SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c

   1 /** @file
   2   Implement authentication services for the authenticated variable
   3   service in UEFI2.2.
   4
   5   Caution: This module requires additional review when modified.
   6   This driver will have external input - variable data. It may be input in SMM mode.
   7   This external input must be validated carefully to avoid security issue like
   8   buffer overflow, integer overflow.
   9   Variable attribute should also be checked to avoid authentication bypass.
  10      The whole SMM authentication variable design relies on the integrity of flash part and SMM.
  11   which is assumed to be protected by platform.  All variable code and metadata in flash/SMM Memory
  12   may not be modified without authorization. If platform fails to protect these resources,
  13   the authentication service provided in this driver will be broken, and the behavior is undefined.
  14
  15   ProcessVarWithPk(), ProcessVarWithKek() and ProcessVariable() are the function to do
  16   variable authentication.
  17
  18   VerifyTimeBasedPayload() and VerifyCounterBasedPayload() are sub function to do verification.
  19   They will do basic validation for authentication data structure, then call crypto library
  20   to verify the signature.
  21
  22 Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>
  23 This program and the accompanying materials
  24 are licensed and made available under the terms and conditions of the BSD License
  25 which accompanies this distribution.  The full text of the license may be found at
  26 http://opensource.org/licenses/bsd-license.php
  27
  28 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  29 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  30
  31 **/
  32
  33 #include "Variable.h"
  34 #include "AuthService.h"
  35
  36 ///
  37 /// Global database array for scratch
  38 ///
  39 UINT8    *mPubKeyStore;
  40 UINT32   mPubKeyNumber;
  41 UINT32   mMaxKeyNumber;
  42 UINT32   mMaxKeyDbSize;
  43 UINT8    *mCertDbStore;
  44 UINT32   mMaxCertDbSize;
  45 UINT32   mPlatformMode;
  46 UINT8    mVendorKeyState;
  47
  48 EFI_GUID mSignatureSupport[] = {EFI_CERT_SHA1_GUID, EFI_CERT_SHA256_GUID, EFI_CERT_RSA2048_GUID, EFI_CERT_X509_GUID};
  49 //
  50 // Public Exponent of RSA Key.
  51 //
  52 CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };
  53 //
  54 // Hash context pointer
  55 //
  56 VOID  *mHashCtx = NULL;
  57
  58 //
  59 // Requirement for different signature type which have been defined in UEFI spec.
  60 // These data are used to peform SignatureList format check while setting PK/KEK variable.
  61 //
  62 EFI_SIGNATURE_ITEM mSupportSigItem[] = {
  63 //{SigType,                       SigHeaderSize,   SigDataSize  }
  64   {EFI_CERT_SHA256_GUID,          0,               32           },
  65   {EFI_CERT_RSA2048_GUID,         0,               256          },
  66   {EFI_CERT_RSA2048_SHA256_GUID,  0,               256          },
  67   {EFI_CERT_SHA1_GUID,            0,               20           },
  68   {EFI_CERT_RSA2048_SHA1_GUID,    0,               256          },
  69   {EFI_CERT_X509_GUID,            0,               ((UINT32) ~0)},
  70   {EFI_CERT_SHA224_GUID,          0,               28           },
  71   {EFI_CERT_SHA384_GUID,          0,               48           },
  72   {EFI_CERT_SHA512_GUID,          0,               64           },
  73   {EFI_CERT_X509_SHA256_GUID,     0,               48           },
  74   {EFI_CERT_X509_SHA384_GUID,     0,               64           },
  75   {EFI_CERT_X509_SHA512_GUID,     0,               80           }
  76 };
  77
  78 /**
  79   Determine whether this operation needs a physical present user.
  80
  81   @param[in]      VariableName            Name of the Variable.
  82   @param[in]      VendorGuid              GUID of the Variable.
  83
  84   @retval TRUE      This variable is protected, only a physical present user could set this variable.
  85   @retval FALSE     This variable is not protected.
  86
  87 **/
  88 BOOLEAN
  89 NeedPhysicallyPresent(
  90   IN     CHAR16         *VariableName,
  91   IN     EFI_GUID       *VendorGuid
  92   )
  93 {
  94   if ((CompareGuid (VendorGuid, &gEfiSecureBootEnableDisableGuid) && (StrCmp (VariableName, EFI_SECURE_BOOT_ENABLE_NAME) == 0))
  95     || (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (VariableName, EFI_CUSTOM_MODE_NAME) == 0))) {
  96     return TRUE;
  97   }
  98
  99   return FALSE;
 100 }
 101
 102 /**
 103   Determine whether the platform is operating in Custom Secure Boot mode.
 104
 105   @retval TRUE           The platform is operating in Custom mode.
 106   @retval FALSE          The platform is operating in Standard mode.
 107
 108 **/
 109 BOOLEAN
 110 InCustomMode (
 111   VOID
 112   )
 113 {
 114   VARIABLE_POINTER_TRACK  Variable;
 115
 116   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 117   if (Variable.CurrPtr != NULL && *(GetVariableDataPtr (Variable.CurrPtr)) == CUSTOM_SECURE_BOOT_MODE) {
 118     return TRUE;
 119   }
 120
 121   return FALSE;
 122 }
 123
 124 /**
 125   Initializes for authenticated varibale service.
 126
 127   @retval EFI_SUCCESS           Function successfully executed.
 128   @retval EFI_OUT_OF_RESOURCES  Fail to allocate enough memory resources.
 129
 130 **/
 131 EFI_STATUS
 132 AutenticatedVariableServiceInitialize (
 133   VOID
 134   )
 135 {
 136   EFI_STATUS              Status;
 137   VARIABLE_POINTER_TRACK  Variable;
 138   VARIABLE_POINTER_TRACK  PkVariable;
 139   UINT8                   VarValue;
 140   UINT32                  VarAttr;
 141   UINT8                   *Data;
 142   UINTN                   DataSize;
 143   UINTN                   CtxSize;
 144   UINT8                   SecureBootMode;
 145   UINT8                   SecureBootEnable;
 146   UINT8                   CustomMode;
 147   UINT32                  ListSize;
 148
 149   //
 150   // Initialize hash context.
 151   //
 152   CtxSize   = Sha256GetContextSize ();
 153   mHashCtx  = AllocateRuntimePool (CtxSize);
 154   if (mHashCtx == NULL) {
 155     return EFI_OUT_OF_RESOURCES;
 156   }
 157
 158   //
 159   // Reserve runtime buffer for public key database. The size excludes variable header and name size.
 160   //
 161   mMaxKeyDbSize = PcdGet32 (PcdMaxVariableSize) - sizeof (VARIABLE_HEADER) - sizeof (AUTHVAR_KEYDB_NAME);
 162   mMaxKeyNumber = mMaxKeyDbSize / EFI_CERT_TYPE_RSA2048_SIZE;
 163   mPubKeyStore  = AllocateRuntimePool (mMaxKeyDbSize);
 164   if (mPubKeyStore == NULL) {
 165     return EFI_OUT_OF_RESOURCES;
 166   }
 167
 168   //
 169   // Reserve runtime buffer for certificate database. The size excludes variable header and name size.
 170   //
 171   mMaxCertDbSize = PcdGet32 (PcdMaxVariableSize) - sizeof (VARIABLE_HEADER) - sizeof (EFI_CERT_DB_NAME);
 172   mCertDbStore   = AllocateRuntimePool (mMaxCertDbSize);
 173   if (mCertDbStore == NULL) {
 174     return EFI_OUT_OF_RESOURCES;
 175   }
 176
 177   //
 178   // Check "AuthVarKeyDatabase" variable's existence.
 179   // If it doesn't exist, create a new one with initial value of 0 and EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
 180   //
 181   Status = FindVariable (
 182              AUTHVAR_KEYDB_NAME,
 183              &gEfiAuthenticatedVariableGuid,
 184              &Variable,
 185              &mVariableModuleGlobal->VariableGlobal,
 186              FALSE
 187              );
 188
 189   if (Variable.CurrPtr == NULL) {
 190     VarAttr       = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 191     VarValue      = 0;
 192     mPubKeyNumber = 0;
 193     Status        = UpdateVariable (
 194                       AUTHVAR_KEYDB_NAME,
 195                       &gEfiAuthenticatedVariableGuid,
 196                       &VarValue,
 197                       sizeof(UINT8),
 198                       VarAttr,
 199                       0,
 200                       0,
 201                       &Variable,
 202                       NULL
 203                       );
 204     if (EFI_ERROR (Status)) {
 205       return Status;
 206     }
 207   } else {
 208     //
 209     // Load database in global variable for cache.
 210     //
 211     DataSize  = DataSizeOfVariable (Variable.CurrPtr);
 212     Data      = GetVariableDataPtr (Variable.CurrPtr);
 213     ASSERT ((DataSize != 0) && (Data != NULL));
 214     //
 215     // "AuthVarKeyDatabase" is an internal variable. Its DataSize is always ensured not to exceed mPubKeyStore buffer size(See definition before)
 216     //  Therefore, there is no memory overflow in underlying CopyMem.
 217     //
 218     CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
 219     mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
 220   }
 221
 222   FindVariable (EFI_PLATFORM_KEY_NAME, &gEfiGlobalVariableGuid, &PkVariable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 223   if (PkVariable.CurrPtr == NULL) {
 224     DEBUG ((EFI_D_INFO, "Variable %s does not exist.\n", EFI_PLATFORM_KEY_NAME));
 225   } else {
 226     DEBUG ((EFI_D_INFO, "Variable %s exists.\n", EFI_PLATFORM_KEY_NAME));
 227   }
 228
 229   //
 230   // Create "SetupMode" variable with BS+RT attribute set.
 231   //
 232   FindVariable (EFI_SETUP_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 233   if (PkVariable.CurrPtr == NULL) {
 234     mPlatformMode = SETUP_MODE;
 235   } else {
 236     mPlatformMode = USER_MODE;
 237   }
 238   Status = UpdateVariable (
 239              EFI_SETUP_MODE_NAME,
 240              &gEfiGlobalVariableGuid,
 241              &mPlatformMode,
 242              sizeof(UINT8),
 243              EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 244              0,
 245              0,
 246              &Variable,
 247              NULL
 248              );
 249   if (EFI_ERROR (Status)) {
 250     return Status;
 251   }
 252
 253   //
 254   // Create "SignatureSupport" variable with BS+RT attribute set.
 255   //
 256   FindVariable (EFI_SIGNATURE_SUPPORT_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 257   Status  = UpdateVariable (
 258               EFI_SIGNATURE_SUPPORT_NAME,
 259               &gEfiGlobalVariableGuid,
 260               mSignatureSupport,
 261               sizeof(mSignatureSupport),
 262               EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 263               0,
 264               0,
 265               &Variable,
 266               NULL
 267               );
 268   if (EFI_ERROR (Status)) {
 269     return Status;
 270   }
 271
 272   //
 273   // If "SecureBootEnable" variable exists, then update "SecureBoot" variable.
 274   // If "SecureBootEnable" variable is SECURE_BOOT_ENABLE and in USER_MODE, Set "SecureBoot" variable to SECURE_BOOT_MODE_ENABLE.
 275   // If "SecureBootEnable" variable is SECURE_BOOT_DISABLE, Set "SecureBoot" variable to SECURE_BOOT_MODE_DISABLE.
