SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c

   1 /** @file
   2   Implement authentication services for the authenticated variable
   3   service in UEFI2.2.
   4
   5   Caution: This module requires additional review when modified.
   6   This driver will have external input - variable data. It may be input in SMM mode.
   7   This external input must be validated carefully to avoid security issue like
   8   buffer overflow, integer overflow.
   9   Variable attribute should also be checked to avoid authentication bypass.
  10      The whole SMM authentication variable design relies on the integrity of flash part and SMM.
  11   which is assumed to be protected by platform.  All variable code and metadata in flash/SMM Memory
  12   may not be modified without authorization. If platform fails to protect these resources,
  13   the authentication service provided in this driver will be broken, and the behavior is undefined.
  14
  15   ProcessVarWithPk(), ProcessVarWithKek() and ProcessVariable() are the function to do
  16   variable authentication.
  17
  18   VerifyTimeBasedPayload() and VerifyCounterBasedPayload() are sub function to do verification.
  19   They will do basic validation for authentication data structure, then call crypto library
  20   to verify the signature.
  21
  22 Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>
  23 This program and the accompanying materials
  24 are licensed and made available under the terms and conditions of the BSD License
  25 which accompanies this distribution.  The full text of the license may be found at
  26 http://opensource.org/licenses/bsd-license.php
  27
  28 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  29 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  30
  31 **/
  32
  33 #include "Variable.h"
  34 #include "AuthService.h"
  35
  36 ///
  37 /// Global database array for scratch
  38 ///
  39 UINT8    *mPubKeyStore;
  40 UINT32   mPubKeyNumber;
  41 UINT32   mMaxKeyNumber;
  42 UINT32   mMaxKeyDbSize;
  43 UINT8    *mCertDbStore;
  44 UINT32   mMaxCertDbSize;
  45 UINT32   mPlatformMode;
  46 UINT8    mVendorKeyState;
  47
  48 EFI_GUID mSignatureSupport[] = {EFI_CERT_SHA1_GUID, EFI_CERT_SHA256_GUID, EFI_CERT_RSA2048_GUID, EFI_CERT_X509_GUID};
  49 //
  50 // Public Exponent of RSA Key.
  51 //
  52 CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };
  53 //
  54 // Hash context pointer
  55 //
  56 VOID  *mHashCtx = NULL;
  57
  58 //
  59 // The serialization of the values of the VariableName, VendorGuid and Attributes
  60 // parameters of the SetVariable() call and the TimeStamp component of the
  61 // EFI_VARIABLE_AUTHENTICATION_2 descriptor followed by the variable's new value
  62 // i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data)
  63 //
  64 UINT8 *mSerializationRuntimeBuffer = NULL;
  65
  66 //
  67 // Requirement for different signature type which have been defined in UEFI spec.
  68 // These data are used to peform SignatureList format check while setting PK/KEK variable.
  69 //
  70 EFI_SIGNATURE_ITEM mSupportSigItem[] = {
  71 //{SigType,                       SigHeaderSize,   SigDataSize  }
  72   {EFI_CERT_SHA256_GUID,          0,               32           },
  73   {EFI_CERT_RSA2048_GUID,         0,               256          },
  74   {EFI_CERT_RSA2048_SHA256_GUID,  0,               256          },
  75   {EFI_CERT_SHA1_GUID,            0,               20           },
  76   {EFI_CERT_RSA2048_SHA1_GUID,    0,               256          },
  77   {EFI_CERT_X509_GUID,            0,               ((UINT32) ~0)},
  78   {EFI_CERT_SHA224_GUID,          0,               28           },
  79   {EFI_CERT_SHA384_GUID,          0,               48           },
  80   {EFI_CERT_SHA512_GUID,          0,               64           },
  81   {EFI_CERT_X509_SHA256_GUID,     0,               48           },
  82   {EFI_CERT_X509_SHA384_GUID,     0,               64           },
  83   {EFI_CERT_X509_SHA512_GUID,     0,               80           }
  84 };
  85
  86 /**
  87   Determine whether this operation needs a physical present user.
  88
  89   @param[in]      VariableName            Name of the Variable.
  90   @param[in]      VendorGuid              GUID of the Variable.
  91
  92   @retval TRUE      This variable is protected, only a physical present user could set this variable.
  93   @retval FALSE     This variable is not protected.
  94
  95 **/
  96 BOOLEAN
  97 NeedPhysicallyPresent(
  98   IN     CHAR16         *VariableName,
  99   IN     EFI_GUID       *VendorGuid
 100   )
 101 {
 102   if ((CompareGuid (VendorGuid, &gEfiSecureBootEnableDisableGuid) && (StrCmp (VariableName, EFI_SECURE_BOOT_ENABLE_NAME) == 0))
 103     || (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (VariableName, EFI_CUSTOM_MODE_NAME) == 0))) {
 104     return TRUE;
 105   }
 106
 107   return FALSE;
 108 }
 109
 110 /**
 111   Determine whether the platform is operating in Custom Secure Boot mode.
 112
 113   @retval TRUE           The platform is operating in Custom mode.
 114   @retval FALSE          The platform is operating in Standard mode.
 115
 116 **/
 117 BOOLEAN
 118 InCustomMode (
 119   VOID
 120   )
 121 {
 122   VARIABLE_POINTER_TRACK  Variable;
 123
 124   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 125   if (Variable.CurrPtr != NULL && *(GetVariableDataPtr (Variable.CurrPtr)) == CUSTOM_SECURE_BOOT_MODE) {
 126     return TRUE;
 127   }
 128
 129   return FALSE;
 130 }
 131
 132 /**
 133   Initializes for authenticated varibale service.
 134
 135   @retval EFI_SUCCESS           Function successfully executed.
 136   @retval EFI_OUT_OF_RESOURCES  Fail to allocate enough memory resources.
 137
 138 **/
 139 EFI_STATUS
 140 AutenticatedVariableServiceInitialize (
 141   VOID
 142   )
 143 {
 144   EFI_STATUS              Status;
 145   VARIABLE_POINTER_TRACK  Variable;
 146   VARIABLE_POINTER_TRACK  PkVariable;
 147   UINT8                   VarValue;
 148   UINT32                  VarAttr;
 149   UINT8                   *Data;
 150   UINTN                   DataSize;
 151   UINTN                   CtxSize;
 152   UINT8                   SecureBootMode;
 153   UINT8                   SecureBootEnable;
 154   UINT8                   CustomMode;
 155   UINT32                  ListSize;
 156
 157   //
 158   // Initialize hash context.
 159   //
 160   CtxSize   = Sha256GetContextSize ();
 161   mHashCtx  = AllocateRuntimePool (CtxSize);
 162   if (mHashCtx == NULL) {
 163     return EFI_OUT_OF_RESOURCES;
 164   }
 165
 166   //
 167   // Reserve runtime buffer for public key database. The size excludes variable header and name size.
 168   //
 169   mMaxKeyDbSize = PcdGet32 (PcdMaxVariableSize) - sizeof (VARIABLE_HEADER) - sizeof (AUTHVAR_KEYDB_NAME);
 170   mMaxKeyNumber = mMaxKeyDbSize / EFI_CERT_TYPE_RSA2048_SIZE;
 171   mPubKeyStore  = AllocateRuntimePool (mMaxKeyDbSize);
 172   if (mPubKeyStore == NULL) {
 173     return EFI_OUT_OF_RESOURCES;
 174   }
 175
 176   //
 177   // Reserve runtime buffer for certificate database. The size excludes variable header and name size.
 178   //
 179   mMaxCertDbSize = PcdGet32 (PcdMaxVariableSize) - sizeof (VARIABLE_HEADER) - sizeof (EFI_CERT_DB_NAME);
 180   mCertDbStore   = AllocateRuntimePool (mMaxCertDbSize);
 181   if (mCertDbStore == NULL) {
 182     return EFI_OUT_OF_RESOURCES;
 183   }
 184
 185   //
 186   // Prepare runtime buffer for serialized data of time-based authenticated
 187   // Variable, i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data).
 188   //
 189   mSerializationRuntimeBuffer = AllocateRuntimePool (PcdGet32 (PcdMaxVariableSize) + sizeof (EFI_GUID) + sizeof (UINT32) + sizeof (EFI_TIME));
 190   if (mSerializationRuntimeBuffer == NULL) {
 191     return EFI_OUT_OF_RESOURCES;
 192   }
 193
 194   //
 195   // Check "AuthVarKeyDatabase" variable's existence.
 196   // If it doesn't exist, create a new one with initial value of 0 and EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
 197   //
 198   Status = FindVariable (
 199              AUTHVAR_KEYDB_NAME,
 200              &gEfiAuthenticatedVariableGuid,
 201              &Variable,
 202              &mVariableModuleGlobal->VariableGlobal,
 203              FALSE
 204              );
 205
 206   if (Variable.CurrPtr == NULL) {
 207     VarAttr       = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 208     VarValue      = 0;
 209     mPubKeyNumber = 0;
 210     Status        = UpdateVariable (
 211                       AUTHVAR_KEYDB_NAME,
 212                       &gEfiAuthenticatedVariableGuid,
 213                       &VarValue,
 214                       sizeof(UINT8),
 215                       VarAttr,
 216                       0,
 217                       0,
 218                       &Variable,
 219                       NULL
 220                       );
 221     if (EFI_ERROR (Status)) {
 222       return Status;
 223     }
 224   } else {
 225     //
 226     // Load database in global variable for cache.
 227     //
 228     DataSize  = DataSizeOfVariable (Variable.CurrPtr);
 229     Data      = GetVariableDataPtr (Variable.CurrPtr);
 230     ASSERT ((DataSize != 0) && (Data != NULL));
 231     //
 232     // "AuthVarKeyDatabase" is an internal variable. Its DataSize is always ensured not to exceed mPubKeyStore buffer size(See definition before)
 233     //  Therefore, there is no memory overflow in underlying CopyMem.
 234     //
 235     CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
 236     mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
 237   }
 238
 239   FindVariable (EFI_PLATFORM_KEY_NAME, &gEfiGlobalVariableGuid, &PkVariable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 240   if (PkVariable.CurrPtr == NULL) {
 241     DEBUG ((EFI_D_INFO, "Variable %s does not exist.\n", EFI_PLATFORM_KEY_NAME));
 242   } else {
 243     DEBUG ((EFI_D_INFO, "Variable %s exists.\n", EFI_PLATFORM_KEY_NAME));
 244   }
 245
 246   //
 247   // Create "SetupMode" variable with BS+RT attribute set.
 248   //
 249   FindVariable (EFI_SETUP_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 250   if (PkVariable.CurrPtr == NULL) {
 251     mPlatformMode = SETUP_MODE;
 252   } else {
 253     mPlatformMode = USER_MODE;
 254   }
 255   Status = UpdateVariable (
 256              EFI_SETUP_MODE_NAME,
 257              &gEfiGlobalVariableGuid,
 258              &mPlatformMode,
 259              sizeof(UINT8),
 260              EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 261              0,
 262              0,
 263              &Variable,
 264              NULL
 265              );
 266   if (EFI_ERROR (Status)) {
 267     return Status;
 268   }
 269
 270   //
 271   // Create "SignatureSupport" variable with BS+RT attribute set.
