SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c

   1 /** @file
   2   Implement authentication services for the authenticated variable
   3   service in UEFI2.2.
   4
   5   Caution: This module requires additional review when modified.
   6   This driver will have external input - variable data. It may be input in SMM mode.
   7   This external input must be validated carefully to avoid security issue like
   8   buffer overflow, integer overflow.
   9   Variable attribute should also be checked to avoid authentication bypass.
  10
  11   ProcessVarWithPk(), ProcessVarWithKek() and ProcessVariable() are the function to do
  12   variable authentication.
  13
  14   VerifyTimeBasedPayload() and VerifyCounterBasedPayload() are sub function to do verification.
  15   They will do basic validation for authentication data structure, then call crypto library
  16   to verify the signature.
  17
  18 Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
  19 This program and the accompanying materials
  20 are licensed and made available under the terms and conditions of the BSD License
  21 which accompanies this distribution.  The full text of the license may be found at
  22 http://opensource.org/licenses/bsd-license.php
  23
  24 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  25 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  26
  27 **/
  28
  29 #include "Variable.h"
  30 #include "AuthService.h"
  31
  32 ///
  33 /// Global database array for scratch
  34 ///
  35 UINT8    mPubKeyStore[MAX_KEYDB_SIZE];
  36 UINT32   mPubKeyNumber;
  37 UINT8    mCertDbStore[MAX_CERTDB_SIZE];
  38 UINT32   mPlatformMode;
  39 UINT8    mVendorKeyState;
  40
  41 EFI_GUID mSignatureSupport[] = {EFI_CERT_SHA1_GUID, EFI_CERT_SHA256_GUID, EFI_CERT_RSA2048_GUID, EFI_CERT_X509_GUID};
  42 //
  43 // Public Exponent of RSA Key.
  44 //
  45 CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };
  46 //
  47 // Hash context pointer
  48 //
  49 VOID  *mHashCtx = NULL;
  50
  51 //
  52 // The serialization of the values of the VariableName, VendorGuid and Attributes
  53 // parameters of the SetVariable() call and the TimeStamp component of the
  54 // EFI_VARIABLE_AUTHENTICATION_2 descriptor followed by the variable's new value
  55 // i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data)
  56 //
  57 UINT8 *mSerializationRuntimeBuffer = NULL;
  58
  59 //
  60 // Requirement for different signature type which have been defined in UEFI spec.
  61 // These data are used to peform SignatureList format check while setting PK/KEK variable.
  62 //
  63 EFI_SIGNATURE_ITEM mSupportSigItem[] = {
  64 //{SigType,                       SigHeaderSize,   SigDataSize  }
  65   {EFI_CERT_SHA256_GUID,          0,               32           },
  66   {EFI_CERT_RSA2048_GUID,         0,               256          },
  67   {EFI_CERT_RSA2048_SHA256_GUID,  0,               256          },
  68   {EFI_CERT_SHA1_GUID,            0,               20           },
  69   {EFI_CERT_RSA2048_SHA1_GUID,    0,               256          },
  70   {EFI_CERT_X509_GUID,            0,               ((UINT32) ~0)},
  71   {EFI_CERT_SHA224_GUID,          0,               28           },
  72   {EFI_CERT_SHA384_GUID,          0,               48           },
  73   {EFI_CERT_SHA512_GUID,          0,               64           }
  74 };
  75
  76 /**
  77   Determine whether this operation needs a physical present user.
  78
  79   @param[in]      VariableName            Name of the Variable.
  80   @param[in]      VendorGuid              GUID of the Variable.
  81
  82   @retval TRUE      This variable is protected, only a physical present user could set this variable.
  83   @retval FALSE     This variable is not protected.
  84
  85 **/
  86 BOOLEAN
  87 NeedPhysicallyPresent(
  88   IN     CHAR16         *VariableName,
  89   IN     EFI_GUID       *VendorGuid
  90   )
  91 {
  92   if ((CompareGuid (VendorGuid, &gEfiSecureBootEnableDisableGuid) && (StrCmp (VariableName, EFI_SECURE_BOOT_ENABLE_NAME) == 0))
  93     || (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (VariableName, EFI_CUSTOM_MODE_NAME) == 0))) {
  94     return TRUE;
  95   }
  96
  97   return FALSE;
  98 }
  99
 100 /**
 101   Determine whether the platform is operating in Custom Secure Boot mode.
 102
 103   @retval TRUE           The platform is operating in Custom mode.
 104   @retval FALSE          The platform is operating in Standard mode.
 105
 106 **/
 107 BOOLEAN
 108 InCustomMode (
 109   VOID
 110   )
 111 {
 112   VARIABLE_POINTER_TRACK  Variable;
 113
 114   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 115   if (Variable.CurrPtr != NULL && *(GetVariableDataPtr (Variable.CurrPtr)) == CUSTOM_SECURE_BOOT_MODE) {
 116     return TRUE;
 117   }
 118
 119   return FALSE;
 120 }
 121
 122
 123 /**
 124   Internal function to delete a Variable given its name and GUID, no authentication
 125   required.
 126
 127   @param[in]      VariableName            Name of the Variable.
 128   @param[in]      VendorGuid              GUID of the Variable.
 129
 130   @retval EFI_SUCCESS              Variable deleted successfully.
 131   @retval Others                   The driver failded to start the device.
 132
 133 **/
 134 EFI_STATUS
 135 DeleteVariable (
 136   IN  CHAR16                    *VariableName,
 137   IN  EFI_GUID                  *VendorGuid
 138   )
 139 {
 140   EFI_STATUS              Status;
 141   VARIABLE_POINTER_TRACK  Variable;
 142
 143   Status = FindVariable (VariableName, VendorGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 144   if (EFI_ERROR (Status)) {
 145     return EFI_SUCCESS;
 146   }
 147
 148   ASSERT (Variable.CurrPtr != NULL);
 149   return UpdateVariable (VariableName, VendorGuid, NULL, 0, 0, 0, 0, &Variable, NULL);
 150 }
 151
 152 /**
 153   Initializes for authenticated varibale service.
 154
 155   @retval EFI_SUCCESS           Function successfully executed.
 156   @retval EFI_OUT_OF_RESOURCES  Fail to allocate enough memory resources.
 157
 158 **/
 159 EFI_STATUS
 160 AutenticatedVariableServiceInitialize (
 161   VOID
 162   )
 163 {
 164   EFI_STATUS              Status;
 165   VARIABLE_POINTER_TRACK  Variable;
 166   VARIABLE_POINTER_TRACK  PkVariable;
 167   UINT8                   VarValue;
 168   UINT32                  VarAttr;
 169   UINT8                   *Data;
 170   UINTN                   DataSize;
 171   UINTN                   CtxSize;
 172   UINT8                   SecureBootMode;
 173   UINT8                   SecureBootEnable;
 174   UINT8                   CustomMode;
 175   UINT32                  ListSize;
 176
 177   //
 178   // Initialize hash context.
 179   //
 180   CtxSize   = Sha256GetContextSize ();
 181   mHashCtx  = AllocateRuntimePool (CtxSize);
 182   if (mHashCtx == NULL) {
 183     return EFI_OUT_OF_RESOURCES;
 184   }
 185
 186   //
 187   // Prepare runtime buffer for serialized data of time-based authenticated
 188   // Variable, i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data).
 189   //
 190   mSerializationRuntimeBuffer = AllocateRuntimePool (PcdGet32 (PcdMaxVariableSize) + sizeof (EFI_GUID) + sizeof (UINT32) + sizeof (EFI_TIME));
 191   if (mSerializationRuntimeBuffer == NULL) {
 192     return EFI_OUT_OF_RESOURCES;
 193   }
 194
 195   //
 196   // Check "AuthVarKeyDatabase" variable's existence.
 197   // If it doesn't exist, create a new one with initial value of 0 and EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
 198   //
 199   Status = FindVariable (
 200              AUTHVAR_KEYDB_NAME,
 201              &gEfiAuthenticatedVariableGuid,
 202              &Variable,
 203              &mVariableModuleGlobal->VariableGlobal,
 204              FALSE
 205              );
 206
 207   if (Variable.CurrPtr == NULL) {
 208     VarAttr       = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 209     VarValue      = 0;
 210     mPubKeyNumber = 0;
 211     Status        = UpdateVariable (
 212                       AUTHVAR_KEYDB_NAME,
 213                       &gEfiAuthenticatedVariableGuid,
 214                       &VarValue,
 215                       sizeof(UINT8),
 216                       VarAttr,
 217                       0,
 218                       0,
 219                       &Variable,
 220                       NULL
 221                       );
 222     if (EFI_ERROR (Status)) {
 223       return Status;
 224     }
 225   } else {
 226     //
 227     // Load database in global variable for cache.
 228     //
 229     DataSize  = DataSizeOfVariable (Variable.CurrPtr);
 230     Data      = GetVariableDataPtr (Variable.CurrPtr);
 231     ASSERT ((DataSize != 0) && (Data != NULL));
 232     CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
 233     mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
 234   }
 235
 236   FindVariable (EFI_PLATFORM_KEY_NAME, &gEfiGlobalVariableGuid, &PkVariable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 237   if (PkVariable.CurrPtr == NULL) {
 238     DEBUG ((EFI_D_INFO, "Variable %s does not exist.\n", EFI_PLATFORM_KEY_NAME));
 239   } else {
 240     DEBUG ((EFI_D_INFO, "Variable %s exists.\n", EFI_PLATFORM_KEY_NAME));
 241   }
 242
 243   //
 244   // Create "SetupMode" variable with BS+RT attribute set.
 245   //
 246   FindVariable (EFI_SETUP_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 247   if (PkVariable.CurrPtr == NULL) {
 248     mPlatformMode = SETUP_MODE;
 249   } else {
 250     mPlatformMode = USER_MODE;
 251   }
 252   Status = UpdateVariable (
 253              EFI_SETUP_MODE_NAME,
 254              &gEfiGlobalVariableGuid,
 255              &mPlatformMode,
 256              sizeof(UINT8),
 257              EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 258              0,
 259              0,
 260              &Variable,
 261              NULL
 262              );
 263   if (EFI_ERROR (Status)) {
 264     return Status;
 265   }
 266
 267   //
 268   // Create "SignatureSupport" variable with BS+RT attribute set.
 269   //
 270   FindVariable (EFI_SIGNATURE_SUPPORT_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 271   Status  = UpdateVariable (
 272               EFI_SIGNATURE_SUPPORT_NAME,
 273               &gEfiGlobalVariableGuid,
 274               mSignatureSupport,
 275               sizeof(mSignatureSupport),
 276               EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 277               0,
 278               0,
 279               &Variable,
 280               NULL
 281               );
 282   if (EFI_ERROR (Status)) {
 283     return Status;
 284   }
 285
 286   //
 287   // If "SecureBootEnable" variable exists, then update "SecureBoot" variable.