 276   //
 277   SecureBootEnable = SECURE_BOOT_DISABLE;
 278   FindVariable (EFI_SECURE_BOOT_ENABLE_NAME, &gEfiSecureBootEnableDisableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 279   if (Variable.CurrPtr != NULL) {
 280     if (mPlatformMode == SETUP_MODE){
 281       //
 282       // PK is cleared in runtime. "SecureBootMode" is not updated before reboot
 283       // Delete "SecureBootMode" in SetupMode
 284       //
 285       Status = UpdateVariable (
 286                  EFI_SECURE_BOOT_ENABLE_NAME,
 287                  &gEfiSecureBootEnableDisableGuid,
 288                  &SecureBootEnable,
 289                  0,
 290                  EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 291                  0,
 292                  0,
 293                  &Variable,
 294                  NULL
 295                  );
 296     } else {
 297       SecureBootEnable = *(GetVariableDataPtr (Variable.CurrPtr));
 298     }
 299   } else if (mPlatformMode == USER_MODE) {
 300     //
 301     // "SecureBootEnable" not exist, initialize it in USER_MODE.
 302     //
 303     SecureBootEnable = SECURE_BOOT_ENABLE;
 304     Status = UpdateVariable (
 305                EFI_SECURE_BOOT_ENABLE_NAME,
 306                &gEfiSecureBootEnableDisableGuid,
 307                &SecureBootEnable,
 308                sizeof (UINT8),
 309                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 310                0,
 311                0,
 312                &Variable,
 313                NULL
 314                );
 315     if (EFI_ERROR (Status)) {
 316       return Status;
 317     }
 318   }
 319
 320   //
 321   // Create "SecureBoot" variable with BS+RT attribute set.
 322   //
 323   if (SecureBootEnable == SECURE_BOOT_ENABLE && mPlatformMode == USER_MODE) {
 324     SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 325   } else {
 326     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 327   }
 328   FindVariable (EFI_SECURE_BOOT_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 329   Status = UpdateVariable (
 330              EFI_SECURE_BOOT_MODE_NAME,
 331              &gEfiGlobalVariableGuid,
 332              &SecureBootMode,
 333              sizeof (UINT8),
 334              EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 335              0,
 336              0,
 337              &Variable,
 338              NULL
 339              );
 340   if (EFI_ERROR (Status)) {
 341     return Status;
 342   }
 343
 344   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SETUP_MODE_NAME, mPlatformMode));
 345   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_MODE_NAME, SecureBootMode));
 346   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_ENABLE_NAME, SecureBootEnable));
 347
 348   //
 349   // Initialize "CustomMode" in STANDARD_SECURE_BOOT_MODE state.
 350   //
 351   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 352   CustomMode = STANDARD_SECURE_BOOT_MODE;
 353   Status = UpdateVariable (
 354              EFI_CUSTOM_MODE_NAME,
 355              &gEfiCustomModeEnableGuid,
 356              &CustomMode,
 357              sizeof (UINT8),
 358              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 359              0,
 360              0,
 361              &Variable,
 362              NULL
 363              );
 364   if (EFI_ERROR (Status)) {
 365     return Status;
 366   }
 367
 368   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_CUSTOM_MODE_NAME, CustomMode));
 369
 370   //
 371   // Check "certdb" variable's existence.
 372   // If it doesn't exist, then create a new one with
 373   // EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.
 374   //
 375   Status = FindVariable (
 376              EFI_CERT_DB_NAME,
 377              &gEfiCertDbGuid,
 378              &Variable,
 379              &mVariableModuleGlobal->VariableGlobal,
 380              FALSE
 381              );
 382
 383   if (Variable.CurrPtr == NULL) {
 384     VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
 385     ListSize = sizeof (UINT32);
 386     Status   = UpdateVariable (
 387                  EFI_CERT_DB_NAME,
 388                  &gEfiCertDbGuid,
 389                  &ListSize,
 390                  sizeof (UINT32),
 391                  VarAttr,
 392                  0,
 393                  0,
 394                  &Variable,
 395                  NULL
 396                  );
 397     if (EFI_ERROR (Status)) {
 398       return Status;
 399     }
 400   }
 401
 402   //
 403   // Check "VendorKeysNv" variable's existence and create "VendorKeys" variable accordingly.
 404   //
 405   FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 406   if (Variable.CurrPtr != NULL) {
 407     mVendorKeyState = *(GetVariableDataPtr (Variable.CurrPtr));
 408   } else {
 409     //
 410     // "VendorKeysNv" not exist, initialize it in VENDOR_KEYS_VALID state.
 411     //
 412     mVendorKeyState = VENDOR_KEYS_VALID;
 413     Status = UpdateVariable (
 414                EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
 415                &gEfiVendorKeysNvGuid,
 416                &mVendorKeyState,
 417                sizeof (UINT8),
 418                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS,
 419                0,
 420                0,
 421                &Variable,
 422                NULL
 423                );
 424     if (EFI_ERROR (Status)) {
 425       return Status;
 426     }
 427   }
 428
 429   //
 430   // Create "VendorKeys" variable with BS+RT attribute set.
 431   //
 432   FindVariable (EFI_VENDOR_KEYS_VARIABLE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 433   Status = UpdateVariable (
 434              EFI_VENDOR_KEYS_VARIABLE_NAME,
 435              &gEfiGlobalVariableGuid,
 436              &mVendorKeyState,
 437              sizeof (UINT8),
 438              EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 439              0,
 440              0,
 441              &Variable,
 442              NULL
 443              );
 444   if (EFI_ERROR (Status)) {
 445     return Status;
 446   }
 447
 448   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_VENDOR_KEYS_VARIABLE_NAME, mVendorKeyState));
 449
 450   return Status;
 451 }
 452
 453 /**
 454   Add public key in store and return its index.
 455
 456   @param[in]  PubKey                  Input pointer to Public Key data
 457   @param[in]  VariableDataEntry       The variable data entry
 458
 459   @return                             Index of new added item
 460
 461 **/
 462 UINT32
 463 AddPubKeyInStore (
 464   IN  UINT8                        *PubKey,
 465   IN  VARIABLE_ENTRY_CONSISTENCY   *VariableDataEntry
 466   )
 467 {
 468   EFI_STATUS                       Status;
 469   BOOLEAN                          IsFound;
 470   UINT32                           Index;
 471   VARIABLE_POINTER_TRACK           Variable;
 472   UINT8                            *Ptr;
 473   UINT8                            *Data;
 474   UINTN                            DataSize;
 475   VARIABLE_ENTRY_CONSISTENCY       PublicKeyEntry;
 476   UINT32                           Attributes;
 477
 478   if (PubKey == NULL) {
 479     return 0;
 480   }
 481
 482   Status = FindVariable (
 483              AUTHVAR_KEYDB_NAME,
 484              &gEfiAuthenticatedVariableGuid,
 485              &Variable,
 486              &mVariableModuleGlobal->VariableGlobal,
 487              FALSE
 488              );
 489   if (EFI_ERROR (Status)) {
 490     DEBUG ((EFI_D_ERROR, "Get public key database variable failure, Status = %r\n", Status));
 491     return 0;
 492   }
 493
 494   //
 495   // Check whether the public key entry does exist.
 496   //
 497   IsFound = FALSE;
 498   for (Ptr = mPubKeyStore, Index = 1; Index <= mPubKeyNumber; Index++) {
 499     if (CompareMem (Ptr, PubKey, EFI_CERT_TYPE_RSA2048_SIZE) == 0) {
 500       IsFound = TRUE;
 501       break;
 502     }
 503     Ptr += EFI_CERT_TYPE_RSA2048_SIZE;
 504   }
 505
 506   if (!IsFound) {
 507     //
 508     // Add public key in database.
 509     //
 510     if (mPubKeyNumber == mMaxKeyNumber) {
 511       //
 512       // Public key dadatase is full, try to reclaim invalid key.
 513       //
 514       if (AtRuntime ()) {
 515         //
 516         // NV storage can't reclaim at runtime.
 517         //
 518         return 0;
 519       }
 520
 521       Status = Reclaim (
 522                  mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase,
 523                  &mVariableModuleGlobal->NonVolatileLastVariableOffset,
 524                  FALSE,
 525                  NULL,
 526                  NULL,
 527                  0,
 528                  TRUE
 529                  );
 530       if (EFI_ERROR (Status)) {
 531         return 0;
 532       }
 533
 534       Status = FindVariable (
 535                  AUTHVAR_KEYDB_NAME,
 536                  &gEfiAuthenticatedVariableGuid,
 537                  &Variable,
 538                  &mVariableModuleGlobal->VariableGlobal,
 539                  FALSE
 540                  );
 541       if (EFI_ERROR (Status)) {
 542         DEBUG ((EFI_D_ERROR, "Get public key database variable failure, Status = %r\n", Status));
 543         return 0;
 544       }
 545
 546       DataSize  = DataSizeOfVariable (Variable.CurrPtr);
 547       Data      = GetVariableDataPtr (Variable.CurrPtr);
 548       ASSERT ((DataSize != 0) && (Data != NULL));
 549       //
 550       // "AuthVarKeyDatabase" is an internal used variable. Its DataSize is always ensured not to exceed mPubKeyStore buffer size(See definition before)
 551       //  Therefore, there is no memory overflow in underlying CopyMem.
 552       //
 553       CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
 554       mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
 555
 556       if (mPubKeyNumber == mMaxKeyNumber) {
 557         return 0;
 558       }
 559     }
 560
 561     //
 562     // Check the variable space for both public key and variable data.
 563     //
 564     PublicKeyEntry.VariableSize = (mPubKeyNumber + 1) * EFI_CERT_TYPE_RSA2048_SIZE;
 565     PublicKeyEntry.Guid         = &gEfiAuthenticatedVariableGuid;
 566     PublicKeyEntry.Name         = AUTHVAR_KEYDB_NAME;
 567     Attributes = VARIABLE_ATTRIBUTE_NV_BS_RT | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 568
 569     if (!CheckRemainingSpaceForConsistency (Attributes, &PublicKeyEntry, VariableDataEntry, NULL)) {
 570       //
 571       // No enough variable space.
 572       //
 573       return 0;
 574     }
 575
 576     CopyMem (mPubKeyStore + mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 577     Index = ++mPubKeyNumber;
 578     //
 579     // Update public key database variable.
 580     //
 581     Status = UpdateVariable (
 582                AUTHVAR_KEYDB_NAME,
 583                &gEfiAuthenticatedVariableGuid,
 584                mPubKeyStore,
 585                mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE,
 586                Attributes,
 587                0,
 588                0,
 589                &Variable,
 590                NULL
 591                );
 592     if (EFI_ERROR (Status)) {
 593       DEBUG ((EFI_D_ERROR, "Update public key database variable failure, Status = %r\n", Status));
 594       return 0;
 595     }
 596   }
 597
 598   return Index;
 599 }
 600
 601 /**
 602   Verify data payload with AuthInfo in EFI_CERT_TYPE_RSA2048_SHA256_GUID type.
 603   Follow the steps in UEFI2.2.
 604
 605   Caution: This function may receive untrusted input.
 606   This function may be invoked in SMM mode, and datasize and data are external input.
 607   This function will do basic validation, before parse the data.
 608   This function will parse the authentication carefully to avoid security issues, like
 609   buffer overflow, integer overflow.
