SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c

   1 /** @file
   2   Implement authentication services for the authenticated variable
   3   service in UEFI2.2.
   4
   5   Caution: This module requires additional review when modified.
   6   This driver will have external input - variable data. It may be input in SMM mode.
   7   This external input must be validated carefully to avoid security issue like
   8   buffer overflow, integer overflow.
   9   Variable attribute should also be checked to avoid authentication bypass.
  10      The whole SMM authentication variable design relies on the integrity of flash part and SMM.
  11   which is assumed to be protected by platform.  All variable code and metadata in flash/SMM Memory
  12   may not be modified without authorization. If platform fails to protect these resources,
  13   the authentication service provided in this driver will be broken, and the behavior is undefined.
  14
  15   ProcessVarWithPk(), ProcessVarWithKek() and ProcessVariable() are the function to do
  16   variable authentication.
  17
  18   VerifyTimeBasedPayload() and VerifyCounterBasedPayload() are sub function to do verification.
  19   They will do basic validation for authentication data structure, then call crypto library
  20   to verify the signature.
  21
  22 Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>
  23 This program and the accompanying materials
  24 are licensed and made available under the terms and conditions of the BSD License
  25 which accompanies this distribution.  The full text of the license may be found at
  26 http://opensource.org/licenses/bsd-license.php
  27
  28 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  29 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  30
  31 **/
  32
  33 #include "Variable.h"
  34 #include "AuthService.h"
  35
  36 ///
  37 /// Global database array for scratch
  38 ///
  39 UINT8    *mPubKeyStore;
  40 UINT32   mPubKeyNumber;
  41 UINT32   mMaxKeyNumber;
  42 UINT32   mMaxKeyDbSize;
  43 UINT8    *mCertDbStore;
  44 UINT32   mMaxCertDbSize;
  45 UINT32   mPlatformMode;
  46 UINT8    mVendorKeyState;
  47
  48 EFI_GUID mSignatureSupport[] = {EFI_CERT_SHA1_GUID, EFI_CERT_SHA256_GUID, EFI_CERT_RSA2048_GUID, EFI_CERT_X509_GUID};
  49 //
  50 // Public Exponent of RSA Key.
  51 //
  52 CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };
  53 //
  54 // Hash context pointer
  55 //
  56 VOID  *mHashCtx = NULL;
  57
  58 //
  59 // The serialization of the values of the VariableName, VendorGuid and Attributes
  60 // parameters of the SetVariable() call and the TimeStamp component of the
  61 // EFI_VARIABLE_AUTHENTICATION_2 descriptor followed by the variable's new value
  62 // i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data)
  63 //
  64 UINT8 *mSerializationRuntimeBuffer = NULL;
  65
  66 //
  67 // Requirement for different signature type which have been defined in UEFI spec.
  68 // These data are used to peform SignatureList format check while setting PK/KEK variable.
  69 //
  70 EFI_SIGNATURE_ITEM mSupportSigItem[] = {
  71 //{SigType,                       SigHeaderSize,   SigDataSize  }
  72   {EFI_CERT_SHA256_GUID,          0,               32           },
  73   {EFI_CERT_RSA2048_GUID,         0,               256          },
  74   {EFI_CERT_RSA2048_SHA256_GUID,  0,               256          },
  75   {EFI_CERT_SHA1_GUID,            0,               20           },
  76   {EFI_CERT_RSA2048_SHA1_GUID,    0,               256          },
  77   {EFI_CERT_X509_GUID,            0,               ((UINT32) ~0)},
  78   {EFI_CERT_SHA224_GUID,          0,               28           },
  79   {EFI_CERT_SHA384_GUID,          0,               48           },
  80   {EFI_CERT_SHA512_GUID,          0,               64           },
  81   {EFI_CERT_X509_SHA256_GUID,     0,               48           },
  82   {EFI_CERT_X509_SHA384_GUID,     0,               64           },
  83   {EFI_CERT_X509_SHA512_GUID,     0,               80           }
  84 };
  85
  86 /**
  87   Determine whether this operation needs a physical present user.
  88
  89   @param[in]      VariableName            Name of the Variable.
  90   @param[in]      VendorGuid              GUID of the Variable.
  91
  92   @retval TRUE      This variable is protected, only a physical present user could set this variable.
  93   @retval FALSE     This variable is not protected.
  94
  95 **/
  96 BOOLEAN
  97 NeedPhysicallyPresent(
  98   IN     CHAR16         *VariableName,
  99   IN     EFI_GUID       *VendorGuid
 100   )
 101 {
 102   if ((CompareGuid (VendorGuid, &gEfiSecureBootEnableDisableGuid) && (StrCmp (VariableName, EFI_SECURE_BOOT_ENABLE_NAME) == 0))
 103     || (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (VariableName, EFI_CUSTOM_MODE_NAME) == 0))) {
 104     return TRUE;
 105   }
 106
 107   return FALSE;
 108 }
 109
 110 /**
 111   Determine whether the platform is operating in Custom Secure Boot mode.
 112
 113   @retval TRUE           The platform is operating in Custom mode.
 114   @retval FALSE          The platform is operating in Standard mode.
 115
 116 **/
 117 BOOLEAN
 118 InCustomMode (
 119   VOID
 120   )
 121 {
 122   VARIABLE_POINTER_TRACK  Variable;
 123
 124   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 125   if (Variable.CurrPtr != NULL && *(GetVariableDataPtr (Variable.CurrPtr)) == CUSTOM_SECURE_BOOT_MODE) {
 126     return TRUE;
 127   }
 128
 129   return FALSE;
 130 }
 131
 132 /**
 133   Initializes for authenticated varibale service.
 134
 135   @retval EFI_SUCCESS           Function successfully executed.
 136   @retval EFI_OUT_OF_RESOURCES  Fail to allocate enough memory resources.
 137
 138 **/
 139 EFI_STATUS
 140 AutenticatedVariableServiceInitialize (
 141   VOID
 142   )
 143 {
 144   EFI_STATUS              Status;
 145   VARIABLE_POINTER_TRACK  Variable;
 146   VARIABLE_POINTER_TRACK  PkVariable;
 147   UINT8                   VarValue;
 148   UINT32                  VarAttr;
 149   UINT8                   *Data;
 150   UINTN                   DataSize;
 151   UINTN                   CtxSize;
 152   UINT8                   SecureBootMode;
 153   UINT8                   SecureBootEnable;
 154   UINT8                   CustomMode;
 155   UINT32                  ListSize;
 156
 157   //
 158   // Initialize hash context.
 159   //
 160   CtxSize   = Sha256GetContextSize ();
 161   mHashCtx  = AllocateRuntimePool (CtxSize);
 162   if (mHashCtx == NULL) {
 163     return EFI_OUT_OF_RESOURCES;
 164   }
 165
 166   //
 167   // Reserve runtime buffer for public key database. The size excludes variable header and name size.
 168   //
 169   mMaxKeyDbSize = PcdGet32 (PcdMaxVariableSize) - sizeof (VARIABLE_HEADER) - sizeof (AUTHVAR_KEYDB_NAME);
 170   mMaxKeyNumber = mMaxKeyDbSize / EFI_CERT_TYPE_RSA2048_SIZE;
 171   mPubKeyStore  = AllocateRuntimePool (mMaxKeyDbSize);
 172   if (mPubKeyStore == NULL) {
 173     return EFI_OUT_OF_RESOURCES;
 174   }
 175
 176   //
 177   // Reserve runtime buffer for certificate database. The size excludes variable header and name size.
 178   //
 179   mMaxCertDbSize = PcdGet32 (PcdMaxVariableSize) - sizeof (VARIABLE_HEADER) - sizeof (EFI_CERT_DB_NAME);
 180   mCertDbStore   = AllocateRuntimePool (mMaxCertDbSize);
 181   if (mCertDbStore == NULL) {
 182     return EFI_OUT_OF_RESOURCES;
 183   }
 184
 185   //
 186   // Prepare runtime buffer for serialized data of time-based authenticated
 187   // Variable, i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data).
 188   //
 189   mSerializationRuntimeBuffer = AllocateRuntimePool (PcdGet32 (PcdMaxVariableSize) + sizeof (EFI_GUID) + sizeof (UINT32) + sizeof (EFI_TIME));
 190   if (mSerializationRuntimeBuffer == NULL) {
 191     return EFI_OUT_OF_RESOURCES;
 192   }
 193
 194   //
 195   // Check "AuthVarKeyDatabase" variable's existence.
 196   // If it doesn't exist, create a new one with initial value of 0 and EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
 197   //
 198   Status = FindVariable (
 199              AUTHVAR_KEYDB_NAME,
 200              &gEfiAuthenticatedVariableGuid,
 201              &Variable,
 202              &mVariableModuleGlobal->VariableGlobal,
 203              FALSE
 204              );
 205
 206   if (Variable.CurrPtr == NULL) {
 207     VarAttr       = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 208     VarValue      = 0;
 209     mPubKeyNumber = 0;
 210     Status        = UpdateVariable (
 211                       AUTHVAR_KEYDB_NAME,
 212                       &gEfiAuthenticatedVariableGuid,
 213                       &VarValue,
 214                       sizeof(UINT8),
 215                       VarAttr,
 216                       0,
 217                       0,
 218                       &Variable,
 219                       NULL
 220                       );
 221     if (EFI_ERROR (Status)) {
 222       return Status;
 223     }
 224   } else {
 225     //
 226     // Load database in global variable for cache.
 227     //
 228     DataSize  = DataSizeOfVariable (Variable.CurrPtr);
 229     Data      = GetVariableDataPtr (Variable.CurrPtr);
 230     ASSERT ((DataSize != 0) && (Data != NULL));
 231     //
 232     // "AuthVarKeyDatabase" is an internal variable. Its DataSize is always ensured not to exceed mPubKeyStore buffer size(See definition before)
 233     //  Therefore, there is no memory overflow in underlying CopyMem.
 234     //
 235     CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
 236     mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
 237   }
 238
 239   FindVariable (EFI_PLATFORM_KEY_NAME, &gEfiGlobalVariableGuid, &PkVariable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 240   if (PkVariable.CurrPtr == NULL) {
 241     DEBUG ((EFI_D_INFO, "Variable %s does not exist.\n", EFI_PLATFORM_KEY_NAME));
 242   } else {
 243     DEBUG ((EFI_D_INFO, "Variable %s exists.\n", EFI_PLATFORM_KEY_NAME));
 244   }
 245
 246   //
 247   // Create "SetupMode" variable with BS+RT attribute set.
 248   //
 249   FindVariable (EFI_SETUP_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 250   if (PkVariable.CurrPtr == NULL) {
 251     mPlatformMode = SETUP_MODE;
 252   } else {
 253     mPlatformMode = USER_MODE;
 254   }
 255   Status = UpdateVariable (
 256              EFI_SETUP_MODE_NAME,
 257              &gEfiGlobalVariableGuid,
 258              &mPlatformMode,
 259              sizeof(UINT8),
 260              EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 261              0,
 262              0,
 263              &Variable,
 264              NULL
 265              );
 266   if (EFI_ERROR (Status)) {
 267     return Status;
 268   }
 269
 270   //
 271   // Create "SignatureSupport" variable with BS+RT attribute set.