 288   // If "SecureBootEnable" variable is SECURE_BOOT_ENABLE and in USER_MODE, Set "SecureBoot" variable to SECURE_BOOT_MODE_ENABLE.
 289   // If "SecureBootEnable" variable is SECURE_BOOT_DISABLE, Set "SecureBoot" variable to SECURE_BOOT_MODE_DISABLE.
 290   //
 291   SecureBootEnable = SECURE_BOOT_DISABLE;
 292   FindVariable (EFI_SECURE_BOOT_ENABLE_NAME, &gEfiSecureBootEnableDisableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 293   if (Variable.CurrPtr != NULL) {
 294     SecureBootEnable = *(GetVariableDataPtr (Variable.CurrPtr));
 295   } else if (mPlatformMode == USER_MODE) {
 296     //
 297     // "SecureBootEnable" not exist, initialize it in USER_MODE.
 298     //
 299     SecureBootEnable = SECURE_BOOT_ENABLE;
 300     Status = UpdateVariable (
 301                EFI_SECURE_BOOT_ENABLE_NAME,
 302                &gEfiSecureBootEnableDisableGuid,
 303                &SecureBootEnable,
 304                sizeof (UINT8),
 305                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 306                0,
 307                0,
 308                &Variable,
 309                NULL
 310                );
 311     if (EFI_ERROR (Status)) {
 312       return Status;
 313     }
 314   }
 315
 316   //
 317   // Create "SecureBoot" variable with BS+RT attribute set.
 318   //
 319   if (SecureBootEnable == SECURE_BOOT_ENABLE && mPlatformMode == USER_MODE) {
 320     SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 321   } else {
 322     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 323   }
 324   FindVariable (EFI_SECURE_BOOT_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 325   Status = UpdateVariable (
 326              EFI_SECURE_BOOT_MODE_NAME,
 327              &gEfiGlobalVariableGuid,
 328              &SecureBootMode,
 329              sizeof (UINT8),
 330              EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 331              0,
 332              0,
 333              &Variable,
 334              NULL
 335              );
 336   if (EFI_ERROR (Status)) {
 337     return Status;
 338   }
 339
 340   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SETUP_MODE_NAME, mPlatformMode));
 341   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_MODE_NAME, SecureBootMode));
 342   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_ENABLE_NAME, SecureBootEnable));
 343
 344   //
 345   // Initialize "CustomMode" in STANDARD_SECURE_BOOT_MODE state.
 346   //
 347   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 348   CustomMode = STANDARD_SECURE_BOOT_MODE;
 349   Status = UpdateVariable (
 350              EFI_CUSTOM_MODE_NAME,
 351              &gEfiCustomModeEnableGuid,
 352              &CustomMode,
 353              sizeof (UINT8),
 354              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 355              0,
 356              0,
 357              &Variable,
 358              NULL
 359              );
 360   if (EFI_ERROR (Status)) {
 361     return Status;
 362   }
 363
 364   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_CUSTOM_MODE_NAME, CustomMode));
 365
 366   //
 367   // Check "certdb" variable's existence.
 368   // If it doesn't exist, then create a new one with
 369   // EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.
 370   //
 371   Status = FindVariable (
 372              EFI_CERT_DB_NAME,
 373              &gEfiCertDbGuid,
 374              &Variable,
 375              &mVariableModuleGlobal->VariableGlobal,
 376              FALSE
 377              );
 378
 379   if (Variable.CurrPtr == NULL) {
 380     VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
 381     ListSize = sizeof (UINT32);
 382     Status   = UpdateVariable (
 383                  EFI_CERT_DB_NAME,
 384                  &gEfiCertDbGuid,
 385                  &ListSize,
 386                  sizeof (UINT32),
 387                  VarAttr,
 388                  0,
 389                  0,
 390                  &Variable,
 391                  NULL
 392                  );
 393     if (EFI_ERROR (Status)) {
 394       return Status;
 395     }
 396   }
 397
 398   //
 399   // Check "VendorKeysNv" variable's existence and create "VendorKeys" variable accordingly.
 400   //
 401   FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 402   if (Variable.CurrPtr != NULL) {
 403     mVendorKeyState = *(GetVariableDataPtr (Variable.CurrPtr));
 404   } else {
 405     //
 406     // "VendorKeysNv" not exist, initialize it in VENDOR_KEYS_VALID state.
 407     //
 408     mVendorKeyState = VENDOR_KEYS_VALID;
 409     Status = UpdateVariable (
 410                EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
 411                &gEfiVendorKeysNvGuid,
 412                &mVendorKeyState,
 413                sizeof (UINT8),
 414                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS,
 415                0,
 416                0,
 417                &Variable,
 418                NULL
 419                );
 420     if (EFI_ERROR (Status)) {
 421       return Status;
 422     }
 423   }
 424
 425   //
 426   // Create "VendorKeys" variable with BS+RT attribute set.
 427   //
 428   FindVariable (EFI_VENDOR_KEYS_VARIABLE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 429   Status = UpdateVariable (
 430              EFI_VENDOR_KEYS_VARIABLE_NAME,
 431              &gEfiGlobalVariableGuid,
 432              &mVendorKeyState,
 433              sizeof (UINT8),
 434              EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 435              0,
 436              0,
 437              &Variable,
 438              NULL
 439              );
 440   if (EFI_ERROR (Status)) {
 441     return Status;
 442   }
 443
 444   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_VENDOR_KEYS_VARIABLE_NAME, mVendorKeyState));
 445
 446   return Status;
 447 }
 448
 449 /**
 450   Add public key in store and return its index.
 451
 452   @param[in]  PubKey                  Input pointer to Public Key data
 453
 454   @return                             Index of new added item
 455
 456 **/
 457 UINT32
 458 AddPubKeyInStore (
 459   IN  UINT8               *PubKey
 460   )
 461 {
 462   EFI_STATUS              Status;
 463   BOOLEAN                 IsFound;
 464   UINT32                  Index;
 465   VARIABLE_POINTER_TRACK  Variable;
 466   UINT8                   *Ptr;
 467   UINT8                   *Data;
 468   UINTN                   DataSize;
 469
 470   if (PubKey == NULL) {
 471     return 0;
 472   }
 473
 474   Status = FindVariable (
 475              AUTHVAR_KEYDB_NAME,
 476              &gEfiAuthenticatedVariableGuid,
 477              &Variable,
 478              &mVariableModuleGlobal->VariableGlobal,
 479              FALSE
 480              );
 481   if (EFI_ERROR (Status)) {
 482     DEBUG ((EFI_D_ERROR, "Get public key database variable failure, Status = %r\n", Status));
 483     return 0;
 484   }
 485
 486   //
 487   // Check whether the public key entry does exist.
 488   //
 489   IsFound = FALSE;
 490   for (Ptr = mPubKeyStore, Index = 1; Index <= mPubKeyNumber; Index++) {
 491     if (CompareMem (Ptr, PubKey, EFI_CERT_TYPE_RSA2048_SIZE) == 0) {
 492       IsFound = TRUE;
 493       break;
 494     }
 495     Ptr += EFI_CERT_TYPE_RSA2048_SIZE;
 496   }
 497
 498   if (!IsFound) {
 499     //
 500     // Add public key in database.
 501     //
 502     if (mPubKeyNumber == MAX_KEY_NUM) {
 503       //
 504       // Public key dadatase is full, try to reclaim invalid key.
 505       //
 506       if (AtRuntime ()) {
 507         //
 508         // NV storage can't reclaim at runtime.
 509         //
 510         return 0;
 511       }
 512
 513       Status = Reclaim (
 514                  mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase,
 515                  &mVariableModuleGlobal->NonVolatileLastVariableOffset,
 516                  FALSE,
 517                  NULL,
 518                  NULL,
 519                  0,
 520                  TRUE
 521                  );
 522       if (EFI_ERROR (Status)) {
 523         return 0;
 524       }
 525
 526       Status = FindVariable (
 527                  AUTHVAR_KEYDB_NAME,
 528                  &gEfiAuthenticatedVariableGuid,
 529                  &Variable,
 530                  &mVariableModuleGlobal->VariableGlobal,
 531                  FALSE
 532                  );
 533       if (EFI_ERROR (Status)) {
 534         DEBUG ((EFI_D_ERROR, "Get public key database variable failure, Status = %r\n", Status));
 535         return 0;
 536       }
 537
 538       DataSize  = DataSizeOfVariable (Variable.CurrPtr);
 539       Data      = GetVariableDataPtr (Variable.CurrPtr);
 540       ASSERT ((DataSize != 0) && (Data != NULL));
 541       CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
 542       mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
 543
 544       if (mPubKeyNumber == MAX_KEY_NUM) {
 545         return 0;
 546       }
 547     }
 548
 549     CopyMem (mPubKeyStore + mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 550     Index = ++mPubKeyNumber;
 551     //
 552     // Update public key database variable.
 553     //
 554     Status = UpdateVariable (
 555                AUTHVAR_KEYDB_NAME,
 556                &gEfiAuthenticatedVariableGuid,
 557                mPubKeyStore,
 558                mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE,
 559                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS,
 560                0,
 561                0,
 562                &Variable,
 563                NULL
 564                );
 565     if (EFI_ERROR (Status)) {
 566       DEBUG ((EFI_D_ERROR, "Update public key database variable failure, Status = %r\n", Status));
 567       return 0;
 568     }
 569   }
 570
 571   return Index;
 572 }
 573
 574 /**
 575   Verify data payload with AuthInfo in EFI_CERT_TYPE_RSA2048_SHA256_GUID type.
 576   Follow the steps in UEFI2.2.
 577
 578   Caution: This function may receive untrusted input.
 579   This function may be invoked in SMM mode, and datasize and data are external input.
 580   This function will do basic validation, before parse the data.
 581   This function will parse the authentication carefully to avoid security issues, like
 582   buffer overflow, integer overflow.
 583
 584   @param[in]      Data                    Pointer to data with AuthInfo.
 585   @param[in]      DataSize                Size of Data.
 586   @param[in]      PubKey                  Public key used for verification.
 587
 588   @retval EFI_INVALID_PARAMETER       Invalid parameter.
 589   @retval EFI_SECURITY_VIOLATION      If authentication failed.
 590   @retval EFI_SUCCESS                 Authentication successful.
