertDb     = (UINT8*) mCertDbStore;
1873
1874   //
1875   // Copy the DB entries before deleting node.
1876   //
1877   CopyMem (NewCertDb, Data, CertNodeOffset);
1878   //
1879   // Update CertDbListSize.
1880   //
1881   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
1882   //
1883   // Copy the DB entries after deleting node.
1884   //
1885   if (DataSize > (CertNodeOffset + CertNodeSize)) {
1886     CopyMem (
1887       NewCertDb + CertNodeOffset,
1888       Data + CertNodeOffset + CertNodeSize,
1889       DataSize - CertNodeOffset - CertNodeSize
1890       );
1891   }
1892
1893   //
1894   // Set "certdb".
1895   //
1896   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
1897   Status   = UpdateVariable (
1898                EFI_CERT_DB_NAME,
1899                &gEfiCertDbGuid,
1900                NewCertDb,
1901                NewCertDbSize,
1902                VarAttr,
1903                0,
1904                0,
1905                &CertDbVariable,
1906                NULL
1907                );
1908
1909   return Status;
1910 }
1911
1912 /**
1913   Insert signer's certificates for common authenticated variable with VariableName
1914   and VendorGuid in AUTH_CERT_DB_DATA to "certdb".
1915
1916   @param[in]  VariableName   Name of authenticated Variable.
1917   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1918   @param[in]  CertData       Pointer to signer's certificates.
1919   @param[in]  CertDataSize   Length of CertData in bytes.
1920
1921   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1922   @retval  EFI_ACCESS_DENIED     An AUTH_CERT_DB_DATA entry with same VariableName
1923                                  and VendorGuid already exists.
1924   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
1925   @retval  EFI_SUCCESS           Insert an AUTH_CERT_DB_DATA entry to "certdb"
1926
1927 **/
1928 EFI_STATUS
1929 InsertCertsToDb (
1930   IN     CHAR16           *VariableName,
1931   IN     EFI_GUID         *VendorGuid,
1932   IN     UINT8            *CertData,
1933   IN     UINTN            CertDataSize
1934   )
1935 {
1936   VARIABLE_POINTER_TRACK  CertDbVariable;
1937   EFI_STATUS              Status;
1938   UINT8                   *Data;
1939   UINTN                   DataSize;
1940   UINT32                  VarAttr;
1941   UINT8                   *NewCertDb;
1942   UINT32                  NewCertDbSize;
1943   UINT32                  CertNodeSize;
1944   UINT32                  NameSize;
1945   AUTH_CERT_DB_DATA       *Ptr;
1946
1947   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL)) {
1948     return EFI_INVALID_PARAMETER;
1949   }
1950
1951   //
1952   // Get variable "certdb".
1953   //
1954   Status = FindVariable (
1955              EFI_CERT_DB_NAME,
1956              &gEfiCertDbGuid,
1957              &CertDbVariable,
1958              &mVariableModuleGlobal->VariableGlobal,
1959              FALSE
1960              );
1961   if (EFI_ERROR (Status)) {
1962     return Status;
1963   }
1964
1965   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1966   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1967   if ((DataSize == 0) || (Data == NULL)) {
1968     ASSERT (FALSE);
1969     return EFI_NOT_FOUND;
1970   }
1971
1972   //
1973   // Find whether matching cert node already exists in "certdb".
1974   // If yes return error.
1975   //
1976   Status = FindCertsFromDb (
1977              VariableName,
1978              VendorGuid,
1979              Data,
1980              DataSize,
1981              NULL,
1982              NULL,
1983              NULL,
1984              NULL
1985              );
1986
1987   if (!EFI_ERROR (Status)) {
1988     ASSERT (FALSE);
1989     return EFI_ACCESS_DENIED;
1990   }
1991
1992   //
1993   // Construct new data content of variable "certdb".