 272   //
 273   FindVariable (EFI_SIGNATURE_SUPPORT_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 274   Status  = UpdateVariable (
 275               EFI_SIGNATURE_SUPPORT_NAME,
 276               &gEfiGlobalVariableGuid,
 277               mSignatureSupport,
 278               sizeof(mSignatureSupport),
 279               EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 280               0,
 281               0,
 282               &Variable,
 283               NULL
 284               );
 285   if (EFI_ERROR (Status)) {
 286     return Status;
 287   }
 288
 289   //
 290   // If "SecureBootEnable" variable exists, then update "SecureBoot" variable.
 291   // If "SecureBootEnable" variable is SECURE_BOOT_ENABLE and in USER_MODE, Set "SecureBoot" variable to SECURE_BOOT_MODE_ENABLE.
 292   // If "SecureBootEnable" variable is SECURE_BOOT_DISABLE, Set "SecureBoot" variable to SECURE_BOOT_MODE_DISABLE.
 293   //
 294   SecureBootEnable = SECURE_BOOT_DISABLE;
 295   FindVariable (EFI_SECURE_BOOT_ENABLE_NAME, &gEfiSecureBootEnableDisableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 296   if (Variable.CurrPtr != NULL) {
 297     SecureBootEnable = *(GetVariableDataPtr (Variable.CurrPtr));
 298   } else if (mPlatformMode == USER_MODE) {
 299     //
 300     // "SecureBootEnable" not exist, initialize it in USER_MODE.
 301     //
 302     SecureBootEnable = SECURE_BOOT_ENABLE;
 303     Status = UpdateVariable (
 304                EFI_SECURE_BOOT_ENABLE_NAME,
 305                &gEfiSecureBootEnableDisableGuid,
 306                &SecureBootEnable,
 307                sizeof (UINT8),
 308                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 309                0,
 310                0,
 311                &Variable,
 312                NULL
 313                );
 314     if (EFI_ERROR (Status)) {
 315       return Status;
 316     }
 317   }
 318
 319   //
 320   // Create "SecureBoot" variable with BS+RT attribute set.
 321   //
 322   if (SecureBootEnable == SECURE_BOOT_ENABLE && mPlatformMode == USER_MODE) {
 323     SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 324   } else {
 325     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 326   }
 327   FindVariable (EFI_SECURE_BOOT_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 328   Status = UpdateVariable (
 329              EFI_SECURE_BOOT_MODE_NAME,
 330              &gEfiGlobalVariableGuid,
 331              &SecureBootMode,
 332              sizeof (UINT8),
 333              EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 334              0,
 335              0,
 336              &Variable,
 337              NULL
 338              );
 339   if (EFI_ERROR (Status)) {
 340     return Status;
 341   }
 342
 343   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SETUP_MODE_NAME, mPlatformMode));
 344   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_MODE_NAME, SecureBootMode));
 345   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_ENABLE_NAME, SecureBootEnable));
 346
 347   //
 348   // Initialize "CustomMode" in STANDARD_SECURE_BOOT_MODE state.
 349   //
 350   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 351   CustomMode = STANDARD_SECURE_BOOT_MODE;
 352   Status = UpdateVariable (
 353              EFI_CUSTOM_MODE_NAME,
 354              &gEfiCustomModeEnableGuid,
 355              &CustomMode,
 356              sizeof (UINT8),
 357              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 358              0,
 359              0,
 360              &Variable,
 361              NULL
 362              );
 363   if (EFI_ERROR (Status)) {
 364     return Status;
 365   }
 366
 367   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_CUSTOM_MODE_NAME, CustomMode));
 368
 369   //
 370   // Check "certdb" variable's existence.
 371   // If it doesn't exist, then create a new one with
 372   // EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.
 373   //
 374   Status = FindVariable (
 375              EFI_CERT_DB_NAME,
 376              &gEfiCertDbGuid,
 377              &Variable,
 378              &mVariableModuleGlobal->VariableGlobal,
 379              FALSE
 380              );
 381
 382   if (Variable.CurrPtr == NULL) {
 383     VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
 384     ListSize = sizeof (UINT32);
 385     Status   = UpdateVariable (
 386                  EFI_CERT_DB_NAME,
 387                  &gEfiCertDbGuid,
 388                  &ListSize,
 389                  sizeof (UINT32),
 390                  VarAttr,
 391                  0,
 392                  0,
 393                  &Variable,
 394                  NULL
 395                  );
 396     if (EFI_ERROR (Status)) {
 397       return Status;
 398     }
 399   }
 400
 401   //
 402   // Check "VendorKeysNv" variable's existence and create "VendorKeys" variable accordingly.
 403   //
 404   FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 405   if (Variable.CurrPtr != NULL) {
 406     mVendorKeyState = *(GetVariableDataPtr (Variable.CurrPtr));
 407   } else {
 408     //
 409     // "VendorKeysNv" not exist, initialize it in VENDOR_KEYS_VALID state.
 410     //
 411     mVendorKeyState = VENDOR_KEYS_VALID;
 412     Status = UpdateVariable (
 413                EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
 414                &gEfiVendorKeysNvGuid,
 415                &mVendorKeyState,
 416                sizeof (UINT8),
 417                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS,
 418                0,
 419                0,
 420                &Variable,
 421                NULL
 422                );
 423     if (EFI_ERROR (Status)) {
 424       return Status;
 425     }
 426   }
 427
 428   //
 429   // Create "VendorKeys" variable with BS+RT attribute set.
 430   //
 431   FindVariable (EFI_VENDOR_KEYS_VARIABLE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 432   Status = UpdateVariable (
 433              EFI_VENDOR_KEYS_VARIABLE_NAME,
 434              &gEfiGlobalVariableGuid,
 435              &mVendorKeyState,
 436              sizeof (UINT8),
 437              EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 438              0,
 439              0,
 440              &Variable,
 441              NULL
 442              );
 443   if (EFI_ERROR (Status)) {
 444     return Status;
 445   }
 446
 447   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_VENDOR_KEYS_VARIABLE_NAME, mVendorKeyState));
 448
 449   return Status;
 450 }
 451
 452 /**
 453   Add public key in store and return its index.
 454
 455   @param[in]  PubKey                  Input pointer to Public Key data
 456   @param[in]  VariableDataEntry       The variable data entry
 457
 458   @return                             Index of new added item
 459
 460 **/
 461 UINT32
 462 AddPubKeyInStore (
 463   IN  UINT8                        *PubKey,
 464   IN  VARIABLE_ENTRY_CONSISTENCY   *VariableDataEntry
 465   )
 466 {
 467   EFI_STATUS                       Status;
 468   BOOLEAN                          IsFound;
 469   UINT32                           Index;
 470   VARIABLE_POINTER_TRACK           Variable;
 471   UINT8                            *Ptr;
 472   UINT8                            *Data;
 473   UINTN                            DataSize;
 474   VARIABLE_ENTRY_CONSISTENCY       PublicKeyEntry;
 475   UINT32                           Attributes;
 476
 477   if (PubKey == NULL) {
 478     return 0;
 479   }
 480
 481   Status = FindVariable (
 482              AUTHVAR_KEYDB_NAME,
 483              &gEfiAuthenticatedVariableGuid,
 484              &Variable,
 485              &mVariableModuleGlobal->VariableGlobal,
 486              FALSE
 487              );
 488   if (EFI_ERROR (Status)) {
 489     DEBUG ((EFI_D_ERROR, "Get public key database variable failure, Status = %r\n", Status));
 490     return 0;
 491   }
 492
 493   //
 494   // Check whether the public key entry does exist.
 495   //
 496   IsFound = FALSE;
 497   for (Ptr = mPubKeyStore, Index = 1; Index <= mPubKeyNumber; Index++) {
 498     if (CompareMem (Ptr, PubKey, EFI_CERT_TYPE_RSA2048_SIZE) == 0) {
 499       IsFound = TRUE;
 500       break;
 501     }
 502     Ptr += EFI_CERT_TYPE_RSA2048_SIZE;
 503   }
 504
 505   if (!IsFound) {
 506     //
 507     // Add public key in database.
 508     //
 509     if (mPubKeyNumber == mMaxKeyNumber) {
 510       //
 511       // Public key dadatase is full, try to reclaim invalid key.
 512       //
 513       if (AtRuntime ()) {
 514         //
 515         // NV storage can't reclaim at runtime.
 516         //
 517         return 0;
 518       }
 519
 520       Status = Reclaim (
 521                  mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase,
 522                  &mVariableModuleGlobal->NonVolatileLastVariableOffset,
 523                  FALSE,
 524                  NULL,
 525                  NULL,
 526                  0,
 527                  TRUE
 528                  );
 529       if (EFI_ERROR (Status)) {
 530         return 0;
 531       }
 532
 533       Status = FindVariable (
 534                  AUTHVAR_KEYDB_NAME,
 535                  &gEfiAuthenticatedVariableGuid,
 536                  &Variable,
 537                  &mVariableModuleGlobal->VariableGlobal,
 538                  FALSE
 539                  );
 540       if (EFI_ERROR (Status)) {
 541         DEBUG ((EFI_D_ERROR, "Get public key database variable failure, Status = %r\n", Status));
 542         return 0;
 543       }
 544
 545       DataSize  = DataSizeOfVariable (Variable.CurrPtr);
 546       Data      = GetVariableDataPtr (Variable.CurrPtr);
 547       ASSERT ((DataSize != 0) && (Data != NULL));
 548       //
 549       // "AuthVarKeyDatabase" is an internal used variable. Its DataSize is always ensured not to exceed mPubKeyStore buffer size(See definition before)
 550       //  Therefore, there is no memory overflow in underlying CopyMem.
 551       //
 552       CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
 553       mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
 554
 555       if (mPubKeyNumber == mMaxKeyNumber) {
 556         return 0;
 557       }
 558     }
 559
 560     //
 561     // Check the variable space for both public key and variable data.
 562     //
 563     PublicKeyEntry.VariableSize = (mPubKeyNumber + 1) * EFI_CERT_TYPE_RSA2048_SIZE;
 564     PublicKeyEntry.Guid         = &gEfiAuthenticatedVariableGuid;
 565     PublicKeyEntry.Name         = AUTHVAR_KEYDB_NAME;
 566     Attributes = VARIABLE_ATTRIBUTE_NV_BS_RT | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 567
 568     if (!CheckRemainingSpaceForConsistency (Attributes, &PublicKeyEntry, VariableDataEntry, NULL)) {
 569       //
 570       // No enough variable space.
 571       //
 572       return 0;
 573     }
 574
 575     CopyMem (mPubKeyStore + mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 576     Index = ++mPubKeyNumber;
 577     //
 578     // Update public key database variable.
 579     //
 580     Status = UpdateVariable (
 581                AUTHVAR_KEYDB_NAME,
 582                &gEfiAuthenticatedVariableGuid,
 583                mPubKeyStore,
 584                mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE,
 585                Attributes,
 586                0,
 587                0,
 588                &Variable,
 589                NULL
 590                );
 591     if (EFI_ERROR (Status)) {
 592       DEBUG ((EFI_D_ERROR, "Update public key database variable failure, Status = %r\n", Status));
 593       return 0;
 594     }
 595   }
 596
 597   return Index;
 598 }
 599
 600 /**
 601   Verify data payload with AuthInfo in EFI_CERT_TYPE_RSA2048_SHA256_GUID type.
 602   Follow the steps in UEFI2.2.
 603
 604   Caution: This function may receive untrusted input.
 605   This function may be invoked in SMM mode, and datasize and data are external input.
 606   This function will do basic validation, before parse the data.
 607   This function will parse the authentication carefully to avoid security issues, like
 608   buffer overflow, integer overflow.
