SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c

   1 /** @file
   2   Implement authentication services for the authenticated variable
   3   service in UEFI2.2.
   4
   5   Caution: This module requires additional review when modified.
   6   This driver will have external input - variable data. It may be input in SMM mode.
   7   This external input must be validated carefully to avoid security issue like
   8   buffer overflow, integer overflow.
   9   Variable attribute should also be checked to avoid authentication bypass.
  10
  11   ProcessVarWithPk(), ProcessVarWithKek() and ProcessVariable() are the function to do
  12   variable authentication.
  13
  14   VerifyTimeBasedPayload() and VerifyCounterBasedPayload() are sub function to do verification.
  15   They will do basic validation for authentication data structure, then call crypto library
  16   to verify the signature.
  17
  18 Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
  19 This program and the accompanying materials
  20 are licensed and made available under the terms and conditions of the BSD License
  21 which accompanies this distribution.  The full text of the license may be found at
  22 http://opensource.org/licenses/bsd-license.php
  23
  24 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  25 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  26
  27 **/
  28
  29 #include "Variable.h"
  30 #include "AuthService.h"
  31
  32 ///
  33 /// Global database array for scratch
  34 ///
  35 UINT8    *mPubKeyStore;
  36 UINT32   mPubKeyNumber;
  37 UINT32   mMaxKeyNumber;
  38 UINT32   mMaxKeyDbSize;
  39 UINT8    *mCertDbStore;
  40 UINT32   mMaxCertDbSize;
  41 UINT32   mPlatformMode;
  42 UINT8    mVendorKeyState;
  43
  44 EFI_GUID mSignatureSupport[] = {EFI_CERT_SHA1_GUID, EFI_CERT_SHA256_GUID, EFI_CERT_RSA2048_GUID, EFI_CERT_X509_GUID};
  45 //
  46 // Public Exponent of RSA Key.
  47 //
  48 CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };
  49 //
  50 // Hash context pointer
  51 //
  52 VOID  *mHashCtx = NULL;
  53
  54 //
  55 // The serialization of the values of the VariableName, VendorGuid and Attributes
  56 // parameters of the SetVariable() call and the TimeStamp component of the
  57 // EFI_VARIABLE_AUTHENTICATION_2 descriptor followed by the variable's new value
  58 // i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data)
  59 //
  60 UINT8 *mSerializationRuntimeBuffer = NULL;
  61
  62 //
  63 // Requirement for different signature type which have been defined in UEFI spec.
  64 // These data are used to peform SignatureList format check while setting PK/KEK variable.
  65 //
  66 EFI_SIGNATURE_ITEM mSupportSigItem[] = {
  67 //{SigType,                       SigHeaderSize,   SigDataSize  }
  68   {EFI_CERT_SHA256_GUID,          0,               32           },
  69   {EFI_CERT_RSA2048_GUID,         0,               256          },
  70   {EFI_CERT_RSA2048_SHA256_GUID,  0,               256          },
  71   {EFI_CERT_SHA1_GUID,            0,               20           },
  72   {EFI_CERT_RSA2048_SHA1_GUID,    0,               256          },
  73   {EFI_CERT_X509_GUID,            0,               ((UINT32) ~0)},
  74   {EFI_CERT_SHA224_GUID,          0,               28           },
  75   {EFI_CERT_SHA384_GUID,          0,               48           },
  76   {EFI_CERT_SHA512_GUID,          0,               64           }
  77 };
  78
  79 /**
  80   Determine whether this operation needs a physical present user.
  81
  82   @param[in]      VariableName            Name of the Variable.
  83   @param[in]      VendorGuid              GUID of the Variable.
  84
  85   @retval TRUE      This variable is protected, only a physical present user could set this variable.
  86   @retval FALSE     This variable is not protected.
  87
  88 **/
  89 BOOLEAN
  90 NeedPhysicallyPresent(
  91   IN     CHAR16         *VariableName,
  92   IN     EFI_GUID       *VendorGuid
  93   )
  94 {
  95   if ((CompareGuid (VendorGuid, &gEfiSecureBootEnableDisableGuid) && (StrCmp (VariableName, EFI_SECURE_BOOT_ENABLE_NAME) == 0))
  96     || (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (VariableName, EFI_CUSTOM_MODE_NAME) == 0))) {
  97     return TRUE;
  98   }
  99
 100   return FALSE;
 101 }
 102
 103 /**
 104   Determine whether the platform is operating in Custom Secure Boot mode.
 105
 106   @retval TRUE           The platform is operating in Custom mode.
 107   @retval FALSE          The platform is operating in Standard mode.
 108
 109 **/
 110 BOOLEAN
 111 InCustomMode (
 112   VOID
 113   )
 114 {
 115   VARIABLE_POINTER_TRACK  Variable;
 116
 117   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 118   if (Variable.CurrPtr != NULL && *(GetVariableDataPtr (Variable.CurrPtr)) == CUSTOM_SECURE_BOOT_MODE) {
 119     return TRUE;
 120   }
 121
 122   return FALSE;
 123 }
 124
 125
 126 /**
 127   Internal function to delete a Variable given its name and GUID, no authentication
 128   required.
 129
 130   @param[in]      VariableName            Name of the Variable.
 131   @param[in]      VendorGuid              GUID of the Variable.
 132
 133   @retval EFI_SUCCESS              Variable deleted successfully.
 134   @retval Others                   The driver failded to start the device.
 135
 136 **/
 137 EFI_STATUS
 138 DeleteVariable (
 139   IN  CHAR16                    *VariableName,
 140   IN  EFI_GUID                  *VendorGuid
 141   )
 142 {
 143   EFI_STATUS              Status;
 144   VARIABLE_POINTER_TRACK  Variable;
 145
 146   Status = FindVariable (VariableName, VendorGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 147   if (EFI_ERROR (Status)) {
 148     return EFI_SUCCESS;
 149   }
 150
 151   ASSERT (Variable.CurrPtr != NULL);
 152   return UpdateVariable (VariableName, VendorGuid, NULL, 0, 0, 0, 0, &Variable, NULL);
 153 }
 154
 155 /**
 156   Initializes for authenticated varibale service.
 157
 158   @retval EFI_SUCCESS           Function successfully executed.
 159   @retval EFI_OUT_OF_RESOURCES  Fail to allocate enough memory resources.
 160
 161 **/
 162 EFI_STATUS
 163 AutenticatedVariableServiceInitialize (
 164   VOID
 165   )
 166 {
 167   EFI_STATUS              Status;
 168   VARIABLE_POINTER_TRACK  Variable;
 169   VARIABLE_POINTER_TRACK  PkVariable;
 170   UINT8                   VarValue;
 171   UINT32                  VarAttr;
 172   UINT8                   *Data;
 173   UINTN                   DataSize;
 174   UINTN                   CtxSize;
 175   UINT8                   SecureBootMode;
 176   UINT8                   SecureBootEnable;
 177   UINT8                   CustomMode;
 178   UINT32                  ListSize;
 179
 180   //
 181   // Initialize hash context.
 182   //
 183   CtxSize   = Sha256GetContextSize ();
 184   mHashCtx  = AllocateRuntimePool (CtxSize);
 185   if (mHashCtx == NULL) {
 186     return EFI_OUT_OF_RESOURCES;
 187   }
 188
 189   //
 190   // Reserve runtime buffer for public key database. The size excludes variable header and name size.
 191   //
 192   mMaxKeyDbSize = PcdGet32 (PcdMaxVariableSize) - sizeof (VARIABLE_HEADER) - sizeof (AUTHVAR_KEYDB_NAME);
 193   mMaxKeyNumber = mMaxKeyDbSize / EFI_CERT_TYPE_RSA2048_SIZE;
 194   mPubKeyStore  = AllocateRuntimePool (mMaxKeyDbSize);
 195   if (mPubKeyStore == NULL) {
 196     return EFI_OUT_OF_RESOURCES;
 197   }
 198
 199   //
 200   // Reserve runtime buffer for certificate database. The size excludes variable header and name size.
 201   //
 202   mMaxCertDbSize = PcdGet32 (PcdMaxVariableSize) - sizeof (VARIABLE_HEADER) - sizeof (EFI_CERT_DB_NAME);
 203   mCertDbStore   = AllocateRuntimePool (mMaxCertDbSize);
 204   if (mCertDbStore == NULL) {
 205     return EFI_OUT_OF_RESOURCES;
 206   }
 207
 208   //
 209   // Prepare runtime buffer for serialized data of time-based authenticated
 210   // Variable, i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data).
 211   //
 212   mSerializationRuntimeBuffer = AllocateRuntimePool (PcdGet32 (PcdMaxVariableSize) + sizeof (EFI_GUID) + sizeof (UINT32) + sizeof (EFI_TIME));
 213   if (mSerializationRuntimeBuffer == NULL) {
 214     return EFI_OUT_OF_RESOURCES;
 215   }
 216
 217   //
 218   // Check "AuthVarKeyDatabase" variable's existence.
 219   // If it doesn't exist, create a new one with initial value of 0 and EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
 220   //
 221   Status = FindVariable (
 222              AUTHVAR_KEYDB_NAME,
 223              &gEfiAuthenticatedVariableGuid,
 224              &Variable,
 225              &mVariableModuleGlobal->VariableGlobal,
 226              FALSE
 227              );
 228
 229   if (Variable.CurrPtr == NULL) {
 230     VarAttr       = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 231     VarValue      = 0;
 232     mPubKeyNumber = 0;
 233     Status        = UpdateVariable (
 234                       AUTHVAR_KEYDB_NAME,
 235                       &gEfiAuthenticatedVariableGuid,
 236                       &VarValue,
 237                       sizeof(UINT8),
 238                       VarAttr,
 239                       0,
 240                       0,
 241                       &Variable,
 242                       NULL
 243                       );
 244     if (EFI_ERROR (Status)) {
 245       return Status;
 246     }
 247   } else {
 248     //
 249     // Load database in global variable for cache.
 250     //
 251     DataSize  = DataSizeOfVariable (Variable.CurrPtr);
 252     Data      = GetVariableDataPtr (Variable.CurrPtr);
 253     ASSERT ((DataSize != 0) && (Data != NULL));
 254     CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
 255     mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
 256   }
 257
 258   FindVariable (EFI_PLATFORM_KEY_NAME, &gEfiGlobalVariableGuid, &PkVariable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 259   if (PkVariable.CurrPtr == NULL) {
 260     DEBUG ((EFI_D_INFO, "Variable %s does not exist.\n", EFI_PLATFORM_KEY_NAME));
 261   } else {
 262     DEBUG ((EFI_D_INFO, "Variable %s exists.\n", EFI_PLATFORM_KEY_NAME));
 263   }
 264
 265   //
 266   // Create "SetupMode" variable with BS+RT attribute set.
