SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c

   1 /** @file
   2   Implement authentication services for the authenticated variable
   3   service in UEFI2.2.
   4
   5   Caution: This module requires additional review when modified.
   6   This driver will have external input - variable data. It may be input in SMM mode.
   7   This external input must be validated carefully to avoid security issue like
   8   buffer overflow, integer overflow.
   9   Variable attribute should also be checked to avoid authentication bypass.
  10      The whole SMM authentication variable design relies on the integrity of flash part and SMM.
  11   which is assumed to be protected by platform.  All variable code and metadata in flash/SMM Memory
  12   may not be modified without authorization. If platform fails to protect these resources,
  13   the authentication service provided in this driver will be broken, and the behavior is undefined.
  14
  15   ProcessVarWithPk(), ProcessVarWithKek() and ProcessVariable() are the function to do
  16   variable authentication.
  17
  18   VerifyTimeBasedPayload() and VerifyCounterBasedPayload() are sub function to do verification.
  19   They will do basic validation for authentication data structure, then call crypto library
  20   to verify the signature.
  21
  22 Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
  23 This program and the accompanying materials
  24 are licensed and made available under the terms and conditions of the BSD License
  25 which accompanies this distribution.  The full text of the license may be found at
  26 http://opensource.org/licenses/bsd-license.php
  27
  28 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  29 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  30
  31 **/
  32
  33 #include "Variable.h"
  34 #include "AuthService.h"
  35
  36 ///
  37 /// Global database array for scratch
  38 ///
  39 UINT8    *mPubKeyStore;
  40 UINT32   mPubKeyNumber;
  41 UINT32   mMaxKeyNumber;
  42 UINT32   mMaxKeyDbSize;
  43 UINT8    *mCertDbStore;
  44 UINT32   mMaxCertDbSize;
  45 UINT32   mPlatformMode;
  46 UINT8    mVendorKeyState;
  47
  48 EFI_GUID mSignatureSupport[] = {EFI_CERT_SHA1_GUID, EFI_CERT_SHA256_GUID, EFI_CERT_RSA2048_GUID, EFI_CERT_X509_GUID};
  49 //
  50 // Public Exponent of RSA Key.
  51 //
  52 CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };
  53 //
  54 // Hash context pointer
  55 //
  56 VOID  *mHashCtx = NULL;
  57
  58 //
  59 // The serialization of the values of the VariableName, VendorGuid and Attributes
  60 // parameters of the SetVariable() call and the TimeStamp component of the
  61 // EFI_VARIABLE_AUTHENTICATION_2 descriptor followed by the variable's new value
  62 // i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data)
  63 //
  64 UINT8 *mSerializationRuntimeBuffer = NULL;
  65
  66 //
  67 // Requirement for different signature type which have been defined in UEFI spec.
  68 // These data are used to peform SignatureList format check while setting PK/KEK variable.
  69 //
  70 EFI_SIGNATURE_ITEM mSupportSigItem[] = {
  71 //{SigType,                       SigHeaderSize,   SigDataSize  }
  72   {EFI_CERT_SHA256_GUID,          0,               32           },
  73   {EFI_CERT_RSA2048_GUID,         0,               256          },
  74   {EFI_CERT_RSA2048_SHA256_GUID,  0,               256          },
  75   {EFI_CERT_SHA1_GUID,            0,               20           },
  76   {EFI_CERT_RSA2048_SHA1_GUID,    0,               256          },
  77   {EFI_CERT_X509_GUID,            0,               ((UINT32) ~0)},
  78   {EFI_CERT_SHA224_GUID,          0,               28           },
  79   {EFI_CERT_SHA384_GUID,          0,               48           },
  80   {EFI_CERT_SHA512_GUID,          0,               64           },
  81   {EFI_CERT_X509_SHA256_GUID,     0,               48           },
  82   {EFI_CERT_X509_SHA384_GUID,     0,               64           },
  83   {EFI_CERT_X509_SHA512_GUID,     0,               80           }
  84 };
  85
  86 /**
  87   Determine whether this operation needs a physical present user.
  88
  89   @param[in]      VariableName            Name of the Variable.
  90   @param[in]      VendorGuid              GUID of the Variable.
  91
  92   @retval TRUE      This variable is protected, only a physical present user could set this variable.
  93   @retval FALSE     This variable is not protected.
  94
  95 **/
  96 BOOLEAN
  97 NeedPhysicallyPresent(
  98   IN     CHAR16         *VariableName,
  99   IN     EFI_GUID       *VendorGuid
 100   )
 101 {
 102   if ((CompareGuid (VendorGuid, &gEfiSecureBootEnableDisableGuid) && (StrCmp (VariableName, EFI_SECURE_BOOT_ENABLE_NAME) == 0))
 103     || (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (VariableName, EFI_CUSTOM_MODE_NAME) == 0))) {
 104     return TRUE;
 105   }
 106
 107   return FALSE;
 108 }
 109
 110 /**
 111   Determine whether the platform is operating in Custom Secure Boot mode.
 112
 113   @retval TRUE           The platform is operating in Custom mode.
 114   @retval FALSE          The platform is operating in Standard mode.
 115
 116 **/
 117 BOOLEAN
 118 InCustomMode (
 119   VOID
 120   )
 121 {
 122   VARIABLE_POINTER_TRACK  Variable;
 123
 124   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 125   if (Variable.CurrPtr != NULL && *(GetVariableDataPtr (Variable.CurrPtr)) == CUSTOM_SECURE_BOOT_MODE) {
 126     return TRUE;
 127   }
 128
 129   return FALSE;
 130 }
 131
 132
 133 /**
 134   Internal function to delete a Variable given its name and GUID, no authentication
 135   required.
 136
 137   @param[in]      VariableName            Name of the Variable.
 138   @param[in]      VendorGuid              GUID of the Variable.
 139
 140   @retval EFI_SUCCESS              Variable deleted successfully.
 141   @retval Others                   The driver failded to start the device.
 142
 143 **/
 144 EFI_STATUS
 145 DeleteVariable (
 146   IN  CHAR16                    *VariableName,
 147   IN  EFI_GUID                  *VendorGuid
 148   )
 149 {
 150   EFI_STATUS              Status;
 151   VARIABLE_POINTER_TRACK  Variable;
 152
 153   Status = FindVariable (VariableName, VendorGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 154   if (EFI_ERROR (Status)) {
 155     return EFI_SUCCESS;
 156   }
 157
 158   ASSERT (Variable.CurrPtr != NULL);
 159   return UpdateVariable (VariableName, VendorGuid, NULL, 0, 0, 0, 0, &Variable, NULL);
 160 }
 161
 162 /**
 163   Initializes for authenticated varibale service.
 164
 165   @retval EFI_SUCCESS           Function successfully executed.
 166   @retval EFI_OUT_OF_RESOURCES  Fail to allocate enough memory resources.
 167
 168 **/
 169 EFI_STATUS
 170 AutenticatedVariableServiceInitialize (
 171   VOID
 172   )
 173 {
 174   EFI_STATUS              Status;
 175   VARIABLE_POINTER_TRACK  Variable;
 176   VARIABLE_POINTER_TRACK  PkVariable;
 177   UINT8                   VarValue;
 178   UINT32                  VarAttr;
 179   UINT8                   *Data;
 180   UINTN                   DataSize;
 181   UINTN                   CtxSize;
 182   UINT8                   SecureBootMode;
 183   UINT8                   SecureBootEnable;
 184   UINT8                   CustomMode;
 185   UINT32                  ListSize;
 186
 187   //
 188   // Initialize hash context.
 189   //
 190   CtxSize   = Sha256GetContextSize ();
 191   mHashCtx  = AllocateRuntimePool (CtxSize);
 192   if (mHashCtx == NULL) {
 193     return EFI_OUT_OF_RESOURCES;
 194   }
 195
 196   //
 197   // Reserve runtime buffer for public key database. The size excludes variable header and name size.
 198   //
 199   mMaxKeyDbSize = PcdGet32 (PcdMaxVariableSize) - sizeof (VARIABLE_HEADER) - sizeof (AUTHVAR_KEYDB_NAME);
 200   mMaxKeyNumber = mMaxKeyDbSize / EFI_CERT_TYPE_RSA2048_SIZE;
 201   mPubKeyStore  = AllocateRuntimePool (mMaxKeyDbSize);
 202   if (mPubKeyStore == NULL) {
 203     return EFI_OUT_OF_RESOURCES;
 204   }
 205
 206   //
 207   // Reserve runtime buffer for certificate database. The size excludes variable header and name size.
 208   //
 209   mMaxCertDbSize = PcdGet32 (PcdMaxVariableSize) - sizeof (VARIABLE_HEADER) - sizeof (EFI_CERT_DB_NAME);
 210   mCertDbStore   = AllocateRuntimePool (mMaxCertDbSize);
 211   if (mCertDbStore == NULL) {
 212     return EFI_OUT_OF_RESOURCES;
 213   }
 214
 215   //
 216   // Prepare runtime buffer for serialized data of time-based authenticated
 217   // Variable, i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data).
 218   //
 219   mSerializationRuntimeBuffer = AllocateRuntimePool (PcdGet32 (PcdMaxVariableSize) + sizeof (EFI_GUID) + sizeof (UINT32) + sizeof (EFI_TIME));
 220   if (mSerializationRuntimeBuffer == NULL) {
 221     return EFI_OUT_OF_RESOURCES;
 222   }
 223
 224   //
 225   // Check "AuthVarKeyDatabase" variable's existence.
 226   // If it doesn't exist, create a new one with initial value of 0 and EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
 227   //
 228   Status = FindVariable (
 229              AUTHVAR_KEYDB_NAME,
 230              &gEfiAuthenticatedVariableGuid,
 231              &Variable,
 232              &mVariableModuleGlobal->VariableGlobal,
 233              FALSE
 234              );
 235
 236   if (Variable.CurrPtr == NULL) {
 237     VarAttr       = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 238     VarValue      = 0;
 239     mPubKeyNumber = 0;
 240     Status        = UpdateVariable (
 241                       AUTHVAR_KEYDB_NAME,
 242                       &gEfiAuthenticatedVariableGuid,
 243                       &VarValue,
 244                       sizeof(UINT8),
 245                       VarAttr,
 246                       0,
 247                       0,
 248                       &Variable,
 249                       NULL
 250                       );
 251     if (EFI_ERROR (Status)) {
 252       return Status;
 253     }
 254   } else {
 255     //
 256     // Load database in global variable for cache.
 257     //
 258     DataSize  = DataSizeOfVariable (Variable.CurrPtr);
 259     Data      = GetVariableDataPtr (Variable.CurrPtr);
 260     ASSERT ((DataSize != 0) && (Data != NULL));
 261     //
 262     // "AuthVarKeyDatabase" is an internal variable. Its DataSize is always ensured not to exceed mPubKeyStore buffer size(See definition before)
 263     //  Therefore, there is no memory overflow in underlying CopyMem.