 272   //
 273   FindVariable (EFI_SIGNATURE_SUPPORT_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 274   Status  = UpdateVariable (
 275               EFI_SIGNATURE_SUPPORT_NAME,
 276               &gEfiGlobalVariableGuid,
 277               mSignatureSupport,
 278               sizeof(mSignatureSupport),
 279               EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 280               0,
 281               0,
 282               &Variable,
 283               NULL
 284               );
 285   if (EFI_ERROR (Status)) {
 286     return Status;
 287   }
 288
 289   //
 290   // If "SecureBootEnable" variable exists, then update "SecureBoot" variable.
 291   // If "SecureBootEnable" variable is SECURE_BOOT_ENABLE and in USER_MODE, Set "SecureBoot" variable to SECURE_BOOT_MODE_ENABLE.
 292   // If "SecureBootEnable" variable is SECURE_BOOT_DISABLE, Set "SecureBoot" variable to SECURE_BOOT_MODE_DISABLE.
 293   //
 294   SecureBootEnable = SECURE_BOOT_DISABLE;
 295   FindVariable (EFI_SECURE_BOOT_ENABLE_NAME, &gEfiSecureBootEnableDisableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 296   if (Variable.CurrPtr != NULL) {
 297     SecureBootEnable = *(GetVariableDataPtr (Variable.CurrPtr));
 298   } else if (mPlatformMode == USER_MODE) {
 299     //
 300     // "SecureBootEnable" not exist, initialize it in USER_MODE.
 301     //
 302     SecureBootEnable = SECURE_BOOT_ENABLE;
 303     Status = UpdateVariable (
 304                EFI_SECURE_BOOT_ENABLE_NAME,
 305                &gEfiSecureBootEnableDisableGuid,
 306                &SecureBootEnable,
 307                sizeof (UINT8),
 308                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 309                0,
 310                0,
 311                &Variable,
 312                NULL
 313                );
 314     if (EFI_ERROR (Status)) {
 315       return Status;
 316     }
 317   }
 318
 319   //
 320   // Create "SecureBoot" variable with BS+RT attribute set.
 321   //
 322   if (SecureBootEnable == SECURE_BOOT_ENABLE && mPlatformMode == USER_MODE) {
 323     SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 324   } else {
 325     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 326   }
 327   FindVariable (EFI_SECURE_BOOT_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 328   Status = UpdateVariable (
 329              EFI_SECURE_BOOT_MODE_NAME,
 330              &gEfiGlobalVariableGuid,
 331              &SecureBootMode,
 332              sizeof (UINT8),
 333              EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 334              0,
 335              0,
 336              &Variable,
 337              NULL
 338              );
 339   if (EFI_ERROR (Status)) {
 340     return Status;
 341   }
 342
 343   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SETUP_MODE_NAME, mPlatformMode));
 344   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_MODE_NAME, SecureBootMode));
 345   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_ENABLE_NAME, SecureBootEnable));
 346
 347   //
 348   // Initialize "CustomMode" in STANDARD_SECURE_BOOT_MODE state.
 349   //
 350   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 351   CustomMode = STANDARD_SECURE_BOOT_MODE;
 352   Status = UpdateVariable (
 353              EFI_CUSTOM_MODE_NAME,
 354              &gEfiCustomModeEnableGuid,
 355              &CustomMode,
 356              sizeof (UINT8),
 357              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 358              0,
 359              0,
 360              &Variable,
 361              NULL
 362              );
 363   if (EFI_ERROR (Status)) {
 364     return Status;
 365   }
 366
 367   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_CUSTOM_MODE_NAME, CustomMode));
 368
 369   //
 370   // Check "certdb" variable's existence.
 371   // If it doesn't exist, then create a new one with
 372   // EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.
 373   //
 374   Status = FindVariable (
 375              EFI_CERT_DB_NAME,
 376              &gEfiCertDbGuid,
 377              &Variable,
 378              &mVariableModuleGlobal->VariableGlobal,
 379              FALSE
 380              );
 381
 382   if (Variable.CurrPtr == NULL) {
 383     VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
 384     ListSize = sizeof (UINT32);
 385     Status   = UpdateVariable (
 386                  EFI_CERT_DB_NAME,
 387                  &gEfiCertDbGuid,
 388                  &ListSize,
 389                  sizeof (UINT32),
 390                  VarAttr,
 391                  0,
 392                  0,
 393                  &Variable,
 394                  NULL
 395                  );
 396     if (EFI_ERROR (Status)) {
 397       return Status;
 398     }
 399   }
 400
 401   //
 402   // Check "VendorKeysNv" variable's existence and create "VendorKeys" variable accordingly.
 403   //
 404   FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 405   if (Variable.CurrPtr != NULL) {
 406     mVendorKeyState = *(GetVariableDataPtr (Variable.CurrPtr));
 407   } else {
 408     //
 409     // "VendorKeysNv" not exist, initialize it in VENDOR_KEYS_VALID state.
 410     //
 411     mVendorKeyState = VENDOR_KEYS_VALID;
 412     Status = UpdateVariable (
 413                EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
 414                &gEfiVendorKeysNvGuid,
 415                &mVendorKeyState,
 416                sizeof (UINT8),
 417                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS,
 418                0,
 419                0,
 420                &Variable,
 421                NULL
 422                );
 423     if (EFI_ERROR (Status)) {
 424       return Status;
 425     }
 426   }
 427
 428   //
 429   // Create "VendorKeys" variable with BS+RT attribute set.
 430   //
 431   FindVariable (EFI_VENDOR_KEYS_VARIABLE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 432   Status = UpdateVariable (
 433              EFI_VENDOR_KEYS_VARIABLE_NAME,
 434              &gEfiGlobalVariableGuid,
 435              &mVendorKeyState,
 436              sizeof (UINT8),
 437              EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 438              0,
 439              0,
 440              &Variable,
 441              NULL
 442              );
 443   if (EFI_ERROR (Status)) {
 444     return Status;
 445   }
 446
 447   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_VENDOR_KEYS_VARIABLE_NAME, mVendorKeyState));
 448
 449   return Status;
 450 }
 451
 452 /**
 453   Add public key in store and return its index.
 454
 455   @param[in]  PubKey                  Input pointer to Public Key data
 456   @param[in]  VariableDataEntry       The variable data entry
 457
 458   @return                             Index of new added item
 459
 460 **/
 461 UINT32
 462 AddPubKeyInStore (
 463   IN  UINT8                        *PubKey,
 464   IN  VARIABLE_ENTRY_CONSISTENCY   *VariableDataEntry
 465   )
 466 {
 467   EFI_STATUS                       Status;
 468   BOOLEAN                          IsFound;
 469   UINT32                           Index;
 470   VARIABLE_POINTER_TRACK           Variable;
 471   UINT8                            *Ptr;
 472   UINT8                            *Data;
 473   UINTN                            DataSize;
 474   VARIABLE_ENTRY_CONSISTENCY       PublicKeyEntry;
 475   UINT32                           Attributes;
 476
 477   if (PubKey == NULL) {
 478     return 0;
 479   }
 480
 481   Status = FindVariable (
 482              AUTHVAR_KEYDB_NAME,
 483              &gEfiAuthenticatedVariableGuid,
 484              &Variable,
 485              &mVariableModuleGlobal->VariableGlobal,
 486              FALSE
 487              );
 488   if (EFI_ERROR (Status)) {
 489     DEBUG ((EFI_D_ERROR, "Get public key database variable failure, Status = %r\n", Status));
 490     return 0;
 491   }
 492
 493   //
 494   // Check whether the public key entry does exist.
 495   //
 496   IsFound = FALSE;
 497   for (Ptr = mPubKeyStore, Index = 1; Index <= mPubKeyNumber; Index++) {
 498     if (CompareMem (Ptr, PubKey, EFI_CERT_TYPE_RSA2048_SIZE) == 0) {
 499       IsFound = TRUE;
 500       break;
 501     }
 502     Ptr += EFI_CERT_TYPE_RSA2048_SIZE;
 503   }
 504
 505   if (!IsFound) {
 506     //
 507     // Add public key in database.
 508     //
 509     if (mPubKeyNumber == mMaxKeyNumber) {
 510       //
 511       // Public key dadatase is full, try to reclaim invalid key.
 512       //
 513       if (AtRuntime ()) {
 514         //
 515         // NV storage can't reclaim at runtime.
 516         //
 517         return 0;
 518       }
 519
 520       Status = Reclaim (
 521                  mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase,
 522                  &mVariableModuleGlobal->NonVolatileLastVariableOffset,
 523                  FALSE,
 524                  NULL,
 525                  NULL,
 526                  0,
 527                  TRUE
 528                  );
 529       if (EFI_ERROR (Status)) {
 530         return 0;
 531       }
 532
 533       Status = FindVariable (
 534                  AUTHVAR_KEYDB_NAME,
 535                  &gEfiAuthenticatedVariableGuid,
 536                  &Variable,
 537                  &mVariableModuleGlobal->VariableGlobal,
 538                  FALSE
 539                  );
 540       if (EFI_ERROR (Status)) {
 541         DEBUG ((EFI_D_ERROR, "Get public key database variable failure, Status = %r\n", Status));
 542         return 0;
 543       }
 544
 545       DataSize  = DataSizeOfVariable (Variable.CurrPtr);
 546       Data      = GetVariableDataPtr (Variable.CurrPtr);
 547       ASSERT ((DataSize != 0) && (Data != NULL));
 548       //
 549       // "AuthVarKeyDatabase" is an internal used variable. Its DataSize is always ensured not to exceed mPubKeyStore buffer size(See definition before)
 550       //  Therefore, there is no memory overflow in underlying CopyMem.
 551       //
 552       CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
 553       mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
 554
 555       if (mPubKeyNumber == mMaxKeyNumber) {
 556         return 0;
 557       }
 558     }
 559
 560     //
 561     // Check the variable space for both public key and variable data.
 562     //
 563     PublicKeyEntry.VariableSize = (mPubKeyNumber + 1) * EFI_CERT_TYPE_RSA2048_SIZE;
 564     PublicKeyEntry.Guid         = &gEfiAuthenticatedVariableGuid;
 565     PublicKeyEntry.Name         = AUTHVAR_KEYDB_NAME;
 566     Attributes = VARIABLE_ATTRIBUTE_NV_BS_RT | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 567
 568     if (!CheckRemainingSpaceForConsistency (Attributes, &PublicKeyEntry, VariableDataEntry, NULL)) {
 569       //
 570       // No enough variable space.
 571       //
 572       return 0;
 573     }
 574
 575     CopyMem (mPubKeyStore + mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 576     Index = ++mPubKeyNumber;
 577     //
 578     // Update public key database variable.
 579     //
 580     Status = UpdateVariable (
 581                AUTHVAR_KEYDB_NAME,
 582                &gEfiAuthenticatedVariableGuid,
 583                mPubKeyStore,
 584                mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE,
 585                Attributes,
 586                0,
 587                0,
 588                &Variable,
 589                NULL
 590                );
 591     if (EFI_ERROR (Status)) {
 592       DEBUG ((EFI_D_ERROR, "Update public key database variable failure, Status = %r\n", Status));
 593       return 0;
 594     }
 595   }
 596
 597   return Index;
 598 }
 599
 600 /**
 601   Verify data payload with AuthInfo in EFI_CERT_TYPE_RSA2048_SHA256_GUID type.
 602   Follow the steps in UEFI2.2.
 603
 604   Caution: This function may receive untrusted input.
 605   This function may be invoked in SMM mode, and datasize and data are external input.
 606   This function will do basic validation, before parse the data.
 607   This function will parse the authentication carefully to avoid security issues, like
 608   buffer overflow, integer overflow.