 591
 592 **/
 593 EFI_STATUS
 594 VerifyCounterBasedPayload (
 595   IN     UINT8          *Data,
 596   IN     UINTN          DataSize,
 597   IN     UINT8          *PubKey
 598   )
 599 {
 600   BOOLEAN                         Status;
 601   EFI_VARIABLE_AUTHENTICATION     *CertData;
 602   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
 603   UINT8                           Digest[SHA256_DIGEST_SIZE];
 604   VOID                            *Rsa;
 605   UINTN                           PayloadSize;
 606
 607   PayloadSize = DataSize - AUTHINFO_SIZE;
 608   Rsa         = NULL;
 609   CertData    = NULL;
 610   CertBlock   = NULL;
 611
 612   if (Data == NULL || PubKey == NULL) {
 613     return EFI_INVALID_PARAMETER;
 614   }
 615
 616   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
 617   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
 618
 619   //
 620   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
 621   // Cert type should be EFI_CERT_TYPE_RSA2048_SHA256_GUID.
 622   //
 623   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
 624       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertTypeRsa2048Sha256Guid)
 625         ) {
 626     //
 627     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
 628     //
 629     return EFI_SECURITY_VIOLATION;
 630   }
 631   //
 632   // Hash data payload with SHA256.
 633   //
 634   ZeroMem (Digest, SHA256_DIGEST_SIZE);
 635   Status  = Sha256Init (mHashCtx);
 636   if (!Status) {
 637     goto Done;
 638   }
 639   Status  = Sha256Update (mHashCtx, Data + AUTHINFO_SIZE, PayloadSize);
 640   if (!Status) {
 641     goto Done;
 642   }
 643   //
 644   // Hash Size.
 645   //
 646   Status  = Sha256Update (mHashCtx, &PayloadSize, sizeof (UINTN));
 647   if (!Status) {
 648     goto Done;
 649   }
 650   //
 651   // Hash Monotonic Count.
 652   //
 653   Status  = Sha256Update (mHashCtx, &CertData->MonotonicCount, sizeof (UINT64));
 654   if (!Status) {
 655     goto Done;
 656   }
 657   Status  = Sha256Final (mHashCtx, Digest);
 658   if (!Status) {
 659     goto Done;
 660   }
 661   //
 662   // Generate & Initialize RSA Context.
 663   //
 664   Rsa = RsaNew ();
 665   ASSERT (Rsa != NULL);
 666   //
 667   // Set RSA Key Components.
 668   // NOTE: Only N and E are needed to be set as RSA public key for signature verification.
 669   //
 670   Status = RsaSetKey (Rsa, RsaKeyN, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 671   if (!Status) {
 672     goto Done;
 673   }
 674   Status = RsaSetKey (Rsa, RsaKeyE, mRsaE, sizeof (mRsaE));
 675   if (!Status) {
 676     goto Done;
 677   }
 678   //
 679   // Verify the signature.
 680   //
 681   Status = RsaPkcs1Verify (
 682              Rsa,
 683              Digest,
 684              SHA256_DIGEST_SIZE,
 685              CertBlock->Signature,
 686              EFI_CERT_TYPE_RSA2048_SHA256_SIZE
 687              );
 688
 689 Done:
 690   if (Rsa != NULL) {
 691     RsaFree (Rsa);
 692   }
 693   if (Status) {
 694     return EFI_SUCCESS;
 695   } else {
 696     return EFI_SECURITY_VIOLATION;
 697   }
 698 }
 699
 700 /**
 701   Update platform mode.
 702
 703   @param[in]      Mode                    SETUP_MODE or USER_MODE.
 704
 705   @return EFI_INVALID_PARAMETER           Invalid parameter.
 706   @return EFI_SUCCESS                     Update platform mode successfully.
 707
 708 **/
 709 EFI_STATUS
 710 UpdatePlatformMode (
 711   IN  UINT32                    Mode
 712   )
 713 {
 714   EFI_STATUS              Status;
 715   VARIABLE_POINTER_TRACK  Variable;
 716   UINT8                   SecureBootMode;
 717   UINT8                   SecureBootEnable;
 718   UINTN                   VariableDataSize;
 719
 720   Status = FindVariable (
 721              EFI_SETUP_MODE_NAME,
 722              &gEfiGlobalVariableGuid,
 723              &Variable,
 724              &mVariableModuleGlobal->VariableGlobal,
 725              FALSE
 726              );
 727   if (EFI_ERROR (Status)) {
 728     return Status;
 729   }
 730
 731   //
 732   // Update the value of SetupMode variable by a simple mem copy, this could avoid possible
 733   // variable storage reclaim at runtime.
 734   //
 735   mPlatformMode = (UINT8) Mode;
 736   CopyMem (GetVariableDataPtr (Variable.CurrPtr), &mPlatformMode, sizeof(UINT8));
 737
 738   if (AtRuntime ()) {
 739     //
 740     // SecureBoot Variable indicates whether the platform firmware is operating
 741     // in Secure boot mode (1) or not (0), so we should not change SecureBoot
 742     // Variable in runtime.
 743     //
 744     return Status;
 745   }
 746
 747   //
 748   // Check "SecureBoot" variable's existence.
 749   // If it doesn't exist, firmware has no capability to perform driver signing verification,
 750   // then set "SecureBoot" to 0.
 751   //
 752   Status = FindVariable (
 753              EFI_SECURE_BOOT_MODE_NAME,
 754              &gEfiGlobalVariableGuid,
 755              &Variable,
 756              &mVariableModuleGlobal->VariableGlobal,
 757              FALSE
 758              );
 759   //
 760   // If "SecureBoot" variable exists, then check "SetupMode" variable update.
 761   // If "SetupMode" variable is USER_MODE, "SecureBoot" variable is set to 1.
 762   // If "SetupMode" variable is SETUP_MODE, "SecureBoot" variable is set to 0.
 763   //
 764   if (Variable.CurrPtr == NULL) {
 765     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 766   } else {
 767     if (mPlatformMode == USER_MODE) {
 768       SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 769     } else if (mPlatformMode == SETUP_MODE) {
 770       SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 771     } else {
 772       return EFI_NOT_FOUND;
 773     }
 774   }
 775
 776   Status  = UpdateVariable (
 777               EFI_SECURE_BOOT_MODE_NAME,
 778               &gEfiGlobalVariableGuid,
 779               &SecureBootMode,
 780               sizeof(UINT8),
 781               EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 782               0,
 783               0,
 784               &Variable,
 785               NULL
 786               );
 787   if (EFI_ERROR (Status)) {
 788     return Status;
 789   }
 790
 791   //
 792   // Check "SecureBootEnable" variable's existence. It can enable/disable secure boot feature.
 793   //
 794   Status = FindVariable (
 795              EFI_SECURE_BOOT_ENABLE_NAME,
 796              &gEfiSecureBootEnableDisableGuid,
 797              &Variable,
 798              &mVariableModuleGlobal->VariableGlobal,
 799              FALSE
 800              );
 801
 802   if (SecureBootMode == SECURE_BOOT_MODE_ENABLE) {
 803     //
 804     // Create the "SecureBootEnable" variable as secure boot is enabled.
 805     //
 806     SecureBootEnable = SECURE_BOOT_ENABLE;
 807     VariableDataSize = sizeof (SecureBootEnable);
 808   } else {
 809     //
 810     // Delete the "SecureBootEnable" variable if this variable exist as "SecureBoot"
 811     // variable is not in secure boot state.
 812     //
 813     if (Variable.CurrPtr == NULL || EFI_ERROR (Status)) {
 814       return EFI_SUCCESS;
 815     }
 816     SecureBootEnable = SECURE_BOOT_DISABLE;
 817     VariableDataSize = 0;
 818   }
 819
 820   Status = UpdateVariable (
 821              EFI_SECURE_BOOT_ENABLE_NAME,
 822              &gEfiSecureBootEnableDisableGuid,
 823              &SecureBootEnable,
 824              VariableDataSize,
 825              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 826              0,
 827              0,
 828              &Variable,
 829              NULL
 830              );
 831   return Status;
 832 }
 833
 834 /**
 835   Check input data form to make sure it is a valid EFI_SIGNATURE_LIST for PK/KEK/db/dbx variable.
 836
 837   @param[in]  VariableName                Name of Variable to be check.
 838   @param[in]  VendorGuid                  Variable vendor GUID.
 839   @param[in]  Data                        Point to the variable data to be checked.
 840   @param[in]  DataSize                    Size of Data.
 841
 842   @return EFI_INVALID_PARAMETER           Invalid signature list format.
 843   @return EFI_SUCCESS                     Passed signature list format check successfully.
 844
 845 **/
 846 EFI_STATUS
 847 CheckSignatureListFormat(
 848   IN  CHAR16                    *VariableName,
 849   IN  EFI_GUID                  *VendorGuid,
 850   IN  VOID                      *Data,
 851   IN  UINTN                     DataSize
 852   )
 853 {
 854   EFI_SIGNATURE_LIST     *SigList;
 855   UINTN                  SigDataSize;
 856   UINT32                 Index;
 857   UINT32                 SigCount;
 858   BOOLEAN                IsPk;
 859   VOID                   *RsaContext;
 860   EFI_SIGNATURE_DATA     *CertData;
 861   UINTN                  CertLen;
 862
 863   if (DataSize == 0) {
 864     return EFI_SUCCESS;
 865   }
 866
 867   ASSERT (VariableName != NULL && VendorGuid != NULL && Data != NULL);
 868
 869   if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_PLATFORM_KEY_NAME) == 0)){
 870     IsPk = TRUE;
 871   } else if ((CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0) ||
 872              (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&
 873               (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0 || StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0))){
 874     IsPk = FALSE;
 875   } else {
 876     return EFI_SUCCESS;
 877   }
 878
 879   SigCount = 0;
 880   SigList  = (EFI_SIGNATURE_LIST *) Data;
 881   SigDataSize  = DataSize;
 882   RsaContext = NULL;
 883
 884   //
 885   // Walk throuth the input signature list and check the data format.
 886   // If any signature is incorrectly formed, the whole check will fail.
 887   //
 888   while ((SigDataSize > 0) && (SigDataSize >= SigList->SignatureListSize)) {
 889     for (Index = 0; Index < (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM)); Index++ ) {
 890       if (CompareGuid (&SigList->SignatureType, &mSupportSigItem[Index].SigType)) {
 891         //
 892         // The value of SignatureSize should always be 16 (size of SignatureOwner
 893         // component) add the data length according to signature type.