 264     //
 265     CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
 266     mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
 267   }
 268
 269   FindVariable (EFI_PLATFORM_KEY_NAME, &gEfiGlobalVariableGuid, &PkVariable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 270   if (PkVariable.CurrPtr == NULL) {
 271     DEBUG ((EFI_D_INFO, "Variable %s does not exist.\n", EFI_PLATFORM_KEY_NAME));
 272   } else {
 273     DEBUG ((EFI_D_INFO, "Variable %s exists.\n", EFI_PLATFORM_KEY_NAME));
 274   }
 275
 276   //
 277   // Create "SetupMode" variable with BS+RT attribute set.
 278   //
 279   FindVariable (EFI_SETUP_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 280   if (PkVariable.CurrPtr == NULL) {
 281     mPlatformMode = SETUP_MODE;
 282   } else {
 283     mPlatformMode = USER_MODE;
 284   }
 285   Status = UpdateVariable (
 286              EFI_SETUP_MODE_NAME,
 287              &gEfiGlobalVariableGuid,
 288              &mPlatformMode,
 289              sizeof(UINT8),
 290              EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 291              0,
 292              0,
 293              &Variable,
 294              NULL
 295              );
 296   if (EFI_ERROR (Status)) {
 297     return Status;
 298   }
 299
 300   //
 301   // Create "SignatureSupport" variable with BS+RT attribute set.
 302   //
 303   FindVariable (EFI_SIGNATURE_SUPPORT_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 304   Status  = UpdateVariable (
 305               EFI_SIGNATURE_SUPPORT_NAME,
 306               &gEfiGlobalVariableGuid,
 307               mSignatureSupport,
 308               sizeof(mSignatureSupport),
 309               EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 310               0,
 311               0,
 312               &Variable,
 313               NULL
 314               );
 315   if (EFI_ERROR (Status)) {
 316     return Status;
 317   }
 318
 319   //
 320   // If "SecureBootEnable" variable exists, then update "SecureBoot" variable.
 321   // If "SecureBootEnable" variable is SECURE_BOOT_ENABLE and in USER_MODE, Set "SecureBoot" variable to SECURE_BOOT_MODE_ENABLE.
 322   // If "SecureBootEnable" variable is SECURE_BOOT_DISABLE, Set "SecureBoot" variable to SECURE_BOOT_MODE_DISABLE.
 323   //
 324   SecureBootEnable = SECURE_BOOT_DISABLE;
 325   FindVariable (EFI_SECURE_BOOT_ENABLE_NAME, &gEfiSecureBootEnableDisableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 326   if (Variable.CurrPtr != NULL) {
 327     SecureBootEnable = *(GetVariableDataPtr (Variable.CurrPtr));
 328   } else if (mPlatformMode == USER_MODE) {
 329     //
 330     // "SecureBootEnable" not exist, initialize it in USER_MODE.
 331     //
 332     SecureBootEnable = SECURE_BOOT_ENABLE;
 333     Status = UpdateVariable (
 334                EFI_SECURE_BOOT_ENABLE_NAME,
 335                &gEfiSecureBootEnableDisableGuid,
 336                &SecureBootEnable,
 337                sizeof (UINT8),
 338                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 339                0,
 340                0,
 341                &Variable,
 342                NULL
 343                );
 344     if (EFI_ERROR (Status)) {
 345       return Status;
 346     }
 347   }
 348
 349   //
 350   // Create "SecureBoot" variable with BS+RT attribute set.
 351   //
 352   if (SecureBootEnable == SECURE_BOOT_ENABLE && mPlatformMode == USER_MODE) {
 353     SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 354   } else {
 355     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 356   }
 357   FindVariable (EFI_SECURE_BOOT_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 358   Status = UpdateVariable (
 359              EFI_SECURE_BOOT_MODE_NAME,
 360              &gEfiGlobalVariableGuid,
 361              &SecureBootMode,
 362              sizeof (UINT8),
 363              EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 364              0,
 365              0,
 366              &Variable,
 367              NULL
 368              );
 369   if (EFI_ERROR (Status)) {
 370     return Status;
 371   }
 372
 373   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SETUP_MODE_NAME, mPlatformMode));
 374   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_MODE_NAME, SecureBootMode));
 375   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_ENABLE_NAME, SecureBootEnable));
 376
 377   //
 378   // Initialize "CustomMode" in STANDARD_SECURE_BOOT_MODE state.
 379   //
 380   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 381   CustomMode = STANDARD_SECURE_BOOT_MODE;
 382   Status = UpdateVariable (
 383              EFI_CUSTOM_MODE_NAME,
 384              &gEfiCustomModeEnableGuid,
 385              &CustomMode,
 386              sizeof (UINT8),
 387              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 388              0,
 389              0,
 390              &Variable,
 391              NULL
 392              );
 393   if (EFI_ERROR (Status)) {
 394     return Status;
 395   }
 396
 397   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_CUSTOM_MODE_NAME, CustomMode));
 398
 399   //
 400   // Check "certdb" variable's existence.
 401   // If it doesn't exist, then create a new one with
 402   // EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.
 403   //
 404   Status = FindVariable (
 405              EFI_CERT_DB_NAME,
 406              &gEfiCertDbGuid,
 407              &Variable,
 408              &mVariableModuleGlobal->VariableGlobal,
 409              FALSE
 410              );
 411
 412   if (Variable.CurrPtr == NULL) {
 413     VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
 414     ListSize = sizeof (UINT32);
 415     Status   = UpdateVariable (
 416                  EFI_CERT_DB_NAME,
 417                  &gEfiCertDbGuid,
 418                  &ListSize,
 419                  sizeof (UINT32),
 420                  VarAttr,
 421                  0,
 422                  0,
 423                  &Variable,
 424                  NULL
 425                  );
 426     if (EFI_ERROR (Status)) {
 427       return Status;
 428     }
 429   }
 430
 431   //
 432   // Check "VendorKeysNv" variable's existence and create "VendorKeys" variable accordingly.
 433   //
 434   FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 435   if (Variable.CurrPtr != NULL) {
 436     mVendorKeyState = *(GetVariableDataPtr (Variable.CurrPtr));
 437   } else {
 438     //
 439     // "VendorKeysNv" not exist, initialize it in VENDOR_KEYS_VALID state.
 440     //
 441     mVendorKeyState = VENDOR_KEYS_VALID;
 442     Status = UpdateVariable (
 443                EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
 444                &gEfiVendorKeysNvGuid,
 445                &mVendorKeyState,
 446                sizeof (UINT8),
 447                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS,
 448                0,
 449                0,
 450                &Variable,
 451                NULL
 452                );
 453     if (EFI_ERROR (Status)) {
 454       return Status;
 455     }
 456   }
 457
 458   //
 459   // Create "VendorKeys" variable with BS+RT attribute set.
 460   //
 461   FindVariable (EFI_VENDOR_KEYS_VARIABLE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 462   Status = UpdateVariable (
 463              EFI_VENDOR_KEYS_VARIABLE_NAME,
 464              &gEfiGlobalVariableGuid,
 465              &mVendorKeyState,
 466              sizeof (UINT8),
 467              EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 468              0,
 469              0,
 470              &Variable,
 471              NULL
 472              );
 473   if (EFI_ERROR (Status)) {
 474     return Status;
 475   }
 476
 477   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_VENDOR_KEYS_VARIABLE_NAME, mVendorKeyState));
 478
 479   return Status;
 480 }
 481
 482 /**
 483   Add public key in store and return its index.
 484
 485   @param[in]  PubKey                  Input pointer to Public Key data
 486   @param[in]  VariableDataEntry       The variable data entry
 487
 488   @return                             Index of new added item
 489
 490 **/
 491 UINT32
 492 AddPubKeyInStore (
 493   IN  UINT8                        *PubKey,
 494   IN  VARIABLE_ENTRY_CONSISTENCY   *VariableDataEntry
 495   )
 496 {
 497   EFI_STATUS                       Status;
 498   BOOLEAN                          IsFound;
 499   UINT32                           Index;
 500   VARIABLE_POINTER_TRACK           Variable;
 501   UINT8                            *Ptr;
 502   UINT8                            *Data;
 503   UINTN                            DataSize;
 504   VARIABLE_ENTRY_CONSISTENCY       PublicKeyEntry;
 505   UINT32                           Attributes;
 506
 507   if (PubKey == NULL) {
 508     return 0;
 509   }
 510
 511   Status = FindVariable (
 512              AUTHVAR_KEYDB_NAME,
 513              &gEfiAuthenticatedVariableGuid,
 514              &Variable,
 515              &mVariableModuleGlobal->VariableGlobal,
 516              FALSE
 517              );
 518   if (EFI_ERROR (Status)) {
 519     DEBUG ((EFI_D_ERROR, "Get public key database variable failure, Status = %r\n", Status));
 520     return 0;
 521   }
 522
 523   //
 524   // Check whether the public key entry does exist.
 525   //
 526   IsFound = FALSE;
 527   for (Ptr = mPubKeyStore, Index = 1; Index <= mPubKeyNumber; Index++) {
 528     if (CompareMem (Ptr, PubKey, EFI_CERT_TYPE_RSA2048_SIZE) == 0) {
 529       IsFound = TRUE;
 530       break;
 531     }
 532     Ptr += EFI_CERT_TYPE_RSA2048_SIZE;
 533   }
 534
 535   if (!IsFound) {
 536     //
 537     // Add public key in database.
 538     //
 539     if (mPubKeyNumber == mMaxKeyNumber) {
 540       //
 541       // Public key dadatase is full, try to reclaim invalid key.
 542       //
 543       if (AtRuntime ()) {
 544         //
 545         // NV storage can't reclaim at runtime.
 546         //
 547         return 0;
 548       }
 549
 550       Status = Reclaim (
 551                  mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase,
 552                  &mVariableModuleGlobal->NonVolatileLastVariableOffset,
 553                  FALSE,
 554                  NULL,
 555                  NULL,
 556                  0,
 557                  TRUE
 558                  );
 559       if (EFI_ERROR (Status)) {
 560         return 0;
 561       }
 562
 563       Status = FindVariable (
 564                  AUTHVAR_KEYDB_NAME,
 565                  &gEfiAuthenticatedVariableGuid,
 566                  &Variable,
 567                  &mVariableModuleGlobal->VariableGlobal,
 568                  FALSE
 569                  );
 570       if (EFI_ERROR (Status)) {
 571         DEBUG ((EFI_D_ERROR, "Get public key database variable failure, Status = %r\n", Status));
 572         return 0;
 573       }
 574
 575       DataSize  = DataSizeOfVariable (Variable.CurrPtr);
 576       Data      = GetVariableDataPtr (Variable.CurrPtr);
 577       ASSERT ((DataSize != 0) && (Data != NULL));
 578       //
 579       // "AuthVarKeyDatabase" is an internal used variable. Its DataSize is always ensured not to exceed mPubKeyStore buffer size(See definition before)
 580       //  Therefore, there is no memory overflow in underlying CopyMem.
 581       //
 582       CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
 583       mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
 584
 585       if (mPubKeyNumber == mMaxKeyNumber) {
 586         return 0;
 587       }
 588     }
 589
 590     //
 591     // Check the variable space for both public key and variable data.