 609
 610   @param[in]      Data                    Pointer to data with AuthInfo.
 611   @param[in]      DataSize                Size of Data.
 612   @param[in]      PubKey                  Public key used for verification.
 613
 614   @retval EFI_INVALID_PARAMETER       Invalid parameter.
 615   @retval EFI_SECURITY_VIOLATION      If authentication failed.
 616   @retval EFI_SUCCESS                 Authentication successful.
 617
 618 **/
 619 EFI_STATUS
 620 VerifyCounterBasedPayload (
 621   IN     UINT8          *Data,
 622   IN     UINTN          DataSize,
 623   IN     UINT8          *PubKey
 624   )
 625 {
 626   BOOLEAN                         Status;
 627   EFI_VARIABLE_AUTHENTICATION     *CertData;
 628   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
 629   UINT8                           Digest[SHA256_DIGEST_SIZE];
 630   VOID                            *Rsa;
 631   UINTN                           PayloadSize;
 632
 633   PayloadSize = DataSize - AUTHINFO_SIZE;
 634   Rsa         = NULL;
 635   CertData    = NULL;
 636   CertBlock   = NULL;
 637
 638   if (Data == NULL || PubKey == NULL) {
 639     return EFI_INVALID_PARAMETER;
 640   }
 641
 642   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
 643   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
 644
 645   //
 646   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
 647   // Cert type should be EFI_CERT_TYPE_RSA2048_SHA256_GUID.
 648   //
 649   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
 650       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertTypeRsa2048Sha256Guid)
 651         ) {
 652     //
 653     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
 654     //
 655     return EFI_SECURITY_VIOLATION;
 656   }
 657   //
 658   // Hash data payload with SHA256.
 659   //
 660   ZeroMem (Digest, SHA256_DIGEST_SIZE);
 661   Status  = Sha256Init (mHashCtx);
 662   if (!Status) {
 663     goto Done;
 664   }
 665   Status  = Sha256Update (mHashCtx, Data + AUTHINFO_SIZE, PayloadSize);
 666   if (!Status) {
 667     goto Done;
 668   }
 669   //
 670   // Hash Size.
 671   //
 672   Status  = Sha256Update (mHashCtx, &PayloadSize, sizeof (UINTN));
 673   if (!Status) {
 674     goto Done;
 675   }
 676   //
 677   // Hash Monotonic Count.
 678   //
 679   Status  = Sha256Update (mHashCtx, &CertData->MonotonicCount, sizeof (UINT64));
 680   if (!Status) {
 681     goto Done;
 682   }
 683   Status  = Sha256Final (mHashCtx, Digest);
 684   if (!Status) {
 685     goto Done;
 686   }
 687   //
 688   // Generate & Initialize RSA Context.
 689   //
 690   Rsa = RsaNew ();
 691   ASSERT (Rsa != NULL);
 692   //
 693   // Set RSA Key Components.
 694   // NOTE: Only N and E are needed to be set as RSA public key for signature verification.
 695   //
 696   Status = RsaSetKey (Rsa, RsaKeyN, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 697   if (!Status) {
 698     goto Done;
 699   }
 700   Status = RsaSetKey (Rsa, RsaKeyE, mRsaE, sizeof (mRsaE));
 701   if (!Status) {
 702     goto Done;
 703   }
 704   //
 705   // Verify the signature.
 706   //
 707   Status = RsaPkcs1Verify (
 708              Rsa,
 709              Digest,
 710              SHA256_DIGEST_SIZE,
 711              CertBlock->Signature,
 712              EFI_CERT_TYPE_RSA2048_SHA256_SIZE
 713              );
 714
 715 Done:
 716   if (Rsa != NULL) {
 717     RsaFree (Rsa);
 718   }
 719   if (Status) {
 720     return EFI_SUCCESS;
 721   } else {
 722     return EFI_SECURITY_VIOLATION;
 723   }
 724 }
 725
 726 /**
 727   Update platform mode.
 728
 729   @param[in]      Mode                    SETUP_MODE or USER_MODE.
 730
 731   @return EFI_INVALID_PARAMETER           Invalid parameter.
 732   @return EFI_SUCCESS                     Update platform mode successfully.
 733
 734 **/
 735 EFI_STATUS
 736 UpdatePlatformMode (
 737   IN  UINT32                    Mode
 738   )
 739 {
 740   EFI_STATUS              Status;
 741   VARIABLE_POINTER_TRACK  Variable;
 742   UINT8                   SecureBootMode;
 743   UINT8                   SecureBootEnable;
 744   UINTN                   VariableDataSize;
 745
 746   Status = FindVariable (
 747              EFI_SETUP_MODE_NAME,
 748              &gEfiGlobalVariableGuid,
 749              &Variable,
 750              &mVariableModuleGlobal->VariableGlobal,
 751              FALSE
 752              );
 753   if (EFI_ERROR (Status)) {
 754     return Status;
 755   }
 756
 757   //
 758   // Update the value of SetupMode variable by a simple mem copy, this could avoid possible
 759   // variable storage reclaim at runtime.
 760   //
 761   mPlatformMode = (UINT8) Mode;
 762   CopyMem (GetVariableDataPtr (Variable.CurrPtr), &mPlatformMode, sizeof(UINT8));
 763
 764   if (AtRuntime ()) {
 765     //
 766     // SecureBoot Variable indicates whether the platform firmware is operating
 767     // in Secure boot mode (1) or not (0), so we should not change SecureBoot
 768     // Variable in runtime.
 769     //
 770     return Status;
 771   }
 772
 773   //
 774   // Check "SecureBoot" variable's existence.
 775   // If it doesn't exist, firmware has no capability to perform driver signing verification,
 776   // then set "SecureBoot" to 0.
 777   //
 778   Status = FindVariable (
 779              EFI_SECURE_BOOT_MODE_NAME,
 780              &gEfiGlobalVariableGuid,
 781              &Variable,
 782              &mVariableModuleGlobal->VariableGlobal,
 783              FALSE
 784              );
 785   //
 786   // If "SecureBoot" variable exists, then check "SetupMode" variable update.
 787   // If "SetupMode" variable is USER_MODE, "SecureBoot" variable is set to 1.
 788   // If "SetupMode" variable is SETUP_MODE, "SecureBoot" variable is set to 0.
 789   //
 790   if (Variable.CurrPtr == NULL) {
 791     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 792   } else {
 793     if (mPlatformMode == USER_MODE) {
 794       SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 795     } else if (mPlatformMode == SETUP_MODE) {
 796       SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 797     } else {
 798       return EFI_NOT_FOUND;
 799     }
 800   }
 801
 802   Status  = UpdateVariable (
 803               EFI_SECURE_BOOT_MODE_NAME,
 804               &gEfiGlobalVariableGuid,
 805               &SecureBootMode,
 806               sizeof(UINT8),
 807               EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 808               0,
 809               0,
 810               &Variable,
 811               NULL
 812               );
 813   if (EFI_ERROR (Status)) {
 814     return Status;
 815   }
 816
 817   //
 818   // Check "SecureBootEnable" variable's existence. It can enable/disable secure boot feature.
 819   //
 820   Status = FindVariable (
 821              EFI_SECURE_BOOT_ENABLE_NAME,
 822              &gEfiSecureBootEnableDisableGuid,
 823              &Variable,
 824              &mVariableModuleGlobal->VariableGlobal,
 825              FALSE
 826              );
 827
 828   if (SecureBootMode == SECURE_BOOT_MODE_ENABLE) {
 829     //
 830     // Create the "SecureBootEnable" variable as secure boot is enabled.
 831     //
 832     SecureBootEnable = SECURE_BOOT_ENABLE;
 833     VariableDataSize = sizeof (SecureBootEnable);
 834   } else {
 835     //
 836     // Delete the "SecureBootEnable" variable if this variable exist as "SecureBoot"
 837     // variable is not in secure boot state.
 838     //
 839     if (Variable.CurrPtr == NULL || EFI_ERROR (Status)) {
 840       return EFI_SUCCESS;
 841     }
 842     SecureBootEnable = SECURE_BOOT_DISABLE;
 843     VariableDataSize = 0;
 844   }
 845
 846   Status = UpdateVariable (
 847              EFI_SECURE_BOOT_ENABLE_NAME,
 848              &gEfiSecureBootEnableDisableGuid,
 849              &SecureBootEnable,
 850              VariableDataSize,
 851              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 852              0,
 853              0,
 854              &Variable,
 855              NULL
 856              );
 857   return Status;
 858 }
 859
 860 /**
 861   Check input data form to make sure it is a valid EFI_SIGNATURE_LIST for PK/KEK/db/dbx/dbt variable.
 862
 863   @param[in]  VariableName                Name of Variable to be check.
 864   @param[in]  VendorGuid                  Variable vendor GUID.
 865   @param[in]  Data                        Point to the variable data to be checked.
 866   @param[in]  DataSize                    Size of Data.
 867
 868   @return EFI_INVALID_PARAMETER           Invalid signature list format.
 869   @return EFI_SUCCESS                     Passed signature list format check successfully.
 870
 871 **/
 872 EFI_STATUS
 873 CheckSignatureListFormat(
 874   IN  CHAR16                    *VariableName,
 875   IN  EFI_GUID                  *VendorGuid,
 876   IN  VOID                      *Data,
 877   IN  UINTN                     DataSize
 878   )
 879 {
 880   EFI_SIGNATURE_LIST     *SigList;
 881   UINTN                  SigDataSize;
 882   UINT32                 Index;
 883   UINT32                 SigCount;
 884   BOOLEAN                IsPk;
 885   VOID                   *RsaContext;
 886   EFI_SIGNATURE_DATA     *CertData;
 887   UINTN                  CertLen;
 888
 889   if (DataSize == 0) {
 890     return EFI_SUCCESS;
 891   }
 892
 893   ASSERT (VariableName != NULL && VendorGuid != NULL && Data != NULL);
 894
 895   if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_PLATFORM_KEY_NAME) == 0)){
 896     IsPk = TRUE;
 897   } else if ((CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0)) ||
 898              (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&
 899              ((StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0) || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0) ||
 900               (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0)))) {
 901     IsPk = FALSE;
 902   } else {
 903     return EFI_SUCCESS;
 904   }
 905
 906   SigCount = 0;
 907   SigList  = (EFI_SIGNATURE_LIST *) Data;
 908   SigDataSize  = DataSize;
 909   RsaContext = NULL;
 910
 911   //
 912   // Walk throuth the input signature list and check the data format.
 913   // If any signature is incorrectly formed, the whole check will fail.
 914   //
 915   while ((SigDataSize > 0) && (SigDataSize >= SigList->SignatureListSize)) {
 916     for (Index = 0; Index < (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM)); Index++ ) {
 917       if (CompareGuid (&SigList->SignatureType, &mSupportSigItem[Index].SigType)) {
 918         //
 919         // The value of SignatureSize should always be 16 (size of SignatureOwner
 920         // component) add the data length according to signature type.