 609
 610   @param[in]      Data                    Pointer to data with AuthInfo.
 611   @param[in]      DataSize                Size of Data.
 612   @param[in]      PubKey                  Public key used for verification.
 613
 614   @retval EFI_INVALID_PARAMETER       Invalid parameter.
 615   @retval EFI_SECURITY_VIOLATION      If authentication failed.
 616   @retval EFI_SUCCESS                 Authentication successful.
 617
 618 **/
 619 EFI_STATUS
 620 VerifyCounterBasedPayload (
 621   IN     UINT8          *Data,
 622   IN     UINTN          DataSize,
 623   IN     UINT8          *PubKey
 624   )
 625 {
 626   BOOLEAN                         Status;
 627   EFI_VARIABLE_AUTHENTICATION     *CertData;
 628   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
 629   UINT8                           Digest[SHA256_DIGEST_SIZE];
 630   VOID                            *Rsa;
 631   UINTN                           PayloadSize;
 632
 633   PayloadSize = DataSize - AUTHINFO_SIZE;
 634   Rsa         = NULL;
 635   CertData    = NULL;
 636   CertBlock   = NULL;
 637
 638   if (Data == NULL || PubKey == NULL) {
 639     return EFI_INVALID_PARAMETER;
 640   }
 641
 642   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
 643   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
 644
 645   //
 646   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
 647   // Cert type should be EFI_CERT_TYPE_RSA2048_SHA256_GUID.
 648   //
 649   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
 650       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertTypeRsa2048Sha256Guid)
 651         ) {
 652     //
 653     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
 654     //
 655     return EFI_SECURITY_VIOLATION;
 656   }
 657   //
 658   // Hash data payload with SHA256.
 659   //
 660   ZeroMem (Digest, SHA256_DIGEST_SIZE);
 661   Status  = Sha256Init (mHashCtx);
 662   if (!Status) {
 663     goto Done;
 664   }
 665   Status  = Sha256Update (mHashCtx, Data + AUTHINFO_SIZE, PayloadSize);
 666   if (!Status) {
 667     goto Done;
 668   }
 669   //
 670   // Hash Size.
 671   //
 672   Status  = Sha256Update (mHashCtx, &PayloadSize, sizeof (UINTN));
 673   if (!Status) {
 674     goto Done;
 675   }
 676   //
 677   // Hash Monotonic Count.
 678   //
 679   Status  = Sha256Update (mHashCtx, &CertData->MonotonicCount, sizeof (UINT64));
 680   if (!Status) {
 681     goto Done;
 682   }
 683   Status  = Sha256Final (mHashCtx, Digest);
 684   if (!Status) {
 685     goto Done;
 686   }
 687   //
 688   // Generate & Initialize RSA Context.
 689   //
 690   Rsa = RsaNew ();
 691   ASSERT (Rsa != NULL);
 692   //
 693   // Set RSA Key Components.
 694   // NOTE: Only N and E are needed to be set as RSA public key for signature verification.
 695   //
 696   Status = RsaSetKey (Rsa, RsaKeyN, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 697   if (!Status) {
 698     goto Done;
 699   }
 700   Status = RsaSetKey (Rsa, RsaKeyE, mRsaE, sizeof (mRsaE));
 701   if (!Status) {
 702     goto Done;
 703   }
 704   //
 705   // Verify the signature.
 706   //
 707   Status = RsaPkcs1Verify (
 708              Rsa,
 709              Digest,
 710              SHA256_DIGEST_SIZE,
 711              CertBlock->Signature,
 712              EFI_CERT_TYPE_RSA2048_SHA256_SIZE
 713              );
 714
 715 Done:
 716   if (Rsa != NULL) {
 717     RsaFree (Rsa);
 718   }
 719   if (Status) {
 720     return EFI_SUCCESS;
 721   } else {
 722     return EFI_SECURITY_VIOLATION;
 723   }
 724 }
 725
 726 /**
 727   Update platform mode.
 728
 729   @param[in]      Mode                    SETUP_MODE or USER_MODE.
 730
 731   @return EFI_INVALID_PARAMETER           Invalid parameter.
 732   @return EFI_SUCCESS                     Update platform mode successfully.
 733
 734 **/
 735 EFI_STATUS
 736 UpdatePlatformMode (
 737   IN  UINT32                    Mode
 738   )
 739 {
 740   EFI_STATUS              Status;
 741   VARIABLE_POINTER_TRACK  Variable;
 742   UINT8                   SecureBootMode;
 743   UINT8                   SecureBootEnable;
 744   UINTN                   VariableDataSize;
 745
 746   Status = FindVariable (
 747              EFI_SETUP_MODE_NAME,
 748              &gEfiGlobalVariableGuid,
 749              &Variable,
 750              &mVariableModuleGlobal->VariableGlobal,
 751              FALSE
 752              );
 753   if (EFI_ERROR (Status)) {
 754     return Status;
 755   }
 756
 757   //
 758   // Update the value of SetupMode variable by a simple mem copy, this could avoid possible
 759   // variable storage reclaim at runtime.
 760   //
 761   mPlatformMode = (UINT8) Mode;
 762   CopyMem (GetVariableDataPtr (Variable.CurrPtr), &mPlatformMode, sizeof(UINT8));
 763
 764   if (AtRuntime ()) {
 765     //
 766     // SecureBoot Variable indicates whether the platform firmware is operating
 767     // in Secure boot mode (1) or not (0), so we should not change SecureBoot
 768     // Variable in runtime.
 769     //
 770     return Status;
 771   }
 772
 773   //
 774   // Check "SecureBoot" variable's existence.
 775   // If it doesn't exist, firmware has no capability to perform driver signing verification,
 776   // then set "SecureBoot" to 0.
 777   //
 778   Status = FindVariable (
 779              EFI_SECURE_BOOT_MODE_NAME,
 780              &gEfiGlobalVariableGuid,
 781              &Variable,
 782              &mVariableModuleGlobal->VariableGlobal,
 783              FALSE
 784              );
 785   //
 786   // If "SecureBoot" variable exists, then check "SetupMode" variable update.
 787   // If "SetupMode" variable is USER_MODE, "SecureBoot" variable is set to 1.
 788   // If "SetupMode" variable is SETUP_MODE, "SecureBoot" variable is set to 0.
 789   //
 790   if (Variable.CurrPtr == NULL) {
 791     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 792   } else {
 793     if (mPlatformMode == USER_MODE) {
 794       SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 795     } else if (mPlatformMode == SETUP_MODE) {
 796       SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 797     } else {
 798       return EFI_NOT_FOUND;
 799     }
 800   }
 801
 802   Status  = UpdateVariable (
 803               EFI_SECURE_BOOT_MODE_NAME,
 804               &gEfiGlobalVariableGuid,
 805               &SecureBootMode,
 806               sizeof(UINT8),
 807               EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 808               0,
 809               0,
 810               &Variable,
 811               NULL
 812               );
 813   if (EFI_ERROR (Status)) {
 814     return Status;
 815   }
 816
 817   //
 818   // Check "SecureBootEnable" variable's existence. It can enable/disable secure boot feature.
 819   //
 820   Status = FindVariable (
 821              EFI_SECURE_BOOT_ENABLE_NAME,
 822              &gEfiSecureBootEnableDisableGuid,
 823              &Variable,
 824              &mVariableModuleGlobal->VariableGlobal,
 825              FALSE
 826              );
 827
 828   if (SecureBootMode == SECURE_BOOT_MODE_ENABLE) {
 829     //
 830     // Create the "SecureBootEnable" variable as secure boot is enabled.
 831     //
 832     SecureBootEnable = SECURE_BOOT_ENABLE;
 833     VariableDataSize = sizeof (SecureBootEnable);
 834   } else {
 835     //
 836     // Delete the "SecureBootEnable" variable if this variable exist as "SecureBoot"
 837     // variable is not in secure boot state.
 838     //
 839     if (Variable.CurrPtr == NULL || EFI_ERROR (Status)) {
 840       return EFI_SUCCESS;
 841     }
 842     SecureBootEnable = SECURE_BOOT_DISABLE;
 843     VariableDataSize = 0;
 844   }
 845
 846   Status = UpdateVariable (
 847              EFI_SECURE_BOOT_ENABLE_NAME,
 848              &gEfiSecureBootEnableDisableGuid,
 849              &SecureBootEnable,
 850              VariableDataSize,
 851              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 852              0,
 853              0,
 854              &Variable,
 855              NULL
 856              );
 857   return Status;
 858 }
 859
 860 /**
 861   Check input data form to make sure it is a valid EFI_SIGNATURE_LIST for PK/KEK/db/dbx/dbt variable.
 862
 863   @param[in]  VariableName                Name of Variable to be check.
 864   @param[in]  VendorGuid                  Variable vendor GUID.
 865   @param[in]  Data                        Point to the variable data to be checked.
 866   @param[in]  DataSize                    Size of Data.
 867
 868   @return EFI_INVALID_PARAMETER           Invalid signature list format.
 869   @return EFI_SUCCESS                     Passed signature list format check successfully.
 870
 871 **/
 872 EFI_STATUS
 873 CheckSignatureListFormat(
 874   IN  CHAR16                    *VariableName,
 875   IN  EFI_GUID                  *VendorGuid,
 876   IN  VOID                      *Data,
 877   IN  UINTN                     DataSize
 878   )
 879 {
 880   EFI_SIGNATURE_LIST     *SigList;
 881   UINTN                  SigDataSize;
 882   UINT32                 Index;
 883   UINT32                 SigCount;
 884   BOOLEAN                IsPk;
 885   VOID                   *RsaContext;
 886   EFI_SIGNATURE_DATA     *CertData;
 887   UINTN                  CertLen;
 888
 889   if (DataSize == 0) {
 890     return EFI_SUCCESS;
 891   }
 892
 893   ASSERT (VariableName != NULL && VendorGuid != NULL && Data != NULL);
 894
 895   if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_PLATFORM_KEY_NAME) == 0)){
 896     IsPk = TRUE;
 897   } else if ((CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0)) ||
 898              (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&
 899              ((StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0) || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0) ||
 900               (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0)))) {
 901     IsPk = FALSE;
 902   } else {
 903     return EFI_SUCCESS;
 904   }
 905
 906   SigCount = 0;
 907   SigList  = (EFI_SIGNATURE_LIST *) Data;
 908   SigDataSize  = DataSize;
 909   RsaContext = NULL;
 910
 911   //
 912   // Walk throuth the input signature list and check the data format.
 913   // If any signature is incorrectly formed, the whole check will fail.
 914   //
 915   while ((SigDataSize > 0) && (SigDataSize >= SigList->SignatureListSize)) {
 916     for (Index = 0; Index < (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM)); Index++ ) {
 917       if (CompareGuid (&SigList->SignatureType, &mSupportSigItem[Index].SigType)) {
 918         //
 919         // The value of SignatureSize should always be 16 (size of SignatureOwner
 920         // component) add the data length according to signature type.
