SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c

   1 /** @file
   2   Implement authentication services for the authenticated variable
   3   service in UEFI2.2.
   4
   5   Caution: This module requires additional review when modified.
   6   This driver will have external input - variable data. It may be input in SMM mode.
   7   This external input must be validated carefully to avoid security issue like
   8   buffer overflow, integer overflow.
   9   Variable attribute should also be checked to avoid authentication bypass.
  10
  11   ProcessVarWithPk(), ProcessVarWithKek() and ProcessVariable() are the function to do
  12   variable authentication.
  13
  14   VerifyTimeBasedPayload() and VerifyCounterBasedPayload() are sub function to do verification.
  15   They will do basic validation for authentication data structure, then call crypto library
  16   to verify the signature.
  17
  18 Copyright (c) 2009 - 2014, Intel Corporation. All rights reserved.<BR>
  19 This program and the accompanying materials
  20 are licensed and made available under the terms and conditions of the BSD License
  21 which accompanies this distribution.  The full text of the license may be found at
  22 http://opensource.org/licenses/bsd-license.php
  23
  24 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  25 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  26
  27 **/
  28
  29 #include "Variable.h"
  30 #include "AuthService.h"
  31
  32 ///
  33 /// Global database array for scratch
  34 ///
  35 UINT8    *mPubKeyStore;
  36 UINT32   mPubKeyNumber;
  37 UINT32   mMaxKeyNumber;
  38 UINT32   mMaxKeyDbSize;
  39 UINT8    *mCertDbStore;
  40 UINT32   mMaxCertDbSize;
  41 UINT32   mPlatformMode;
  42 UINT8    mVendorKeyState;
  43
  44 EFI_GUID mSignatureSupport[] = {EFI_CERT_SHA1_GUID, EFI_CERT_SHA256_GUID, EFI_CERT_RSA2048_GUID, EFI_CERT_X509_GUID};
  45 //
  46 // Public Exponent of RSA Key.
  47 //
  48 CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };
  49 //
  50 // Hash context pointer
  51 //
  52 VOID  *mHashCtx = NULL;
  53
  54 //
  55 // The serialization of the values of the VariableName, VendorGuid and Attributes
  56 // parameters of the SetVariable() call and the TimeStamp component of the
  57 // EFI_VARIABLE_AUTHENTICATION_2 descriptor followed by the variable's new value
  58 // i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data)
  59 //
  60 UINT8 *mSerializationRuntimeBuffer = NULL;
  61
  62 //
  63 // Requirement for different signature type which have been defined in UEFI spec.
  64 // These data are used to peform SignatureList format check while setting PK/KEK variable.
  65 //
  66 EFI_SIGNATURE_ITEM mSupportSigItem[] = {
  67 //{SigType,                       SigHeaderSize,   SigDataSize  }
  68   {EFI_CERT_SHA256_GUID,          0,               32           },
  69   {EFI_CERT_RSA2048_GUID,         0,               256          },
  70   {EFI_CERT_RSA2048_SHA256_GUID,  0,               256          },
  71   {EFI_CERT_SHA1_GUID,            0,               20           },
  72   {EFI_CERT_RSA2048_SHA1_GUID,    0,               256          },
  73   {EFI_CERT_X509_GUID,            0,               ((UINT32) ~0)},
  74   {EFI_CERT_SHA224_GUID,          0,               28           },
  75   {EFI_CERT_SHA384_GUID,          0,               48           },
  76   {EFI_CERT_SHA512_GUID,          0,               64           }
  77 };
  78
  79 /**
  80   Determine whether this operation needs a physical present user.
  81
  82   @param[in]      VariableName            Name of the Variable.
  83   @param[in]      VendorGuid              GUID of the Variable.
  84
  85   @retval TRUE      This variable is protected, only a physical present user could set this variable.
  86   @retval FALSE     This variable is not protected.
  87
  88 **/
  89 BOOLEAN
  90 NeedPhysicallyPresent(
  91   IN     CHAR16         *VariableName,
  92   IN     EFI_GUID       *VendorGuid
  93   )
  94 {
  95   if ((CompareGuid (VendorGuid, &gEfiSecureBootEnableDisableGuid) && (StrCmp (VariableName, EFI_SECURE_BOOT_ENABLE_NAME) == 0))
  96     || (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (VariableName, EFI_CUSTOM_MODE_NAME) == 0))) {
  97     return TRUE;
  98   }
  99
 100   return FALSE;
 101 }
 102
 103 /**
 104   Determine whether the platform is operating in Custom Secure Boot mode.
 105
 106   @retval TRUE           The platform is operating in Custom mode.
 107   @retval FALSE          The platform is operating in Standard mode.
 108
 109 **/
 110 BOOLEAN
 111 InCustomMode (
 112   VOID
 113   )
 114 {
 115   VARIABLE_POINTER_TRACK  Variable;
 116
 117   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 118   if (Variable.CurrPtr != NULL && *(GetVariableDataPtr (Variable.CurrPtr)) == CUSTOM_SECURE_BOOT_MODE) {
 119     return TRUE;
 120   }
 121
 122   return FALSE;
 123 }
 124
 125
 126 /**
 127   Internal function to delete a Variable given its name and GUID, no authentication
 128   required.
 129
 130   @param[in]      VariableName            Name of the Variable.
 131   @param[in]      VendorGuid              GUID of the Variable.
 132
 133   @retval EFI_SUCCESS              Variable deleted successfully.
 134   @retval Others                   The driver failded to start the device.
 135
 136 **/
 137 EFI_STATUS
 138 DeleteVariable (
 139   IN  CHAR16                    *VariableName,
 140   IN  EFI_GUID                  *VendorGuid
 141   )
 142 {
 143   EFI_STATUS              Status;
 144   VARIABLE_POINTER_TRACK  Variable;
 145
 146   Status = FindVariable (VariableName, VendorGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 147   if (EFI_ERROR (Status)) {
 148     return EFI_SUCCESS;
 149   }
 150
 151   ASSERT (Variable.CurrPtr != NULL);
 152   return UpdateVariable (VariableName, VendorGuid, NULL, 0, 0, 0, 0, &Variable, NULL);
 153 }
 154
 155 /**
 156   Initializes for authenticated varibale service.
 157
 158   @retval EFI_SUCCESS           Function successfully executed.
 159   @retval EFI_OUT_OF_RESOURCES  Fail to allocate enough memory resources.
 160
 161 **/
 162 EFI_STATUS
 163 AutenticatedVariableServiceInitialize (
 164   VOID
 165   )
 166 {
 167   EFI_STATUS              Status;
 168   VARIABLE_POINTER_TRACK  Variable;
 169   VARIABLE_POINTER_TRACK  PkVariable;
 170   UINT8                   VarValue;
 171   UINT32                  VarAttr;
 172   UINT8                   *Data;
 173   UINTN                   DataSize;
 174   UINTN                   CtxSize;
 175   UINT8                   SecureBootMode;
 176   UINT8                   SecureBootEnable;
 177   UINT8                   CustomMode;
 178   UINT32                  ListSize;
 179
 180   //
 181   // Initialize hash context.
 182   //
 183   CtxSize   = Sha256GetContextSize ();
 184   mHashCtx  = AllocateRuntimePool (CtxSize);
 185   if (mHashCtx == NULL) {
 186     return EFI_OUT_OF_RESOURCES;
 187   }
 188
 189   //
 190   // Reserve runtime buffer for public key database. The size excludes variable header and name size.
 191   //
 192   mMaxKeyDbSize = PcdGet32 (PcdMaxVariableSize) - sizeof (VARIABLE_HEADER) - sizeof (AUTHVAR_KEYDB_NAME);
 193   mMaxKeyNumber = mMaxKeyDbSize / EFI_CERT_TYPE_RSA2048_SIZE;
 194   mPubKeyStore  = AllocateRuntimePool (mMaxKeyDbSize);
 195   if (mPubKeyStore == NULL) {
 196     return EFI_OUT_OF_RESOURCES;
 197   }
 198
 199   //
 200   // Reserve runtime buffer for certificate database. The size excludes variable header and name size.
 201   //
 202   mMaxCertDbSize = PcdGet32 (PcdMaxVariableSize) - sizeof (VARIABLE_HEADER) - sizeof (EFI_CERT_DB_NAME);
 203   mCertDbStore   = AllocateRuntimePool (mMaxCertDbSize);
 204   if (mCertDbStore == NULL) {
 205     return EFI_OUT_OF_RESOURCES;
 206   }
 207
 208   //
 209   // Prepare runtime buffer for serialized data of time-based authenticated
 210   // Variable, i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data).
 211   //
 212   mSerializationRuntimeBuffer = AllocateRuntimePool (PcdGet32 (PcdMaxVariableSize) + sizeof (EFI_GUID) + sizeof (UINT32) + sizeof (EFI_TIME));
 213   if (mSerializationRuntimeBuffer == NULL) {
 214     return EFI_OUT_OF_RESOURCES;
 215   }
 216
 217   //
 218   // Check "AuthVarKeyDatabase" variable's existence.
 219   // If it doesn't exist, create a new one with initial value of 0 and EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
 220   //
 221   Status = FindVariable (
 222              AUTHVAR_KEYDB_NAME,
 223              &gEfiAuthenticatedVariableGuid,
 224              &Variable,
 225              &mVariableModuleGlobal->VariableGlobal,
 226              FALSE
 227              );
 228
 229   if (Variable.CurrPtr == NULL) {
 230     VarAttr       = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 231     VarValue      = 0;
 232     mPubKeyNumber = 0;
 233     Status        = UpdateVariable (
 234                       AUTHVAR_KEYDB_NAME,
 235                       &gEfiAuthenticatedVariableGuid,
 236                       &VarValue,
 237                       sizeof(UINT8),
 238                       VarAttr,
 239                       0,
 240                       0,
 241                       &Variable,
 242                       NULL
 243                       );
 244     if (EFI_ERROR (Status)) {
 245       return Status;
 246     }
 247   } else {
 248     //
 249     // Load database in global variable for cache.
 250     //
 251     DataSize  = DataSizeOfVariable (Variable.CurrPtr);
 252     Data      = GetVariableDataPtr (Variable.CurrPtr);
 253     ASSERT ((DataSize != 0) && (Data != NULL));
 254     CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
 255     mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
 256   }
 257
 258   FindVariable (EFI_PLATFORM_KEY_NAME, &gEfiGlobalVariableGuid, &PkVariable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 259   if (PkVariable.CurrPtr == NULL) {
 260     DEBUG ((EFI_D_INFO, "Variable %s does not exist.\n", EFI_PLATFORM_KEY_NAME));
 261   } else {
 262     DEBUG ((EFI_D_INFO, "Variable %s exists.\n", EFI_PLATFORM_KEY_NAME));
 263   }
 264
 265   //
 266   // Create "SetupMode" variable with BS+RT attribute set.