 610
 611   @param[in]      Data                    Pointer to data with AuthInfo.
 612   @param[in]      DataSize                Size of Data.
 613   @param[in]      PubKey                  Public key used for verification.
 614
 615   @retval EFI_INVALID_PARAMETER       Invalid parameter.
 616   @retval EFI_SECURITY_VIOLATION      If authentication failed.
 617   @retval EFI_SUCCESS                 Authentication successful.
 618
 619 **/
 620 EFI_STATUS
 621 VerifyCounterBasedPayload (
 622   IN     UINT8          *Data,
 623   IN     UINTN          DataSize,
 624   IN     UINT8          *PubKey
 625   )
 626 {
 627   BOOLEAN                         Status;
 628   EFI_VARIABLE_AUTHENTICATION     *CertData;
 629   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
 630   UINT8                           Digest[SHA256_DIGEST_SIZE];
 631   VOID                            *Rsa;
 632   UINTN                           PayloadSize;
 633
 634   PayloadSize = DataSize - AUTHINFO_SIZE;
 635   Rsa         = NULL;
 636   CertData    = NULL;
 637   CertBlock   = NULL;
 638
 639   if (Data == NULL || PubKey == NULL) {
 640     return EFI_INVALID_PARAMETER;
 641   }
 642
 643   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
 644   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
 645
 646   //
 647   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
 648   // Cert type should be EFI_CERT_TYPE_RSA2048_SHA256_GUID.
 649   //
 650   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
 651       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertTypeRsa2048Sha256Guid)
 652         ) {
 653     //
 654     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
 655     //
 656     return EFI_SECURITY_VIOLATION;
 657   }
 658   //
 659   // Hash data payload with SHA256.
 660   //
 661   ZeroMem (Digest, SHA256_DIGEST_SIZE);
 662   Status  = Sha256Init (mHashCtx);
 663   if (!Status) {
 664     goto Done;
 665   }
 666   Status  = Sha256Update (mHashCtx, Data + AUTHINFO_SIZE, PayloadSize);
 667   if (!Status) {
 668     goto Done;
 669   }
 670   //
 671   // Hash Size.
 672   //
 673   Status  = Sha256Update (mHashCtx, &PayloadSize, sizeof (UINTN));
 674   if (!Status) {
 675     goto Done;
 676   }
 677   //
 678   // Hash Monotonic Count.
 679   //
 680   Status  = Sha256Update (mHashCtx, &CertData->MonotonicCount, sizeof (UINT64));
 681   if (!Status) {
 682     goto Done;
 683   }
 684   Status  = Sha256Final (mHashCtx, Digest);
 685   if (!Status) {
 686     goto Done;
 687   }
 688   //
 689   // Generate & Initialize RSA Context.
 690   //
 691   Rsa = RsaNew ();
 692   ASSERT (Rsa != NULL);
 693   //
 694   // Set RSA Key Components.
 695   // NOTE: Only N and E are needed to be set as RSA public key for signature verification.
 696   //
 697   Status = RsaSetKey (Rsa, RsaKeyN, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 698   if (!Status) {
 699     goto Done;
 700   }
 701   Status = RsaSetKey (Rsa, RsaKeyE, mRsaE, sizeof (mRsaE));
 702   if (!Status) {
 703     goto Done;
 704   }
 705   //
 706   // Verify the signature.
 707   //
 708   Status = RsaPkcs1Verify (
 709              Rsa,
 710              Digest,
 711              SHA256_DIGEST_SIZE,
 712              CertBlock->Signature,
 713              EFI_CERT_TYPE_RSA2048_SHA256_SIZE
 714              );
 715
 716 Done:
 717   if (Rsa != NULL) {
 718     RsaFree (Rsa);
 719   }
 720   if (Status) {
 721     return EFI_SUCCESS;
 722   } else {
 723     return EFI_SECURITY_VIOLATION;
 724   }
 725 }
 726
 727 /**
 728   Update platform mode.
 729
 730   @param[in]      Mode                    SETUP_MODE or USER_MODE.
 731
 732   @return EFI_INVALID_PARAMETER           Invalid parameter.
 733   @return EFI_SUCCESS                     Update platform mode successfully.
 734
 735 **/
 736 EFI_STATUS
 737 UpdatePlatformMode (
 738   IN  UINT32                    Mode
 739   )
 740 {
 741   EFI_STATUS              Status;
 742   VARIABLE_POINTER_TRACK  Variable;
 743   UINT8                   SecureBootMode;
 744   UINT8                   SecureBootEnable;
 745   UINTN                   VariableDataSize;
 746
 747   Status = FindVariable (
 748              EFI_SETUP_MODE_NAME,
 749              &gEfiGlobalVariableGuid,
 750              &Variable,
 751              &mVariableModuleGlobal->VariableGlobal,
 752              FALSE
 753              );
 754   if (EFI_ERROR (Status)) {
 755     return Status;
 756   }
 757
 758   //
 759   // Update the value of SetupMode variable by a simple mem copy, this could avoid possible
 760   // variable storage reclaim at runtime.
 761   //
 762   mPlatformMode = (UINT8) Mode;
 763   CopyMem (GetVariableDataPtr (Variable.CurrPtr), &mPlatformMode, sizeof(UINT8));
 764
 765   if (AtRuntime ()) {
 766     //
 767     // SecureBoot Variable indicates whether the platform firmware is operating
 768     // in Secure boot mode (1) or not (0), so we should not change SecureBoot
 769     // Variable in runtime.
 770     //
 771     return Status;
 772   }
 773
 774   //
 775   // Check "SecureBoot" variable's existence.
 776   // If it doesn't exist, firmware has no capability to perform driver signing verification,
 777   // then set "SecureBoot" to 0.
 778   //
 779   Status = FindVariable (
 780              EFI_SECURE_BOOT_MODE_NAME,
 781              &gEfiGlobalVariableGuid,
 782              &Variable,
 783              &mVariableModuleGlobal->VariableGlobal,
 784              FALSE
 785              );
 786   //
 787   // If "SecureBoot" variable exists, then check "SetupMode" variable update.
 788   // If "SetupMode" variable is USER_MODE, "SecureBoot" variable is set to 1.
 789   // If "SetupMode" variable is SETUP_MODE, "SecureBoot" variable is set to 0.
 790   //
 791   if (Variable.CurrPtr == NULL) {
 792     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 793   } else {
 794     if (mPlatformMode == USER_MODE) {
 795       SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 796     } else if (mPlatformMode == SETUP_MODE) {
 797       SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 798     } else {
 799       return EFI_NOT_FOUND;
 800     }
 801   }
 802
 803   Status  = UpdateVariable (
 804               EFI_SECURE_BOOT_MODE_NAME,
 805               &gEfiGlobalVariableGuid,
 806               &SecureBootMode,
 807               sizeof(UINT8),
 808               EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 809               0,
 810               0,
 811               &Variable,
 812               NULL
 813               );
 814   if (EFI_ERROR (Status)) {
 815     return Status;
 816   }
 817
 818   //
 819   // Check "SecureBootEnable" variable's existence. It can enable/disable secure boot feature.
 820   //
 821   Status = FindVariable (
 822              EFI_SECURE_BOOT_ENABLE_NAME,
 823              &gEfiSecureBootEnableDisableGuid,
 824              &Variable,
 825              &mVariableModuleGlobal->VariableGlobal,
 826              FALSE
 827              );
 828
 829   if (SecureBootMode == SECURE_BOOT_MODE_ENABLE) {
 830     //
 831     // Create the "SecureBootEnable" variable as secure boot is enabled.
 832     //
 833     SecureBootEnable = SECURE_BOOT_ENABLE;
 834     VariableDataSize = sizeof (SecureBootEnable);
 835   } else {
 836     //
 837     // Delete the "SecureBootEnable" variable if this variable exist as "SecureBoot"
 838     // variable is not in secure boot state.
 839     //
 840     if (Variable.CurrPtr == NULL || EFI_ERROR (Status)) {
 841       return EFI_SUCCESS;
 842     }
 843     SecureBootEnable = SECURE_BOOT_DISABLE;
 844     VariableDataSize = 0;
 845   }
 846
 847   Status = UpdateVariable (
 848              EFI_SECURE_BOOT_ENABLE_NAME,
 849              &gEfiSecureBootEnableDisableGuid,
 850              &SecureBootEnable,
 851              VariableDataSize,
 852              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 853              0,
 854              0,
 855              &Variable,
 856              NULL
 857              );
 858   return Status;
 859 }
 860
 861 /**
 862   Check input data form to make sure it is a valid EFI_SIGNATURE_LIST for PK/KEK/db/dbx/dbt variable.
 863
 864   @param[in]  VariableName                Name of Variable to be check.
 865   @param[in]  VendorGuid                  Variable vendor GUID.
 866   @param[in]  Data                        Point to the variable data to be checked.
 867   @param[in]  DataSize                    Size of Data.
 868
 869   @return EFI_INVALID_PARAMETER           Invalid signature list format.
 870   @return EFI_SUCCESS                     Passed signature list format check successfully.
 871
 872 **/
 873 EFI_STATUS
 874 CheckSignatureListFormat(
 875   IN  CHAR16                    *VariableName,
 876   IN  EFI_GUID                  *VendorGuid,
 877   IN  VOID                      *Data,
 878   IN  UINTN                     DataSize
 879   )
 880 {
 881   EFI_SIGNATURE_LIST     *SigList;
 882   UINTN                  SigDataSize;
 883   UINT32                 Index;
 884   UINT32                 SigCount;
 885   BOOLEAN                IsPk;
 886   VOID                   *RsaContext;
 887   EFI_SIGNATURE_DATA     *CertData;
 888   UINTN                  CertLen;
 889
 890   if (DataSize == 0) {
 891     return EFI_SUCCESS;
 892   }
 893
 894   ASSERT (VariableName != NULL && VendorGuid != NULL && Data != NULL);
 895
 896   if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_PLATFORM_KEY_NAME) == 0)){
 897     IsPk = TRUE;
 898   } else if ((CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0)) ||
 899              (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&
 900              ((StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0) || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0) ||
 901               (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0)))) {
 902     IsPk = FALSE;
 903   } else {
 904     return EFI_SUCCESS;
 905   }
 906
 907   SigCount = 0;
 908   SigList  = (EFI_SIGNATURE_LIST *) Data;
 909   SigDataSize  = DataSize;
 910   RsaContext = NULL;
 911
 912   //
 913   // Walk throuth the input signature list and check the data format.
 914   // If any signature is incorrectly formed, the whole check will fail.
 915   //
 916   while ((SigDataSize > 0) && (SigDataSize >= SigList->SignatureListSize)) {
 917     for (Index = 0; Index < (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM)); Index++ ) {
 918       if (CompareGuid (&SigList->SignatureType, &mSupportSigItem[Index].SigType)) {
 919         //
 920         // The value of SignatureSize should always be 16 (size of SignatureOwner
 921         // component) add the data length according to signature type.
