SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c

   1 /** @file
   2   Implement authentication services for the authenticated variable
   3   service in UEFI2.2.
   4
   5   Caution: This module requires additional review when modified.
   6   This driver will have external input - variable data. It may be input in SMM mode.
   7   This external input must be validated carefully to avoid security issue like
   8   buffer overflow, integer overflow.
   9   Variable attribute should also be checked to avoid authentication bypass.
  10      The whole SMM authentication variable design relies on the integrity of flash part and SMM.
  11   which is assumed to be protected by platform.  All variable code and metadata in flash/SMM Memory
  12   may not be modified without authorization. If platform fails to protect these resources,
  13   the authentication service provided in this driver will be broken, and the behavior is undefined.
  14
  15   ProcessVarWithPk(), ProcessVarWithKek() and ProcessVariable() are the function to do
  16   variable authentication.
  17
  18   VerifyTimeBasedPayload() and VerifyCounterBasedPayload() are sub function to do verification.
  19   They will do basic validation for authentication data structure, then call crypto library
  20   to verify the signature.
  21
  22 Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>
  23 This program and the accompanying materials
  24 are licensed and made available under the terms and conditions of the BSD License
  25 which accompanies this distribution.  The full text of the license may be found at
  26 http://opensource.org/licenses/bsd-license.php
  27
  28 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  29 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  30
  31 **/
  32
  33 #include "Variable.h"
  34 #include "AuthService.h"
  35
  36 ///
  37 /// Global database array for scratch
  38 ///
  39 UINT8    *mPubKeyStore;
  40 UINT32   mPubKeyNumber;
  41 UINT32   mMaxKeyNumber;
  42 UINT32   mMaxKeyDbSize;
  43 UINT8    *mCertDbStore;
  44 UINT32   mMaxCertDbSize;
  45 UINT32   mPlatformMode;
  46 UINT8    mVendorKeyState;
  47
  48 EFI_GUID mSignatureSupport[] = {EFI_CERT_SHA1_GUID, EFI_CERT_SHA256_GUID, EFI_CERT_RSA2048_GUID, EFI_CERT_X509_GUID};
  49 //
  50 // Public Exponent of RSA Key.
  51 //
  52 CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };
  53 //
  54 // Hash context pointer
  55 //
  56 VOID  *mHashCtx = NULL;
  57
  58 //
  59 // Requirement for different signature type which have been defined in UEFI spec.
  60 // These data are used to peform SignatureList format check while setting PK/KEK variable.
  61 //
  62 EFI_SIGNATURE_ITEM mSupportSigItem[] = {
  63 //{SigType,                       SigHeaderSize,   SigDataSize  }
  64   {EFI_CERT_SHA256_GUID,          0,               32           },
  65   {EFI_CERT_RSA2048_GUID,         0,               256          },
  66   {EFI_CERT_RSA2048_SHA256_GUID,  0,               256          },
  67   {EFI_CERT_SHA1_GUID,            0,               20           },
  68   {EFI_CERT_RSA2048_SHA1_GUID,    0,               256          },
  69   {EFI_CERT_X509_GUID,            0,               ((UINT32) ~0)},
  70   {EFI_CERT_SHA224_GUID,          0,               28           },
  71   {EFI_CERT_SHA384_GUID,          0,               48           },
  72   {EFI_CERT_SHA512_GUID,          0,               64           },
  73   {EFI_CERT_X509_SHA256_GUID,     0,               48           },
  74   {EFI_CERT_X509_SHA384_GUID,     0,               64           },
  75   {EFI_CERT_X509_SHA512_GUID,     0,               80           }
  76 };
  77
  78 /**
  79   Determine whether this operation needs a physical present user.
  80
  81   @param[in]      VariableName            Name of the Variable.
  82   @param[in]      VendorGuid              GUID of the Variable.
  83
  84   @retval TRUE      This variable is protected, only a physical present user could set this variable.
  85   @retval FALSE     This variable is not protected.
  86
  87 **/
  88 BOOLEAN
  89 NeedPhysicallyPresent(
  90   IN     CHAR16         *VariableName,
  91   IN     EFI_GUID       *VendorGuid
  92   )
  93 {
  94   if ((CompareGuid (VendorGuid, &gEfiSecureBootEnableDisableGuid) && (StrCmp (VariableName, EFI_SECURE_BOOT_ENABLE_NAME) == 0))
  95     || (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (VariableName, EFI_CUSTOM_MODE_NAME) == 0))) {
  96     return TRUE;
  97   }
  98
  99   return FALSE;
 100 }
 101
 102 /**
 103   Determine whether the platform is operating in Custom Secure Boot mode.
 104
 105   @retval TRUE           The platform is operating in Custom mode.
 106   @retval FALSE          The platform is operating in Standard mode.
 107
 108 **/
 109 BOOLEAN
 110 InCustomMode (
 111   VOID
 112   )
 113 {
 114   VARIABLE_POINTER_TRACK  Variable;
 115
 116   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 117   if (Variable.CurrPtr != NULL && *(GetVariableDataPtr (Variable.CurrPtr)) == CUSTOM_SECURE_BOOT_MODE) {
 118     return TRUE;
 119   }
 120
 121   return FALSE;
 122 }
 123
 124 /**
 125   Initializes for authenticated varibale service.
 126
 127   @param[in] MaxAuthVariableSize    Reflect the overhead associated with the saving
 128                                     of a single EFI authenticated variable with the exception
 129                                     of the overhead associated with the length
 130                                     of the string name of the EFI variable.
 131
 132   @retval EFI_SUCCESS           Function successfully executed.
 133   @retval EFI_OUT_OF_RESOURCES  Fail to allocate enough memory resources.
 134
 135 **/
 136 EFI_STATUS
 137 AutenticatedVariableServiceInitialize (
 138   IN UINTN      MaxAuthVariableSize
 139   )
 140 {
 141   EFI_STATUS              Status;
 142   VARIABLE_POINTER_TRACK  Variable;
 143   VARIABLE_POINTER_TRACK  PkVariable;
 144   UINT8                   VarValue;
 145   UINT32                  VarAttr;
 146   UINT8                   *Data;
 147   UINTN                   DataSize;
 148   UINTN                   CtxSize;
 149   UINT8                   SecureBootMode;
 150   UINT8                   SecureBootEnable;
 151   UINT8                   CustomMode;
 152   UINT32                  ListSize;
 153
 154   //
 155   // Initialize hash context.
 156   //
 157   CtxSize   = Sha256GetContextSize ();
 158   mHashCtx  = AllocateRuntimePool (CtxSize);
 159   if (mHashCtx == NULL) {
 160     return EFI_OUT_OF_RESOURCES;
 161   }
 162
 163   //
 164   // Reserve runtime buffer for public key database. The size excludes variable header and name size.
 165   //
 166   mMaxKeyDbSize = (UINT32) (MaxAuthVariableSize - sizeof (AUTHVAR_KEYDB_NAME));
 167   mMaxKeyNumber = mMaxKeyDbSize / EFI_CERT_TYPE_RSA2048_SIZE;
 168   mPubKeyStore  = AllocateRuntimePool (mMaxKeyDbSize);
 169   if (mPubKeyStore == NULL) {
 170     return EFI_OUT_OF_RESOURCES;
 171   }
 172
 173   //
 174   // Reserve runtime buffer for certificate database. The size excludes variable header and name size.
 175   //
 176   mMaxCertDbSize = (UINT32) (MaxAuthVariableSize - sizeof (EFI_CERT_DB_NAME));
 177   mCertDbStore   = AllocateRuntimePool (mMaxCertDbSize);
 178   if (mCertDbStore == NULL) {
 179     return EFI_OUT_OF_RESOURCES;
 180   }
 181
 182   //
 183   // Check "AuthVarKeyDatabase" variable's existence.
 184   // If it doesn't exist, create a new one with initial value of 0 and EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
 185   //
 186   Status = FindVariable (
 187              AUTHVAR_KEYDB_NAME,
 188              &gEfiAuthenticatedVariableGuid,
 189              &Variable,
 190              &mVariableModuleGlobal->VariableGlobal,
 191              FALSE
 192              );
 193
 194   if (Variable.CurrPtr == NULL) {
 195     VarAttr       = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 196     VarValue      = 0;
 197     mPubKeyNumber = 0;
 198     Status        = UpdateVariable (
 199                       AUTHVAR_KEYDB_NAME,
 200                       &gEfiAuthenticatedVariableGuid,
 201                       &VarValue,
 202                       sizeof(UINT8),
 203                       VarAttr,
 204                       0,
 205                       0,
 206                       &Variable,
 207                       NULL
 208                       );
 209     if (EFI_ERROR (Status)) {
 210       return Status;
 211     }
 212   } else {
 213     //
 214     // Load database in global variable for cache.
 215     //
 216     DataSize  = DataSizeOfVariable (Variable.CurrPtr);
 217     Data      = GetVariableDataPtr (Variable.CurrPtr);
 218     ASSERT ((DataSize != 0) && (Data != NULL));
 219     //
 220     // "AuthVarKeyDatabase" is an internal variable. Its DataSize is always ensured not to exceed mPubKeyStore buffer size(See definition before)
 221     //  Therefore, there is no memory overflow in underlying CopyMem.
 222     //
 223     CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
 224     mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
 225   }
 226
 227   FindVariable (EFI_PLATFORM_KEY_NAME, &gEfiGlobalVariableGuid, &PkVariable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 228   if (PkVariable.CurrPtr == NULL) {
 229     DEBUG ((EFI_D_INFO, "Variable %s does not exist.\n", EFI_PLATFORM_KEY_NAME));
 230   } else {
 231     DEBUG ((EFI_D_INFO, "Variable %s exists.\n", EFI_PLATFORM_KEY_NAME));
 232   }
 233
 234   //
 235   // Create "SetupMode" variable with BS+RT attribute set.
 236   //
 237   FindVariable (EFI_SETUP_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 238   if (PkVariable.CurrPtr == NULL) {
 239     mPlatformMode = SETUP_MODE;
 240   } else {
 241     mPlatformMode = USER_MODE;
 242   }
 243   Status = UpdateVariable (
 244              EFI_SETUP_MODE_NAME,
 245              &gEfiGlobalVariableGuid,
 246              &mPlatformMode,
 247              sizeof(UINT8),
 248              EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 249              0,
 250              0,
 251              &Variable,
 252              NULL
 253              );
 254   if (EFI_ERROR (Status)) {
 255     return Status;
 256   }
 257
 258   //
 259   // Create "SignatureSupport" variable with BS+RT attribute set.
 260   //
 261   FindVariable (EFI_SIGNATURE_SUPPORT_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 262   Status  = UpdateVariable (
 263               EFI_SIGNATURE_SUPPORT_NAME,
 264               &gEfiGlobalVariableGuid,
 265               mSignatureSupport,
 266               sizeof(mSignatureSupport),
 267               EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 268               0,
 269               0,
 270               &Variable,
 271               NULL
 272               );
 273   if (EFI_ERROR (Status)) {
 274     return Status;
 275   }
 276
 277   //
 278   // If "SecureBootEnable" variable exists, then update "SecureBoot" variable.
 279   // If "SecureBootEnable" variable is SECURE_BOOT_ENABLE and in USER_MODE, Set "SecureBoot" variable to SECURE_BOOT_MODE_ENABLE.