 894         //
 895         if (mSupportSigItem[Index].SigDataSize != ((UINT32) ~0) &&
 896           (SigList->SignatureSize - sizeof (EFI_GUID)) != mSupportSigItem[Index].SigDataSize) {
 897           return EFI_INVALID_PARAMETER;
 898         }
 899         if (mSupportSigItem[Index].SigHeaderSize != ((UINTN) ~0) &&
 900           SigList->SignatureHeaderSize != mSupportSigItem[Index].SigHeaderSize) {
 901           return EFI_INVALID_PARAMETER;
 902         }
 903         break;
 904       }
 905     }
 906
 907     if (Index == (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM))) {
 908       //
 909       // Undefined signature type.
 910       //
 911       return EFI_INVALID_PARAMETER;
 912     }
 913
 914     if (CompareGuid (&SigList->SignatureType, &gEfiCertX509Guid)) {
 915       //
 916       // Try to retrieve the RSA public key from the X.509 certificate.
 917       // If this operation fails, it's not a valid certificate.
 918       //
 919       RsaContext = RsaNew ();
 920       if (RsaContext == NULL) {
 921         return EFI_INVALID_PARAMETER;
 922       }
 923       CertData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigList + sizeof (EFI_SIGNATURE_LIST) + SigList->SignatureHeaderSize);
 924       CertLen = SigList->SignatureSize - sizeof (EFI_GUID);
 925       if (!RsaGetPublicKeyFromX509 (CertData->SignatureData, CertLen, &RsaContext)) {
 926         RsaFree (RsaContext);
 927         return EFI_INVALID_PARAMETER;
 928       }
 929       RsaFree (RsaContext);
 930     }
 931
 932     if ((SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) % SigList->SignatureSize != 0) {
 933       return EFI_INVALID_PARAMETER;
 934     }
 935     SigCount += (SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) / SigList->SignatureSize;
 936
 937     SigDataSize -= SigList->SignatureListSize;
 938     SigList = (EFI_SIGNATURE_LIST *) ((UINT8 *) SigList + SigList->SignatureListSize);
 939   }
 940
 941   if (((UINTN) SigList - (UINTN) Data) != DataSize) {
 942     return EFI_INVALID_PARAMETER;
 943   }
 944
 945   if (IsPk && SigCount > 1) {
 946     return EFI_INVALID_PARAMETER;
 947   }
 948
 949   return EFI_SUCCESS;
 950 }
 951
 952 /**
 953   Update "VendorKeys" variable to record the out of band secure boot key modification.
 954
 955   @return EFI_SUCCESS           Variable is updated successfully.
 956   @return Others                Failed to update variable.
 957
 958 **/
 959 EFI_STATUS
 960 VendorKeyIsModified (
 961   VOID
 962   )
 963 {
 964   EFI_STATUS              Status;
 965   VARIABLE_POINTER_TRACK  Variable;
 966
 967   if (mVendorKeyState == VENDOR_KEYS_MODIFIED) {
 968     return EFI_SUCCESS;
 969   }
 970   mVendorKeyState = VENDOR_KEYS_MODIFIED;
 971
 972   FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 973   Status = UpdateVariable (
 974              EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
 975              &gEfiVendorKeysNvGuid,
 976              &mVendorKeyState,
 977              sizeof (UINT8),
 978              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS,
 979              0,
 980              0,
 981              &Variable,
 982              NULL
 983              );
 984   if (EFI_ERROR (Status)) {
 985     return Status;
 986   }
 987
 988   FindVariable (EFI_VENDOR_KEYS_VARIABLE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 989   return UpdateVariable (
 990            EFI_VENDOR_KEYS_VARIABLE_NAME,
 991            &gEfiGlobalVariableGuid,
 992            &mVendorKeyState,
 993            sizeof (UINT8),
 994            EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 995            0,
 996            0,
 997            &Variable,
 998            NULL
 999            );
1000 }
1001
1002 /**
1003   Process variable with platform key for verification.
1004
1005   Caution: This function may receive untrusted input.
1006   This function may be invoked in SMM mode, and datasize and data are external input.
1007   This function will do basic validation, before parse the data.
1008   This function will parse the authentication carefully to avoid security issues, like
1009   buffer overflow, integer overflow.
1010   This function will check attribute carefully to avoid authentication bypass.
1011
1012   @param[in]  VariableName                Name of Variable to be found.
1013   @param[in]  VendorGuid                  Variable vendor GUID.
1014   @param[in]  Data                        Data pointer.
1015   @param[in]  DataSize                    Size of Data found. If size is less than the
1016                                           data, this value contains the required size.
1017   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1018   @param[in]  Attributes                  Attribute value of the variable
1019   @param[in]  IsPk                        Indicate whether it is to process pk.
1020
1021   @return EFI_INVALID_PARAMETER           Invalid parameter.
1022   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation.
1023                                           check carried out by the firmware.
1024   @return EFI_SUCCESS                     Variable passed validation successfully.
1025
1026 **/
1027 EFI_STATUS
1028 ProcessVarWithPk (
1029   IN  CHAR16                    *VariableName,
1030   IN  EFI_GUID                  *VendorGuid,
1031   IN  VOID                      *Data,
1032   IN  UINTN                     DataSize,
1033   IN  VARIABLE_POINTER_TRACK    *Variable,
1034   IN  UINT32                    Attributes OPTIONAL,
1035   IN  BOOLEAN                   IsPk
1036   )
1037 {
1038   EFI_STATUS                  Status;
1039   BOOLEAN                     Del;
1040   UINT8                       *Payload;
1041   UINTN                       PayloadSize;
1042
1043   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1044       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1045     //
1046     // PK, KEK and db/dbx should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1047     // authenticated variable.
1048     //
1049     return EFI_INVALID_PARAMETER;
1050   }
1051
1052   Del = FALSE;
1053   if ((InCustomMode() && UserPhysicalPresent()) || (mPlatformMode == SETUP_MODE && !IsPk)) {
1054     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1055     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1056     if (PayloadSize == 0) {
1057       Del = TRUE;
1058     }
1059
1060     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
1061     if (EFI_ERROR (Status)) {
1062       return Status;
1063     }
1064
1065     Status = UpdateVariable (
1066                VariableName,
1067                VendorGuid,
1068                Payload,
1069                PayloadSize,
1070                Attributes,
1071                0,
1072                0,
1073                Variable,
1074                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1075                );
1076     if (EFI_ERROR(Status)) {
1077       return Status;
1078     }
1079
1080     if ((mPlatformMode != SETUP_MODE) || IsPk) {
1081       Status = VendorKeyIsModified ();
1082     }
1083   } else if (mPlatformMode == USER_MODE) {
1084     //
1085     // Verify against X509 Cert in PK database.
1086     //
1087     Status = VerifyTimeBasedPayload (
1088                VariableName,
1089                VendorGuid,
1090                Data,
1091                DataSize,
1092                Variable,
1093                Attributes,
1094                AuthVarTypePk,
1095                &Del
1096                );
1097   } else {
1098     //
1099     // Verify against the certificate in data payload.
1100     //
1101     Status = VerifyTimeBasedPayload (
1102                VariableName,
1103                VendorGuid,
1104                Data,
1105                DataSize,
1106                Variable,
1107                Attributes,
1108                AuthVarTypePayload,
1109                &Del
1110                );
1111   }
1112
1113   if (!EFI_ERROR(Status) && IsPk) {
1114     if (mPlatformMode == SETUP_MODE && !Del) {
1115       //
1116       // If enroll PK in setup mode, need change to user mode.
1117       //
1118       Status = UpdatePlatformMode (USER_MODE);
1119     } else if (mPlatformMode == USER_MODE && Del){
1120       //
1121       // If delete PK in user mode, need change to setup mode.
1122       //
1123       Status = UpdatePlatformMode (SETUP_MODE);
1124     }
1125   }
1126
1127   return Status;
1128 }
1129
1130 /**
1131   Process variable with key exchange key for verification.
1132
1133   Caution: This function may receive untrusted input.
1134   This function may be invoked in SMM mode, and datasize and data are external input.
1135   This function will do basic validation, before parse the data.
1136   This function will parse the authentication carefully to avoid security issues, like
1137   buffer overflow, integer overflow.
1138   This function will check attribute carefully to avoid authentication bypass.
1139
1140   @param[in]  VariableName                Name of Variable to be found.
1141   @param[in]  VendorGuid                  Variable vendor GUID.
1142   @param[in]  Data                        Data pointer.
1143   @param[in]  DataSize                    Size of Data found. If size is less than the
1144                                           data, this value contains the required size.
1145   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1146   @param[in]  Attributes                  Attribute value of the variable.
1147
1148   @return EFI_INVALID_PARAMETER           Invalid parameter.
1149   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
1150                                           check carried out by the firmware.
1151   @return EFI_SUCCESS                     Variable pass validation successfully.
1152
1153 **/
1154 EFI_STATUS
1155 ProcessVarWithKek (
1156   IN  CHAR16                               *VariableName,
1157   IN  EFI_GUID                             *VendorGuid,
1158   IN  VOID                                 *Data,
1159   IN  UINTN                                DataSize,
1160   IN  VARIABLE_POINTER_TRACK               *Variable,
1161   IN  UINT32                               Attributes OPTIONAL
1162   )
1163 {
1164   EFI_STATUS                      Status;
1165   UINT8                           *Payload;
1166   UINTN                           PayloadSize;
1167
1168   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1169       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1170     //
1171     // DB and DBX should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1172     // authenticated variable.
1173     //
1174     return EFI_INVALID_PARAMETER;
1175   }
1176
1177   Status = EFI_SUCCESS;
1178   if (mPlatformMode == USER_MODE && !(InCustomMode() && UserPhysicalPresent())) {
1179     //
1180     // Time-based, verify against X509 Cert KEK.
1181     //
1182     return VerifyTimeBasedPayload (
1183              VariableName,
1184              VendorGuid,
1185              Data,
1186              DataSize,
1187              Variable,
1188              Attributes,
1189              AuthVarTypeKek,
1190              NULL
1191              );
1192   } else {
1193     //
1194     // If in setup mode or custom secure boot mode, no authentication needed.
1195     //
1196     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1197     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1198
1199     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
1200     if (EFI_ERROR (Status)) {
1201       return Status;
1202     }
1203
1204     Status = UpdateVariable (
1205                VariableName,
1206                VendorGuid,
1207                Payload,
1208                PayloadSize,
1209                Attributes,
1210                0,
1211                0,
1212                Variable,
1213                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1214                );
1215     if (EFI_ERROR (Status)) {
1216       return Status;
1217     }
1218
1219     if (mPlatformMode != SETUP_MODE) {
1220       Status = VendorKeyIsModified ();
1221     }
1222   }
1223
1224   return Status;
1225 }
1226
1227 /**
1228   Process variable with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS/EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
1229
1230   Caution: This function may receive untrusted input.
1231   This function may be invoked in SMM mode, and datasize and data are external input.
1232   This function will do basic validation, before parse the data.
1233   This function will parse the authentication carefully to avoid security issues, like
1234   buffer overflow, integer overflow.
