SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c

   1 /** @file
   2   Implement authentication services for the authenticated variable
   3   service in UEFI2.2.
   4
   5   Caution: This module requires additional review when modified.
   6   This driver will have external input - variable data. It may be input in SMM mode.
   7   This external input must be validated carefully to avoid security issue like
   8   buffer overflow, integer overflow.
   9   Variable attribute should also be checked to avoid authentication bypass.
  10      The whole SMM authentication variable design relies on the integrity of flash part and SMM.
  11   which is assumed to be protected by platform.  All variable code and metadata in flash/SMM Memory
  12   may not be modified without authorization. If platform fails to protect these resources,
  13   the authentication service provided in this driver will be broken, and the behavior is undefined.
  14
  15   ProcessVarWithPk(), ProcessVarWithKek() and ProcessVariable() are the function to do
  16   variable authentication.
  17
  18   VerifyTimeBasedPayload() and VerifyCounterBasedPayload() are sub function to do verification.
  19   They will do basic validation for authentication data structure, then call crypto library
  20   to verify the signature.
  21
  22 Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>
  23 This program and the accompanying materials
  24 are licensed and made available under the terms and conditions of the BSD License
  25 which accompanies this distribution.  The full text of the license may be found at
  26 http://opensource.org/licenses/bsd-license.php
  27
  28 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  29 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  30
  31 **/
  32
  33 #include "Variable.h"
  34 #include "AuthService.h"
  35
  36 ///
  37 /// Global database array for scratch
  38 ///
  39 UINT8    *mPubKeyStore;
  40 UINT32   mPubKeyNumber;
  41 UINT32   mMaxKeyNumber;
  42 UINT32   mMaxKeyDbSize;
  43 UINT8    *mCertDbStore;
  44 UINT32   mMaxCertDbSize;
  45 UINT32   mPlatformMode;
  46 UINT8    mVendorKeyState;
  47
  48 EFI_GUID mSignatureSupport[] = {EFI_CERT_SHA1_GUID, EFI_CERT_SHA256_GUID, EFI_CERT_RSA2048_GUID, EFI_CERT_X509_GUID};
  49 //
  50 // Public Exponent of RSA Key.
  51 //
  52 CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };
  53 //
  54 // Hash context pointer
  55 //
  56 VOID  *mHashCtx = NULL;
  57
  58 //
  59 // Requirement for different signature type which have been defined in UEFI spec.
  60 // These data are used to peform SignatureList format check while setting PK/KEK variable.
  61 //
  62 EFI_SIGNATURE_ITEM mSupportSigItem[] = {
  63 //{SigType,                       SigHeaderSize,   SigDataSize  }
  64   {EFI_CERT_SHA256_GUID,          0,               32           },
  65   {EFI_CERT_RSA2048_GUID,         0,               256          },
  66   {EFI_CERT_RSA2048_SHA256_GUID,  0,               256          },
  67   {EFI_CERT_SHA1_GUID,            0,               20           },
  68   {EFI_CERT_RSA2048_SHA1_GUID,    0,               256          },
  69   {EFI_CERT_X509_GUID,            0,               ((UINT32) ~0)},
  70   {EFI_CERT_SHA224_GUID,          0,               28           },
  71   {EFI_CERT_SHA384_GUID,          0,               48           },
  72   {EFI_CERT_SHA512_GUID,          0,               64           },
  73   {EFI_CERT_X509_SHA256_GUID,     0,               48           },
  74   {EFI_CERT_X509_SHA384_GUID,     0,               64           },
  75   {EFI_CERT_X509_SHA512_GUID,     0,               80           }
  76 };
  77
  78 /**
  79   Determine whether this operation needs a physical present user.
  80
  81   @param[in]      VariableName            Name of the Variable.
  82   @param[in]      VendorGuid              GUID of the Variable.
  83
  84   @retval TRUE      This variable is protected, only a physical present user could set this variable.
  85   @retval FALSE     This variable is not protected.