 280   // If "SecureBootEnable" variable is SECURE_BOOT_DISABLE, Set "SecureBoot" variable to SECURE_BOOT_MODE_DISABLE.
 281   //
 282   SecureBootEnable = SECURE_BOOT_DISABLE;
 283   FindVariable (EFI_SECURE_BOOT_ENABLE_NAME, &gEfiSecureBootEnableDisableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 284   if (Variable.CurrPtr != NULL) {
 285     if (mPlatformMode == SETUP_MODE){
 286       //
 287       // PK is cleared in runtime. "SecureBootMode" is not updated before reboot
 288       // Delete "SecureBootMode" in SetupMode
 289       //
 290       Status = UpdateVariable (
 291                  EFI_SECURE_BOOT_ENABLE_NAME,
 292                  &gEfiSecureBootEnableDisableGuid,
 293                  &SecureBootEnable,
 294                  0,
 295                  EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 296                  0,
 297                  0,
 298                  &Variable,
 299                  NULL
 300                  );
 301     } else {
 302       SecureBootEnable = *(GetVariableDataPtr (Variable.CurrPtr));
 303     }
 304   } else if (mPlatformMode == USER_MODE) {
 305     //
 306     // "SecureBootEnable" not exist, initialize it in USER_MODE.
 307     //
 308     SecureBootEnable = SECURE_BOOT_ENABLE;
 309     Status = UpdateVariable (
 310                EFI_SECURE_BOOT_ENABLE_NAME,
 311                &gEfiSecureBootEnableDisableGuid,
 312                &SecureBootEnable,
 313                sizeof (UINT8),
 314                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 315                0,
 316                0,
 317                &Variable,
 318                NULL
 319                );
 320     if (EFI_ERROR (Status)) {
 321       return Status;
 322     }
 323   }
 324
 325   //
 326   // Create "SecureBoot" variable with BS+RT attribute set.
 327   //
 328   if (SecureBootEnable == SECURE_BOOT_ENABLE && mPlatformMode == USER_MODE) {
 329     SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 330   } else {
 331     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 332   }
 333   FindVariable (EFI_SECURE_BOOT_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 334   Status = UpdateVariable (
 335              EFI_SECURE_BOOT_MODE_NAME,
 336              &gEfiGlobalVariableGuid,
 337              &SecureBootMode,
 338              sizeof (UINT8),
 339              EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 340              0,
 341              0,
 342              &Variable,
 343              NULL
 344              );
 345   if (EFI_ERROR (Status)) {
 346     return Status;
 347   }
 348
 349   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SETUP_MODE_NAME, mPlatformMode));
 350   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_MODE_NAME, SecureBootMode));
 351   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_ENABLE_NAME, SecureBootEnable));
 352
 353   //
 354   // Initialize "CustomMode" in STANDARD_SECURE_BOOT_MODE state.
 355   //
 356   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 357   CustomMode = STANDARD_SECURE_BOOT_MODE;
 358   Status = UpdateVariable (
 359              EFI_CUSTOM_MODE_NAME,
 360              &gEfiCustomModeEnableGuid,
 361              &CustomMode,
 362              sizeof (UINT8),
 363              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 364              0,
 365              0,
 366              &Variable,
 367              NULL
 368              );
 369   if (EFI_ERROR (Status)) {
 370     return Status;
 371   }
 372
 373   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_CUSTOM_MODE_NAME, CustomMode));
 374
 375   //
 376   // Check "certdb" variable's existence.
 377   // If it doesn't exist, then create a new one with
 378   // EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.
 379   //
 380   Status = FindVariable (
 381              EFI_CERT_DB_NAME,
 382              &gEfiCertDbGuid,
 383              &Variable,
 384              &mVariableModuleGlobal->VariableGlobal,
 385              FALSE
 386              );
 387
 388   if (Variable.CurrPtr == NULL) {
 389     VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
 390     ListSize = sizeof (UINT32);
 391     Status   = UpdateVariable (
 392                  EFI_CERT_DB_NAME,
 393                  &gEfiCertDbGuid,
 394                  &ListSize,
 395                  sizeof (UINT32),
 396                  VarAttr,
 397                  0,
 398                  0,
 399                  &Variable,
 400                  NULL
 401                  );
 402     if (EFI_ERROR (Status)) {
 403       return Status;
 404     }
 405   }
 406
 407   //
 408   // Check "VendorKeysNv" variable's existence and create "VendorKeys" variable accordingly.
 409   //
 410   FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 411   if (Variable.CurrPtr != NULL) {
 412     mVendorKeyState = *(GetVariableDataPtr (Variable.CurrPtr));
 413   } else {
 414     //
 415     // "VendorKeysNv" not exist, initialize it in VENDOR_KEYS_VALID state.
 416     //
 417     mVendorKeyState = VENDOR_KEYS_VALID;
 418     Status = UpdateVariable (
 419                EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
 420                &gEfiVendorKeysNvGuid,
 421                &mVendorKeyState,
 422                sizeof (UINT8),
 423                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS,
 424                0,
 425                0,
 426                &Variable,
 427                NULL
 428                );
 429     if (EFI_ERROR (Status)) {
 430       return Status;
 431     }
 432   }
 433
 434   //
 435   // Create "VendorKeys" variable with BS+RT attribute set.
 436   //
 437   FindVariable (EFI_VENDOR_KEYS_VARIABLE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 438   Status = UpdateVariable (
 439              EFI_VENDOR_KEYS_VARIABLE_NAME,
 440              &gEfiGlobalVariableGuid,
 441              &mVendorKeyState,
 442              sizeof (UINT8),
 443              EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 444              0,
 445              0,
 446              &Variable,
 447              NULL
 448              );
 449   if (EFI_ERROR (Status)) {
 450     return Status;
 451   }
 452
 453   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_VENDOR_KEYS_VARIABLE_NAME, mVendorKeyState));
 454
 455   return Status;
 456 }
 457
 458 /**
 459   Add public key in store and return its index.
 460
 461   @param[in]  PubKey                  Input pointer to Public Key data
 462   @param[in]  VariableDataEntry       The variable data entry
 463
 464   @return                             Index of new added item
 465
 466 **/
 467 UINT32
 468 AddPubKeyInStore (
 469   IN  UINT8                        *PubKey,
 470   IN  VARIABLE_ENTRY_CONSISTENCY   *VariableDataEntry
 471   )
 472 {
 473   EFI_STATUS                       Status;
 474   BOOLEAN                          IsFound;
 475   UINT32                           Index;
 476   VARIABLE_POINTER_TRACK           Variable;
 477   UINT8                            *Ptr;
 478   UINT8                            *Data;
 479   UINTN                            DataSize;
 480   VARIABLE_ENTRY_CONSISTENCY       PublicKeyEntry;
 481   UINT32                           Attributes;
 482
 483   if (PubKey == NULL) {
 484     return 0;
 485   }
 486
 487   Status = FindVariable (
 488              AUTHVAR_KEYDB_NAME,
 489              &gEfiAuthenticatedVariableGuid,
 490              &Variable,
 491              &mVariableModuleGlobal->VariableGlobal,
 492              FALSE
 493              );
 494   if (EFI_ERROR (Status)) {
 495     DEBUG ((EFI_D_ERROR, "Get public key database variable failure, Status = %r\n", Status));
 496     return 0;
 497   }
 498
 499   //
 500   // Check whether the public key entry does exist.
 501   //
 502   IsFound = FALSE;
 503   for (Ptr = mPubKeyStore, Index = 1; Index <= mPubKeyNumber; Index++) {
 504     if (CompareMem (Ptr, PubKey, EFI_CERT_TYPE_RSA2048_SIZE) == 0) {
 505       IsFound = TRUE;
 506       break;
 507     }
 508     Ptr += EFI_CERT_TYPE_RSA2048_SIZE;
 509   }
 510
 511   if (!IsFound) {
 512     //
 513     // Add public key in database.
 514     //
 515     if (mPubKeyNumber == mMaxKeyNumber) {
 516       //
 517       // Public key dadatase is full, try to reclaim invalid key.
 518       //
 519       if (AtRuntime ()) {
 520         //
 521         // NV storage can't reclaim at runtime.
 522         //
 523         return 0;
 524       }
 525
 526       Status = Reclaim (
 527                  mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase,
 528                  &mVariableModuleGlobal->NonVolatileLastVariableOffset,
 529                  FALSE,
 530                  NULL,
 531                  NULL,
 532                  0,
 533                  TRUE
 534                  );
 535       if (EFI_ERROR (Status)) {
 536         return 0;
 537       }
 538
 539       Status = FindVariable (
 540                  AUTHVAR_KEYDB_NAME,
 541                  &gEfiAuthenticatedVariableGuid,
 542                  &Variable,
 543                  &mVariableModuleGlobal->VariableGlobal,
 544                  FALSE
 545                  );
 546       if (EFI_ERROR (Status)) {
 547         DEBUG ((EFI_D_ERROR, "Get public key database variable failure, Status = %r\n", Status));
 548         return 0;
 549       }
 550
 551       DataSize  = DataSizeOfVariable (Variable.CurrPtr);
 552       Data      = GetVariableDataPtr (Variable.CurrPtr);
 553       ASSERT ((DataSize != 0) && (Data != NULL));
 554       //
 555       // "AuthVarKeyDatabase" is an internal used variable. Its DataSize is always ensured not to exceed mPubKeyStore buffer size(See definition before)
 556       //  Therefore, there is no memory overflow in underlying CopyMem.
 557       //
 558       CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
 559       mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
 560
 561       if (mPubKeyNumber == mMaxKeyNumber) {
 562         return 0;
 563       }
 564     }
 565
 566     //
 567     // Check the variable space for both public key and variable data.
 568     //
 569     PublicKeyEntry.VariableSize = (mPubKeyNumber + 1) * EFI_CERT_TYPE_RSA2048_SIZE;
 570     PublicKeyEntry.Guid         = &gEfiAuthenticatedVariableGuid;
 571     PublicKeyEntry.Name         = AUTHVAR_KEYDB_NAME;
 572     Attributes = VARIABLE_ATTRIBUTE_NV_BS_RT | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 573
 574     if (!CheckRemainingSpaceForConsistency (Attributes, &PublicKeyEntry, VariableDataEntry, NULL)) {
 575       //
 576       // No enough variable space.
 577       //
 578       return 0;
 579     }
 580
 581     CopyMem (mPubKeyStore + mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 582     Index = ++mPubKeyNumber;
 583     //
 584     // Update public key database variable.
 585     //
 586     Status = UpdateVariable (
 587                AUTHVAR_KEYDB_NAME,
 588                &gEfiAuthenticatedVariableGuid,
 589                mPubKeyStore,
 590                mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE,
 591                Attributes,
 592                0,
 593                0,
 594                &Variable,
 595                NULL
 596                );
 597     if (EFI_ERROR (Status)) {
 598       DEBUG ((EFI_D_ERROR, "Update public key database variable failure, Status = %r\n", Status));
 599       return 0;
 600     }
 601   }
 602
 603   return Index;
 604 }
 605
 606 /**
 607   Verify data payload with AuthInfo in EFI_CERT_TYPE_RSA2048_SHA256_GUID type.
 608   Follow the steps in UEFI2.2.
 609
 610   Caution: This function may receive untrusted input.
 611   This function may be invoked in SMM mode, and datasize and data are external input.
 612   This function will do basic validation, before parse the data.
 613   This function will parse the authentication carefully to avoid security issues, like
 614   buffer overflow, integer overflow.