 921         //
 922         if (mSupportSigItem[Index].SigDataSize != ((UINT32) ~0) &&
 923           (SigList->SignatureSize - sizeof (EFI_GUID)) != mSupportSigItem[Index].SigDataSize) {
 924           return EFI_INVALID_PARAMETER;
 925         }
 926         if (mSupportSigItem[Index].SigHeaderSize != ((UINTN) ~0) &&
 927           SigList->SignatureHeaderSize != mSupportSigItem[Index].SigHeaderSize) {
 928           return EFI_INVALID_PARAMETER;
 929         }
 930         break;
 931       }
 932     }
 933
 934     if (Index == (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM))) {
 935       //
 936       // Undefined signature type.
 937       //
 938       return EFI_INVALID_PARAMETER;
 939     }
 940
 941     if (CompareGuid (&SigList->SignatureType, &gEfiCertX509Guid)) {
 942       //
 943       // Try to retrieve the RSA public key from the X.509 certificate.
 944       // If this operation fails, it's not a valid certificate.
 945       //
 946       RsaContext = RsaNew ();
 947       if (RsaContext == NULL) {
 948         return EFI_INVALID_PARAMETER;
 949       }
 950       CertData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigList + sizeof (EFI_SIGNATURE_LIST) + SigList->SignatureHeaderSize);
 951       CertLen = SigList->SignatureSize - sizeof (EFI_GUID);
 952       if (!RsaGetPublicKeyFromX509 (CertData->SignatureData, CertLen, &RsaContext)) {
 953         RsaFree (RsaContext);
 954         return EFI_INVALID_PARAMETER;
 955       }
 956       RsaFree (RsaContext);
 957     }
 958
 959     if ((SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) % SigList->SignatureSize != 0) {
 960       return EFI_INVALID_PARAMETER;
 961     }
 962     SigCount += (SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) / SigList->SignatureSize;
 963
 964     SigDataSize -= SigList->SignatureListSize;
 965     SigList = (EFI_SIGNATURE_LIST *) ((UINT8 *) SigList + SigList->SignatureListSize);
 966   }
 967
 968   if (((UINTN) SigList - (UINTN) Data) != DataSize) {
 969     return EFI_INVALID_PARAMETER;
 970   }
 971
 972   if (IsPk && SigCount > 1) {
 973     return EFI_INVALID_PARAMETER;
 974   }
 975
 976   return EFI_SUCCESS;
 977 }
 978
 979 /**
 980   Update "VendorKeys" variable to record the out of band secure boot key modification.
 981
 982   @return EFI_SUCCESS           Variable is updated successfully.
 983   @return Others                Failed to update variable.
 984
 985 **/
 986 EFI_STATUS
 987 VendorKeyIsModified (
 988   VOID
 989   )
 990 {
 991   EFI_STATUS              Status;
 992   VARIABLE_POINTER_TRACK  Variable;
 993
 994   if (mVendorKeyState == VENDOR_KEYS_MODIFIED) {
 995     return EFI_SUCCESS;
 996   }
 997   mVendorKeyState = VENDOR_KEYS_MODIFIED;
 998
 999   FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
1000   Status = UpdateVariable (
1001              EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
1002              &gEfiVendorKeysNvGuid,
1003              &mVendorKeyState,
1004              sizeof (UINT8),
1005              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS,
1006              0,
1007              0,
1008              &Variable,
1009              NULL
1010              );
1011   if (EFI_ERROR (Status)) {
1012     return Status;
1013   }
1014
1015   FindVariable (EFI_VENDOR_KEYS_VARIABLE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
1016   return UpdateVariable (
1017            EFI_VENDOR_KEYS_VARIABLE_NAME,
1018            &gEfiGlobalVariableGuid,
1019            &mVendorKeyState,
1020            sizeof (UINT8),
1021            EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
1022            0,
1023            0,
1024            &Variable,
1025            NULL
1026            );
1027 }
1028
1029 /**
1030   Process variable with platform key for verification.
1031
1032   Caution: This function may receive untrusted input.
1033   This function may be invoked in SMM mode, and datasize and data are external input.
1034   This function will do basic validation, before parse the data.
1035   This function will parse the authentication carefully to avoid security issues, like
1036   buffer overflow, integer overflow.
1037   This function will check attribute carefully to avoid authentication bypass.
1038
1039   @param[in]  VariableName                Name of Variable to be found.
1040   @param[in]  VendorGuid                  Variable vendor GUID.
1041   @param[in]  Data                        Data pointer.
1042   @param[in]  DataSize                    Size of Data found. If size is less than the
1043                                           data, this value contains the required size.
1044   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1045   @param[in]  Attributes                  Attribute value of the variable
1046   @param[in]  IsPk                        Indicate whether it is to process pk.
1047
1048   @return EFI_INVALID_PARAMETER           Invalid parameter.
1049   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation.
1050                                           check carried out by the firmware.
1051   @return EFI_SUCCESS                     Variable passed validation successfully.
1052
1053 **/
1054 EFI_STATUS
1055 ProcessVarWithPk (
1056   IN  CHAR16                    *VariableName,
1057   IN  EFI_GUID                  *VendorGuid,
1058   IN  VOID                      *Data,
1059   IN  UINTN                     DataSize,
1060   IN  VARIABLE_POINTER_TRACK    *Variable,
1061   IN  UINT32                    Attributes OPTIONAL,
1062   IN  BOOLEAN                   IsPk
1063   )
1064 {
1065   EFI_STATUS                  Status;
1066   BOOLEAN                     Del;
1067   UINT8                       *Payload;
1068   UINTN                       PayloadSize;
1069
1070   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1071       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1072     //
1073     // PK, KEK and db/dbx/dbt should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1074     // authenticated variable.
1075     //
1076     return EFI_INVALID_PARAMETER;
1077   }
1078
1079   Del = FALSE;
1080   if ((InCustomMode() && UserPhysicalPresent()) || (mPlatformMode == SETUP_MODE && !IsPk)) {
1081     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1082     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1083     if (PayloadSize == 0) {
1084       Del = TRUE;
1085     }
1086
1087     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
1088     if (EFI_ERROR (Status)) {
1089       return Status;
1090     }
1091
1092     Status = UpdateVariable (
1093                VariableName,
1094                VendorGuid,
1095                Payload,
1096                PayloadSize,
1097                Attributes,
1098                0,
1099                0,
1100                Variable,
1101                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1102                );
1103     if (EFI_ERROR(Status)) {
1104       return Status;
1105     }
1106
1107     if ((mPlatformMode != SETUP_MODE) || IsPk) {
1108       Status = VendorKeyIsModified ();
1109     }
1110   } else if (mPlatformMode == USER_MODE) {
1111     //
1112     // Verify against X509 Cert in PK database.
1113     //
1114     Status = VerifyTimeBasedPayload (
1115                VariableName,
1116                VendorGuid,
1117                Data,
1118                DataSize,
1119                Variable,
1120                Attributes,
1121                AuthVarTypePk,
1122                &Del
1123                );
1124   } else {
1125     //
1126     // Verify against the certificate in data payload.
1127     //
1128     Status = VerifyTimeBasedPayload (
1129                VariableName,
1130                VendorGuid,
1131                Data,
1132                DataSize,
1133                Variable,
1134                Attributes,
1135                AuthVarTypePayload,
1136                &Del
1137                );
1138   }
1139
1140   if (!EFI_ERROR(Status) && IsPk) {
1141     if (mPlatformMode == SETUP_MODE && !Del) {
1142       //
1143       // If enroll PK in setup mode, need change to user mode.
1144       //
1145       Status = UpdatePlatformMode (USER_MODE);
1146     } else if (mPlatformMode == USER_MODE && Del){
1147       //
1148       // If delete PK in user mode, need change to setup mode.
1149       //
1150       Status = UpdatePlatformMode (SETUP_MODE);
1151     }
1152   }
1153
1154   return Status;
1155 }
1156
1157 /**
1158   Process variable with key exchange key for verification.
1159
1160   Caution: This function may receive untrusted input.
1161   This function may be invoked in SMM mode, and datasize and data are external input.
1162   This function will do basic validation, before parse the data.
1163   This function will parse the authentication carefully to avoid security issues, like
1164   buffer overflow, integer overflow.
1165   This function will check attribute carefully to avoid authentication bypass.
1166
1167   @param[in]  VariableName                Name of Variable to be found.
1168   @param[in]  VendorGuid                  Variable vendor GUID.
1169   @param[in]  Data                        Data pointer.
1170   @param[in]  DataSize                    Size of Data found. If size is less than the
1171                                           data, this value contains the required size.
1172   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1173   @param[in]  Attributes                  Attribute value of the variable.
1174
1175   @return EFI_INVALID_PARAMETER           Invalid parameter.
1176   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
1177                                           check carried out by the firmware.
1178   @return EFI_SUCCESS                     Variable pass validation successfully.
1179
1180 **/
1181 EFI_STATUS
1182 ProcessVarWithKek (
1183   IN  CHAR16                               *VariableName,
1184   IN  EFI_GUID                             *VendorGuid,
1185   IN  VOID                                 *Data,
1186   IN  UINTN                                DataSize,
1187   IN  VARIABLE_POINTER_TRACK               *Variable,
1188   IN  UINT32                               Attributes OPTIONAL
1189   )
1190 {
1191   EFI_STATUS                      Status;
1192   UINT8                           *Payload;
1193   UINTN                           PayloadSize;
1194
1195   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1196       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1197     //
1198     // DB, DBX and DBT should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1199     // authenticated variable.
1200     //
1201     return EFI_INVALID_PARAMETER;
1202   }
1203
1204   Status = EFI_SUCCESS;
1205   if (mPlatformMode == USER_MODE && !(InCustomMode() && UserPhysicalPresent())) {
1206     //
1207     // Time-based, verify against X509 Cert KEK.
1208     //
1209     return VerifyTimeBasedPayload (
1210              VariableName,
1211              VendorGuid,
1212              Data,
1213              DataSize,
1214              Variable,
1215              Attributes,
1216              AuthVarTypeKek,
1217              NULL
1218              );
1219   } else {
1220     //
1221     // If in setup mode or custom secure boot mode, no authentication needed.
1222     //
1223     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1224     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1225
1226     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
1227     if (EFI_ERROR (Status)) {
1228       return Status;
1229     }
1230
1231     Status = UpdateVariable (
1232                VariableName,
1233                VendorGuid,
1234                Payload,
1235                PayloadSize,
1236                Attributes,
1237                0,
1238                0,
1239                Variable,
1240                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1241                );
1242     if (EFI_ERROR (Status)) {
1243       return Status;
1244     }
1245
1246     if (mPlatformMode != SETUP_MODE) {
1247       Status = VendorKeyIsModified ();
1248     }
1249   }
1250
1251   return Status;
1252 }
1253
1254 /**
1255   Check if it is to delete auth variable.
1256
1257   @param[in] Data               Data pointer.
1258   @param[in] DataSize           Size of Data.
1259   @param[in] Variable           The variable information which is used to keep track of variable usage.
1260   @param[in] Attributes         Attribute value of the variable.
1261
1262   @retval TRUE                  It is to delete auth variable.