  86
  87 **/
  88 BOOLEAN
  89 NeedPhysicallyPresent(
  90   IN     CHAR16         *VariableName,
  91   IN     EFI_GUID       *VendorGuid
  92   )
  93 {
  94   if ((CompareGuid (VendorGuid, &gEfiSecureBootEnableDisableGuid) && (StrCmp (VariableName, EFI_SECURE_BOOT_ENABLE_NAME) == 0))
  95     || (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (VariableName, EFI_CUSTOM_MODE_NAME) == 0))) {
  96     return TRUE;
  97   }
  98
  99   return FALSE;
 100 }
 101
 102 /**
 103   Determine whether the platform is operating in Custom Secure Boot mode.
 104
 105   @retval TRUE           The platform is operating in Custom mode.
 106   @retval FALSE          The platform is operating in Standard mode.
 107
 108 **/
 109 BOOLEAN
 110 InCustomMode (
 111   VOID
 112   )
 113 {
 114   VARIABLE_POINTER_TRACK  Variable;
 115
 116   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 117   if (Variable.CurrPtr != NULL && *(GetVariableDataPtr (Variable.CurrPtr)) == CUSTOM_SECURE_BOOT_MODE) {
 118     return TRUE;
 119   }
 120
 121   return FALSE;
 122 }
 123
 124 /**
 125   Initializes for authenticated varibale service.
 126
 127   @retval EFI_SUCCESS           Function successfully executed.
 128   @retval EFI_OUT_OF_RESOURCES  Fail to allocate enough memory resources.
 129
 130 **/
 131 EFI_STATUS
 132 AutenticatedVariableServiceInitialize (
 133   VOID
 134   )
 135 {
 136   EFI_STATUS              Status;
 137   VARIABLE_POINTER_TRACK  Variable;
 138   VARIABLE_POINTER_TRACK  PkVariable;
 139   UINT8                   VarValue;
 140   UINT32                  VarAttr;
 141   UINT8                   *Data;
 142   UINTN                   DataSize;
 143   UINTN                   CtxSize;
 144   UINT8                   SecureBootMode;
 145   UINT8                   SecureBootEnable;
 146   UINT8                   CustomMode;
 147   UINT32                  ListSize;
 148
 149   //
 150   // Initialize hash context.
 151   //
 152   CtxSize   = Sha256GetContextSize ();
 153   mHashCtx  = AllocateRuntimePool (CtxSize);
 154   if (mHashCtx == NULL) {
 155     return EFI_OUT_OF_RESOURCES;
 156   }
 157
 158   //
 159   // Reserve runtime buffer for public key database. The size excludes variable header and name size.
 160   //
 161   mMaxKeyDbSize = PcdGet32 (PcdMaxVariableSize) - sizeof (VARIABLE_HEADER) - sizeof (AUTHVAR_KEYDB_NAME);
 162   mMaxKeyNumber = mMaxKeyDbSize / EFI_CERT_TYPE_RSA2048_SIZE;
 163   mPubKeyStore  = AllocateRuntimePool (mMaxKeyDbSize);
 164   if (mPubKeyStore == NULL) {
 165     return EFI_OUT_OF_RESOURCES;
 166   }
 167
 168   //
 169   // Reserve runtime buffer for certificate database. The size excludes variable header and name size.
 170   //
 171   mMaxCertDbSize = PcdGet32 (PcdMaxVariableSize) - sizeof (VARIABLE_HEADER) - sizeof (EFI_CERT_DB_NAME);
 172   mCertDbStore   = AllocateRuntimePool (mMaxCertDbSize);
 173   if (mCertDbStore == NULL) {
 174     return EFI_OUT_OF_RESOURCES;
 175   }
 176
 177   //
 178   // Check "AuthVarKeyDatabase" variable's existence.
 179   // If it doesn't exist, create a new one with initial value of 0 and EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
 180   //
 181   Status = FindVariable (
 182              AUTHVAR_KEYDB_NAME,
 183              &gEfiAuthenticatedVariableGuid,
 184              &Variable,
 185              &mVariableModuleGlobal->VariableGlobal,
 186              FALSE
 187              );
 188
 189   if (Variable.CurrPtr == NULL) {
 190     VarAttr       = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 191     VarValue      = 0;
 192     mPubKeyNumber = 0;
 193     Status        = UpdateVariable (
 194                       AUTHVAR_KEYDB_NAME,
 195                       &gEfiAuthenticatedVariableGuid,
 196                       &VarValue,
 197                       sizeof(UINT8),
 198                       VarAttr,
 199                       0,
 200                       0,
 201                       &Variable,
 202                       NULL
 203                       );
 204     if (EFI_ERROR (Status)) {
 205       return Status;
 206     }
 207   } else {
 208     //
 209     // Load database in global variable for cache.