 921         //
 922         if (mSupportSigItem[Index].SigDataSize != ((UINT32) ~0) &&
 923           (SigList->SignatureSize - sizeof (EFI_GUID)) != mSupportSigItem[Index].SigDataSize) {
 924           return EFI_INVALID_PARAMETER;
 925         }
 926         if (mSupportSigItem[Index].SigHeaderSize != ((UINTN) ~0) &&
 927           SigList->SignatureHeaderSize != mSupportSigItem[Index].SigHeaderSize) {
 928           return EFI_INVALID_PARAMETER;
 929         }
 930         break;
 931       }
 932     }
 933
 934     if (Index == (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM))) {
 935       //
 936       // Undefined signature type.
 937       //
 938       return EFI_INVALID_PARAMETER;
 939     }
 940
 941     if (CompareGuid (&SigList->SignatureType, &gEfiCertX509Guid)) {
 942       //
 943       // Try to retrieve the RSA public key from the X.509 certificate.
 944       // If this operation fails, it's not a valid certificate.
 945       //
 946       RsaContext = RsaNew ();
 947       if (RsaContext == NULL) {
 948         return EFI_INVALID_PARAMETER;
 949       }
 950       CertData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigList + sizeof (EFI_SIGNATURE_LIST) + SigList->SignatureHeaderSize);
 951       CertLen = SigList->SignatureSize - sizeof (EFI_GUID);
 952       if (!RsaGetPublicKeyFromX509 (CertData->SignatureData, CertLen, &RsaContext)) {
 953         RsaFree (RsaContext);
 954         return EFI_INVALID_PARAMETER;
 955       }
 956       RsaFree (RsaContext);
 957     }
 958
 959     if ((SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) % SigList->SignatureSize != 0) {
 960       return EFI_INVALID_PARAMETER;
 961     }
 962     SigCount += (SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) / SigList->SignatureSize;
 963
 964     SigDataSize -= SigList->SignatureListSize;
 965     SigList = (EFI_SIGNATURE_LIST *) ((UINT8 *) SigList + SigList->SignatureListSize);
 966   }
 967
 968   if (((UINTN) SigList - (UINTN) Data) != DataSize) {
 969     return EFI_INVALID_PARAMETER;
 970   }
 971
 972   if (IsPk && SigCount > 1) {
 973     return EFI_INVALID_PARAMETER;
 974   }
 975
 976   return EFI_SUCCESS;
 977 }
 978
 979 /**
 980   Update "VendorKeys" variable to record the out of band secure boot key modification.
 981
 982   @return EFI_SUCCESS           Variable is updated successfully.
 983   @return Others                Failed to update variable.
 984
 985 **/
 986 EFI_STATUS
 987 VendorKeyIsModified (
 988   VOID
 989   )
 990 {
 991   EFI_STATUS              Status;
 992   VARIABLE_POINTER_TRACK  Variable;
 993
 994   if (mVendorKeyState == VENDOR_KEYS_MODIFIED) {
 995     return EFI_SUCCESS;
 996   }
 997   mVendorKeyState = VENDOR_KEYS_MODIFIED;
 998
 999   FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
1000   Status = UpdateVariable (
1001              EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
1002              &gEfiVendorKeysNvGuid,
1003              &mVendorKeyState,
1004              sizeof (UINT8),
1005              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS,
1006              0,
1007              0,
1008              &Variable,
1009              NULL
1010              );
1011   if (EFI_ERROR (Status)) {
1012     return Status;
1013   }
1014
1015   FindVariable (EFI_VENDOR_KEYS_VARIABLE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
1016   return UpdateVariable (
1017            EFI_VENDOR_KEYS_VARIABLE_NAME,
1018            &gEfiGlobalVariableGuid,
1019            &mVendorKeyState,
1020            sizeof (UINT8),
1021            EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
1022            0,
1023            0,
1024            &Variable,
1025            NULL
1026            );
1027 }
1028
1029 /**
1030   Process variable with platform key for verification.
1031
1032   Caution: This function may receive untrusted input.
1033   This function may be invoked in SMM mode, and datasize and data are external input.
1034   This function will do basic validation, before parse the data.
1035   This function will parse the authentication carefully to avoid security issues, like
1036   buffer overflow, integer overflow.
1037   This function will check attribute carefully to avoid authentication bypass.
1038
1039   @param[in]  VariableName                Name of Variable to be found.
1040   @param[in]  VendorGuid                  Variable vendor GUID.
1041   @param[in]  Data                        Data pointer.
1042   @param[in]  DataSize                    Size of Data found. If size is less than the
1043                                           data, this value contains the required size.
1044   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1045   @param[in]  Attributes                  Attribute value of the variable
1046   @param[in]  IsPk                        Indicate whether it is to process pk.
1047
1048   @return EFI_INVALID_PARAMETER           Invalid parameter.
1049   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation.
1050                                           check carried out by the firmware.
1051   @return EFI_SUCCESS                     Variable passed validation successfully.
1052
1053 **/
1054 EFI_STATUS
1055 ProcessVarWithPk (
1056   IN  CHAR16                    *VariableName,
1057   IN  EFI_GUID                  *VendorGuid,
1058   IN  VOID                      *Data,
1059   IN  UINTN                     DataSize,
1060   IN  VARIABLE_POINTER_TRACK    *Variable,
1061   IN  UINT32                    Attributes OPTIONAL,
1062   IN  BOOLEAN                   IsPk
1063   )
1064 {
1065   EFI_STATUS                  Status;
1066   BOOLEAN                     Del;
1067   UINT8                       *Payload;
1068   UINTN                       PayloadSize;
1069
1070   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1071       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1072     //
1073     // PK, KEK and db/dbx/dbt should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1074     // authenticated variable.
1075     //
1076     return EFI_INVALID_PARAMETER;
1077   }
1078
1079   Del = FALSE;
1080   if ((InCustomMode() && UserPhysicalPresent()) || (mPlatformMode == SETUP_MODE && !IsPk)) {
1081     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1082     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1083     if (PayloadSize == 0) {
1084       Del = TRUE;
1085     }
1086
1087     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
1088     if (EFI_ERROR (Status)) {
1089       return Status;
1090     }
1091
1092     Status = UpdateVariable (
1093                VariableName,
1094                VendorGuid,
1095                Payload,
1096                PayloadSize,
1097                Attributes,
1098                0,
1099                0,
1100                Variable,
1101                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1102                );
1103     if (EFI_ERROR(Status)) {
1104       return Status;
1105     }
1106
1107     if ((mPlatformMode != SETUP_MODE) || IsPk) {
1108       Status = VendorKeyIsModified ();
1109     }
1110   } else if (mPlatformMode == USER_MODE) {
1111     //
1112     // Verify against X509 Cert in PK database.
1113     //
1114     Status = VerifyTimeBasedPayload (
1115                VariableName,
1116                VendorGuid,
1117                Data,
1118                DataSize,
1119                Variable,
1120                Attributes,
1121                AuthVarTypePk,
1122                &Del
1123                );
1124   } else {
1125     //
1126     // Verify against the certificate in data payload.
1127     //
1128     Status = VerifyTimeBasedPayload (
1129                VariableName,
1130                VendorGuid,
1131                Data,
1132                DataSize,
1133                Variable,
1134                Attributes,
1135                AuthVarTypePayload,
1136                &Del
1137                );
1138   }
1139
1140   if (!EFI_ERROR(Status) && IsPk) {
1141     if (mPlatformMode == SETUP_MODE && !Del) {
1142       //
1143       // If enroll PK in setup mode, need change to user mode.
1144       //
1145       Status = UpdatePlatformMode (USER_MODE);
1146     } else if (mPlatformMode == USER_MODE && Del){
1147       //
1148       // If delete PK in user mode, need change to setup mode.
1149       //
1150       Status = UpdatePlatformMode (SETUP_MODE);
1151     }
1152   }
1153
1154   return Status;
1155 }
1156
1157 /**
1158   Process variable with key exchange key for verification.
1159
1160   Caution: This function may receive untrusted input.
1161   This function may be invoked in SMM mode, and datasize and data are external input.
1162   This function will do basic validation, before parse the data.
1163   This function will parse the authentication carefully to avoid security issues, like
1164   buffer overflow, integer overflow.
1165   This function will check attribute carefully to avoid authentication bypass.
1166
1167   @param[in]  VariableName                Name of Variable to be found.
1168   @param[in]  VendorGuid                  Variable vendor GUID.
1169   @param[in]  Data                        Data pointer.
1170   @param[in]  DataSize                    Size of Data found. If size is less than the
1171                                           data, this value contains the required size.
1172   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1173   @param[in]  Attributes                  Attribute value of the variable.
1174
1175   @return EFI_INVALID_PARAMETER           Invalid parameter.
1176   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
1177                                           check carried out by the firmware.
1178   @return EFI_SUCCESS                     Variable pass validation successfully.
1179
1180 **/
1181 EFI_STATUS
1182 ProcessVarWithKek (
1183   IN  CHAR16                               *VariableName,
1184   IN  EFI_GUID                             *VendorGuid,
1185   IN  VOID                                 *Data,
1186   IN  UINTN                                DataSize,
1187   IN  VARIABLE_POINTER_TRACK               *Variable,
1188   IN  UINT32                               Attributes OPTIONAL
1189   )
1190 {
1191   EFI_STATUS                      Status;
1192   UINT8                           *Payload;
1193   UINTN                           PayloadSize;
1194
1195   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1196       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1197     //
1198     // DB, DBX and DBT should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1199     // authenticated variable.
1200     //
1201     return EFI_INVALID_PARAMETER;
1202   }
1203
1204   Status = EFI_SUCCESS;
1205   if (mPlatformMode == USER_MODE && !(InCustomMode() && UserPhysicalPresent())) {
1206     //
1207     // Time-based, verify against X509 Cert KEK.
1208     //
1209     return VerifyTimeBasedPayload (
1210              VariableName,
1211              VendorGuid,
1212              Data,
1213              DataSize,
1214              Variable,
1215              Attributes,
1216              AuthVarTypeKek,
1217              NULL
1218              );
1219   } else {
1220     //
1221     // If in setup mode or custom secure boot mode, no authentication needed.
1222     //
1223     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1224     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1225
1226     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
1227     if (EFI_ERROR (Status)) {
1228       return Status;
1229     }
1230
1231     Status = UpdateVariable (
1232                VariableName,
1233                VendorGuid,
1234                Payload,
1235                PayloadSize,
1236                Attributes,
1237                0,
1238                0,
1239                Variable,
1240                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1241                );
1242     if (EFI_ERROR (Status)) {
1243       return Status;
1244     }
1245
1246     if (mPlatformMode != SETUP_MODE) {
1247       Status = VendorKeyIsModified ();
1248     }
1249   }
1250
1251   return Status;
1252 }
1253
1254 /**
1255   Check if it is to delete auth variable.
1256
1257   @param[in] Data               Data pointer.
1258   @param[in] DataSize           Size of Data.
1259   @param[in] Variable           The variable information which is used to keep track of variable usage.
1260   @param[in] Attributes         Attribute value of the variable.
1261
1262   @retval TRUE                  It is to delete auth variable.