1994   //
1995   NameSize      = (UINT32) StrLen (VariableName);
1996   CertNodeSize  = sizeof (AUTH_CERT_DB_DATA) + (UINT32) CertDataSize + NameSize * sizeof (CHAR16);
1997   NewCertDbSize = (UINT32) DataSize + CertNodeSize;
1998   if (NewCertDbSize > MAX_CERTDB_SIZE) {
1999     return EFI_OUT_OF_RESOURCES;
2000   }
2001   NewCertDb     = (UINT8*) mCertDbStore;
2002
2003   //
2004   // Copy the DB entries before deleting node.
2005   //
2006   CopyMem (NewCertDb, Data, DataSize);
2007   //
2008   // Update CertDbListSize.
2009   //
2010   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
2011   //
2012   // Construct new cert node.
2013   //
2014   Ptr = (AUTH_CERT_DB_DATA *) (NewCertDb + DataSize);
2015   CopyGuid (&Ptr->VendorGuid, VendorGuid);
2016   CopyMem (&Ptr->CertNodeSize, &CertNodeSize, sizeof (UINT32));
2017   CopyMem (&Ptr->NameSize, &NameSize, sizeof (UINT32));
2018   CopyMem (&Ptr->CertDataSize, &CertDataSize, sizeof (UINT32));
2019
2020   CopyMem (
2021     (UINT8 *) Ptr + sizeof (AUTH_CERT_DB_DATA),
2022     VariableName,
2023     NameSize * sizeof (CHAR16)
2024     );
2025
2026   CopyMem (
2027     (UINT8 *) Ptr +  sizeof (AUTH_CERT_DB_DATA) + NameSize * sizeof (CHAR16),
2028     CertData,
2029     CertDataSize
2030     );
2031
2032   //
2033   // Set "certdb".
2034   //
2035   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
2036   Status   = UpdateVariable (
2037                EFI_CERT_DB_NAME,
2038                &gEfiCertDbGuid,
2039                NewCertDb,
2040                NewCertDbSize,
2041                VarAttr,
2042                0,
2043                0,
2044                &CertDbVariable,
2045                NULL
2046                );
2047
2048   return Status;
2049 }
2050
2051 /**
2052   Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
2053
2054   Caution: This function may receive untrusted input.
2055   This function may be invoked in SMM mode, and datasize and data are external input.
2056   This function will do basic validation, before parse the data.
2057   This function will parse the authentication carefully to avoid security issues, like
2058   buffer overflow, integer overflow.
2059
2060   @param[in]  VariableName                Name of Variable to be found.
2061   @param[in]  VendorGuid                  Variable vendor GUID.
2062   @param[in]  Data                        Data pointer.
2063   @param[in]  DataSize                    Size of Data found. If size is less than the
2064                                           data, this value contains the required size.
2065   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
2066   @param[in]  Attributes                  Attribute value of the variable.
2067   @param[in]  AuthVarType                 Verify against PK, KEK database, private database or certificate in data payload.
2068   @param[out] VarDel                      Delete the variable or not.
2069
2070   @retval EFI_INVALID_PARAMETER           Invalid parameter.
2071   @retval EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
2072                                           check carried out by the firmware.
2073   @retval EFI_OUT_OF_RESOURCES            Failed to process variable due to lack
2074                                           of resources.
2075   @retval EFI_SUCCESS                     Variable pass validation successfully.