1263   @retval FALSE                 It is not to delete auth variable.
1264
1265 **/
1266 BOOLEAN
1267 IsDeleteAuthVariable (
1268   IN  VOID                      *Data,
1269   IN  UINTN                     DataSize,
1270   IN  VARIABLE_POINTER_TRACK    *Variable,
1271   IN  UINT32                    Attributes
1272   )
1273 {
1274   BOOLEAN                       Del;
1275   UINT8                         *Payload;
1276   UINTN                         PayloadSize;
1277
1278   Del = FALSE;
1279
1280   //
1281   // To delete a variable created with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
1282   // or the EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS attribute,
1283   // SetVariable must be used with attributes matching the existing variable
1284   // and the DataSize set to the size of the AuthInfo descriptor.
1285   //
1286   if ((Variable->CurrPtr != NULL) &&
1287       (Attributes == Variable->CurrPtr->Attributes) &&
1288       ((Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)) {
1289     if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1290       Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1291       PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1292       if (PayloadSize == 0) {
1293         Del = TRUE;
1294       }
1295     } else {
1296       Payload = (UINT8 *) Data + AUTHINFO_SIZE;
1297       PayloadSize = DataSize - AUTHINFO_SIZE;
1298       if (PayloadSize == 0) {
1299         Del = TRUE;
1300       }
1301     }
1302   }
1303
1304   return Del;
1305 }
1306
1307 /**
1308   Process variable with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS/EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
1309
1310   Caution: This function may receive untrusted input.
1311   This function may be invoked in SMM mode, and datasize and data are external input.
1312   This function will do basic validation, before parse the data.
1313   This function will parse the authentication carefully to avoid security issues, like
1314   buffer overflow, integer overflow.
1315   This function will check attribute carefully to avoid authentication bypass.
1316
1317   @param[in]  VariableName                Name of Variable to be found.
1318   @param[in]  VendorGuid                  Variable vendor GUID.
1319
1320   @param[in]  Data                        Data pointer.
1321   @param[in]  DataSize                    Size of Data.
1322   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1323   @param[in]  Attributes                  Attribute value of the variable.
1324
1325   @return EFI_INVALID_PARAMETER           Invalid parameter.
1326   @return EFI_WRITE_PROTECTED             Variable is write-protected and needs authentication with
1327                                           EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1328   @return EFI_OUT_OF_RESOURCES            The Database to save the public key is full.
1329   @return EFI_SECURITY_VIOLATION          The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
1330                                           set, but the AuthInfo does NOT pass the validation
1331                                           check carried out by the firmware.
1332   @return EFI_SUCCESS                     Variable is not write-protected or pass validation successfully.
1333
1334 **/
1335 EFI_STATUS
1336 ProcessVariable (
1337   IN     CHAR16                             *VariableName,
1338   IN     EFI_GUID                           *VendorGuid,
1339   IN     VOID                               *Data,
1340   IN     UINTN                              DataSize,
1341   IN     VARIABLE_POINTER_TRACK             *Variable,
1342   IN     UINT32                             Attributes
1343   )
1344 {
1345   EFI_STATUS                      Status;
1346   BOOLEAN                         IsDeletion;
1347   BOOLEAN                         IsFirstTime;
1348   UINT8                           *PubKey;
1349   EFI_VARIABLE_AUTHENTICATION     *CertData;
1350   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
1351   UINT32                          KeyIndex;
1352   UINT64                          MonotonicCount;
1353   VARIABLE_ENTRY_CONSISTENCY      VariableDataEntry;
1354
1355   KeyIndex    = 0;
1356   CertData    = NULL;
1357   CertBlock   = NULL;
1358   PubKey      = NULL;
1359   IsDeletion  = FALSE;
1360   Status      = EFI_SUCCESS;
1361
1362   if (IsDeleteAuthVariable (Data, DataSize, Variable, Attributes) && UserPhysicalPresent()) {
1363     //
1364     // Allow the delete operation of common authenticated variable at user physical presence.
1365     //
1366     if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1367       Status = DeleteCertsFromDb (VariableName, VendorGuid);
1368     }
1369     if (!EFI_ERROR (Status)) {
1370       Status = UpdateVariable (
1371                  VariableName,
1372                  VendorGuid,
1373                  NULL,
1374                  0,
1375                  0,
1376                  0,
1377                  0,
1378                  Variable,
1379                  NULL
1380                  );
1381     }
1382     return Status;
1383   }
1384
1385   if (NeedPhysicallyPresent (VariableName, VendorGuid) && !UserPhysicalPresent()) {
1386     //
1387     // This variable is protected, only physical present user could modify its value.
1388     //
1389     return EFI_SECURITY_VIOLATION;
1390   }
1391
1392   //
1393   // A time-based authenticated variable and a count-based authenticated variable
1394   // can't be updated by each other.
1395   //
1396   if (Variable->CurrPtr != NULL) {
1397     if (((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) &&
1398         ((Variable->CurrPtr->Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0)) {
1399       return EFI_SECURITY_VIOLATION;
1400     }
1401
1402     if (((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) &&
1403         ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0)) {
1404       return EFI_SECURITY_VIOLATION;
1405     }
1406   }
1407
1408   //
1409   // Process Time-based Authenticated variable.
1410   //
1411   if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1412     return VerifyTimeBasedPayload (
1413              VariableName,
1414              VendorGuid,
1415              Data,
1416              DataSize,
1417              Variable,
1418              Attributes,
1419              AuthVarTypePriv,
1420              NULL
1421              );
1422   }
1423
1424   //
1425   // Determine if first time SetVariable with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS.
1426   //
1427   if ((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) {
1428     //
1429     // Determine current operation type.
1430     //
1431     if (DataSize == AUTHINFO_SIZE) {
1432       IsDeletion = TRUE;
1433     }
1434     //
1435     // Determine whether this is the first time with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1436     //
1437     if (Variable->CurrPtr == NULL) {
1438       IsFirstTime = TRUE;
1439     } else if ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) == 0) {
1440       IsFirstTime = TRUE;
1441     } else {
1442       KeyIndex   = Variable->CurrPtr->PubKeyIndex;
1443       IsFirstTime = FALSE;
1444     }
1445   } else if ((Variable->CurrPtr != NULL) &&
1446              ((Variable->CurrPtr->Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)
1447             ) {
1448     //
1449     // If the variable is already write-protected, it always needs authentication before update.
1450     //
1451     return EFI_WRITE_PROTECTED;
1452   } else {
1453     //
1454     // If without EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS, set and attributes collision.
1455     // That means it is not authenticated variable, just update variable as usual.
1456     //
1457     Status = UpdateVariable (VariableName, VendorGuid, Data, DataSize, Attributes, 0, 0, Variable, NULL);
1458     return Status;
1459   }
1460
1461   //
1462   // Get PubKey and check Monotonic Count value corresponding to the variable.
1463   //
1464   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
1465   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
1466   PubKey    = CertBlock->PublicKey;
1467
1468   //
1469   // Update Monotonic Count value.
1470   //
1471   MonotonicCount = CertData->MonotonicCount;
1472
1473   if (!IsFirstTime) {
1474     //
1475     // 2 cases need to check here
1476     //   1. Internal PubKey variable. PubKeyIndex is always 0
1477     //   2. Other counter-based AuthVariable. Check input PubKey.
1478     //
1479     if (KeyIndex == 0 || CompareMem (PubKey, mPubKeyStore + (KeyIndex - 1) * EFI_CERT_TYPE_RSA2048_SIZE, EFI_CERT_TYPE_RSA2048_SIZE) != 0) {
1480       return EFI_SECURITY_VIOLATION;
1481     }
1482     //
1483     // Compare the current monotonic count and ensure that it is greater than the last SetVariable
1484     // operation with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS attribute set.
1485     //
1486     if (CertData->MonotonicCount <= Variable->CurrPtr->MonotonicCount) {
1487       //
1488       // Monotonic count check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
1489       //
1490       return EFI_SECURITY_VIOLATION;
1491     }
1492   }
1493   //
1494   // Verify the certificate in Data payload.
1495   //
1496   Status = VerifyCounterBasedPayload (Data, DataSize, PubKey);
1497   if (EFI_ERROR (Status)) {
1498     return Status;
1499   }
1500
1501   //
1502   // Now, the signature has been verified!
1503   //
1504   if (IsFirstTime && !IsDeletion) {
1505     VariableDataEntry.VariableSize = DataSize - AUTHINFO_SIZE;
1506     VariableDataEntry.Guid         = VendorGuid;
1507     VariableDataEntry.Name         = VariableName;
1508
1509     //
1510     // Update public key database variable if need.
1511     //
1512     KeyIndex = AddPubKeyInStore (PubKey, &VariableDataEntry);
1513     if (KeyIndex == 0) {
1514       return EFI_OUT_OF_RESOURCES;
1515     }
1516   }
1517
1518   //
1519   // Verification pass.
1520   //
1521   return UpdateVariable (VariableName, VendorGuid, (UINT8*)Data + AUTHINFO_SIZE, DataSize - AUTHINFO_SIZE, Attributes, KeyIndex, MonotonicCount, Variable, NULL);
1522 }
1523
1524 /**
1525   Merge two buffers which formatted as EFI_SIGNATURE_LIST. Only the new EFI_SIGNATURE_DATA
1526   will be appended to the original EFI_SIGNATURE_LIST, duplicate EFI_SIGNATURE_DATA
1527   will be ignored.
1528
1529   @param[in, out]  Data              Pointer to original EFI_SIGNATURE_LIST.
1530   @param[in]       DataSize          Size of Data buffer.
1531   @param[in]       FreeBufSize       Size of free data buffer
1532   @param[in]       NewData           Pointer to new EFI_SIGNATURE_LIST to be appended.
1533   @param[in]       NewDataSize       Size of NewData buffer.
1534   @param[out]      MergedBufSize     Size of the merged buffer
1535
1536   @return EFI_BUFFER_TOO_SMALL if input Data buffer overflowed
1537
1538 **/
1539 EFI_STATUS
1540 AppendSignatureList (
1541   IN  OUT VOID            *Data,
1542   IN  UINTN               DataSize,
1543   IN  UINTN               FreeBufSize,
1544   IN  VOID                *NewData,
1545   IN  UINTN               NewDataSize,
1546   OUT UINTN               *MergedBufSize
1547   )
1548 {
1549   EFI_SIGNATURE_LIST  *CertList;
1550   EFI_SIGNATURE_DATA  *Cert;
1551   UINTN               CertCount;
1552   EFI_SIGNATURE_LIST  *NewCertList;
1553   EFI_SIGNATURE_DATA  *NewCert;
1554   UINTN               NewCertCount;
1555   UINTN               Index;
1556   UINTN               Index2;
1557   UINTN               Size;
1558   UINT8               *Tail;
1559   UINTN               CopiedCount;
1560   UINTN               SignatureListSize;
1561   BOOLEAN             IsNewCert;
1562
1563   Tail = (UINT8 *) Data + DataSize;
1564
1565   NewCertList = (EFI_SIGNATURE_LIST *) NewData;
1566   while ((NewDataSize > 0) && (NewDataSize >= NewCertList->SignatureListSize)) {
1567     NewCert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCertList + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1568     NewCertCount = (NewCertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - NewCertList->SignatureHeaderSize) / NewCertList->SignatureSize;
1569
1570     CopiedCount = 0;
1571     for (Index = 0; Index < NewCertCount; Index++) {
1572       IsNewCert = TRUE;
1573
1574       Size = DataSize;
1575       CertList = (EFI_SIGNATURE_LIST *) Data;
1576       while ((Size > 0) && (Size >= CertList->SignatureListSize)) {
1577         if (CompareGuid (&CertList->SignatureType, &NewCertList->SignatureType) &&
1578            (CertList->SignatureSize == NewCertList->SignatureSize)) {
1579           Cert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
1580           CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
1581           for (Index2 = 0; Index2 < CertCount; Index2++) {
1582             //
1583             // Iterate each Signature Data in this Signature List.