 267   //
 268   FindVariable (EFI_SETUP_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 269   if (PkVariable.CurrPtr == NULL) {
 270     mPlatformMode = SETUP_MODE;
 271   } else {
 272     mPlatformMode = USER_MODE;
 273   }
 274   Status = UpdateVariable (
 275              EFI_SETUP_MODE_NAME,
 276              &gEfiGlobalVariableGuid,
 277              &mPlatformMode,
 278              sizeof(UINT8),
 279              EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 280              0,
 281              0,
 282              &Variable,
 283              NULL
 284              );
 285   if (EFI_ERROR (Status)) {
 286     return Status;
 287   }
 288
 289   //
 290   // Create "SignatureSupport" variable with BS+RT attribute set.
 291   //
 292   FindVariable (EFI_SIGNATURE_SUPPORT_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 293   Status  = UpdateVariable (
 294               EFI_SIGNATURE_SUPPORT_NAME,
 295               &gEfiGlobalVariableGuid,
 296               mSignatureSupport,
 297               sizeof(mSignatureSupport),
 298               EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 299               0,
 300               0,
 301               &Variable,
 302               NULL
 303               );
 304   if (EFI_ERROR (Status)) {
 305     return Status;
 306   }
 307
 308   //
 309   // If "SecureBootEnable" variable exists, then update "SecureBoot" variable.
 310   // If "SecureBootEnable" variable is SECURE_BOOT_ENABLE and in USER_MODE, Set "SecureBoot" variable to SECURE_BOOT_MODE_ENABLE.
 311   // If "SecureBootEnable" variable is SECURE_BOOT_DISABLE, Set "SecureBoot" variable to SECURE_BOOT_MODE_DISABLE.
 312   //
 313   SecureBootEnable = SECURE_BOOT_DISABLE;
 314   FindVariable (EFI_SECURE_BOOT_ENABLE_NAME, &gEfiSecureBootEnableDisableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 315   if (Variable.CurrPtr != NULL) {
 316     SecureBootEnable = *(GetVariableDataPtr (Variable.CurrPtr));
 317   } else if (mPlatformMode == USER_MODE) {
 318     //
 319     // "SecureBootEnable" not exist, initialize it in USER_MODE.
 320     //
 321     SecureBootEnable = SECURE_BOOT_ENABLE;
 322     Status = UpdateVariable (
 323                EFI_SECURE_BOOT_ENABLE_NAME,
 324                &gEfiSecureBootEnableDisableGuid,
 325                &SecureBootEnable,
 326                sizeof (UINT8),
 327                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 328                0,
 329                0,
 330                &Variable,
 331                NULL
 332                );
 333     if (EFI_ERROR (Status)) {
 334       return Status;
 335     }
 336   }
 337
 338   //
 339   // Create "SecureBoot" variable with BS+RT attribute set.
 340   //
 341   if (SecureBootEnable == SECURE_BOOT_ENABLE && mPlatformMode == USER_MODE) {
 342     SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 343   } else {
 344     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 345   }
 346   FindVariable (EFI_SECURE_BOOT_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 347   Status = UpdateVariable (
 348              EFI_SECURE_BOOT_MODE_NAME,
 349              &gEfiGlobalVariableGuid,
 350              &SecureBootMode,
 351              sizeof (UINT8),
 352              EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 353              0,
 354              0,
 355              &Variable,
 356              NULL
 357              );
 358   if (EFI_ERROR (Status)) {
 359     return Status;
 360   }
 361
 362   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SETUP_MODE_NAME, mPlatformMode));
 363   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_MODE_NAME, SecureBootMode));
 364   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_ENABLE_NAME, SecureBootEnable));
 365
 366   //
 367   // Initialize "CustomMode" in STANDARD_SECURE_BOOT_MODE state.
 368   //
 369   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 370   CustomMode = STANDARD_SECURE_BOOT_MODE;
 371   Status = UpdateVariable (
 372              EFI_CUSTOM_MODE_NAME,
 373              &gEfiCustomModeEnableGuid,
 374              &CustomMode,
 375              sizeof (UINT8),
 376              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 377              0,
 378              0,
 379              &Variable,
 380              NULL
 381              );
 382   if (EFI_ERROR (Status)) {
 383     return Status;
 384   }
 385
 386   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_CUSTOM_MODE_NAME, CustomMode));
 387
 388   //
 389   // Check "certdb" variable's existence.
 390   // If it doesn't exist, then create a new one with
 391   // EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.
 392   //
 393   Status = FindVariable (
 394              EFI_CERT_DB_NAME,
 395              &gEfiCertDbGuid,
 396              &Variable,
 397              &mVariableModuleGlobal->VariableGlobal,
 398              FALSE
 399              );
 400
 401   if (Variable.CurrPtr == NULL) {
 402     VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
 403     ListSize = sizeof (UINT32);
 404     Status   = UpdateVariable (
 405                  EFI_CERT_DB_NAME,
 406                  &gEfiCertDbGuid,
 407                  &ListSize,
 408                  sizeof (UINT32),
 409                  VarAttr,
 410                  0,
 411                  0,
 412                  &Variable,
 413                  NULL
 414                  );
 415     if (EFI_ERROR (Status)) {
 416       return Status;
 417     }
 418   }
 419
 420   //
 421   // Check "VendorKeysNv" variable's existence and create "VendorKeys" variable accordingly.
 422   //
 423   FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 424   if (Variable.CurrPtr != NULL) {
 425     mVendorKeyState = *(GetVariableDataPtr (Variable.CurrPtr));
 426   } else {
 427     //
 428     // "VendorKeysNv" not exist, initialize it in VENDOR_KEYS_VALID state.
 429     //
 430     mVendorKeyState = VENDOR_KEYS_VALID;
 431     Status = UpdateVariable (
 432                EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
 433                &gEfiVendorKeysNvGuid,
 434                &mVendorKeyState,
 435                sizeof (UINT8),
 436                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS,
 437                0,
 438                0,
 439                &Variable,
 440                NULL
 441                );
 442     if (EFI_ERROR (Status)) {
 443       return Status;
 444     }
 445   }
 446
 447   //
 448   // Create "VendorKeys" variable with BS+RT attribute set.
 449   //
 450   FindVariable (EFI_VENDOR_KEYS_VARIABLE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 451   Status = UpdateVariable (
 452              EFI_VENDOR_KEYS_VARIABLE_NAME,
 453              &gEfiGlobalVariableGuid,
 454              &mVendorKeyState,
 455              sizeof (UINT8),
 456              EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 457              0,
 458              0,
 459              &Variable,
 460              NULL
 461              );
 462   if (EFI_ERROR (Status)) {
 463     return Status;
 464   }
 465
 466   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_VENDOR_KEYS_VARIABLE_NAME, mVendorKeyState));
 467
 468   return Status;
 469 }
 470
 471 /**
 472   Add public key in store and return its index.
 473
 474   @param[in]  PubKey                  Input pointer to Public Key data
 475   @param[in]  VariableDataEntry       The variable data entry
 476
 477   @return                             Index of new added item
 478
 479 **/
 480 UINT32
 481 AddPubKeyInStore (
 482   IN  UINT8                        *PubKey,
 483   IN  VARIABLE_ENTRY_CONSISTENCY   *VariableDataEntry
 484   )
 485 {
 486   EFI_STATUS                       Status;
 487   BOOLEAN                          IsFound;
 488   UINT32                           Index;
 489   VARIABLE_POINTER_TRACK           Variable;
 490   UINT8                            *Ptr;
 491   UINT8                            *Data;
 492   UINTN                            DataSize;
 493   VARIABLE_ENTRY_CONSISTENCY       PublicKeyEntry;
 494   UINT32                           Attributes;
 495
 496   if (PubKey == NULL) {
 497     return 0;
 498   }
 499
 500   Status = FindVariable (
 501              AUTHVAR_KEYDB_NAME,
 502              &gEfiAuthenticatedVariableGuid,
 503              &Variable,
 504              &mVariableModuleGlobal->VariableGlobal,
 505              FALSE
 506              );
 507   if (EFI_ERROR (Status)) {
 508     DEBUG ((EFI_D_ERROR, "Get public key database variable failure, Status = %r\n", Status));
 509     return 0;
 510   }
 511
 512   //
 513   // Check whether the public key entry does exist.
 514   //
 515   IsFound = FALSE;
 516   for (Ptr = mPubKeyStore, Index = 1; Index <= mPubKeyNumber; Index++) {
 517     if (CompareMem (Ptr, PubKey, EFI_CERT_TYPE_RSA2048_SIZE) == 0) {
 518       IsFound = TRUE;
 519       break;
 520     }
 521     Ptr += EFI_CERT_TYPE_RSA2048_SIZE;
 522   }
 523
 524   if (!IsFound) {
 525     //
 526     // Add public key in database.
 527     //
 528     if (mPubKeyNumber == mMaxKeyNumber) {
 529       //
 530       // Public key dadatase is full, try to reclaim invalid key.
 531       //
 532       if (AtRuntime ()) {
 533         //
 534         // NV storage can't reclaim at runtime.
 535         //
 536         return 0;
 537       }
 538
 539       Status = Reclaim (
 540                  mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase,
 541                  &mVariableModuleGlobal->NonVolatileLastVariableOffset,
 542                  FALSE,
 543                  NULL,
 544                  NULL,
 545                  0,
 546                  TRUE
 547                  );
 548       if (EFI_ERROR (Status)) {
 549         return 0;
 550       }
 551
 552       Status = FindVariable (
 553                  AUTHVAR_KEYDB_NAME,
 554                  &gEfiAuthenticatedVariableGuid,
 555                  &Variable,
 556                  &mVariableModuleGlobal->VariableGlobal,
 557                  FALSE
 558                  );
 559       if (EFI_ERROR (Status)) {
 560         DEBUG ((EFI_D_ERROR, "Get public key database variable failure, Status = %r\n", Status));
 561         return 0;
 562       }
 563
 564       DataSize  = DataSizeOfVariable (Variable.CurrPtr);
 565       Data      = GetVariableDataPtr (Variable.CurrPtr);
 566       ASSERT ((DataSize != 0) && (Data != NULL));
 567       CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
 568       mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
 569
 570       if (mPubKeyNumber == mMaxKeyNumber) {
 571         return 0;
 572       }
 573     }
 574
 575     //
 576     // Check the variable space for both public key and variable data.
 577     //
 578     PublicKeyEntry.VariableSize = (mPubKeyNumber + 1) * EFI_CERT_TYPE_RSA2048_SIZE;
 579     PublicKeyEntry.Guid         = &gEfiAuthenticatedVariableGuid;
 580     PublicKeyEntry.Name         = AUTHVAR_KEYDB_NAME;
 581     Attributes = VARIABLE_ATTRIBUTE_NV_BS_RT | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 582
 583     if (!CheckRemainingSpaceForConsistency (Attributes, &PublicKeyEntry, VariableDataEntry, NULL)) {
 584       //
 585       // No enough variable space.
 586       //
 587       return 0;
 588     }
 589
 590     CopyMem (mPubKeyStore + mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 591     Index = ++mPubKeyNumber;
 592     //
 593     // Update public key database variable.