 922         //
 923         if (mSupportSigItem[Index].SigDataSize != ((UINT32) ~0) &&
 924           (SigList->SignatureSize - sizeof (EFI_GUID)) != mSupportSigItem[Index].SigDataSize) {
 925           return EFI_INVALID_PARAMETER;
 926         }
 927         if (mSupportSigItem[Index].SigHeaderSize != ((UINTN) ~0) &&
 928           SigList->SignatureHeaderSize != mSupportSigItem[Index].SigHeaderSize) {
 929           return EFI_INVALID_PARAMETER;
 930         }
 931         break;
 932       }
 933     }
 934
 935     if (Index == (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM))) {
 936       //
 937       // Undefined signature type.
 938       //
 939       return EFI_INVALID_PARAMETER;
 940     }
 941
 942     if (CompareGuid (&SigList->SignatureType, &gEfiCertX509Guid)) {
 943       //
 944       // Try to retrieve the RSA public key from the X.509 certificate.
 945       // If this operation fails, it's not a valid certificate.
 946       //
 947       RsaContext = RsaNew ();
 948       if (RsaContext == NULL) {
 949         return EFI_INVALID_PARAMETER;
 950       }
 951       CertData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigList + sizeof (EFI_SIGNATURE_LIST) + SigList->SignatureHeaderSize);
 952       CertLen = SigList->SignatureSize - sizeof (EFI_GUID);
 953       if (!RsaGetPublicKeyFromX509 (CertData->SignatureData, CertLen, &RsaContext)) {
 954         RsaFree (RsaContext);
 955         return EFI_INVALID_PARAMETER;
 956       }
 957       RsaFree (RsaContext);
 958     }
 959
 960     if ((SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) % SigList->SignatureSize != 0) {
 961       return EFI_INVALID_PARAMETER;
 962     }
 963     SigCount += (SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) / SigList->SignatureSize;
 964
 965     SigDataSize -= SigList->SignatureListSize;
 966     SigList = (EFI_SIGNATURE_LIST *) ((UINT8 *) SigList + SigList->SignatureListSize);
 967   }
 968
 969   if (((UINTN) SigList - (UINTN) Data) != DataSize) {
 970     return EFI_INVALID_PARAMETER;
 971   }
 972
 973   if (IsPk && SigCount > 1) {
 974     return EFI_INVALID_PARAMETER;
 975   }
 976
 977   return EFI_SUCCESS;
 978 }
 979
 980 /**
 981   Update "VendorKeys" variable to record the out of band secure boot key modification.
 982
 983   @return EFI_SUCCESS           Variable is updated successfully.
 984   @return Others                Failed to update variable.
 985
 986 **/
 987 EFI_STATUS
 988 VendorKeyIsModified (
 989   VOID
 990   )
 991 {
 992   EFI_STATUS              Status;
 993   VARIABLE_POINTER_TRACK  Variable;
 994
 995   if (mVendorKeyState == VENDOR_KEYS_MODIFIED) {
 996     return EFI_SUCCESS;
 997   }
 998   mVendorKeyState = VENDOR_KEYS_MODIFIED;
 999
1000   FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
1001   Status = UpdateVariable (
1002              EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
1003              &gEfiVendorKeysNvGuid,
1004              &mVendorKeyState,
1005              sizeof (UINT8),
1006              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS,
1007              0,
1008              0,
1009              &Variable,
1010              NULL
1011              );
1012   if (EFI_ERROR (Status)) {
1013     return Status;
1014   }
1015
1016   FindVariable (EFI_VENDOR_KEYS_VARIABLE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
1017   return UpdateVariable (
1018            EFI_VENDOR_KEYS_VARIABLE_NAME,
1019            &gEfiGlobalVariableGuid,
1020            &mVendorKeyState,
1021            sizeof (UINT8),
1022            EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
1023            0,
1024            0,
1025            &Variable,
1026            NULL
1027            );
1028 }
1029
1030 /**
1031   Process variable with platform key for verification.
1032
1033   Caution: This function may receive untrusted input.
1034   This function may be invoked in SMM mode, and datasize and data are external input.
1035   This function will do basic validation, before parse the data.
1036   This function will parse the authentication carefully to avoid security issues, like
1037   buffer overflow, integer overflow.
1038   This function will check attribute carefully to avoid authentication bypass.
1039
1040   @param[in]  VariableName                Name of Variable to be found.
1041   @param[in]  VendorGuid                  Variable vendor GUID.
1042   @param[in]  Data                        Data pointer.
1043   @param[in]  DataSize                    Size of Data found. If size is less than the
1044                                           data, this value contains the required size.
1045   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1046   @param[in]  Attributes                  Attribute value of the variable
1047   @param[in]  IsPk                        Indicate whether it is to process pk.
1048
1049   @return EFI_INVALID_PARAMETER           Invalid parameter.
1050   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation.
1051                                           check carried out by the firmware.
1052   @return EFI_SUCCESS                     Variable passed validation successfully.
1053
1054 **/
1055 EFI_STATUS
1056 ProcessVarWithPk (
1057   IN  CHAR16                    *VariableName,
1058   IN  EFI_GUID                  *VendorGuid,
1059   IN  VOID                      *Data,
1060   IN  UINTN                     DataSize,
1061   IN  VARIABLE_POINTER_TRACK    *Variable,
1062   IN  UINT32                    Attributes OPTIONAL,
1063   IN  BOOLEAN                   IsPk
1064   )
1065 {
1066   EFI_STATUS                  Status;
1067   BOOLEAN                     Del;
1068   UINT8                       *Payload;
1069   UINTN                       PayloadSize;
1070
1071   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1072       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1073     //
1074     // PK, KEK and db/dbx/dbt should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1075     // authenticated variable.
1076     //
1077     return EFI_INVALID_PARAMETER;
1078   }
1079
1080   Del = FALSE;
1081   if ((InCustomMode() && UserPhysicalPresent()) || (mPlatformMode == SETUP_MODE && !IsPk)) {
1082     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1083     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1084     if (PayloadSize == 0) {
1085       Del = TRUE;
1086     }
1087
1088     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
1089     if (EFI_ERROR (Status)) {
1090       return Status;
1091     }
1092
1093     Status = UpdateVariable (
1094                VariableName,
1095                VendorGuid,
1096                Payload,
1097                PayloadSize,
1098                Attributes,
1099                0,
1100                0,
1101                Variable,
1102                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1103                );
1104     if (EFI_ERROR(Status)) {
1105       return Status;
1106     }
1107
1108     if ((mPlatformMode != SETUP_MODE) || IsPk) {
1109       Status = VendorKeyIsModified ();
1110     }
1111   } else if (mPlatformMode == USER_MODE) {
1112     //
1113     // Verify against X509 Cert in PK database.
1114     //
1115     Status = VerifyTimeBasedPayload (
1116                VariableName,
1117                VendorGuid,
1118                Data,
1119                DataSize,
1120                Variable,
1121                Attributes,
1122                AuthVarTypePk,
1123                &Del
1124                );
1125   } else {
1126     //
1127     // Verify against the certificate in data payload.
1128     //
1129     Status = VerifyTimeBasedPayload (
1130                VariableName,
1131                VendorGuid,
1132                Data,
1133                DataSize,
1134                Variable,
1135                Attributes,
1136                AuthVarTypePayload,
1137                &Del
1138                );
1139   }
1140
1141   if (!EFI_ERROR(Status) && IsPk) {
1142     if (mPlatformMode == SETUP_MODE && !Del) {
1143       //
1144       // If enroll PK in setup mode, need change to user mode.
1145       //
1146       Status = UpdatePlatformMode (USER_MODE);
1147     } else if (mPlatformMode == USER_MODE && Del){
1148       //
1149       // If delete PK in user mode, need change to setup mode.
1150       //
1151       Status = UpdatePlatformMode (SETUP_MODE);
1152     }
1153   }
1154
1155   return Status;
1156 }
1157
1158 /**
1159   Process variable with key exchange key for verification.
1160
1161   Caution: This function may receive untrusted input.
1162   This function may be invoked in SMM mode, and datasize and data are external input.
1163   This function will do basic validation, before parse the data.
1164   This function will parse the authentication carefully to avoid security issues, like
1165   buffer overflow, integer overflow.
1166   This function will check attribute carefully to avoid authentication bypass.
1167
1168   @param[in]  VariableName                Name of Variable to be found.
1169   @param[in]  VendorGuid                  Variable vendor GUID.
1170   @param[in]  Data                        Data pointer.
1171   @param[in]  DataSize                    Size of Data found. If size is less than the
1172                                           data, this value contains the required size.
1173   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1174   @param[in]  Attributes                  Attribute value of the variable.
1175
1176   @return EFI_INVALID_PARAMETER           Invalid parameter.
1177   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
1178                                           check carried out by the firmware.
1179   @return EFI_SUCCESS                     Variable pass validation successfully.
1180
1181 **/
1182 EFI_STATUS
1183 ProcessVarWithKek (
1184   IN  CHAR16                               *VariableName,
1185   IN  EFI_GUID                             *VendorGuid,
1186   IN  VOID                                 *Data,
1187   IN  UINTN                                DataSize,
1188   IN  VARIABLE_POINTER_TRACK               *Variable,
1189   IN  UINT32                               Attributes OPTIONAL
1190   )
1191 {
1192   EFI_STATUS                      Status;
1193   UINT8                           *Payload;
1194   UINTN                           PayloadSize;
1195
1196   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1197       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1198     //
1199     // DB, DBX and DBT should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1200     // authenticated variable.
1201     //
1202     return EFI_INVALID_PARAMETER;
1203   }
1204
1205   Status = EFI_SUCCESS;
1206   if (mPlatformMode == USER_MODE && !(InCustomMode() && UserPhysicalPresent())) {
1207     //
1208     // Time-based, verify against X509 Cert KEK.
1209     //
1210     return VerifyTimeBasedPayload (
1211              VariableName,
1212              VendorGuid,
1213              Data,
1214              DataSize,
1215              Variable,
1216              Attributes,
1217              AuthVarTypeKek,
1218              NULL
1219              );
1220   } else {
1221     //
1222     // If in setup mode or custom secure boot mode, no authentication needed.
1223     //
1224     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1225     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1226
1227     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
1228     if (EFI_ERROR (Status)) {
1229       return Status;
1230     }
1231
1232     Status = UpdateVariable (
1233                VariableName,
1234                VendorGuid,
1235                Payload,
1236                PayloadSize,
1237                Attributes,
1238                0,
1239                0,
1240                Variable,
1241                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1242                );
1243     if (EFI_ERROR (Status)) {
1244       return Status;
1245     }
1246
1247     if (mPlatformMode != SETUP_MODE) {
1248       Status = VendorKeyIsModified ();
1249     }
1250   }
1251
1252   return Status;
1253 }
1254
1255 /**
1256   Check if it is to delete auth variable.
1257
1258   @param[in] Data               Data pointer.
1259   @param[in] DataSize           Size of Data.
1260   @param[in] Variable           The variable information which is used to keep track of variable usage.
1261   @param[in] Attributes         Attribute value of the variable.
1262
1263   @retval TRUE                  It is to delete auth variable.
1264   @retval FALSE                 It is not to delete auth variable.