1263   @retval FALSE                 It is not to delete auth variable.
1264
1265 **/
1266 BOOLEAN
1267 IsDeleteAuthVariable (
1268   IN  VOID                      *Data,
1269   IN  UINTN                     DataSize,
1270   IN  VARIABLE_POINTER_TRACK    *Variable,
1271   IN  UINT32                    Attributes
1272   )
1273 {
1274   BOOLEAN                       Del;
1275   UINT8                         *Payload;
1276   UINTN                         PayloadSize;
1277
1278   Del = FALSE;
1279
1280   //
1281   // To delete a variable created with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
1282   // or the EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS attribute,
1283   // SetVariable must be used with attributes matching the existing variable
1284   // and the DataSize set to the size of the AuthInfo descriptor.
1285   //
1286   if ((Variable->CurrPtr != NULL) &&
1287       (Attributes == Variable->CurrPtr->Attributes) &&
1288       ((Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)) {
1289     if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1290       Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1291       PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1292       if (PayloadSize == 0) {
1293         Del = TRUE;
1294       }
1295     } else {
1296       Payload = (UINT8 *) Data + AUTHINFO_SIZE;
1297       PayloadSize = DataSize - AUTHINFO_SIZE;
1298       if (PayloadSize == 0) {
1299         Del = TRUE;
1300       }
1301     }
1302   }
1303
1304   return Del;
1305 }
1306
1307 /**
1308   Process variable with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS/EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
1309
1310   Caution: This function may receive untrusted input.
1311   This function may be invoked in SMM mode, and datasize and data are external input.
1312   This function will do basic validation, before parse the data.
1313   This function will parse the authentication carefully to avoid security issues, like
1314   buffer overflow, integer overflow.
1315   This function will check attribute carefully to avoid authentication bypass.
1316
1317   @param[in]  VariableName                Name of Variable to be found.
1318   @param[in]  VendorGuid                  Variable vendor GUID.
1319
1320   @param[in]  Data                        Data pointer.
1321   @param[in]  DataSize                    Size of Data.
1322   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1323   @param[in]  Attributes                  Attribute value of the variable.
1324
1325   @return EFI_INVALID_PARAMETER           Invalid parameter.
1326   @return EFI_WRITE_PROTECTED             Variable is write-protected and needs authentication with
1327                                           EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1328   @return EFI_OUT_OF_RESOURCES            The Database to save the public key is full.
1329   @return EFI_SECURITY_VIOLATION          The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
1330                                           set, but the AuthInfo does NOT pass the validation
1331                                           check carried out by the firmware.
1332   @return EFI_SUCCESS                     Variable is not write-protected or pass validation successfully.
1333
1334 **/
1335 EFI_STATUS
1336 ProcessVariable (
1337   IN     CHAR16                             *VariableName,
1338   IN     EFI_GUID                           *VendorGuid,
1339   IN     VOID                               *Data,
1340   IN     UINTN                              DataSize,
1341   IN     VARIABLE_POINTER_TRACK             *Variable,
1342   IN     UINT32                             Attributes
1343   )
1344 {
1345   EFI_STATUS                      Status;
1346   BOOLEAN                         IsDeletion;
1347   BOOLEAN                         IsFirstTime;
1348   UINT8                           *PubKey;
1349   EFI_VARIABLE_AUTHENTICATION     *CertData;
1350   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
1351   UINT32                          KeyIndex;
1352   UINT64                          MonotonicCount;
1353   VARIABLE_ENTRY_CONSISTENCY      VariableDataEntry;
1354
1355   KeyIndex    = 0;
1356   CertData    = NULL;
1357   CertBlock   = NULL;
1358   PubKey      = NULL;
1359   IsDeletion  = FALSE;
1360   Status      = EFI_SUCCESS;
1361
1362   if (UserPhysicalPresent()) {
1363     //
1364     // Allow the delete operation of common authenticated variable at user physical presence.
1365     //
1366     if (IsDeleteAuthVariable (Data, DataSize, Variable, Attributes)) {
1367       if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1368         Status = DeleteCertsFromDb (VariableName, VendorGuid);
1369       }
1370       if (!EFI_ERROR (Status)) {
1371         Status = UpdateVariable (
1372                    VariableName,
1373                    VendorGuid,
1374                    NULL,
1375                    0,
1376                    0,
1377                    0,
1378                    0,
1379                    Variable,
1380                    NULL
1381                    );
1382       }
1383       return Status;
1384     }
1385   } else {
1386     if (NeedPhysicallyPresent(VariableName, VendorGuid)) {
1387       //
1388       // This variable is protected, only physical present user could modify its value.
1389       //
1390       return EFI_SECURITY_VIOLATION;
1391     }
1392   }
1393
1394   //
1395   // A time-based authenticated variable and a count-based authenticated variable
1396   // can't be updated by each other.
1397   //
1398   if (Variable->CurrPtr != NULL) {
1399     if (((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) &&
1400         ((Variable->CurrPtr->Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0)) {
1401       return EFI_SECURITY_VIOLATION;
1402     }
1403
1404     if (((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) &&
1405         ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0)) {
1406       return EFI_SECURITY_VIOLATION;
1407     }
1408   }
1409
1410   //
1411   // Process Time-based Authenticated variable.
1412   //
1413   if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1414     return VerifyTimeBasedPayload (
1415              VariableName,
1416              VendorGuid,
1417              Data,
1418              DataSize,
1419              Variable,
1420              Attributes,
1421              AuthVarTypePriv,
1422              NULL
1423              );
1424   }
1425
1426   //
1427   // Determine if first time SetVariable with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS.
1428   //
1429   if ((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) {
1430     //
1431     // Determine current operation type.
1432     //
1433     if (DataSize == AUTHINFO_SIZE) {
1434       IsDeletion = TRUE;
1435     }
1436     //
1437     // Determine whether this is the first time with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1438     //
1439     if (Variable->CurrPtr == NULL) {
1440       IsFirstTime = TRUE;
1441     } else if ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) == 0) {
1442       IsFirstTime = TRUE;
1443     } else {
1444       KeyIndex   = Variable->CurrPtr->PubKeyIndex;
1445       IsFirstTime = FALSE;
1446     }
1447   } else if ((Variable->CurrPtr != NULL) &&
1448              ((Variable->CurrPtr->Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)
1449             ) {
1450     //
1451     // If the variable is already write-protected, it always needs authentication before update.
1452     //
1453     return EFI_WRITE_PROTECTED;
1454   } else {
1455     //
1456     // If without EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS, set and attributes collision.
1457     // That means it is not authenticated variable, just update variable as usual.
1458     //
1459     Status = UpdateVariable (VariableName, VendorGuid, Data, DataSize, Attributes, 0, 0, Variable, NULL);
1460     return Status;
1461   }
1462
1463   //
1464   // Get PubKey and check Monotonic Count value corresponding to the variable.
1465   //
1466   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
1467   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
1468   PubKey    = CertBlock->PublicKey;
1469
1470   //
1471   // Update Monotonic Count value.
1472   //
1473   MonotonicCount = CertData->MonotonicCount;
1474
1475   if (!IsFirstTime) {
1476     //
1477     // 2 cases need to check here
1478     //   1. Internal PubKey variable. PubKeyIndex is always 0
1479     //   2. Other counter-based AuthVariable. Check input PubKey.
1480     //
1481     if (KeyIndex == 0 || CompareMem (PubKey, mPubKeyStore + (KeyIndex - 1) * EFI_CERT_TYPE_RSA2048_SIZE, EFI_CERT_TYPE_RSA2048_SIZE) != 0) {
1482       return EFI_SECURITY_VIOLATION;
1483     }
1484     //
1485     // Compare the current monotonic count and ensure that it is greater than the last SetVariable
1486     // operation with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS attribute set.
1487     //
1488     if (CertData->MonotonicCount <= Variable->CurrPtr->MonotonicCount) {
1489       //
1490       // Monotonic count check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
1491       //
1492       return EFI_SECURITY_VIOLATION;
1493     }
1494   }
1495   //
1496   // Verify the certificate in Data payload.
1497   //
1498   Status = VerifyCounterBasedPayload (Data, DataSize, PubKey);
1499   if (EFI_ERROR (Status)) {
1500     return Status;
1501   }
1502
1503   //
1504   // Now, the signature has been verified!
1505   //
1506   if (IsFirstTime && !IsDeletion) {
1507     VariableDataEntry.VariableSize = DataSize - AUTHINFO_SIZE;
1508     VariableDataEntry.Guid         = VendorGuid;
1509     VariableDataEntry.Name         = VariableName;
1510
1511     //
1512     // Update public key database variable if need.
1513     //
1514     KeyIndex = AddPubKeyInStore (PubKey, &VariableDataEntry);
1515     if (KeyIndex == 0) {
1516       return EFI_OUT_OF_RESOURCES;
1517     }
1518   }
1519
1520   //
1521   // Verification pass.
1522   //
1523   return UpdateVariable (VariableName, VendorGuid, (UINT8*)Data + AUTHINFO_SIZE, DataSize - AUTHINFO_SIZE, Attributes, KeyIndex, MonotonicCount, Variable, NULL);
1524 }
1525
1526 /**
1527   Merge two buffers which formatted as EFI_SIGNATURE_LIST. Only the new EFI_SIGNATURE_DATA
1528   will be appended to the original EFI_SIGNATURE_LIST, duplicate EFI_SIGNATURE_DATA
1529   will be ignored.
1530
1531   @param[in, out]  Data              Pointer to original EFI_SIGNATURE_LIST.
1532   @param[in]       DataSize          Size of Data buffer.
1533   @param[in]       FreeBufSize       Size of free data buffer
1534   @param[in]       NewData           Pointer to new EFI_SIGNATURE_LIST to be appended.
1535   @param[in]       NewDataSize       Size of NewData buffer.
1536   @param[out]      MergedBufSize     Size of the merged buffer
1537
1538   @return EFI_BUFFER_TOO_SMALL if input Data buffer overflowed
1539
1540 **/
1541 EFI_STATUS
1542 AppendSignatureList (
1543   IN  OUT VOID            *Data,
1544   IN  UINTN               DataSize,
1545   IN  UINTN               FreeBufSize,
1546   IN  VOID                *NewData,
1547   IN  UINTN               NewDataSize,
1548   OUT UINTN               *MergedBufSize
1549   )
1550 {
1551   EFI_SIGNATURE_LIST  *CertList;
1552   EFI_SIGNATURE_DATA  *Cert;
1553   UINTN               CertCount;
1554   EFI_SIGNATURE_LIST  *NewCertList;
1555   EFI_SIGNATURE_DATA  *NewCert;
1556   UINTN               NewCertCount;
1557   UINTN               Index;
1558   UINTN               Index2;
1559   UINTN               Size;
1560   UINT8               *Tail;
1561   UINTN               CopiedCount;
1562   UINTN               SignatureListSize;
1563   BOOLEAN             IsNewCert;
1564
1565   Tail = (UINT8 *) Data + DataSize;
1566
1567   NewCertList = (EFI_SIGNATURE_LIST *) NewData;
1568   while ((NewDataSize > 0) && (NewDataSize >= NewCertList->SignatureListSize)) {
1569     NewCert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCertList + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1570     NewCertCount = (NewCertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - NewCertList->SignatureHeaderSize) / NewCertList->SignatureSize;
1571
1572     CopiedCount = 0;
1573     for (Index = 0; Index < NewCertCount; Index++) {
1574       IsNewCert = TRUE;
1575
1576       Size = DataSize;
1577       CertList = (EFI_SIGNATURE_LIST *) Data;
1578       while ((Size > 0) && (Size >= CertList->SignatureListSize)) {
1579         if (CompareGuid (&CertList->SignatureType, &NewCertList->SignatureType) &&
1580            (CertList->SignatureSize == NewCertList->SignatureSize)) {
1581           Cert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
1582           CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
1583           for (Index2 = 0; Index2 < CertCount; Index2++) {
1584             //
1585             // Iterate each Signature Data in this Signature List.