 267   //
 268   FindVariable (EFI_SETUP_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 269   if (PkVariable.CurrPtr == NULL) {
 270     mPlatformMode = SETUP_MODE;
 271   } else {
 272     mPlatformMode = USER_MODE;
 273   }
 274   Status = UpdateVariable (
 275              EFI_SETUP_MODE_NAME,
 276              &gEfiGlobalVariableGuid,
 277              &mPlatformMode,
 278              sizeof(UINT8),
 279              EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 280              0,
 281              0,
 282              &Variable,
 283              NULL
 284              );
 285   if (EFI_ERROR (Status)) {
 286     return Status;
 287   }
 288
 289   //
 290   // Create "SignatureSupport" variable with BS+RT attribute set.
 291   //
 292   FindVariable (EFI_SIGNATURE_SUPPORT_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 293   Status  = UpdateVariable (
 294               EFI_SIGNATURE_SUPPORT_NAME,
 295               &gEfiGlobalVariableGuid,
 296               mSignatureSupport,
 297               sizeof(mSignatureSupport),
 298               EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 299               0,
 300               0,
 301               &Variable,
 302               NULL
 303               );
 304   if (EFI_ERROR (Status)) {
 305     return Status;
 306   }
 307
 308   //
 309   // If "SecureBootEnable" variable exists, then update "SecureBoot" variable.
 310   // If "SecureBootEnable" variable is SECURE_BOOT_ENABLE and in USER_MODE, Set "SecureBoot" variable to SECURE_BOOT_MODE_ENABLE.
 311   // If "SecureBootEnable" variable is SECURE_BOOT_DISABLE, Set "SecureBoot" variable to SECURE_BOOT_MODE_DISABLE.
 312   //
 313   SecureBootEnable = SECURE_BOOT_DISABLE;
 314   FindVariable (EFI_SECURE_BOOT_ENABLE_NAME, &gEfiSecureBootEnableDisableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 315   if (Variable.CurrPtr != NULL) {
 316     SecureBootEnable = *(GetVariableDataPtr (Variable.CurrPtr));
 317   } else if (mPlatformMode == USER_MODE) {
 318     //
 319     // "SecureBootEnable" not exist, initialize it in USER_MODE.
 320     //
 321     SecureBootEnable = SECURE_BOOT_ENABLE;
 322     Status = UpdateVariable (
 323                EFI_SECURE_BOOT_ENABLE_NAME,
 324                &gEfiSecureBootEnableDisableGuid,
 325                &SecureBootEnable,
 326                sizeof (UINT8),
 327                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 328                0,
 329                0,
 330                &Variable,
 331                NULL
 332                );
 333     if (EFI_ERROR (Status)) {
 334       return Status;
 335     }
 336   }
 337
 338   //
 339   // Create "SecureBoot" variable with BS+RT attribute set.
 340   //
 341   if (SecureBootEnable == SECURE_BOOT_ENABLE && mPlatformMode == USER_MODE) {
 342     SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 343   } else {
 344     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 345   }
 346   FindVariable (EFI_SECURE_BOOT_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 347   Status = UpdateVariable (
 348              EFI_SECURE_BOOT_MODE_NAME,
 349              &gEfiGlobalVariableGuid,
 350              &SecureBootMode,
 351              sizeof (UINT8),
 352              EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 353              0,
 354              0,
 355              &Variable,
 356              NULL
 357              );
 358   if (EFI_ERROR (Status)) {
 359     return Status;
 360   }
 361
 362   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SETUP_MODE_NAME, mPlatformMode));
 363   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_MODE_NAME, SecureBootMode));
 364   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_ENABLE_NAME, SecureBootEnable));
 365
 366   //
 367   // Initialize "CustomMode" in STANDARD_SECURE_BOOT_MODE state.
 368   //
 369   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 370   CustomMode = STANDARD_SECURE_BOOT_MODE;
 371   Status = UpdateVariable (
 372              EFI_CUSTOM_MODE_NAME,
 373              &gEfiCustomModeEnableGuid,
 374              &CustomMode,
 375              sizeof (UINT8),
 376              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 377              0,
 378              0,
 379              &Variable,
 380              NULL
 381              );
 382   if (EFI_ERROR (Status)) {
 383     return Status;
 384   }
 385
 386   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_CUSTOM_MODE_NAME, CustomMode));
 387
 388   //
 389   // Check "certdb" variable's existence.
 390   // If it doesn't exist, then create a new one with
 391   // EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.
 392   //
 393   Status = FindVariable (
 394              EFI_CERT_DB_NAME,
 395              &gEfiCertDbGuid,
 396              &Variable,
 397              &mVariableModuleGlobal->VariableGlobal,
 398              FALSE
 399              );
 400
 401   if (Variable.CurrPtr == NULL) {
 402     VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
 403     ListSize = sizeof (UINT32);
 404     Status   = UpdateVariable (
 405                  EFI_CERT_DB_NAME,
 406                  &gEfiCertDbGuid,
 407                  &ListSize,
 408                  sizeof (UINT32),
 409                  VarAttr,
 410                  0,
 411                  0,
 412                  &Variable,
 413                  NULL
 414                  );
 415     if (EFI_ERROR (Status)) {
 416       return Status;
 417     }
 418   }
 419
 420   //
 421   // Check "VendorKeysNv" variable's existence and create "VendorKeys" variable accordingly.
 422   //
 423   FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 424   if (Variable.CurrPtr != NULL) {
 425     mVendorKeyState = *(GetVariableDataPtr (Variable.CurrPtr));
 426   } else {
 427     //
 428     // "VendorKeysNv" not exist, initialize it in VENDOR_KEYS_VALID state.
 429     //
 430     mVendorKeyState = VENDOR_KEYS_VALID;
 431     Status = UpdateVariable (
 432                EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
 433                &gEfiVendorKeysNvGuid,
 434                &mVendorKeyState,
 435                sizeof (UINT8),
 436                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS,
 437                0,
 438                0,
 439                &Variable,
 440                NULL
 441                );
 442     if (EFI_ERROR (Status)) {
 443       return Status;
 444     }
 445   }
 446
 447   //
 448   // Create "VendorKeys" variable with BS+RT attribute set.
 449   //
 450   FindVariable (EFI_VENDOR_KEYS_VARIABLE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 451   Status = UpdateVariable (
 452              EFI_VENDOR_KEYS_VARIABLE_NAME,
 453              &gEfiGlobalVariableGuid,
 454              &mVendorKeyState,
 455              sizeof (UINT8),
 456              EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 457              0,
 458              0,
 459              &Variable,
 460              NULL
 461              );
 462   if (EFI_ERROR (Status)) {
 463     return Status;
 464   }
 465
 466   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_VENDOR_KEYS_VARIABLE_NAME, mVendorKeyState));
 467
 468   return Status;
 469 }
 470
 471 /**
 472   Add public key in store and return its index.
 473
 474   @param[in]  PubKey                  Input pointer to Public Key data
 475   @param[in]  VariableDataEntry       The variable data entry
 476
 477   @return                             Index of new added item
 478
 479 **/
 480 UINT32
 481 AddPubKeyInStore (
 482   IN  UINT8                        *PubKey,
 483   IN  VARIABLE_ENTRY_CONSISTENCY   *VariableDataEntry
 484   )
 485 {
 486   EFI_STATUS                       Status;
 487   BOOLEAN                          IsFound;
 488   UINT32                           Index;
 489   VARIABLE_POINTER_TRACK           Variable;
 490   UINT8                            *Ptr;
 491   UINT8                            *Data;
 492   UINTN                            DataSize;
 493   VARIABLE_ENTRY_CONSISTENCY       PublicKeyEntry;
 494   UINT32                           Attributes;
 495
 496   if (PubKey == NULL) {
 497     return 0;
 498   }
 499
 500   Status = FindVariable (
 501              AUTHVAR_KEYDB_NAME,
 502              &gEfiAuthenticatedVariableGuid,
 503              &Variable,
 504              &mVariableModuleGlobal->VariableGlobal,
 505              FALSE
 506              );
 507   if (EFI_ERROR (Status)) {
 508     DEBUG ((EFI_D_ERROR, "Get public key database variable failure, Status = %r\n", Status));
 509     return 0;
 510   }
 511
 512   //
 513   // Check whether the public key entry does exist.
 514   //
 515   IsFound = FALSE;
 516   for (Ptr = mPubKeyStore, Index = 1; Index <= mPubKeyNumber; Index++) {
 517     if (CompareMem (Ptr, PubKey, EFI_CERT_TYPE_RSA2048_SIZE) == 0) {
 518       IsFound = TRUE;
 519       break;
 520     }
 521     Ptr += EFI_CERT_TYPE_RSA2048_SIZE;
 522   }
 523
 524   if (!IsFound) {
 525     //
 526     // Add public key in database.
 527     //
 528     if (mPubKeyNumber == mMaxKeyNumber) {
 529       //
 530       // Public key dadatase is full, try to reclaim invalid key.
 531       //
 532       if (AtRuntime ()) {
 533         //
 534         // NV storage can't reclaim at runtime.
 535         //
 536         return 0;
 537       }
 538
 539       Status = Reclaim (
 540                  mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase,
 541                  &mVariableModuleGlobal->NonVolatileLastVariableOffset,
 542                  FALSE,
 543                  NULL,
 544                  NULL,
 545                  0,
 546                  TRUE
 547                  );
 548       if (EFI_ERROR (Status)) {
 549         return 0;
 550       }
 551
 552       Status = FindVariable (
 553                  AUTHVAR_KEYDB_NAME,
 554                  &gEfiAuthenticatedVariableGuid,
 555                  &Variable,
 556                  &mVariableModuleGlobal->VariableGlobal,
 557                  FALSE
 558                  );
 559       if (EFI_ERROR (Status)) {
 560         DEBUG ((EFI_D_ERROR, "Get public key database variable failure, Status = %r\n", Status));
 561         return 0;
 562       }
 563
 564       DataSize  = DataSizeOfVariable (Variable.CurrPtr);
 565       Data      = GetVariableDataPtr (Variable.CurrPtr);
 566       ASSERT ((DataSize != 0) && (Data != NULL));
 567       CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
 568       mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
 569
 570       if (mPubKeyNumber == mMaxKeyNumber) {
 571         return 0;
 572       }
 573     }
 574
 575     //
 576     // Check the variable space for both public key and variable data.
 577     //
 578     PublicKeyEntry.VariableSize = (mPubKeyNumber + 1) * EFI_CERT_TYPE_RSA2048_SIZE;
 579     PublicKeyEntry.Guid         = &gEfiAuthenticatedVariableGuid;
 580     PublicKeyEntry.Name         = AUTHVAR_KEYDB_NAME;
 581     Attributes = VARIABLE_ATTRIBUTE_NV_BS_RT | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 582
 583     if (!CheckRemainingSpaceForConsistency (Attributes, &PublicKeyEntry, VariableDataEntry, NULL)) {
 584       //
 585       // No enough variable space.