1265
1266 **/
1267 BOOLEAN
1268 IsDeleteAuthVariable (
1269   IN  VOID                      *Data,
1270   IN  UINTN                     DataSize,
1271   IN  VARIABLE_POINTER_TRACK    *Variable,
1272   IN  UINT32                    Attributes
1273   )
1274 {
1275   BOOLEAN                       Del;
1276   UINTN                         PayloadSize;
1277
1278   Del = FALSE;
1279
1280   //
1281   // To delete a variable created with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
1282   // or the EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS attribute,
1283   // SetVariable must be used with attributes matching the existing variable
1284   // and the DataSize set to the size of the AuthInfo descriptor.
1285   //
1286   if ((Variable->CurrPtr != NULL) &&
1287       (Attributes == Variable->CurrPtr->Attributes) &&
1288       ((Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)) {
1289     if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1290       PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1291       if (PayloadSize == 0) {
1292         Del = TRUE;
1293       }
1294     } else {
1295       PayloadSize = DataSize - AUTHINFO_SIZE;
1296       if (PayloadSize == 0) {
1297         Del = TRUE;
1298       }
1299     }
1300   }
1301
1302   return Del;
1303 }
1304
1305 /**
1306   Process variable with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS/EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
1307
1308   Caution: This function may receive untrusted input.
1309   This function may be invoked in SMM mode, and datasize and data are external input.
1310   This function will do basic validation, before parse the data.
1311   This function will parse the authentication carefully to avoid security issues, like
1312   buffer overflow, integer overflow.
1313   This function will check attribute carefully to avoid authentication bypass.
1314
1315   @param[in]  VariableName                Name of Variable to be found.
1316   @param[in]  VendorGuid                  Variable vendor GUID.
1317
1318   @param[in]  Data                        Data pointer.
1319   @param[in]  DataSize                    Size of Data.
1320   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1321   @param[in]  Attributes                  Attribute value of the variable.
1322
1323   @return EFI_INVALID_PARAMETER           Invalid parameter.
1324   @return EFI_WRITE_PROTECTED             Variable is write-protected and needs authentication with
1325                                           EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1326   @return EFI_OUT_OF_RESOURCES            The Database to save the public key is full.
1327   @return EFI_SECURITY_VIOLATION          The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
1328                                           set, but the AuthInfo does NOT pass the validation
1329                                           check carried out by the firmware.
1330   @return EFI_SUCCESS                     Variable is not write-protected or pass validation successfully.
1331
1332 **/
1333 EFI_STATUS
1334 ProcessVariable (
1335   IN     CHAR16                             *VariableName,
1336   IN     EFI_GUID                           *VendorGuid,
1337   IN     VOID                               *Data,
1338   IN     UINTN                              DataSize,
1339   IN     VARIABLE_POINTER_TRACK             *Variable,
1340   IN     UINT32                             Attributes
1341   )
1342 {
1343   EFI_STATUS                      Status;
1344   BOOLEAN                         IsDeletion;
1345   BOOLEAN                         IsFirstTime;
1346   UINT8                           *PubKey;
1347   EFI_VARIABLE_AUTHENTICATION     *CertData;
1348   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
1349   UINT32                          KeyIndex;
1350   UINT64                          MonotonicCount;
1351   VARIABLE_ENTRY_CONSISTENCY      VariableDataEntry;
1352
1353   KeyIndex    = 0;
1354   CertData    = NULL;
1355   CertBlock   = NULL;
1356   PubKey      = NULL;
1357   IsDeletion  = FALSE;
1358   Status      = EFI_SUCCESS;
1359
1360   if (IsDeleteAuthVariable (Data, DataSize, Variable, Attributes) && UserPhysicalPresent()) {
1361     //
1362     // Allow the delete operation of common authenticated variable at user physical presence.
1363     //
1364     if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1365       Status = DeleteCertsFromDb (VariableName, VendorGuid);
1366     }
1367     if (!EFI_ERROR (Status)) {
1368       Status = UpdateVariable (
1369                  VariableName,
1370                  VendorGuid,
1371                  NULL,
1372                  0,
1373                  0,
1374                  0,
1375                  0,
1376                  Variable,
1377                  NULL
1378                  );
1379     }
1380     return Status;
1381   }
1382
1383   if (NeedPhysicallyPresent (VariableName, VendorGuid) && !UserPhysicalPresent()) {
1384     //
1385     // This variable is protected, only physical present user could modify its value.
1386     //
1387     return EFI_SECURITY_VIOLATION;
1388   }
1389
1390   //
1391   // A time-based authenticated variable and a count-based authenticated variable
1392   // can't be updated by each other.
1393   //
1394   if (Variable->CurrPtr != NULL) {
1395     if (((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) &&
1396         ((Variable->CurrPtr->Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0)) {
1397       return EFI_SECURITY_VIOLATION;
1398     }
1399
1400     if (((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) &&
1401         ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0)) {
1402       return EFI_SECURITY_VIOLATION;
1403     }
1404   }
1405
1406   //
1407   // Process Time-based Authenticated variable.
1408   //
1409   if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1410     return VerifyTimeBasedPayload (
1411              VariableName,
1412              VendorGuid,
1413              Data,
1414              DataSize,
1415              Variable,
1416              Attributes,
1417              AuthVarTypePriv,
1418              NULL
1419              );
1420   }
1421
1422   //
1423   // Determine if first time SetVariable with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS.
1424   //
1425   if ((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) {
1426     //
1427     // Determine current operation type.
1428     //
1429     if (DataSize == AUTHINFO_SIZE) {
1430       IsDeletion = TRUE;
1431     }
1432     //
1433     // Determine whether this is the first time with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1434     //
1435     if (Variable->CurrPtr == NULL) {
1436       IsFirstTime = TRUE;
1437     } else if ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) == 0) {
1438       IsFirstTime = TRUE;
1439     } else {
1440       KeyIndex   = Variable->CurrPtr->PubKeyIndex;
1441       IsFirstTime = FALSE;
1442     }
1443   } else if ((Variable->CurrPtr != NULL) &&
1444              ((Variable->CurrPtr->Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)
1445             ) {
1446     //
1447     // If the variable is already write-protected, it always needs authentication before update.
1448     //
1449     return EFI_WRITE_PROTECTED;
1450   } else {
1451     //
1452     // If without EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS, set and attributes collision.
1453     // That means it is not authenticated variable, just update variable as usual.
1454     //
1455     Status = UpdateVariable (VariableName, VendorGuid, Data, DataSize, Attributes, 0, 0, Variable, NULL);
1456     return Status;
1457   }
1458
1459   //
1460   // Get PubKey and check Monotonic Count value corresponding to the variable.
1461   //
1462   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
1463   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
1464   PubKey    = CertBlock->PublicKey;
1465
1466   //
1467   // Update Monotonic Count value.
1468   //
1469   MonotonicCount = CertData->MonotonicCount;
1470
1471   if (!IsFirstTime) {
1472     //
1473     // 2 cases need to check here
1474     //   1. Internal PubKey variable. PubKeyIndex is always 0
1475     //   2. Other counter-based AuthVariable. Check input PubKey.
1476     //
1477     if (KeyIndex == 0 || CompareMem (PubKey, mPubKeyStore + (KeyIndex - 1) * EFI_CERT_TYPE_RSA2048_SIZE, EFI_CERT_TYPE_RSA2048_SIZE) != 0) {
1478       return EFI_SECURITY_VIOLATION;
1479     }
1480     //
1481     // Compare the current monotonic count and ensure that it is greater than the last SetVariable
1482     // operation with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS attribute set.
1483     //
1484     if (CertData->MonotonicCount <= Variable->CurrPtr->MonotonicCount) {
1485       //
1486       // Monotonic count check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
1487       //
1488       return EFI_SECURITY_VIOLATION;
1489     }
1490   }
1491   //
1492   // Verify the certificate in Data payload.
1493   //
1494   Status = VerifyCounterBasedPayload (Data, DataSize, PubKey);
1495   if (EFI_ERROR (Status)) {
1496     return Status;
1497   }
1498
1499   //
1500   // Now, the signature has been verified!
1501   //
1502   if (IsFirstTime && !IsDeletion) {
1503     VariableDataEntry.VariableSize = DataSize - AUTHINFO_SIZE;
1504     VariableDataEntry.Guid         = VendorGuid;
1505     VariableDataEntry.Name         = VariableName;
1506
1507     //
1508     // Update public key database variable if need.
1509     //
1510     KeyIndex = AddPubKeyInStore (PubKey, &VariableDataEntry);
1511     if (KeyIndex == 0) {
1512       return EFI_OUT_OF_RESOURCES;
1513     }
1514   }
1515
1516   //
1517   // Verification pass.
1518   //
1519   return UpdateVariable (VariableName, VendorGuid, (UINT8*)Data + AUTHINFO_SIZE, DataSize - AUTHINFO_SIZE, Attributes, KeyIndex, MonotonicCount, Variable, NULL);
1520 }
1521
1522 /**
1523   Merge two buffers which formatted as EFI_SIGNATURE_LIST. Only the new EFI_SIGNATURE_DATA
1524   will be appended to the original EFI_SIGNATURE_LIST, duplicate EFI_SIGNATURE_DATA
1525   will be ignored.
1526
1527   @param[in, out]  Data              Pointer to original EFI_SIGNATURE_LIST.
1528   @param[in]       DataSize          Size of Data buffer.
1529   @param[in]       FreeBufSize       Size of free data buffer
1530   @param[in]       NewData           Pointer to new EFI_SIGNATURE_LIST to be appended.
1531   @param[in]       NewDataSize       Size of NewData buffer.
1532   @param[out]      MergedBufSize     Size of the merged buffer
1533
1534   @return EFI_BUFFER_TOO_SMALL if input Data buffer overflowed
1535
1536 **/
1537 EFI_STATUS
1538 AppendSignatureList (
1539   IN  OUT VOID            *Data,
1540   IN  UINTN               DataSize,
1541   IN  UINTN               FreeBufSize,
1542   IN  VOID                *NewData,
1543   IN  UINTN               NewDataSize,
1544   OUT UINTN               *MergedBufSize
1545   )
1546 {
1547   EFI_SIGNATURE_LIST  *CertList;
1548   EFI_SIGNATURE_DATA  *Cert;
1549   UINTN               CertCount;
1550   EFI_SIGNATURE_LIST  *NewCertList;
1551   EFI_SIGNATURE_DATA  *NewCert;
1552   UINTN               NewCertCount;
1553   UINTN               Index;
1554   UINTN               Index2;
1555   UINTN               Size;
1556   UINT8               *Tail;
1557   UINTN               CopiedCount;
1558   UINTN               SignatureListSize;
1559   BOOLEAN             IsNewCert;
1560
1561   Tail = (UINT8 *) Data + DataSize;
1562
1563   NewCertList = (EFI_SIGNATURE_LIST *) NewData;
1564   while ((NewDataSize > 0) && (NewDataSize >= NewCertList->SignatureListSize)) {
1565     NewCert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCertList + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1566     NewCertCount = (NewCertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - NewCertList->SignatureHeaderSize) / NewCertList->SignatureSize;
1567
1568     CopiedCount = 0;
1569     for (Index = 0; Index < NewCertCount; Index++) {
1570       IsNewCert = TRUE;
1571
1572       Size = DataSize;
1573       CertList = (EFI_SIGNATURE_LIST *) Data;
1574       while ((Size > 0) && (Size >= CertList->SignatureListSize)) {
1575         if (CompareGuid (&CertList->SignatureType, &NewCertList->SignatureType) &&
1576            (CertList->SignatureSize == NewCertList->SignatureSize)) {
1577           Cert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
1578           CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
1579           for (Index2 = 0; Index2 < CertCount; Index2++) {
1580             //
1581             // Iterate each Signature Data in this Signature List.