 615
 616   @param[in]      Data                    Pointer to data with AuthInfo.
 617   @param[in]      DataSize                Size of Data.
 618   @param[in]      PubKey                  Public key used for verification.
 619
 620   @retval EFI_INVALID_PARAMETER       Invalid parameter.
 621   @retval EFI_SECURITY_VIOLATION      If authentication failed.
 622   @retval EFI_SUCCESS                 Authentication successful.
 623
 624 **/
 625 EFI_STATUS
 626 VerifyCounterBasedPayload (
 627   IN     UINT8          *Data,
 628   IN     UINTN          DataSize,
 629   IN     UINT8          *PubKey
 630   )
 631 {
 632   BOOLEAN                         Status;
 633   EFI_VARIABLE_AUTHENTICATION     *CertData;
 634   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
 635   UINT8                           Digest[SHA256_DIGEST_SIZE];
 636   VOID                            *Rsa;
 637   UINTN                           PayloadSize;
 638
 639   PayloadSize = DataSize - AUTHINFO_SIZE;
 640   Rsa         = NULL;
 641   CertData    = NULL;
 642   CertBlock   = NULL;
 643
 644   if (Data == NULL || PubKey == NULL) {
 645     return EFI_INVALID_PARAMETER;
 646   }
 647
 648   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
 649   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
 650
 651   //
 652   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
 653   // Cert type should be EFI_CERT_TYPE_RSA2048_SHA256_GUID.
 654   //
 655   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
 656       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertTypeRsa2048Sha256Guid)
 657         ) {
 658     //
 659     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
 660     //
 661     return EFI_SECURITY_VIOLATION;
 662   }
 663   //
 664   // Hash data payload with SHA256.
 665   //
 666   ZeroMem (Digest, SHA256_DIGEST_SIZE);
 667   Status  = Sha256Init (mHashCtx);
 668   if (!Status) {
 669     goto Done;
 670   }
 671   Status  = Sha256Update (mHashCtx, Data + AUTHINFO_SIZE, PayloadSize);
 672   if (!Status) {
 673     goto Done;
 674   }
 675   //
 676   // Hash Size.
 677   //
 678   Status  = Sha256Update (mHashCtx, &PayloadSize, sizeof (UINTN));
 679   if (!Status) {
 680     goto Done;
 681   }
 682   //
 683   // Hash Monotonic Count.
 684   //
 685   Status  = Sha256Update (mHashCtx, &CertData->MonotonicCount, sizeof (UINT64));
 686   if (!Status) {
 687     goto Done;
 688   }
 689   Status  = Sha256Final (mHashCtx, Digest);
 690   if (!Status) {
 691     goto Done;
 692   }
 693   //
 694   // Generate & Initialize RSA Context.
 695   //
 696   Rsa = RsaNew ();
 697   ASSERT (Rsa != NULL);
 698   //
 699   // Set RSA Key Components.
 700   // NOTE: Only N and E are needed to be set as RSA public key for signature verification.
 701   //
 702   Status = RsaSetKey (Rsa, RsaKeyN, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 703   if (!Status) {
 704     goto Done;
 705   }
 706   Status = RsaSetKey (Rsa, RsaKeyE, mRsaE, sizeof (mRsaE));
 707   if (!Status) {
 708     goto Done;
 709   }
 710   //
 711   // Verify the signature.
 712   //
 713   Status = RsaPkcs1Verify (
 714              Rsa,
 715              Digest,
 716              SHA256_DIGEST_SIZE,
 717              CertBlock->Signature,
 718              EFI_CERT_TYPE_RSA2048_SHA256_SIZE
 719              );
 720
 721 Done:
 722   if (Rsa != NULL) {
 723     RsaFree (Rsa);
 724   }
 725   if (Status) {
 726     return EFI_SUCCESS;
 727   } else {
 728     return EFI_SECURITY_VIOLATION;
 729   }
 730 }
 731
 732 /**
 733   Update platform mode.
 734
 735   @param[in]      Mode                    SETUP_MODE or USER_MODE.
 736
 737   @return EFI_INVALID_PARAMETER           Invalid parameter.
 738   @return EFI_SUCCESS                     Update platform mode successfully.
 739
 740 **/
 741 EFI_STATUS
 742 UpdatePlatformMode (
 743   IN  UINT32                    Mode
 744   )
 745 {
 746   EFI_STATUS              Status;
 747   VARIABLE_POINTER_TRACK  Variable;
 748   UINT8                   SecureBootMode;
 749   UINT8                   SecureBootEnable;
 750   UINTN                   VariableDataSize;
 751
 752   Status = FindVariable (
 753              EFI_SETUP_MODE_NAME,
 754              &gEfiGlobalVariableGuid,
 755              &Variable,
 756              &mVariableModuleGlobal->VariableGlobal,
 757              FALSE
 758              );
 759   if (EFI_ERROR (Status)) {
 760     return Status;
 761   }
 762
 763   //
 764   // Update the value of SetupMode variable by a simple mem copy, this could avoid possible
 765   // variable storage reclaim at runtime.
 766   //
 767   mPlatformMode = (UINT8) Mode;
 768   CopyMem (GetVariableDataPtr (Variable.CurrPtr), &mPlatformMode, sizeof(UINT8));
 769
 770   if (AtRuntime ()) {
 771     //
 772     // SecureBoot Variable indicates whether the platform firmware is operating
 773     // in Secure boot mode (1) or not (0), so we should not change SecureBoot
 774     // Variable in runtime.
 775     //
 776     return Status;
 777   }
 778
 779   //
 780   // Check "SecureBoot" variable's existence.
 781   // If it doesn't exist, firmware has no capability to perform driver signing verification,
 782   // then set "SecureBoot" to 0.
 783   //
 784   Status = FindVariable (
 785              EFI_SECURE_BOOT_MODE_NAME,
 786              &gEfiGlobalVariableGuid,
 787              &Variable,
 788              &mVariableModuleGlobal->VariableGlobal,
 789              FALSE
 790              );
 791   //
 792   // If "SecureBoot" variable exists, then check "SetupMode" variable update.
 793   // If "SetupMode" variable is USER_MODE, "SecureBoot" variable is set to 1.
 794   // If "SetupMode" variable is SETUP_MODE, "SecureBoot" variable is set to 0.
 795   //
 796   if (Variable.CurrPtr == NULL) {
 797     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 798   } else {
 799     if (mPlatformMode == USER_MODE) {
 800       SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 801     } else if (mPlatformMode == SETUP_MODE) {
 802       SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 803     } else {
 804       return EFI_NOT_FOUND;
 805     }
 806   }
 807
 808   Status  = UpdateVariable (
 809               EFI_SECURE_BOOT_MODE_NAME,
 810               &gEfiGlobalVariableGuid,
 811               &SecureBootMode,
 812               sizeof(UINT8),
 813               EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 814               0,
 815               0,
 816               &Variable,
 817               NULL
 818               );
 819   if (EFI_ERROR (Status)) {
 820     return Status;
 821   }
 822
 823   //
 824   // Check "SecureBootEnable" variable's existence. It can enable/disable secure boot feature.
 825   //
 826   Status = FindVariable (
 827              EFI_SECURE_BOOT_ENABLE_NAME,
 828              &gEfiSecureBootEnableDisableGuid,
 829              &Variable,
 830              &mVariableModuleGlobal->VariableGlobal,
 831              FALSE
 832              );
 833
 834   if (SecureBootMode == SECURE_BOOT_MODE_ENABLE) {
 835     //
 836     // Create the "SecureBootEnable" variable as secure boot is enabled.
 837     //
 838     SecureBootEnable = SECURE_BOOT_ENABLE;
 839     VariableDataSize = sizeof (SecureBootEnable);
 840   } else {
 841     //
 842     // Delete the "SecureBootEnable" variable if this variable exist as "SecureBoot"
 843     // variable is not in secure boot state.
 844     //
 845     if (Variable.CurrPtr == NULL || EFI_ERROR (Status)) {
 846       return EFI_SUCCESS;
 847     }
 848     SecureBootEnable = SECURE_BOOT_DISABLE;
 849     VariableDataSize = 0;
 850   }
 851
 852   Status = UpdateVariable (
 853              EFI_SECURE_BOOT_ENABLE_NAME,
 854              &gEfiSecureBootEnableDisableGuid,
 855              &SecureBootEnable,
 856              VariableDataSize,
 857              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 858              0,
 859              0,
 860              &Variable,
 861              NULL
 862              );
 863   return Status;
 864 }
 865
 866 /**
 867   Check input data form to make sure it is a valid EFI_SIGNATURE_LIST for PK/KEK/db/dbx/dbt variable.
 868
 869   @param[in]  VariableName                Name of Variable to be check.
 870   @param[in]  VendorGuid                  Variable vendor GUID.
 871   @param[in]  Data                        Point to the variable data to be checked.
 872   @param[in]  DataSize                    Size of Data.
 873
 874   @return EFI_INVALID_PARAMETER           Invalid signature list format.
 875   @return EFI_SUCCESS                     Passed signature list format check successfully.
 876
 877 **/
 878 EFI_STATUS
 879 CheckSignatureListFormat(
 880   IN  CHAR16                    *VariableName,
 881   IN  EFI_GUID                  *VendorGuid,
 882   IN  VOID                      *Data,
 883   IN  UINTN                     DataSize
 884   )
 885 {
 886   EFI_SIGNATURE_LIST     *SigList;
 887   UINTN                  SigDataSize;
 888   UINT32                 Index;
 889   UINT32                 SigCount;
 890   BOOLEAN                IsPk;
 891   VOID                   *RsaContext;
 892   EFI_SIGNATURE_DATA     *CertData;
 893   UINTN                  CertLen;
 894
 895   if (DataSize == 0) {
 896     return EFI_SUCCESS;
 897   }
 898
 899   ASSERT (VariableName != NULL && VendorGuid != NULL && Data != NULL);
 900
 901   if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_PLATFORM_KEY_NAME) == 0)){
 902     IsPk = TRUE;
 903   } else if ((CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0)) ||
 904              (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&
 905              ((StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0) || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0) ||
 906               (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0)))) {
 907     IsPk = FALSE;
 908   } else {
 909     return EFI_SUCCESS;
 910   }
 911
 912   SigCount = 0;
 913   SigList  = (EFI_SIGNATURE_LIST *) Data;
 914   SigDataSize  = DataSize;
 915   RsaContext = NULL;
 916
 917   //
 918   // Walk throuth the input signature list and check the data format.
 919   // If any signature is incorrectly formed, the whole check will fail.
 920   //
 921   while ((SigDataSize > 0) && (SigDataSize >= SigList->SignatureListSize)) {
 922     for (Index = 0; Index < (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM)); Index++ ) {
 923       if (CompareGuid (&SigList->SignatureType, &mSupportSigItem[Index].SigType)) {
 924         //
 925         // The value of SignatureSize should always be 16 (size of SignatureOwner
 926         // component) add the data length according to signature type.