 586       //
 587       return 0;
 588     }
 589
 590     CopyMem (mPubKeyStore + mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 591     Index = ++mPubKeyNumber;
 592     //
 593     // Update public key database variable.
 594     //
 595     Status = UpdateVariable (
 596                AUTHVAR_KEYDB_NAME,
 597                &gEfiAuthenticatedVariableGuid,
 598                mPubKeyStore,
 599                mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE,
 600                Attributes,
 601                0,
 602                0,
 603                &Variable,
 604                NULL
 605                );
 606     if (EFI_ERROR (Status)) {
 607       DEBUG ((EFI_D_ERROR, "Update public key database variable failure, Status = %r\n", Status));
 608       return 0;
 609     }
 610   }
 611
 612   return Index;
 613 }
 614
 615 /**
 616   Verify data payload with AuthInfo in EFI_CERT_TYPE_RSA2048_SHA256_GUID type.
 617   Follow the steps in UEFI2.2.
 618
 619   Caution: This function may receive untrusted input.
 620   This function may be invoked in SMM mode, and datasize and data are external input.
 621   This function will do basic validation, before parse the data.
 622   This function will parse the authentication carefully to avoid security issues, like
 623   buffer overflow, integer overflow.
 624
 625   @param[in]      Data                    Pointer to data with AuthInfo.
 626   @param[in]      DataSize                Size of Data.
 627   @param[in]      PubKey                  Public key used for verification.
 628
 629   @retval EFI_INVALID_PARAMETER       Invalid parameter.
 630   @retval EFI_SECURITY_VIOLATION      If authentication failed.
 631   @retval EFI_SUCCESS                 Authentication successful.
 632
 633 **/
 634 EFI_STATUS
 635 VerifyCounterBasedPayload (
 636   IN     UINT8          *Data,
 637   IN     UINTN          DataSize,
 638   IN     UINT8          *PubKey
 639   )
 640 {
 641   BOOLEAN                         Status;
 642   EFI_VARIABLE_AUTHENTICATION     *CertData;
 643   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
 644   UINT8                           Digest[SHA256_DIGEST_SIZE];
 645   VOID                            *Rsa;
 646   UINTN                           PayloadSize;
 647
 648   PayloadSize = DataSize - AUTHINFO_SIZE;
 649   Rsa         = NULL;
 650   CertData    = NULL;
 651   CertBlock   = NULL;
 652
 653   if (Data == NULL || PubKey == NULL) {
 654     return EFI_INVALID_PARAMETER;
 655   }
 656
 657   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
 658   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
 659
 660   //
 661   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
 662   // Cert type should be EFI_CERT_TYPE_RSA2048_SHA256_GUID.
 663   //
 664   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
 665       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertTypeRsa2048Sha256Guid)
 666         ) {
 667     //
 668     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
 669     //
 670     return EFI_SECURITY_VIOLATION;
 671   }
 672   //
 673   // Hash data payload with SHA256.
 674   //
 675   ZeroMem (Digest, SHA256_DIGEST_SIZE);
 676   Status  = Sha256Init (mHashCtx);
 677   if (!Status) {
 678     goto Done;
 679   }
 680   Status  = Sha256Update (mHashCtx, Data + AUTHINFO_SIZE, PayloadSize);
 681   if (!Status) {
 682     goto Done;
 683   }
 684   //
 685   // Hash Size.
 686   //
 687   Status  = Sha256Update (mHashCtx, &PayloadSize, sizeof (UINTN));
 688   if (!Status) {
 689     goto Done;
 690   }
 691   //
 692   // Hash Monotonic Count.
 693   //
 694   Status  = Sha256Update (mHashCtx, &CertData->MonotonicCount, sizeof (UINT64));
 695   if (!Status) {
 696     goto Done;
 697   }
 698   Status  = Sha256Final (mHashCtx, Digest);
 699   if (!Status) {
 700     goto Done;
 701   }
 702   //
 703   // Generate & Initialize RSA Context.
 704   //
 705   Rsa = RsaNew ();
 706   ASSERT (Rsa != NULL);
 707   //
 708   // Set RSA Key Components.
 709   // NOTE: Only N and E are needed to be set as RSA public key for signature verification.
 710   //
 711   Status = RsaSetKey (Rsa, RsaKeyN, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 712   if (!Status) {
 713     goto Done;
 714   }
 715   Status = RsaSetKey (Rsa, RsaKeyE, mRsaE, sizeof (mRsaE));
 716   if (!Status) {
 717     goto Done;
 718   }
 719   //
 720   // Verify the signature.
 721   //
 722   Status = RsaPkcs1Verify (
 723              Rsa,
 724              Digest,
 725              SHA256_DIGEST_SIZE,
 726              CertBlock->Signature,
 727              EFI_CERT_TYPE_RSA2048_SHA256_SIZE
 728              );
 729
 730 Done:
 731   if (Rsa != NULL) {
 732     RsaFree (Rsa);
 733   }
 734   if (Status) {
 735     return EFI_SUCCESS;
 736   } else {
 737     return EFI_SECURITY_VIOLATION;
 738   }
 739 }
 740
 741 /**
 742   Update platform mode.
 743
 744   @param[in]      Mode                    SETUP_MODE or USER_MODE.
 745
 746   @return EFI_INVALID_PARAMETER           Invalid parameter.
 747   @return EFI_SUCCESS                     Update platform mode successfully.
 748
 749 **/
 750 EFI_STATUS
 751 UpdatePlatformMode (
 752   IN  UINT32                    Mode
 753   )
 754 {
 755   EFI_STATUS              Status;
 756   VARIABLE_POINTER_TRACK  Variable;
 757   UINT8                   SecureBootMode;
 758   UINT8                   SecureBootEnable;
 759   UINTN                   VariableDataSize;
 760
 761   Status = FindVariable (
 762              EFI_SETUP_MODE_NAME,
 763              &gEfiGlobalVariableGuid,
 764              &Variable,
 765              &mVariableModuleGlobal->VariableGlobal,
 766              FALSE
 767              );
 768   if (EFI_ERROR (Status)) {
 769     return Status;
 770   }
 771
 772   //
 773   // Update the value of SetupMode variable by a simple mem copy, this could avoid possible
 774   // variable storage reclaim at runtime.
 775   //
 776   mPlatformMode = (UINT8) Mode;
 777   CopyMem (GetVariableDataPtr (Variable.CurrPtr), &mPlatformMode, sizeof(UINT8));
 778
 779   if (AtRuntime ()) {
 780     //
 781     // SecureBoot Variable indicates whether the platform firmware is operating
 782     // in Secure boot mode (1) or not (0), so we should not change SecureBoot
 783     // Variable in runtime.
 784     //
 785     return Status;
 786   }
 787
 788   //
 789   // Check "SecureBoot" variable's existence.
 790   // If it doesn't exist, firmware has no capability to perform driver signing verification,
 791   // then set "SecureBoot" to 0.
 792   //
 793   Status = FindVariable (
 794              EFI_SECURE_BOOT_MODE_NAME,
 795              &gEfiGlobalVariableGuid,
 796              &Variable,
 797              &mVariableModuleGlobal->VariableGlobal,
 798              FALSE
 799              );
 800   //
 801   // If "SecureBoot" variable exists, then check "SetupMode" variable update.
 802   // If "SetupMode" variable is USER_MODE, "SecureBoot" variable is set to 1.
 803   // If "SetupMode" variable is SETUP_MODE, "SecureBoot" variable is set to 0.
 804   //
 805   if (Variable.CurrPtr == NULL) {
 806     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 807   } else {
 808     if (mPlatformMode == USER_MODE) {
 809       SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 810     } else if (mPlatformMode == SETUP_MODE) {
 811       SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 812     } else {
 813       return EFI_NOT_FOUND;
 814     }
 815   }
 816
 817   Status  = UpdateVariable (
 818               EFI_SECURE_BOOT_MODE_NAME,
 819               &gEfiGlobalVariableGuid,
 820               &SecureBootMode,
 821               sizeof(UINT8),
 822               EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 823               0,
 824               0,
 825               &Variable,
 826               NULL
 827               );
 828   if (EFI_ERROR (Status)) {
 829     return Status;
 830   }
 831
 832   //
 833   // Check "SecureBootEnable" variable's existence. It can enable/disable secure boot feature.
 834   //
 835   Status = FindVariable (
 836              EFI_SECURE_BOOT_ENABLE_NAME,
 837              &gEfiSecureBootEnableDisableGuid,
 838              &Variable,
 839              &mVariableModuleGlobal->VariableGlobal,
 840              FALSE
 841              );
 842
 843   if (SecureBootMode == SECURE_BOOT_MODE_ENABLE) {
 844     //
 845     // Create the "SecureBootEnable" variable as secure boot is enabled.
 846     //
 847     SecureBootEnable = SECURE_BOOT_ENABLE;
 848     VariableDataSize = sizeof (SecureBootEnable);
 849   } else {
 850     //
 851     // Delete the "SecureBootEnable" variable if this variable exist as "SecureBoot"
 852     // variable is not in secure boot state.
 853     //
 854     if (Variable.CurrPtr == NULL || EFI_ERROR (Status)) {
 855       return EFI_SUCCESS;
 856     }
 857     SecureBootEnable = SECURE_BOOT_DISABLE;
 858     VariableDataSize = 0;
 859   }
 860
 861   Status = UpdateVariable (
 862              EFI_SECURE_BOOT_ENABLE_NAME,
 863              &gEfiSecureBootEnableDisableGuid,
 864              &SecureBootEnable,
 865              VariableDataSize,
 866              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 867              0,
 868              0,
 869              &Variable,
 870              NULL
 871              );
 872   return Status;
 873 }
 874
 875 /**
 876   Check input data form to make sure it is a valid EFI_SIGNATURE_LIST for PK/KEK/db/dbx variable.
 877
 878   @param[in]  VariableName                Name of Variable to be check.
 879   @param[in]  VendorGuid                  Variable vendor GUID.
 880   @param[in]  Data                        Point to the variable data to be checked.
 881   @param[in]  DataSize                    Size of Data.
 882
 883   @return EFI_INVALID_PARAMETER           Invalid signature list format.
 884   @return EFI_SUCCESS                     Passed signature list format check successfully.
 885
 886 **/
 887 EFI_STATUS
 888 CheckSignatureListFormat(
 889   IN  CHAR16                    *VariableName,
 890   IN  EFI_GUID                  *VendorGuid,
 891   IN  VOID                      *Data,
 892   IN  UINTN                     DataSize
 893   )
 894 {
 895   EFI_SIGNATURE_LIST     *SigList;
 896   UINTN                  SigDataSize;
 897   UINT32                 Index;
 898   UINT32                 SigCount;
 899   BOOLEAN                IsPk;
 900   VOID                   *RsaContext;
 901   EFI_SIGNATURE_DATA     *CertData;
 902   UINTN                  CertLen;
 903
 904   if (DataSize == 0) {
 905     return EFI_SUCCESS;
 906   }
 907
 908   ASSERT (VariableName != NULL && VendorGuid != NULL && Data != NULL);
 909
 910   if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_PLATFORM_KEY_NAME) == 0)){
 911     IsPk = TRUE;
 912   } else if ((CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0) ||
 913              (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&
 914               (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0 || StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0))){
 915     IsPk = FALSE;
 916   } else {
 917     return EFI_SUCCESS;
 918   }
 919
 920   SigCount = 0;
 921   SigList  = (EFI_SIGNATURE_LIST *) Data;
 922   SigDataSize  = DataSize;
 923   RsaContext = NULL;
 924
 925   //
 926   // Walk throuth the input signature list and check the data format.