 210     //
 211     DataSize  = DataSizeOfVariable (Variable.CurrPtr);
 212     Data      = GetVariableDataPtr (Variable.CurrPtr);
 213     ASSERT ((DataSize != 0) && (Data != NULL));
 214     //
 215     // "AuthVarKeyDatabase" is an internal variable. Its DataSize is always ensured not to exceed mPubKeyStore buffer size(See definition before)
 216     //  Therefore, there is no memory overflow in underlying CopyMem.
 217     //
 218     CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
 219     mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
 220   }
 221
 222   FindVariable (EFI_PLATFORM_KEY_NAME, &gEfiGlobalVariableGuid, &PkVariable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 223   if (PkVariable.CurrPtr == NULL) {
 224     DEBUG ((EFI_D_INFO, "Variable %s does not exist.\n", EFI_PLATFORM_KEY_NAME));
 225   } else {
 226     DEBUG ((EFI_D_INFO, "Variable %s exists.\n", EFI_PLATFORM_KEY_NAME));
 227   }
 228
 229   //
 230   // Create "SetupMode" variable with BS+RT attribute set.
 231   //
 232   FindVariable (EFI_SETUP_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 233   if (PkVariable.CurrPtr == NULL) {
 234     mPlatformMode = SETUP_MODE;
 235   } else {
 236     mPlatformMode = USER_MODE;
 237   }
 238   Status = UpdateVariable (
 239              EFI_SETUP_MODE_NAME,
 240              &gEfiGlobalVariableGuid,
 241              &mPlatformMode,
 242              sizeof(UINT8),
 243              EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 244              0,
 245              0,
 246              &Variable,
 247              NULL
 248              );
 249   if (EFI_ERROR (Status)) {
 250     return Status;
 251   }
 252
 253   //
 254   // Create "SignatureSupport" variable with BS+RT attribute set.
 255   //
 256   FindVariable (EFI_SIGNATURE_SUPPORT_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 257   Status  = UpdateVariable (
 258               EFI_SIGNATURE_SUPPORT_NAME,
 259               &gEfiGlobalVariableGuid,
 260               mSignatureSupport,
 261               sizeof(mSignatureSupport),
 262               EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 263               0,
 264               0,
 265               &Variable,
 266               NULL
 267               );
 268   if (EFI_ERROR (Status)) {
 269     return Status;
 270   }
 271
 272   //
 273   // If "SecureBootEnable" variable exists, then update "SecureBoot" variable.
 274   // If "SecureBootEnable" variable is SECURE_BOOT_ENABLE and in USER_MODE, Set "SecureBoot" variable to SECURE_BOOT_MODE_ENABLE.
 275   // If "SecureBootEnable" variable is SECURE_BOOT_DISABLE, Set "SecureBoot" variable to SECURE_BOOT_MODE_DISABLE.
 276   //
 277   SecureBootEnable = SECURE_BOOT_DISABLE;
 278   FindVariable (EFI_SECURE_BOOT_ENABLE_NAME, &gEfiSecureBootEnableDisableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 279   if (Variable.CurrPtr != NULL) {
 280     SecureBootEnable = *(GetVariableDataPtr (Variable.CurrPtr));
 281   } else if (mPlatformMode == USER_MODE) {
 282     //
 283     // "SecureBootEnable" not exist, initialize it in USER_MODE.
 284     //
 285     SecureBootEnable = SECURE_BOOT_ENABLE;
 286     Status = UpdateVariable (
 287                EFI_SECURE_BOOT_ENABLE_NAME,
 288                &gEfiSecureBootEnableDisableGuid,
 289                &SecureBootEnable,
 290                sizeof (UINT8),
 291                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 292                0,
 293                0,
 294                &Variable,
 295                NULL
 296                );
 297     if (EFI_ERROR (Status)) {
 298       return Status;
 299     }
 300   }
 301
 302   //
 303   // Create "SecureBoot" variable with BS+RT attribute set.