 927         //
 928         if (mSupportSigItem[Index].SigDataSize != ((UINT32) ~0) &&
 929           (SigList->SignatureSize - sizeof (EFI_GUID)) != mSupportSigItem[Index].SigDataSize) {
 930           return EFI_INVALID_PARAMETER;
 931         }
 932         if (mSupportSigItem[Index].SigHeaderSize != ((UINTN) ~0) &&
 933           SigList->SignatureHeaderSize != mSupportSigItem[Index].SigHeaderSize) {
 934           return EFI_INVALID_PARAMETER;
 935         }
 936         break;
 937       }
 938     }
 939
 940     if (Index == (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM))) {
 941       //
 942       // Undefined signature type.
 943       //
 944       return EFI_INVALID_PARAMETER;
 945     }
 946
 947     if (CompareGuid (&SigList->SignatureType, &gEfiCertX509Guid)) {
 948       //
 949       // Try to retrieve the RSA public key from the X.509 certificate.
 950       // If this operation fails, it's not a valid certificate.
 951       //
 952       RsaContext = RsaNew ();
 953       if (RsaContext == NULL) {
 954         return EFI_INVALID_PARAMETER;
 955       }
 956       CertData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigList + sizeof (EFI_SIGNATURE_LIST) + SigList->SignatureHeaderSize);
 957       CertLen = SigList->SignatureSize - sizeof (EFI_GUID);
 958       if (!RsaGetPublicKeyFromX509 (CertData->SignatureData, CertLen, &RsaContext)) {
 959         RsaFree (RsaContext);
 960         return EFI_INVALID_PARAMETER;
 961       }
 962       RsaFree (RsaContext);
 963     }
 964
 965     if ((SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) % SigList->SignatureSize != 0) {
 966       return EFI_INVALID_PARAMETER;
 967     }
 968     SigCount += (SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) / SigList->SignatureSize;
 969
 970     SigDataSize -= SigList->SignatureListSize;
 971     SigList = (EFI_SIGNATURE_LIST *) ((UINT8 *) SigList + SigList->SignatureListSize);
 972   }
 973
 974   if (((UINTN) SigList - (UINTN) Data) != DataSize) {
 975     return EFI_INVALID_PARAMETER;
 976   }
 977
 978   if (IsPk && SigCount > 1) {
 979     return EFI_INVALID_PARAMETER;
 980   }
 981
 982   return EFI_SUCCESS;
 983 }
 984
 985 /**
 986   Update "VendorKeys" variable to record the out of band secure boot key modification.
 987
 988   @return EFI_SUCCESS           Variable is updated successfully.
 989   @return Others                Failed to update variable.
 990
 991 **/
 992 EFI_STATUS
 993 VendorKeyIsModified (
 994   VOID
 995   )
 996 {
 997   EFI_STATUS              Status;
 998   VARIABLE_POINTER_TRACK  Variable;
 999
1000   if (mVendorKeyState == VENDOR_KEYS_MODIFIED) {
1001     return EFI_SUCCESS;
1002   }
1003   mVendorKeyState = VENDOR_KEYS_MODIFIED;
1004
1005   FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
1006   Status = UpdateVariable (
1007              EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
1008              &gEfiVendorKeysNvGuid,
1009              &mVendorKeyState,
1010              sizeof (UINT8),
1011              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS,
1012              0,
1013              0,
1014              &Variable,
1015              NULL
1016              );
1017   if (EFI_ERROR (Status)) {
1018     return Status;
1019   }
1020
1021   FindVariable (EFI_VENDOR_KEYS_VARIABLE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
1022   return UpdateVariable (
1023            EFI_VENDOR_KEYS_VARIABLE_NAME,
1024            &gEfiGlobalVariableGuid,
1025            &mVendorKeyState,
1026            sizeof (UINT8),
1027            EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
1028            0,
1029            0,
1030            &Variable,
1031            NULL
1032            );
1033 }
1034
1035 /**
1036   Process variable with platform key for verification.
1037
1038   Caution: This function may receive untrusted input.
1039   This function may be invoked in SMM mode, and datasize and data are external input.
1040   This function will do basic validation, before parse the data.
1041   This function will parse the authentication carefully to avoid security issues, like
1042   buffer overflow, integer overflow.
1043   This function will check attribute carefully to avoid authentication bypass.
1044
1045   @param[in]  VariableName                Name of Variable to be found.
1046   @param[in]  VendorGuid                  Variable vendor GUID.
1047   @param[in]  Data                        Data pointer.
1048   @param[in]  DataSize                    Size of Data found. If size is less than the
1049                                           data, this value contains the required size.
1050   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1051   @param[in]  Attributes                  Attribute value of the variable
1052   @param[in]  IsPk                        Indicate whether it is to process pk.
1053
1054   @return EFI_INVALID_PARAMETER           Invalid parameter.
1055   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation.
1056                                           check carried out by the firmware.
1057   @return EFI_SUCCESS                     Variable passed validation successfully.
1058
1059 **/
1060 EFI_STATUS
1061 ProcessVarWithPk (
1062   IN  CHAR16                    *VariableName,
1063   IN  EFI_GUID                  *VendorGuid,
1064   IN  VOID                      *Data,
1065   IN  UINTN                     DataSize,
1066   IN  VARIABLE_POINTER_TRACK    *Variable,
1067   IN  UINT32                    Attributes OPTIONAL,
1068   IN  BOOLEAN                   IsPk
1069   )
1070 {
1071   EFI_STATUS                  Status;
1072   BOOLEAN                     Del;
1073   UINT8                       *Payload;
1074   UINTN                       PayloadSize;
1075
1076   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1077       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1078     //
1079     // PK, KEK and db/dbx/dbt should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1080     // authenticated variable.
1081     //
1082     return EFI_INVALID_PARAMETER;
1083   }
1084
1085   Del = FALSE;
1086   if ((InCustomMode() && UserPhysicalPresent()) || (mPlatformMode == SETUP_MODE && !IsPk)) {
1087     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1088     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1089     if (PayloadSize == 0) {
1090       Del = TRUE;
1091     }
1092
1093     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
1094     if (EFI_ERROR (Status)) {
1095       return Status;
1096     }
1097
1098     Status = UpdateVariable (
1099                VariableName,
1100                VendorGuid,
1101                Payload,
1102                PayloadSize,
1103                Attributes,
1104                0,
1105                0,
1106                Variable,
1107                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1108                );
1109     if (EFI_ERROR(Status)) {
1110       return Status;
1111     }
1112
1113     if ((mPlatformMode != SETUP_MODE) || IsPk) {
1114       Status = VendorKeyIsModified ();
1115     }
1116   } else if (mPlatformMode == USER_MODE) {
1117     //
1118     // Verify against X509 Cert in PK database.
1119     //
1120     Status = VerifyTimeBasedPayload (
1121                VariableName,
1122                VendorGuid,
1123                Data,
1124                DataSize,
1125                Variable,
1126                Attributes,
1127                AuthVarTypePk,
1128                &Del
1129                );
1130   } else {
1131     //
1132     // Verify against the certificate in data payload.
1133     //
1134     Status = VerifyTimeBasedPayload (
1135                VariableName,
1136                VendorGuid,
1137                Data,
1138                DataSize,
1139                Variable,
1140                Attributes,
1141                AuthVarTypePayload,
1142                &Del
1143                );
1144   }
1145
1146   if (!EFI_ERROR(Status) && IsPk) {
1147     if (mPlatformMode == SETUP_MODE && !Del) {
1148       //
1149       // If enroll PK in setup mode, need change to user mode.
1150       //
1151       Status = UpdatePlatformMode (USER_MODE);
1152     } else if (mPlatformMode == USER_MODE && Del){
1153       //
1154       // If delete PK in user mode, need change to setup mode.
1155       //
1156       Status = UpdatePlatformMode (SETUP_MODE);
1157     }
1158   }
1159
1160   return Status;
1161 }
1162
1163 /**
1164   Process variable with key exchange key for verification.
1165
1166   Caution: This function may receive untrusted input.
1167   This function may be invoked in SMM mode, and datasize and data are external input.
1168   This function will do basic validation, before parse the data.
1169   This function will parse the authentication carefully to avoid security issues, like
1170   buffer overflow, integer overflow.
1171   This function will check attribute carefully to avoid authentication bypass.
1172
1173   @param[in]  VariableName                Name of Variable to be found.
1174   @param[in]  VendorGuid                  Variable vendor GUID.
1175   @param[in]  Data                        Data pointer.
1176   @param[in]  DataSize                    Size of Data found. If size is less than the
1177                                           data, this value contains the required size.
1178   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1179   @param[in]  Attributes                  Attribute value of the variable.
1180
1181   @return EFI_INVALID_PARAMETER           Invalid parameter.
1182   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
1183                                           check carried out by the firmware.
1184   @return EFI_SUCCESS                     Variable pass validation successfully.
1185
1186 **/
1187 EFI_STATUS
1188 ProcessVarWithKek (
1189   IN  CHAR16                               *VariableName,
1190   IN  EFI_GUID                             *VendorGuid,
1191   IN  VOID                                 *Data,
1192   IN  UINTN                                DataSize,
1193   IN  VARIABLE_POINTER_TRACK               *Variable,
1194   IN  UINT32                               Attributes OPTIONAL
1195   )
1196 {
1197   EFI_STATUS                      Status;
1198   UINT8                           *Payload;
1199   UINTN                           PayloadSize;
1200
1201   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1202       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1203     //
1204     // DB, DBX and DBT should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1205     // authenticated variable.
1206     //
1207     return EFI_INVALID_PARAMETER;
1208   }
1209
1210   Status = EFI_SUCCESS;
1211   if (mPlatformMode == USER_MODE && !(InCustomMode() && UserPhysicalPresent())) {
1212     //
1213     // Time-based, verify against X509 Cert KEK.
1214     //
1215     return VerifyTimeBasedPayload (
1216              VariableName,
1217              VendorGuid,
1218              Data,
1219              DataSize,
1220              Variable,
1221              Attributes,
1222              AuthVarTypeKek,
1223              NULL
1224              );
1225   } else {
1226     //
1227     // If in setup mode or custom secure boot mode, no authentication needed.
1228     //
1229     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1230     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1231
1232     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
1233     if (EFI_ERROR (Status)) {
1234       return Status;
1235     }
1236
1237     Status = UpdateVariable (
1238                VariableName,
1239                VendorGuid,
1240                Payload,
1241                PayloadSize,
1242                Attributes,
1243                0,
1244                0,
1245                Variable,
1246                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1247                );
1248     if (EFI_ERROR (Status)) {
1249       return Status;
1250     }
1251
1252     if (mPlatformMode != SETUP_MODE) {
1253       Status = VendorKeyIsModified ();
1254     }
1255   }
1256
1257   return Status;
1258 }
1259
1260 /**
1261   Check if it is to delete auth variable.
1262
1263   @param[in] Data               Data pointer.
1264   @param[in] DataSize           Size of Data.
1265   @param[in] Variable           The variable information which is used to keep track of variable usage.
1266   @param[in] Attributes         Attribute value of the variable.
1267
1268   @retval TRUE                  It is to delete auth variable.
1269   @retval FALSE                 It is not to delete auth variable.