1235   This function will check attribute carefully to avoid authentication bypass.
1236
1237   @param[in]  VariableName                Name of Variable to be found.
1238   @param[in]  VendorGuid                  Variable vendor GUID.
1239
1240   @param[in]  Data                        Data pointer.
1241   @param[in]  DataSize                    Size of Data found. If size is less than the
1242                                           data, this value contains the required size.
1243   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1244   @param[in]  Attributes                  Attribute value of the variable.
1245
1246   @return EFI_INVALID_PARAMETER           Invalid parameter.
1247   @return EFI_WRITE_PROTECTED             Variable is write-protected and needs authentication with
1248                                           EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1249   @return EFI_OUT_OF_RESOURCES            The Database to save the public key is full.
1250   @return EFI_SECURITY_VIOLATION          The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
1251                                           set, but the AuthInfo does NOT pass the validation
1252                                           check carried out by the firmware.
1253   @return EFI_SUCCESS                     Variable is not write-protected or pass validation successfully.
1254
1255 **/
1256 EFI_STATUS
1257 ProcessVariable (
1258   IN     CHAR16                             *VariableName,
1259   IN     EFI_GUID                           *VendorGuid,
1260   IN     VOID                               *Data,
1261   IN     UINTN                              DataSize,
1262   IN     VARIABLE_POINTER_TRACK             *Variable,
1263   IN     UINT32                             Attributes
1264   )
1265 {
1266   EFI_STATUS                      Status;
1267   BOOLEAN                         IsDeletion;
1268   BOOLEAN                         IsFirstTime;
1269   UINT8                           *PubKey;
1270   EFI_VARIABLE_AUTHENTICATION     *CertData;
1271   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
1272   UINT32                          KeyIndex;
1273   UINT64                          MonotonicCount;
1274
1275   KeyIndex    = 0;
1276   CertData    = NULL;
1277   CertBlock   = NULL;
1278   PubKey      = NULL;
1279   IsDeletion  = FALSE;
1280
1281   if (NeedPhysicallyPresent(VariableName, VendorGuid) && !UserPhysicalPresent()) {
1282     //
1283     // This variable is protected, only physical present user could modify its value.
1284     //
1285     return EFI_SECURITY_VIOLATION;
1286   }
1287
1288   //
1289   // A time-based authenticated variable and a count-based authenticated variable
1290   // can't be updated by each other.
1291   //
1292   if (Variable->CurrPtr != NULL) {
1293     if (((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) &&
1294         ((Variable->CurrPtr->Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0)) {
1295       return EFI_SECURITY_VIOLATION;
1296     }
1297
1298     if (((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) &&
1299         ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0)) {
1300       return EFI_SECURITY_VIOLATION;
1301     }
1302   }
1303
1304   //
1305   // Process Time-based Authenticated variable.
1306   //
1307   if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1308     return VerifyTimeBasedPayload (
1309              VariableName,
1310              VendorGuid,
1311              Data,
1312              DataSize,
1313              Variable,
1314              Attributes,
1315              AuthVarTypePriv,
1316              NULL
1317              );
1318   }
1319
1320   //
1321   // Determine if first time SetVariable with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS.
1322   //
1323   if ((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) {
1324     //
1325     // Determine current operation type.
1326     //
1327     if (DataSize == AUTHINFO_SIZE) {
1328       IsDeletion = TRUE;
1329     }
1330     //
1331     // Determine whether this is the first time with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1332     //
1333     if (Variable->CurrPtr == NULL) {
1334       IsFirstTime = TRUE;
1335     } else if ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) == 0) {
1336       IsFirstTime = TRUE;
1337     } else {
1338       KeyIndex   = Variable->CurrPtr->PubKeyIndex;
1339       IsFirstTime = FALSE;
1340     }
1341   } else if ((Variable->CurrPtr != NULL) &&
1342              ((Variable->CurrPtr->Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)
1343             ) {
1344     //
1345     // If the variable is already write-protected, it always needs authentication before update.
1346     //
1347     return EFI_WRITE_PROTECTED;
1348   } else {
1349     //
1350     // If without EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS, set and attributes collision.
1351     // That means it is not authenticated variable, just update variable as usual.
1352     //
1353     Status = UpdateVariable (VariableName, VendorGuid, Data, DataSize, Attributes, 0, 0, Variable, NULL);
1354     return Status;
1355   }
1356
1357   //
1358   // Get PubKey and check Monotonic Count value corresponding to the variable.
1359   //
1360   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
1361   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
1362   PubKey    = CertBlock->PublicKey;
1363
1364   //
1365   // Update Monotonic Count value.
1366   //
1367   MonotonicCount = CertData->MonotonicCount;
1368
1369   if (!IsFirstTime) {
1370     //
1371     // Check input PubKey.
1372     //
1373     if (CompareMem (PubKey, mPubKeyStore + (KeyIndex - 1) * EFI_CERT_TYPE_RSA2048_SIZE, EFI_CERT_TYPE_RSA2048_SIZE) != 0) {
1374       return EFI_SECURITY_VIOLATION;
1375     }
1376     //
1377     // Compare the current monotonic count and ensure that it is greater than the last SetVariable
1378     // operation with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS attribute set.
1379     //
1380     if (CertData->MonotonicCount <= Variable->CurrPtr->MonotonicCount) {
1381       //
1382       // Monotonic count check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
1383       //
1384       return EFI_SECURITY_VIOLATION;
1385     }
1386   }
1387   //
1388   // Verify the certificate in Data payload.
1389   //
1390   Status = VerifyCounterBasedPayload (Data, DataSize, PubKey);
1391   if (EFI_ERROR (Status)) {
1392     return Status;
1393   }
1394
1395   //
1396   // Now, the signature has been verified!
1397   //
1398   if (IsFirstTime && !IsDeletion) {
1399     //
1400     // Update public key database variable if need.
1401     //
1402     KeyIndex = AddPubKeyInStore (PubKey);
1403     if (KeyIndex == 0) {
1404       return EFI_OUT_OF_RESOURCES;
1405     }
1406   }
1407
1408   //
1409   // Verification pass.
1410   //
1411   return UpdateVariable (VariableName, VendorGuid, (UINT8*)Data + AUTHINFO_SIZE, DataSize - AUTHINFO_SIZE, Attributes, KeyIndex, MonotonicCount, Variable, NULL);
1412 }
1413
1414 /**
1415   Merge two buffers which formatted as EFI_SIGNATURE_LIST. Only the new EFI_SIGNATURE_DATA
1416   will be appended to the original EFI_SIGNATURE_LIST, duplicate EFI_SIGNATURE_DATA
1417   will be ignored.
1418
1419   @param[in, out]  Data              Pointer to original EFI_SIGNATURE_LIST.
1420   @param[in]       DataSize          Size of Data buffer.
1421   @param[in]       FreeBufSize       Size of free data buffer
1422   @param[in]       NewData           Pointer to new EFI_SIGNATURE_LIST to be appended.
1423   @param[in]       NewDataSize       Size of NewData buffer.
1424   @param[out]      MergedBufSize     Size of the merged buffer
1425
1426   @return EFI_BUFFER_TOO_SMALL if input Data buffer overflowed
1427
1428 **/
1429 EFI_STATUS
1430 AppendSignatureList (
1431   IN  OUT VOID            *Data,
1432   IN  UINTN               DataSize,
1433   IN  UINTN               FreeBufSize,
1434   IN  VOID                *NewData,
1435   IN  UINTN               NewDataSize,
1436   OUT UINTN               *MergedBufSize
1437   )
1438 {
1439   EFI_SIGNATURE_LIST  *CertList;
1440   EFI_SIGNATURE_DATA  *Cert;
1441   UINTN               CertCount;
1442   EFI_SIGNATURE_LIST  *NewCertList;
1443   EFI_SIGNATURE_DATA  *NewCert;
1444   UINTN               NewCertCount;
1445   UINTN               Index;
1446   UINTN               Index2;
1447   UINTN               Size;
1448   UINT8               *Tail;
1449   UINTN               CopiedCount;
1450   UINTN               SignatureListSize;
1451   BOOLEAN             IsNewCert;
1452
1453   Tail = (UINT8 *) Data + DataSize;
1454
1455   NewCertList = (EFI_SIGNATURE_LIST *) NewData;
1456   while ((NewDataSize > 0) && (NewDataSize >= NewCertList->SignatureListSize)) {
1457     NewCert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCertList + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1458     NewCertCount = (NewCertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - NewCertList->SignatureHeaderSize) / NewCertList->SignatureSize;
1459
1460     CopiedCount = 0;
1461     for (Index = 0; Index < NewCertCount; Index++) {
1462       IsNewCert = TRUE;
1463
1464       Size = DataSize;
1465       CertList = (EFI_SIGNATURE_LIST *) Data;
1466       while ((Size > 0) && (Size >= CertList->SignatureListSize)) {
1467         if (CompareGuid (&CertList->SignatureType, &NewCertList->SignatureType) &&
1468            (CertList->SignatureSize == NewCertList->SignatureSize)) {
1469           Cert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
1470           CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
1471           for (Index2 = 0; Index2 < CertCount; Index2++) {
1472             //
1473             // Iterate each Signature Data in this Signature List.
1474             //
1475             if (CompareMem (NewCert, Cert, CertList->SignatureSize) == 0) {
1476               IsNewCert = FALSE;
1477               break;
1478             }
1479             Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
1480           }
1481         }
1482
1483         if (!IsNewCert) {
1484           break;
1485         }
1486         Size -= CertList->SignatureListSize;
1487         CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
1488       }
1489
1490       if (IsNewCert) {
1491         //
1492         // New EFI_SIGNATURE_DATA, append it.
1493         //
1494         if (CopiedCount == 0) {
1495           if (FreeBufSize < sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize) {
1496             return EFI_BUFFER_TOO_SMALL;
1497           }
1498
1499           //
1500           // Copy EFI_SIGNATURE_LIST header for only once.
1501           //
1502
1503           CopyMem (Tail, NewCertList, sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1504           Tail = Tail + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1505           FreeBufSize -= sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1506         }
1507
1508         if (FreeBufSize < NewCertList->SignatureSize) {
1509           return EFI_BUFFER_TOO_SMALL;
1510         }
1511         CopyMem (Tail, NewCert, NewCertList->SignatureSize);
1512         Tail += NewCertList->SignatureSize;
1513         FreeBufSize -= NewCertList->SignatureSize;
1514         CopiedCount++;
1515       }
1516
1517       NewCert = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCert + NewCertList->SignatureSize);
1518     }
1519
1520     //
1521     // Update SignatureListSize in newly appended EFI_SIGNATURE_LIST.