 592     //
 593     PublicKeyEntry.VariableSize = (mPubKeyNumber + 1) * EFI_CERT_TYPE_RSA2048_SIZE;
 594     PublicKeyEntry.Guid         = &gEfiAuthenticatedVariableGuid;
 595     PublicKeyEntry.Name         = AUTHVAR_KEYDB_NAME;
 596     Attributes = VARIABLE_ATTRIBUTE_NV_BS_RT | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 597
 598     if (!CheckRemainingSpaceForConsistency (Attributes, &PublicKeyEntry, VariableDataEntry, NULL)) {
 599       //
 600       // No enough variable space.
 601       //
 602       return 0;
 603     }
 604
 605     CopyMem (mPubKeyStore + mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 606     Index = ++mPubKeyNumber;
 607     //
 608     // Update public key database variable.
 609     //
 610     Status = UpdateVariable (
 611                AUTHVAR_KEYDB_NAME,
 612                &gEfiAuthenticatedVariableGuid,
 613                mPubKeyStore,
 614                mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE,
 615                Attributes,
 616                0,
 617                0,
 618                &Variable,
 619                NULL
 620                );
 621     if (EFI_ERROR (Status)) {
 622       DEBUG ((EFI_D_ERROR, "Update public key database variable failure, Status = %r\n", Status));
 623       return 0;
 624     }
 625   }
 626
 627   return Index;
 628 }
 629
 630 /**
 631   Verify data payload with AuthInfo in EFI_CERT_TYPE_RSA2048_SHA256_GUID type.
 632   Follow the steps in UEFI2.2.
 633
 634   Caution: This function may receive untrusted input.
 635   This function may be invoked in SMM mode, and datasize and data are external input.
 636   This function will do basic validation, before parse the data.
 637   This function will parse the authentication carefully to avoid security issues, like
 638   buffer overflow, integer overflow.
 639
 640   @param[in]      Data                    Pointer to data with AuthInfo.
 641   @param[in]      DataSize                Size of Data.
 642   @param[in]      PubKey                  Public key used for verification.
 643
 644   @retval EFI_INVALID_PARAMETER       Invalid parameter.
 645   @retval EFI_SECURITY_VIOLATION      If authentication failed.
 646   @retval EFI_SUCCESS                 Authentication successful.
 647
 648 **/
 649 EFI_STATUS
 650 VerifyCounterBasedPayload (
 651   IN     UINT8          *Data,
 652   IN     UINTN          DataSize,
 653   IN     UINT8          *PubKey
 654   )
 655 {
 656   BOOLEAN                         Status;
 657   EFI_VARIABLE_AUTHENTICATION     *CertData;
 658   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
 659   UINT8                           Digest[SHA256_DIGEST_SIZE];
 660   VOID                            *Rsa;
 661   UINTN                           PayloadSize;
 662
 663   PayloadSize = DataSize - AUTHINFO_SIZE;
 664   Rsa         = NULL;
 665   CertData    = NULL;
 666   CertBlock   = NULL;
 667
 668   if (Data == NULL || PubKey == NULL) {
 669     return EFI_INVALID_PARAMETER;
 670   }
 671
 672   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
 673   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
 674
 675   //
 676   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
 677   // Cert type should be EFI_CERT_TYPE_RSA2048_SHA256_GUID.
 678   //
 679   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
 680       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertTypeRsa2048Sha256Guid)
 681         ) {
 682     //
 683     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
 684     //
 685     return EFI_SECURITY_VIOLATION;
 686   }
 687   //
 688   // Hash data payload with SHA256.
 689   //
 690   ZeroMem (Digest, SHA256_DIGEST_SIZE);
 691   Status  = Sha256Init (mHashCtx);
 692   if (!Status) {
 693     goto Done;
 694   }
 695   Status  = Sha256Update (mHashCtx, Data + AUTHINFO_SIZE, PayloadSize);
 696   if (!Status) {
 697     goto Done;
 698   }
 699   //
 700   // Hash Size.
 701   //
 702   Status  = Sha256Update (mHashCtx, &PayloadSize, sizeof (UINTN));
 703   if (!Status) {
 704     goto Done;
 705   }
 706   //
 707   // Hash Monotonic Count.
 708   //
 709   Status  = Sha256Update (mHashCtx, &CertData->MonotonicCount, sizeof (UINT64));
 710   if (!Status) {
 711     goto Done;
 712   }
 713   Status  = Sha256Final (mHashCtx, Digest);
 714   if (!Status) {
 715     goto Done;
 716   }
 717   //
 718   // Generate & Initialize RSA Context.
 719   //
 720   Rsa = RsaNew ();
 721   ASSERT (Rsa != NULL);
 722   //
 723   // Set RSA Key Components.
 724   // NOTE: Only N and E are needed to be set as RSA public key for signature verification.
 725   //
 726   Status = RsaSetKey (Rsa, RsaKeyN, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 727   if (!Status) {
 728     goto Done;
 729   }
 730   Status = RsaSetKey (Rsa, RsaKeyE, mRsaE, sizeof (mRsaE));
 731   if (!Status) {
 732     goto Done;
 733   }
 734   //
 735   // Verify the signature.
 736   //
 737   Status = RsaPkcs1Verify (
 738              Rsa,
 739              Digest,
 740              SHA256_DIGEST_SIZE,
 741              CertBlock->Signature,
 742              EFI_CERT_TYPE_RSA2048_SHA256_SIZE
 743              );
 744
 745 Done:
 746   if (Rsa != NULL) {
 747     RsaFree (Rsa);
 748   }
 749   if (Status) {
 750     return EFI_SUCCESS;
 751   } else {
 752     return EFI_SECURITY_VIOLATION;
 753   }
 754 }
 755
 756 /**
 757   Update platform mode.
 758
 759   @param[in]      Mode                    SETUP_MODE or USER_MODE.
 760
 761   @return EFI_INVALID_PARAMETER           Invalid parameter.
 762   @return EFI_SUCCESS                     Update platform mode successfully.
 763
 764 **/
 765 EFI_STATUS
 766 UpdatePlatformMode (
 767   IN  UINT32                    Mode
 768   )
 769 {
 770   EFI_STATUS              Status;
 771   VARIABLE_POINTER_TRACK  Variable;
 772   UINT8                   SecureBootMode;
 773   UINT8                   SecureBootEnable;
 774   UINTN                   VariableDataSize;
 775
 776   Status = FindVariable (
 777              EFI_SETUP_MODE_NAME,
 778              &gEfiGlobalVariableGuid,
 779              &Variable,
 780              &mVariableModuleGlobal->VariableGlobal,
 781              FALSE
 782              );
 783   if (EFI_ERROR (Status)) {
 784     return Status;
 785   }
 786
 787   //
 788   // Update the value of SetupMode variable by a simple mem copy, this could avoid possible
 789   // variable storage reclaim at runtime.
 790   //
 791   mPlatformMode = (UINT8) Mode;
 792   CopyMem (GetVariableDataPtr (Variable.CurrPtr), &mPlatformMode, sizeof(UINT8));
 793
 794   if (AtRuntime ()) {
 795     //
 796     // SecureBoot Variable indicates whether the platform firmware is operating
 797     // in Secure boot mode (1) or not (0), so we should not change SecureBoot
 798     // Variable in runtime.
 799     //
 800     return Status;
 801   }
 802
 803   //
 804   // Check "SecureBoot" variable's existence.
 805   // If it doesn't exist, firmware has no capability to perform driver signing verification,
 806   // then set "SecureBoot" to 0.
 807   //
 808   Status = FindVariable (
 809              EFI_SECURE_BOOT_MODE_NAME,
 810              &gEfiGlobalVariableGuid,
 811              &Variable,
 812              &mVariableModuleGlobal->VariableGlobal,
 813              FALSE
 814              );
 815   //
 816   // If "SecureBoot" variable exists, then check "SetupMode" variable update.
 817   // If "SetupMode" variable is USER_MODE, "SecureBoot" variable is set to 1.
 818   // If "SetupMode" variable is SETUP_MODE, "SecureBoot" variable is set to 0.
 819   //
 820   if (Variable.CurrPtr == NULL) {
 821     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 822   } else {
 823     if (mPlatformMode == USER_MODE) {
 824       SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 825     } else if (mPlatformMode == SETUP_MODE) {
 826       SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 827     } else {
 828       return EFI_NOT_FOUND;
 829     }
 830   }
 831
 832   Status  = UpdateVariable (
 833               EFI_SECURE_BOOT_MODE_NAME,
 834               &gEfiGlobalVariableGuid,
 835               &SecureBootMode,
 836               sizeof(UINT8),
 837               EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 838               0,
 839               0,
 840               &Variable,
 841               NULL
 842               );
 843   if (EFI_ERROR (Status)) {
 844     return Status;
 845   }
 846
 847   //
 848   // Check "SecureBootEnable" variable's existence. It can enable/disable secure boot feature.
 849   //
 850   Status = FindVariable (
 851              EFI_SECURE_BOOT_ENABLE_NAME,
 852              &gEfiSecureBootEnableDisableGuid,
 853              &Variable,
 854              &mVariableModuleGlobal->VariableGlobal,
 855              FALSE
 856              );
 857
 858   if (SecureBootMode == SECURE_BOOT_MODE_ENABLE) {
 859     //
 860     // Create the "SecureBootEnable" variable as secure boot is enabled.
 861     //
 862     SecureBootEnable = SECURE_BOOT_ENABLE;
 863     VariableDataSize = sizeof (SecureBootEnable);
 864   } else {
 865     //
 866     // Delete the "SecureBootEnable" variable if this variable exist as "SecureBoot"
 867     // variable is not in secure boot state.
 868     //
 869     if (Variable.CurrPtr == NULL || EFI_ERROR (Status)) {
 870       return EFI_SUCCESS;
 871     }
 872     SecureBootEnable = SECURE_BOOT_DISABLE;
 873     VariableDataSize = 0;
 874   }
 875
 876   Status = UpdateVariable (
 877              EFI_SECURE_BOOT_ENABLE_NAME,
 878              &gEfiSecureBootEnableDisableGuid,
 879              &SecureBootEnable,
 880              VariableDataSize,
 881              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 882              0,
 883              0,
 884              &Variable,
 885              NULL
 886              );
 887   return Status;
 888 }
 889
 890 /**
 891   Check input data form to make sure it is a valid EFI_SIGNATURE_LIST for PK/KEK/db/dbx/dbt variable.
 892
 893   @param[in]  VariableName                Name of Variable to be check.
 894   @param[in]  VendorGuid                  Variable vendor GUID.
 895   @param[in]  Data                        Point to the variable data to be checked.
 896   @param[in]  DataSize                    Size of Data.
 897
 898   @return EFI_INVALID_PARAMETER           Invalid signature list format.
 899   @return EFI_SUCCESS                     Passed signature list format check successfully.