1270
1271 **/
1272 BOOLEAN
1273 IsDeleteAuthVariable (
1274   IN  VOID                      *Data,
1275   IN  UINTN                     DataSize,
1276   IN  VARIABLE_POINTER_TRACK    *Variable,
1277   IN  UINT32                    Attributes
1278   )
1279 {
1280   BOOLEAN                       Del;
1281   UINTN                         PayloadSize;
1282
1283   Del = FALSE;
1284
1285   //
1286   // To delete a variable created with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
1287   // or the EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS attribute,
1288   // SetVariable must be used with attributes matching the existing variable
1289   // and the DataSize set to the size of the AuthInfo descriptor.
1290   //
1291   if ((Variable->CurrPtr != NULL) &&
1292       (Attributes == Variable->CurrPtr->Attributes) &&
1293       ((Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)) {
1294     if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1295       PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1296       if (PayloadSize == 0) {
1297         Del = TRUE;
1298       }
1299     } else {
1300       PayloadSize = DataSize - AUTHINFO_SIZE;
1301       if (PayloadSize == 0) {
1302         Del = TRUE;
1303       }
1304     }
1305   }
1306
1307   return Del;
1308 }
1309
1310 /**
1311   Process variable with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS/EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
1312
1313   Caution: This function may receive untrusted input.
1314   This function may be invoked in SMM mode, and datasize and data are external input.
1315   This function will do basic validation, before parse the data.
1316   This function will parse the authentication carefully to avoid security issues, like
1317   buffer overflow, integer overflow.
1318   This function will check attribute carefully to avoid authentication bypass.
1319
1320   @param[in]  VariableName                Name of Variable to be found.
1321   @param[in]  VendorGuid                  Variable vendor GUID.
1322
1323   @param[in]  Data                        Data pointer.
1324   @param[in]  DataSize                    Size of Data.
1325   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1326   @param[in]  Attributes                  Attribute value of the variable.
1327
1328   @return EFI_INVALID_PARAMETER           Invalid parameter.
1329   @return EFI_WRITE_PROTECTED             Variable is write-protected and needs authentication with
1330                                           EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1331   @return EFI_OUT_OF_RESOURCES            The Database to save the public key is full.
1332   @return EFI_SECURITY_VIOLATION          The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
1333                                           set, but the AuthInfo does NOT pass the validation
1334                                           check carried out by the firmware.
1335   @return EFI_SUCCESS                     Variable is not write-protected or pass validation successfully.
1336
1337 **/
1338 EFI_STATUS
1339 ProcessVariable (
1340   IN     CHAR16                             *VariableName,
1341   IN     EFI_GUID                           *VendorGuid,
1342   IN     VOID                               *Data,
1343   IN     UINTN                              DataSize,
1344   IN     VARIABLE_POINTER_TRACK             *Variable,
1345   IN     UINT32                             Attributes
1346   )
1347 {
1348   EFI_STATUS                      Status;
1349   BOOLEAN                         IsDeletion;
1350   BOOLEAN                         IsFirstTime;
1351   UINT8                           *PubKey;
1352   EFI_VARIABLE_AUTHENTICATION     *CertData;
1353   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
1354   UINT32                          KeyIndex;
1355   UINT64                          MonotonicCount;
1356   VARIABLE_ENTRY_CONSISTENCY      VariableDataEntry;
1357
1358   KeyIndex    = 0;
1359   CertData    = NULL;
1360   CertBlock   = NULL;
1361   PubKey      = NULL;
1362   IsDeletion  = FALSE;
1363   Status      = EFI_SUCCESS;
1364
1365   if (IsDeleteAuthVariable (Data, DataSize, Variable, Attributes) && UserPhysicalPresent()) {
1366     //
1367     // Allow the delete operation of common authenticated variable at user physical presence.
1368     //
1369     if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1370       Status = DeleteCertsFromDb (VariableName, VendorGuid);
1371     }
1372     if (!EFI_ERROR (Status)) {
1373       Status = UpdateVariable (
1374                  VariableName,
1375                  VendorGuid,
1376                  NULL,
1377                  0,
1378                  0,
1379                  0,
1380                  0,
1381                  Variable,
1382                  NULL
1383                  );
1384     }
1385     return Status;
1386   }
1387
1388   if (NeedPhysicallyPresent (VariableName, VendorGuid) && !UserPhysicalPresent()) {
1389     //
1390     // This variable is protected, only physical present user could modify its value.
1391     //
1392     return EFI_SECURITY_VIOLATION;
1393   }
1394
1395   //
1396   // A time-based authenticated variable and a count-based authenticated variable
1397   // can't be updated by each other.
1398   //
1399   if (Variable->CurrPtr != NULL) {
1400     if (((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) &&
1401         ((Variable->CurrPtr->Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0)) {
1402       return EFI_SECURITY_VIOLATION;
1403     }
1404
1405     if (((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) &&
1406         ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0)) {
1407       return EFI_SECURITY_VIOLATION;
1408     }
1409   }
1410
1411   //
1412   // Process Time-based Authenticated variable.
1413   //
1414   if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1415     return VerifyTimeBasedPayload (
1416              VariableName,
1417              VendorGuid,
1418              Data,
1419              DataSize,
1420              Variable,
1421              Attributes,
1422              AuthVarTypePriv,
1423              NULL
1424              );
1425   }
1426
1427   //
1428   // Determine if first time SetVariable with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS.
1429   //
1430   if ((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) {
1431     //
1432     // Determine current operation type.
1433     //
1434     if (DataSize == AUTHINFO_SIZE) {
1435       IsDeletion = TRUE;
1436     }
1437     //
1438     // Determine whether this is the first time with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1439     //
1440     if (Variable->CurrPtr == NULL) {
1441       IsFirstTime = TRUE;
1442     } else if ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) == 0) {
1443       IsFirstTime = TRUE;
1444     } else {
1445       KeyIndex   = Variable->CurrPtr->PubKeyIndex;
1446       IsFirstTime = FALSE;
1447     }
1448   } else if ((Variable->CurrPtr != NULL) &&
1449              ((Variable->CurrPtr->Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)
1450             ) {
1451     //
1452     // If the variable is already write-protected, it always needs authentication before update.
1453     //
1454     return EFI_WRITE_PROTECTED;
1455   } else {
1456     //
1457     // If without EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS, set and attributes collision.
1458     // That means it is not authenticated variable, just update variable as usual.
1459     //
1460     Status = UpdateVariable (VariableName, VendorGuid, Data, DataSize, Attributes, 0, 0, Variable, NULL);
1461     return Status;
1462   }
1463
1464   //
1465   // Get PubKey and check Monotonic Count value corresponding to the variable.
1466   //
1467   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
1468   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
1469   PubKey    = CertBlock->PublicKey;
1470
1471   //
1472   // Update Monotonic Count value.
1473   //
1474   MonotonicCount = CertData->MonotonicCount;
1475
1476   if (!IsFirstTime) {
1477     //
1478     // 2 cases need to check here
1479     //   1. Internal PubKey variable. PubKeyIndex is always 0
1480     //   2. Other counter-based AuthVariable. Check input PubKey.
1481     //
1482     if (KeyIndex == 0 || CompareMem (PubKey, mPubKeyStore + (KeyIndex - 1) * EFI_CERT_TYPE_RSA2048_SIZE, EFI_CERT_TYPE_RSA2048_SIZE) != 0) {
1483       return EFI_SECURITY_VIOLATION;
1484     }
1485     //
1486     // Compare the current monotonic count and ensure that it is greater than the last SetVariable
1487     // operation with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS attribute set.
1488     //
1489     if (CertData->MonotonicCount <= Variable->CurrPtr->MonotonicCount) {
1490       //
1491       // Monotonic count check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
1492       //
1493       return EFI_SECURITY_VIOLATION;
1494     }
1495   }
1496   //
1497   // Verify the certificate in Data payload.
1498   //
1499   Status = VerifyCounterBasedPayload (Data, DataSize, PubKey);
1500   if (EFI_ERROR (Status)) {
1501     return Status;
1502   }
1503
1504   //
1505   // Now, the signature has been verified!
1506   //
1507   if (IsFirstTime && !IsDeletion) {
1508     VariableDataEntry.VariableSize = DataSize - AUTHINFO_SIZE;
1509     VariableDataEntry.Guid         = VendorGuid;
1510     VariableDataEntry.Name         = VariableName;
1511
1512     //
1513     // Update public key database variable if need.
1514     //
1515     KeyIndex = AddPubKeyInStore (PubKey, &VariableDataEntry);
1516     if (KeyIndex == 0) {
1517       return EFI_OUT_OF_RESOURCES;
1518     }
1519   }
1520
1521   //
1522   // Verification pass.
1523   //
1524   return UpdateVariable (VariableName, VendorGuid, (UINT8*)Data + AUTHINFO_SIZE, DataSize - AUTHINFO_SIZE, Attributes, KeyIndex, MonotonicCount, Variable, NULL);
1525 }
1526
1527 /**
1528   Merge two buffers which formatted as EFI_SIGNATURE_LIST. Only the new EFI_SIGNATURE_DATA
1529   will be appended to the original EFI_SIGNATURE_LIST, duplicate EFI_SIGNATURE_DATA
1530   will be ignored.
1531
1532   @param[in, out]  Data              Pointer to original EFI_SIGNATURE_LIST.
1533   @param[in]       DataSize          Size of Data buffer.
1534   @param[in]       FreeBufSize       Size of free data buffer
1535   @param[in]       NewData           Pointer to new EFI_SIGNATURE_LIST to be appended.
1536   @param[in]       NewDataSize       Size of NewData buffer.
1537   @param[out]      MergedBufSize     Size of the merged buffer
1538
1539   @return EFI_BUFFER_TOO_SMALL if input Data buffer overflowed
1540
1541 **/
1542 EFI_STATUS
1543 AppendSignatureList (
1544   IN  OUT VOID            *Data,
1545   IN  UINTN               DataSize,
1546   IN  UINTN               FreeBufSize,
1547   IN  VOID                *NewData,
1548   IN  UINTN               NewDataSize,
1549   OUT UINTN               *MergedBufSize
1550   )
1551 {
1552   EFI_SIGNATURE_LIST  *CertList;
1553   EFI_SIGNATURE_DATA  *Cert;
1554   UINTN               CertCount;
1555   EFI_SIGNATURE_LIST  *NewCertList;
1556   EFI_SIGNATURE_DATA  *NewCert;
1557   UINTN               NewCertCount;
1558   UINTN               Index;
1559   UINTN               Index2;
1560   UINTN               Size;
1561   UINT8               *Tail;
1562   UINTN               CopiedCount;
1563   UINTN               SignatureListSize;
1564   BOOLEAN             IsNewCert;
1565
1566   Tail = (UINT8 *) Data + DataSize;
1567
1568   NewCertList = (EFI_SIGNATURE_LIST *) NewData;
1569   while ((NewDataSize > 0) && (NewDataSize >= NewCertList->SignatureListSize)) {
1570     NewCert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCertList + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1571     NewCertCount = (NewCertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - NewCertList->SignatureHeaderSize) / NewCertList->SignatureSize;
1572
1573     CopiedCount = 0;
1574     for (Index = 0; Index < NewCertCount; Index++) {
1575       IsNewCert = TRUE;
1576
1577       Size = DataSize;
1578       CertList = (EFI_SIGNATURE_LIST *) Data;
1579       while ((Size > 0) && (Size >= CertList->SignatureListSize)) {
1580         if (CompareGuid (&CertList->SignatureType, &NewCertList->SignatureType) &&
1581            (CertList->SignatureSize == NewCertList->SignatureSize)) {
1582           Cert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
1583           CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
1584           for (Index2 = 0; Index2 < CertCount; Index2++) {
1585             //
1586             // Iterate each Signature Data in this Signature List.