2076
2077 **/
2078 EFI_STATUS
2079 VerifyTimeBasedPayload (
2080   IN     CHAR16                             *VariableName,
2081   IN     EFI_GUID                           *VendorGuid,
2082   IN     VOID                               *Data,
2083   IN     UINTN                              DataSize,
2084   IN     VARIABLE_POINTER_TRACK             *Variable,
2085   IN     UINT32                             Attributes,
2086   IN     AUTHVAR_TYPE                       AuthVarType,
2087   OUT    BOOLEAN                            *VarDel
2088   )
2089 {
2090   UINT8                            *RootCert;
2091   UINT8                            *SigData;
2092   UINT8                            *PayloadPtr;
2093   UINTN                            RootCertSize;
2094   UINTN                            Index;
2095   UINTN                            CertCount;
2096   UINTN                            PayloadSize;
2097   UINT32                           Attr;
2098   UINT32                           SigDataSize;
2099   UINT32                           KekDataSize;
2100   BOOLEAN                          VerifyStatus;
2101   EFI_STATUS                       Status;
2102   EFI_SIGNATURE_LIST               *CertList;
2103   EFI_SIGNATURE_DATA               *Cert;
2104   VARIABLE_POINTER_TRACK           KekVariable;
2105   EFI_VARIABLE_AUTHENTICATION_2    *CertData;
2106   UINT8                            *NewData;
2107   UINTN                            NewDataSize;
2108   VARIABLE_POINTER_TRACK           PkVariable;
2109   UINT8                            *Buffer;
2110   UINTN                            Length;
2111   UINT8                            *SignerCerts;
2112   UINT8                            *WrapSigData;
2113   UINTN                            CertStackSize;
2114   UINT8                            *CertsInCertDb;
2115   UINT32                           CertsSizeinDb;
2116
2117   VerifyStatus           = FALSE;
2118   CertData               = NULL;
2119   NewData                = NULL;
2120   Attr                   = Attributes;
2121   WrapSigData            = NULL;
2122   SignerCerts            = NULL;
2123   RootCert               = NULL;
2124
2125   //
2126   // When the attribute EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS is
2127   // set, then the Data buffer shall begin with an instance of a complete (and serialized)
2128   // EFI_VARIABLE_AUTHENTICATION_2 descriptor. The descriptor shall be followed by the new
2129   // variable value and DataSize shall reflect the combined size of the descriptor and the new
2130   // variable value. The authentication descriptor is not part of the variable data and is not
2131   // returned by subsequent calls to GetVariable().
2132   //
2133   CertData = (EFI_VARIABLE_AUTHENTICATION_2 *) Data;
2134
2135   //
2136   // Verify that Pad1, Nanosecond, TimeZone, Daylight and Pad2 components of the
2137   // TimeStamp value are set to zero.
2138   //
2139   if ((CertData->TimeStamp.Pad1 != 0) ||
2140       (CertData->TimeStamp.Nanosecond != 0) ||
2141       (CertData->TimeStamp.TimeZone != 0) ||
2142       (CertData->TimeStamp.Daylight != 0) ||
2143       (CertData->TimeStamp.Pad2 != 0)) {
2144     return EFI_SECURITY_VIOLATION;
2145   }
2146
2147   if ((Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
2148     if (CompareTimeStamp (&CertData->TimeStamp, &Variable->CurrPtr->TimeStamp)) {
2149       //
2150       // TimeStamp check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
2151       //
2152       return EFI_SECURITY_VIOLATION;
2153     }
2154   }
2155
2156   //
2157   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
2158   // Cert type should be EFI_CERT_TYPE_PKCS7_GUID.
2159   //
2160   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
2161       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertPkcs7Guid)) {
2162     //
2163     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
2164     //
2165     return EFI_SECURITY_VIOLATION;
2166   }
2167
2168   //
2169   // Find out Pkcs7 SignedData which follows the EFI_VARIABLE_AUTHENTICATION_2 descriptor.
2170   // AuthInfo.Hdr.dwLength is the length of the entire certificate, including the length of the header.
2171   //
2172   SigData = CertData->AuthInfo.CertData;
2173   SigDataSize = CertData->AuthInfo.Hdr.dwLength - (UINT32) (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData));
2174
2175   //
2176   // Find out the new data payload which follows Pkcs7 SignedData directly.
2177   //
2178   PayloadPtr = SigData + SigDataSize;
2179   PayloadSize = DataSize - OFFSET_OF_AUTHINFO2_CERT_DATA - (UINTN) SigDataSize;
2180
2181   //
2182   // Construct a buffer to fill with (VariableName, VendorGuid, Attributes, TimeStamp, Data).