1586             //
1587             if (CompareMem (NewCert, Cert, CertList->SignatureSize) == 0) {
1588               IsNewCert = FALSE;
1589               break;
1590             }
1591             Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
1592           }
1593         }
1594
1595         if (!IsNewCert) {
1596           break;
1597         }
1598         Size -= CertList->SignatureListSize;
1599         CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
1600       }
1601
1602       if (IsNewCert) {
1603         //
1604         // New EFI_SIGNATURE_DATA, append it.
1605         //
1606         if (CopiedCount == 0) {
1607           if (FreeBufSize < sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize) {
1608             return EFI_BUFFER_TOO_SMALL;
1609           }
1610
1611           //
1612           // Copy EFI_SIGNATURE_LIST header for only once.
1613           //
1614
1615           CopyMem (Tail, NewCertList, sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1616           Tail = Tail + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1617           FreeBufSize -= sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1618         }
1619
1620         if (FreeBufSize < NewCertList->SignatureSize) {
1621           return EFI_BUFFER_TOO_SMALL;
1622         }
1623         CopyMem (Tail, NewCert, NewCertList->SignatureSize);
1624         Tail += NewCertList->SignatureSize;
1625         FreeBufSize -= NewCertList->SignatureSize;
1626         CopiedCount++;
1627       }
1628
1629       NewCert = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCert + NewCertList->SignatureSize);
1630     }
1631
1632     //
1633     // Update SignatureListSize in newly appended EFI_SIGNATURE_LIST.
1634     //
1635     if (CopiedCount != 0) {
1636       SignatureListSize = sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize + (CopiedCount * NewCertList->SignatureSize);
1637       CertList = (EFI_SIGNATURE_LIST *) (Tail - SignatureListSize);
1638       CertList->SignatureListSize = (UINT32) SignatureListSize;
1639     }
1640
1641     NewDataSize -= NewCertList->SignatureListSize;
1642     NewCertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) NewCertList + NewCertList->SignatureListSize);
1643   }
1644
1645   *MergedBufSize = (Tail - (UINT8 *) Data);
1646   return EFI_SUCCESS;
1647 }
1648
1649 /**
1650   Compare two EFI_TIME data.
1651
1652
1653   @param FirstTime           A pointer to the first EFI_TIME data.
1654   @param SecondTime          A pointer to the second EFI_TIME data.
1655
1656   @retval  TRUE              The FirstTime is not later than the SecondTime.
1657   @retval  FALSE             The FirstTime is later than the SecondTime.
1658
1659 **/
1660 BOOLEAN
1661 CompareTimeStamp (
1662   IN EFI_TIME               *FirstTime,
1663   IN EFI_TIME               *SecondTime
1664   )
1665 {
1666   if (FirstTime->Year != SecondTime->Year) {
1667     return (BOOLEAN) (FirstTime->Year < SecondTime->Year);
1668   } else if (FirstTime->Month != SecondTime->Month) {
1669     return (BOOLEAN) (FirstTime->Month < SecondTime->Month);
1670   } else if (FirstTime->Day != SecondTime->Day) {
1671     return (BOOLEAN) (FirstTime->Day < SecondTime->Day);
1672   } else if (FirstTime->Hour != SecondTime->Hour) {
1673     return (BOOLEAN) (FirstTime->Hour < SecondTime->Hour);
1674   } else if (FirstTime->Minute != SecondTime->Minute) {
1675     return (BOOLEAN) (FirstTime->Minute < SecondTime->Minute);
1676   }
1677
1678   return (BOOLEAN) (FirstTime->Second <= SecondTime->Second);
1679 }
1680
1681 /**
1682   Find matching signer's certificates for common authenticated variable
1683   by corresponding VariableName and VendorGuid from "certdb".
1684
1685   The data format of "certdb":
1686   //
1687   //     UINT32 CertDbListSize;
1688   // /// AUTH_CERT_DB_DATA Certs1[];
1689   // /// AUTH_CERT_DB_DATA Certs2[];
1690   // /// ...
1691   // /// AUTH_CERT_DB_DATA Certsn[];
1692   //
1693
1694   @param[in]  VariableName   Name of authenticated Variable.
1695   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1696   @param[in]  Data           Pointer to variable "certdb".
1697   @param[in]  DataSize       Size of variable "certdb".
1698   @param[out] CertOffset     Offset of matching CertData, from starting of Data.
1699   @param[out] CertDataSize   Length of CertData in bytes.
1700   @param[out] CertNodeOffset Offset of matching AUTH_CERT_DB_DATA , from
1701                              starting of Data.
1702   @param[out] CertNodeSize   Length of AUTH_CERT_DB_DATA in bytes.
1703
1704   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1705   @retval  EFI_NOT_FOUND         Fail to find matching certs.
1706   @retval  EFI_SUCCESS           Find matching certs and output parameters.
1707
1708 **/
1709 EFI_STATUS
1710 FindCertsFromDb (
1711   IN     CHAR16           *VariableName,
1712   IN     EFI_GUID         *VendorGuid,
1713   IN     UINT8            *Data,
1714   IN     UINTN            DataSize,
1715   OUT    UINT32           *CertOffset,    OPTIONAL
1716   OUT    UINT32           *CertDataSize,  OPTIONAL
1717   OUT    UINT32           *CertNodeOffset,OPTIONAL
1718   OUT    UINT32           *CertNodeSize   OPTIONAL
1719   )
1720 {
1721   UINT32                  Offset;
1722   AUTH_CERT_DB_DATA       *Ptr;
1723   UINT32                  CertSize;
1724   UINT32                  NameSize;
1725   UINT32                  NodeSize;
1726   UINT32                  CertDbListSize;
1727
1728   if ((VariableName == NULL) || (VendorGuid == NULL) || (Data == NULL)) {
1729     return EFI_INVALID_PARAMETER;
1730   }
1731
1732   //
1733   // Check whether DataSize matches recorded CertDbListSize.
1734   //
1735   if (DataSize < sizeof (UINT32)) {
1736     return EFI_INVALID_PARAMETER;
1737   }
1738
1739   CertDbListSize = ReadUnaligned32 ((UINT32 *) Data);
1740
1741   if (CertDbListSize != (UINT32) DataSize) {
1742     return EFI_INVALID_PARAMETER;
1743   }
1744
1745   Offset = sizeof (UINT32);
1746
1747   //
1748   // Get corresponding certificates by VendorGuid and VariableName.
1749   //
1750   while (Offset < (UINT32) DataSize) {
1751     Ptr = (AUTH_CERT_DB_DATA *) (Data + Offset);
1752     //
1753     // Check whether VendorGuid matches.
1754     //
1755     if (CompareGuid (&Ptr->VendorGuid, VendorGuid)) {
1756       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1757       NameSize = ReadUnaligned32 (&Ptr->NameSize);
1758       CertSize = ReadUnaligned32 (&Ptr->CertDataSize);
1759
1760       if (NodeSize != sizeof (EFI_GUID) + sizeof (UINT32) * 3 + CertSize +
1761           sizeof (CHAR16) * NameSize) {
1762         return EFI_INVALID_PARAMETER;
1763       }
1764
1765       Offset = Offset + sizeof (EFI_GUID) + sizeof (UINT32) * 3;
1766       //
1767       // Check whether VariableName matches.
1768       //
1769       if ((NameSize == StrLen (VariableName)) &&
1770           (CompareMem (Data + Offset, VariableName, NameSize * sizeof (CHAR16)) == 0)) {
1771         Offset = Offset + NameSize * sizeof (CHAR16);
1772
1773         if (CertOffset != NULL) {
1774           *CertOffset = Offset;
1775         }
1776
1777         if (CertDataSize != NULL) {
1778           *CertDataSize = CertSize;
1779         }
1780
1781         if (CertNodeOffset != NULL) {
1782           *CertNodeOffset = (UINT32) ((UINT8 *) Ptr - Data);
1783         }
1784
1785         if (CertNodeSize != NULL) {
1786           *CertNodeSize = NodeSize;
1787         }
1788
1789         return EFI_SUCCESS;
1790       } else {
1791         Offset = Offset + NameSize * sizeof (CHAR16) + CertSize;
1792       }
1793     } else {
1794       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1795       Offset   = Offset + NodeSize;
1796     }
1797   }
1798
1799   return EFI_NOT_FOUND;
1800 }
1801
1802 /**
1803   Retrieve signer's certificates for common authenticated variable
1804   by corresponding VariableName and VendorGuid from "certdb".
1805
1806   @param[in]  VariableName   Name of authenticated Variable.
1807   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1808   @param[out] CertData       Pointer to signer's certificates.
1809   @param[out] CertDataSize   Length of CertData in bytes.
1810
1811   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1812   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1813   @retval  EFI_SUCCESS           Get signer's certificates successfully.
1814
1815 **/
1816 EFI_STATUS
1817 GetCertsFromDb (
1818   IN     CHAR16           *VariableName,
1819   IN     EFI_GUID         *VendorGuid,
1820   OUT    UINT8            **CertData,
1821   OUT    UINT32           *CertDataSize
1822   )
1823 {
1824   VARIABLE_POINTER_TRACK  CertDbVariable;
1825   EFI_STATUS              Status;
1826   UINT8                   *Data;
1827   UINTN                   DataSize;
1828   UINT32                  CertOffset;
1829
1830   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL) || (CertDataSize == NULL)) {
1831     return EFI_INVALID_PARAMETER;
1832   }
1833
1834   //
1835   // Get variable "certdb".
1836   //
1837   Status = FindVariable (
1838              EFI_CERT_DB_NAME,
1839              &gEfiCertDbGuid,
1840              &CertDbVariable,
1841              &mVariableModuleGlobal->VariableGlobal,
1842              FALSE
1843              );
1844   if (EFI_ERROR (Status)) {
1845     return Status;
1846   }
1847
1848   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1849   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1850   if ((DataSize == 0) || (Data == NULL)) {
1851     ASSERT (FALSE);
1852     return EFI_NOT_FOUND;
1853   }
1854
1855   Status = FindCertsFromDb (
1856              VariableName,
1857              VendorGuid,
1858              Data,
1859              DataSize,
1860              &CertOffset,
1861              CertDataSize,
1862              NULL,
1863              NULL
1864              );
1865
1866   if (EFI_ERROR (Status)) {
1867     return Status;
1868   }
1869
1870   *CertData = Data + CertOffset;
1871   return EFI_SUCCESS;
1872 }
1873
1874 /**
1875   Delete matching signer's certificates when deleting common authenticated
1876   variable by corresponding VariableName and VendorGuid from "certdb".