1587             //
1588             if (CompareMem (NewCert, Cert, CertList->SignatureSize) == 0) {
1589               IsNewCert = FALSE;
1590               break;
1591             }
1592             Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
1593           }
1594         }
1595
1596         if (!IsNewCert) {
1597           break;
1598         }
1599         Size -= CertList->SignatureListSize;
1600         CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
1601       }
1602
1603       if (IsNewCert) {
1604         //
1605         // New EFI_SIGNATURE_DATA, append it.
1606         //
1607         if (CopiedCount == 0) {
1608           if (FreeBufSize < sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize) {
1609             return EFI_BUFFER_TOO_SMALL;
1610           }
1611
1612           //
1613           // Copy EFI_SIGNATURE_LIST header for only once.
1614           //
1615
1616           CopyMem (Tail, NewCertList, sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1617           Tail = Tail + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1618           FreeBufSize -= sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1619         }
1620
1621         if (FreeBufSize < NewCertList->SignatureSize) {
1622           return EFI_BUFFER_TOO_SMALL;
1623         }
1624         CopyMem (Tail, NewCert, NewCertList->SignatureSize);
1625         Tail += NewCertList->SignatureSize;
1626         FreeBufSize -= NewCertList->SignatureSize;
1627         CopiedCount++;
1628       }
1629
1630       NewCert = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCert + NewCertList->SignatureSize);
1631     }
1632
1633     //
1634     // Update SignatureListSize in newly appended EFI_SIGNATURE_LIST.
1635     //
1636     if (CopiedCount != 0) {
1637       SignatureListSize = sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize + (CopiedCount * NewCertList->SignatureSize);
1638       CertList = (EFI_SIGNATURE_LIST *) (Tail - SignatureListSize);
1639       CertList->SignatureListSize = (UINT32) SignatureListSize;
1640     }
1641
1642     NewDataSize -= NewCertList->SignatureListSize;
1643     NewCertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) NewCertList + NewCertList->SignatureListSize);
1644   }
1645
1646   *MergedBufSize = (Tail - (UINT8 *) Data);
1647   return EFI_SUCCESS;
1648 }
1649
1650 /**
1651   Compare two EFI_TIME data.
1652
1653
1654   @param FirstTime           A pointer to the first EFI_TIME data.
1655   @param SecondTime          A pointer to the second EFI_TIME data.
1656
1657   @retval  TRUE              The FirstTime is not later than the SecondTime.
1658   @retval  FALSE             The FirstTime is later than the SecondTime.
1659
1660 **/
1661 BOOLEAN
1662 CompareTimeStamp (
1663   IN EFI_TIME               *FirstTime,
1664   IN EFI_TIME               *SecondTime
1665   )
1666 {
1667   if (FirstTime->Year != SecondTime->Year) {
1668     return (BOOLEAN) (FirstTime->Year < SecondTime->Year);
1669   } else if (FirstTime->Month != SecondTime->Month) {
1670     return (BOOLEAN) (FirstTime->Month < SecondTime->Month);
1671   } else if (FirstTime->Day != SecondTime->Day) {
1672     return (BOOLEAN) (FirstTime->Day < SecondTime->Day);
1673   } else if (FirstTime->Hour != SecondTime->Hour) {
1674     return (BOOLEAN) (FirstTime->Hour < SecondTime->Hour);
1675   } else if (FirstTime->Minute != SecondTime->Minute) {
1676     return (BOOLEAN) (FirstTime->Minute < SecondTime->Minute);
1677   }
1678
1679   return (BOOLEAN) (FirstTime->Second <= SecondTime->Second);
1680 }
1681
1682 /**
1683   Find matching signer's certificates for common authenticated variable
1684   by corresponding VariableName and VendorGuid from "certdb".
1685
1686   The data format of "certdb":
1687   //
1688   //     UINT32 CertDbListSize;
1689   // /// AUTH_CERT_DB_DATA Certs1[];
1690   // /// AUTH_CERT_DB_DATA Certs2[];
1691   // /// ...
1692   // /// AUTH_CERT_DB_DATA Certsn[];
1693   //
1694
1695   @param[in]  VariableName   Name of authenticated Variable.
1696   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1697   @param[in]  Data           Pointer to variable "certdb".
1698   @param[in]  DataSize       Size of variable "certdb".
1699   @param[out] CertOffset     Offset of matching CertData, from starting of Data.
1700   @param[out] CertDataSize   Length of CertData in bytes.
1701   @param[out] CertNodeOffset Offset of matching AUTH_CERT_DB_DATA , from
1702                              starting of Data.
1703   @param[out] CertNodeSize   Length of AUTH_CERT_DB_DATA in bytes.
1704
1705   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1706   @retval  EFI_NOT_FOUND         Fail to find matching certs.
1707   @retval  EFI_SUCCESS           Find matching certs and output parameters.
1708
1709 **/
1710 EFI_STATUS
1711 FindCertsFromDb (
1712   IN     CHAR16           *VariableName,
1713   IN     EFI_GUID         *VendorGuid,
1714   IN     UINT8            *Data,
1715   IN     UINTN            DataSize,
1716   OUT    UINT32           *CertOffset,    OPTIONAL
1717   OUT    UINT32           *CertDataSize,  OPTIONAL
1718   OUT    UINT32           *CertNodeOffset,OPTIONAL
1719   OUT    UINT32           *CertNodeSize   OPTIONAL
1720   )
1721 {
1722   UINT32                  Offset;
1723   AUTH_CERT_DB_DATA       *Ptr;
1724   UINT32                  CertSize;
1725   UINT32                  NameSize;
1726   UINT32                  NodeSize;
1727   UINT32                  CertDbListSize;
1728
1729   if ((VariableName == NULL) || (VendorGuid == NULL) || (Data == NULL)) {
1730     return EFI_INVALID_PARAMETER;
1731   }
1732
1733   //
1734   // Check whether DataSize matches recorded CertDbListSize.
1735   //
1736   if (DataSize < sizeof (UINT32)) {
1737     return EFI_INVALID_PARAMETER;
1738   }
1739
1740   CertDbListSize = ReadUnaligned32 ((UINT32 *) Data);
1741
1742   if (CertDbListSize != (UINT32) DataSize) {
1743     return EFI_INVALID_PARAMETER;
1744   }
1745
1746   Offset = sizeof (UINT32);
1747
1748   //
1749   // Get corresponding certificates by VendorGuid and VariableName.
1750   //
1751   while (Offset < (UINT32) DataSize) {
1752     Ptr = (AUTH_CERT_DB_DATA *) (Data + Offset);
1753     //
1754     // Check whether VendorGuid matches.
1755     //
1756     if (CompareGuid (&Ptr->VendorGuid, VendorGuid)) {
1757       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1758       NameSize = ReadUnaligned32 (&Ptr->NameSize);
1759       CertSize = ReadUnaligned32 (&Ptr->CertDataSize);
1760
1761       if (NodeSize != sizeof (EFI_GUID) + sizeof (UINT32) * 3 + CertSize +
1762           sizeof (CHAR16) * NameSize) {
1763         return EFI_INVALID_PARAMETER;
1764       }
1765
1766       Offset = Offset + sizeof (EFI_GUID) + sizeof (UINT32) * 3;
1767       //
1768       // Check whether VariableName matches.
1769       //
1770       if ((NameSize == StrLen (VariableName)) &&
1771           (CompareMem (Data + Offset, VariableName, NameSize * sizeof (CHAR16)) == 0)) {
1772         Offset = Offset + NameSize * sizeof (CHAR16);
1773
1774         if (CertOffset != NULL) {
1775           *CertOffset = Offset;
1776         }
1777
1778         if (CertDataSize != NULL) {
1779           *CertDataSize = CertSize;
1780         }
1781
1782         if (CertNodeOffset != NULL) {
1783           *CertNodeOffset = (UINT32) ((UINT8 *) Ptr - Data);
1784         }
1785
1786         if (CertNodeSize != NULL) {
1787           *CertNodeSize = NodeSize;
1788         }
1789
1790         return EFI_SUCCESS;
1791       } else {
1792         Offset = Offset + NameSize * sizeof (CHAR16) + CertSize;
1793       }
1794     } else {
1795       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1796       Offset   = Offset + NodeSize;
1797     }
1798   }
1799
1800   return EFI_NOT_FOUND;
1801 }
1802
1803 /**
1804   Retrieve signer's certificates for common authenticated variable
1805   by corresponding VariableName and VendorGuid from "certdb".
1806
1807   @param[in]  VariableName   Name of authenticated Variable.
1808   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1809   @param[out] CertData       Pointer to signer's certificates.
1810   @param[out] CertDataSize   Length of CertData in bytes.
1811
1812   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1813   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1814   @retval  EFI_SUCCESS           Get signer's certificates successfully.
1815
1816 **/
1817 EFI_STATUS
1818 GetCertsFromDb (
1819   IN     CHAR16           *VariableName,
1820   IN     EFI_GUID         *VendorGuid,
1821   OUT    UINT8            **CertData,
1822   OUT    UINT32           *CertDataSize
1823   )
1824 {
1825   VARIABLE_POINTER_TRACK  CertDbVariable;
1826   EFI_STATUS              Status;
1827   UINT8                   *Data;
1828   UINTN                   DataSize;
1829   UINT32                  CertOffset;
1830
1831   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL) || (CertDataSize == NULL)) {
1832     return EFI_INVALID_PARAMETER;
1833   }
1834
1835   //
1836   // Get variable "certdb".
1837   //
1838   Status = FindVariable (
1839              EFI_CERT_DB_NAME,
1840              &gEfiCertDbGuid,
1841              &CertDbVariable,
1842              &mVariableModuleGlobal->VariableGlobal,
1843              FALSE
1844              );
1845   if (EFI_ERROR (Status)) {
1846     return Status;
1847   }
1848
1849   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1850   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1851   if ((DataSize == 0) || (Data == NULL)) {
1852     ASSERT (FALSE);
1853     return EFI_NOT_FOUND;
1854   }
1855
1856   Status = FindCertsFromDb (
1857              VariableName,
1858              VendorGuid,
1859              Data,
1860              DataSize,
1861              &CertOffset,
1862              CertDataSize,
1863              NULL,
1864              NULL
1865              );
1866
1867   if (EFI_ERROR (Status)) {
1868     return Status;
1869   }
1870
1871   *CertData = Data + CertOffset;
1872   return EFI_SUCCESS;
1873 }
1874
1875 /**
1876   Delete matching signer's certificates when deleting common authenticated
1877   variable by corresponding VariableName and VendorGuid from "certdb".
1878
1879   @param[in]  VariableName   Name of authenticated Variable.
1880   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1881
1882   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1883   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1884   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
1885   @retval  EFI_SUCCESS           The operation is completed successfully.