 594     //
 595     Status = UpdateVariable (
 596                AUTHVAR_KEYDB_NAME,
 597                &gEfiAuthenticatedVariableGuid,
 598                mPubKeyStore,
 599                mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE,
 600                Attributes,
 601                0,
 602                0,
 603                &Variable,
 604                NULL
 605                );
 606     if (EFI_ERROR (Status)) {
 607       DEBUG ((EFI_D_ERROR, "Update public key database variable failure, Status = %r\n", Status));
 608       return 0;
 609     }
 610   }
 611
 612   return Index;
 613 }
 614
 615 /**
 616   Verify data payload with AuthInfo in EFI_CERT_TYPE_RSA2048_SHA256_GUID type.
 617   Follow the steps in UEFI2.2.
 618
 619   Caution: This function may receive untrusted input.
 620   This function may be invoked in SMM mode, and datasize and data are external input.
 621   This function will do basic validation, before parse the data.
 622   This function will parse the authentication carefully to avoid security issues, like
 623   buffer overflow, integer overflow.
 624
 625   @param[in]      Data                    Pointer to data with AuthInfo.
 626   @param[in]      DataSize                Size of Data.
 627   @param[in]      PubKey                  Public key used for verification.
 628
 629   @retval EFI_INVALID_PARAMETER       Invalid parameter.
 630   @retval EFI_SECURITY_VIOLATION      If authentication failed.
 631   @retval EFI_SUCCESS                 Authentication successful.
 632
 633 **/
 634 EFI_STATUS
 635 VerifyCounterBasedPayload (
 636   IN     UINT8          *Data,
 637   IN     UINTN          DataSize,
 638   IN     UINT8          *PubKey
 639   )
 640 {
 641   BOOLEAN                         Status;
 642   EFI_VARIABLE_AUTHENTICATION     *CertData;
 643   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
 644   UINT8                           Digest[SHA256_DIGEST_SIZE];
 645   VOID                            *Rsa;
 646   UINTN                           PayloadSize;
 647
 648   PayloadSize = DataSize - AUTHINFO_SIZE;
 649   Rsa         = NULL;
 650   CertData    = NULL;
 651   CertBlock   = NULL;
 652
 653   if (Data == NULL || PubKey == NULL) {
 654     return EFI_INVALID_PARAMETER;
 655   }
 656
 657   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
 658   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
 659
 660   //
 661   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
 662   // Cert type should be EFI_CERT_TYPE_RSA2048_SHA256_GUID.
 663   //
 664   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
 665       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertTypeRsa2048Sha256Guid)
 666         ) {
 667     //
 668     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
 669     //
 670     return EFI_SECURITY_VIOLATION;
 671   }
 672   //
 673   // Hash data payload with SHA256.
 674   //
 675   ZeroMem (Digest, SHA256_DIGEST_SIZE);
 676   Status  = Sha256Init (mHashCtx);
 677   if (!Status) {
 678     goto Done;
 679   }
 680   Status  = Sha256Update (mHashCtx, Data + AUTHINFO_SIZE, PayloadSize);
 681   if (!Status) {
 682     goto Done;
 683   }
 684   //
 685   // Hash Size.
 686   //
 687   Status  = Sha256Update (mHashCtx, &PayloadSize, sizeof (UINTN));
 688   if (!Status) {
 689     goto Done;
 690   }
 691   //
 692   // Hash Monotonic Count.
 693   //
 694   Status  = Sha256Update (mHashCtx, &CertData->MonotonicCount, sizeof (UINT64));
 695   if (!Status) {
 696     goto Done;
 697   }
 698   Status  = Sha256Final (mHashCtx, Digest);
 699   if (!Status) {
 700     goto Done;
 701   }
 702   //
 703   // Generate & Initialize RSA Context.
 704   //
 705   Rsa = RsaNew ();
 706   ASSERT (Rsa != NULL);
 707   //
 708   // Set RSA Key Components.
 709   // NOTE: Only N and E are needed to be set as RSA public key for signature verification.
 710   //
 711   Status = RsaSetKey (Rsa, RsaKeyN, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 712   if (!Status) {
 713     goto Done;
 714   }
 715   Status = RsaSetKey (Rsa, RsaKeyE, mRsaE, sizeof (mRsaE));
 716   if (!Status) {
 717     goto Done;
 718   }
 719   //
 720   // Verify the signature.
 721   //
 722   Status = RsaPkcs1Verify (
 723              Rsa,
 724              Digest,
 725              SHA256_DIGEST_SIZE,
 726              CertBlock->Signature,
 727              EFI_CERT_TYPE_RSA2048_SHA256_SIZE
 728              );
 729
 730 Done:
 731   if (Rsa != NULL) {
 732     RsaFree (Rsa);
 733   }
 734   if (Status) {
 735     return EFI_SUCCESS;
 736   } else {
 737     return EFI_SECURITY_VIOLATION;
 738   }
 739 }
 740
 741 /**
 742   Update platform mode.
 743
 744   @param[in]      Mode                    SETUP_MODE or USER_MODE.
 745
 746   @return EFI_INVALID_PARAMETER           Invalid parameter.
 747   @return EFI_SUCCESS                     Update platform mode successfully.
 748
 749 **/
 750 EFI_STATUS
 751 UpdatePlatformMode (
 752   IN  UINT32                    Mode
 753   )
 754 {
 755   EFI_STATUS              Status;
 756   VARIABLE_POINTER_TRACK  Variable;
 757   UINT8                   SecureBootMode;
 758   UINT8                   SecureBootEnable;
 759   UINTN                   VariableDataSize;
 760
 761   Status = FindVariable (
 762              EFI_SETUP_MODE_NAME,
 763              &gEfiGlobalVariableGuid,
 764              &Variable,
 765              &mVariableModuleGlobal->VariableGlobal,
 766              FALSE
 767              );
 768   if (EFI_ERROR (Status)) {
 769     return Status;
 770   }
 771
 772   //
 773   // Update the value of SetupMode variable by a simple mem copy, this could avoid possible
 774   // variable storage reclaim at runtime.
 775   //
 776   mPlatformMode = (UINT8) Mode;
 777   CopyMem (GetVariableDataPtr (Variable.CurrPtr), &mPlatformMode, sizeof(UINT8));
 778
 779   if (AtRuntime ()) {
 780     //
 781     // SecureBoot Variable indicates whether the platform firmware is operating
 782     // in Secure boot mode (1) or not (0), so we should not change SecureBoot
 783     // Variable in runtime.
 784     //
 785     return Status;
 786   }
 787
 788   //
 789   // Check "SecureBoot" variable's existence.
 790   // If it doesn't exist, firmware has no capability to perform driver signing verification,
 791   // then set "SecureBoot" to 0.
 792   //
 793   Status = FindVariable (
 794              EFI_SECURE_BOOT_MODE_NAME,
 795              &gEfiGlobalVariableGuid,
 796              &Variable,
 797              &mVariableModuleGlobal->VariableGlobal,
 798              FALSE
 799              );
 800   //
 801   // If "SecureBoot" variable exists, then check "SetupMode" variable update.
 802   // If "SetupMode" variable is USER_MODE, "SecureBoot" variable is set to 1.
 803   // If "SetupMode" variable is SETUP_MODE, "SecureBoot" variable is set to 0.
 804   //
 805   if (Variable.CurrPtr == NULL) {
 806     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 807   } else {
 808     if (mPlatformMode == USER_MODE) {
 809       SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 810     } else if (mPlatformMode == SETUP_MODE) {
 811       SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 812     } else {
 813       return EFI_NOT_FOUND;
 814     }
 815   }
 816
 817   Status  = UpdateVariable (
 818               EFI_SECURE_BOOT_MODE_NAME,
 819               &gEfiGlobalVariableGuid,
 820               &SecureBootMode,
 821               sizeof(UINT8),
 822               EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 823               0,
 824               0,
 825               &Variable,
 826               NULL
 827               );
 828   if (EFI_ERROR (Status)) {
 829     return Status;
 830   }
 831
 832   //
 833   // Check "SecureBootEnable" variable's existence. It can enable/disable secure boot feature.
 834   //
 835   Status = FindVariable (
 836              EFI_SECURE_BOOT_ENABLE_NAME,
 837              &gEfiSecureBootEnableDisableGuid,
 838              &Variable,
 839              &mVariableModuleGlobal->VariableGlobal,
 840              FALSE
 841              );
 842
 843   if (SecureBootMode == SECURE_BOOT_MODE_ENABLE) {
 844     //
 845     // Create the "SecureBootEnable" variable as secure boot is enabled.
 846     //
 847     SecureBootEnable = SECURE_BOOT_ENABLE;
 848     VariableDataSize = sizeof (SecureBootEnable);
 849   } else {
 850     //
 851     // Delete the "SecureBootEnable" variable if this variable exist as "SecureBoot"
 852     // variable is not in secure boot state.
 853     //
 854     if (Variable.CurrPtr == NULL || EFI_ERROR (Status)) {
 855       return EFI_SUCCESS;
 856     }
 857     SecureBootEnable = SECURE_BOOT_DISABLE;
 858     VariableDataSize = 0;
 859   }
 860
 861   Status = UpdateVariable (
 862              EFI_SECURE_BOOT_ENABLE_NAME,
 863              &gEfiSecureBootEnableDisableGuid,
 864              &SecureBootEnable,
 865              VariableDataSize,
 866              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 867              0,
 868              0,
 869              &Variable,
 870              NULL
 871              );
 872   return Status;
 873 }
 874
 875 /**
 876   Check input data form to make sure it is a valid EFI_SIGNATURE_LIST for PK/KEK/db/dbx variable.
 877
 878   @param[in]  VariableName                Name of Variable to be check.
 879   @param[in]  VendorGuid                  Variable vendor GUID.
 880   @param[in]  Data                        Point to the variable data to be checked.
 881   @param[in]  DataSize                    Size of Data.
 882
 883   @return EFI_INVALID_PARAMETER           Invalid signature list format.
 884   @return EFI_SUCCESS                     Passed signature list format check successfully.
 885
 886 **/
 887 EFI_STATUS
 888 CheckSignatureListFormat(
 889   IN  CHAR16                    *VariableName,
 890   IN  EFI_GUID                  *VendorGuid,
 891   IN  VOID                      *Data,
 892   IN  UINTN                     DataSize
 893   )
 894 {
 895   EFI_SIGNATURE_LIST     *SigList;
 896   UINTN                  SigDataSize;
 897   UINT32                 Index;
 898   UINT32                 SigCount;
 899   BOOLEAN                IsPk;
 900   VOID                   *RsaContext;
 901   EFI_SIGNATURE_DATA     *CertData;
 902   UINTN                  CertLen;
 903
 904   if (DataSize == 0) {
 905     return EFI_SUCCESS;
 906   }
 907
 908   ASSERT (VariableName != NULL && VendorGuid != NULL && Data != NULL);
 909
 910   if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_PLATFORM_KEY_NAME) == 0)){
 911     IsPk = TRUE;
 912   } else if ((CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0) ||
 913              (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&
 914               (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0 || StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0))){
 915     IsPk = FALSE;
 916   } else {
 917     return EFI_SUCCESS;
 918   }
 919
 920   SigCount = 0;
 921   SigList  = (EFI_SIGNATURE_LIST *) Data;
 922   SigDataSize  = DataSize;
 923   RsaContext = NULL;
 924
 925   //
 926   // Walk throuth the input signature list and check the data format.