1877
1878   @param[in]  VariableName   Name of authenticated Variable.
1879   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1880
1881   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1882   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1883   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
1884   @retval  EFI_SUCCESS           The operation is completed successfully.
1885
1886 **/
1887 EFI_STATUS
1888 DeleteCertsFromDb (
1889   IN     CHAR16           *VariableName,
1890   IN     EFI_GUID         *VendorGuid
1891   )
1892 {
1893   VARIABLE_POINTER_TRACK  CertDbVariable;
1894   EFI_STATUS              Status;
1895   UINT8                   *Data;
1896   UINTN                   DataSize;
1897   UINT32                  VarAttr;
1898   UINT32                  CertNodeOffset;
1899   UINT32                  CertNodeSize;
1900   UINT8                   *NewCertDb;
1901   UINT32                  NewCertDbSize;
1902
1903   if ((VariableName == NULL) || (VendorGuid == NULL)) {
1904     return EFI_INVALID_PARAMETER;
1905   }
1906
1907   //
1908   // Get variable "certdb".
1909   //
1910   Status = FindVariable (
1911              EFI_CERT_DB_NAME,
1912              &gEfiCertDbGuid,
1913              &CertDbVariable,
1914              &mVariableModuleGlobal->VariableGlobal,
1915              FALSE
1916              );
1917   if (EFI_ERROR (Status)) {
1918     return Status;
1919   }
1920
1921   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1922   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1923   if ((DataSize == 0) || (Data == NULL)) {
1924     ASSERT (FALSE);
1925     return EFI_NOT_FOUND;
1926   }
1927
1928   if (DataSize == sizeof (UINT32)) {
1929     //
1930     // There is no certs in certdb.
1931     //
1932     return EFI_SUCCESS;
1933   }
1934
1935   //
1936   // Get corresponding cert node from certdb.
1937   //
1938   Status = FindCertsFromDb (
1939              VariableName,
1940              VendorGuid,
1941              Data,
1942              DataSize,
1943              NULL,
1944              NULL,
1945              &CertNodeOffset,
1946              &CertNodeSize
1947              );
1948
1949   if (EFI_ERROR (Status)) {
1950     return Status;
1951   }
1952
1953   if (DataSize < (CertNodeOffset + CertNodeSize)) {
1954     return EFI_NOT_FOUND;
1955   }
1956
1957   //
1958   // Construct new data content of variable "certdb".
1959   //
1960   NewCertDbSize = (UINT32) DataSize - CertNodeSize;
1961   NewCertDb     = (UINT8*) mCertDbStore;
1962
1963   //
1964   // Copy the DB entries before deleting node.
1965   //
1966   CopyMem (NewCertDb, Data, CertNodeOffset);
1967   //
1968   // Update CertDbListSize.
1969   //
1970   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
1971   //
1972   // Copy the DB entries after deleting node.
1973   //
1974   if (DataSize > (CertNodeOffset + CertNodeSize)) {
1975     CopyMem (
1976       NewCertDb + CertNodeOffset,
1977       Data + CertNodeOffset + CertNodeSize,
1978       DataSize - CertNodeOffset - CertNodeSize
1979       );
1980   }
1981
1982   //
1983   // Set "certdb".
1984   //
1985   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
1986   Status   = UpdateVariable (
1987                EFI_CERT_DB_NAME,
1988                &gEfiCertDbGuid,
1989                NewCertDb,
1990                NewCertDbSize,
1991                VarAttr,
1992                0,
1993                0,
1994                &CertDbVariable,
1995                NULL
1996                );
1997
1998   return Status;
1999 }
2000
2001 /**
2002   Insert signer's certificates for common authenticated variable with VariableName
2003   and VendorGuid in AUTH_CERT_DB_DATA to "certdb".
2004
2005   @param[in]  VariableName   Name of authenticated Variable.
2006   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
2007   @param[in]  CertData       Pointer to signer's certificates.
2008   @param[in]  CertDataSize   Length of CertData in bytes.
2009
2010   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
2011   @retval  EFI_ACCESS_DENIED     An AUTH_CERT_DB_DATA entry with same VariableName
2012                                  and VendorGuid already exists.
2013   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
2014   @retval  EFI_SUCCESS           Insert an AUTH_CERT_DB_DATA entry to "certdb"
2015
2016 **/
2017 EFI_STATUS
2018 InsertCertsToDb (
2019   IN     CHAR16           *VariableName,
2020   IN     EFI_GUID         *VendorGuid,
2021   IN     UINT8            *CertData,
2022   IN     UINTN            CertDataSize
2023   )
2024 {
2025   VARIABLE_POINTER_TRACK  CertDbVariable;
2026   EFI_STATUS              Status;
2027   UINT8                   *Data;
2028   UINTN                   DataSize;
2029   UINT32                  VarAttr;
2030   UINT8                   *NewCertDb;
2031   UINT32                  NewCertDbSize;
2032   UINT32                  CertNodeSize;
2033   UINT32                  NameSize;
2034   AUTH_CERT_DB_DATA       *Ptr;
2035
2036   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL)) {
2037     return EFI_INVALID_PARAMETER;
2038   }
2039
2040   //
2041   // Get variable "certdb".
2042   //
2043   Status = FindVariable (
2044              EFI_CERT_DB_NAME,
2045              &gEfiCertDbGuid,
2046              &CertDbVariable,
2047              &mVariableModuleGlobal->VariableGlobal,
2048              FALSE
2049              );
2050   if (EFI_ERROR (Status)) {
2051     return Status;
2052   }
2053
2054   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
2055   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
2056   if ((DataSize == 0) || (Data == NULL)) {
2057     ASSERT (FALSE);
2058     return EFI_NOT_FOUND;
2059   }
2060
2061   //
2062   // Find whether matching cert node already exists in "certdb".
2063   // If yes return error.
2064   //
2065   Status = FindCertsFromDb (
2066              VariableName,
2067              VendorGuid,
2068              Data,
2069              DataSize,
2070              NULL,
2071              NULL,
2072              NULL,
2073              NULL
2074              );
2075
2076   if (!EFI_ERROR (Status)) {
2077     ASSERT (FALSE);
2078     return EFI_ACCESS_DENIED;
2079   }
2080
2081   //
2082   // Construct new data content of variable "certdb".
2083   //
2084   NameSize      = (UINT32) StrLen (VariableName);
2085   CertNodeSize  = sizeof (AUTH_CERT_DB_DATA) + (UINT32) CertDataSize + NameSize * sizeof (CHAR16);
2086   NewCertDbSize = (UINT32) DataSize + CertNodeSize;
2087   if (NewCertDbSize > mMaxCertDbSize) {
2088     return EFI_OUT_OF_RESOURCES;
2089   }
2090   NewCertDb     = (UINT8*) mCertDbStore;
2091
2092   //
2093   // Copy the DB entries before deleting node.
2094   //
2095   CopyMem (NewCertDb, Data, DataSize);
2096   //
2097   // Update CertDbListSize.
2098   //
2099   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
2100   //
2101   // Construct new cert node.
2102   //
2103   Ptr = (AUTH_CERT_DB_DATA *) (NewCertDb + DataSize);
2104   CopyGuid (&Ptr->VendorGuid, VendorGuid);
2105   CopyMem (&Ptr->CertNodeSize, &CertNodeSize, sizeof (UINT32));
2106   CopyMem (&Ptr->NameSize, &NameSize, sizeof (UINT32));
2107   CopyMem (&Ptr->CertDataSize, &CertDataSize, sizeof (UINT32));
2108
2109   CopyMem (
2110     (UINT8 *) Ptr + sizeof (AUTH_CERT_DB_DATA),
2111     VariableName,
2112     NameSize * sizeof (CHAR16)
2113     );
2114
2115   CopyMem (
2116     (UINT8 *) Ptr +  sizeof (AUTH_CERT_DB_DATA) + NameSize * sizeof (CHAR16),
2117     CertData,
2118     CertDataSize
2119     );
2120
2121   //
2122   // Set "certdb".
2123   //
2124   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
2125   Status   = UpdateVariable (
2126                EFI_CERT_DB_NAME,
2127                &gEfiCertDbGuid,
2128                NewCertDb,
2129                NewCertDbSize,
2130                VarAttr,
2131                0,
2132                0,
2133                &CertDbVariable,
2134                NULL
2135                );
2136
2137   return Status;
2138 }
2139
2140 /**
2141   Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
2142
2143   Caution: This function may receive untrusted input.
2144   This function may be invoked in SMM mode, and datasize and data are external input.
2145   This function will do basic validation, before parse the data.
2146   This function will parse the authentication carefully to avoid security issues, like
2147   buffer overflow, integer overflow.
2148
2149   @param[in]  VariableName                Name of Variable to be found.
2150   @param[in]  VendorGuid                  Variable vendor GUID.
2151   @param[in]  Data                        Data pointer.
2152   @param[in]  DataSize                    Size of Data found. If size is less than the
2153                                           data, this value contains the required size.
2154   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
2155   @param[in]  Attributes                  Attribute value of the variable.
2156   @param[in]  AuthVarType                 Verify against PK, KEK database, private database or certificate in data payload.
2157   @param[out] VarDel                      Delete the variable or not.
2158
2159   @retval EFI_INVALID_PARAMETER           Invalid parameter.
2160   @retval EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
2161                                           check carried out by the firmware.
2162   @retval EFI_OUT_OF_RESOURCES            Failed to process variable due to lack
2163                                           of resources.
2164   @retval EFI_SUCCESS                     Variable pass validation successfully.
2165
2166 **/
2167 EFI_STATUS
2168 VerifyTimeBasedPayload (
2169   IN     CHAR16                             *VariableName,
2170   IN     EFI_GUID                           *VendorGuid,
2171   IN     VOID                               *Data,
2172   IN     UINTN                              DataSize,
2173   IN     VARIABLE_POINTER_TRACK             *Variable,
2174   IN     UINT32                             Attributes,
2175   IN     AUTHVAR_TYPE                       AuthVarType,
2176   OUT    BOOLEAN                            *VarDel
2177   )
2178 {
2179   UINT8                            *RootCert;
2180   UINT8                            *SigData;
2181   UINT8                            *PayloadPtr;
2182   UINTN                            RootCertSize;
2183   UINTN                            Index;
2184   UINTN                            CertCount;
2185   UINTN                            PayloadSize;
2186   UINT32                           Attr;
2187   UINT32                           SigDataSize;
2188   UINT32                           KekDataSize;
2189   BOOLEAN                          VerifyStatus;
2190   EFI_STATUS                       Status;
2191   EFI_SIGNATURE_LIST               *CertList;
2192   EFI_SIGNATURE_DATA               *Cert;
2193   VARIABLE_POINTER_TRACK           KekVariable;
2194   EFI_VARIABLE_AUTHENTICATION_2    *CertData;
2195   UINT8                            *NewData;
2196   UINTN                            NewDataSize;
2197   VARIABLE_POINTER_TRACK           PkVariable;
2198   UINT8                            *Buffer;
2199   UINTN                            Length;
2200   UINT8                            *SignerCerts;
2201   UINT8                            *WrapSigData;
2202   UINTN                            CertStackSize;
2203   UINT8                            *CertsInCertDb;
2204   UINT32                           CertsSizeinDb;
2205
2206   VerifyStatus           = FALSE;
2207   CertData               = NULL;
2208   NewData                = NULL;
2209   Attr                   = Attributes;
2210   WrapSigData            = NULL;
2211   SignerCerts            = NULL;
2212   RootCert               = NULL;
2213   CertsInCertDb          = NULL;
2214
2215   //
2216   // When the attribute EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS is
2217   // set, then the Data buffer shall begin with an instance of a complete (and serialized)
2218   // EFI_VARIABLE_AUTHENTICATION_2 descriptor. The descriptor shall be followed by the new
2219   // variable value and DataSize shall reflect the combined size of the descriptor and the new
2220   // variable value. The authentication descriptor is not part of the variable data and is not
2221   // returned by subsequent calls to GetVariable().