1886
1887 **/
1888 EFI_STATUS
1889 DeleteCertsFromDb (
1890   IN     CHAR16           *VariableName,
1891   IN     EFI_GUID         *VendorGuid
1892   )
1893 {
1894   VARIABLE_POINTER_TRACK  CertDbVariable;
1895   EFI_STATUS              Status;
1896   UINT8                   *Data;
1897   UINTN                   DataSize;
1898   UINT32                  VarAttr;
1899   UINT32                  CertNodeOffset;
1900   UINT32                  CertNodeSize;
1901   UINT8                   *NewCertDb;
1902   UINT32                  NewCertDbSize;
1903
1904   if ((VariableName == NULL) || (VendorGuid == NULL)) {
1905     return EFI_INVALID_PARAMETER;
1906   }
1907
1908   //
1909   // Get variable "certdb".
1910   //
1911   Status = FindVariable (
1912              EFI_CERT_DB_NAME,
1913              &gEfiCertDbGuid,
1914              &CertDbVariable,
1915              &mVariableModuleGlobal->VariableGlobal,
1916              FALSE
1917              );
1918   if (EFI_ERROR (Status)) {
1919     return Status;
1920   }
1921
1922   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1923   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1924   if ((DataSize == 0) || (Data == NULL)) {
1925     ASSERT (FALSE);
1926     return EFI_NOT_FOUND;
1927   }
1928
1929   if (DataSize == sizeof (UINT32)) {
1930     //
1931     // There is no certs in certdb.
1932     //
1933     return EFI_SUCCESS;
1934   }
1935
1936   //
1937   // Get corresponding cert node from certdb.
1938   //
1939   Status = FindCertsFromDb (
1940              VariableName,
1941              VendorGuid,
1942              Data,
1943              DataSize,
1944              NULL,
1945              NULL,
1946              &CertNodeOffset,
1947              &CertNodeSize
1948              );
1949
1950   if (EFI_ERROR (Status)) {
1951     return Status;
1952   }
1953
1954   if (DataSize < (CertNodeOffset + CertNodeSize)) {
1955     return EFI_NOT_FOUND;
1956   }
1957
1958   //
1959   // Construct new data content of variable "certdb".
1960   //
1961   NewCertDbSize = (UINT32) DataSize - CertNodeSize;
1962   NewCertDb     = (UINT8*) mCertDbStore;
1963
1964   //
1965   // Copy the DB entries before deleting node.
1966   //
1967   CopyMem (NewCertDb, Data, CertNodeOffset);
1968   //
1969   // Update CertDbListSize.
1970   //
1971   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
1972   //
1973   // Copy the DB entries after deleting node.
1974   //
1975   if (DataSize > (CertNodeOffset + CertNodeSize)) {
1976     CopyMem (
1977       NewCertDb + CertNodeOffset,
1978       Data + CertNodeOffset + CertNodeSize,
1979       DataSize - CertNodeOffset - CertNodeSize
1980       );
1981   }
1982
1983   //
1984   // Set "certdb".
1985   //
1986   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
1987   Status   = UpdateVariable (
1988                EFI_CERT_DB_NAME,
1989                &gEfiCertDbGuid,
1990                NewCertDb,
1991                NewCertDbSize,
1992                VarAttr,
1993                0,
1994                0,
1995                &CertDbVariable,
1996                NULL
1997                );
1998
1999   return Status;
2000 }
2001
2002 /**
2003   Insert signer's certificates for common authenticated variable with VariableName
2004   and VendorGuid in AUTH_CERT_DB_DATA to "certdb".
2005
2006   @param[in]  VariableName   Name of authenticated Variable.
2007   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
2008   @param[in]  CertData       Pointer to signer's certificates.
2009   @param[in]  CertDataSize   Length of CertData in bytes.
2010
2011   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
2012   @retval  EFI_ACCESS_DENIED     An AUTH_CERT_DB_DATA entry with same VariableName
2013                                  and VendorGuid already exists.
2014   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
2015   @retval  EFI_SUCCESS           Insert an AUTH_CERT_DB_DATA entry to "certdb"
2016
2017 **/
2018 EFI_STATUS
2019 InsertCertsToDb (
2020   IN     CHAR16           *VariableName,
2021   IN     EFI_GUID         *VendorGuid,
2022   IN     UINT8            *CertData,
2023   IN     UINTN            CertDataSize
2024   )
2025 {
2026   VARIABLE_POINTER_TRACK  CertDbVariable;
2027   EFI_STATUS              Status;
2028   UINT8                   *Data;
2029   UINTN                   DataSize;
2030   UINT32                  VarAttr;
2031   UINT8                   *NewCertDb;
2032   UINT32                  NewCertDbSize;
2033   UINT32                  CertNodeSize;
2034   UINT32                  NameSize;
2035   AUTH_CERT_DB_DATA       *Ptr;
2036
2037   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL)) {
2038     return EFI_INVALID_PARAMETER;
2039   }
2040
2041   //
2042   // Get variable "certdb".
2043   //
2044   Status = FindVariable (
2045              EFI_CERT_DB_NAME,
2046              &gEfiCertDbGuid,
2047              &CertDbVariable,
2048              &mVariableModuleGlobal->VariableGlobal,
2049              FALSE
2050              );
2051   if (EFI_ERROR (Status)) {
2052     return Status;
2053   }
2054
2055   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
2056   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
2057   if ((DataSize == 0) || (Data == NULL)) {
2058     ASSERT (FALSE);
2059     return EFI_NOT_FOUND;
2060   }
2061
2062   //
2063   // Find whether matching cert node already exists in "certdb".
2064   // If yes return error.
2065   //
2066   Status = FindCertsFromDb (
2067              VariableName,
2068              VendorGuid,
2069              Data,
2070              DataSize,
2071              NULL,
2072              NULL,
2073              NULL,
2074              NULL
2075              );
2076
2077   if (!EFI_ERROR (Status)) {
2078     ASSERT (FALSE);
2079     return EFI_ACCESS_DENIED;
2080   }
2081
2082   //
2083   // Construct new data content of variable "certdb".
2084   //
2085   NameSize      = (UINT32) StrLen (VariableName);
2086   CertNodeSize  = sizeof (AUTH_CERT_DB_DATA) + (UINT32) CertDataSize + NameSize * sizeof (CHAR16);
2087   NewCertDbSize = (UINT32) DataSize + CertNodeSize;
2088   if (NewCertDbSize > mMaxCertDbSize) {
2089     return EFI_OUT_OF_RESOURCES;
2090   }
2091   NewCertDb     = (UINT8*) mCertDbStore;
2092
2093   //
2094   // Copy the DB entries before deleting node.
2095   //
2096   CopyMem (NewCertDb, Data, DataSize);
2097   //
2098   // Update CertDbListSize.
2099   //
2100   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
2101   //
2102   // Construct new cert node.
2103   //
2104   Ptr = (AUTH_CERT_DB_DATA *) (NewCertDb + DataSize);
2105   CopyGuid (&Ptr->VendorGuid, VendorGuid);
2106   CopyMem (&Ptr->CertNodeSize, &CertNodeSize, sizeof (UINT32));
2107   CopyMem (&Ptr->NameSize, &NameSize, sizeof (UINT32));
2108   CopyMem (&Ptr->CertDataSize, &CertDataSize, sizeof (UINT32));
2109
2110   CopyMem (
2111     (UINT8 *) Ptr + sizeof (AUTH_CERT_DB_DATA),
2112     VariableName,
2113     NameSize * sizeof (CHAR16)
2114     );
2115
2116   CopyMem (
2117     (UINT8 *) Ptr +  sizeof (AUTH_CERT_DB_DATA) + NameSize * sizeof (CHAR16),
2118     CertData,
2119     CertDataSize
2120     );
2121
2122   //
2123   // Set "certdb".
2124   //
2125   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
2126   Status   = UpdateVariable (
2127                EFI_CERT_DB_NAME,
2128                &gEfiCertDbGuid,
2129                NewCertDb,
2130                NewCertDbSize,
2131                VarAttr,
2132                0,
2133                0,
2134                &CertDbVariable,
2135                NULL
2136                );
2137
2138   return Status;
2139 }
2140
2141 /**
2142   Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
2143
2144   Caution: This function may receive untrusted input.
2145   This function may be invoked in SMM mode, and datasize and data are external input.
2146   This function will do basic validation, before parse the data.
2147   This function will parse the authentication carefully to avoid security issues, like
2148   buffer overflow, integer overflow.
2149
2150   @param[in]  VariableName                Name of Variable to be found.
2151   @param[in]  VendorGuid                  Variable vendor GUID.
2152   @param[in]  Data                        Data pointer.
2153   @param[in]  DataSize                    Size of Data found. If size is less than the
2154                                           data, this value contains the required size.
2155   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
2156   @param[in]  Attributes                  Attribute value of the variable.
2157   @param[in]  AuthVarType                 Verify against PK, KEK database, private database or certificate in data payload.
2158   @param[out] VarDel                      Delete the variable or not.
2159
2160   @retval EFI_INVALID_PARAMETER           Invalid parameter.
2161   @retval EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
2162                                           check carried out by the firmware.
2163   @retval EFI_OUT_OF_RESOURCES            Failed to process variable due to lack
2164                                           of resources.
2165   @retval EFI_SUCCESS                     Variable pass validation successfully.
2166
2167 **/
2168 EFI_STATUS
2169 VerifyTimeBasedPayload (
2170   IN     CHAR16                             *VariableName,
2171   IN     EFI_GUID                           *VendorGuid,
2172   IN     VOID                               *Data,
2173   IN     UINTN                              DataSize,
2174   IN     VARIABLE_POINTER_TRACK             *Variable,
2175   IN     UINT32                             Attributes,
2176   IN     AUTHVAR_TYPE                       AuthVarType,
2177   OUT    BOOLEAN                            *VarDel
2178   )
2179 {
2180   UINT8                            *RootCert;
2181   UINT8                            *SigData;
2182   UINT8                            *PayloadPtr;
2183   UINTN                            RootCertSize;
2184   UINTN                            Index;
2185   UINTN                            CertCount;
2186   UINTN                            PayloadSize;
2187   UINT32                           Attr;
2188   UINT32                           SigDataSize;
2189   UINT32                           KekDataSize;
2190   BOOLEAN                          VerifyStatus;
2191   EFI_STATUS                       Status;
2192   EFI_SIGNATURE_LIST               *CertList;
2193   EFI_SIGNATURE_DATA               *Cert;
2194   VARIABLE_POINTER_TRACK           KekVariable;
2195   EFI_VARIABLE_AUTHENTICATION_2    *CertData;
2196   UINT8                            *NewData;
2197   UINTN                            NewDataSize;
2198   VARIABLE_POINTER_TRACK           PkVariable;
2199   UINT8                            *Buffer;
2200   UINTN                            Length;
2201   UINT8                            *SignerCerts;
2202   UINTN                            CertStackSize;
2203   UINT8                            *CertsInCertDb;
2204   UINT32                           CertsSizeinDb;
2205
2206   VerifyStatus           = FALSE;
2207   CertData               = NULL;
2208   NewData                = NULL;
2209   Attr                   = Attributes;
2210   SignerCerts            = NULL;
2211   RootCert               = NULL;
2212   CertsInCertDb          = NULL;
2213
2214   //
2215   // When the attribute EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS is
2216   // set, then the Data buffer shall begin with an instance of a complete (and serialized)
2217   // EFI_VARIABLE_AUTHENTICATION_2 descriptor. The descriptor shall be followed by the new
2218   // variable value and DataSize shall reflect the combined size of the descriptor and the new
2219   // variable value. The authentication descriptor is not part of the variable data and is not
2220   // returned by subsequent calls to GetVariable().