1522     //
1523     if (CopiedCount != 0) {
1524       SignatureListSize = sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize + (CopiedCount * NewCertList->SignatureSize);
1525       CertList = (EFI_SIGNATURE_LIST *) (Tail - SignatureListSize);
1526       CertList->SignatureListSize = (UINT32) SignatureListSize;
1527     }
1528
1529     NewDataSize -= NewCertList->SignatureListSize;
1530     NewCertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) NewCertList + NewCertList->SignatureListSize);
1531   }
1532
1533   *MergedBufSize = (Tail - (UINT8 *) Data);
1534   return EFI_SUCCESS;
1535 }
1536
1537 /**
1538   Compare two EFI_TIME data.
1539
1540
1541   @param FirstTime           A pointer to the first EFI_TIME data.
1542   @param SecondTime          A pointer to the second EFI_TIME data.
1543
1544   @retval  TRUE              The FirstTime is not later than the SecondTime.
1545   @retval  FALSE             The FirstTime is later than the SecondTime.
1546
1547 **/
1548 BOOLEAN
1549 CompareTimeStamp (
1550   IN EFI_TIME               *FirstTime,
1551   IN EFI_TIME               *SecondTime
1552   )
1553 {
1554   if (FirstTime->Year != SecondTime->Year) {
1555     return (BOOLEAN) (FirstTime->Year < SecondTime->Year);
1556   } else if (FirstTime->Month != SecondTime->Month) {
1557     return (BOOLEAN) (FirstTime->Month < SecondTime->Month);
1558   } else if (FirstTime->Day != SecondTime->Day) {
1559     return (BOOLEAN) (FirstTime->Day < SecondTime->Day);
1560   } else if (FirstTime->Hour != SecondTime->Hour) {
1561     return (BOOLEAN) (FirstTime->Hour < SecondTime->Hour);
1562   } else if (FirstTime->Minute != SecondTime->Minute) {
1563     return (BOOLEAN) (FirstTime->Minute < SecondTime->Minute);
1564   }
1565
1566   return (BOOLEAN) (FirstTime->Second <= SecondTime->Second);
1567 }
1568
1569 /**
1570   Find matching signer's certificates for common authenticated variable
1571   by corresponding VariableName and VendorGuid from "certdb".
1572
1573   The data format of "certdb":
1574   //
1575   //     UINT32 CertDbListSize;
1576   // /// AUTH_CERT_DB_DATA Certs1[];
1577   // /// AUTH_CERT_DB_DATA Certs2[];
1578   // /// ...
1579   // /// AUTH_CERT_DB_DATA Certsn[];
1580   //
1581
1582   @param[in]  VariableName   Name of authenticated Variable.
1583   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1584   @param[in]  Data           Pointer to variable "certdb".
1585   @param[in]  DataSize       Size of variable "certdb".
1586   @param[out] CertOffset     Offset of matching CertData, from starting of Data.
1587   @param[out] CertDataSize   Length of CertData in bytes.
1588   @param[out] CertNodeOffset Offset of matching AUTH_CERT_DB_DATA , from
1589                              starting of Data.
1590   @param[out] CertNodeSize   Length of AUTH_CERT_DB_DATA in bytes.
1591
1592   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1593   @retval  EFI_NOT_FOUND         Fail to find matching certs.
1594   @retval  EFI_SUCCESS           Find matching certs and output parameters.
1595
1596 **/
1597 EFI_STATUS
1598 FindCertsFromDb (
1599   IN     CHAR16           *VariableName,
1600   IN     EFI_GUID         *VendorGuid,
1601   IN     UINT8            *Data,
1602   IN     UINTN            DataSize,
1603   OUT    UINT32           *CertOffset,    OPTIONAL
1604   OUT    UINT32           *CertDataSize,  OPTIONAL
1605   OUT    UINT32           *CertNodeOffset,OPTIONAL
1606   OUT    UINT32           *CertNodeSize   OPTIONAL
1607   )
1608 {
1609   UINT32                  Offset;
1610   AUTH_CERT_DB_DATA       *Ptr;
1611   UINT32                  CertSize;
1612   UINT32                  NameSize;
1613   UINT32                  NodeSize;
1614   UINT32                  CertDbListSize;
1615
1616   if ((VariableName == NULL) || (VendorGuid == NULL) || (Data == NULL)) {
1617     return EFI_INVALID_PARAMETER;
1618   }
1619
1620   //
1621   // Check whether DataSize matches recorded CertDbListSize.
1622   //
1623   if (DataSize < sizeof (UINT32)) {
1624     return EFI_INVALID_PARAMETER;
1625   }
1626
1627   CertDbListSize = ReadUnaligned32 ((UINT32 *) Data);
1628
1629   if (CertDbListSize != (UINT32) DataSize) {
1630     return EFI_INVALID_PARAMETER;
1631   }
1632
1633   Offset = sizeof (UINT32);
1634
1635   //
1636   // Get corresponding certificates by VendorGuid and VariableName.
1637   //
1638   while (Offset < (UINT32) DataSize) {
1639     Ptr = (AUTH_CERT_DB_DATA *) (Data + Offset);
1640     //
1641     // Check whether VendorGuid matches.
1642     //
1643     if (CompareGuid (&Ptr->VendorGuid, VendorGuid)) {
1644       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1645       NameSize = ReadUnaligned32 (&Ptr->NameSize);
1646       CertSize = ReadUnaligned32 (&Ptr->CertDataSize);
1647
1648       if (NodeSize != sizeof (EFI_GUID) + sizeof (UINT32) * 3 + CertSize +
1649           sizeof (CHAR16) * NameSize) {
1650         return EFI_INVALID_PARAMETER;
1651       }
1652
1653       Offset = Offset + sizeof (EFI_GUID) + sizeof (UINT32) * 3;
1654       //
1655       // Check whether VariableName matches.
1656       //
1657       if ((NameSize == StrLen (VariableName)) &&
1658           (CompareMem (Data + Offset, VariableName, NameSize * sizeof (CHAR16)) == 0)) {
1659         Offset = Offset + NameSize * sizeof (CHAR16);
1660
1661         if (CertOffset != NULL) {
1662           *CertOffset = Offset;
1663         }
1664
1665         if (CertDataSize != NULL) {
1666           *CertDataSize = CertSize;
1667         }
1668
1669         if (CertNodeOffset != NULL) {
1670           *CertNodeOffset = (UINT32) ((UINT8 *) Ptr - Data);
1671         }
1672
1673         if (CertNodeSize != NULL) {
1674           *CertNodeSize = NodeSize;
1675         }
1676
1677         return EFI_SUCCESS;
1678       } else {
1679         Offset = Offset + NameSize * sizeof (CHAR16) + CertSize;
1680       }
1681     } else {
1682       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1683       Offset   = Offset + NodeSize;
1684     }
1685   }
1686
1687   return EFI_NOT_FOUND;
1688 }
1689
1690 /**
1691   Retrieve signer's certificates for common authenticated variable
1692   by corresponding VariableName and VendorGuid from "certdb".
1693
1694   @param[in]  VariableName   Name of authenticated Variable.
1695   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1696   @param[out] CertData       Pointer to signer's certificates.
1697   @param[out] CertDataSize   Length of CertData in bytes.
1698
1699   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1700   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1701   @retval  EFI_SUCCESS           Get signer's certificates successfully.
1702
1703 **/
1704 EFI_STATUS
1705 GetCertsFromDb (
1706   IN     CHAR16           *VariableName,
1707   IN     EFI_GUID         *VendorGuid,
1708   OUT    UINT8            **CertData,
1709   OUT    UINT32           *CertDataSize
1710   )
1711 {
1712   VARIABLE_POINTER_TRACK  CertDbVariable;
1713   EFI_STATUS              Status;
1714   UINT8                   *Data;
1715   UINTN                   DataSize;
1716   UINT32                  CertOffset;
1717
1718   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL) || (CertDataSize == NULL)) {
1719     return EFI_INVALID_PARAMETER;
1720   }
1721
1722   //
1723   // Get variable "certdb".
1724   //
1725   Status = FindVariable (
1726              EFI_CERT_DB_NAME,
1727              &gEfiCertDbGuid,
1728              &CertDbVariable,
1729              &mVariableModuleGlobal->VariableGlobal,
1730              FALSE
1731              );
1732   if (EFI_ERROR (Status)) {
1733     return Status;
1734   }
1735
1736   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1737   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1738   if ((DataSize == 0) || (Data == NULL)) {
1739     ASSERT (FALSE);
1740     return EFI_NOT_FOUND;
1741   }
1742
1743   Status = FindCertsFromDb (
1744              VariableName,
1745              VendorGuid,
1746              Data,
1747              DataSize,
1748              &CertOffset,
1749              CertDataSize,
1750              NULL,
1751              NULL
1752              );
1753
1754   if (EFI_ERROR (Status)) {
1755     return Status;
1756   }
1757
1758   *CertData = Data + CertOffset;
1759   return EFI_SUCCESS;
1760 }
1761
1762 /**
1763   Delete matching signer's certificates when deleting common authenticated
1764   variable by corresponding VariableName and VendorGuid from "certdb".
1765
1766   @param[in]  VariableName   Name of authenticated Variable.
1767   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1768
1769   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1770   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1771   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
1772   @retval  EFI_SUCCESS           The operation is completed successfully.
1773
1774 **/
1775 EFI_STATUS
1776 DeleteCertsFromDb (
1777   IN     CHAR16           *VariableName,
1778   IN     EFI_GUID         *VendorGuid
1779   )
1780 {
1781   VARIABLE_POINTER_TRACK  CertDbVariable;
1782   EFI_STATUS              Status;
1783   UINT8                   *Data;
1784   UINTN                   DataSize;
1785   UINT32                  VarAttr;
1786   UINT32                  CertNodeOffset;
1787   UINT32                  CertNodeSize;
1788   UINT8                   *NewCertDb;
1789   UINT32                  NewCertDbSize;
1790
1791   if ((VariableName == NULL) || (VendorGuid == NULL)) {
1792     return EFI_INVALID_PARAMETER;
1793   }
1794
1795   //
1796   // Get variable "certdb".