 927   // If any signature is incorrectly formed, the whole check will fail.
 928   //
 929   while ((SigDataSize > 0) && (SigDataSize >= SigList->SignatureListSize)) {
 930     for (Index = 0; Index < (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM)); Index++ ) {
 931       if (CompareGuid (&SigList->SignatureType, &mSupportSigItem[Index].SigType)) {
 932         //
 933         // The value of SignatureSize should always be 16 (size of SignatureOwner
 934         // component) add the data length according to signature type.
 935         //
 936         if (mSupportSigItem[Index].SigDataSize != ((UINT32) ~0) &&
 937           (SigList->SignatureSize - sizeof (EFI_GUID)) != mSupportSigItem[Index].SigDataSize) {
 938           return EFI_INVALID_PARAMETER;
 939         }
 940         if (mSupportSigItem[Index].SigHeaderSize != ((UINTN) ~0) &&
 941           SigList->SignatureHeaderSize != mSupportSigItem[Index].SigHeaderSize) {
 942           return EFI_INVALID_PARAMETER;
 943         }
 944         break;
 945       }
 946     }
 947
 948     if (Index == (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM))) {
 949       //
 950       // Undefined signature type.
 951       //
 952       return EFI_INVALID_PARAMETER;
 953     }
 954
 955     if (CompareGuid (&SigList->SignatureType, &gEfiCertX509Guid)) {
 956       //
 957       // Try to retrieve the RSA public key from the X.509 certificate.
 958       // If this operation fails, it's not a valid certificate.
 959       //
 960       RsaContext = RsaNew ();
 961       if (RsaContext == NULL) {
 962         return EFI_INVALID_PARAMETER;
 963       }
 964       CertData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigList + sizeof (EFI_SIGNATURE_LIST) + SigList->SignatureHeaderSize);
 965       CertLen = SigList->SignatureSize - sizeof (EFI_GUID);
 966       if (!RsaGetPublicKeyFromX509 (CertData->SignatureData, CertLen, &RsaContext)) {
 967         RsaFree (RsaContext);
 968         return EFI_INVALID_PARAMETER;
 969       }
 970       RsaFree (RsaContext);
 971     }
 972
 973     if ((SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) % SigList->SignatureSize != 0) {
 974       return EFI_INVALID_PARAMETER;
 975     }
 976     SigCount += (SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) / SigList->SignatureSize;
 977
 978     SigDataSize -= SigList->SignatureListSize;
 979     SigList = (EFI_SIGNATURE_LIST *) ((UINT8 *) SigList + SigList->SignatureListSize);
 980   }
 981
 982   if (((UINTN) SigList - (UINTN) Data) != DataSize) {
 983     return EFI_INVALID_PARAMETER;
 984   }
 985
 986   if (IsPk && SigCount > 1) {
 987     return EFI_INVALID_PARAMETER;
 988   }
 989
 990   return EFI_SUCCESS;
 991 }
 992
 993 /**
 994   Update "VendorKeys" variable to record the out of band secure boot key modification.
 995
 996   @return EFI_SUCCESS           Variable is updated successfully.
 997   @return Others                Failed to update variable.
 998
 999 **/
1000 EFI_STATUS
1001 VendorKeyIsModified (
1002   VOID
1003   )
1004 {
1005   EFI_STATUS              Status;
1006   VARIABLE_POINTER_TRACK  Variable;
1007
1008   if (mVendorKeyState == VENDOR_KEYS_MODIFIED) {
1009     return EFI_SUCCESS;
1010   }
1011   mVendorKeyState = VENDOR_KEYS_MODIFIED;
1012
1013   FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
1014   Status = UpdateVariable (
1015              EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
1016              &gEfiVendorKeysNvGuid,
1017              &mVendorKeyState,
1018              sizeof (UINT8),
1019              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS,
1020              0,
1021              0,
1022              &Variable,
1023              NULL
1024              );
1025   if (EFI_ERROR (Status)) {
1026     return Status;
1027   }
1028
1029   FindVariable (EFI_VENDOR_KEYS_VARIABLE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
1030   return UpdateVariable (
1031            EFI_VENDOR_KEYS_VARIABLE_NAME,
1032            &gEfiGlobalVariableGuid,
1033            &mVendorKeyState,
1034            sizeof (UINT8),
1035            EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
1036            0,
1037            0,
1038            &Variable,
1039            NULL
1040            );
1041 }
1042
1043 /**
1044   Process variable with platform key for verification.
1045
1046   Caution: This function may receive untrusted input.
1047   This function may be invoked in SMM mode, and datasize and data are external input.
1048   This function will do basic validation, before parse the data.
1049   This function will parse the authentication carefully to avoid security issues, like
1050   buffer overflow, integer overflow.
1051   This function will check attribute carefully to avoid authentication bypass.
1052
1053   @param[in]  VariableName                Name of Variable to be found.
1054   @param[in]  VendorGuid                  Variable vendor GUID.
1055   @param[in]  Data                        Data pointer.
1056   @param[in]  DataSize                    Size of Data found. If size is less than the
1057                                           data, this value contains the required size.
1058   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1059   @param[in]  Attributes                  Attribute value of the variable
1060   @param[in]  IsPk                        Indicate whether it is to process pk.
1061
1062   @return EFI_INVALID_PARAMETER           Invalid parameter.
1063   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation.
1064                                           check carried out by the firmware.
1065   @return EFI_SUCCESS                     Variable passed validation successfully.
1066
1067 **/
1068 EFI_STATUS
1069 ProcessVarWithPk (
1070   IN  CHAR16                    *VariableName,
1071   IN  EFI_GUID                  *VendorGuid,
1072   IN  VOID                      *Data,
1073   IN  UINTN                     DataSize,
1074   IN  VARIABLE_POINTER_TRACK    *Variable,
1075   IN  UINT32                    Attributes OPTIONAL,
1076   IN  BOOLEAN                   IsPk
1077   )
1078 {
1079   EFI_STATUS                  Status;
1080   BOOLEAN                     Del;
1081   UINT8                       *Payload;
1082   UINTN                       PayloadSize;
1083
1084   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1085       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1086     //
1087     // PK, KEK and db/dbx should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1088     // authenticated variable.
1089     //
1090     return EFI_INVALID_PARAMETER;
1091   }
1092
1093   Del = FALSE;
1094   if ((InCustomMode() && UserPhysicalPresent()) || (mPlatformMode == SETUP_MODE && !IsPk)) {
1095     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1096     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1097     if (PayloadSize == 0) {
1098       Del = TRUE;
1099     }
1100
1101     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
1102     if (EFI_ERROR (Status)) {
1103       return Status;
1104     }
1105
1106     Status = UpdateVariable (
1107                VariableName,
1108                VendorGuid,
1109                Payload,
1110                PayloadSize,
1111                Attributes,
1112                0,
1113                0,
1114                Variable,
1115                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1116                );
1117     if (EFI_ERROR(Status)) {
1118       return Status;
1119     }
1120
1121     if ((mPlatformMode != SETUP_MODE) || IsPk) {
1122       Status = VendorKeyIsModified ();
1123     }
1124   } else if (mPlatformMode == USER_MODE) {
1125     //
1126     // Verify against X509 Cert in PK database.
1127     //
1128     Status = VerifyTimeBasedPayload (
1129                VariableName,
1130                VendorGuid,
1131                Data,
1132                DataSize,
1133                Variable,
1134                Attributes,
1135                AuthVarTypePk,
1136                &Del
1137                );
1138   } else {
1139     //
1140     // Verify against the certificate in data payload.
1141     //
1142     Status = VerifyTimeBasedPayload (
1143                VariableName,
1144                VendorGuid,
1145                Data,
1146                DataSize,
1147                Variable,
1148                Attributes,
1149                AuthVarTypePayload,
1150                &Del
1151                );
1152   }
1153
1154   if (!EFI_ERROR(Status) && IsPk) {
1155     if (mPlatformMode == SETUP_MODE && !Del) {
1156       //
1157       // If enroll PK in setup mode, need change to user mode.
1158       //
1159       Status = UpdatePlatformMode (USER_MODE);
1160     } else if (mPlatformMode == USER_MODE && Del){
1161       //
1162       // If delete PK in user mode, need change to setup mode.
1163       //
1164       Status = UpdatePlatformMode (SETUP_MODE);
1165     }
1166   }
1167
1168   return Status;
1169 }
1170
1171 /**
1172   Process variable with key exchange key for verification.
1173
1174   Caution: This function may receive untrusted input.
1175   This function may be invoked in SMM mode, and datasize and data are external input.
1176   This function will do basic validation, before parse the data.
1177   This function will parse the authentication carefully to avoid security issues, like
1178   buffer overflow, integer overflow.
1179   This function will check attribute carefully to avoid authentication bypass.
1180
1181   @param[in]  VariableName                Name of Variable to be found.
1182   @param[in]  VendorGuid                  Variable vendor GUID.
1183   @param[in]  Data                        Data pointer.
1184   @param[in]  DataSize                    Size of Data found. If size is less than the
1185                                           data, this value contains the required size.
1186   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1187   @param[in]  Attributes                  Attribute value of the variable.
1188
1189   @return EFI_INVALID_PARAMETER           Invalid parameter.
1190   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
1191                                           check carried out by the firmware.
1192   @return EFI_SUCCESS                     Variable pass validation successfully.
1193
1194 **/
1195 EFI_STATUS
1196 ProcessVarWithKek (
1197   IN  CHAR16                               *VariableName,
1198   IN  EFI_GUID                             *VendorGuid,
1199   IN  VOID                                 *Data,
1200   IN  UINTN                                DataSize,
1201   IN  VARIABLE_POINTER_TRACK               *Variable,
1202   IN  UINT32                               Attributes OPTIONAL
1203   )
1204 {
1205   EFI_STATUS                      Status;
1206   UINT8                           *Payload;
1207   UINTN                           PayloadSize;
1208
1209   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1210       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1211     //
1212     // DB and DBX should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1213     // authenticated variable.
1214     //
1215     return EFI_INVALID_PARAMETER;
1216   }
1217
1218   Status = EFI_SUCCESS;
1219   if (mPlatformMode == USER_MODE && !(InCustomMode() && UserPhysicalPresent())) {
1220     //
1221     // Time-based, verify against X509 Cert KEK.