 927   // If any signature is incorrectly formed, the whole check will fail.
 928   //
 929   while ((SigDataSize > 0) && (SigDataSize >= SigList->SignatureListSize)) {
 930     for (Index = 0; Index < (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM)); Index++ ) {
 931       if (CompareGuid (&SigList->SignatureType, &mSupportSigItem[Index].SigType)) {
 932         //
 933         // The value of SignatureSize should always be 16 (size of SignatureOwner
 934         // component) add the data length according to signature type.
 935         //
 936         if (mSupportSigItem[Index].SigDataSize != ((UINT32) ~0) &&
 937           (SigList->SignatureSize - sizeof (EFI_GUID)) != mSupportSigItem[Index].SigDataSize) {
 938           return EFI_INVALID_PARAMETER;
 939         }
 940         if (mSupportSigItem[Index].SigHeaderSize != ((UINTN) ~0) &&
 941           SigList->SignatureHeaderSize != mSupportSigItem[Index].SigHeaderSize) {
 942           return EFI_INVALID_PARAMETER;
 943         }
 944         break;
 945       }
 946     }
 947
 948     if (Index == (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM))) {
 949       //
 950       // Undefined signature type.
 951       //
 952       return EFI_INVALID_PARAMETER;
 953     }
 954
 955     if (CompareGuid (&SigList->SignatureType, &gEfiCertX509Guid)) {
 956       //
 957       // Try to retrieve the RSA public key from the X.509 certificate.
 958       // If this operation fails, it's not a valid certificate.
 959       //
 960       RsaContext = RsaNew ();
 961       if (RsaContext == NULL) {
 962         return EFI_INVALID_PARAMETER;
 963       }
 964       CertData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigList + sizeof (EFI_SIGNATURE_LIST) + SigList->SignatureHeaderSize);
 965       CertLen = SigList->SignatureSize - sizeof (EFI_GUID);
 966       if (!RsaGetPublicKeyFromX509 (CertData->SignatureData, CertLen, &RsaContext)) {
 967         RsaFree (RsaContext);
 968         return EFI_INVALID_PARAMETER;
 969       }
 970       RsaFree (RsaContext);
 971     }
 972
 973     if ((SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) % SigList->SignatureSize != 0) {
 974       return EFI_INVALID_PARAMETER;
 975     }
 976     SigCount += (SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) / SigList->SignatureSize;
 977
 978     SigDataSize -= SigList->SignatureListSize;
 979     SigList = (EFI_SIGNATURE_LIST *) ((UINT8 *) SigList + SigList->SignatureListSize);
 980   }
 981
 982   if (((UINTN) SigList - (UINTN) Data) != DataSize) {
 983     return EFI_INVALID_PARAMETER;
 984   }
 985
 986   if (IsPk && SigCount > 1) {
 987     return EFI_INVALID_PARAMETER;
 988   }
 989
 990   return EFI_SUCCESS;
 991 }
 992
 993 /**
 994   Update "VendorKeys" variable to record the out of band secure boot key modification.
 995
 996   @return EFI_SUCCESS           Variable is updated successfully.
 997   @return Others                Failed to update variable.
 998
 999 **/
1000 EFI_STATUS
1001 VendorKeyIsModified (
1002   VOID
1003   )
1004 {
1005   EFI_STATUS              Status;
1006   VARIABLE_POINTER_TRACK  Variable;
1007
1008   if (mVendorKeyState == VENDOR_KEYS_MODIFIED) {
1009     return EFI_SUCCESS;
1010   }
1011   mVendorKeyState = VENDOR_KEYS_MODIFIED;
1012
1013   FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
1014   Status = UpdateVariable (
1015              EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
1016              &gEfiVendorKeysNvGuid,
1017              &mVendorKeyState,
1018              sizeof (UINT8),
1019              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS,
1020              0,
1021              0,
1022              &Variable,
1023              NULL
1024              );
1025   if (EFI_ERROR (Status)) {
1026     return Status;
1027   }
1028
1029   FindVariable (EFI_VENDOR_KEYS_VARIABLE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
1030   return UpdateVariable (
1031            EFI_VENDOR_KEYS_VARIABLE_NAME,
1032            &gEfiGlobalVariableGuid,
1033            &mVendorKeyState,
1034            sizeof (UINT8),
1035            EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
1036            0,
1037            0,
1038            &Variable,
1039            NULL
1040            );
1041 }
1042
1043 /**
1044   Process variable with platform key for verification.
1045
1046   Caution: This function may receive untrusted input.
1047   This function may be invoked in SMM mode, and datasize and data are external input.
1048   This function will do basic validation, before parse the data.
1049   This function will parse the authentication carefully to avoid security issues, like
1050   buffer overflow, integer overflow.
1051   This function will check attribute carefully to avoid authentication bypass.
1052
1053   @param[in]  VariableName                Name of Variable to be found.
1054   @param[in]  VendorGuid                  Variable vendor GUID.
1055   @param[in]  Data                        Data pointer.
1056   @param[in]  DataSize                    Size of Data found. If size is less than the
1057                                           data, this value contains the required size.
1058   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1059   @param[in]  Attributes                  Attribute value of the variable
1060   @param[in]  IsPk                        Indicate whether it is to process pk.
1061
1062   @return EFI_INVALID_PARAMETER           Invalid parameter.
1063   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation.
1064                                           check carried out by the firmware.
1065   @return EFI_SUCCESS                     Variable passed validation successfully.
1066
1067 **/
1068 EFI_STATUS
1069 ProcessVarWithPk (
1070   IN  CHAR16                    *VariableName,
1071   IN  EFI_GUID                  *VendorGuid,
1072   IN  VOID                      *Data,
1073   IN  UINTN                     DataSize,
1074   IN  VARIABLE_POINTER_TRACK    *Variable,
1075   IN  UINT32                    Attributes OPTIONAL,
1076   IN  BOOLEAN                   IsPk
1077   )
1078 {
1079   EFI_STATUS                  Status;
1080   BOOLEAN                     Del;
1081   UINT8                       *Payload;
1082   UINTN                       PayloadSize;
1083
1084   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1085       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1086     //
1087     // PK, KEK and db/dbx should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1088     // authenticated variable.
1089     //
1090     return EFI_INVALID_PARAMETER;
1091   }
1092
1093   Del = FALSE;
1094   if ((InCustomMode() && UserPhysicalPresent()) || (mPlatformMode == SETUP_MODE && !IsPk)) {
1095     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1096     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1097     if (PayloadSize == 0) {
1098       Del = TRUE;
1099     }
1100
1101     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
1102     if (EFI_ERROR (Status)) {
1103       return Status;
1104     }
1105
1106     Status = UpdateVariable (
1107                VariableName,
1108                VendorGuid,
1109                Payload,
1110                PayloadSize,
1111                Attributes,
1112                0,
1113                0,
1114                Variable,
1115                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1116                );
1117     if (EFI_ERROR(Status)) {
1118       return Status;
1119     }
1120
1121     if ((mPlatformMode != SETUP_MODE) || IsPk) {
1122       Status = VendorKeyIsModified ();
1123     }
1124   } else if (mPlatformMode == USER_MODE) {
1125     //
1126     // Verify against X509 Cert in PK database.
1127     //
1128     Status = VerifyTimeBasedPayload (
1129                VariableName,
1130                VendorGuid,
1131                Data,
1132                DataSize,
1133                Variable,
1134                Attributes,
1135                AuthVarTypePk,
1136                &Del
1137                );
1138   } else {
1139     //
1140     // Verify against the certificate in data payload.
1141     //
1142     Status = VerifyTimeBasedPayload (
1143                VariableName,
1144                VendorGuid,
1145                Data,
1146                DataSize,
1147                Variable,
1148                Attributes,
1149                AuthVarTypePayload,
1150                &Del
1151                );
1152   }
1153
1154   if (!EFI_ERROR(Status) && IsPk) {
1155     if (mPlatformMode == SETUP_MODE && !Del) {
1156       //
1157       // If enroll PK in setup mode, need change to user mode.
1158       //
1159       Status = UpdatePlatformMode (USER_MODE);
1160     } else if (mPlatformMode == USER_MODE && Del){
1161       //
1162       // If delete PK in user mode, need change to setup mode.
1163       //
1164       Status = UpdatePlatformMode (SETUP_MODE);
1165     }
1166   }
1167
1168   return Status;
1169 }
1170
1171 /**
1172   Process variable with key exchange key for verification.
1173
1174   Caution: This function may receive untrusted input.
1175   This function may be invoked in SMM mode, and datasize and data are external input.
1176   This function will do basic validation, before parse the data.
1177   This function will parse the authentication carefully to avoid security issues, like
1178   buffer overflow, integer overflow.
1179   This function will check attribute carefully to avoid authentication bypass.
1180
1181   @param[in]  VariableName                Name of Variable to be found.
1182   @param[in]  VendorGuid                  Variable vendor GUID.
1183   @param[in]  Data                        Data pointer.
1184   @param[in]  DataSize                    Size of Data found. If size is less than the
1185                                           data, this value contains the required size.
1186   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1187   @param[in]  Attributes                  Attribute value of the variable.
1188
1189   @return EFI_INVALID_PARAMETER           Invalid parameter.
1190   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
1191                                           check carried out by the firmware.
1192   @return EFI_SUCCESS                     Variable pass validation successfully.
1193
1194 **/
1195 EFI_STATUS
1196 ProcessVarWithKek (
1197   IN  CHAR16                               *VariableName,
1198   IN  EFI_GUID                             *VendorGuid,
1199   IN  VOID                                 *Data,
1200   IN  UINTN                                DataSize,
1201   IN  VARIABLE_POINTER_TRACK               *Variable,
1202   IN  UINT32                               Attributes OPTIONAL
1203   )
1204 {
1205   EFI_STATUS                      Status;
1206   UINT8                           *Payload;
1207   UINTN                           PayloadSize;
1208
1209   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1210       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1211     //
1212     // DB and DBX should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1213     // authenticated variable.
1214     //
1215     return EFI_INVALID_PARAMETER;
1216   }
1217
1218   Status = EFI_SUCCESS;
1219   if (mPlatformMode == USER_MODE && !(InCustomMode() && UserPhysicalPresent())) {
1220     //
1221     // Time-based, verify against X509 Cert KEK.