1797   //
1798   Status = FindVariable (
1799              EFI_CERT_DB_NAME,
1800              &gEfiCertDbGuid,
1801              &CertDbVariable,
1802              &mVariableModuleGlobal->VariableGlobal,
1803              FALSE
1804              );
1805   if (EFI_ERROR (Status)) {
1806     return Status;
1807   }
1808
1809   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1810   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1811   if ((DataSize == 0) || (Data == NULL)) {
1812     ASSERT (FALSE);
1813     return EFI_NOT_FOUND;
1814   }
1815
1816   if (DataSize == sizeof (UINT32)) {
1817     //
1818     // There is no certs in certdb.
1819     //
1820     return EFI_SUCCESS;
1821   }
1822
1823   //
1824   // Get corresponding cert node from certdb.
1825   //
1826   Status = FindCertsFromDb (
1827              VariableName,
1828              VendorGuid,
1829              Data,
1830              DataSize,
1831              NULL,
1832              NULL,
1833              &CertNodeOffset,
1834              &CertNodeSize
1835              );
1836
1837   if (EFI_ERROR (Status)) {
1838     return Status;
1839   }
1840
1841   if (DataSize < (CertNodeOffset + CertNodeSize)) {
1842     return EFI_NOT_FOUND;
1843   }
1844
1845   //
1846   // Construct new data content of variable "certdb".
1847   //
1848   NewCertDbSize = (UINT32) DataSize - CertNodeSize;
1849   NewCertDb     = (UINT8*) mCertDbStore;
1850
1851   //
1852   // Copy the DB entries before deleting node.
1853   //
1854   CopyMem (NewCertDb, Data, CertNodeOffset);
1855   //
1856   // Update CertDbListSize.
1857   //
1858   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
1859   //
1860   // Copy the DB entries after deleting node.
1861   //
1862   if (DataSize > (CertNodeOffset + CertNodeSize)) {
1863     CopyMem (
1864       NewCertDb + CertNodeOffset,
1865       Data + CertNodeOffset + CertNodeSize,
1866       DataSize - CertNodeOffset - CertNodeSize
1867       );
1868   }
1869
1870   //
1871   // Set "certdb".
1872   //
1873   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
1874   Status   = UpdateVariable (
1875                EFI_CERT_DB_NAME,
1876                &gEfiCertDbGuid,
1877                NewCertDb,
1878                NewCertDbSize,
1879                VarAttr,
1880                0,
1881                0,
1882                &CertDbVariable,
1883                NULL
1884                );
1885
1886   return Status;
1887 }
1888
1889 /**
1890   Insert signer's certificates for common authenticated variable with VariableName
1891   and VendorGuid in AUTH_CERT_DB_DATA to "certdb".
1892
1893   @param[in]  VariableName   Name of authenticated Variable.
1894   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1895   @param[in]  CertData       Pointer to signer's certificates.
1896   @param[in]  CertDataSize   Length of CertData in bytes.
1897
1898   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1899   @retval  EFI_ACCESS_DENIED     An AUTH_CERT_DB_DATA entry with same VariableName
1900                                  and VendorGuid already exists.
1901   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
1902   @retval  EFI_SUCCESS           Insert an AUTH_CERT_DB_DATA entry to "certdb"
1903
1904 **/
1905 EFI_STATUS
1906 InsertCertsToDb (
1907   IN     CHAR16           *VariableName,
1908   IN     EFI_GUID         *VendorGuid,
1909   IN     UINT8            *CertData,
1910   IN     UINTN            CertDataSize
1911   )
1912 {
1913   VARIABLE_POINTER_TRACK  CertDbVariable;
1914   EFI_STATUS              Status;
1915   UINT8                   *Data;
1916   UINTN                   DataSize;
1917   UINT32                  VarAttr;
1918   UINT8                   *NewCertDb;
1919   UINT32                  NewCertDbSize;
1920   UINT32                  CertNodeSize;
1921   UINT32                  NameSize;
1922   AUTH_CERT_DB_DATA       *Ptr;
1923
1924   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL)) {
1925     return EFI_INVALID_PARAMETER;
1926   }
1927
1928   //
1929   // Get variable "certdb".
1930   //
1931   Status = FindVariable (
1932              EFI_CERT_DB_NAME,
1933              &gEfiCertDbGuid,
1934              &CertDbVariable,
1935              &mVariableModuleGlobal->VariableGlobal,
1936              FALSE
1937              );
1938   if (EFI_ERROR (Status)) {
1939     return Status;
1940   }
1941
1942   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1943   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1944   if ((DataSize == 0) || (Data == NULL)) {
1945     ASSERT (FALSE);
1946     return EFI_NOT_FOUND;
1947   }
1948
1949   //
1950   // Find whether matching cert node already exists in "certdb".
1951   // If yes return error.
1952   //
1953   Status = FindCertsFromDb (
1954              VariableName,
1955              VendorGuid,
1956              Data,
1957              DataSize,
1958              NULL,
1959              NULL,
1960              NULL,
1961              NULL
1962              );
1963
1964   if (!EFI_ERROR (Status)) {
1965     ASSERT (FALSE);
1966     return EFI_ACCESS_DENIED;
1967   }
1968
1969   //
1970   // Construct new data content of variable "certdb".
1971   //
1972   NameSize      = (UINT32) StrLen (VariableName);
1973   CertNodeSize  = sizeof (AUTH_CERT_DB_DATA) + (UINT32) CertDataSize + NameSize * sizeof (CHAR16);
1974   NewCertDbSize = (UINT32) DataSize + CertNodeSize;
1975   if (NewCertDbSize > MAX_CERTDB_SIZE) {
1976     return EFI_OUT_OF_RESOURCES;
1977   }
1978   NewCertDb     = (UINT8*) mCertDbStore;
1979
1980   //
1981   // Copy the DB entries before deleting node.
1982   //
1983   CopyMem (NewCertDb, Data, DataSize);
1984   //
1985   // Update CertDbListSize.
1986   //
1987   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
1988   //
1989   // Construct new cert node.
1990   //
1991   Ptr = (AUTH_CERT_DB_DATA *) (NewCertDb + DataSize);
1992   CopyGuid (&Ptr->VendorGuid, VendorGuid);
1993   CopyMem (&Ptr->CertNodeSize, &CertNodeSize, sizeof (UINT32));
1994   CopyMem (&Ptr->NameSize, &NameSize, sizeof (UINT32));
1995   CopyMem (&Ptr->CertDataSize, &CertDataSize, sizeof (UINT32));
1996
1997   CopyMem (
1998     (UINT8 *) Ptr + sizeof (AUTH_CERT_DB_DATA),
1999     VariableName,
2000     NameSize * sizeof (CHAR16)
2001     );
2002
2003   CopyMem (
2004     (UINT8 *) Ptr +  sizeof (AUTH_CERT_DB_DATA) + NameSize * sizeof (CHAR16),
2005     CertData,
2006     CertDataSize
2007     );
2008
2009   //
2010   // Set "certdb".
2011   //
2012   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
2013   Status   = UpdateVariable (
2014                EFI_CERT_DB_NAME,
2015                &gEfiCertDbGuid,
2016                NewCertDb,
2017                NewCertDbSize,
2018                VarAttr,
2019                0,
2020                0,
2021                &CertDbVariable,
2022                NULL
2023                );
2024
2025   return Status;
2026 }
2027
2028 /**
2029   Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
2030
2031   Caution: This function may receive untrusted input.
2032   This function may be invoked in SMM mode, and datasize and data are external input.
2033   This function will do basic validation, before parse the data.
2034   This function will parse the authentication carefully to avoid security issues, like
2035   buffer overflow, integer overflow.
2036
2037   @param[in]  VariableName                Name of Variable to be found.
2038   @param[in]  VendorGuid                  Variable vendor GUID.
2039   @param[in]  Data                        Data pointer.
2040   @param[in]  DataSize                    Size of Data found. If size is less than the
2041                                           data, this value contains the required size.
2042   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
2043   @param[in]  Attributes                  Attribute value of the variable.
2044   @param[in]  AuthVarType                 Verify against PK, KEK database, private database or certificate in data payload.
2045   @param[out] VarDel                      Delete the variable or not.
2046
2047   @retval EFI_INVALID_PARAMETER           Invalid parameter.
2048   @retval EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
2049                                           check carried out by the firmware.
2050   @retval EFI_OUT_OF_RESOURCES            Failed to process variable due to lack
2051                                           of resources.
2052   @retval EFI_SUCCESS                     Variable pass validation successfully.
2053
2054 **/
2055 EFI_STATUS
2056 VerifyTimeBasedPayload (
2057   IN     CHAR16                             *VariableName,
2058   IN     EFI_GUID                           *VendorGuid,
2059   IN     VOID                               *Data,
2060   IN     UINTN                              DataSize,
2061   IN     VARIABLE_POINTER_TRACK             *Variable,
2062   IN     UINT32                             Attributes,
2063   IN     AUTHVAR_TYPE                       AuthVarType,
2064   OUT    BOOLEAN                            *VarDel
2065   )
2066 {
2067   UINT8                            *RootCert;
2068   UINT8                            *SigData;
2069   UINT8                            *PayloadPtr;
2070   UINTN                            RootCertSize;
2071   UINTN                            Index;
2072   UINTN                            CertCount;
2073   UINTN                            PayloadSize;
2074   UINT32                           Attr;
2075   UINT32                           SigDataSize;
2076   UINT32                           KekDataSize;
2077   BOOLEAN                          VerifyStatus;
2078   EFI_STATUS                       Status;
2079   EFI_SIGNATURE_LIST               *CertList;
2080   EFI_SIGNATURE_DATA               *Cert;
2081   VARIABLE_POINTER_TRACK           KekVariable;
2082   EFI_VARIABLE_AUTHENTICATION_2    *CertData;
2083   UINT8                            *NewData;
2084   UINTN                            NewDataSize;
2085   VARIABLE_POINTER_TRACK           PkVariable;
2086   UINT8                            *Buffer;
2087   UINTN                            Length;
2088   UINT8                            *SignerCerts;
2089   UINT8                            *WrapSigData;
2090   UINTN                            CertStackSize;
2091   UINT8                            *CertsInCertDb;
2092   UINT32                           CertsSizeinDb;
2093
2094   VerifyStatus           = FALSE;
2095   CertData               = NULL;
2096   NewData                = NULL;
2097   Attr                   = Attributes;
2098   WrapSigData            = NULL;
2099   SignerCerts            = NULL;
2100   RootCert               = NULL;
2101
2102   //
2103   // When the attribute EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS is
2104   // set, then the Data buffer shall begin with an instance of a complete (and serialized)
2105   // EFI_VARIABLE_AUTHENTICATION_2 descriptor. The descriptor shall be followed by the new
2106   // variable value and DataSize shall reflect the combined size of the descriptor and the new
2107   // variable value. The authentication descriptor is not part of the variable data and is not
2108   // returned by subsequent calls to GetVariable().