1222     //
1223     return VerifyTimeBasedPayload (
1224              VariableName,
1225              VendorGuid,
1226              Data,
1227              DataSize,
1228              Variable,
1229              Attributes,
1230              AuthVarTypeKek,
1231              NULL
1232              );
1233   } else {
1234     //
1235     // If in setup mode or custom secure boot mode, no authentication needed.
1236     //
1237     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1238     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1239
1240     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
1241     if (EFI_ERROR (Status)) {
1242       return Status;
1243     }
1244
1245     Status = UpdateVariable (
1246                VariableName,
1247                VendorGuid,
1248                Payload,
1249                PayloadSize,
1250                Attributes,
1251                0,
1252                0,
1253                Variable,
1254                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1255                );
1256     if (EFI_ERROR (Status)) {
1257       return Status;
1258     }
1259
1260     if (mPlatformMode != SETUP_MODE) {
1261       Status = VendorKeyIsModified ();
1262     }
1263   }
1264
1265   return Status;
1266 }
1267
1268 /**
1269   Process variable with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS/EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
1270
1271   Caution: This function may receive untrusted input.
1272   This function may be invoked in SMM mode, and datasize and data are external input.
1273   This function will do basic validation, before parse the data.
1274   This function will parse the authentication carefully to avoid security issues, like
1275   buffer overflow, integer overflow.
1276   This function will check attribute carefully to avoid authentication bypass.
1277
1278   @param[in]  VariableName                Name of Variable to be found.
1279   @param[in]  VendorGuid                  Variable vendor GUID.
1280
1281   @param[in]  Data                        Data pointer.
1282   @param[in]  DataSize                    Size of Data found. If size is less than the
1283                                           data, this value contains the required size.
1284   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1285   @param[in]  Attributes                  Attribute value of the variable.
1286
1287   @return EFI_INVALID_PARAMETER           Invalid parameter.
1288   @return EFI_WRITE_PROTECTED             Variable is write-protected and needs authentication with
1289                                           EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1290   @return EFI_OUT_OF_RESOURCES            The Database to save the public key is full.
1291   @return EFI_SECURITY_VIOLATION          The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
1292                                           set, but the AuthInfo does NOT pass the validation
1293                                           check carried out by the firmware.
1294   @return EFI_SUCCESS                     Variable is not write-protected or pass validation successfully.
1295
1296 **/
1297 EFI_STATUS
1298 ProcessVariable (
1299   IN     CHAR16                             *VariableName,
1300   IN     EFI_GUID                           *VendorGuid,
1301   IN     VOID                               *Data,
1302   IN     UINTN                              DataSize,
1303   IN     VARIABLE_POINTER_TRACK             *Variable,
1304   IN     UINT32                             Attributes
1305   )
1306 {
1307   EFI_STATUS                      Status;
1308   BOOLEAN                         IsDeletion;
1309   BOOLEAN                         IsFirstTime;
1310   UINT8                           *PubKey;
1311   EFI_VARIABLE_AUTHENTICATION     *CertData;
1312   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
1313   UINT32                          KeyIndex;
1314   UINT64                          MonotonicCount;
1315   VARIABLE_ENTRY_CONSISTENCY      VariableDataEntry;
1316
1317   KeyIndex    = 0;
1318   CertData    = NULL;
1319   CertBlock   = NULL;
1320   PubKey      = NULL;
1321   IsDeletion  = FALSE;
1322
1323   if (NeedPhysicallyPresent(VariableName, VendorGuid) && !UserPhysicalPresent()) {
1324     //
1325     // This variable is protected, only physical present user could modify its value.
1326     //
1327     return EFI_SECURITY_VIOLATION;
1328   }
1329
1330   //
1331   // A time-based authenticated variable and a count-based authenticated variable
1332   // can't be updated by each other.
1333   //
1334   if (Variable->CurrPtr != NULL) {
1335     if (((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) &&
1336         ((Variable->CurrPtr->Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0)) {
1337       return EFI_SECURITY_VIOLATION;
1338     }
1339
1340     if (((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) &&
1341         ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0)) {
1342       return EFI_SECURITY_VIOLATION;
1343     }
1344   }
1345
1346   //
1347   // Process Time-based Authenticated variable.
1348   //
1349   if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1350     return VerifyTimeBasedPayload (
1351              VariableName,
1352              VendorGuid,
1353              Data,
1354              DataSize,
1355              Variable,
1356              Attributes,
1357              AuthVarTypePriv,
1358              NULL
1359              );
1360   }
1361
1362   //
1363   // Determine if first time SetVariable with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS.
1364   //
1365   if ((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) {
1366     //
1367     // Determine current operation type.
1368     //
1369     if (DataSize == AUTHINFO_SIZE) {
1370       IsDeletion = TRUE;
1371     }
1372     //
1373     // Determine whether this is the first time with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1374     //
1375     if (Variable->CurrPtr == NULL) {
1376       IsFirstTime = TRUE;
1377     } else if ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) == 0) {
1378       IsFirstTime = TRUE;
1379     } else {
1380       KeyIndex   = Variable->CurrPtr->PubKeyIndex;
1381       IsFirstTime = FALSE;
1382     }
1383   } else if ((Variable->CurrPtr != NULL) &&
1384              ((Variable->CurrPtr->Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)
1385             ) {
1386     //
1387     // If the variable is already write-protected, it always needs authentication before update.
1388     //
1389     return EFI_WRITE_PROTECTED;
1390   } else {
1391     //
1392     // If without EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS, set and attributes collision.
1393     // That means it is not authenticated variable, just update variable as usual.
1394     //
1395     Status = UpdateVariable (VariableName, VendorGuid, Data, DataSize, Attributes, 0, 0, Variable, NULL);
1396     return Status;
1397   }
1398
1399   //
1400   // Get PubKey and check Monotonic Count value corresponding to the variable.
1401   //
1402   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
1403   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
1404   PubKey    = CertBlock->PublicKey;
1405
1406   //
1407   // Update Monotonic Count value.
1408   //
1409   MonotonicCount = CertData->MonotonicCount;
1410
1411   if (!IsFirstTime) {
1412     //
1413     // 2 cases need to check here
1414     //   1. Internal PubKey variable. PubKeyIndex is always 0
1415     //   2. Other counter-based AuthVariable. Check input PubKey.
1416     //
1417     if (KeyIndex == 0 || CompareMem (PubKey, mPubKeyStore + (KeyIndex - 1) * EFI_CERT_TYPE_RSA2048_SIZE, EFI_CERT_TYPE_RSA2048_SIZE) != 0) {
1418       return EFI_SECURITY_VIOLATION;
1419     }
1420     //
1421     // Compare the current monotonic count and ensure that it is greater than the last SetVariable
1422     // operation with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS attribute set.
1423     //
1424     if (CertData->MonotonicCount <= Variable->CurrPtr->MonotonicCount) {
1425       //
1426       // Monotonic count check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
1427       //
1428       return EFI_SECURITY_VIOLATION;
1429     }
1430   }
1431   //
1432   // Verify the certificate in Data payload.
1433   //
1434   Status = VerifyCounterBasedPayload (Data, DataSize, PubKey);
1435   if (EFI_ERROR (Status)) {
1436     return Status;
1437   }
1438
1439   //
1440   // Now, the signature has been verified!
1441   //
1442   if (IsFirstTime && !IsDeletion) {
1443     VariableDataEntry.VariableSize = DataSize - AUTHINFO_SIZE;
1444     VariableDataEntry.Guid         = VendorGuid;
1445     VariableDataEntry.Name         = VariableName;
1446
1447     //
1448     // Update public key database variable if need.
1449     //
1450     KeyIndex = AddPubKeyInStore (PubKey, &VariableDataEntry);
1451     if (KeyIndex == 0) {
1452       return EFI_OUT_OF_RESOURCES;
1453     }
1454   }
1455
1456   //
1457   // Verification pass.
1458   //
1459   return UpdateVariable (VariableName, VendorGuid, (UINT8*)Data + AUTHINFO_SIZE, DataSize - AUTHINFO_SIZE, Attributes, KeyIndex, MonotonicCount, Variable, NULL);
1460 }
1461
1462 /**
1463   Merge two buffers which formatted as EFI_SIGNATURE_LIST. Only the new EFI_SIGNATURE_DATA
1464   will be appended to the original EFI_SIGNATURE_LIST, duplicate EFI_SIGNATURE_DATA
1465   will be ignored.
1466
1467   @param[in, out]  Data              Pointer to original EFI_SIGNATURE_LIST.
1468   @param[in]       DataSize          Size of Data buffer.
1469   @param[in]       FreeBufSize       Size of free data buffer
1470   @param[in]       NewData           Pointer to new EFI_SIGNATURE_LIST to be appended.
1471   @param[in]       NewDataSize       Size of NewData buffer.
1472   @param[out]      MergedBufSize     Size of the merged buffer
1473
1474   @return EFI_BUFFER_TOO_SMALL if input Data buffer overflowed
1475
1476 **/
1477 EFI_STATUS
1478 AppendSignatureList (
1479   IN  OUT VOID            *Data,
1480   IN  UINTN               DataSize,
1481   IN  UINTN               FreeBufSize,
1482   IN  VOID                *NewData,
1483   IN  UINTN               NewDataSize,
1484   OUT UINTN               *MergedBufSize
1485   )
1486 {
1487   EFI_SIGNATURE_LIST  *CertList;
1488   EFI_SIGNATURE_DATA  *Cert;
1489   UINTN               CertCount;
1490   EFI_SIGNATURE_LIST  *NewCertList;
1491   EFI_SIGNATURE_DATA  *NewCert;
1492   UINTN               NewCertCount;
1493   UINTN               Index;
1494   UINTN               Index2;
1495   UINTN               Size;
1496   UINT8               *Tail;
1497   UINTN               CopiedCount;
1498   UINTN               SignatureListSize;
1499   BOOLEAN             IsNewCert;
1500
1501   Tail = (UINT8 *) Data + DataSize;
1502
1503   NewCertList = (EFI_SIGNATURE_LIST *) NewData;
1504   while ((NewDataSize > 0) && (NewDataSize >= NewCertList->SignatureListSize)) {
1505     NewCert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCertList + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1506     NewCertCount = (NewCertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - NewCertList->SignatureHeaderSize) / NewCertList->SignatureSize;
1507
1508     CopiedCount = 0;
1509     for (Index = 0; Index < NewCertCount; Index++) {
1510       IsNewCert = TRUE;
1511
1512       Size = DataSize;
1513       CertList = (EFI_SIGNATURE_LIST *) Data;
1514       while ((Size > 0) && (Size >= CertList->SignatureListSize)) {
1515         if (CompareGuid (&CertList->SignatureType, &NewCertList->SignatureType) &&
1516            (CertList->SignatureSize == NewCertList->SignatureSize)) {
1517           Cert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
1518           CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
1519           for (Index2 = 0; Index2 < CertCount; Index2++) {
1520             //
1521             // Iterate each Signature Data in this Signature List.