1582             //
1583             if (CompareMem (NewCert, Cert, CertList->SignatureSize) == 0) {
1584               IsNewCert = FALSE;
1585               break;
1586             }
1587             Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
1588           }
1589         }
1590
1591         if (!IsNewCert) {
1592           break;
1593         }
1594         Size -= CertList->SignatureListSize;
1595         CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
1596       }
1597
1598       if (IsNewCert) {
1599         //
1600         // New EFI_SIGNATURE_DATA, append it.
1601         //
1602         if (CopiedCount == 0) {
1603           if (FreeBufSize < sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize) {
1604             return EFI_BUFFER_TOO_SMALL;
1605           }
1606
1607           //
1608           // Copy EFI_SIGNATURE_LIST header for only once.
1609           //
1610
1611           CopyMem (Tail, NewCertList, sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1612           Tail = Tail + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1613           FreeBufSize -= sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1614         }
1615
1616         if (FreeBufSize < NewCertList->SignatureSize) {
1617           return EFI_BUFFER_TOO_SMALL;
1618         }
1619         CopyMem (Tail, NewCert, NewCertList->SignatureSize);
1620         Tail += NewCertList->SignatureSize;
1621         FreeBufSize -= NewCertList->SignatureSize;
1622         CopiedCount++;
1623       }
1624
1625       NewCert = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCert + NewCertList->SignatureSize);
1626     }
1627
1628     //
1629     // Update SignatureListSize in newly appended EFI_SIGNATURE_LIST.
1630     //
1631     if (CopiedCount != 0) {
1632       SignatureListSize = sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize + (CopiedCount * NewCertList->SignatureSize);
1633       CertList = (EFI_SIGNATURE_LIST *) (Tail - SignatureListSize);
1634       CertList->SignatureListSize = (UINT32) SignatureListSize;
1635     }
1636
1637     NewDataSize -= NewCertList->SignatureListSize;
1638     NewCertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) NewCertList + NewCertList->SignatureListSize);
1639   }
1640
1641   *MergedBufSize = (Tail - (UINT8 *) Data);
1642   return EFI_SUCCESS;
1643 }
1644
1645 /**
1646   Compare two EFI_TIME data.
1647
1648
1649   @param FirstTime           A pointer to the first EFI_TIME data.
1650   @param SecondTime          A pointer to the second EFI_TIME data.
1651
1652   @retval  TRUE              The FirstTime is not later than the SecondTime.
1653   @retval  FALSE             The FirstTime is later than the SecondTime.
1654
1655 **/
1656 BOOLEAN
1657 CompareTimeStamp (
1658   IN EFI_TIME               *FirstTime,
1659   IN EFI_TIME               *SecondTime
1660   )
1661 {
1662   if (FirstTime->Year != SecondTime->Year) {
1663     return (BOOLEAN) (FirstTime->Year < SecondTime->Year);
1664   } else if (FirstTime->Month != SecondTime->Month) {
1665     return (BOOLEAN) (FirstTime->Month < SecondTime->Month);
1666   } else if (FirstTime->Day != SecondTime->Day) {
1667     return (BOOLEAN) (FirstTime->Day < SecondTime->Day);
1668   } else if (FirstTime->Hour != SecondTime->Hour) {
1669     return (BOOLEAN) (FirstTime->Hour < SecondTime->Hour);
1670   } else if (FirstTime->Minute != SecondTime->Minute) {
1671     return (BOOLEAN) (FirstTime->Minute < SecondTime->Minute);
1672   }
1673
1674   return (BOOLEAN) (FirstTime->Second <= SecondTime->Second);
1675 }
1676
1677 /**
1678   Find matching signer's certificates for common authenticated variable
1679   by corresponding VariableName and VendorGuid from "certdb".
1680
1681   The data format of "certdb":
1682   //
1683   //     UINT32 CertDbListSize;
1684   // /// AUTH_CERT_DB_DATA Certs1[];
1685   // /// AUTH_CERT_DB_DATA Certs2[];
1686   // /// ...
1687   // /// AUTH_CERT_DB_DATA Certsn[];
1688   //
1689
1690   @param[in]  VariableName   Name of authenticated Variable.
1691   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1692   @param[in]  Data           Pointer to variable "certdb".
1693   @param[in]  DataSize       Size of variable "certdb".
1694   @param[out] CertOffset     Offset of matching CertData, from starting of Data.
1695   @param[out] CertDataSize   Length of CertData in bytes.
1696   @param[out] CertNodeOffset Offset of matching AUTH_CERT_DB_DATA , from
1697                              starting of Data.
1698   @param[out] CertNodeSize   Length of AUTH_CERT_DB_DATA in bytes.
1699
1700   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1701   @retval  EFI_NOT_FOUND         Fail to find matching certs.
1702   @retval  EFI_SUCCESS           Find matching certs and output parameters.
1703
1704 **/
1705 EFI_STATUS
1706 FindCertsFromDb (
1707   IN     CHAR16           *VariableName,
1708   IN     EFI_GUID         *VendorGuid,
1709   IN     UINT8            *Data,
1710   IN     UINTN            DataSize,
1711   OUT    UINT32           *CertOffset,    OPTIONAL
1712   OUT    UINT32           *CertDataSize,  OPTIONAL
1713   OUT    UINT32           *CertNodeOffset,OPTIONAL
1714   OUT    UINT32           *CertNodeSize   OPTIONAL
1715   )
1716 {
1717   UINT32                  Offset;
1718   AUTH_CERT_DB_DATA       *Ptr;
1719   UINT32                  CertSize;
1720   UINT32                  NameSize;
1721   UINT32                  NodeSize;
1722   UINT32                  CertDbListSize;
1723
1724   if ((VariableName == NULL) || (VendorGuid == NULL) || (Data == NULL)) {
1725     return EFI_INVALID_PARAMETER;
1726   }
1727
1728   //
1729   // Check whether DataSize matches recorded CertDbListSize.
1730   //
1731   if (DataSize < sizeof (UINT32)) {
1732     return EFI_INVALID_PARAMETER;
1733   }
1734
1735   CertDbListSize = ReadUnaligned32 ((UINT32 *) Data);
1736
1737   if (CertDbListSize != (UINT32) DataSize) {
1738     return EFI_INVALID_PARAMETER;
1739   }
1740
1741   Offset = sizeof (UINT32);
1742
1743   //
1744   // Get corresponding certificates by VendorGuid and VariableName.
1745   //
1746   while (Offset < (UINT32) DataSize) {
1747     Ptr = (AUTH_CERT_DB_DATA *) (Data + Offset);
1748     //
1749     // Check whether VendorGuid matches.
1750     //
1751     if (CompareGuid (&Ptr->VendorGuid, VendorGuid)) {
1752       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1753       NameSize = ReadUnaligned32 (&Ptr->NameSize);
1754       CertSize = ReadUnaligned32 (&Ptr->CertDataSize);
1755
1756       if (NodeSize != sizeof (EFI_GUID) + sizeof (UINT32) * 3 + CertSize +
1757           sizeof (CHAR16) * NameSize) {
1758         return EFI_INVALID_PARAMETER;
1759       }
1760
1761       Offset = Offset + sizeof (EFI_GUID) + sizeof (UINT32) * 3;
1762       //
1763       // Check whether VariableName matches.
1764       //
1765       if ((NameSize == StrLen (VariableName)) &&
1766           (CompareMem (Data + Offset, VariableName, NameSize * sizeof (CHAR16)) == 0)) {
1767         Offset = Offset + NameSize * sizeof (CHAR16);
1768
1769         if (CertOffset != NULL) {
1770           *CertOffset = Offset;
1771         }
1772
1773         if (CertDataSize != NULL) {
1774           *CertDataSize = CertSize;
1775         }
1776
1777         if (CertNodeOffset != NULL) {
1778           *CertNodeOffset = (UINT32) ((UINT8 *) Ptr - Data);
1779         }
1780
1781         if (CertNodeSize != NULL) {
1782           *CertNodeSize = NodeSize;
1783         }
1784
1785         return EFI_SUCCESS;
1786       } else {
1787         Offset = Offset + NameSize * sizeof (CHAR16) + CertSize;
1788       }
1789     } else {
1790       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1791       Offset   = Offset + NodeSize;
1792     }
1793   }
1794
1795   return EFI_NOT_FOUND;
1796 }
1797
1798 /**
1799   Retrieve signer's certificates for common authenticated variable
1800   by corresponding VariableName and VendorGuid from "certdb".
1801
1802   @param[in]  VariableName   Name of authenticated Variable.
1803   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1804   @param[out] CertData       Pointer to signer's certificates.
1805   @param[out] CertDataSize   Length of CertData in bytes.
1806
1807   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1808   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1809   @retval  EFI_SUCCESS           Get signer's certificates successfully.
1810
1811 **/
1812 EFI_STATUS
1813 GetCertsFromDb (
1814   IN     CHAR16           *VariableName,
1815   IN     EFI_GUID         *VendorGuid,
1816   OUT    UINT8            **CertData,
1817   OUT    UINT32           *CertDataSize
1818   )
1819 {
1820   VARIABLE_POINTER_TRACK  CertDbVariable;
1821   EFI_STATUS              Status;
1822   UINT8                   *Data;
1823   UINTN                   DataSize;
1824   UINT32                  CertOffset;
1825
1826   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL) || (CertDataSize == NULL)) {
1827     return EFI_INVALID_PARAMETER;
1828   }
1829
1830   //
1831   // Get variable "certdb".
1832   //
1833   Status = FindVariable (
1834              EFI_CERT_DB_NAME,
1835              &gEfiCertDbGuid,
1836              &CertDbVariable,
1837              &mVariableModuleGlobal->VariableGlobal,
1838              FALSE
1839              );
1840   if (EFI_ERROR (Status)) {
1841     return Status;
1842   }
1843
1844   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1845   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1846   if ((DataSize == 0) || (Data == NULL)) {
1847     ASSERT (FALSE);
1848     return EFI_NOT_FOUND;
1849   }
1850
1851   Status = FindCertsFromDb (
1852              VariableName,
1853              VendorGuid,
1854              Data,
1855              DataSize,
1856              &CertOffset,
1857              CertDataSize,
1858              NULL,
1859              NULL
1860              );
1861
1862   if (EFI_ERROR (Status)) {
1863     return Status;
1864   }
1865
1866   *CertData = Data + CertOffset;
1867   return EFI_SUCCESS;
1868 }
1869
1870 /**
1871   Delete matching signer's certificates when deleting common authenticated
1872   variable by corresponding VariableName and VendorGuid from "certdb".
1873
1874   @param[in]  VariableName   Name of authenticated Variable.
1875   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1876
1877   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1878   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1879   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
1880   @retval  EFI_SUCCESS           The operation is completed successfully.