2222   //
2223   CertData = (EFI_VARIABLE_AUTHENTICATION_2 *) Data;
2224
2225   //
2226   // Verify that Pad1, Nanosecond, TimeZone, Daylight and Pad2 components of the
2227   // TimeStamp value are set to zero.
2228   //
2229   if ((CertData->TimeStamp.Pad1 != 0) ||
2230       (CertData->TimeStamp.Nanosecond != 0) ||
2231       (CertData->TimeStamp.TimeZone != 0) ||
2232       (CertData->TimeStamp.Daylight != 0) ||
2233       (CertData->TimeStamp.Pad2 != 0)) {
2234     return EFI_SECURITY_VIOLATION;
2235   }
2236
2237   if ((Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
2238     if (CompareTimeStamp (&CertData->TimeStamp, &Variable->CurrPtr->TimeStamp)) {
2239       //
2240       // TimeStamp check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
2241       //
2242       return EFI_SECURITY_VIOLATION;
2243     }
2244   }
2245
2246   //
2247   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
2248   // Cert type should be EFI_CERT_TYPE_PKCS7_GUID.
2249   //
2250   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
2251       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertPkcs7Guid)) {
2252     //
2253     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
2254     //
2255     return EFI_SECURITY_VIOLATION;
2256   }
2257
2258   //
2259   // Find out Pkcs7 SignedData which follows the EFI_VARIABLE_AUTHENTICATION_2 descriptor.
2260   // AuthInfo.Hdr.dwLength is the length of the entire certificate, including the length of the header.
2261   //
2262   SigData = CertData->AuthInfo.CertData;
2263   SigDataSize = CertData->AuthInfo.Hdr.dwLength - (UINT32) (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData));
2264
2265   //
2266   // Find out the new data payload which follows Pkcs7 SignedData directly.
2267   //
2268   PayloadPtr = SigData + SigDataSize;
2269   PayloadSize = DataSize - OFFSET_OF_AUTHINFO2_CERT_DATA - (UINTN) SigDataSize;
2270
2271   //
2272   // Construct a buffer to fill with (VariableName, VendorGuid, Attributes, TimeStamp, Data).
2273   //
2274   NewDataSize = PayloadSize + sizeof (EFI_TIME) + sizeof (UINT32) +
2275                 sizeof (EFI_GUID) + StrSize (VariableName) - sizeof (CHAR16);
2276   NewData = mSerializationRuntimeBuffer;
2277
2278   Buffer = NewData;
2279   Length = StrLen (VariableName) * sizeof (CHAR16);
2280   CopyMem (Buffer, VariableName, Length);
2281   Buffer += Length;
2282
2283   Length = sizeof (EFI_GUID);
2284   CopyMem (Buffer, VendorGuid, Length);
2285   Buffer += Length;
2286
2287   Length = sizeof (UINT32);
2288   CopyMem (Buffer, &Attr, Length);
2289   Buffer += Length;
2290
2291   Length = sizeof (EFI_TIME);
2292   CopyMem (Buffer, &CertData->TimeStamp, Length);
2293   Buffer += Length;
2294
2295   CopyMem (Buffer, PayloadPtr, PayloadSize);
2296
2297   if (AuthVarType == AuthVarTypePk) {
2298     //
2299     // Verify that the signature has been made with the current Platform Key (no chaining for PK).
2300     // First, get signer's certificates from SignedData.
2301     //
2302     VerifyStatus = Pkcs7GetSigners (
2303                      SigData,
2304                      SigDataSize,
2305                      &SignerCerts,
2306                      &CertStackSize,
2307                      &RootCert,
2308                      &RootCertSize
2309                      );
2310     if (!VerifyStatus) {
2311       goto Exit;
2312     }
2313
2314     //
2315     // Second, get the current platform key from variable. Check whether it's identical with signer's certificates
2316     // in SignedData. If not, return error immediately.
2317     //
2318     Status = FindVariable (
2319                EFI_PLATFORM_KEY_NAME,
2320                &gEfiGlobalVariableGuid,
2321                &PkVariable,
2322                &mVariableModuleGlobal->VariableGlobal,
2323                FALSE
2324                );
2325     if (EFI_ERROR (Status)) {
2326       VerifyStatus = FALSE;
2327       goto Exit;
2328     }
2329     CertList = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (PkVariable.CurrPtr);
2330     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2331     if ((RootCertSize != (CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1))) ||
2332         (CompareMem (Cert->SignatureData, RootCert, RootCertSize) != 0)) {
2333       VerifyStatus = FALSE;
2334       goto Exit;
2335     }
2336
2337     //
2338     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2339     //
2340     VerifyStatus = Pkcs7Verify (
2341                      SigData,
2342                      SigDataSize,
2343                      RootCert,
2344                      RootCertSize,
2345                      NewData,
2346                      NewDataSize
2347                      );
2348
2349   } else if (AuthVarType == AuthVarTypeKek) {
2350
2351     //
2352     // Get KEK database from variable.
2353     //
2354     Status = FindVariable (
2355                EFI_KEY_EXCHANGE_KEY_NAME,
2356                &gEfiGlobalVariableGuid,
2357                &KekVariable,
2358                &mVariableModuleGlobal->VariableGlobal,
2359                FALSE
2360                );
2361     if (EFI_ERROR (Status)) {
2362       return Status;
2363     }
2364
2365     //
2366     // Ready to verify Pkcs7 SignedData. Go through KEK Signature Database to find out X.509 CertList.
2367     //
2368     KekDataSize      = KekVariable.CurrPtr->DataSize;
2369     CertList         = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (KekVariable.CurrPtr);
2370     while ((KekDataSize > 0) && (KekDataSize >= CertList->SignatureListSize)) {
2371       if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {
2372         Cert       = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2373         CertCount  = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
2374         for (Index = 0; Index < CertCount; Index++) {
2375           //
2376           // Iterate each Signature Data Node within this CertList for a verify
2377           //
2378           RootCert      = Cert->SignatureData;
2379           RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2380
2381           //
2382           // Verify Pkcs7 SignedData via Pkcs7Verify library.
2383           //
2384           VerifyStatus = Pkcs7Verify (
2385                            SigData,
2386                            SigDataSize,
2387                            RootCert,
2388                            RootCertSize,
2389                            NewData,
2390                            NewDataSize
2391                            );
2392           if (VerifyStatus) {
2393             goto Exit;
2394           }
2395           Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
2396         }
2397       }
2398       KekDataSize -= CertList->SignatureListSize;
2399       CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
2400     }
2401   } else if (AuthVarType == AuthVarTypePriv) {
2402
2403     //
2404     // Process common authenticated variable except PK/KEK/DB/DBX/DBT.
2405     // Get signer's certificates from SignedData.
2406     //
2407     VerifyStatus = Pkcs7GetSigners (
2408                      SigData,
2409                      SigDataSize,
2410                      &SignerCerts,
2411                      &CertStackSize,
2412                      &RootCert,
2413                      &RootCertSize
2414                      );
2415     if (!VerifyStatus) {
2416       goto Exit;
2417     }
2418
2419     //
2420     // Get previously stored signer's certificates from certdb for existing
2421     // variable. Check whether they are identical with signer's certificates
2422     // in SignedData. If not, return error immediately.
2423     //
2424     if ((Variable->CurrPtr != NULL)) {
2425       VerifyStatus = FALSE;
2426
2427       Status = GetCertsFromDb (VariableName, VendorGuid, &CertsInCertDb, &CertsSizeinDb);
2428       if (EFI_ERROR (Status)) {
2429         goto Exit;
2430       }
2431
2432       if ((CertStackSize != CertsSizeinDb) ||
2433           (CompareMem (SignerCerts, CertsInCertDb, CertsSizeinDb) != 0)) {
2434         goto Exit;
2435       }
2436     }
2437
2438     VerifyStatus = Pkcs7Verify (
2439                      SigData,
2440                      SigDataSize,
2441                      RootCert,
2442                      RootCertSize,
2443                      NewData,
2444                      NewDataSize
2445                      );
2446     if (!VerifyStatus) {
2447       goto Exit;
2448     }
2449
2450     //
2451     // Delete signer's certificates when delete the common authenticated variable.
2452     //
2453     if ((PayloadSize == 0) && (Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
2454       Status = DeleteCertsFromDb (VariableName, VendorGuid);
2455       if (EFI_ERROR (Status)) {
2456         VerifyStatus = FALSE;
2457         goto Exit;
2458       }
2459     } else if (Variable->CurrPtr == NULL && PayloadSize != 0) {
2460       //
2461       // Insert signer's certificates when adding a new common authenticated variable.
2462       //
2463       Status = InsertCertsToDb (VariableName, VendorGuid, SignerCerts, CertStackSize);
2464       if (EFI_ERROR (Status)) {
2465         VerifyStatus = FALSE;
2466         goto Exit;
2467       }
2468     }
2469   } else if (AuthVarType == AuthVarTypePayload) {
2470     CertList = (EFI_SIGNATURE_LIST *) PayloadPtr;
2471     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2472     RootCert      = Cert->SignatureData;
2473     RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2474
2475     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2476     //
2477     VerifyStatus = Pkcs7Verify (
2478                      SigData,
2479                      SigDataSize,
2480                      RootCert,
2481                      RootCertSize,
2482                      NewData,
2483                      NewDataSize
2484                      );
2485   } else {
2486     return EFI_SECURITY_VIOLATION;
2487   }
2488
2489 Exit:
2490
2491   if (AuthVarType == AuthVarTypePk || AuthVarType == AuthVarTypePriv) {
2492     Pkcs7FreeSigners (RootCert);
2493     Pkcs7FreeSigners (SignerCerts);
2494   }
2495
2496   if (!VerifyStatus) {
2497     return EFI_SECURITY_VIOLATION;
2498   }
2499
2500   Status = CheckSignatureListFormat(VariableName, VendorGuid, PayloadPtr, PayloadSize);
2501   if (EFI_ERROR (Status)) {
2502     return Status;
2503   }
2504
2505   if ((PayloadSize == 0) && (VarDel != NULL)) {
2506     *VarDel = TRUE;
2507   }
2508
2509   //
2510   // Final step: Update/Append Variable if it pass Pkcs7Verify
2511   //
2512   return UpdateVariable (
2513            VariableName,
2514            VendorGuid,
2515            PayloadPtr,
2516            PayloadSize,
2517            Attributes,
2518            0,
2519            0,
2520            Variable,
2521            &CertData->TimeStamp
2522            );
2523 }