1522             //
1523             if (CompareMem (NewCert, Cert, CertList->SignatureSize) == 0) {
1524               IsNewCert = FALSE;
1525               break;
1526             }
1527             Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
1528           }
1529         }
1530
1531         if (!IsNewCert) {
1532           break;
1533         }
1534         Size -= CertList->SignatureListSize;
1535         CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
1536       }
1537
1538       if (IsNewCert) {
1539         //
1540         // New EFI_SIGNATURE_DATA, append it.
1541         //
1542         if (CopiedCount == 0) {
1543           if (FreeBufSize < sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize) {
1544             return EFI_BUFFER_TOO_SMALL;
1545           }
1546
1547           //
1548           // Copy EFI_SIGNATURE_LIST header for only once.
1549           //
1550
1551           CopyMem (Tail, NewCertList, sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1552           Tail = Tail + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1553           FreeBufSize -= sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1554         }
1555
1556         if (FreeBufSize < NewCertList->SignatureSize) {
1557           return EFI_BUFFER_TOO_SMALL;
1558         }
1559         CopyMem (Tail, NewCert, NewCertList->SignatureSize);
1560         Tail += NewCertList->SignatureSize;
1561         FreeBufSize -= NewCertList->SignatureSize;
1562         CopiedCount++;
1563       }
1564
1565       NewCert = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCert + NewCertList->SignatureSize);
1566     }
1567
1568     //
1569     // Update SignatureListSize in newly appended EFI_SIGNATURE_LIST.
1570     //
1571     if (CopiedCount != 0) {
1572       SignatureListSize = sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize + (CopiedCount * NewCertList->SignatureSize);
1573       CertList = (EFI_SIGNATURE_LIST *) (Tail - SignatureListSize);
1574       CertList->SignatureListSize = (UINT32) SignatureListSize;
1575     }
1576
1577     NewDataSize -= NewCertList->SignatureListSize;
1578     NewCertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) NewCertList + NewCertList->SignatureListSize);
1579   }
1580
1581   *MergedBufSize = (Tail - (UINT8 *) Data);
1582   return EFI_SUCCESS;
1583 }
1584
1585 /**
1586   Compare two EFI_TIME data.
1587
1588
1589   @param FirstTime           A pointer to the first EFI_TIME data.
1590   @param SecondTime          A pointer to the second EFI_TIME data.
1591
1592   @retval  TRUE              The FirstTime is not later than the SecondTime.
1593   @retval  FALSE             The FirstTime is later than the SecondTime.
1594
1595 **/
1596 BOOLEAN
1597 CompareTimeStamp (
1598   IN EFI_TIME               *FirstTime,
1599   IN EFI_TIME               *SecondTime
1600   )
1601 {
1602   if (FirstTime->Year != SecondTime->Year) {
1603     return (BOOLEAN) (FirstTime->Year < SecondTime->Year);
1604   } else if (FirstTime->Month != SecondTime->Month) {
1605     return (BOOLEAN) (FirstTime->Month < SecondTime->Month);
1606   } else if (FirstTime->Day != SecondTime->Day) {
1607     return (BOOLEAN) (FirstTime->Day < SecondTime->Day);
1608   } else if (FirstTime->Hour != SecondTime->Hour) {
1609     return (BOOLEAN) (FirstTime->Hour < SecondTime->Hour);
1610   } else if (FirstTime->Minute != SecondTime->Minute) {
1611     return (BOOLEAN) (FirstTime->Minute < SecondTime->Minute);
1612   }
1613
1614   return (BOOLEAN) (FirstTime->Second <= SecondTime->Second);
1615 }
1616
1617 /**
1618   Find matching signer's certificates for common authenticated variable
1619   by corresponding VariableName and VendorGuid from "certdb".
1620
1621   The data format of "certdb":
1622   //
1623   //     UINT32 CertDbListSize;
1624   // /// AUTH_CERT_DB_DATA Certs1[];
1625   // /// AUTH_CERT_DB_DATA Certs2[];
1626   // /// ...
1627   // /// AUTH_CERT_DB_DATA Certsn[];
1628   //
1629
1630   @param[in]  VariableName   Name of authenticated Variable.
1631   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1632   @param[in]  Data           Pointer to variable "certdb".
1633   @param[in]  DataSize       Size of variable "certdb".
1634   @param[out] CertOffset     Offset of matching CertData, from starting of Data.
1635   @param[out] CertDataSize   Length of CertData in bytes.
1636   @param[out] CertNodeOffset Offset of matching AUTH_CERT_DB_DATA , from
1637                              starting of Data.
1638   @param[out] CertNodeSize   Length of AUTH_CERT_DB_DATA in bytes.
1639
1640   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1641   @retval  EFI_NOT_FOUND         Fail to find matching certs.
1642   @retval  EFI_SUCCESS           Find matching certs and output parameters.
1643
1644 **/
1645 EFI_STATUS
1646 FindCertsFromDb (
1647   IN     CHAR16           *VariableName,
1648   IN     EFI_GUID         *VendorGuid,
1649   IN     UINT8            *Data,
1650   IN     UINTN            DataSize,
1651   OUT    UINT32           *CertOffset,    OPTIONAL
1652   OUT    UINT32           *CertDataSize,  OPTIONAL
1653   OUT    UINT32           *CertNodeOffset,OPTIONAL
1654   OUT    UINT32           *CertNodeSize   OPTIONAL
1655   )
1656 {
1657   UINT32                  Offset;
1658   AUTH_CERT_DB_DATA       *Ptr;
1659   UINT32                  CertSize;
1660   UINT32                  NameSize;
1661   UINT32                  NodeSize;
1662   UINT32                  CertDbListSize;
1663
1664   if ((VariableName == NULL) || (VendorGuid == NULL) || (Data == NULL)) {
1665     return EFI_INVALID_PARAMETER;
1666   }
1667
1668   //
1669   // Check whether DataSize matches recorded CertDbListSize.
1670   //
1671   if (DataSize < sizeof (UINT32)) {
1672     return EFI_INVALID_PARAMETER;
1673   }
1674
1675   CertDbListSize = ReadUnaligned32 ((UINT32 *) Data);
1676
1677   if (CertDbListSize != (UINT32) DataSize) {
1678     return EFI_INVALID_PARAMETER;
1679   }
1680
1681   Offset = sizeof (UINT32);
1682
1683   //
1684   // Get corresponding certificates by VendorGuid and VariableName.
1685   //
1686   while (Offset < (UINT32) DataSize) {
1687     Ptr = (AUTH_CERT_DB_DATA *) (Data + Offset);
1688     //
1689     // Check whether VendorGuid matches.
1690     //
1691     if (CompareGuid (&Ptr->VendorGuid, VendorGuid)) {
1692       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1693       NameSize = ReadUnaligned32 (&Ptr->NameSize);
1694       CertSize = ReadUnaligned32 (&Ptr->CertDataSize);
1695
1696       if (NodeSize != sizeof (EFI_GUID) + sizeof (UINT32) * 3 + CertSize +
1697           sizeof (CHAR16) * NameSize) {
1698         return EFI_INVALID_PARAMETER;
1699       }
1700
1701       Offset = Offset + sizeof (EFI_GUID) + sizeof (UINT32) * 3;
1702       //
1703       // Check whether VariableName matches.
1704       //
1705       if ((NameSize == StrLen (VariableName)) &&
1706           (CompareMem (Data + Offset, VariableName, NameSize * sizeof (CHAR16)) == 0)) {
1707         Offset = Offset + NameSize * sizeof (CHAR16);
1708
1709         if (CertOffset != NULL) {
1710           *CertOffset = Offset;
1711         }
1712
1713         if (CertDataSize != NULL) {
1714           *CertDataSize = CertSize;
1715         }
1716
1717         if (CertNodeOffset != NULL) {
1718           *CertNodeOffset = (UINT32) ((UINT8 *) Ptr - Data);
1719         }
1720
1721         if (CertNodeSize != NULL) {
1722           *CertNodeSize = NodeSize;
1723         }
1724
1725         return EFI_SUCCESS;
1726       } else {
1727         Offset = Offset + NameSize * sizeof (CHAR16) + CertSize;
1728       }
1729     } else {
1730       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1731       Offset   = Offset + NodeSize;
1732     }
1733   }
1734
1735   return EFI_NOT_FOUND;
1736 }
1737
1738 /**
1739   Retrieve signer's certificates for common authenticated variable
1740   by corresponding VariableName and VendorGuid from "certdb".
1741
1742   @param[in]  VariableName   Name of authenticated Variable.
1743   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1744   @param[out] CertData       Pointer to signer's certificates.
1745   @param[out] CertDataSize   Length of CertData in bytes.
1746
1747   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1748   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1749   @retval  EFI_SUCCESS           Get signer's certificates successfully.
1750
1751 **/
1752 EFI_STATUS
1753 GetCertsFromDb (
1754   IN     CHAR16           *VariableName,
1755   IN     EFI_GUID         *VendorGuid,
1756   OUT    UINT8            **CertData,
1757   OUT    UINT32           *CertDataSize
1758   )
1759 {
1760   VARIABLE_POINTER_TRACK  CertDbVariable;
1761   EFI_STATUS              Status;
1762   UINT8                   *Data;
1763   UINTN                   DataSize;
1764   UINT32                  CertOffset;
1765
1766   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL) || (CertDataSize == NULL)) {
1767     return EFI_INVALID_PARAMETER;
1768   }
1769
1770   //
1771   // Get variable "certdb".
1772   //
1773   Status = FindVariable (
1774              EFI_CERT_DB_NAME,
1775              &gEfiCertDbGuid,
1776              &CertDbVariable,
1777              &mVariableModuleGlobal->VariableGlobal,
1778              FALSE
1779              );
1780   if (EFI_ERROR (Status)) {
1781     return Status;
1782   }
1783
1784   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1785   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1786   if ((DataSize == 0) || (Data == NULL)) {
1787     ASSERT (FALSE);
1788     return EFI_NOT_FOUND;
1789   }
1790
1791   Status = FindCertsFromDb (
1792              VariableName,
1793              VendorGuid,
1794              Data,
1795              DataSize,
1796              &CertOffset,
1797              CertDataSize,
1798              NULL,
1799              NULL
1800              );
1801
1802   if (EFI_ERROR (Status)) {
1803     return Status;
1804   }
1805
1806   *CertData = Data + CertOffset;
1807   return EFI_SUCCESS;
1808 }
1809
1810 /**
1811   Delete matching signer's certificates when deleting common authenticated
1812   variable by corresponding VariableName and VendorGuid from "certdb".
1813
1814   @param[in]  VariableName   Name of authenticated Variable.
1815   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1816
1817   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1818   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1819   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
1820   @retval  EFI_SUCCESS           The operation is completed successfully.