1584             //
1585             if (CompareMem (NewCert, Cert, CertList->SignatureSize) == 0) {
1586               IsNewCert = FALSE;
1587               break;
1588             }
1589             Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
1590           }
1591         }
1592
1593         if (!IsNewCert) {
1594           break;
1595         }
1596         Size -= CertList->SignatureListSize;
1597         CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
1598       }
1599
1600       if (IsNewCert) {
1601         //
1602         // New EFI_SIGNATURE_DATA, append it.
1603         //
1604         if (CopiedCount == 0) {
1605           if (FreeBufSize < sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize) {
1606             return EFI_BUFFER_TOO_SMALL;
1607           }
1608
1609           //
1610           // Copy EFI_SIGNATURE_LIST header for only once.
1611           //
1612
1613           CopyMem (Tail, NewCertList, sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1614           Tail = Tail + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1615           FreeBufSize -= sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1616         }
1617
1618         if (FreeBufSize < NewCertList->SignatureSize) {
1619           return EFI_BUFFER_TOO_SMALL;
1620         }
1621         CopyMem (Tail, NewCert, NewCertList->SignatureSize);
1622         Tail += NewCertList->SignatureSize;
1623         FreeBufSize -= NewCertList->SignatureSize;
1624         CopiedCount++;
1625       }
1626
1627       NewCert = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCert + NewCertList->SignatureSize);
1628     }
1629
1630     //
1631     // Update SignatureListSize in newly appended EFI_SIGNATURE_LIST.
1632     //
1633     if (CopiedCount != 0) {
1634       SignatureListSize = sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize + (CopiedCount * NewCertList->SignatureSize);
1635       CertList = (EFI_SIGNATURE_LIST *) (Tail - SignatureListSize);
1636       CertList->SignatureListSize = (UINT32) SignatureListSize;
1637     }
1638
1639     NewDataSize -= NewCertList->SignatureListSize;
1640     NewCertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) NewCertList + NewCertList->SignatureListSize);
1641   }
1642
1643   *MergedBufSize = (Tail - (UINT8 *) Data);
1644   return EFI_SUCCESS;
1645 }
1646
1647 /**
1648   Compare two EFI_TIME data.
1649
1650
1651   @param FirstTime           A pointer to the first EFI_TIME data.
1652   @param SecondTime          A pointer to the second EFI_TIME data.
1653
1654   @retval  TRUE              The FirstTime is not later than the SecondTime.
1655   @retval  FALSE             The FirstTime is later than the SecondTime.
1656
1657 **/
1658 BOOLEAN
1659 CompareTimeStamp (
1660   IN EFI_TIME               *FirstTime,
1661   IN EFI_TIME               *SecondTime
1662   )
1663 {
1664   if (FirstTime->Year != SecondTime->Year) {
1665     return (BOOLEAN) (FirstTime->Year < SecondTime->Year);
1666   } else if (FirstTime->Month != SecondTime->Month) {
1667     return (BOOLEAN) (FirstTime->Month < SecondTime->Month);
1668   } else if (FirstTime->Day != SecondTime->Day) {
1669     return (BOOLEAN) (FirstTime->Day < SecondTime->Day);
1670   } else if (FirstTime->Hour != SecondTime->Hour) {
1671     return (BOOLEAN) (FirstTime->Hour < SecondTime->Hour);
1672   } else if (FirstTime->Minute != SecondTime->Minute) {
1673     return (BOOLEAN) (FirstTime->Minute < SecondTime->Minute);
1674   }
1675
1676   return (BOOLEAN) (FirstTime->Second <= SecondTime->Second);
1677 }
1678
1679 /**
1680   Find matching signer's certificates for common authenticated variable
1681   by corresponding VariableName and VendorGuid from "certdb".
1682
1683   The data format of "certdb":
1684   //
1685   //     UINT32 CertDbListSize;
1686   // /// AUTH_CERT_DB_DATA Certs1[];
1687   // /// AUTH_CERT_DB_DATA Certs2[];
1688   // /// ...
1689   // /// AUTH_CERT_DB_DATA Certsn[];
1690   //
1691
1692   @param[in]  VariableName   Name of authenticated Variable.
1693   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1694   @param[in]  Data           Pointer to variable "certdb".
1695   @param[in]  DataSize       Size of variable "certdb".
1696   @param[out] CertOffset     Offset of matching CertData, from starting of Data.
1697   @param[out] CertDataSize   Length of CertData in bytes.
1698   @param[out] CertNodeOffset Offset of matching AUTH_CERT_DB_DATA , from
1699                              starting of Data.
1700   @param[out] CertNodeSize   Length of AUTH_CERT_DB_DATA in bytes.
1701
1702   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1703   @retval  EFI_NOT_FOUND         Fail to find matching certs.
1704   @retval  EFI_SUCCESS           Find matching certs and output parameters.
1705
1706 **/
1707 EFI_STATUS
1708 FindCertsFromDb (
1709   IN     CHAR16           *VariableName,
1710   IN     EFI_GUID         *VendorGuid,
1711   IN     UINT8            *Data,
1712   IN     UINTN            DataSize,
1713   OUT    UINT32           *CertOffset,    OPTIONAL
1714   OUT    UINT32           *CertDataSize,  OPTIONAL
1715   OUT    UINT32           *CertNodeOffset,OPTIONAL
1716   OUT    UINT32           *CertNodeSize   OPTIONAL
1717   )
1718 {
1719   UINT32                  Offset;
1720   AUTH_CERT_DB_DATA       *Ptr;
1721   UINT32                  CertSize;
1722   UINT32                  NameSize;
1723   UINT32                  NodeSize;
1724   UINT32                  CertDbListSize;
1725
1726   if ((VariableName == NULL) || (VendorGuid == NULL) || (Data == NULL)) {
1727     return EFI_INVALID_PARAMETER;
1728   }
1729
1730   //
1731   // Check whether DataSize matches recorded CertDbListSize.
1732   //
1733   if (DataSize < sizeof (UINT32)) {
1734     return EFI_INVALID_PARAMETER;
1735   }
1736
1737   CertDbListSize = ReadUnaligned32 ((UINT32 *) Data);
1738
1739   if (CertDbListSize != (UINT32) DataSize) {
1740     return EFI_INVALID_PARAMETER;
1741   }
1742
1743   Offset = sizeof (UINT32);
1744
1745   //
1746   // Get corresponding certificates by VendorGuid and VariableName.
1747   //
1748   while (Offset < (UINT32) DataSize) {
1749     Ptr = (AUTH_CERT_DB_DATA *) (Data + Offset);
1750     //
1751     // Check whether VendorGuid matches.
1752     //
1753     if (CompareGuid (&Ptr->VendorGuid, VendorGuid)) {
1754       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1755       NameSize = ReadUnaligned32 (&Ptr->NameSize);
1756       CertSize = ReadUnaligned32 (&Ptr->CertDataSize);
1757
1758       if (NodeSize != sizeof (EFI_GUID) + sizeof (UINT32) * 3 + CertSize +
1759           sizeof (CHAR16) * NameSize) {
1760         return EFI_INVALID_PARAMETER;
1761       }
1762
1763       Offset = Offset + sizeof (EFI_GUID) + sizeof (UINT32) * 3;
1764       //
1765       // Check whether VariableName matches.
1766       //
1767       if ((NameSize == StrLen (VariableName)) &&
1768           (CompareMem (Data + Offset, VariableName, NameSize * sizeof (CHAR16)) == 0)) {
1769         Offset = Offset + NameSize * sizeof (CHAR16);
1770
1771         if (CertOffset != NULL) {
1772           *CertOffset = Offset;
1773         }
1774
1775         if (CertDataSize != NULL) {
1776           *CertDataSize = CertSize;
1777         }
1778
1779         if (CertNodeOffset != NULL) {
1780           *CertNodeOffset = (UINT32) ((UINT8 *) Ptr - Data);
1781         }
1782
1783         if (CertNodeSize != NULL) {
1784           *CertNodeSize = NodeSize;
1785         }
1786
1787         return EFI_SUCCESS;
1788       } else {
1789         Offset = Offset + NameSize * sizeof (CHAR16) + CertSize;
1790       }
1791     } else {
1792       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1793       Offset   = Offset + NodeSize;
1794     }
1795   }
1796
1797   return EFI_NOT_FOUND;
1798 }
1799
1800 /**
1801   Retrieve signer's certificates for common authenticated variable
1802   by corresponding VariableName and VendorGuid from "certdb".
1803
1804   @param[in]  VariableName   Name of authenticated Variable.
1805   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1806   @param[out] CertData       Pointer to signer's certificates.
1807   @param[out] CertDataSize   Length of CertData in bytes.
1808
1809   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1810   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1811   @retval  EFI_SUCCESS           Get signer's certificates successfully.
1812
1813 **/
1814 EFI_STATUS
1815 GetCertsFromDb (
1816   IN     CHAR16           *VariableName,
1817   IN     EFI_GUID         *VendorGuid,
1818   OUT    UINT8            **CertData,
1819   OUT    UINT32           *CertDataSize
1820   )
1821 {
1822   VARIABLE_POINTER_TRACK  CertDbVariable;
1823   EFI_STATUS              Status;
1824   UINT8                   *Data;
1825   UINTN                   DataSize;
1826   UINT32                  CertOffset;
1827
1828   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL) || (CertDataSize == NULL)) {
1829     return EFI_INVALID_PARAMETER;
1830   }
1831
1832   //
1833   // Get variable "certdb".
1834   //
1835   Status = FindVariable (
1836              EFI_CERT_DB_NAME,
1837              &gEfiCertDbGuid,
1838              &CertDbVariable,
1839              &mVariableModuleGlobal->VariableGlobal,
1840              FALSE
1841              );
1842   if (EFI_ERROR (Status)) {
1843     return Status;
1844   }
1845
1846   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1847   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1848   if ((DataSize == 0) || (Data == NULL)) {
1849     ASSERT (FALSE);
1850     return EFI_NOT_FOUND;
1851   }
1852
1853   Status = FindCertsFromDb (
1854              VariableName,
1855              VendorGuid,
1856              Data,
1857              DataSize,
1858              &CertOffset,
1859              CertDataSize,
1860              NULL,
1861              NULL
1862              );
1863
1864   if (EFI_ERROR (Status)) {
1865     return Status;
1866   }
1867
1868   *CertData = Data + CertOffset;
1869   return EFI_SUCCESS;
1870 }
1871
1872 /**
1873   Delete matching signer's certificates when deleting common authenticated
1874   variable by corresponding VariableName and VendorGuid from "certdb".