 900
 901 **/
 902 EFI_STATUS
 903 CheckSignatureListFormat(
 904   IN  CHAR16                    *VariableName,
 905   IN  EFI_GUID                  *VendorGuid,
 906   IN  VOID                      *Data,
 907   IN  UINTN                     DataSize
 908   )
 909 {
 910   EFI_SIGNATURE_LIST     *SigList;
 911   UINTN                  SigDataSize;
 912   UINT32                 Index;
 913   UINT32                 SigCount;
 914   BOOLEAN                IsPk;
 915   VOID                   *RsaContext;
 916   EFI_SIGNATURE_DATA     *CertData;
 917   UINTN                  CertLen;
 918
 919   if (DataSize == 0) {
 920     return EFI_SUCCESS;
 921   }
 922
 923   ASSERT (VariableName != NULL && VendorGuid != NULL && Data != NULL);
 924
 925   if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_PLATFORM_KEY_NAME) == 0)){
 926     IsPk = TRUE;
 927   } else if ((CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0)) ||
 928              (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&
 929              ((StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0) || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0) ||
 930               (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0)))) {
 931     IsPk = FALSE;
 932   } else {
 933     return EFI_SUCCESS;
 934   }
 935
 936   SigCount = 0;
 937   SigList  = (EFI_SIGNATURE_LIST *) Data;
 938   SigDataSize  = DataSize;
 939   RsaContext = NULL;
 940
 941   //
 942   // Walk throuth the input signature list and check the data format.
 943   // If any signature is incorrectly formed, the whole check will fail.
 944   //
 945   while ((SigDataSize > 0) && (SigDataSize >= SigList->SignatureListSize)) {
 946     for (Index = 0; Index < (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM)); Index++ ) {
 947       if (CompareGuid (&SigList->SignatureType, &mSupportSigItem[Index].SigType)) {
 948         //
 949         // The value of SignatureSize should always be 16 (size of SignatureOwner
 950         // component) add the data length according to signature type.
 951         //
 952         if (mSupportSigItem[Index].SigDataSize != ((UINT32) ~0) &&
 953           (SigList->SignatureSize - sizeof (EFI_GUID)) != mSupportSigItem[Index].SigDataSize) {
 954           return EFI_INVALID_PARAMETER;
 955         }
 956         if (mSupportSigItem[Index].SigHeaderSize != ((UINTN) ~0) &&
 957           SigList->SignatureHeaderSize != mSupportSigItem[Index].SigHeaderSize) {
 958           return EFI_INVALID_PARAMETER;
 959         }
 960         break;
 961       }
 962     }
 963
 964     if (Index == (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM))) {
 965       //
 966       // Undefined signature type.
 967       //
 968       return EFI_INVALID_PARAMETER;
 969     }
 970
 971     if (CompareGuid (&SigList->SignatureType, &gEfiCertX509Guid)) {
 972       //
 973       // Try to retrieve the RSA public key from the X.509 certificate.
 974       // If this operation fails, it's not a valid certificate.
 975       //
 976       RsaContext = RsaNew ();
 977       if (RsaContext == NULL) {
 978         return EFI_INVALID_PARAMETER;
 979       }
 980       CertData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigList + sizeof (EFI_SIGNATURE_LIST) + SigList->SignatureHeaderSize);
 981       CertLen = SigList->SignatureSize - sizeof (EFI_GUID);
 982       if (!RsaGetPublicKeyFromX509 (CertData->SignatureData, CertLen, &RsaContext)) {
 983         RsaFree (RsaContext);
 984         return EFI_INVALID_PARAMETER;
 985       }
 986       RsaFree (RsaContext);
 987     }
 988
 989     if ((SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) % SigList->SignatureSize != 0) {
 990       return EFI_INVALID_PARAMETER;
 991     }
 992     SigCount += (SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) / SigList->SignatureSize;
 993
 994     SigDataSize -= SigList->SignatureListSize;
 995     SigList = (EFI_SIGNATURE_LIST *) ((UINT8 *) SigList + SigList->SignatureListSize);
 996   }
 997
 998   if (((UINTN) SigList - (UINTN) Data) != DataSize) {
 999     return EFI_INVALID_PARAMETER;
1000   }
1001
1002   if (IsPk && SigCount > 1) {
1003     return EFI_INVALID_PARAMETER;
1004   }
1005
1006   return EFI_SUCCESS;
1007 }
1008
1009 /**
1010   Update "VendorKeys" variable to record the out of band secure boot key modification.
1011
1012   @return EFI_SUCCESS           Variable is updated successfully.
1013   @return Others                Failed to update variable.
1014
1015 **/
1016 EFI_STATUS
1017 VendorKeyIsModified (
1018   VOID
1019   )
1020 {
1021   EFI_STATUS              Status;
1022   VARIABLE_POINTER_TRACK  Variable;
1023
1024   if (mVendorKeyState == VENDOR_KEYS_MODIFIED) {
1025     return EFI_SUCCESS;
1026   }
1027   mVendorKeyState = VENDOR_KEYS_MODIFIED;
1028
1029   FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
1030   Status = UpdateVariable (
1031              EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
1032              &gEfiVendorKeysNvGuid,
1033              &mVendorKeyState,
1034              sizeof (UINT8),
1035              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS,
1036              0,
1037              0,
1038              &Variable,
1039              NULL
1040              );
1041   if (EFI_ERROR (Status)) {
1042     return Status;
1043   }
1044
1045   FindVariable (EFI_VENDOR_KEYS_VARIABLE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
1046   return UpdateVariable (
1047            EFI_VENDOR_KEYS_VARIABLE_NAME,
1048            &gEfiGlobalVariableGuid,
1049            &mVendorKeyState,
1050            sizeof (UINT8),
1051            EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
1052            0,
1053            0,
1054            &Variable,
1055            NULL
1056            );
1057 }
1058
1059 /**
1060   Process variable with platform key for verification.
1061
1062   Caution: This function may receive untrusted input.
1063   This function may be invoked in SMM mode, and datasize and data are external input.
1064   This function will do basic validation, before parse the data.
1065   This function will parse the authentication carefully to avoid security issues, like
1066   buffer overflow, integer overflow.
1067   This function will check attribute carefully to avoid authentication bypass.
1068
1069   @param[in]  VariableName                Name of Variable to be found.
1070   @param[in]  VendorGuid                  Variable vendor GUID.
1071   @param[in]  Data                        Data pointer.
1072   @param[in]  DataSize                    Size of Data found. If size is less than the
1073                                           data, this value contains the required size.
1074   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1075   @param[in]  Attributes                  Attribute value of the variable
1076   @param[in]  IsPk                        Indicate whether it is to process pk.
1077
1078   @return EFI_INVALID_PARAMETER           Invalid parameter.
1079   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation.
1080                                           check carried out by the firmware.
1081   @return EFI_SUCCESS                     Variable passed validation successfully.
1082
1083 **/
1084 EFI_STATUS
1085 ProcessVarWithPk (
1086   IN  CHAR16                    *VariableName,
1087   IN  EFI_GUID                  *VendorGuid,
1088   IN  VOID                      *Data,
1089   IN  UINTN                     DataSize,
1090   IN  VARIABLE_POINTER_TRACK    *Variable,
1091   IN  UINT32                    Attributes OPTIONAL,
1092   IN  BOOLEAN                   IsPk
1093   )
1094 {
1095   EFI_STATUS                  Status;
1096   BOOLEAN                     Del;
1097   UINT8                       *Payload;
1098   UINTN                       PayloadSize;
1099
1100   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1101       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1102     //
1103     // PK, KEK and db/dbx/dbt should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1104     // authenticated variable.
1105     //
1106     return EFI_INVALID_PARAMETER;
1107   }
1108
1109   Del = FALSE;
1110   if ((InCustomMode() && UserPhysicalPresent()) || (mPlatformMode == SETUP_MODE && !IsPk)) {
1111     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1112     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1113     if (PayloadSize == 0) {
1114       Del = TRUE;
1115     }
1116
1117     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
1118     if (EFI_ERROR (Status)) {
1119       return Status;
1120     }
1121
1122     Status = UpdateVariable (
1123                VariableName,
1124                VendorGuid,
1125                Payload,
1126                PayloadSize,
1127                Attributes,
1128                0,
1129                0,
1130                Variable,
1131                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1132                );
1133     if (EFI_ERROR(Status)) {
1134       return Status;
1135     }
1136
1137     if ((mPlatformMode != SETUP_MODE) || IsPk) {
1138       Status = VendorKeyIsModified ();
1139     }
1140   } else if (mPlatformMode == USER_MODE) {
1141     //
1142     // Verify against X509 Cert in PK database.
1143     //
1144     Status = VerifyTimeBasedPayload (
1145                VariableName,
1146                VendorGuid,
1147                Data,
1148                DataSize,
1149                Variable,
1150                Attributes,
1151                AuthVarTypePk,
1152                &Del
1153                );
1154   } else {
1155     //
1156     // Verify against the certificate in data payload.
1157     //
1158     Status = VerifyTimeBasedPayload (
1159                VariableName,
1160                VendorGuid,
1161                Data,
1162                DataSize,
1163                Variable,
1164                Attributes,
1165                AuthVarTypePayload,
1166                &Del
1167                );
1168   }
1169
1170   if (!EFI_ERROR(Status) && IsPk) {
1171     if (mPlatformMode == SETUP_MODE && !Del) {
1172       //
1173       // If enroll PK in setup mode, need change to user mode.
1174       //
1175       Status = UpdatePlatformMode (USER_MODE);
1176     } else if (mPlatformMode == USER_MODE && Del){
1177       //
1178       // If delete PK in user mode, need change to setup mode.
1179       //
1180       Status = UpdatePlatformMode (SETUP_MODE);
1181     }
1182   }
1183
1184   return Status;
1185 }
1186
1187 /**
1188   Process variable with key exchange key for verification.
1189
1190   Caution: This function may receive untrusted input.
1191   This function may be invoked in SMM mode, and datasize and data are external input.
1192   This function will do basic validation, before parse the data.
1193   This function will parse the authentication carefully to avoid security issues, like
1194   buffer overflow, integer overflow.
1195   This function will check attribute carefully to avoid authentication bypass.
1196
1197   @param[in]  VariableName                Name of Variable to be found.
1198   @param[in]  VendorGuid                  Variable vendor GUID.
1199   @param[in]  Data                        Data pointer.
1200   @param[in]  DataSize                    Size of Data found. If size is less than the
1201                                           data, this value contains the required size.
1202   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1203   @param[in]  Attributes                  Attribute value of the variable.
1204
1205   @return EFI_INVALID_PARAMETER           Invalid parameter.
1206   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
1207                                           check carried out by the firmware.
1208   @return EFI_SUCCESS                     Variable pass validation successfully.
1209
1210 **/
1211 EFI_STATUS
1212 ProcessVarWithKek (
1213   IN  CHAR16                               *VariableName,
1214   IN  EFI_GUID                             *VendorGuid,
1215   IN  VOID                                 *Data,
1216   IN  UINTN                                DataSize,
1217   IN  VARIABLE_POINTER_TRACK               *Variable,
1218   IN  UINT32                               Attributes OPTIONAL
1219   )
1220 {
1221   EFI_STATUS                      Status;
1222   UINT8                           *Payload;
1223   UINTN                           PayloadSize;
1224
1225   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1226       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1227     //
1228     // DB, DBX and DBT should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1229     // authenticated variable.