2109   //
2110   CertData = (EFI_VARIABLE_AUTHENTICATION_2 *) Data;
2111
2112   //
2113   // Verify that Pad1, Nanosecond, TimeZone, Daylight and Pad2 components of the
2114   // TimeStamp value are set to zero.
2115   //
2116   if ((CertData->TimeStamp.Pad1 != 0) ||
2117       (CertData->TimeStamp.Nanosecond != 0) ||
2118       (CertData->TimeStamp.TimeZone != 0) ||
2119       (CertData->TimeStamp.Daylight != 0) ||
2120       (CertData->TimeStamp.Pad2 != 0)) {
2121     return EFI_SECURITY_VIOLATION;
2122   }
2123
2124   if ((Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
2125     if (CompareTimeStamp (&CertData->TimeStamp, &Variable->CurrPtr->TimeStamp)) {
2126       //
2127       // TimeStamp check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
2128       //
2129       return EFI_SECURITY_VIOLATION;
2130     }
2131   }
2132
2133   //
2134   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
2135   // Cert type should be EFI_CERT_TYPE_PKCS7_GUID.
2136   //
2137   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
2138       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertPkcs7Guid)) {
2139     //
2140     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
2141     //
2142     return EFI_SECURITY_VIOLATION;
2143   }
2144
2145   //
2146   // Find out Pkcs7 SignedData which follows the EFI_VARIABLE_AUTHENTICATION_2 descriptor.
2147   // AuthInfo.Hdr.dwLength is the length of the entire certificate, including the length of the header.
2148   //
2149   SigData = CertData->AuthInfo.CertData;
2150   SigDataSize = CertData->AuthInfo.Hdr.dwLength - (UINT32) (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData));
2151
2152   //
2153   // Find out the new data payload which follows Pkcs7 SignedData directly.
2154   //
2155   PayloadPtr = SigData + SigDataSize;
2156   PayloadSize = DataSize - OFFSET_OF_AUTHINFO2_CERT_DATA - (UINTN) SigDataSize;
2157
2158   //
2159   // Construct a buffer to fill with (VariableName, VendorGuid, Attributes, TimeStamp, Data).
2160   //
2161   NewDataSize = PayloadSize + sizeof (EFI_TIME) + sizeof (UINT32) +
2162                 sizeof (EFI_GUID) + StrSize (VariableName) - sizeof (CHAR16);
2163   NewData = mSerializationRuntimeBuffer;
2164
2165   Buffer = NewData;
2166   Length = StrLen (VariableName) * sizeof (CHAR16);
2167   CopyMem (Buffer, VariableName, Length);
2168   Buffer += Length;
2169
2170   Length = sizeof (EFI_GUID);
2171   CopyMem (Buffer, VendorGuid, Length);
2172   Buffer += Length;
2173
2174   Length = sizeof (UINT32);
2175   CopyMem (Buffer, &Attr, Length);
2176   Buffer += Length;
2177
2178   Length = sizeof (EFI_TIME);
2179   CopyMem (Buffer, &CertData->TimeStamp, Length);
2180   Buffer += Length;
2181
2182   CopyMem (Buffer, PayloadPtr, PayloadSize);
2183
2184   if (AuthVarType == AuthVarTypePk) {
2185     //
2186     // Verify that the signature has been made with the current Platform Key (no chaining for PK).
2187     // First, get signer's certificates from SignedData.
2188     //
2189     VerifyStatus = Pkcs7GetSigners (
2190                      SigData,
2191                      SigDataSize,
2192                      &SignerCerts,
2193                      &CertStackSize,
2194                      &RootCert,
2195                      &RootCertSize
2196                      );
2197     if (!VerifyStatus) {
2198       goto Exit;
2199     }
2200
2201     //
2202     // Second, get the current platform key from variable. Check whether it's identical with signer's certificates
2203     // in SignedData. If not, return error immediately.
2204     //
2205     Status = FindVariable (
2206                EFI_PLATFORM_KEY_NAME,
2207                &gEfiGlobalVariableGuid,
2208                &PkVariable,
2209                &mVariableModuleGlobal->VariableGlobal,
2210                FALSE
2211                );
2212     if (EFI_ERROR (Status)) {
2213       VerifyStatus = FALSE;
2214       goto Exit;
2215     }
2216     CertList = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (PkVariable.CurrPtr);
2217     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2218     if ((RootCertSize != (CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1))) ||
2219         (CompareMem (Cert->SignatureData, RootCert, RootCertSize) != 0)) {
2220       VerifyStatus = FALSE;
2221       goto Exit;
2222     }
2223
2224     //
2225     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2226     //
2227     VerifyStatus = Pkcs7Verify (
2228                      SigData,
2229                      SigDataSize,
2230                      RootCert,
2231                      RootCertSize,
2232                      NewData,
2233                      NewDataSize
2234                      );
2235
2236   } else if (AuthVarType == AuthVarTypeKek) {
2237
2238     //
2239     // Get KEK database from variable.
2240     //
2241     Status = FindVariable (
2242                EFI_KEY_EXCHANGE_KEY_NAME,
2243                &gEfiGlobalVariableGuid,
2244                &KekVariable,
2245                &mVariableModuleGlobal->VariableGlobal,
2246                FALSE
2247                );
2248     if (EFI_ERROR (Status)) {
2249       return Status;
2250     }
2251
2252     //
2253     // Ready to verify Pkcs7 SignedData. Go through KEK Signature Database to find out X.509 CertList.
2254     //
2255     KekDataSize      = KekVariable.CurrPtr->DataSize;
2256     CertList         = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (KekVariable.CurrPtr);
2257     while ((KekDataSize > 0) && (KekDataSize >= CertList->SignatureListSize)) {
2258       if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {
2259         Cert       = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2260         CertCount  = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
2261         for (Index = 0; Index < CertCount; Index++) {
2262           //
2263           // Iterate each Signature Data Node within this CertList for a verify
2264           //
2265           RootCert      = Cert->SignatureData;
2266           RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2267
2268           //
2269           // Verify Pkcs7 SignedData via Pkcs7Verify library.
2270           //
2271           VerifyStatus = Pkcs7Verify (
2272                            SigData,
2273                            SigDataSize,
2274                            RootCert,
2275                            RootCertSize,
2276                            NewData,
2277                            NewDataSize
2278                            );
2279           if (VerifyStatus) {
2280             goto Exit;
2281           }
2282           Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
2283         }
2284       }
2285       KekDataSize -= CertList->SignatureListSize;
2286       CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
2287     }
2288   } else if (AuthVarType == AuthVarTypePriv) {
2289
2290     //
2291     // Process common authenticated variable except PK/KEK/DB/DBX.
2292     // Get signer's certificates from SignedData.
2293     //
2294     VerifyStatus = Pkcs7GetSigners (
2295                      SigData,
2296                      SigDataSize,
2297                      &SignerCerts,
2298                      &CertStackSize,
2299                      &RootCert,
2300                      &RootCertSize
2301                      );
2302     if (!VerifyStatus) {
2303       goto Exit;
2304     }
2305
2306     //
2307     // Get previously stored signer's certificates from certdb for existing
2308     // variable. Check whether they are identical with signer's certificates
2309     // in SignedData. If not, return error immediately.
2310     //
2311     if ((Variable->CurrPtr != NULL)) {
2312       VerifyStatus = FALSE;
2313
2314       Status = GetCertsFromDb (VariableName, VendorGuid, &CertsInCertDb, &CertsSizeinDb);
2315       if (EFI_ERROR (Status)) {
2316         goto Exit;
2317       }
2318
2319       if ((CertStackSize != CertsSizeinDb) ||
2320           (CompareMem (SignerCerts, CertsInCertDb, CertsSizeinDb) != 0)) {
2321         goto Exit;
2322       }
2323     }
2324
2325     VerifyStatus = Pkcs7Verify (
2326                      SigData,
2327                      SigDataSize,
2328                      RootCert,
2329                      RootCertSize,
2330                      NewData,
2331                      NewDataSize
2332                      );
2333     if (!VerifyStatus) {
2334       goto Exit;
2335     }
2336
2337     //
2338     // Delete signer's certificates when delete the common authenticated variable.
2339     //
2340     if ((PayloadSize == 0) && (Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
2341       Status = DeleteCertsFromDb (VariableName, VendorGuid);
2342       if (EFI_ERROR (Status)) {
2343         VerifyStatus = FALSE;
2344         goto Exit;
2345       }
2346     } else if (Variable->CurrPtr == NULL && PayloadSize != 0) {
2347       //
2348       // Insert signer's certificates when adding a new common authenticated variable.
2349       //
2350       Status = InsertCertsToDb (VariableName, VendorGuid, SignerCerts, CertStackSize);
2351       if (EFI_ERROR (Status)) {
2352         VerifyStatus = FALSE;
2353         goto Exit;
2354       }
2355     }
2356   } else if (AuthVarType == AuthVarTypePayload) {
2357     CertList = (EFI_SIGNATURE_LIST *) PayloadPtr;
2358     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2359     RootCert      = Cert->SignatureData;
2360     RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2361
2362     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2363     //
2364     VerifyStatus = Pkcs7Verify (
2365                      SigData,
2366                      SigDataSize,
2367                      RootCert,
2368                      RootCertSize,
2369                      NewData,
2370                      NewDataSize
2371                      );
2372   } else {
2373     return EFI_SECURITY_VIOLATION;
2374   }
2375
2376 Exit:
2377
2378   if (AuthVarType == AuthVarTypePk || AuthVarType == AuthVarTypePriv) {
2379     Pkcs7FreeSigners (RootCert);
2380     Pkcs7FreeSigners (SignerCerts);
2381   }
2382
2383   if (!VerifyStatus) {
2384     return EFI_SECURITY_VIOLATION;
2385   }
2386
2387   Status = CheckSignatureListFormat(VariableName, VendorGuid, PayloadPtr, PayloadSize);
2388   if (EFI_ERROR (Status)) {
2389     return Status;
2390   }
2391
2392   if ((PayloadSize == 0) && (VarDel != NULL)) {
2393     *VarDel = TRUE;
2394   }
2395
2396   //
2397   // Final step: Update/Append Variable if it pass Pkcs7Verify
2398   //
2399   return UpdateVariable (
2400            VariableName,
2401            VendorGuid,
2402            PayloadPtr,
2403            PayloadSize,
2404            Attributes,
2405            0,
2406            0,
2407            Variable,
2408            &CertData->TimeStamp
2409            );
2410 }
2411