1875
1876   @param[in]  VariableName   Name of authenticated Variable.
1877   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1878
1879   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1880   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1881   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
1882   @retval  EFI_SUCCESS           The operation is completed successfully.
1883
1884 **/
1885 EFI_STATUS
1886 DeleteCertsFromDb (
1887   IN     CHAR16           *VariableName,
1888   IN     EFI_GUID         *VendorGuid
1889   )
1890 {
1891   VARIABLE_POINTER_TRACK  CertDbVariable;
1892   EFI_STATUS              Status;
1893   UINT8                   *Data;
1894   UINTN                   DataSize;
1895   UINT32                  VarAttr;
1896   UINT32                  CertNodeOffset;
1897   UINT32                  CertNodeSize;
1898   UINT8                   *NewCertDb;
1899   UINT32                  NewCertDbSize;
1900
1901   if ((VariableName == NULL) || (VendorGuid == NULL)) {
1902     return EFI_INVALID_PARAMETER;
1903   }
1904
1905   //
1906   // Get variable "certdb".
1907   //
1908   Status = FindVariable (
1909              EFI_CERT_DB_NAME,
1910              &gEfiCertDbGuid,
1911              &CertDbVariable,
1912              &mVariableModuleGlobal->VariableGlobal,
1913              FALSE
1914              );
1915   if (EFI_ERROR (Status)) {
1916     return Status;
1917   }
1918
1919   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1920   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1921   if ((DataSize == 0) || (Data == NULL)) {
1922     ASSERT (FALSE);
1923     return EFI_NOT_FOUND;
1924   }
1925
1926   if (DataSize == sizeof (UINT32)) {
1927     //
1928     // There is no certs in certdb.
1929     //
1930     return EFI_SUCCESS;
1931   }
1932
1933   //
1934   // Get corresponding cert node from certdb.
1935   //
1936   Status = FindCertsFromDb (
1937              VariableName,
1938              VendorGuid,
1939              Data,
1940              DataSize,
1941              NULL,
1942              NULL,
1943              &CertNodeOffset,
1944              &CertNodeSize
1945              );
1946
1947   if (EFI_ERROR (Status)) {
1948     return Status;
1949   }
1950
1951   if (DataSize < (CertNodeOffset + CertNodeSize)) {
1952     return EFI_NOT_FOUND;
1953   }
1954
1955   //
1956   // Construct new data content of variable "certdb".
1957   //
1958   NewCertDbSize = (UINT32) DataSize - CertNodeSize;
1959   NewCertDb     = (UINT8*) mCertDbStore;
1960
1961   //
1962   // Copy the DB entries before deleting node.
1963   //
1964   CopyMem (NewCertDb, Data, CertNodeOffset);
1965   //
1966   // Update CertDbListSize.
1967   //
1968   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
1969   //
1970   // Copy the DB entries after deleting node.
1971   //
1972   if (DataSize > (CertNodeOffset + CertNodeSize)) {
1973     CopyMem (
1974       NewCertDb + CertNodeOffset,
1975       Data + CertNodeOffset + CertNodeSize,
1976       DataSize - CertNodeOffset - CertNodeSize
1977       );
1978   }
1979
1980   //
1981   // Set "certdb".
1982   //
1983   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
1984   Status   = UpdateVariable (
1985                EFI_CERT_DB_NAME,
1986                &gEfiCertDbGuid,
1987                NewCertDb,
1988                NewCertDbSize,
1989                VarAttr,
1990                0,
1991                0,
1992                &CertDbVariable,
1993                NULL
1994                );
1995
1996   return Status;
1997 }
1998
1999 /**
2000   Insert signer's certificates for common authenticated variable with VariableName
2001   and VendorGuid in AUTH_CERT_DB_DATA to "certdb".
2002
2003   @param[in]  VariableName   Name of authenticated Variable.
2004   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
2005   @param[in]  CertData       Pointer to signer's certificates.
2006   @param[in]  CertDataSize   Length of CertData in bytes.
2007
2008   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
2009   @retval  EFI_ACCESS_DENIED     An AUTH_CERT_DB_DATA entry with same VariableName
2010                                  and VendorGuid already exists.
2011   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
2012   @retval  EFI_SUCCESS           Insert an AUTH_CERT_DB_DATA entry to "certdb"
2013
2014 **/
2015 EFI_STATUS
2016 InsertCertsToDb (
2017   IN     CHAR16           *VariableName,
2018   IN     EFI_GUID         *VendorGuid,
2019   IN     UINT8            *CertData,
2020   IN     UINTN            CertDataSize
2021   )
2022 {
2023   VARIABLE_POINTER_TRACK  CertDbVariable;
2024   EFI_STATUS              Status;
2025   UINT8                   *Data;
2026   UINTN                   DataSize;
2027   UINT32                  VarAttr;
2028   UINT8                   *NewCertDb;
2029   UINT32                  NewCertDbSize;
2030   UINT32                  CertNodeSize;
2031   UINT32                  NameSize;
2032   AUTH_CERT_DB_DATA       *Ptr;
2033
2034   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL)) {
2035     return EFI_INVALID_PARAMETER;
2036   }
2037
2038   //
2039   // Get variable "certdb".
2040   //
2041   Status = FindVariable (
2042              EFI_CERT_DB_NAME,
2043              &gEfiCertDbGuid,
2044              &CertDbVariable,
2045              &mVariableModuleGlobal->VariableGlobal,
2046              FALSE
2047              );
2048   if (EFI_ERROR (Status)) {
2049     return Status;
2050   }
2051
2052   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
2053   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
2054   if ((DataSize == 0) || (Data == NULL)) {
2055     ASSERT (FALSE);
2056     return EFI_NOT_FOUND;
2057   }
2058
2059   //
2060   // Find whether matching cert node already exists in "certdb".
2061   // If yes return error.
2062   //
2063   Status = FindCertsFromDb (
2064              VariableName,
2065              VendorGuid,
2066              Data,
2067              DataSize,
2068              NULL,
2069              NULL,
2070              NULL,
2071              NULL
2072              );
2073
2074   if (!EFI_ERROR (Status)) {
2075     ASSERT (FALSE);
2076     return EFI_ACCESS_DENIED;
2077   }
2078
2079   //
2080   // Construct new data content of variable "certdb".
2081   //
2082   NameSize      = (UINT32) StrLen (VariableName);
2083   CertNodeSize  = sizeof (AUTH_CERT_DB_DATA) + (UINT32) CertDataSize + NameSize * sizeof (CHAR16);
2084   NewCertDbSize = (UINT32) DataSize + CertNodeSize;
2085   if (NewCertDbSize > mMaxCertDbSize) {
2086     return EFI_OUT_OF_RESOURCES;
2087   }
2088   NewCertDb     = (UINT8*) mCertDbStore;
2089
2090   //
2091   // Copy the DB entries before deleting node.
2092   //
2093   CopyMem (NewCertDb, Data, DataSize);
2094   //
2095   // Update CertDbListSize.
2096   //
2097   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
2098   //
2099   // Construct new cert node.
2100   //
2101   Ptr = (AUTH_CERT_DB_DATA *) (NewCertDb + DataSize);
2102   CopyGuid (&Ptr->VendorGuid, VendorGuid);
2103   CopyMem (&Ptr->CertNodeSize, &CertNodeSize, sizeof (UINT32));
2104   CopyMem (&Ptr->NameSize, &NameSize, sizeof (UINT32));
2105   CopyMem (&Ptr->CertDataSize, &CertDataSize, sizeof (UINT32));
2106
2107   CopyMem (
2108     (UINT8 *) Ptr + sizeof (AUTH_CERT_DB_DATA),
2109     VariableName,
2110     NameSize * sizeof (CHAR16)
2111     );
2112
2113   CopyMem (
2114     (UINT8 *) Ptr +  sizeof (AUTH_CERT_DB_DATA) + NameSize * sizeof (CHAR16),
2115     CertData,
2116     CertDataSize
2117     );
2118
2119   //
2120   // Set "certdb".
2121   //
2122   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
2123   Status   = UpdateVariable (
2124                EFI_CERT_DB_NAME,
2125                &gEfiCertDbGuid,
2126                NewCertDb,
2127                NewCertDbSize,
2128                VarAttr,
2129                0,
2130                0,
2131                &CertDbVariable,
2132                NULL
2133                );
2134
2135   return Status;
2136 }
2137
2138 /**
2139   Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
2140
2141   Caution: This function may receive untrusted input.
2142   This function may be invoked in SMM mode, and datasize and data are external input.
2143   This function will do basic validation, before parse the data.
2144   This function will parse the authentication carefully to avoid security issues, like
2145   buffer overflow, integer overflow.
2146
2147   @param[in]  VariableName                Name of Variable to be found.
2148   @param[in]  VendorGuid                  Variable vendor GUID.
2149   @param[in]  Data                        Data pointer.
2150   @param[in]  DataSize                    Size of Data found. If size is less than the
2151                                           data, this value contains the required size.
2152   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
2153   @param[in]  Attributes                  Attribute value of the variable.
2154   @param[in]  AuthVarType                 Verify against PK, KEK database, private database or certificate in data payload.
2155   @param[out] VarDel                      Delete the variable or not.
2156
2157   @retval EFI_INVALID_PARAMETER           Invalid parameter.
2158   @retval EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
2159                                           check carried out by the firmware.
2160   @retval EFI_OUT_OF_RESOURCES            Failed to process variable due to lack
2161                                           of resources.
2162   @retval EFI_SUCCESS                     Variable pass validation successfully.
2163
2164 **/
2165 EFI_STATUS
2166 VerifyTimeBasedPayload (
2167   IN     CHAR16                             *VariableName,
2168   IN     EFI_GUID                           *VendorGuid,
2169   IN     VOID                               *Data,
2170   IN     UINTN                              DataSize,
2171   IN     VARIABLE_POINTER_TRACK             *Variable,
2172   IN     UINT32                             Attributes,
2173   IN     AUTHVAR_TYPE                       AuthVarType,
2174   OUT    BOOLEAN                            *VarDel
2175   )
2176 {
2177   UINT8                            *RootCert;
2178   UINT8                            *SigData;
2179   UINT8                            *PayloadPtr;
2180   UINTN                            RootCertSize;
2181   UINTN                            Index;
2182   UINTN                            CertCount;
2183   UINTN                            PayloadSize;
2184   UINT32                           Attr;
2185   UINT32                           SigDataSize;
2186   UINT32                           KekDataSize;
2187   BOOLEAN                          VerifyStatus;
2188   EFI_STATUS                       Status;
2189   EFI_SIGNATURE_LIST               *CertList;
2190   EFI_SIGNATURE_DATA               *Cert;
2191   VARIABLE_POINTER_TRACK           KekVariable;
2192   EFI_VARIABLE_AUTHENTICATION_2    *CertData;
2193   UINT8                            *NewData;
2194   UINTN                            NewDataSize;
2195   VARIABLE_POINTER_TRACK           PkVariable;
2196   UINT8                            *Buffer;
2197   UINTN                            Length;
2198   UINT8                            *SignerCerts;
2199   UINT8                            *WrapSigData;
2200   UINTN                            CertStackSize;
2201   UINT8                            *CertsInCertDb;
2202   UINT32                           CertsSizeinDb;
2203
2204   VerifyStatus           = FALSE;
2205   CertData               = NULL;
2206   NewData                = NULL;
2207   Attr                   = Attributes;
2208   WrapSigData            = NULL;
2209   SignerCerts            = NULL;
2210   RootCert               = NULL;
2211   CertsInCertDb          = NULL;
2212
2213   //
2214   // When the attribute EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS is
2215   // set, then the Data buffer shall begin with an instance of a complete (and serialized)
2216   // EFI_VARIABLE_AUTHENTICATION_2 descriptor. The descriptor shall be followed by the new
2217   // variable value and DataSize shall reflect the combined size of the descriptor and the new
2218   // variable value. The authentication descriptor is not part of the variable data and is not
2219   // returned by subsequent calls to GetVariable().