1230     //
1231     return EFI_INVALID_PARAMETER;
1232   }
1233
1234   Status = EFI_SUCCESS;
1235   if (mPlatformMode == USER_MODE && !(InCustomMode() && UserPhysicalPresent())) {
1236     //
1237     // Time-based, verify against X509 Cert KEK.
1238     //
1239     return VerifyTimeBasedPayload (
1240              VariableName,
1241              VendorGuid,
1242              Data,
1243              DataSize,
1244              Variable,
1245              Attributes,
1246              AuthVarTypeKek,
1247              NULL
1248              );
1249   } else {
1250     //
1251     // If in setup mode or custom secure boot mode, no authentication needed.
1252     //
1253     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1254     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1255
1256     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
1257     if (EFI_ERROR (Status)) {
1258       return Status;
1259     }
1260
1261     Status = UpdateVariable (
1262                VariableName,
1263                VendorGuid,
1264                Payload,
1265                PayloadSize,
1266                Attributes,
1267                0,
1268                0,
1269                Variable,
1270                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1271                );
1272     if (EFI_ERROR (Status)) {
1273       return Status;
1274     }
1275
1276     if (mPlatformMode != SETUP_MODE) {
1277       Status = VendorKeyIsModified ();
1278     }
1279   }
1280
1281   return Status;
1282 }
1283
1284 /**
1285   Process variable with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS/EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
1286
1287   Caution: This function may receive untrusted input.
1288   This function may be invoked in SMM mode, and datasize and data are external input.
1289   This function will do basic validation, before parse the data.
1290   This function will parse the authentication carefully to avoid security issues, like
1291   buffer overflow, integer overflow.
1292   This function will check attribute carefully to avoid authentication bypass.
1293
1294   @param[in]  VariableName                Name of Variable to be found.
1295   @param[in]  VendorGuid                  Variable vendor GUID.
1296
1297   @param[in]  Data                        Data pointer.
1298   @param[in]  DataSize                    Size of Data found. If size is less than the
1299                                           data, this value contains the required size.
1300   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1301   @param[in]  Attributes                  Attribute value of the variable.
1302
1303   @return EFI_INVALID_PARAMETER           Invalid parameter.
1304   @return EFI_WRITE_PROTECTED             Variable is write-protected and needs authentication with
1305                                           EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1306   @return EFI_OUT_OF_RESOURCES            The Database to save the public key is full.
1307   @return EFI_SECURITY_VIOLATION          The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
1308                                           set, but the AuthInfo does NOT pass the validation
1309                                           check carried out by the firmware.
1310   @return EFI_SUCCESS                     Variable is not write-protected or pass validation successfully.
1311
1312 **/
1313 EFI_STATUS
1314 ProcessVariable (
1315   IN     CHAR16                             *VariableName,
1316   IN     EFI_GUID                           *VendorGuid,
1317   IN     VOID                               *Data,
1318   IN     UINTN                              DataSize,
1319   IN     VARIABLE_POINTER_TRACK             *Variable,
1320   IN     UINT32                             Attributes
1321   )
1322 {
1323   EFI_STATUS                      Status;
1324   BOOLEAN                         IsDeletion;
1325   BOOLEAN                         IsFirstTime;
1326   UINT8                           *PubKey;
1327   EFI_VARIABLE_AUTHENTICATION     *CertData;
1328   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
1329   UINT32                          KeyIndex;
1330   UINT64                          MonotonicCount;
1331   VARIABLE_ENTRY_CONSISTENCY      VariableDataEntry;
1332
1333   KeyIndex    = 0;
1334   CertData    = NULL;
1335   CertBlock   = NULL;
1336   PubKey      = NULL;
1337   IsDeletion  = FALSE;
1338
1339   if (NeedPhysicallyPresent(VariableName, VendorGuid) && !UserPhysicalPresent()) {
1340     //
1341     // This variable is protected, only physical present user could modify its value.
1342     //
1343     return EFI_SECURITY_VIOLATION;
1344   }
1345
1346   //
1347   // A time-based authenticated variable and a count-based authenticated variable
1348   // can't be updated by each other.
1349   //
1350   if (Variable->CurrPtr != NULL) {
1351     if (((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) &&
1352         ((Variable->CurrPtr->Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0)) {
1353       return EFI_SECURITY_VIOLATION;
1354     }
1355
1356     if (((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) &&
1357         ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0)) {
1358       return EFI_SECURITY_VIOLATION;
1359     }
1360   }
1361
1362   //
1363   // Process Time-based Authenticated variable.
1364   //
1365   if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1366     return VerifyTimeBasedPayload (
1367              VariableName,
1368              VendorGuid,
1369              Data,
1370              DataSize,
1371              Variable,
1372              Attributes,
1373              AuthVarTypePriv,
1374              NULL
1375              );
1376   }
1377
1378   //
1379   // Determine if first time SetVariable with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS.
1380   //
1381   if ((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) {
1382     //
1383     // Determine current operation type.
1384     //
1385     if (DataSize == AUTHINFO_SIZE) {
1386       IsDeletion = TRUE;
1387     }
1388     //
1389     // Determine whether this is the first time with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1390     //
1391     if (Variable->CurrPtr == NULL) {
1392       IsFirstTime = TRUE;
1393     } else if ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) == 0) {
1394       IsFirstTime = TRUE;
1395     } else {
1396       KeyIndex   = Variable->CurrPtr->PubKeyIndex;
1397       IsFirstTime = FALSE;
1398     }
1399   } else if ((Variable->CurrPtr != NULL) &&
1400              ((Variable->CurrPtr->Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)
1401             ) {
1402     //
1403     // If the variable is already write-protected, it always needs authentication before update.
1404     //
1405     return EFI_WRITE_PROTECTED;
1406   } else {
1407     //
1408     // If without EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS, set and attributes collision.
1409     // That means it is not authenticated variable, just update variable as usual.
1410     //
1411     Status = UpdateVariable (VariableName, VendorGuid, Data, DataSize, Attributes, 0, 0, Variable, NULL);
1412     return Status;
1413   }
1414
1415   //
1416   // Get PubKey and check Monotonic Count value corresponding to the variable.
1417   //
1418   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
1419   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
1420   PubKey    = CertBlock->PublicKey;
1421
1422   //
1423   // Update Monotonic Count value.
1424   //
1425   MonotonicCount = CertData->MonotonicCount;
1426
1427   if (!IsFirstTime) {
1428     //
1429     // 2 cases need to check here
1430     //   1. Internal PubKey variable. PubKeyIndex is always 0
1431     //   2. Other counter-based AuthVariable. Check input PubKey.
1432     //
1433     if (KeyIndex == 0 || CompareMem (PubKey, mPubKeyStore + (KeyIndex - 1) * EFI_CERT_TYPE_RSA2048_SIZE, EFI_CERT_TYPE_RSA2048_SIZE) != 0) {
1434       return EFI_SECURITY_VIOLATION;
1435     }
1436     //
1437     // Compare the current monotonic count and ensure that it is greater than the last SetVariable
1438     // operation with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS attribute set.
1439     //
1440     if (CertData->MonotonicCount <= Variable->CurrPtr->MonotonicCount) {
1441       //
1442       // Monotonic count check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
1443       //
1444       return EFI_SECURITY_VIOLATION;
1445     }
1446   }
1447   //
1448   // Verify the certificate in Data payload.
1449   //
1450   Status = VerifyCounterBasedPayload (Data, DataSize, PubKey);
1451   if (EFI_ERROR (Status)) {
1452     return Status;
1453   }
1454
1455   //
1456   // Now, the signature has been verified!
1457   //
1458   if (IsFirstTime && !IsDeletion) {
1459     VariableDataEntry.VariableSize = DataSize - AUTHINFO_SIZE;
1460     VariableDataEntry.Guid         = VendorGuid;
1461     VariableDataEntry.Name         = VariableName;
1462
1463     //
1464     // Update public key database variable if need.
1465     //
1466     KeyIndex = AddPubKeyInStore (PubKey, &VariableDataEntry);
1467     if (KeyIndex == 0) {
1468       return EFI_OUT_OF_RESOURCES;
1469     }
1470   }
1471
1472   //
1473   // Verification pass.
1474   //
1475   return UpdateVariable (VariableName, VendorGuid, (UINT8*)Data + AUTHINFO_SIZE, DataSize - AUTHINFO_SIZE, Attributes, KeyIndex, MonotonicCount, Variable, NULL);
1476 }
1477
1478 /**
1479   Merge two buffers which formatted as EFI_SIGNATURE_LIST. Only the new EFI_SIGNATURE_DATA
1480   will be appended to the original EFI_SIGNATURE_LIST, duplicate EFI_SIGNATURE_DATA
1481   will be ignored.
1482
1483   @param[in, out]  Data              Pointer to original EFI_SIGNATURE_LIST.
1484   @param[in]       DataSize          Size of Data buffer.
1485   @param[in]       FreeBufSize       Size of free data buffer
1486   @param[in]       NewData           Pointer to new EFI_SIGNATURE_LIST to be appended.
1487   @param[in]       NewDataSize       Size of NewData buffer.
1488   @param[out]      MergedBufSize     Size of the merged buffer
1489
1490   @return EFI_BUFFER_TOO_SMALL if input Data buffer overflowed
1491
1492 **/
1493 EFI_STATUS
1494 AppendSignatureList (
1495   IN  OUT VOID            *Data,
1496   IN  UINTN               DataSize,
1497   IN  UINTN               FreeBufSize,
1498   IN  VOID                *NewData,
1499   IN  UINTN               NewDataSize,
1500   OUT UINTN               *MergedBufSize
1501   )
1502 {
1503   EFI_SIGNATURE_LIST  *CertList;
1504   EFI_SIGNATURE_DATA  *Cert;
1505   UINTN               CertCount;
1506   EFI_SIGNATURE_LIST  *NewCertList;
1507   EFI_SIGNATURE_DATA  *NewCert;
1508   UINTN               NewCertCount;
1509   UINTN               Index;
1510   UINTN               Index2;
1511   UINTN               Size;
1512   UINT8               *Tail;
1513   UINTN               CopiedCount;
1514   UINTN               SignatureListSize;
1515   BOOLEAN             IsNewCert;
1516
1517   Tail = (UINT8 *) Data + DataSize;
1518
1519   NewCertList = (EFI_SIGNATURE_LIST *) NewData;
1520   while ((NewDataSize > 0) && (NewDataSize >= NewCertList->SignatureListSize)) {
1521     NewCert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCertList + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1522     NewCertCount = (NewCertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - NewCertList->SignatureHeaderSize) / NewCertList->SignatureSize;
1523
1524     CopiedCount = 0;
1525     for (Index = 0; Index < NewCertCount; Index++) {
1526       IsNewCert = TRUE;
1527
1528       Size = DataSize;
1529       CertList = (EFI_SIGNATURE_LIST *) Data;
1530       while ((Size > 0) && (Size >= CertList->SignatureListSize)) {
1531         if (CompareGuid (&CertList->SignatureType, &NewCertList->SignatureType) &&
1532            (CertList->SignatureSize == NewCertList->SignatureSize)) {
1533           Cert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
1534           CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
1535           for (Index2 = 0; Index2 < CertCount; Index2++) {
1536             //
1537             // Iterate each Signature Data in this Signature List.