1222     //
1223     return VerifyTimeBasedPayload (
1224              VariableName,
1225              VendorGuid,
1226              Data,
1227              DataSize,
1228              Variable,
1229              Attributes,
1230              AuthVarTypeKek,
1231              NULL
1232              );
1233   } else {
1234     //
1235     // If in setup mode or custom secure boot mode, no authentication needed.
1236     //
1237     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1238     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1239
1240     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
1241     if (EFI_ERROR (Status)) {
1242       return Status;
1243     }
1244
1245     Status = UpdateVariable (
1246                VariableName,
1247                VendorGuid,
1248                Payload,
1249                PayloadSize,
1250                Attributes,
1251                0,
1252                0,
1253                Variable,
1254                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1255                );
1256     if (EFI_ERROR (Status)) {
1257       return Status;
1258     }
1259
1260     if (mPlatformMode != SETUP_MODE) {
1261       Status = VendorKeyIsModified ();
1262     }
1263   }
1264
1265   return Status;
1266 }
1267
1268 /**
1269   Process variable with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS/EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
1270
1271   Caution: This function may receive untrusted input.
1272   This function may be invoked in SMM mode, and datasize and data are external input.
1273   This function will do basic validation, before parse the data.
1274   This function will parse the authentication carefully to avoid security issues, like
1275   buffer overflow, integer overflow.
1276   This function will check attribute carefully to avoid authentication bypass.
1277
1278   @param[in]  VariableName                Name of Variable to be found.
1279   @param[in]  VendorGuid                  Variable vendor GUID.
1280
1281   @param[in]  Data                        Data pointer.
1282   @param[in]  DataSize                    Size of Data found. If size is less than the
1283                                           data, this value contains the required size.
1284   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1285   @param[in]  Attributes                  Attribute value of the variable.
1286
1287   @return EFI_INVALID_PARAMETER           Invalid parameter.
1288   @return EFI_WRITE_PROTECTED             Variable is write-protected and needs authentication with
1289                                           EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1290   @return EFI_OUT_OF_RESOURCES            The Database to save the public key is full.
1291   @return EFI_SECURITY_VIOLATION          The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
1292                                           set, but the AuthInfo does NOT pass the validation
1293                                           check carried out by the firmware.
1294   @return EFI_SUCCESS                     Variable is not write-protected or pass validation successfully.
1295
1296 **/
1297 EFI_STATUS
1298 ProcessVariable (
1299   IN     CHAR16                             *VariableName,
1300   IN     EFI_GUID                           *VendorGuid,
1301   IN     VOID                               *Data,
1302   IN     UINTN                              DataSize,
1303   IN     VARIABLE_POINTER_TRACK             *Variable,
1304   IN     UINT32                             Attributes
1305   )
1306 {
1307   EFI_STATUS                      Status;
1308   BOOLEAN                         IsDeletion;
1309   BOOLEAN                         IsFirstTime;
1310   UINT8                           *PubKey;
1311   EFI_VARIABLE_AUTHENTICATION     *CertData;
1312   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
1313   UINT32                          KeyIndex;
1314   UINT64                          MonotonicCount;
1315   VARIABLE_ENTRY_CONSISTENCY      VariableDataEntry;
1316
1317   KeyIndex    = 0;
1318   CertData    = NULL;
1319   CertBlock   = NULL;
1320   PubKey      = NULL;
1321   IsDeletion  = FALSE;
1322
1323   if (NeedPhysicallyPresent(VariableName, VendorGuid) && !UserPhysicalPresent()) {
1324     //
1325     // This variable is protected, only physical present user could modify its value.
1326     //
1327     return EFI_SECURITY_VIOLATION;
1328   }
1329
1330   //
1331   // A time-based authenticated variable and a count-based authenticated variable
1332   // can't be updated by each other.
1333   //
1334   if (Variable->CurrPtr != NULL) {
1335     if (((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) &&
1336         ((Variable->CurrPtr->Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0)) {
1337       return EFI_SECURITY_VIOLATION;
1338     }
1339
1340     if (((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) &&
1341         ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0)) {
1342       return EFI_SECURITY_VIOLATION;
1343     }
1344   }
1345
1346   //
1347   // Process Time-based Authenticated variable.
1348   //
1349   if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1350     return VerifyTimeBasedPayload (
1351              VariableName,
1352              VendorGuid,
1353              Data,
1354              DataSize,
1355              Variable,
1356              Attributes,
1357              AuthVarTypePriv,
1358              NULL
1359              );
1360   }
1361
1362   //
1363   // Determine if first time SetVariable with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS.
1364   //
1365   if ((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) {
1366     //
1367     // Determine current operation type.
1368     //
1369     if (DataSize == AUTHINFO_SIZE) {
1370       IsDeletion = TRUE;
1371     }
1372     //
1373     // Determine whether this is the first time with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1374     //
1375     if (Variable->CurrPtr == NULL) {
1376       IsFirstTime = TRUE;
1377     } else if ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) == 0) {
1378       IsFirstTime = TRUE;
1379     } else {
1380       KeyIndex   = Variable->CurrPtr->PubKeyIndex;
1381       IsFirstTime = FALSE;
1382     }
1383   } else if ((Variable->CurrPtr != NULL) &&
1384              ((Variable->CurrPtr->Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)
1385             ) {
1386     //
1387     // If the variable is already write-protected, it always needs authentication before update.
1388     //
1389     return EFI_WRITE_PROTECTED;
1390   } else {
1391     //
1392     // If without EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS, set and attributes collision.
1393     // That means it is not authenticated variable, just update variable as usual.
1394     //
1395     Status = UpdateVariable (VariableName, VendorGuid, Data, DataSize, Attributes, 0, 0, Variable, NULL);
1396     return Status;
1397   }
1398
1399   //
1400   // Get PubKey and check Monotonic Count value corresponding to the variable.
1401   //
1402   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
1403   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
1404   PubKey    = CertBlock->PublicKey;
1405
1406   //
1407   // Update Monotonic Count value.
1408   //
1409   MonotonicCount = CertData->MonotonicCount;
1410
1411   if (!IsFirstTime) {
1412     //
1413     // Check input PubKey.
1414     //
1415     if (CompareMem (PubKey, mPubKeyStore + (KeyIndex - 1) * EFI_CERT_TYPE_RSA2048_SIZE, EFI_CERT_TYPE_RSA2048_SIZE) != 0) {
1416       return EFI_SECURITY_VIOLATION;
1417     }
1418     //
1419     // Compare the current monotonic count and ensure that it is greater than the last SetVariable
1420     // operation with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS attribute set.
1421     //
1422     if (CertData->MonotonicCount <= Variable->CurrPtr->MonotonicCount) {
1423       //
1424       // Monotonic count check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
1425       //
1426       return EFI_SECURITY_VIOLATION;
1427     }
1428   }
1429   //
1430   // Verify the certificate in Data payload.
1431   //
1432   Status = VerifyCounterBasedPayload (Data, DataSize, PubKey);
1433   if (EFI_ERROR (Status)) {
1434     return Status;
1435   }
1436
1437   //
1438   // Now, the signature has been verified!
1439   //
1440   if (IsFirstTime && !IsDeletion) {
1441     VariableDataEntry.VariableSize = DataSize - AUTHINFO_SIZE;
1442     VariableDataEntry.Guid         = VendorGuid;
1443     VariableDataEntry.Name         = VariableName;
1444
1445     //
1446     // Update public key database variable if need.
1447     //
1448     KeyIndex = AddPubKeyInStore (PubKey, &VariableDataEntry);
1449     if (KeyIndex == 0) {
1450       return EFI_OUT_OF_RESOURCES;
1451     }
1452   }
1453
1454   //
1455   // Verification pass.
1456   //
1457   return UpdateVariable (VariableName, VendorGuid, (UINT8*)Data + AUTHINFO_SIZE, DataSize - AUTHINFO_SIZE, Attributes, KeyIndex, MonotonicCount, Variable, NULL);
1458 }
1459
1460 /**
1461   Merge two buffers which formatted as EFI_SIGNATURE_LIST. Only the new EFI_SIGNATURE_DATA
1462   will be appended to the original EFI_SIGNATURE_LIST, duplicate EFI_SIGNATURE_DATA
1463   will be ignored.
1464
1465   @param[in, out]  Data              Pointer to original EFI_SIGNATURE_LIST.
1466   @param[in]       DataSize          Size of Data buffer.
1467   @param[in]       FreeBufSize       Size of free data buffer
1468   @param[in]       NewData           Pointer to new EFI_SIGNATURE_LIST to be appended.
1469   @param[in]       NewDataSize       Size of NewData buffer.
1470   @param[out]      MergedBufSize     Size of the merged buffer
1471
1472   @return EFI_BUFFER_TOO_SMALL if input Data buffer overflowed
1473
1474 **/
1475 EFI_STATUS
1476 AppendSignatureList (
1477   IN  OUT VOID            *Data,
1478   IN  UINTN               DataSize,
1479   IN  UINTN               FreeBufSize,
1480   IN  VOID                *NewData,
1481   IN  UINTN               NewDataSize,
1482   OUT UINTN               *MergedBufSize
1483   )
1484 {
1485   EFI_SIGNATURE_LIST  *CertList;
1486   EFI_SIGNATURE_DATA  *Cert;
1487   UINTN               CertCount;
1488   EFI_SIGNATURE_LIST  *NewCertList;
1489   EFI_SIGNATURE_DATA  *NewCert;
1490   UINTN               NewCertCount;
1491   UINTN               Index;
1492   UINTN               Index2;
1493   UINTN               Size;
1494   UINT8               *Tail;
1495   UINTN               CopiedCount;
1496   UINTN               SignatureListSize;
1497   BOOLEAN             IsNewCert;
1498
1499   Tail = (UINT8 *) Data + DataSize;
1500
1501   NewCertList = (EFI_SIGNATURE_LIST *) NewData;
1502   while ((NewDataSize > 0) && (NewDataSize >= NewCertList->SignatureListSize)) {
1503     NewCert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCertList + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1504     NewCertCount = (NewCertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - NewCertList->SignatureHeaderSize) / NewCertList->SignatureSize;
1505
1506     CopiedCount = 0;
1507     for (Index = 0; Index < NewCertCount; Index++) {
1508       IsNewCert = TRUE;
1509
1510       Size = DataSize;
1511       CertList = (EFI_SIGNATURE_LIST *) Data;
1512       while ((Size > 0) && (Size >= CertList->SignatureListSize)) {
1513         if (CompareGuid (&CertList->SignatureType, &NewCertList->SignatureType) &&
1514            (CertList->SignatureSize == NewCertList->SignatureSize)) {
1515           Cert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
1516           CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
1517           for (Index2 = 0; Index2 < CertCount; Index2++) {
1518             //
1519             // Iterate each Signature Data in this Signature List.