2220   //
2221   CertData = (EFI_VARIABLE_AUTHENTICATION_2 *) Data;
2222
2223   //
2224   // Verify that Pad1, Nanosecond, TimeZone, Daylight and Pad2 components of the
2225   // TimeStamp value are set to zero.
2226   //
2227   if ((CertData->TimeStamp.Pad1 != 0) ||
2228       (CertData->TimeStamp.Nanosecond != 0) ||
2229       (CertData->TimeStamp.TimeZone != 0) ||
2230       (CertData->TimeStamp.Daylight != 0) ||
2231       (CertData->TimeStamp.Pad2 != 0)) {
2232     return EFI_SECURITY_VIOLATION;
2233   }
2234
2235   if ((Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
2236     if (CompareTimeStamp (&CertData->TimeStamp, &Variable->CurrPtr->TimeStamp)) {
2237       //
2238       // TimeStamp check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
2239       //
2240       return EFI_SECURITY_VIOLATION;
2241     }
2242   }
2243
2244   //
2245   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
2246   // Cert type should be EFI_CERT_TYPE_PKCS7_GUID.
2247   //
2248   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
2249       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertPkcs7Guid)) {
2250     //
2251     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
2252     //
2253     return EFI_SECURITY_VIOLATION;
2254   }
2255
2256   //
2257   // Find out Pkcs7 SignedData which follows the EFI_VARIABLE_AUTHENTICATION_2 descriptor.
2258   // AuthInfo.Hdr.dwLength is the length of the entire certificate, including the length of the header.
2259   //
2260   SigData = CertData->AuthInfo.CertData;
2261   SigDataSize = CertData->AuthInfo.Hdr.dwLength - (UINT32) (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData));
2262
2263   //
2264   // Find out the new data payload which follows Pkcs7 SignedData directly.
2265   //
2266   PayloadPtr = SigData + SigDataSize;
2267   PayloadSize = DataSize - OFFSET_OF_AUTHINFO2_CERT_DATA - (UINTN) SigDataSize;
2268
2269   //
2270   // Construct a buffer to fill with (VariableName, VendorGuid, Attributes, TimeStamp, Data).
2271   //
2272   NewDataSize = PayloadSize + sizeof (EFI_TIME) + sizeof (UINT32) +
2273                 sizeof (EFI_GUID) + StrSize (VariableName) - sizeof (CHAR16);
2274   NewData = mSerializationRuntimeBuffer;
2275
2276   Buffer = NewData;
2277   Length = StrLen (VariableName) * sizeof (CHAR16);
2278   CopyMem (Buffer, VariableName, Length);
2279   Buffer += Length;
2280
2281   Length = sizeof (EFI_GUID);
2282   CopyMem (Buffer, VendorGuid, Length);
2283   Buffer += Length;
2284
2285   Length = sizeof (UINT32);
2286   CopyMem (Buffer, &Attr, Length);
2287   Buffer += Length;
2288
2289   Length = sizeof (EFI_TIME);
2290   CopyMem (Buffer, &CertData->TimeStamp, Length);
2291   Buffer += Length;
2292
2293   CopyMem (Buffer, PayloadPtr, PayloadSize);
2294
2295   if (AuthVarType == AuthVarTypePk) {
2296     //
2297     // Verify that the signature has been made with the current Platform Key (no chaining for PK).
2298     // First, get signer's certificates from SignedData.
2299     //
2300     VerifyStatus = Pkcs7GetSigners (
2301                      SigData,
2302                      SigDataSize,
2303                      &SignerCerts,
2304                      &CertStackSize,
2305                      &RootCert,
2306                      &RootCertSize
2307                      );
2308     if (!VerifyStatus) {
2309       goto Exit;
2310     }
2311
2312     //
2313     // Second, get the current platform key from variable. Check whether it's identical with signer's certificates
2314     // in SignedData. If not, return error immediately.
2315     //
2316     Status = FindVariable (
2317                EFI_PLATFORM_KEY_NAME,
2318                &gEfiGlobalVariableGuid,
2319                &PkVariable,
2320                &mVariableModuleGlobal->VariableGlobal,
2321                FALSE
2322                );
2323     if (EFI_ERROR (Status)) {
2324       VerifyStatus = FALSE;
2325       goto Exit;
2326     }
2327     CertList = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (PkVariable.CurrPtr);
2328     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2329     if ((RootCertSize != (CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1))) ||
2330         (CompareMem (Cert->SignatureData, RootCert, RootCertSize) != 0)) {
2331       VerifyStatus = FALSE;
2332       goto Exit;
2333     }
2334
2335     //
2336     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2337     //
2338     VerifyStatus = Pkcs7Verify (
2339                      SigData,
2340                      SigDataSize,
2341                      RootCert,
2342                      RootCertSize,
2343                      NewData,
2344                      NewDataSize
2345                      );
2346
2347   } else if (AuthVarType == AuthVarTypeKek) {
2348
2349     //
2350     // Get KEK database from variable.
2351     //
2352     Status = FindVariable (
2353                EFI_KEY_EXCHANGE_KEY_NAME,
2354                &gEfiGlobalVariableGuid,
2355                &KekVariable,
2356                &mVariableModuleGlobal->VariableGlobal,
2357                FALSE
2358                );
2359     if (EFI_ERROR (Status)) {
2360       return Status;
2361     }
2362
2363     //
2364     // Ready to verify Pkcs7 SignedData. Go through KEK Signature Database to find out X.509 CertList.
2365     //
2366     KekDataSize      = KekVariable.CurrPtr->DataSize;
2367     CertList         = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (KekVariable.CurrPtr);
2368     while ((KekDataSize > 0) && (KekDataSize >= CertList->SignatureListSize)) {
2369       if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {
2370         Cert       = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2371         CertCount  = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
2372         for (Index = 0; Index < CertCount; Index++) {
2373           //
2374           // Iterate each Signature Data Node within this CertList for a verify
2375           //
2376           RootCert      = Cert->SignatureData;
2377           RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2378
2379           //
2380           // Verify Pkcs7 SignedData via Pkcs7Verify library.
2381           //
2382           VerifyStatus = Pkcs7Verify (
2383                            SigData,
2384                            SigDataSize,
2385                            RootCert,
2386                            RootCertSize,
2387                            NewData,
2388                            NewDataSize
2389                            );
2390           if (VerifyStatus) {
2391             goto Exit;
2392           }
2393           Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
2394         }
2395       }
2396       KekDataSize -= CertList->SignatureListSize;
2397       CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
2398     }
2399   } else if (AuthVarType == AuthVarTypePriv) {
2400
2401     //
2402     // Process common authenticated variable except PK/KEK/DB/DBX/DBT.
2403     // Get signer's certificates from SignedData.
2404     //
2405     VerifyStatus = Pkcs7GetSigners (
2406                      SigData,
2407                      SigDataSize,
2408                      &SignerCerts,
2409                      &CertStackSize,
2410                      &RootCert,
2411                      &RootCertSize
2412                      );
2413     if (!VerifyStatus) {
2414       goto Exit;
2415     }
2416
2417     //
2418     // Get previously stored signer's certificates from certdb for existing
2419     // variable. Check whether they are identical with signer's certificates
2420     // in SignedData. If not, return error immediately.
2421     //
2422     if ((Variable->CurrPtr != NULL)) {
2423       VerifyStatus = FALSE;
2424
2425       Status = GetCertsFromDb (VariableName, VendorGuid, &CertsInCertDb, &CertsSizeinDb);
2426       if (EFI_ERROR (Status)) {
2427         goto Exit;
2428       }
2429
2430       if ((CertStackSize != CertsSizeinDb) ||
2431           (CompareMem (SignerCerts, CertsInCertDb, CertsSizeinDb) != 0)) {
2432         goto Exit;
2433       }
2434     }
2435
2436     VerifyStatus = Pkcs7Verify (
2437                      SigData,
2438                      SigDataSize,
2439                      RootCert,
2440                      RootCertSize,
2441                      NewData,
2442                      NewDataSize
2443                      );
2444     if (!VerifyStatus) {
2445       goto Exit;
2446     }
2447
2448     //
2449     // Delete signer's certificates when delete the common authenticated variable.
2450     //
2451     if ((PayloadSize == 0) && (Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
2452       Status = DeleteCertsFromDb (VariableName, VendorGuid);
2453       if (EFI_ERROR (Status)) {
2454         VerifyStatus = FALSE;
2455         goto Exit;
2456       }
2457     } else if (Variable->CurrPtr == NULL && PayloadSize != 0) {
2458       //
2459       // Insert signer's certificates when adding a new common authenticated variable.
2460       //
2461       Status = InsertCertsToDb (VariableName, VendorGuid, SignerCerts, CertStackSize);
2462       if (EFI_ERROR (Status)) {
2463         VerifyStatus = FALSE;
2464         goto Exit;
2465       }
2466     }
2467   } else if (AuthVarType == AuthVarTypePayload) {
2468     CertList = (EFI_SIGNATURE_LIST *) PayloadPtr;
2469     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2470     RootCert      = Cert->SignatureData;
2471     RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2472
2473     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2474     //
2475     VerifyStatus = Pkcs7Verify (
2476                      SigData,
2477                      SigDataSize,
2478                      RootCert,
2479                      RootCertSize,
2480                      NewData,
2481                      NewDataSize
2482                      );
2483   } else {
2484     return EFI_SECURITY_VIOLATION;
2485   }
2486
2487 Exit:
2488
2489   if (AuthVarType == AuthVarTypePk || AuthVarType == AuthVarTypePriv) {
2490     Pkcs7FreeSigners (RootCert);
2491     Pkcs7FreeSigners (SignerCerts);
2492   }
2493
2494   if (!VerifyStatus) {
2495     return EFI_SECURITY_VIOLATION;
2496   }
2497
2498   Status = CheckSignatureListFormat(VariableName, VendorGuid, PayloadPtr, PayloadSize);
2499   if (EFI_ERROR (Status)) {
2500     return Status;
2501   }
2502
2503   if ((PayloadSize == 0) && (VarDel != NULL)) {
2504     *VarDel = TRUE;
2505   }
2506
2507   //
2508   // Final step: Update/Append Variable if it pass Pkcs7Verify
2509   //
2510   return UpdateVariable (
2511            VariableName,
2512            VendorGuid,
2513            PayloadPtr,
2514            PayloadSize,
2515            Attributes,
2516            0,
2517            0,
2518            Variable,
2519            &CertData->TimeStamp
2520            );
2521 }