1538             //
1539             if (CompareMem (NewCert, Cert, CertList->SignatureSize) == 0) {
1540               IsNewCert = FALSE;
1541               break;
1542             }
1543             Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
1544           }
1545         }
1546
1547         if (!IsNewCert) {
1548           break;
1549         }
1550         Size -= CertList->SignatureListSize;
1551         CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
1552       }
1553
1554       if (IsNewCert) {
1555         //
1556         // New EFI_SIGNATURE_DATA, append it.
1557         //
1558         if (CopiedCount == 0) {
1559           if (FreeBufSize < sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize) {
1560             return EFI_BUFFER_TOO_SMALL;
1561           }
1562
1563           //
1564           // Copy EFI_SIGNATURE_LIST header for only once.
1565           //
1566
1567           CopyMem (Tail, NewCertList, sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1568           Tail = Tail + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1569           FreeBufSize -= sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1570         }
1571
1572         if (FreeBufSize < NewCertList->SignatureSize) {
1573           return EFI_BUFFER_TOO_SMALL;
1574         }
1575         CopyMem (Tail, NewCert, NewCertList->SignatureSize);
1576         Tail += NewCertList->SignatureSize;
1577         FreeBufSize -= NewCertList->SignatureSize;
1578         CopiedCount++;
1579       }
1580
1581       NewCert = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCert + NewCertList->SignatureSize);
1582     }
1583
1584     //
1585     // Update SignatureListSize in newly appended EFI_SIGNATURE_LIST.
1586     //
1587     if (CopiedCount != 0) {
1588       SignatureListSize = sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize + (CopiedCount * NewCertList->SignatureSize);
1589       CertList = (EFI_SIGNATURE_LIST *) (Tail - SignatureListSize);
1590       CertList->SignatureListSize = (UINT32) SignatureListSize;
1591     }
1592
1593     NewDataSize -= NewCertList->SignatureListSize;
1594     NewCertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) NewCertList + NewCertList->SignatureListSize);
1595   }
1596
1597   *MergedBufSize = (Tail - (UINT8 *) Data);
1598   return EFI_SUCCESS;
1599 }
1600
1601 /**
1602   Compare two EFI_TIME data.
1603
1604
1605   @param FirstTime           A pointer to the first EFI_TIME data.
1606   @param SecondTime          A pointer to the second EFI_TIME data.
1607
1608   @retval  TRUE              The FirstTime is not later than the SecondTime.
1609   @retval  FALSE             The FirstTime is later than the SecondTime.
1610
1611 **/
1612 BOOLEAN
1613 CompareTimeStamp (
1614   IN EFI_TIME               *FirstTime,
1615   IN EFI_TIME               *SecondTime
1616   )
1617 {
1618   if (FirstTime->Year != SecondTime->Year) {
1619     return (BOOLEAN) (FirstTime->Year < SecondTime->Year);
1620   } else if (FirstTime->Month != SecondTime->Month) {
1621     return (BOOLEAN) (FirstTime->Month < SecondTime->Month);
1622   } else if (FirstTime->Day != SecondTime->Day) {
1623     return (BOOLEAN) (FirstTime->Day < SecondTime->Day);
1624   } else if (FirstTime->Hour != SecondTime->Hour) {
1625     return (BOOLEAN) (FirstTime->Hour < SecondTime->Hour);
1626   } else if (FirstTime->Minute != SecondTime->Minute) {
1627     return (BOOLEAN) (FirstTime->Minute < SecondTime->Minute);
1628   }
1629
1630   return (BOOLEAN) (FirstTime->Second <= SecondTime->Second);
1631 }
1632
1633 /**
1634   Find matching signer's certificates for common authenticated variable
1635   by corresponding VariableName and VendorGuid from "certdb".
1636
1637   The data format of "certdb":
1638   //
1639   //     UINT32 CertDbListSize;
1640   // /// AUTH_CERT_DB_DATA Certs1[];
1641   // /// AUTH_CERT_DB_DATA Certs2[];
1642   // /// ...
1643   // /// AUTH_CERT_DB_DATA Certsn[];
1644   //
1645
1646   @param[in]  VariableName   Name of authenticated Variable.
1647   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1648   @param[in]  Data           Pointer to variable "certdb".
1649   @param[in]  DataSize       Size of variable "certdb".
1650   @param[out] CertOffset     Offset of matching CertData, from starting of Data.
1651   @param[out] CertDataSize   Length of CertData in bytes.
1652   @param[out] CertNodeOffset Offset of matching AUTH_CERT_DB_DATA , from
1653                              starting of Data.
1654   @param[out] CertNodeSize   Length of AUTH_CERT_DB_DATA in bytes.
1655
1656   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1657   @retval  EFI_NOT_FOUND         Fail to find matching certs.
1658   @retval  EFI_SUCCESS           Find matching certs and output parameters.
1659
1660 **/
1661 EFI_STATUS
1662 FindCertsFromDb (
1663   IN     CHAR16           *VariableName,
1664   IN     EFI_GUID         *VendorGuid,
1665   IN     UINT8            *Data,
1666   IN     UINTN            DataSize,
1667   OUT    UINT32           *CertOffset,    OPTIONAL
1668   OUT    UINT32           *CertDataSize,  OPTIONAL
1669   OUT    UINT32           *CertNodeOffset,OPTIONAL
1670   OUT    UINT32           *CertNodeSize   OPTIONAL
1671   )
1672 {
1673   UINT32                  Offset;
1674   AUTH_CERT_DB_DATA       *Ptr;
1675   UINT32                  CertSize;
1676   UINT32                  NameSize;
1677   UINT32                  NodeSize;
1678   UINT32                  CertDbListSize;
1679
1680   if ((VariableName == NULL) || (VendorGuid == NULL) || (Data == NULL)) {
1681     return EFI_INVALID_PARAMETER;
1682   }
1683
1684   //
1685   // Check whether DataSize matches recorded CertDbListSize.
1686   //
1687   if (DataSize < sizeof (UINT32)) {
1688     return EFI_INVALID_PARAMETER;
1689   }
1690
1691   CertDbListSize = ReadUnaligned32 ((UINT32 *) Data);
1692
1693   if (CertDbListSize != (UINT32) DataSize) {
1694     return EFI_INVALID_PARAMETER;
1695   }
1696
1697   Offset = sizeof (UINT32);
1698
1699   //
1700   // Get corresponding certificates by VendorGuid and VariableName.
1701   //
1702   while (Offset < (UINT32) DataSize) {
1703     Ptr = (AUTH_CERT_DB_DATA *) (Data + Offset);
1704     //
1705     // Check whether VendorGuid matches.
1706     //
1707     if (CompareGuid (&Ptr->VendorGuid, VendorGuid)) {
1708       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1709       NameSize = ReadUnaligned32 (&Ptr->NameSize);
1710       CertSize = ReadUnaligned32 (&Ptr->CertDataSize);
1711
1712       if (NodeSize != sizeof (EFI_GUID) + sizeof (UINT32) * 3 + CertSize +
1713           sizeof (CHAR16) * NameSize) {
1714         return EFI_INVALID_PARAMETER;
1715       }
1716
1717       Offset = Offset + sizeof (EFI_GUID) + sizeof (UINT32) * 3;
1718       //
1719       // Check whether VariableName matches.
1720       //
1721       if ((NameSize == StrLen (VariableName)) &&
1722           (CompareMem (Data + Offset, VariableName, NameSize * sizeof (CHAR16)) == 0)) {
1723         Offset = Offset + NameSize * sizeof (CHAR16);
1724
1725         if (CertOffset != NULL) {
1726           *CertOffset = Offset;
1727         }
1728
1729         if (CertDataSize != NULL) {
1730           *CertDataSize = CertSize;
1731         }
1732
1733         if (CertNodeOffset != NULL) {
1734           *CertNodeOffset = (UINT32) ((UINT8 *) Ptr - Data);
1735         }
1736
1737         if (CertNodeSize != NULL) {
1738           *CertNodeSize = NodeSize;
1739         }
1740
1741         return EFI_SUCCESS;
1742       } else {
1743         Offset = Offset + NameSize * sizeof (CHAR16) + CertSize;
1744       }
1745     } else {
1746       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1747       Offset   = Offset + NodeSize;
1748     }
1749   }
1750
1751   return EFI_NOT_FOUND;
1752 }
1753
1754 /**
1755   Retrieve signer's certificates for common authenticated variable
1756   by corresponding VariableName and VendorGuid from "certdb".
1757
1758   @param[in]  VariableName   Name of authenticated Variable.
1759   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1760   @param[out] CertData       Pointer to signer's certificates.
1761   @param[out] CertDataSize   Length of CertData in bytes.
1762
1763   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1764   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1765   @retval  EFI_SUCCESS           Get signer's certificates successfully.
1766
1767 **/
1768 EFI_STATUS
1769 GetCertsFromDb (
1770   IN     CHAR16           *VariableName,
1771   IN     EFI_GUID         *VendorGuid,
1772   OUT    UINT8            **CertData,
1773   OUT    UINT32           *CertDataSize
1774   )
1775 {
1776   VARIABLE_POINTER_TRACK  CertDbVariable;
1777   EFI_STATUS              Status;
1778   UINT8                   *Data;
1779   UINTN                   DataSize;
1780   UINT32                  CertOffset;
1781
1782   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL) || (CertDataSize == NULL)) {
1783     return EFI_INVALID_PARAMETER;
1784   }
1785
1786   //
1787   // Get variable "certdb".
1788   //
1789   Status = FindVariable (
1790              EFI_CERT_DB_NAME,
1791              &gEfiCertDbGuid,
1792              &CertDbVariable,
1793              &mVariableModuleGlobal->VariableGlobal,
1794              FALSE
1795              );
1796   if (EFI_ERROR (Status)) {
1797     return Status;
1798   }
1799
1800   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1801   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1802   if ((DataSize == 0) || (Data == NULL)) {
1803     ASSERT (FALSE);
1804     return EFI_NOT_FOUND;
1805   }
1806
1807   Status = FindCertsFromDb (
1808              VariableName,
1809              VendorGuid,
1810              Data,
1811              DataSize,
1812              &CertOffset,
1813              CertDataSize,
1814              NULL,
1815              NULL
1816              );
1817
1818   if (EFI_ERROR (Status)) {
1819     return Status;
1820   }
1821
1822   *CertData = Data + CertOffset;
1823   return EFI_SUCCESS;
1824 }
1825
1826 /**
1827   Delete matching signer's certificates when deleting common authenticated
1828   variable by corresponding VariableName and VendorGuid from "certdb".
1829
1830   @param[in]  VariableName   Name of authenticated Variable.
1831   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1832
1833   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1834   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1835   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
1836   @retval  EFI_SUCCESS           The operation is completed successfully.