1520             //
1521             if (CompareMem (NewCert, Cert, CertList->SignatureSize) == 0) {
1522               IsNewCert = FALSE;
1523               break;
1524             }
1525             Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
1526           }
1527         }
1528
1529         if (!IsNewCert) {
1530           break;
1531         }
1532         Size -= CertList->SignatureListSize;
1533         CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
1534       }
1535
1536       if (IsNewCert) {
1537         //
1538         // New EFI_SIGNATURE_DATA, append it.
1539         //
1540         if (CopiedCount == 0) {
1541           if (FreeBufSize < sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize) {
1542             return EFI_BUFFER_TOO_SMALL;
1543           }
1544
1545           //
1546           // Copy EFI_SIGNATURE_LIST header for only once.
1547           //
1548
1549           CopyMem (Tail, NewCertList, sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1550           Tail = Tail + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1551           FreeBufSize -= sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1552         }
1553
1554         if (FreeBufSize < NewCertList->SignatureSize) {
1555           return EFI_BUFFER_TOO_SMALL;
1556         }
1557         CopyMem (Tail, NewCert, NewCertList->SignatureSize);
1558         Tail += NewCertList->SignatureSize;
1559         FreeBufSize -= NewCertList->SignatureSize;
1560         CopiedCount++;
1561       }
1562
1563       NewCert = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCert + NewCertList->SignatureSize);
1564     }
1565
1566     //
1567     // Update SignatureListSize in newly appended EFI_SIGNATURE_LIST.
1568     //
1569     if (CopiedCount != 0) {
1570       SignatureListSize = sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize + (CopiedCount * NewCertList->SignatureSize);
1571       CertList = (EFI_SIGNATURE_LIST *) (Tail - SignatureListSize);
1572       CertList->SignatureListSize = (UINT32) SignatureListSize;
1573     }
1574
1575     NewDataSize -= NewCertList->SignatureListSize;
1576     NewCertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) NewCertList + NewCertList->SignatureListSize);
1577   }
1578
1579   *MergedBufSize = (Tail - (UINT8 *) Data);
1580   return EFI_SUCCESS;
1581 }
1582
1583 /**
1584   Compare two EFI_TIME data.
1585
1586
1587   @param FirstTime           A pointer to the first EFI_TIME data.
1588   @param SecondTime          A pointer to the second EFI_TIME data.
1589
1590   @retval  TRUE              The FirstTime is not later than the SecondTime.
1591   @retval  FALSE             The FirstTime is later than the SecondTime.
1592
1593 **/
1594 BOOLEAN
1595 CompareTimeStamp (
1596   IN EFI_TIME               *FirstTime,
1597   IN EFI_TIME               *SecondTime
1598   )
1599 {
1600   if (FirstTime->Year != SecondTime->Year) {
1601     return (BOOLEAN) (FirstTime->Year < SecondTime->Year);
1602   } else if (FirstTime->Month != SecondTime->Month) {
1603     return (BOOLEAN) (FirstTime->Month < SecondTime->Month);
1604   } else if (FirstTime->Day != SecondTime->Day) {
1605     return (BOOLEAN) (FirstTime->Day < SecondTime->Day);
1606   } else if (FirstTime->Hour != SecondTime->Hour) {
1607     return (BOOLEAN) (FirstTime->Hour < SecondTime->Hour);
1608   } else if (FirstTime->Minute != SecondTime->Minute) {
1609     return (BOOLEAN) (FirstTime->Minute < SecondTime->Minute);
1610   }
1611
1612   return (BOOLEAN) (FirstTime->Second <= SecondTime->Second);
1613 }
1614
1615 /**
1616   Find matching signer's certificates for common authenticated variable
1617   by corresponding VariableName and VendorGuid from "certdb".
1618
1619   The data format of "certdb":
1620   //
1621   //     UINT32 CertDbListSize;
1622   // /// AUTH_CERT_DB_DATA Certs1[];
1623   // /// AUTH_CERT_DB_DATA Certs2[];
1624   // /// ...
1625   // /// AUTH_CERT_DB_DATA Certsn[];
1626   //
1627
1628   @param[in]  VariableName   Name of authenticated Variable.
1629   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1630   @param[in]  Data           Pointer to variable "certdb".
1631   @param[in]  DataSize       Size of variable "certdb".
1632   @param[out] CertOffset     Offset of matching CertData, from starting of Data.
1633   @param[out] CertDataSize   Length of CertData in bytes.
1634   @param[out] CertNodeOffset Offset of matching AUTH_CERT_DB_DATA , from
1635                              starting of Data.
1636   @param[out] CertNodeSize   Length of AUTH_CERT_DB_DATA in bytes.
1637
1638   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1639   @retval  EFI_NOT_FOUND         Fail to find matching certs.
1640   @retval  EFI_SUCCESS           Find matching certs and output parameters.
1641
1642 **/
1643 EFI_STATUS
1644 FindCertsFromDb (
1645   IN     CHAR16           *VariableName,
1646   IN     EFI_GUID         *VendorGuid,
1647   IN     UINT8            *Data,
1648   IN     UINTN            DataSize,
1649   OUT    UINT32           *CertOffset,    OPTIONAL
1650   OUT    UINT32           *CertDataSize,  OPTIONAL
1651   OUT    UINT32           *CertNodeOffset,OPTIONAL
1652   OUT    UINT32           *CertNodeSize   OPTIONAL
1653   )
1654 {
1655   UINT32                  Offset;
1656   AUTH_CERT_DB_DATA       *Ptr;
1657   UINT32                  CertSize;
1658   UINT32                  NameSize;
1659   UINT32                  NodeSize;
1660   UINT32                  CertDbListSize;
1661
1662   if ((VariableName == NULL) || (VendorGuid == NULL) || (Data == NULL)) {
1663     return EFI_INVALID_PARAMETER;
1664   }
1665
1666   //
1667   // Check whether DataSize matches recorded CertDbListSize.
1668   //
1669   if (DataSize < sizeof (UINT32)) {
1670     return EFI_INVALID_PARAMETER;
1671   }
1672
1673   CertDbListSize = ReadUnaligned32 ((UINT32 *) Data);
1674
1675   if (CertDbListSize != (UINT32) DataSize) {
1676     return EFI_INVALID_PARAMETER;
1677   }
1678
1679   Offset = sizeof (UINT32);
1680
1681   //
1682   // Get corresponding certificates by VendorGuid and VariableName.
1683   //
1684   while (Offset < (UINT32) DataSize) {
1685     Ptr = (AUTH_CERT_DB_DATA *) (Data + Offset);
1686     //
1687     // Check whether VendorGuid matches.
1688     //
1689     if (CompareGuid (&Ptr->VendorGuid, VendorGuid)) {
1690       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1691       NameSize = ReadUnaligned32 (&Ptr->NameSize);
1692       CertSize = ReadUnaligned32 (&Ptr->CertDataSize);
1693
1694       if (NodeSize != sizeof (EFI_GUID) + sizeof (UINT32) * 3 + CertSize +
1695           sizeof (CHAR16) * NameSize) {
1696         return EFI_INVALID_PARAMETER;
1697       }
1698
1699       Offset = Offset + sizeof (EFI_GUID) + sizeof (UINT32) * 3;
1700       //
1701       // Check whether VariableName matches.
1702       //
1703       if ((NameSize == StrLen (VariableName)) &&
1704           (CompareMem (Data + Offset, VariableName, NameSize * sizeof (CHAR16)) == 0)) {
1705         Offset = Offset + NameSize * sizeof (CHAR16);
1706
1707         if (CertOffset != NULL) {
1708           *CertOffset = Offset;
1709         }
1710
1711         if (CertDataSize != NULL) {
1712           *CertDataSize = CertSize;
1713         }
1714
1715         if (CertNodeOffset != NULL) {
1716           *CertNodeOffset = (UINT32) ((UINT8 *) Ptr - Data);
1717         }
1718
1719         if (CertNodeSize != NULL) {
1720           *CertNodeSize = NodeSize;
1721         }
1722
1723         return EFI_SUCCESS;
1724       } else {
1725         Offset = Offset + NameSize * sizeof (CHAR16) + CertSize;
1726       }
1727     } else {
1728       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1729       Offset   = Offset + NodeSize;
1730     }
1731   }
1732
1733   return EFI_NOT_FOUND;
1734 }
1735
1736 /**
1737   Retrieve signer's certificates for common authenticated variable
1738   by corresponding VariableName and VendorGuid from "certdb".
1739
1740   @param[in]  VariableName   Name of authenticated Variable.
1741   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1742   @param[out] CertData       Pointer to signer's certificates.
1743   @param[out] CertDataSize   Length of CertData in bytes.
1744
1745   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1746   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1747   @retval  EFI_SUCCESS           Get signer's certificates successfully.
1748
1749 **/
1750 EFI_STATUS
1751 GetCertsFromDb (
1752   IN     CHAR16           *VariableName,
1753   IN     EFI_GUID         *VendorGuid,
1754   OUT    UINT8            **CertData,
1755   OUT    UINT32           *CertDataSize
1756   )
1757 {
1758   VARIABLE_POINTER_TRACK  CertDbVariable;
1759   EFI_STATUS              Status;
1760   UINT8                   *Data;
1761   UINTN                   DataSize;
1762   UINT32                  CertOffset;
1763
1764   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL) || (CertDataSize == NULL)) {
1765     return EFI_INVALID_PARAMETER;
1766   }
1767
1768   //
1769   // Get variable "certdb".
1770   //
1771   Status = FindVariable (
1772              EFI_CERT_DB_NAME,
1773              &gEfiCertDbGuid,
1774              &CertDbVariable,
1775              &mVariableModuleGlobal->VariableGlobal,
1776              FALSE
1777              );
1778   if (EFI_ERROR (Status)) {
1779     return Status;
1780   }
1781
1782   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1783   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1784   if ((DataSize == 0) || (Data == NULL)) {
1785     ASSERT (FALSE);
1786     return EFI_NOT_FOUND;
1787   }
1788
1789   Status = FindCertsFromDb (
1790              VariableName,
1791              VendorGuid,
1792              Data,
1793              DataSize,
1794              &CertOffset,
1795              CertDataSize,
1796              NULL,
1797              NULL
1798              );
1799
1800   if (EFI_ERROR (Status)) {
1801     return Status;
1802   }
1803
1804   *CertData = Data + CertOffset;
1805   return EFI_SUCCESS;
1806 }
1807
1808 /**
1809   Delete matching signer's certificates when deleting common authenticated
1810   variable by corresponding VariableName and VendorGuid from "certdb".
1811
1812   @param[in]  VariableName   Name of authenticated Variable.
1813   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1814
1815   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1816   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1817   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
1818   @retval  EFI_SUCCESS           The operation is completed successfully.