1821
1822 **/
1823 EFI_STATUS
1824 DeleteCertsFromDb (
1825   IN     CHAR16           *VariableName,
1826   IN     EFI_GUID         *VendorGuid
1827   )
1828 {
1829   VARIABLE_POINTER_TRACK  CertDbVariable;
1830   EFI_STATUS              Status;
1831   UINT8                   *Data;
1832   UINTN                   DataSize;
1833   UINT32                  VarAttr;
1834   UINT32                  CertNodeOffset;
1835   UINT32                  CertNodeSize;
1836   UINT8                   *NewCertDb;
1837   UINT32                  NewCertDbSize;
1838
1839   if ((VariableName == NULL) || (VendorGuid == NULL)) {
1840     return EFI_INVALID_PARAMETER;
1841   }
1842
1843   //
1844   // Get variable "certdb".
1845   //
1846   Status = FindVariable (
1847              EFI_CERT_DB_NAME,
1848              &gEfiCertDbGuid,
1849              &CertDbVariable,
1850              &mVariableModuleGlobal->VariableGlobal,
1851              FALSE
1852              );
1853   if (EFI_ERROR (Status)) {
1854     return Status;
1855   }
1856
1857   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1858   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1859   if ((DataSize == 0) || (Data == NULL)) {
1860     ASSERT (FALSE);
1861     return EFI_NOT_FOUND;
1862   }
1863
1864   if (DataSize == sizeof (UINT32)) {
1865     //
1866     // There is no certs in certdb.
1867     //
1868     return EFI_SUCCESS;
1869   }
1870
1871   //
1872   // Get corresponding cert node from certdb.
1873   //
1874   Status = FindCertsFromDb (
1875              VariableName,
1876              VendorGuid,
1877              Data,
1878              DataSize,
1879              NULL,
1880              NULL,
1881              &CertNodeOffset,
1882              &CertNodeSize
1883              );
1884
1885   if (EFI_ERROR (Status)) {
1886     return Status;
1887   }
1888
1889   if (DataSize < (CertNodeOffset + CertNodeSize)) {
1890     return EFI_NOT_FOUND;
1891   }
1892
1893   //
1894   // Construct new data content of variable "certdb".
1895   //
1896   NewCertDbSize = (UINT32) DataSize - CertNodeSize;
1897   NewCertDb     = (UINT8*) mCertDbStore;
1898
1899   //
1900   // Copy the DB entries before deleting node.
1901   //
1902   CopyMem (NewCertDb, Data, CertNodeOffset);
1903   //
1904   // Update CertDbListSize.
1905   //
1906   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
1907   //
1908   // Copy the DB entries after deleting node.
1909   //
1910   if (DataSize > (CertNodeOffset + CertNodeSize)) {
1911     CopyMem (
1912       NewCertDb + CertNodeOffset,
1913       Data + CertNodeOffset + CertNodeSize,
1914       DataSize - CertNodeOffset - CertNodeSize
1915       );
1916   }
1917
1918   //
1919   // Set "certdb".
1920   //
1921   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
1922   Status   = UpdateVariable (
1923                EFI_CERT_DB_NAME,
1924                &gEfiCertDbGuid,
1925                NewCertDb,
1926                NewCertDbSize,
1927                VarAttr,
1928                0,
1929                0,
1930                &CertDbVariable,
1931                NULL
1932                );
1933
1934   return Status;
1935 }
1936
1937 /**
1938   Insert signer's certificates for common authenticated variable with VariableName
1939   and VendorGuid in AUTH_CERT_DB_DATA to "certdb".
1940
1941   @param[in]  VariableName   Name of authenticated Variable.
1942   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1943   @param[in]  CertData       Pointer to signer's certificates.
1944   @param[in]  CertDataSize   Length of CertData in bytes.
1945
1946   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1947   @retval  EFI_ACCESS_DENIED     An AUTH_CERT_DB_DATA entry with same VariableName
1948                                  and VendorGuid already exists.
1949   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
1950   @retval  EFI_SUCCESS           Insert an AUTH_CERT_DB_DATA entry to "certdb"
1951
1952 **/
1953 EFI_STATUS
1954 InsertCertsToDb (
1955   IN     CHAR16           *VariableName,
1956   IN     EFI_GUID         *VendorGuid,
1957   IN     UINT8            *CertData,
1958   IN     UINTN            CertDataSize
1959   )
1960 {
1961   VARIABLE_POINTER_TRACK  CertDbVariable;
1962   EFI_STATUS              Status;
1963   UINT8                   *Data;
1964   UINTN                   DataSize;
1965   UINT32                  VarAttr;
1966   UINT8                   *NewCertDb;
1967   UINT32                  NewCertDbSize;
1968   UINT32                  CertNodeSize;
1969   UINT32                  NameSize;
1970   AUTH_CERT_DB_DATA       *Ptr;
1971
1972   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL)) {
1973     return EFI_INVALID_PARAMETER;
1974   }
1975
1976   //
1977   // Get variable "certdb".
1978   //
1979   Status = FindVariable (
1980              EFI_CERT_DB_NAME,
1981              &gEfiCertDbGuid,
1982              &CertDbVariable,
1983              &mVariableModuleGlobal->VariableGlobal,
1984              FALSE
1985              );
1986   if (EFI_ERROR (Status)) {
1987     return Status;
1988   }
1989
1990   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1991   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1992   if ((DataSize == 0) || (Data == NULL)) {
1993     ASSERT (FALSE);
1994     return EFI_NOT_FOUND;
1995   }
1996
1997   //
1998   // Find whether matching cert node already exists in "certdb".
1999   // If yes return error.
2000   //
2001   Status = FindCertsFromDb (
2002              VariableName,
2003              VendorGuid,
2004              Data,
2005              DataSize,
2006              NULL,
2007              NULL,
2008              NULL,
2009              NULL
2010              );
2011
2012   if (!EFI_ERROR (Status)) {
2013     ASSERT (FALSE);
2014     return EFI_ACCESS_DENIED;
2015   }
2016
2017   //
2018   // Construct new data content of variable "certdb".
2019   //
2020   NameSize      = (UINT32) StrLen (VariableName);
2021   CertNodeSize  = sizeof (AUTH_CERT_DB_DATA) + (UINT32) CertDataSize + NameSize * sizeof (CHAR16);
2022   NewCertDbSize = (UINT32) DataSize + CertNodeSize;
2023   if (NewCertDbSize > mMaxCertDbSize) {
2024     return EFI_OUT_OF_RESOURCES;
2025   }
2026   NewCertDb     = (UINT8*) mCertDbStore;
2027
2028   //
2029   // Copy the DB entries before deleting node.
2030   //
2031   CopyMem (NewCertDb, Data, DataSize);
2032   //
2033   // Update CertDbListSize.
2034   //
2035   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
2036   //
2037   // Construct new cert node.
2038   //
2039   Ptr = (AUTH_CERT_DB_DATA *) (NewCertDb + DataSize);
2040   CopyGuid (&Ptr->VendorGuid, VendorGuid);
2041   CopyMem (&Ptr->CertNodeSize, &CertNodeSize, sizeof (UINT32));
2042   CopyMem (&Ptr->NameSize, &NameSize, sizeof (UINT32));
2043   CopyMem (&Ptr->CertDataSize, &CertDataSize, sizeof (UINT32));
2044
2045   CopyMem (
2046     (UINT8 *) Ptr + sizeof (AUTH_CERT_DB_DATA),
2047     VariableName,
2048     NameSize * sizeof (CHAR16)
2049     );
2050
2051   CopyMem (
2052     (UINT8 *) Ptr +  sizeof (AUTH_CERT_DB_DATA) + NameSize * sizeof (CHAR16),
2053     CertData,
2054     CertDataSize
2055     );
2056
2057   //
2058   // Set "certdb".
2059   //
2060   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
2061   Status   = UpdateVariable (
2062                EFI_CERT_DB_NAME,
2063                &gEfiCertDbGuid,
2064                NewCertDb,
2065                NewCertDbSize,
2066                VarAttr,
2067                0,
2068                0,
2069                &CertDbVariable,
2070                NULL
2071                );
2072
2073   return Status;
2074 }
2075
2076 /**
2077   Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
2078
2079   Caution: This function may receive untrusted input.
2080   This function may be invoked in SMM mode, and datasize and data are external input.
2081   This function will do basic validation, before parse the data.
2082   This function will parse the authentication carefully to avoid security issues, like
2083   buffer overflow, integer overflow.
2084
2085   @param[in]  VariableName                Name of Variable to be found.
2086   @param[in]  VendorGuid                  Variable vendor GUID.
2087   @param[in]  Data                        Data pointer.
2088   @param[in]  DataSize                    Size of Data found. If size is less than the
2089                                           data, this value contains the required size.
2090   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
2091   @param[in]  Attributes                  Attribute value of the variable.
2092   @param[in]  AuthVarType                 Verify against PK, KEK database, private database or certificate in data payload.
2093   @param[out] VarDel                      Delete the variable or not.
2094
2095   @retval EFI_INVALID_PARAMETER           Invalid parameter.
2096   @retval EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
2097                                           check carried out by the firmware.
2098   @retval EFI_OUT_OF_RESOURCES            Failed to process variable due to lack
2099                                           of resources.
2100   @retval EFI_SUCCESS                     Variable pass validation successfully.
2101
2102 **/
2103 EFI_STATUS
2104 VerifyTimeBasedPayload (
2105   IN     CHAR16                             *VariableName,
2106   IN     EFI_GUID                           *VendorGuid,
2107   IN     VOID                               *Data,
2108   IN     UINTN                              DataSize,
2109   IN     VARIABLE_POINTER_TRACK             *Variable,
2110   IN     UINT32                             Attributes,
2111   IN     AUTHVAR_TYPE                       AuthVarType,
2112   OUT    BOOLEAN                            *VarDel
2113   )
2114 {
2115   UINT8                            *RootCert;
2116   UINT8                            *SigData;
2117   UINT8                            *PayloadPtr;
2118   UINTN                            RootCertSize;
2119   UINTN                            Index;
2120   UINTN                            CertCount;
2121   UINTN                            PayloadSize;
2122   UINT32                           Attr;
2123   UINT32                           SigDataSize;
2124   UINT32                           KekDataSize;
2125   BOOLEAN                          VerifyStatus;
2126   EFI_STATUS                       Status;
2127   EFI_SIGNATURE_LIST               *CertList;
2128   EFI_SIGNATURE_DATA               *Cert;
2129   VARIABLE_POINTER_TRACK           KekVariable;
2130   EFI_VARIABLE_AUTHENTICATION_2    *CertData;
2131   UINT8                            *NewData;
2132   UINTN                            NewDataSize;
2133   VARIABLE_POINTER_TRACK           PkVariable;
2134   UINT8                            *Buffer;
2135   UINTN                            Length;
2136   UINT8                            *SignerCerts;
2137   UINT8                            *WrapSigData;
2138   UINTN                            CertStackSize;
2139   UINT8                            *CertsInCertDb;
2140   UINT32                           CertsSizeinDb;
2141
2142   VerifyStatus           = FALSE;
2143   CertData               = NULL;
2144   NewData                = NULL;
2145   Attr                   = Attributes;
2146   WrapSigData            = NULL;
2147   SignerCerts            = NULL;
2148   RootCert               = NULL;
2149   CertsInCertDb          = NULL;
2150
2151   //
2152   // When the attribute EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS is
2153   // set, then the Data buffer shall begin with an instance of a complete (and serialized)
2154   // EFI_VARIABLE_AUTHENTICATION_2 descriptor. The descriptor shall be followed by the new
2155   // variable value and DataSize shall reflect the combined size of the descriptor and the new
2156   // variable value. The authentication descriptor is not part of the variable data and is not
2157   // returned by subsequent calls to GetVariable().