2221   //
2222   CertData = (EFI_VARIABLE_AUTHENTICATION_2 *) Data;
2223
2224   //
2225   // Verify that Pad1, Nanosecond, TimeZone, Daylight and Pad2 components of the
2226   // TimeStamp value are set to zero.
2227   //
2228   if ((CertData->TimeStamp.Pad1 != 0) ||
2229       (CertData->TimeStamp.Nanosecond != 0) ||
2230       (CertData->TimeStamp.TimeZone != 0) ||
2231       (CertData->TimeStamp.Daylight != 0) ||
2232       (CertData->TimeStamp.Pad2 != 0)) {
2233     return EFI_SECURITY_VIOLATION;
2234   }
2235
2236   if ((Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
2237     if (CompareTimeStamp (&CertData->TimeStamp, &Variable->CurrPtr->TimeStamp)) {
2238       //
2239       // TimeStamp check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
2240       //
2241       return EFI_SECURITY_VIOLATION;
2242     }
2243   }
2244
2245   //
2246   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
2247   // Cert type should be EFI_CERT_TYPE_PKCS7_GUID.
2248   //
2249   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
2250       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertPkcs7Guid)) {
2251     //
2252     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
2253     //
2254     return EFI_SECURITY_VIOLATION;
2255   }
2256
2257   //
2258   // Find out Pkcs7 SignedData which follows the EFI_VARIABLE_AUTHENTICATION_2 descriptor.
2259   // AuthInfo.Hdr.dwLength is the length of the entire certificate, including the length of the header.
2260   //
2261   SigData = CertData->AuthInfo.CertData;
2262   SigDataSize = CertData->AuthInfo.Hdr.dwLength - (UINT32) (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData));
2263
2264   //
2265   // Find out the new data payload which follows Pkcs7 SignedData directly.
2266   //
2267   PayloadPtr = SigData + SigDataSize;
2268   PayloadSize = DataSize - OFFSET_OF_AUTHINFO2_CERT_DATA - (UINTN) SigDataSize;
2269
2270   //
2271   // Construct a serialization buffer of the values of the VariableName, VendorGuid and Attributes
2272   // parameters of the SetVariable() call and the TimeStamp component of the
2273   // EFI_VARIABLE_AUTHENTICATION_2 descriptor followed by the variable's new value
2274   // i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data)
2275   //
2276   NewDataSize = PayloadSize + sizeof (EFI_TIME) + sizeof (UINT32) +
2277                 sizeof (EFI_GUID) + StrSize (VariableName) - sizeof (CHAR16);
2278   //
2279   // Here is to reuse scratch data area(at the end of volatile variable store)
2280   // to reduce SMRAM consumption for SMM variable driver.
2281   // The scratch buffer is enough to hold the serialized data and safe to use,
2282   // because it will be used at here to do verification only first
2283   // and then used in UpdateVariable() for a time based auth variable set.
2284   //
2285   NewData = (UINT8 *) GetEndPointer ((VARIABLE_STORE_HEADER *) ((UINTN) mVariableModuleGlobal->VariableGlobal.VolatileVariableBase));
2286
2287   Buffer = NewData;
2288   Length = StrLen (VariableName) * sizeof (CHAR16);
2289   CopyMem (Buffer, VariableName, Length);
2290   Buffer += Length;
2291
2292   Length = sizeof (EFI_GUID);
2293   CopyMem (Buffer, VendorGuid, Length);
2294   Buffer += Length;
2295
2296   Length = sizeof (UINT32);
2297   CopyMem (Buffer, &Attr, Length);
2298   Buffer += Length;
2299
2300   Length = sizeof (EFI_TIME);
2301   CopyMem (Buffer, &CertData->TimeStamp, Length);
2302   Buffer += Length;
2303
2304   CopyMem (Buffer, PayloadPtr, PayloadSize);
2305
2306   if (AuthVarType == AuthVarTypePk) {
2307     //
2308     // Verify that the signature has been made with the current Platform Key (no chaining for PK).
2309     // First, get signer's certificates from SignedData.
2310     //
2311     VerifyStatus = Pkcs7GetSigners (
2312                      SigData,
2313                      SigDataSize,
2314                      &SignerCerts,
2315                      &CertStackSize,
2316                      &RootCert,
2317                      &RootCertSize
2318                      );
2319     if (!VerifyStatus) {
2320       goto Exit;
2321     }
2322
2323     //
2324     // Second, get the current platform key from variable. Check whether it's identical with signer's certificates
2325     // in SignedData. If not, return error immediately.
2326     //
2327     Status = FindVariable (
2328                EFI_PLATFORM_KEY_NAME,
2329                &gEfiGlobalVariableGuid,
2330                &PkVariable,
2331                &mVariableModuleGlobal->VariableGlobal,
2332                FALSE
2333                );
2334     if (EFI_ERROR (Status)) {
2335       VerifyStatus = FALSE;
2336       goto Exit;
2337     }
2338     CertList = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (PkVariable.CurrPtr);
2339     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2340     if ((RootCertSize != (CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1))) ||
2341         (CompareMem (Cert->SignatureData, RootCert, RootCertSize) != 0)) {
2342       VerifyStatus = FALSE;
2343       goto Exit;
2344     }
2345
2346     //
2347     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2348     //
2349     VerifyStatus = Pkcs7Verify (
2350                      SigData,
2351                      SigDataSize,
2352                      RootCert,
2353                      RootCertSize,
2354                      NewData,
2355                      NewDataSize
2356                      );
2357
2358   } else if (AuthVarType == AuthVarTypeKek) {
2359
2360     //
2361     // Get KEK database from variable.
2362     //
2363     Status = FindVariable (
2364                EFI_KEY_EXCHANGE_KEY_NAME,
2365                &gEfiGlobalVariableGuid,
2366                &KekVariable,
2367                &mVariableModuleGlobal->VariableGlobal,
2368                FALSE
2369                );
2370     if (EFI_ERROR (Status)) {
2371       return Status;
2372     }
2373
2374     //
2375     // Ready to verify Pkcs7 SignedData. Go through KEK Signature Database to find out X.509 CertList.
2376     //
2377     KekDataSize      = KekVariable.CurrPtr->DataSize;
2378     CertList         = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (KekVariable.CurrPtr);
2379     while ((KekDataSize > 0) && (KekDataSize >= CertList->SignatureListSize)) {
2380       if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {
2381         Cert       = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2382         CertCount  = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
2383         for (Index = 0; Index < CertCount; Index++) {
2384           //
2385           // Iterate each Signature Data Node within this CertList for a verify
2386           //
2387           RootCert      = Cert->SignatureData;
2388           RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2389
2390           //
2391           // Verify Pkcs7 SignedData via Pkcs7Verify library.
2392           //
2393           VerifyStatus = Pkcs7Verify (
2394                            SigData,
2395                            SigDataSize,
2396                            RootCert,
2397                            RootCertSize,
2398                            NewData,
2399                            NewDataSize
2400                            );
2401           if (VerifyStatus) {
2402             goto Exit;
2403           }
2404           Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
2405         }
2406       }
2407       KekDataSize -= CertList->SignatureListSize;
2408       CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
2409     }
2410   } else if (AuthVarType == AuthVarTypePriv) {
2411
2412     //
2413     // Process common authenticated variable except PK/KEK/DB/DBX/DBT.
2414     // Get signer's certificates from SignedData.
2415     //
2416     VerifyStatus = Pkcs7GetSigners (
2417                      SigData,
2418                      SigDataSize,
2419                      &SignerCerts,
2420                      &CertStackSize,
2421                      &RootCert,
2422                      &RootCertSize
2423                      );
2424     if (!VerifyStatus) {
2425       goto Exit;
2426     }
2427
2428     //
2429     // Get previously stored signer's certificates from certdb for existing
2430     // variable. Check whether they are identical with signer's certificates
2431     // in SignedData. If not, return error immediately.
2432     //
2433     if ((Variable->CurrPtr != NULL)) {
2434       VerifyStatus = FALSE;
2435
2436       Status = GetCertsFromDb (VariableName, VendorGuid, &CertsInCertDb, &CertsSizeinDb);
2437       if (EFI_ERROR (Status)) {
2438         goto Exit;
2439       }
2440
2441       if ((CertStackSize != CertsSizeinDb) ||
2442           (CompareMem (SignerCerts, CertsInCertDb, CertsSizeinDb) != 0)) {
2443         goto Exit;
2444       }
2445     }
2446
2447     VerifyStatus = Pkcs7Verify (
2448                      SigData,
2449                      SigDataSize,
2450                      RootCert,
2451                      RootCertSize,
2452                      NewData,
2453                      NewDataSize
2454                      );
2455     if (!VerifyStatus) {
2456       goto Exit;
2457     }
2458
2459     //
2460     // Delete signer's certificates when delete the common authenticated variable.
2461     //
2462     if ((PayloadSize == 0) && (Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
2463       Status = DeleteCertsFromDb (VariableName, VendorGuid);
2464       if (EFI_ERROR (Status)) {
2465         VerifyStatus = FALSE;
2466         goto Exit;
2467       }
2468     } else if (Variable->CurrPtr == NULL && PayloadSize != 0) {
2469       //
2470       // Insert signer's certificates when adding a new common authenticated variable.
2471       //
2472       Status = InsertCertsToDb (VariableName, VendorGuid, SignerCerts, CertStackSize);
2473       if (EFI_ERROR (Status)) {
2474         VerifyStatus = FALSE;
2475         goto Exit;
2476       }
2477     }
2478   } else if (AuthVarType == AuthVarTypePayload) {
2479     CertList = (EFI_SIGNATURE_LIST *) PayloadPtr;
2480     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2481     RootCert      = Cert->SignatureData;
2482     RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2483
2484     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2485     //
2486     VerifyStatus = Pkcs7Verify (
2487                      SigData,
2488                      SigDataSize,
2489                      RootCert,
2490                      RootCertSize,
2491                      NewData,
2492                      NewDataSize
2493                      );
2494   } else {
2495     return EFI_SECURITY_VIOLATION;
2496   }
2497
2498 Exit:
2499
2500   if (AuthVarType == AuthVarTypePk || AuthVarType == AuthVarTypePriv) {
2501     Pkcs7FreeSigners (RootCert);
2502     Pkcs7FreeSigners (SignerCerts);
2503   }
2504
2505   if (!VerifyStatus) {
2506     return EFI_SECURITY_VIOLATION;
2507   }
2508
2509   Status = CheckSignatureListFormat(VariableName, VendorGuid, PayloadPtr, PayloadSize);
2510   if (EFI_ERROR (Status)) {
2511     return Status;
2512   }
2513
2514   if ((PayloadSize == 0) && (VarDel != NULL)) {
2515     *VarDel = TRUE;
2516   }
2517
2518   //
2519   // Final step: Update/Append Variable if it pass Pkcs7Verify
2520   //
2521   return UpdateVariable (
2522            VariableName,
2523            VendorGuid,
2524            PayloadPtr,
2525            PayloadSize,
2526            Attributes,
2527            0,
2528            0,
2529            Variable,
2530            &CertData->TimeStamp
2531            );
2532 }