 304   //
 305   if (SecureBootEnable == SECURE_BOOT_ENABLE && mPlatformMode == USER_MODE) {
 306     SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 307   } else {
 308     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 309   }
 310   FindVariable (EFI_SECURE_BOOT_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 311   Status = UpdateVariable (
 312              EFI_SECURE_BOOT_MODE_NAME,
 313              &gEfiGlobalVariableGuid,
 314              &SecureBootMode,
 315              sizeof (UINT8),
 316              EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 317              0,
 318              0,
 319              &Variable,
 320              NULL
 321              );
 322   if (EFI_ERROR (Status)) {
 323     return Status;
 324   }
 325
 326   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SETUP_MODE_NAME, mPlatformMode));
 327   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_MODE_NAME, SecureBootMode));
 328   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_ENABLE_NAME, SecureBootEnable));
 329
 330   //
 331   // Initialize "CustomMode" in STANDARD_SECURE_BOOT_MODE state.
 332   //
 333   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 334   CustomMode = STANDARD_SECURE_BOOT_MODE;
 335   Status = UpdateVariable (
 336              EFI_CUSTOM_MODE_NAME,
 337              &gEfiCustomModeEnableGuid,
 338              &CustomMode,
 339              sizeof (UINT8),
 340              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 341              0,
 342              0,
 343              &Variable,
 344              NULL
 345              );
 346   if (EFI_ERROR (Status)) {
 347     return Status;
 348   }
 349
 350   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_CUSTOM_MODE_NAME, CustomMode));
 351
 352   //
 353   // Check "certdb" variable's existence.
 354   // If it doesn't exist, then create a new one with
 355   // EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.
 356   //
 357   Status = FindVariable (
 358              EFI_CERT_DB_NAME,
 359              &gEfiCertDbGuid,
 360              &Variable,
 361              &mVariableModuleGlobal->VariableGlobal,
 362              FALSE
 363              );
 364
 365   if (Variable.CurrPtr == NULL) {
 366     VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
 367     ListSize = sizeof (UINT32);
 368     Status   = UpdateVariable (
 369                  EFI_CERT_DB_NAME,
 370                  &gEfiCertDbGuid,
 371                  &ListSize,
 372                  sizeof (UINT32),
 373                  VarAttr,
 374                  0,
 375                  0,
 376                  &Variable,
 377                  NULL
 378                  );
 379     if (EFI_ERROR (Status)) {
 380       return Status;
 381     }
 382   }
 383
 384   //
 385   // Check "VendorKeysNv" variable's existence and create "VendorKeys" variable accordingly.
 386   //
 387   FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 388   if (Variable.CurrPtr != NULL) {
 389     mVendorKeyState = *(GetVariableDataPtr (Variable.CurrPtr));
 390   } else {
 391     //
 392     // "VendorKeysNv" not exist, initialize it in VENDOR_KEYS_VALID state.
 393     //
 394     mVendorKeyState = VENDOR_KEYS_VALID;
 395     Status = UpdateVariable (
 396                EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
 397                &gEfiVendorKeysNvGuid,
 398                &mVendorKeyState,
 399                sizeof (UINT8),
 400                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS,
 401                0,
 402                0,
 403                &Variable,
 404                NULL
 405                );
 406     if (EFI_ERROR (Status)) {
 407       return Status;
 408     }
 409   }
 410
 411   //
 412   // Create "VendorKeys" variable with BS+RT attribute set.