1837
1838 **/
1839 EFI_STATUS
1840 DeleteCertsFromDb (
1841   IN     CHAR16           *VariableName,
1842   IN     EFI_GUID         *VendorGuid
1843   )
1844 {
1845   VARIABLE_POINTER_TRACK  CertDbVariable;
1846   EFI_STATUS              Status;
1847   UINT8                   *Data;
1848   UINTN                   DataSize;
1849   UINT32                  VarAttr;
1850   UINT32                  CertNodeOffset;
1851   UINT32                  CertNodeSize;
1852   UINT8                   *NewCertDb;
1853   UINT32                  NewCertDbSize;
1854
1855   if ((VariableName == NULL) || (VendorGuid == NULL)) {
1856     return EFI_INVALID_PARAMETER;
1857   }
1858
1859   //
1860   // Get variable "certdb".
1861   //
1862   Status = FindVariable (
1863              EFI_CERT_DB_NAME,
1864              &gEfiCertDbGuid,
1865              &CertDbVariable,
1866              &mVariableModuleGlobal->VariableGlobal,
1867              FALSE
1868              );
1869   if (EFI_ERROR (Status)) {
1870     return Status;
1871   }
1872
1873   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1874   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1875   if ((DataSize == 0) || (Data == NULL)) {
1876     ASSERT (FALSE);
1877     return EFI_NOT_FOUND;
1878   }
1879
1880   if (DataSize == sizeof (UINT32)) {
1881     //
1882     // There is no certs in certdb.
1883     //
1884     return EFI_SUCCESS;
1885   }
1886
1887   //
1888   // Get corresponding cert node from certdb.
1889   //
1890   Status = FindCertsFromDb (
1891              VariableName,
1892              VendorGuid,
1893              Data,
1894              DataSize,
1895              NULL,
1896              NULL,
1897              &CertNodeOffset,
1898              &CertNodeSize
1899              );
1900
1901   if (EFI_ERROR (Status)) {
1902     return Status;
1903   }
1904
1905   if (DataSize < (CertNodeOffset + CertNodeSize)) {
1906     return EFI_NOT_FOUND;
1907   }
1908
1909   //
1910   // Construct new data content of variable "certdb".
1911   //
1912   NewCertDbSize = (UINT32) DataSize - CertNodeSize;
1913   NewCertDb     = (UINT8*) mCertDbStore;
1914
1915   //
1916   // Copy the DB entries before deleting node.
1917   //
1918   CopyMem (NewCertDb, Data, CertNodeOffset);
1919   //
1920   // Update CertDbListSize.
1921   //
1922   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
1923   //
1924   // Copy the DB entries after deleting node.
1925   //
1926   if (DataSize > (CertNodeOffset + CertNodeSize)) {
1927     CopyMem (
1928       NewCertDb + CertNodeOffset,
1929       Data + CertNodeOffset + CertNodeSize,
1930       DataSize - CertNodeOffset - CertNodeSize
1931       );
1932   }
1933
1934   //
1935   // Set "certdb".
1936   //
1937   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
1938   Status   = UpdateVariable (
1939                EFI_CERT_DB_NAME,
1940                &gEfiCertDbGuid,
1941                NewCertDb,
1942                NewCertDbSize,
1943                VarAttr,
1944                0,
1945                0,
1946                &CertDbVariable,
1947                NULL
1948                );
1949
1950   return Status;
1951 }
1952
1953 /**
1954   Insert signer's certificates for common authenticated variable with VariableName
1955   and VendorGuid in AUTH_CERT_DB_DATA to "certdb".
1956
1957   @param[in]  VariableName   Name of authenticated Variable.
1958   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1959   @param[in]  CertData       Pointer to signer's certificates.
1960   @param[in]  CertDataSize   Length of CertData in bytes.
1961
1962   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1963   @retval  EFI_ACCESS_DENIED     An AUTH_CERT_DB_DATA entry with same VariableName
1964                                  and VendorGuid already exists.
1965   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
1966   @retval  EFI_SUCCESS           Insert an AUTH_CERT_DB_DATA entry to "certdb"
1967
1968 **/
1969 EFI_STATUS
1970 InsertCertsToDb (
1971   IN     CHAR16           *VariableName,
1972   IN     EFI_GUID         *VendorGuid,
1973   IN     UINT8            *CertData,
1974   IN     UINTN            CertDataSize
1975   )
1976 {
1977   VARIABLE_POINTER_TRACK  CertDbVariable;
1978   EFI_STATUS              Status;
1979   UINT8                   *Data;
1980   UINTN                   DataSize;
1981   UINT32                  VarAttr;
1982   UINT8                   *NewCertDb;
1983   UINT32                  NewCertDbSize;
1984   UINT32                  CertNodeSize;
1985   UINT32                  NameSize;
1986   AUTH_CERT_DB_DATA       *Ptr;
1987
1988   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL)) {
1989     return EFI_INVALID_PARAMETER;
1990   }
1991
1992   //
1993   // Get variable "certdb".
1994   //
1995   Status = FindVariable (
1996              EFI_CERT_DB_NAME,
1997              &gEfiCertDbGuid,
1998              &CertDbVariable,
1999              &mVariableModuleGlobal->VariableGlobal,
2000              FALSE
2001              );
2002   if (EFI_ERROR (Status)) {
2003     return Status;
2004   }
2005
2006   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
2007   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
2008   if ((DataSize == 0) || (Data == NULL)) {
2009     ASSERT (FALSE);
2010     return EFI_NOT_FOUND;
2011   }
2012
2013   //
2014   // Find whether matching cert node already exists in "certdb".
2015   // If yes return error.
2016   //
2017   Status = FindCertsFromDb (
2018              VariableName,
2019              VendorGuid,
2020              Data,
2021              DataSize,
2022              NULL,
2023              NULL,
2024              NULL,
2025              NULL
2026              );
2027
2028   if (!EFI_ERROR (Status)) {
2029     ASSERT (FALSE);
2030     return EFI_ACCESS_DENIED;
2031   }
2032
2033   //
2034   // Construct new data content of variable "certdb".
2035   //
2036   NameSize      = (UINT32) StrLen (VariableName);
2037   CertNodeSize  = sizeof (AUTH_CERT_DB_DATA) + (UINT32) CertDataSize + NameSize * sizeof (CHAR16);
2038   NewCertDbSize = (UINT32) DataSize + CertNodeSize;
2039   if (NewCertDbSize > mMaxCertDbSize) {
2040     return EFI_OUT_OF_RESOURCES;
2041   }
2042   NewCertDb     = (UINT8*) mCertDbStore;
2043
2044   //
2045   // Copy the DB entries before deleting node.
2046   //
2047   CopyMem (NewCertDb, Data, DataSize);
2048   //
2049   // Update CertDbListSize.
2050   //
2051   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
2052   //
2053   // Construct new cert node.
2054   //
2055   Ptr = (AUTH_CERT_DB_DATA *) (NewCertDb + DataSize);
2056   CopyGuid (&Ptr->VendorGuid, VendorGuid);
2057   CopyMem (&Ptr->CertNodeSize, &CertNodeSize, sizeof (UINT32));
2058   CopyMem (&Ptr->NameSize, &NameSize, sizeof (UINT32));
2059   CopyMem (&Ptr->CertDataSize, &CertDataSize, sizeof (UINT32));
2060
2061   CopyMem (
2062     (UINT8 *) Ptr + sizeof (AUTH_CERT_DB_DATA),
2063     VariableName,
2064     NameSize * sizeof (CHAR16)
2065     );
2066
2067   CopyMem (
2068     (UINT8 *) Ptr +  sizeof (AUTH_CERT_DB_DATA) + NameSize * sizeof (CHAR16),
2069     CertData,
2070     CertDataSize
2071     );
2072
2073   //
2074   // Set "certdb".
2075   //
2076   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
2077   Status   = UpdateVariable (
2078                EFI_CERT_DB_NAME,
2079                &gEfiCertDbGuid,
2080                NewCertDb,
2081                NewCertDbSize,
2082                VarAttr,
2083                0,
2084                0,
2085                &CertDbVariable,
2086                NULL
2087                );
2088
2089   return Status;
2090 }
2091
2092 /**
2093   Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
2094
2095   Caution: This function may receive untrusted input.
2096   This function may be invoked in SMM mode, and datasize and data are external input.
2097   This function will do basic validation, before parse the data.
2098   This function will parse the authentication carefully to avoid security issues, like
2099   buffer overflow, integer overflow.
2100
2101   @param[in]  VariableName                Name of Variable to be found.
2102   @param[in]  VendorGuid                  Variable vendor GUID.
2103   @param[in]  Data                        Data pointer.
2104   @param[in]  DataSize                    Size of Data found. If size is less than the
2105                                           data, this value contains the required size.
2106   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
2107   @param[in]  Attributes                  Attribute value of the variable.
2108   @param[in]  AuthVarType                 Verify against PK, KEK database, private database or certificate in data payload.
2109   @param[out] VarDel                      Delete the variable or not.
2110
2111   @retval EFI_INVALID_PARAMETER           Invalid parameter.
2112   @retval EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
2113                                           check carried out by the firmware.
2114   @retval EFI_OUT_OF_RESOURCES            Failed to process variable due to lack
2115                                           of resources.
2116   @retval EFI_SUCCESS                     Variable pass validation successfully.
2117
2118 **/
2119 EFI_STATUS
2120 VerifyTimeBasedPayload (
2121   IN     CHAR16                             *VariableName,
2122   IN     EFI_GUID                           *VendorGuid,
2123   IN     VOID                               *Data,
2124   IN     UINTN                              DataSize,
2125   IN     VARIABLE_POINTER_TRACK             *Variable,
2126   IN     UINT32                             Attributes,
2127   IN     AUTHVAR_TYPE                       AuthVarType,
2128   OUT    BOOLEAN                            *VarDel
2129   )
2130 {
2131   UINT8                            *RootCert;
2132   UINT8                            *SigData;
2133   UINT8                            *PayloadPtr;
2134   UINTN                            RootCertSize;
2135   UINTN                            Index;
2136   UINTN                            CertCount;
2137   UINTN                            PayloadSize;
2138   UINT32                           Attr;
2139   UINT32                           SigDataSize;
2140   UINT32                           KekDataSize;
2141   BOOLEAN                          VerifyStatus;
2142   EFI_STATUS                       Status;
2143   EFI_SIGNATURE_LIST               *CertList;
2144   EFI_SIGNATURE_DATA               *Cert;
2145   VARIABLE_POINTER_TRACK           KekVariable;
2146   EFI_VARIABLE_AUTHENTICATION_2    *CertData;
2147   UINT8                            *NewData;
2148   UINTN                            NewDataSize;
2149   VARIABLE_POINTER_TRACK           PkVariable;
2150   UINT8                            *Buffer;
2151   UINTN                            Length;
2152   UINT8                            *SignerCerts;
2153   UINT8                            *WrapSigData;
2154   UINTN                            CertStackSize;
2155   UINT8                            *CertsInCertDb;
2156   UINT32                           CertsSizeinDb;
2157
2158   VerifyStatus           = FALSE;
2159   CertData               = NULL;
2160   NewData                = NULL;
2161   Attr                   = Attributes;
2162   WrapSigData            = NULL;
2163   SignerCerts            = NULL;
2164   RootCert               = NULL;
2165   CertsInCertDb          = NULL;
2166
2167   //
2168   // When the attribute EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS is
2169   // set, then the Data buffer shall begin with an instance of a complete (and serialized)
2170   // EFI_VARIABLE_AUTHENTICATION_2 descriptor. The descriptor shall be followed by the new
2171   // variable value and DataSize shall reflect the combined size of the descriptor and the new
2172   // variable value. The authentication descriptor is not part of the variable data and is not
2173   // returned by subsequent calls to GetVariable().