2183   //
2184   NewDataSize = PayloadSize + sizeof (EFI_TIME) + sizeof (UINT32) +
2185                 sizeof (EFI_GUID) + StrSize (VariableName) - sizeof (CHAR16);
2186   NewData = mSerializationRuntimeBuffer;
2187
2188   Buffer = NewData;
2189   Length = StrLen (VariableName) * sizeof (CHAR16);
2190   CopyMem (Buffer, VariableName, Length);
2191   Buffer += Length;
2192
2193   Length = sizeof (EFI_GUID);
2194   CopyMem (Buffer, VendorGuid, Length);
2195   Buffer += Length;
2196
2197   Length = sizeof (UINT32);
2198   CopyMem (Buffer, &Attr, Length);
2199   Buffer += Length;
2200
2201   Length = sizeof (EFI_TIME);
2202   CopyMem (Buffer, &CertData->TimeStamp, Length);
2203   Buffer += Length;
2204
2205   CopyMem (Buffer, PayloadPtr, PayloadSize);
2206
2207   if (AuthVarType == AuthVarTypePk) {
2208     //
2209     // Verify that the signature has been made with the current Platform Key (no chaining for PK).
2210     // First, get signer's certificates from SignedData.
2211     //
2212     VerifyStatus = Pkcs7GetSigners (
2213                      SigData,
2214                      SigDataSize,
2215                      &SignerCerts,
2216                      &CertStackSize,
2217                      &RootCert,
2218                      &RootCertSize
2219                      );
2220     if (!VerifyStatus) {
2221       goto Exit;
2222     }
2223
2224     //
2225     // Second, get the current platform key from variable. Check whether it's identical with signer's certificates
2226     // in SignedData. If not, return error immediately.
2227     //
2228     Status = FindVariable (
2229                EFI_PLATFORM_KEY_NAME,
2230                &gEfiGlobalVariableGuid,
2231                &PkVariable,
2232                &mVariableModuleGlobal->VariableGlobal,
2233                FALSE
2234                );
2235     if (EFI_ERROR (Status)) {
2236       VerifyStatus = FALSE;
2237       goto Exit;
2238     }
2239     CertList = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (PkVariable.CurrPtr);
2240     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2241     if ((RootCertSize != (CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1))) ||
2242         (CompareMem (Cert->SignatureData, RootCert, RootCertSize) != 0)) {
2243       VerifyStatus = FALSE;
2244       goto Exit;
2245     }
2246
2247     //
2248     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2249     //
2250     VerifyStatus = Pkcs7Verify (
2251                      SigData,
2252                      SigDataSize,
2253                      RootCert,
2254                      RootCertSize,
2255                      NewData,
2256                      NewDataSize
2257                      );
2258
2259   } else if (AuthVarType == AuthVarTypeKek) {
2260
2261     //
2262     // Get KEK database from variable.
2263     //
2264     Status = FindVariable (
2265                EFI_KEY_EXCHANGE_KEY_NAME,
2266                &gEfiGlobalVariableGuid,
2267                &KekVariable,
2268                &mVariableModuleGlobal->VariableGlobal,
2269                FALSE
2270                );
2271     if (EFI_ERROR (Status)) {
2272       return Status;
2273     }
2274
2275     //
2276     // Ready to verify Pkcs7 SignedData. Go through KEK Signature Database to find out X.509 CertList.
2277     //
2278     KekDataSize      = KekVariable.CurrPtr->DataSize;
2279     CertList         = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (KekVariable.CurrPtr);
2280     while ((KekDataSize > 0) && (KekDataSize >= CertList->SignatureListSize)) {
2281       if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {
2282         Cert       = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2283         CertCount  = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
2284         for (Index = 0; Index < CertCount; Index++) {
2285           //
2286           // Iterate each Signature Data Node within this CertList for a verify
2287           //
2288           RootCert      = Cert->SignatureData;
2289           RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2290
2291           //
2292           // Verify Pkcs7 SignedData via Pkcs7Verify library.
2293           //
2294           VerifyStatus = Pkcs7Verify (
2295                            SigData,
2296                            SigDataSize,
2297                            RootCert,
2298                            RootCertSize,
2299                            NewData,
2300                            NewDataSize
2301                            );
2302           if (VerifyStatus) {
2303             goto Exit;
2304           }
2305           Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
2306         }
2307       }
2308       KekDataSize -= CertList->SignatureListSize;
2309       CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
2310     }
2311   } else if (AuthVarType == AuthVarTypePriv) {
2312
2313     //
2314     // Process common authenticated variable except PK/KEK/DB/DBX.