2158   //
2159   CertData = (EFI_VARIABLE_AUTHENTICATION_2 *) Data;
2160
2161   //
2162   // Verify that Pad1, Nanosecond, TimeZone, Daylight and Pad2 components of the
2163   // TimeStamp value are set to zero.
2164   //
2165   if ((CertData->TimeStamp.Pad1 != 0) ||
2166       (CertData->TimeStamp.Nanosecond != 0) ||
2167       (CertData->TimeStamp.TimeZone != 0) ||
2168       (CertData->TimeStamp.Daylight != 0) ||
2169       (CertData->TimeStamp.Pad2 != 0)) {
2170     return EFI_SECURITY_VIOLATION;
2171   }
2172
2173   if ((Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
2174     if (CompareTimeStamp (&CertData->TimeStamp, &Variable->CurrPtr->TimeStamp)) {
2175       //
2176       // TimeStamp check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
2177       //
2178       return EFI_SECURITY_VIOLATION;
2179     }
2180   }
2181
2182   //
2183   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
2184   // Cert type should be EFI_CERT_TYPE_PKCS7_GUID.
2185   //
2186   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
2187       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertPkcs7Guid)) {
2188     //
2189     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
2190     //
2191     return EFI_SECURITY_VIOLATION;
2192   }
2193
2194   //
2195   // Find out Pkcs7 SignedData which follows the EFI_VARIABLE_AUTHENTICATION_2 descriptor.
2196   // AuthInfo.Hdr.dwLength is the length of the entire certificate, including the length of the header.
2197   //
2198   SigData = CertData->AuthInfo.CertData;
2199   SigDataSize = CertData->AuthInfo.Hdr.dwLength - (UINT32) (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData));
2200
2201   //
2202   // Find out the new data payload which follows Pkcs7 SignedData directly.
2203   //
2204   PayloadPtr = SigData + SigDataSize;
2205   PayloadSize = DataSize - OFFSET_OF_AUTHINFO2_CERT_DATA - (UINTN) SigDataSize;
2206
2207   //
2208   // Construct a buffer to fill with (VariableName, VendorGuid, Attributes, TimeStamp, Data).
2209   //
2210   NewDataSize = PayloadSize + sizeof (EFI_TIME) + sizeof (UINT32) +
2211                 sizeof (EFI_GUID) + StrSize (VariableName) - sizeof (CHAR16);
2212   NewData = mSerializationRuntimeBuffer;
2213
2214   Buffer = NewData;
2215   Length = StrLen (VariableName) * sizeof (CHAR16);
2216   CopyMem (Buffer, VariableName, Length);
2217   Buffer += Length;
2218
2219   Length = sizeof (EFI_GUID);
2220   CopyMem (Buffer, VendorGuid, Length);
2221   Buffer += Length;
2222
2223   Length = sizeof (UINT32);
2224   CopyMem (Buffer, &Attr, Length);
2225   Buffer += Length;
2226
2227   Length = sizeof (EFI_TIME);
2228   CopyMem (Buffer, &CertData->TimeStamp, Length);
2229   Buffer += Length;
2230
2231   CopyMem (Buffer, PayloadPtr, PayloadSize);
2232
2233   if (AuthVarType == AuthVarTypePk) {
2234     //
2235     // Verify that the signature has been made with the current Platform Key (no chaining for PK).
2236     // First, get signer's certificates from SignedData.
2237     //
2238     VerifyStatus = Pkcs7GetSigners (
2239                      SigData,
2240                      SigDataSize,
2241                      &SignerCerts,
2242                      &CertStackSize,
2243                      &RootCert,
2244                      &RootCertSize
2245                      );
2246     if (!VerifyStatus) {
2247       goto Exit;
2248     }
2249
2250     //
2251     // Second, get the current platform key from variable. Check whether it's identical with signer's certificates
2252     // in SignedData. If not, return error immediately.
2253     //
2254     Status = FindVariable (
2255                EFI_PLATFORM_KEY_NAME,
2256                &gEfiGlobalVariableGuid,
2257                &PkVariable,
2258                &mVariableModuleGlobal->VariableGlobal,
2259                FALSE
2260                );
2261     if (EFI_ERROR (Status)) {
2262       VerifyStatus = FALSE;
2263       goto Exit;
2264     }
2265     CertList = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (PkVariable.CurrPtr);
2266     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2267     if ((RootCertSize != (CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1))) ||
2268         (CompareMem (Cert->SignatureData, RootCert, RootCertSize) != 0)) {
2269       VerifyStatus = FALSE;
2270       goto Exit;
2271     }
2272
2273     //
2274     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2275     //
2276     VerifyStatus = Pkcs7Verify (
2277                      SigData,
2278                      SigDataSize,
2279                      RootCert,
2280                      RootCertSize,
2281                      NewData,
2282                      NewDataSize
2283                      );
2284
2285   } else if (AuthVarType == AuthVarTypeKek) {
2286
2287     //
2288     // Get KEK database from variable.
2289     //
2290     Status = FindVariable (
2291                EFI_KEY_EXCHANGE_KEY_NAME,
2292                &gEfiGlobalVariableGuid,
2293                &KekVariable,
2294                &mVariableModuleGlobal->VariableGlobal,
2295                FALSE
2296                );
2297     if (EFI_ERROR (Status)) {
2298       return Status;
2299     }
2300
2301     //
2302     // Ready to verify Pkcs7 SignedData. Go through KEK Signature Database to find out X.509 CertList.
2303     //
2304     KekDataSize      = KekVariable.CurrPtr->DataSize;
2305     CertList         = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (KekVariable.CurrPtr);
2306     while ((KekDataSize > 0) && (KekDataSize >= CertList->SignatureListSize)) {
2307       if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {
2308         Cert       = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2309         CertCount  = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
2310         for (Index = 0; Index < CertCount; Index++) {
2311           //
2312           // Iterate each Signature Data Node within this CertList for a verify
2313           //
2314           RootCert      = Cert->SignatureData;
2315           RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2316
2317           //
2318           // Verify Pkcs7 SignedData via Pkcs7Verify library.
2319           //
2320           VerifyStatus = Pkcs7Verify (
2321                            SigData,
2322                            SigDataSize,
2323                            RootCert,
2324                            RootCertSize,
2325                            NewData,
2326                            NewDataSize
2327                            );
2328           if (VerifyStatus) {
2329             goto Exit;
2330           }
2331           Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
2332         }
2333       }
2334       KekDataSize -= CertList->SignatureListSize;
2335       CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
2336     }
2337   } else if (AuthVarType == AuthVarTypePriv) {
2338
2339     //
2340     // Process common authenticated variable except PK/KEK/DB/DBX.
2341     // Get signer's certificates from SignedData.
2342     //
2343     VerifyStatus = Pkcs7GetSigners (
2344                      SigData,
2345                      SigDataSize,
2346                      &SignerCerts,
2347                      &CertStackSize,
2348                      &RootCert,
2349                      &RootCertSize
2350                      );
2351     if (!VerifyStatus) {
2352       goto Exit;
2353     }
2354
2355     //
2356     // Get previously stored signer's certificates from certdb for existing
2357     // variable. Check whether they are identical with signer's certificates
2358     // in SignedData. If not, return error immediately.
2359     //
2360     if ((Variable->CurrPtr != NULL)) {
2361       VerifyStatus = FALSE;
2362
2363       Status = GetCertsFromDb (VariableName, VendorGuid, &CertsInCertDb, &CertsSizeinDb);
2364       if (EFI_ERROR (Status)) {
2365         goto Exit;
2366       }
2367
2368       if ((CertStackSize != CertsSizeinDb) ||
2369           (CompareMem (SignerCerts, CertsInCertDb, CertsSizeinDb) != 0)) {
2370         goto Exit;
2371       }
2372     }
2373
2374     VerifyStatus = Pkcs7Verify (
2375                      SigData,
2376                      SigDataSize,
2377                      RootCert,
2378                      RootCertSize,
2379                      NewData,
2380                      NewDataSize
2381                      );
2382     if (!VerifyStatus) {
2383       goto Exit;
2384     }
2385
2386     //
2387     // Delete signer's certificates when delete the common authenticated variable.
2388     //
2389     if ((PayloadSize == 0) && (Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
2390       Status = DeleteCertsFromDb (VariableName, VendorGuid);
2391       if (EFI_ERROR (Status)) {
2392         VerifyStatus = FALSE;
2393         goto Exit;
2394       }
2395     } else if (Variable->CurrPtr == NULL && PayloadSize != 0) {
2396       //
2397       // Insert signer's certificates when adding a new common authenticated variable.
2398       //
2399       Status = InsertCertsToDb (VariableName, VendorGuid, SignerCerts, CertStackSize);
2400       if (EFI_ERROR (Status)) {
2401         VerifyStatus = FALSE;
2402         goto Exit;
2403       }
2404     }
2405   } else if (AuthVarType == AuthVarTypePayload) {
2406     CertList = (EFI_SIGNATURE_LIST *) PayloadPtr;
2407     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2408     RootCert      = Cert->SignatureData;
2409     RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2410
2411     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2412     //
2413     VerifyStatus = Pkcs7Verify (
2414                      SigData,
2415                      SigDataSize,
2416                      RootCert,
2417                      RootCertSize,
2418                      NewData,
2419                      NewDataSize
2420                      );
2421   } else {
2422     return EFI_SECURITY_VIOLATION;
2423   }
2424
2425 Exit:
2426
2427   if (AuthVarType == AuthVarTypePk || AuthVarType == AuthVarTypePriv) {
2428     Pkcs7FreeSigners (RootCert);
2429     Pkcs7FreeSigners (SignerCerts);
2430   }
2431
2432   if (!VerifyStatus) {
2433     return EFI_SECURITY_VIOLATION;
2434   }
2435
2436   Status = CheckSignatureListFormat(VariableName, VendorGuid, PayloadPtr, PayloadSize);
2437   if (EFI_ERROR (Status)) {
2438     return Status;
2439   }
2440
2441   if ((PayloadSize == 0) && (VarDel != NULL)) {
2442     *VarDel = TRUE;
2443   }
2444
2445   //
2446   // Final step: Update/Append Variable if it pass Pkcs7Verify
2447   //
2448   return UpdateVariable (
2449            VariableName,
2450            VendorGuid,
2451            PayloadPtr,
2452            PayloadSize,
2453            Attributes,
2454            0,
2455            0,
2456            Variable,
2457            &CertData->TimeStamp
2458            );
2459 }
2460