1881
1882 **/
1883 EFI_STATUS
1884 DeleteCertsFromDb (
1885   IN     CHAR16           *VariableName,
1886   IN     EFI_GUID         *VendorGuid
1887   )
1888 {
1889   VARIABLE_POINTER_TRACK  CertDbVariable;
1890   EFI_STATUS              Status;
1891   UINT8                   *Data;
1892   UINTN                   DataSize;
1893   UINT32                  VarAttr;
1894   UINT32                  CertNodeOffset;
1895   UINT32                  CertNodeSize;
1896   UINT8                   *NewCertDb;
1897   UINT32                  NewCertDbSize;
1898
1899   if ((VariableName == NULL) || (VendorGuid == NULL)) {
1900     return EFI_INVALID_PARAMETER;
1901   }
1902
1903   //
1904   // Get variable "certdb".
1905   //
1906   Status = FindVariable (
1907              EFI_CERT_DB_NAME,
1908              &gEfiCertDbGuid,
1909              &CertDbVariable,
1910              &mVariableModuleGlobal->VariableGlobal,
1911              FALSE
1912              );
1913   if (EFI_ERROR (Status)) {
1914     return Status;
1915   }
1916
1917   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1918   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1919   if ((DataSize == 0) || (Data == NULL)) {
1920     ASSERT (FALSE);
1921     return EFI_NOT_FOUND;
1922   }
1923
1924   if (DataSize == sizeof (UINT32)) {
1925     //
1926     // There is no certs in certdb.
1927     //
1928     return EFI_SUCCESS;
1929   }
1930
1931   //
1932   // Get corresponding cert node from certdb.
1933   //
1934   Status = FindCertsFromDb (
1935              VariableName,
1936              VendorGuid,
1937              Data,
1938              DataSize,
1939              NULL,
1940              NULL,
1941              &CertNodeOffset,
1942              &CertNodeSize
1943              );
1944
1945   if (EFI_ERROR (Status)) {
1946     return Status;
1947   }
1948
1949   if (DataSize < (CertNodeOffset + CertNodeSize)) {
1950     return EFI_NOT_FOUND;
1951   }
1952
1953   //
1954   // Construct new data content of variable "certdb".
1955   //
1956   NewCertDbSize = (UINT32) DataSize - CertNodeSize;
1957   NewCertDb     = (UINT8*) mCertDbStore;
1958
1959   //
1960   // Copy the DB entries before deleting node.
1961   //
1962   CopyMem (NewCertDb, Data, CertNodeOffset);
1963   //
1964   // Update CertDbListSize.
1965   //
1966   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
1967   //
1968   // Copy the DB entries after deleting node.
1969   //
1970   if (DataSize > (CertNodeOffset + CertNodeSize)) {
1971     CopyMem (
1972       NewCertDb + CertNodeOffset,
1973       Data + CertNodeOffset + CertNodeSize,
1974       DataSize - CertNodeOffset - CertNodeSize
1975       );
1976   }
1977
1978   //
1979   // Set "certdb".
1980   //
1981   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
1982   Status   = UpdateVariable (
1983                EFI_CERT_DB_NAME,
1984                &gEfiCertDbGuid,
1985                NewCertDb,
1986                NewCertDbSize,
1987                VarAttr,
1988                0,
1989                0,
1990                &CertDbVariable,
1991                NULL
1992                );
1993
1994   return Status;
1995 }
1996
1997 /**
1998   Insert signer's certificates for common authenticated variable with VariableName
1999   and VendorGuid in AUTH_CERT_DB_DATA to "certdb".
2000
2001   @param[in]  VariableName   Name of authenticated Variable.
2002   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
2003   @param[in]  CertData       Pointer to signer's certificates.
2004   @param[in]  CertDataSize   Length of CertData in bytes.
2005
2006   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
2007   @retval  EFI_ACCESS_DENIED     An AUTH_CERT_DB_DATA entry with same VariableName
2008                                  and VendorGuid already exists.
2009   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
2010   @retval  EFI_SUCCESS           Insert an AUTH_CERT_DB_DATA entry to "certdb"
2011
2012 **/
2013 EFI_STATUS
2014 InsertCertsToDb (
2015   IN     CHAR16           *VariableName,
2016   IN     EFI_GUID         *VendorGuid,
2017   IN     UINT8            *CertData,
2018   IN     UINTN            CertDataSize
2019   )
2020 {
2021   VARIABLE_POINTER_TRACK  CertDbVariable;
2022   EFI_STATUS              Status;
2023   UINT8                   *Data;
2024   UINTN                   DataSize;
2025   UINT32                  VarAttr;
2026   UINT8                   *NewCertDb;
2027   UINT32                  NewCertDbSize;
2028   UINT32                  CertNodeSize;
2029   UINT32                  NameSize;
2030   AUTH_CERT_DB_DATA       *Ptr;
2031
2032   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL)) {
2033     return EFI_INVALID_PARAMETER;
2034   }
2035
2036   //
2037   // Get variable "certdb".
2038   //
2039   Status = FindVariable (
2040              EFI_CERT_DB_NAME,
2041              &gEfiCertDbGuid,
2042              &CertDbVariable,
2043              &mVariableModuleGlobal->VariableGlobal,
2044              FALSE
2045              );
2046   if (EFI_ERROR (Status)) {
2047     return Status;
2048   }
2049
2050   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
2051   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
2052   if ((DataSize == 0) || (Data == NULL)) {
2053     ASSERT (FALSE);
2054     return EFI_NOT_FOUND;
2055   }
2056
2057   //
2058   // Find whether matching cert node already exists in "certdb".
2059   // If yes return error.
2060   //
2061   Status = FindCertsFromDb (
2062              VariableName,
2063              VendorGuid,
2064              Data,
2065              DataSize,
2066              NULL,
2067              NULL,
2068              NULL,
2069              NULL
2070              );
2071
2072   if (!EFI_ERROR (Status)) {
2073     ASSERT (FALSE);
2074     return EFI_ACCESS_DENIED;
2075   }
2076
2077   //
2078   // Construct new data content of variable "certdb".
2079   //
2080   NameSize      = (UINT32) StrLen (VariableName);
2081   CertNodeSize  = sizeof (AUTH_CERT_DB_DATA) + (UINT32) CertDataSize + NameSize * sizeof (CHAR16);
2082   NewCertDbSize = (UINT32) DataSize + CertNodeSize;
2083   if (NewCertDbSize > mMaxCertDbSize) {
2084     return EFI_OUT_OF_RESOURCES;
2085   }
2086   NewCertDb     = (UINT8*) mCertDbStore;
2087
2088   //
2089   // Copy the DB entries before deleting node.
2090   //
2091   CopyMem (NewCertDb, Data, DataSize);
2092   //
2093   // Update CertDbListSize.
2094   //
2095   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
2096   //
2097   // Construct new cert node.
2098   //
2099   Ptr = (AUTH_CERT_DB_DATA *) (NewCertDb + DataSize);
2100   CopyGuid (&Ptr->VendorGuid, VendorGuid);
2101   CopyMem (&Ptr->CertNodeSize, &CertNodeSize, sizeof (UINT32));
2102   CopyMem (&Ptr->NameSize, &NameSize, sizeof (UINT32));
2103   CopyMem (&Ptr->CertDataSize, &CertDataSize, sizeof (UINT32));
2104
2105   CopyMem (
2106     (UINT8 *) Ptr + sizeof (AUTH_CERT_DB_DATA),
2107     VariableName,
2108     NameSize * sizeof (CHAR16)
2109     );
2110
2111   CopyMem (
2112     (UINT8 *) Ptr +  sizeof (AUTH_CERT_DB_DATA) + NameSize * sizeof (CHAR16),
2113     CertData,
2114     CertDataSize
2115     );
2116
2117   //
2118   // Set "certdb".
2119   //
2120   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
2121   Status   = UpdateVariable (
2122                EFI_CERT_DB_NAME,
2123                &gEfiCertDbGuid,
2124                NewCertDb,
2125                NewCertDbSize,
2126                VarAttr,
2127                0,
2128                0,
2129                &CertDbVariable,
2130                NULL
2131                );
2132
2133   return Status;
2134 }
2135
2136 /**
2137   Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
2138
2139   Caution: This function may receive untrusted input.
2140   This function may be invoked in SMM mode, and datasize and data are external input.
2141   This function will do basic validation, before parse the data.
2142   This function will parse the authentication carefully to avoid security issues, like
2143   buffer overflow, integer overflow.
2144
2145   @param[in]  VariableName                Name of Variable to be found.
2146   @param[in]  VendorGuid                  Variable vendor GUID.
2147   @param[in]  Data                        Data pointer.
2148   @param[in]  DataSize                    Size of Data found. If size is less than the
2149                                           data, this value contains the required size.
2150   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
2151   @param[in]  Attributes                  Attribute value of the variable.
2152   @param[in]  AuthVarType                 Verify against PK, KEK database, private database or certificate in data payload.
2153   @param[out] VarDel                      Delete the variable or not.
2154
2155   @retval EFI_INVALID_PARAMETER           Invalid parameter.
2156   @retval EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
2157                                           check carried out by the firmware.
2158   @retval EFI_OUT_OF_RESOURCES            Failed to process variable due to lack
2159                                           of resources.
2160   @retval EFI_SUCCESS                     Variable pass validation successfully.
2161
2162 **/
2163 EFI_STATUS
2164 VerifyTimeBasedPayload (
2165   IN     CHAR16                             *VariableName,
2166   IN     EFI_GUID                           *VendorGuid,
2167   IN     VOID                               *Data,
2168   IN     UINTN                              DataSize,
2169   IN     VARIABLE_POINTER_TRACK             *Variable,
2170   IN     UINT32                             Attributes,
2171   IN     AUTHVAR_TYPE                       AuthVarType,
2172   OUT    BOOLEAN                            *VarDel
2173   )
2174 {
2175   UINT8                            *RootCert;
2176   UINT8                            *SigData;
2177   UINT8                            *PayloadPtr;
2178   UINTN                            RootCertSize;
2179   UINTN                            Index;
2180   UINTN                            CertCount;
2181   UINTN                            PayloadSize;
2182   UINT32                           Attr;
2183   UINT32                           SigDataSize;
2184   UINT32                           KekDataSize;
2185   BOOLEAN                          VerifyStatus;
2186   EFI_STATUS                       Status;
2187   EFI_SIGNATURE_LIST               *CertList;
2188   EFI_SIGNATURE_DATA               *Cert;
2189   VARIABLE_POINTER_TRACK           KekVariable;
2190   EFI_VARIABLE_AUTHENTICATION_2    *CertData;
2191   UINT8                            *NewData;
2192   UINTN                            NewDataSize;
2193   VARIABLE_POINTER_TRACK           PkVariable;
2194   UINT8                            *Buffer;
2195   UINTN                            Length;
2196   UINT8                            *SignerCerts;
2197   UINTN                            CertStackSize;
2198   UINT8                            *CertsInCertDb;
2199   UINT32                           CertsSizeinDb;
2200
2201   VerifyStatus           = FALSE;
2202   CertData               = NULL;
2203   NewData                = NULL;
2204   Attr                   = Attributes;
2205   SignerCerts            = NULL;
2206   RootCert               = NULL;
2207   CertsInCertDb          = NULL;
2208
2209   //
2210   // When the attribute EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS is
2211   // set, then the Data buffer shall begin with an instance of a complete (and serialized)
2212   // EFI_VARIABLE_AUTHENTICATION_2 descriptor. The descriptor shall be followed by the new
2213   // variable value and DataSize shall reflect the combined size of the descriptor and the new
2214   // variable value. The authentication descriptor is not part of the variable data and is not
2215   // returned by subsequent calls to GetVariable().