1819
1820 **/
1821 EFI_STATUS
1822 DeleteCertsFromDb (
1823   IN     CHAR16           *VariableName,
1824   IN     EFI_GUID         *VendorGuid
1825   )
1826 {
1827   VARIABLE_POINTER_TRACK  CertDbVariable;
1828   EFI_STATUS              Status;
1829   UINT8                   *Data;
1830   UINTN                   DataSize;
1831   UINT32                  VarAttr;
1832   UINT32                  CertNodeOffset;
1833   UINT32                  CertNodeSize;
1834   UINT8                   *NewCertDb;
1835   UINT32                  NewCertDbSize;
1836
1837   if ((VariableName == NULL) || (VendorGuid == NULL)) {
1838     return EFI_INVALID_PARAMETER;
1839   }
1840
1841   //
1842   // Get variable "certdb".
1843   //
1844   Status = FindVariable (
1845              EFI_CERT_DB_NAME,
1846              &gEfiCertDbGuid,
1847              &CertDbVariable,
1848              &mVariableModuleGlobal->VariableGlobal,
1849              FALSE
1850              );
1851   if (EFI_ERROR (Status)) {
1852     return Status;
1853   }
1854
1855   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1856   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1857   if ((DataSize == 0) || (Data == NULL)) {
1858     ASSERT (FALSE);
1859     return EFI_NOT_FOUND;
1860   }
1861
1862   if (DataSize == sizeof (UINT32)) {
1863     //
1864     // There is no certs in certdb.
1865     //
1866     return EFI_SUCCESS;
1867   }
1868
1869   //
1870   // Get corresponding cert node from certdb.
1871   //
1872   Status = FindCertsFromDb (
1873              VariableName,
1874              VendorGuid,
1875              Data,
1876              DataSize,
1877              NULL,
1878              NULL,
1879              &CertNodeOffset,
1880              &CertNodeSize
1881              );
1882
1883   if (EFI_ERROR (Status)) {
1884     return Status;
1885   }
1886
1887   if (DataSize < (CertNodeOffset + CertNodeSize)) {
1888     return EFI_NOT_FOUND;
1889   }
1890
1891   //
1892   // Construct new data content of variable "certdb".
1893   //
1894   NewCertDbSize = (UINT32) DataSize - CertNodeSize;
1895   NewCertDb     = (UINT8*) mCertDbStore;
1896
1897   //
1898   // Copy the DB entries before deleting node.
1899   //
1900   CopyMem (NewCertDb, Data, CertNodeOffset);
1901   //
1902   // Update CertDbListSize.
1903   //
1904   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
1905   //
1906   // Copy the DB entries after deleting node.
1907   //
1908   if (DataSize > (CertNodeOffset + CertNodeSize)) {
1909     CopyMem (
1910       NewCertDb + CertNodeOffset,
1911       Data + CertNodeOffset + CertNodeSize,
1912       DataSize - CertNodeOffset - CertNodeSize
1913       );
1914   }
1915
1916   //
1917   // Set "certdb".
1918   //
1919   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
1920   Status   = UpdateVariable (
1921                EFI_CERT_DB_NAME,
1922                &gEfiCertDbGuid,
1923                NewCertDb,
1924                NewCertDbSize,
1925                VarAttr,
1926                0,
1927                0,
1928                &CertDbVariable,
1929                NULL
1930                );
1931
1932   return Status;
1933 }
1934
1935 /**
1936   Insert signer's certificates for common authenticated variable with VariableName
1937   and VendorGuid in AUTH_CERT_DB_DATA to "certdb".
1938
1939   @param[in]  VariableName   Name of authenticated Variable.
1940   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1941   @param[in]  CertData       Pointer to signer's certificates.
1942   @param[in]  CertDataSize   Length of CertData in bytes.
1943
1944   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1945   @retval  EFI_ACCESS_DENIED     An AUTH_CERT_DB_DATA entry with same VariableName
1946                                  and VendorGuid already exists.
1947   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
1948   @retval  EFI_SUCCESS           Insert an AUTH_CERT_DB_DATA entry to "certdb"
1949
1950 **/
1951 EFI_STATUS
1952 InsertCertsToDb (
1953   IN     CHAR16           *VariableName,
1954   IN     EFI_GUID         *VendorGuid,
1955   IN     UINT8            *CertData,
1956   IN     UINTN            CertDataSize
1957   )
1958 {
1959   VARIABLE_POINTER_TRACK  CertDbVariable;
1960   EFI_STATUS              Status;
1961   UINT8                   *Data;
1962   UINTN                   DataSize;
1963   UINT32                  VarAttr;
1964   UINT8                   *NewCertDb;
1965   UINT32                  NewCertDbSize;
1966   UINT32                  CertNodeSize;
1967   UINT32                  NameSize;
1968   AUTH_CERT_DB_DATA       *Ptr;
1969
1970   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL)) {
1971     return EFI_INVALID_PARAMETER;
1972   }
1973
1974   //
1975   // Get variable "certdb".
1976   //
1977   Status = FindVariable (
1978              EFI_CERT_DB_NAME,
1979              &gEfiCertDbGuid,
1980              &CertDbVariable,
1981              &mVariableModuleGlobal->VariableGlobal,
1982              FALSE
1983              );
1984   if (EFI_ERROR (Status)) {
1985     return Status;
1986   }
1987
1988   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1989   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1990   if ((DataSize == 0) || (Data == NULL)) {
1991     ASSERT (FALSE);
1992     return EFI_NOT_FOUND;
1993   }
1994
1995   //
1996   // Find whether matching cert node already exists in "certdb".
1997   // If yes return error.
1998   //
1999   Status = FindCertsFromDb (
2000              VariableName,
2001              VendorGuid,
2002              Data,
2003              DataSize,
2004              NULL,
2005              NULL,
2006              NULL,
2007              NULL
2008              );
2009
2010   if (!EFI_ERROR (Status)) {
2011     ASSERT (FALSE);
2012     return EFI_ACCESS_DENIED;
2013   }
2014
2015   //
2016   // Construct new data content of variable "certdb".
2017   //
2018   NameSize      = (UINT32) StrLen (VariableName);
2019   CertNodeSize  = sizeof (AUTH_CERT_DB_DATA) + (UINT32) CertDataSize + NameSize * sizeof (CHAR16);
2020   NewCertDbSize = (UINT32) DataSize + CertNodeSize;
2021   if (NewCertDbSize > mMaxCertDbSize) {
2022     return EFI_OUT_OF_RESOURCES;
2023   }
2024   NewCertDb     = (UINT8*) mCertDbStore;
2025
2026   //
2027   // Copy the DB entries before deleting node.
2028   //
2029   CopyMem (NewCertDb, Data, DataSize);
2030   //
2031   // Update CertDbListSize.
2032   //
2033   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
2034   //
2035   // Construct new cert node.
2036   //
2037   Ptr = (AUTH_CERT_DB_DATA *) (NewCertDb + DataSize);
2038   CopyGuid (&Ptr->VendorGuid, VendorGuid);
2039   CopyMem (&Ptr->CertNodeSize, &CertNodeSize, sizeof (UINT32));
2040   CopyMem (&Ptr->NameSize, &NameSize, sizeof (UINT32));
2041   CopyMem (&Ptr->CertDataSize, &CertDataSize, sizeof (UINT32));
2042
2043   CopyMem (
2044     (UINT8 *) Ptr + sizeof (AUTH_CERT_DB_DATA),
2045     VariableName,
2046     NameSize * sizeof (CHAR16)
2047     );
2048
2049   CopyMem (
2050     (UINT8 *) Ptr +  sizeof (AUTH_CERT_DB_DATA) + NameSize * sizeof (CHAR16),
2051     CertData,
2052     CertDataSize
2053     );
2054
2055   //
2056   // Set "certdb".
2057   //
2058   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
2059   Status   = UpdateVariable (
2060                EFI_CERT_DB_NAME,
2061                &gEfiCertDbGuid,
2062                NewCertDb,
2063                NewCertDbSize,
2064                VarAttr,
2065                0,
2066                0,
2067                &CertDbVariable,
2068                NULL
2069                );
2070
2071   return Status;
2072 }
2073
2074 /**
2075   Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
2076
2077   Caution: This function may receive untrusted input.
2078   This function may be invoked in SMM mode, and datasize and data are external input.
2079   This function will do basic validation, before parse the data.
2080   This function will parse the authentication carefully to avoid security issues, like
2081   buffer overflow, integer overflow.
2082
2083   @param[in]  VariableName                Name of Variable to be found.
2084   @param[in]  VendorGuid                  Variable vendor GUID.
2085   @param[in]  Data                        Data pointer.
2086   @param[in]  DataSize                    Size of Data found. If size is less than the
2087                                           data, this value contains the required size.
2088   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
2089   @param[in]  Attributes                  Attribute value of the variable.
2090   @param[in]  AuthVarType                 Verify against PK, KEK database, private database or certificate in data payload.
2091   @param[out] VarDel                      Delete the variable or not.
2092
2093   @retval EFI_INVALID_PARAMETER           Invalid parameter.
2094   @retval EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
2095                                           check carried out by the firmware.
2096   @retval EFI_OUT_OF_RESOURCES            Failed to process variable due to lack
2097                                           of resources.
2098   @retval EFI_SUCCESS                     Variable pass validation successfully.
2099
2100 **/
2101 EFI_STATUS
2102 VerifyTimeBasedPayload (
2103   IN     CHAR16                             *VariableName,
2104   IN     EFI_GUID                           *VendorGuid,
2105   IN     VOID                               *Data,
2106   IN     UINTN                              DataSize,
2107   IN     VARIABLE_POINTER_TRACK             *Variable,
2108   IN     UINT32                             Attributes,
2109   IN     AUTHVAR_TYPE                       AuthVarType,
2110   OUT    BOOLEAN                            *VarDel
2111   )
2112 {
2113   UINT8                            *RootCert;
2114   UINT8                            *SigData;
2115   UINT8                            *PayloadPtr;
2116   UINTN                            RootCertSize;
2117   UINTN                            Index;
2118   UINTN                            CertCount;
2119   UINTN                            PayloadSize;
2120   UINT32                           Attr;
2121   UINT32                           SigDataSize;
2122   UINT32                           KekDataSize;
2123   BOOLEAN                          VerifyStatus;
2124   EFI_STATUS                       Status;
2125   EFI_SIGNATURE_LIST               *CertList;
2126   EFI_SIGNATURE_DATA               *Cert;
2127   VARIABLE_POINTER_TRACK           KekVariable;
2128   EFI_VARIABLE_AUTHENTICATION_2    *CertData;
2129   UINT8                            *NewData;
2130   UINTN                            NewDataSize;
2131   VARIABLE_POINTER_TRACK           PkVariable;
2132   UINT8                            *Buffer;
2133   UINTN                            Length;
2134   UINT8                            *SignerCerts;
2135   UINT8                            *WrapSigData;
2136   UINTN                            CertStackSize;
2137   UINT8                            *CertsInCertDb;
2138   UINT32                           CertsSizeinDb;
2139
2140   VerifyStatus           = FALSE;
2141   CertData               = NULL;
2142   NewData                = NULL;
2143   Attr                   = Attributes;
2144   WrapSigData            = NULL;
2145   SignerCerts            = NULL;
2146   RootCert               = NULL;
2147   CertsInCertDb          = NULL;
2148
2149   //
2150   // When the attribute EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS is
2151   // set, then the Data buffer shall begin with an instance of a complete (and serialized)
2152   // EFI_VARIABLE_AUTHENTICATION_2 descriptor. The descriptor shall be followed by the new
2153   // variable value and DataSize shall reflect the combined size of the descriptor and the new
2154   // variable value. The authentication descriptor is not part of the variable data and is not
2155   // returned by subsequent calls to GetVariable().