 413   //
 414   FindVariable (EFI_VENDOR_KEYS_VARIABLE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 415   Status = UpdateVariable (
 416              EFI_VENDOR_KEYS_VARIABLE_NAME,
 417              &gEfiGlobalVariableGuid,
 418              &mVendorKeyState,
 419              sizeof (UINT8),
 420              EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 421              0,
 422              0,
 423              &Variable,
 424              NULL
 425              );
 426   if (EFI_ERROR (Status)) {
 427     return Status;
 428   }
 429
 430   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_VENDOR_KEYS_VARIABLE_NAME, mVendorKeyState));
 431
 432   return Status;
 433 }
 434
 435 /**
 436   Add public key in store and return its index.
 437
 438   @param[in]  PubKey                  Input pointer to Public Key data
 439   @param[in]  VariableDataEntry       The variable data entry
 440
 441   @return                             Index of new added item
 442
 443 **/
 444 UINT32
 445 AddPubKeyInStore (
 446   IN  UINT8                        *PubKey,
 447   IN  VARIABLE_ENTRY_CONSISTENCY   *VariableDataEntry
 448   )
 449 {
 450   EFI_STATUS                       Status;
 451   BOOLEAN                          IsFound;
 452   UINT32                           Index;
 453   VARIABLE_POINTER_TRACK           Variable;
 454   UINT8                            *Ptr;
 455   UINT8                            *Data;
 456   UINTN                            DataSize;
 457   VARIABLE_ENTRY_CONSISTENCY       PublicKeyEntry;
 458   UINT32                           Attributes;
 459
 460   if (PubKey == NULL) {
 461     return 0;
 462   }
 463
 464   Status = FindVariable (
 465              AUTHVAR_KEYDB_NAME,
 466              &gEfiAuthenticatedVariableGuid,
 467              &Variable,
 468              &mVariableModuleGlobal->VariableGlobal,
 469              FALSE
 470              );
 471   if (EFI_ERROR (Status)) {
 472     DEBUG ((EFI_D_ERROR, "Get public key database variable failure, Status = %r\n", Status));
 473     return 0;
 474   }
 475
 476   //
 477   // Check whether the public key entry does exist.
 478   //
 479   IsFound = FALSE;
 480   for (Ptr = mPubKeyStore, Index = 1; Index <= mPubKeyNumber; Index++) {
 481     if (CompareMem (Ptr, PubKey, EFI_CERT_TYPE_RSA2048_SIZE) == 0) {
 482       IsFound = TRUE;
 483       break;
 484     }
 485     Ptr += EFI_CERT_TYPE_RSA2048_SIZE;
 486   }
 487
 488   if (!IsFound) {
 489     //
 490     // Add public key in database.
 491     //
 492     if (mPubKeyNumber == mMaxKeyNumber) {
 493       //
 494       // Public key dadatase is full, try to reclaim invalid key.
 495       //
 496       if (AtRuntime ()) {
 497         //
 498         // NV storage can't reclaim at runtime.
 499         //
 500         return 0;
 501       }
 502
 503       Status = Reclaim (
 504                  mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase,
 505                  &mVariableModuleGlobal->NonVolatileLastVariableOffset,
 506                  FALSE,
 507                  NULL,
 508                  NULL,
 509                  0,
 510                  TRUE
 511                  );
 512       if (EFI_ERROR (Status)) {
 513         return 0;
 514       }
 515
 516       Status = FindVariable (
 517                  AUTHVAR_KEYDB_NAME,
 518                  &gEfiAuthenticatedVariableGuid,
 519                  &Variable,
 520                  &mVariableModuleGlobal->VariableGlobal,
 521                  FALSE
 522                  );
 523       if (EFI_ERROR (Status)) {
 524         DEBUG ((EFI_D_ERROR, "Get public key database variable failure, Status = %r\n", Status));
 525         return 0;
 526       }
 527
 528       DataSize  = DataSizeOfVariable (Variable.CurrPtr);
 529       Data      = GetVariableDataPtr (Variable.CurrPtr);
 530       ASSERT ((DataSize != 0) && (Data != NULL));
 531       //
 532       // "AuthVarKeyDatabase" is an internal used variable. Its DataSize is always ensured not to exceed mPubKeyStore buffer size(See definition before)
 533       //  Therefore, there is no memory overflow in underlying CopyMem.
 534       //
 535       CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
 536       mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
 537
 538       if (mPubKeyNumber == mMaxKeyNumber) {
 539         return 0;
 540       }
 541     }
 542
 543     //
 544     // Check the variable space for both public key and variable data.