2216   //
2217   CertData = (EFI_VARIABLE_AUTHENTICATION_2 *) Data;
2218
2219   //
2220   // Verify that Pad1, Nanosecond, TimeZone, Daylight and Pad2 components of the
2221   // TimeStamp value are set to zero.
2222   //
2223   if ((CertData->TimeStamp.Pad1 != 0) ||
2224       (CertData->TimeStamp.Nanosecond != 0) ||
2225       (CertData->TimeStamp.TimeZone != 0) ||
2226       (CertData->TimeStamp.Daylight != 0) ||
2227       (CertData->TimeStamp.Pad2 != 0)) {
2228     return EFI_SECURITY_VIOLATION;
2229   }
2230
2231   if ((Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
2232     if (CompareTimeStamp (&CertData->TimeStamp, &Variable->CurrPtr->TimeStamp)) {
2233       //
2234       // TimeStamp check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
2235       //
2236       return EFI_SECURITY_VIOLATION;
2237     }
2238   }
2239
2240   //
2241   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
2242   // Cert type should be EFI_CERT_TYPE_PKCS7_GUID.
2243   //
2244   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
2245       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertPkcs7Guid)) {
2246     //
2247     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
2248     //
2249     return EFI_SECURITY_VIOLATION;
2250   }
2251
2252   //
2253   // Find out Pkcs7 SignedData which follows the EFI_VARIABLE_AUTHENTICATION_2 descriptor.
2254   // AuthInfo.Hdr.dwLength is the length of the entire certificate, including the length of the header.
2255   //
2256   SigData = CertData->AuthInfo.CertData;
2257   SigDataSize = CertData->AuthInfo.Hdr.dwLength - (UINT32) (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData));
2258
2259   //
2260   // Find out the new data payload which follows Pkcs7 SignedData directly.
2261   //
2262   PayloadPtr = SigData + SigDataSize;
2263   PayloadSize = DataSize - OFFSET_OF_AUTHINFO2_CERT_DATA - (UINTN) SigDataSize;
2264
2265   //
2266   // Construct a serialization buffer of the values of the VariableName, VendorGuid and Attributes
2267   // parameters of the SetVariable() call and the TimeStamp component of the
2268   // EFI_VARIABLE_AUTHENTICATION_2 descriptor followed by the variable's new value
2269   // i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data)
2270   //
2271   NewDataSize = PayloadSize + sizeof (EFI_TIME) + sizeof (UINT32) +
2272                 sizeof (EFI_GUID) + StrSize (VariableName) - sizeof (CHAR16);
2273   //
2274   // Here is to reuse scratch data area(at the end of volatile variable store)
2275   // to reduce SMRAM consumption for SMM variable driver.
2276   // The scratch buffer is enough to hold the serialized data and safe to use,
2277   // because it will be used at here to do verification only first
2278   // and then used in UpdateVariable() for a time based auth variable set.
2279   //
2280   NewData = (UINT8 *) GetEndPointer ((VARIABLE_STORE_HEADER *) ((UINTN) mVariableModuleGlobal->VariableGlobal.VolatileVariableBase));
2281
2282   Buffer = NewData;
2283   Length = StrLen (VariableName) * sizeof (CHAR16);
2284   CopyMem (Buffer, VariableName, Length);
2285   Buffer += Length;
2286
2287   Length = sizeof (EFI_GUID);
2288   CopyMem (Buffer, VendorGuid, Length);
2289   Buffer += Length;
2290
2291   Length = sizeof (UINT32);
2292   CopyMem (Buffer, &Attr, Length);
2293   Buffer += Length;
2294
2295   Length = sizeof (EFI_TIME);
2296   CopyMem (Buffer, &CertData->TimeStamp, Length);
2297   Buffer += Length;
2298
2299   CopyMem (Buffer, PayloadPtr, PayloadSize);
2300
2301   if (AuthVarType == AuthVarTypePk) {
2302     //
2303     // Verify that the signature has been made with the current Platform Key (no chaining for PK).
2304     // First, get signer's certificates from SignedData.
2305     //
2306     VerifyStatus = Pkcs7GetSigners (
2307                      SigData,
2308                      SigDataSize,
2309                      &SignerCerts,
2310                      &CertStackSize,
2311                      &RootCert,
2312                      &RootCertSize
2313                      );
2314     if (!VerifyStatus) {
2315       goto Exit;
2316     }
2317
2318     //
2319     // Second, get the current platform key from variable. Check whether it's identical with signer's certificates
2320     // in SignedData. If not, return error immediately.
2321     //
2322     Status = FindVariable (
2323                EFI_PLATFORM_KEY_NAME,
2324                &gEfiGlobalVariableGuid,
2325                &PkVariable,
2326                &mVariableModuleGlobal->VariableGlobal,
2327                FALSE
2328                );
2329     if (EFI_ERROR (Status)) {
2330       VerifyStatus = FALSE;
2331       goto Exit;
2332     }
2333     CertList = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (PkVariable.CurrPtr);
2334     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2335     if ((RootCertSize != (CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1))) ||
2336         (CompareMem (Cert->SignatureData, RootCert, RootCertSize) != 0)) {
2337       VerifyStatus = FALSE;
2338       goto Exit;
2339     }
2340
2341     //
2342     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2343     //
2344     VerifyStatus = Pkcs7Verify (
2345                      SigData,
2346                      SigDataSize,
2347                      RootCert,
2348                      RootCertSize,
2349                      NewData,
2350                      NewDataSize
2351                      );
2352
2353   } else if (AuthVarType == AuthVarTypeKek) {
2354
2355     //
2356     // Get KEK database from variable.
2357     //
2358     Status = FindVariable (
2359                EFI_KEY_EXCHANGE_KEY_NAME,
2360                &gEfiGlobalVariableGuid,
2361                &KekVariable,
2362                &mVariableModuleGlobal->VariableGlobal,
2363                FALSE
2364                );
2365     if (EFI_ERROR (Status)) {
2366       return Status;
2367     }
2368
2369     //
2370     // Ready to verify Pkcs7 SignedData. Go through KEK Signature Database to find out X.509 CertList.
2371     //
2372     KekDataSize      = KekVariable.CurrPtr->DataSize;
2373     CertList         = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (KekVariable.CurrPtr);
2374     while ((KekDataSize > 0) && (KekDataSize >= CertList->SignatureListSize)) {
2375       if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {
2376         Cert       = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2377         CertCount  = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
2378         for (Index = 0; Index < CertCount; Index++) {
2379           //
2380           // Iterate each Signature Data Node within this CertList for a verify
2381           //
2382           RootCert      = Cert->SignatureData;
2383           RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2384
2385           //
2386           // Verify Pkcs7 SignedData via Pkcs7Verify library.
2387           //
2388           VerifyStatus = Pkcs7Verify (
2389                            SigData,
2390                            SigDataSize,
2391                            RootCert,
2392                            RootCertSize,
2393                            NewData,
2394                            NewDataSize
2395                            );
2396           if (VerifyStatus) {
2397             goto Exit;
2398           }
2399           Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
2400         }
2401       }
2402       KekDataSize -= CertList->SignatureListSize;
2403       CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
2404     }
2405   } else if (AuthVarType == AuthVarTypePriv) {
2406
2407     //
2408     // Process common authenticated variable except PK/KEK/DB/DBX/DBT.
2409     // Get signer's certificates from SignedData.
2410     //
2411     VerifyStatus = Pkcs7GetSigners (
2412                      SigData,
2413                      SigDataSize,
2414                      &SignerCerts,
2415                      &CertStackSize,
2416                      &RootCert,
2417                      &RootCertSize
2418                      );
2419     if (!VerifyStatus) {
2420       goto Exit;
2421     }
2422
2423     //
2424     // Get previously stored signer's certificates from certdb for existing
2425     // variable. Check whether they are identical with signer's certificates
2426     // in SignedData. If not, return error immediately.
2427     //
2428     if ((Variable->CurrPtr != NULL)) {
2429       VerifyStatus = FALSE;
2430
2431       Status = GetCertsFromDb (VariableName, VendorGuid, &CertsInCertDb, &CertsSizeinDb);
2432       if (EFI_ERROR (Status)) {
2433         goto Exit;
2434       }
2435
2436       if ((CertStackSize != CertsSizeinDb) ||
2437           (CompareMem (SignerCerts, CertsInCertDb, CertsSizeinDb) != 0)) {
2438         goto Exit;
2439       }
2440     }
2441
2442     VerifyStatus = Pkcs7Verify (
2443                      SigData,
2444                      SigDataSize,
2445                      RootCert,
2446                      RootCertSize,
2447                      NewData,
2448                      NewDataSize
2449                      );
2450     if (!VerifyStatus) {
2451       goto Exit;
2452     }
2453
2454     //
2455     // Delete signer's certificates when delete the common authenticated variable.
2456     //
2457     if ((PayloadSize == 0) && (Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
2458       Status = DeleteCertsFromDb (VariableName, VendorGuid);
2459       if (EFI_ERROR (Status)) {
2460         VerifyStatus = FALSE;
2461         goto Exit;
2462       }
2463     } else if (Variable->CurrPtr == NULL && PayloadSize != 0) {
2464       //
2465       // Insert signer's certificates when adding a new common authenticated variable.
2466       //
2467       Status = InsertCertsToDb (VariableName, VendorGuid, SignerCerts, CertStackSize);
2468       if (EFI_ERROR (Status)) {
2469         VerifyStatus = FALSE;
2470         goto Exit;
2471       }
2472     }
2473   } else if (AuthVarType == AuthVarTypePayload) {
2474     CertList = (EFI_SIGNATURE_LIST *) PayloadPtr;
2475     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2476     RootCert      = Cert->SignatureData;
2477     RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2478
2479     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2480     //
2481     VerifyStatus = Pkcs7Verify (
2482                      SigData,
2483                      SigDataSize,
2484                      RootCert,
2485                      RootCertSize,
2486                      NewData,
2487                      NewDataSize
2488                      );
2489   } else {
2490     return EFI_SECURITY_VIOLATION;
2491   }
2492
2493 Exit:
2494
2495   if (AuthVarType == AuthVarTypePk || AuthVarType == AuthVarTypePriv) {
2496     Pkcs7FreeSigners (RootCert);
2497     Pkcs7FreeSigners (SignerCerts);
2498   }
2499
2500   if (!VerifyStatus) {
2501     return EFI_SECURITY_VIOLATION;
2502   }
2503
2504   Status = CheckSignatureListFormat(VariableName, VendorGuid, PayloadPtr, PayloadSize);
2505   if (EFI_ERROR (Status)) {
2506     return Status;
2507   }
2508
2509   if ((PayloadSize == 0) && (VarDel != NULL)) {
2510     *VarDel = TRUE;
2511   }
2512
2513   //
2514   // Final step: Update/Append Variable if it pass Pkcs7Verify
2515   //
2516   return UpdateVariable (
2517            VariableName,
2518            VendorGuid,
2519            PayloadPtr,
2520            PayloadSize,
2521            Attributes,
2522            0,
2523            0,
2524            Variable,
2525            &CertData->TimeStamp
2526            );
2527 }