2156   //
2157   CertData = (EFI_VARIABLE_AUTHENTICATION_2 *) Data;
2158
2159   //
2160   // Verify that Pad1, Nanosecond, TimeZone, Daylight and Pad2 components of the
2161   // TimeStamp value are set to zero.
2162   //
2163   if ((CertData->TimeStamp.Pad1 != 0) ||
2164       (CertData->TimeStamp.Nanosecond != 0) ||
2165       (CertData->TimeStamp.TimeZone != 0) ||
2166       (CertData->TimeStamp.Daylight != 0) ||
2167       (CertData->TimeStamp.Pad2 != 0)) {
2168     return EFI_SECURITY_VIOLATION;
2169   }
2170
2171   if ((Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
2172     if (CompareTimeStamp (&CertData->TimeStamp, &Variable->CurrPtr->TimeStamp)) {
2173       //
2174       // TimeStamp check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
2175       //
2176       return EFI_SECURITY_VIOLATION;
2177     }
2178   }
2179
2180   //
2181   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
2182   // Cert type should be EFI_CERT_TYPE_PKCS7_GUID.
2183   //
2184   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
2185       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertPkcs7Guid)) {
2186     //
2187     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
2188     //
2189     return EFI_SECURITY_VIOLATION;
2190   }
2191
2192   //
2193   // Find out Pkcs7 SignedData which follows the EFI_VARIABLE_AUTHENTICATION_2 descriptor.
2194   // AuthInfo.Hdr.dwLength is the length of the entire certificate, including the length of the header.
2195   //
2196   SigData = CertData->AuthInfo.CertData;
2197   SigDataSize = CertData->AuthInfo.Hdr.dwLength - (UINT32) (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData));
2198
2199   //
2200   // Find out the new data payload which follows Pkcs7 SignedData directly.
2201   //
2202   PayloadPtr = SigData + SigDataSize;
2203   PayloadSize = DataSize - OFFSET_OF_AUTHINFO2_CERT_DATA - (UINTN) SigDataSize;
2204
2205   //
2206   // Construct a buffer to fill with (VariableName, VendorGuid, Attributes, TimeStamp, Data).
2207   //
2208   NewDataSize = PayloadSize + sizeof (EFI_TIME) + sizeof (UINT32) +
2209                 sizeof (EFI_GUID) + StrSize (VariableName) - sizeof (CHAR16);
2210   NewData = mSerializationRuntimeBuffer;
2211
2212   Buffer = NewData;
2213   Length = StrLen (VariableName) * sizeof (CHAR16);
2214   CopyMem (Buffer, VariableName, Length);
2215   Buffer += Length;
2216
2217   Length = sizeof (EFI_GUID);
2218   CopyMem (Buffer, VendorGuid, Length);
2219   Buffer += Length;
2220
2221   Length = sizeof (UINT32);
2222   CopyMem (Buffer, &Attr, Length);
2223   Buffer += Length;
2224
2225   Length = sizeof (EFI_TIME);
2226   CopyMem (Buffer, &CertData->TimeStamp, Length);
2227   Buffer += Length;
2228
2229   CopyMem (Buffer, PayloadPtr, PayloadSize);
2230
2231   if (AuthVarType == AuthVarTypePk) {
2232     //
2233     // Verify that the signature has been made with the current Platform Key (no chaining for PK).
2234     // First, get signer's certificates from SignedData.
2235     //
2236     VerifyStatus = Pkcs7GetSigners (
2237                      SigData,
2238                      SigDataSize,
2239                      &SignerCerts,
2240                      &CertStackSize,
2241                      &RootCert,
2242                      &RootCertSize
2243                      );
2244     if (!VerifyStatus) {
2245       goto Exit;
2246     }
2247
2248     //
2249     // Second, get the current platform key from variable. Check whether it's identical with signer's certificates
2250     // in SignedData. If not, return error immediately.
2251     //
2252     Status = FindVariable (
2253                EFI_PLATFORM_KEY_NAME,
2254                &gEfiGlobalVariableGuid,
2255                &PkVariable,
2256                &mVariableModuleGlobal->VariableGlobal,
2257                FALSE
2258                );
2259     if (EFI_ERROR (Status)) {
2260       VerifyStatus = FALSE;
2261       goto Exit;
2262     }
2263     CertList = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (PkVariable.CurrPtr);
2264     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2265     if ((RootCertSize != (CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1))) ||
2266         (CompareMem (Cert->SignatureData, RootCert, RootCertSize) != 0)) {
2267       VerifyStatus = FALSE;
2268       goto Exit;
2269     }
2270
2271     //
2272     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2273     //
2274     VerifyStatus = Pkcs7Verify (
2275                      SigData,
2276                      SigDataSize,
2277                      RootCert,
2278                      RootCertSize,
2279                      NewData,
2280                      NewDataSize
2281                      );
2282
2283   } else if (AuthVarType == AuthVarTypeKek) {
2284
2285     //
2286     // Get KEK database from variable.
2287     //
2288     Status = FindVariable (
2289                EFI_KEY_EXCHANGE_KEY_NAME,
2290                &gEfiGlobalVariableGuid,
2291                &KekVariable,
2292                &mVariableModuleGlobal->VariableGlobal,
2293                FALSE
2294                );
2295     if (EFI_ERROR (Status)) {
2296       return Status;
2297     }
2298
2299     //
2300     // Ready to verify Pkcs7 SignedData. Go through KEK Signature Database to find out X.509 CertList.
2301     //
2302     KekDataSize      = KekVariable.CurrPtr->DataSize;
2303     CertList         = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (KekVariable.CurrPtr);
2304     while ((KekDataSize > 0) && (KekDataSize >= CertList->SignatureListSize)) {
2305       if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {
2306         Cert       = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2307         CertCount  = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
2308         for (Index = 0; Index < CertCount; Index++) {
2309           //
2310           // Iterate each Signature Data Node within this CertList for a verify
2311           //
2312           RootCert      = Cert->SignatureData;
2313           RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2314
2315           //
2316           // Verify Pkcs7 SignedData via Pkcs7Verify library.
2317           //
2318           VerifyStatus = Pkcs7Verify (
2319                            SigData,
2320                            SigDataSize,
2321                            RootCert,
2322                            RootCertSize,
2323                            NewData,
2324                            NewDataSize
2325                            );
2326           if (VerifyStatus) {
2327             goto Exit;
2328           }
2329           Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
2330         }
2331       }
2332       KekDataSize -= CertList->SignatureListSize;
2333       CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
2334     }
2335   } else if (AuthVarType == AuthVarTypePriv) {
2336
2337     //
2338     // Process common authenticated variable except PK/KEK/DB/DBX.
2339     // Get signer's certificates from SignedData.
2340     //
2341     VerifyStatus = Pkcs7GetSigners (
2342                      SigData,
2343                      SigDataSize,
2344                      &SignerCerts,
2345                      &CertStackSize,
2346                      &RootCert,
2347                      &RootCertSize
2348                      );
2349     if (!VerifyStatus) {
2350       goto Exit;
2351     }
2352
2353     //
2354     // Get previously stored signer's certificates from certdb for existing
2355     // variable. Check whether they are identical with signer's certificates
2356     // in SignedData. If not, return error immediately.
2357     //
2358     if ((Variable->CurrPtr != NULL)) {
2359       VerifyStatus = FALSE;
2360
2361       Status = GetCertsFromDb (VariableName, VendorGuid, &CertsInCertDb, &CertsSizeinDb);
2362       if (EFI_ERROR (Status)) {
2363         goto Exit;
2364       }
2365
2366       if ((CertStackSize != CertsSizeinDb) ||
2367           (CompareMem (SignerCerts, CertsInCertDb, CertsSizeinDb) != 0)) {
2368         goto Exit;
2369       }
2370     }
2371
2372     VerifyStatus = Pkcs7Verify (
2373                      SigData,
2374                      SigDataSize,
2375                      RootCert,
2376                      RootCertSize,
2377                      NewData,
2378                      NewDataSize
2379                      );
2380     if (!VerifyStatus) {
2381       goto Exit;
2382     }
2383
2384     //
2385     // Delete signer's certificates when delete the common authenticated variable.
2386     //
2387     if ((PayloadSize == 0) && (Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
2388       Status = DeleteCertsFromDb (VariableName, VendorGuid);
2389       if (EFI_ERROR (Status)) {
2390         VerifyStatus = FALSE;
2391         goto Exit;
2392       }
2393     } else if (Variable->CurrPtr == NULL && PayloadSize != 0) {
2394       //
2395       // Insert signer's certificates when adding a new common authenticated variable.
2396       //
2397       Status = InsertCertsToDb (VariableName, VendorGuid, SignerCerts, CertStackSize);
2398       if (EFI_ERROR (Status)) {
2399         VerifyStatus = FALSE;
2400         goto Exit;
2401       }
2402     }
2403   } else if (AuthVarType == AuthVarTypePayload) {
2404     CertList = (EFI_SIGNATURE_LIST *) PayloadPtr;
2405     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2406     RootCert      = Cert->SignatureData;
2407     RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2408
2409     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2410     //
2411     VerifyStatus = Pkcs7Verify (
2412                      SigData,
2413                      SigDataSize,
2414                      RootCert,
2415                      RootCertSize,
2416                      NewData,
2417                      NewDataSize
2418                      );
2419   } else {
2420     return EFI_SECURITY_VIOLATION;
2421   }
2422
2423 Exit:
2424
2425   if (AuthVarType == AuthVarTypePk || AuthVarType == AuthVarTypePriv) {
2426     Pkcs7FreeSigners (RootCert);
2427     Pkcs7FreeSigners (SignerCerts);
2428   }
2429
2430   if (!VerifyStatus) {
2431     return EFI_SECURITY_VIOLATION;
2432   }
2433
2434   Status = CheckSignatureListFormat(VariableName, VendorGuid, PayloadPtr, PayloadSize);
2435   if (EFI_ERROR (Status)) {
2436     return Status;
2437   }
2438
2439   if ((PayloadSize == 0) && (VarDel != NULL)) {
2440     *VarDel = TRUE;
2441   }
2442
2443   //
2444   // Final step: Update/Append Variable if it pass Pkcs7Verify
2445   //
2446   return UpdateVariable (
2447            VariableName,
2448            VendorGuid,
2449            PayloadPtr,
2450            PayloadSize,
2451            Attributes,
2452            0,
2453            0,
2454            Variable,
2455            &CertData->TimeStamp
2456            );
2457 }
2458