2315     // Get signer's certificates from SignedData.
2316     //
2317     VerifyStatus = Pkcs7GetSigners (
2318                      SigData,
2319                      SigDataSize,
2320                      &SignerCerts,
2321                      &CertStackSize,
2322                      &RootCert,
2323                      &RootCertSize
2324                      );
2325     if (!VerifyStatus) {
2326       goto Exit;
2327     }
2328
2329     //
2330     // Get previously stored signer's certificates from certdb for existing
2331     // variable. Check whether they are identical with signer's certificates
2332     // in SignedData. If not, return error immediately.
2333     //
2334     if ((Variable->CurrPtr != NULL)) {
2335       VerifyStatus = FALSE;
2336
2337       Status = GetCertsFromDb (VariableName, VendorGuid, &CertsInCertDb, &CertsSizeinDb);
2338       if (EFI_ERROR (Status)) {
2339         goto Exit;
2340       }
2341
2342       if ((CertStackSize != CertsSizeinDb) ||
2343           (CompareMem (SignerCerts, CertsInCertDb, CertsSizeinDb) != 0)) {
2344         goto Exit;
2345       }
2346     }
2347
2348     VerifyStatus = Pkcs7Verify (
2349                      SigData,
2350                      SigDataSize,
2351                      RootCert,
2352                      RootCertSize,
2353                      NewData,
2354                      NewDataSize
2355                      );
2356     if (!VerifyStatus) {
2357       goto Exit;
2358     }
2359
2360     //
2361     // Delete signer's certificates when delete the common authenticated variable.
2362     //
2363     if ((PayloadSize == 0) && (Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
2364       Status = DeleteCertsFromDb (VariableName, VendorGuid);
2365       if (EFI_ERROR (Status)) {
2366         VerifyStatus = FALSE;
2367         goto Exit;
2368       }
2369     } else if (Variable->CurrPtr == NULL && PayloadSize != 0) {
2370       //
2371       // Insert signer's certificates when adding a new common authenticated variable.
2372       //
2373       Status = InsertCertsToDb (VariableName, VendorGuid, SignerCerts, CertStackSize);
2374       if (EFI_ERROR (Status)) {
2375         VerifyStatus = FALSE;
2376         goto Exit;
2377       }
2378     }
2379   } else if (AuthVarType == AuthVarTypePayload) {
2380     CertList = (EFI_SIGNATURE_LIST *) PayloadPtr;
2381     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2382     RootCert      = Cert->SignatureData;
2383     RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2384
2385     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2386     //
2387     VerifyStatus = Pkcs7Verify (
2388                      SigData,
2389                      SigDataSize,
2390                      RootCert,
2391                      RootCertSize,
2392                      NewData,
2393                      NewDataSize
2394                      );
2395   } else {
2396     return EFI_SECURITY_VIOLATION;
2397   }
2398
2399 Exit:
2400
2401   if (AuthVarType == AuthVarTypePk || AuthVarType == AuthVarTypePriv) {
2402     Pkcs7FreeSigners (RootCert);
2403     Pkcs7FreeSigners (SignerCerts);
2404   }
2405
2406   if (!VerifyStatus) {
2407     return EFI_SECURITY_VIOLATION;
2408   }
2409
2410   Status = CheckSignatureListFormat(VariableName, VendorGuid, PayloadPtr, PayloadSize);
2411   if (EFI_ERROR (Status)) {
2412     return Status;
2413   }
2414
2415   if ((PayloadSize == 0) && (VarDel != NULL)) {
2416     *VarDel = TRUE;
2417   }
2418
2419   //
2420   // Final step: Update/Append Variable if it pass Pkcs7Verify
2421   //
2422   return UpdateVariable (
2423            VariableName,
2424            VendorGuid,
2425            PayloadPtr,
2426            PayloadSize,
2427            Attributes,
2428            0,
2429            0,
2430            Variable,
2431            &CertData->TimeStamp
2432            );
2433 }
2434