2174   //
2175   CertData = (EFI_VARIABLE_AUTHENTICATION_2 *) Data;
2176
2177   //
2178   // Verify that Pad1, Nanosecond, TimeZone, Daylight and Pad2 components of the
2179   // TimeStamp value are set to zero.
2180   //
2181   if ((CertData->TimeStamp.Pad1 != 0) ||
2182       (CertData->TimeStamp.Nanosecond != 0) ||
2183       (CertData->TimeStamp.TimeZone != 0) ||
2184       (CertData->TimeStamp.Daylight != 0) ||
2185       (CertData->TimeStamp.Pad2 != 0)) {
2186     return EFI_SECURITY_VIOLATION;
2187   }
2188
2189   if ((Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
2190     if (CompareTimeStamp (&CertData->TimeStamp, &Variable->CurrPtr->TimeStamp)) {
2191       //
2192       // TimeStamp check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
2193       //
2194       return EFI_SECURITY_VIOLATION;
2195     }
2196   }
2197
2198   //
2199   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
2200   // Cert type should be EFI_CERT_TYPE_PKCS7_GUID.
2201   //
2202   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
2203       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertPkcs7Guid)) {
2204     //
2205     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
2206     //
2207     return EFI_SECURITY_VIOLATION;
2208   }
2209
2210   //
2211   // Find out Pkcs7 SignedData which follows the EFI_VARIABLE_AUTHENTICATION_2 descriptor.
2212   // AuthInfo.Hdr.dwLength is the length of the entire certificate, including the length of the header.
2213   //
2214   SigData = CertData->AuthInfo.CertData;
2215   SigDataSize = CertData->AuthInfo.Hdr.dwLength - (UINT32) (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData));
2216
2217   //
2218   // Find out the new data payload which follows Pkcs7 SignedData directly.
2219   //
2220   PayloadPtr = SigData + SigDataSize;
2221   PayloadSize = DataSize - OFFSET_OF_AUTHINFO2_CERT_DATA - (UINTN) SigDataSize;
2222
2223   //
2224   // Construct a buffer to fill with (VariableName, VendorGuid, Attributes, TimeStamp, Data).
2225   //
2226   NewDataSize = PayloadSize + sizeof (EFI_TIME) + sizeof (UINT32) +
2227                 sizeof (EFI_GUID) + StrSize (VariableName) - sizeof (CHAR16);
2228   NewData = mSerializationRuntimeBuffer;
2229
2230   Buffer = NewData;
2231   Length = StrLen (VariableName) * sizeof (CHAR16);
2232   CopyMem (Buffer, VariableName, Length);
2233   Buffer += Length;
2234
2235   Length = sizeof (EFI_GUID);
2236   CopyMem (Buffer, VendorGuid, Length);
2237   Buffer += Length;
2238
2239   Length = sizeof (UINT32);
2240   CopyMem (Buffer, &Attr, Length);
2241   Buffer += Length;
2242
2243   Length = sizeof (EFI_TIME);
2244   CopyMem (Buffer, &CertData->TimeStamp, Length);
2245   Buffer += Length;
2246
2247   CopyMem (Buffer, PayloadPtr, PayloadSize);
2248
2249   if (AuthVarType == AuthVarTypePk) {
2250     //
2251     // Verify that the signature has been made with the current Platform Key (no chaining for PK).
2252     // First, get signer's certificates from SignedData.
2253     //
2254     VerifyStatus = Pkcs7GetSigners (
2255                      SigData,
2256                      SigDataSize,
2257                      &SignerCerts,
2258                      &CertStackSize,
2259                      &RootCert,
2260                      &RootCertSize
2261                      );
2262     if (!VerifyStatus) {
2263       goto Exit;
2264     }
2265
2266     //
2267     // Second, get the current platform key from variable. Check whether it's identical with signer's certificates
2268     // in SignedData. If not, return error immediately.
2269     //
2270     Status = FindVariable (
2271                EFI_PLATFORM_KEY_NAME,
2272                &gEfiGlobalVariableGuid,
2273                &PkVariable,
2274                &mVariableModuleGlobal->VariableGlobal,
2275                FALSE
2276                );
2277     if (EFI_ERROR (Status)) {
2278       VerifyStatus = FALSE;
2279       goto Exit;
2280     }
2281     CertList = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (PkVariable.CurrPtr);
2282     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2283     if ((RootCertSize != (CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1))) ||
2284         (CompareMem (Cert->SignatureData, RootCert, RootCertSize) != 0)) {
2285       VerifyStatus = FALSE;
2286       goto Exit;
2287     }
2288
2289     //
2290     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2291     //
2292     VerifyStatus = Pkcs7Verify (
2293                      SigData,
2294                      SigDataSize,
2295                      RootCert,
2296                      RootCertSize,
2297                      NewData,
2298                      NewDataSize
2299                      );
2300
2301   } else if (AuthVarType == AuthVarTypeKek) {
2302
2303     //
2304     // Get KEK database from variable.
2305     //
2306     Status = FindVariable (
2307                EFI_KEY_EXCHANGE_KEY_NAME,
2308                &gEfiGlobalVariableGuid,
2309                &KekVariable,
2310                &mVariableModuleGlobal->VariableGlobal,
2311                FALSE
2312                );
2313     if (EFI_ERROR (Status)) {
2314       return Status;
2315     }
2316
2317     //
2318     // Ready to verify Pkcs7 SignedData. Go through KEK Signature Database to find out X.509 CertList.
2319     //
2320     KekDataSize      = KekVariable.CurrPtr->DataSize;
2321     CertList         = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (KekVariable.CurrPtr);
2322     while ((KekDataSize > 0) && (KekDataSize >= CertList->SignatureListSize)) {
2323       if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {
2324         Cert       = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2325         CertCount  = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
2326         for (Index = 0; Index < CertCount; Index++) {
2327           //
2328           // Iterate each Signature Data Node within this CertList for a verify
2329           //
2330           RootCert      = Cert->SignatureData;
2331           RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2332
2333           //
2334           // Verify Pkcs7 SignedData via Pkcs7Verify library.
2335           //
2336           VerifyStatus = Pkcs7Verify (
2337                            SigData,
2338                            SigDataSize,
2339                            RootCert,
2340                            RootCertSize,
2341                            NewData,
2342                            NewDataSize
2343                            );
2344           if (VerifyStatus) {
2345             goto Exit;
2346           }
2347           Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
2348         }
2349       }
2350       KekDataSize -= CertList->SignatureListSize;
2351       CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
2352     }
2353   } else if (AuthVarType == AuthVarTypePriv) {
2354
2355     //
2356     // Process common authenticated variable except PK/KEK/DB/DBX/DBT.
2357     // Get signer's certificates from SignedData.
2358     //
2359     VerifyStatus = Pkcs7GetSigners (
2360                      SigData,
2361                      SigDataSize,
2362                      &SignerCerts,
2363                      &CertStackSize,
2364                      &RootCert,
2365                      &RootCertSize
2366                      );
2367     if (!VerifyStatus) {
2368       goto Exit;
2369     }
2370
2371     //
2372     // Get previously stored signer's certificates from certdb for existing
2373     // variable. Check whether they are identical with signer's certificates
2374     // in SignedData. If not, return error immediately.
2375     //
2376     if ((Variable->CurrPtr != NULL)) {
2377       VerifyStatus = FALSE;
2378
2379       Status = GetCertsFromDb (VariableName, VendorGuid, &CertsInCertDb, &CertsSizeinDb);
2380       if (EFI_ERROR (Status)) {
2381         goto Exit;
2382       }
2383
2384       if ((CertStackSize != CertsSizeinDb) ||
2385           (CompareMem (SignerCerts, CertsInCertDb, CertsSizeinDb) != 0)) {
2386         goto Exit;
2387       }
2388     }
2389
2390     VerifyStatus = Pkcs7Verify (
2391                      SigData,
2392                      SigDataSize,
2393                      RootCert,
2394                      RootCertSize,
2395                      NewData,
2396                      NewDataSize
2397                      );
2398     if (!VerifyStatus) {
2399       goto Exit;
2400     }
2401
2402     //
2403     // Delete signer's certificates when delete the common authenticated variable.
2404     //
2405     if ((PayloadSize == 0) && (Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
2406       Status = DeleteCertsFromDb (VariableName, VendorGuid);
2407       if (EFI_ERROR (Status)) {
2408         VerifyStatus = FALSE;
2409         goto Exit;
2410       }
2411     } else if (Variable->CurrPtr == NULL && PayloadSize != 0) {
2412       //
2413       // Insert signer's certificates when adding a new common authenticated variable.
2414       //
2415       Status = InsertCertsToDb (VariableName, VendorGuid, SignerCerts, CertStackSize);
2416       if (EFI_ERROR (Status)) {
2417         VerifyStatus = FALSE;
2418         goto Exit;
2419       }
2420     }
2421   } else if (AuthVarType == AuthVarTypePayload) {
2422     CertList = (EFI_SIGNATURE_LIST *) PayloadPtr;
2423     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2424     RootCert      = Cert->SignatureData;
2425     RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2426
2427     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2428     //
2429     VerifyStatus = Pkcs7Verify (
2430                      SigData,
2431                      SigDataSize,
2432                      RootCert,
2433                      RootCertSize,
2434                      NewData,
2435                      NewDataSize
2436                      );
2437   } else {
2438     return EFI_SECURITY_VIOLATION;
2439   }
2440
2441 Exit:
2442
2443   if (AuthVarType == AuthVarTypePk || AuthVarType == AuthVarTypePriv) {
2444     Pkcs7FreeSigners (RootCert);
2445     Pkcs7FreeSigners (SignerCerts);
2446   }
2447
2448   if (!VerifyStatus) {
2449     return EFI_SECURITY_VIOLATION;
2450   }
2451
2452   Status = CheckSignatureListFormat(VariableName, VendorGuid, PayloadPtr, PayloadSize);
2453   if (EFI_ERROR (Status)) {
2454     return Status;
2455   }
2456
2457   if ((PayloadSize == 0) && (VarDel != NULL)) {
2458     *VarDel = TRUE;
2459   }
2460
2461   //
2462   // Final step: Update/Append Variable if it pass Pkcs7Verify
2463   //
2464   return UpdateVariable (
2465            VariableName,
2466            VendorGuid,
2467            PayloadPtr,
2468            PayloadSize,
2469            Attributes,
2470            0,
2471            0,
2472            Variable,
2473            &CertData->TimeStamp
2474            );
2475 }