 545     //
 546     PublicKeyEntry.VariableSize = (mPubKeyNumber + 1) * EFI_CERT_TYPE_RSA2048_SIZE;
 547     PublicKeyEntry.Guid         = &gEfiAuthenticatedVariableGuid;
 548     PublicKeyEntry.Name         = AUTHVAR_KEYDB_NAME;
 549     Attributes = VARIABLE_ATTRIBUTE_NV_BS_RT | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 550
 551     if (!CheckRemainingSpaceForConsistency (Attributes, &PublicKeyEntry, VariableDataEntry, NULL)) {
 552       //
 553       // No enough variable space.
 554       //
 555       return 0;
 556     }
 557
 558     CopyMem (mPubKeyStore + mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 559     Index = ++mPubKeyNumber;
 560     //
 561     // Update public key database variable.
 562     //
 563     Status = UpdateVariable (
 564                AUTHVAR_KEYDB_NAME,
 565                &gEfiAuthenticatedVariableGuid,
 566                mPubKeyStore,
 567                mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE,
 568                Attributes,
 569                0,
 570                0,
 571                &Variable,
 572                NULL
 573                );
 574     if (EFI_ERROR (Status)) {
 575       DEBUG ((EFI_D_ERROR, "Update public key database variable failure, Status = %r\n", Status));
 576       return 0;
 577     }
 578   }
 579
 580   return Index;
 581 }
 582
 583 /**
 584   Verify data payload with AuthInfo in EFI_CERT_TYPE_RSA2048_SHA256_GUID type.
 585   Follow the steps in UEFI2.2.
 586
 587   Caution: This function may receive untrusted input.
 588   This function may be invoked in SMM mode, and datasize and data are external input.
 589   This function will do basic validation, before parse the data.
 590   This function will parse the authentication carefully to avoid security issues, like
 591   buffer overflow, integer overflow.
 592
 593   @param[in]      Data                    Pointer to data with AuthInfo.
 594   @param[in]      DataSize                Size of Data.
 595   @param[in]      PubKey                  Public key used for verification.
 596
 597   @retval EFI_INVALID_PARAMETER       Invalid parameter.
 598   @retval EFI_SECURITY_VIOLATION      If authentication failed.
 599   @retval EFI_SUCCESS                 Authentication successful.
 600
 601 **/
 602 EFI_STATUS
 603 VerifyCounterBasedPayload (
 604   IN     UINT8          *Data,
 605   IN     UINTN          DataSize,
 606   IN     UINT8          *PubKey
 607   )
 608 {
 609   BOOLEAN                         Status;
 610   EFI_VARIABLE_AUTHENTICATION     *CertData;
 611   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
 612   UINT8                           Digest[SHA256_DIGEST_SIZE];
 613   VOID                            *Rsa;
 614   UINTN                           PayloadSize;
 615
 616   PayloadSize = DataSize - AUTHINFO_SIZE;
 617   Rsa         = NULL;
 618   CertData    = NULL;
 619   CertBlock   = NULL;
 620
 621   if (Data == NULL || PubKey == NULL) {
 622     return EFI_INVALID_PARAMETER;
 623   }
 624
 625   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
 626   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
 627
 628   //
 629   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
 630   // Cert type should be EFI_CERT_TYPE_RSA2048_SHA256_GUID.
 631   //
 632   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
 633       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertTypeRsa2048Sha256Guid)
 634         ) {
 635     //
 636     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
 637     //
 638     return EFI_SECURITY_VIOLATION;
 639   }
 640   //
 641   // Hash data payload with SHA256.
 642   //
 643   ZeroMem (Digest, SHA256_DIGEST_SIZE);
 644   Status  = Sha256Init (mHashCtx);
 645   if (!Status) {
 646     goto Done;
 647   }
 648   Status  = Sha256Update (mHashCtx, Data + AUTHINFO_SIZE, PayloadSize);
 649   if (!Status) {
 650     goto Done;
 651   }
 652   //
 653   // Hash Size.
 654   //
 655   Status  = Sha256Update (mHashCtx, &PayloadSize, sizeof (UINTN));
 656   if (!Status) {
 657     goto Done;
 658   }
 659   //
 660   // Hash Monotonic Count.
 661   //
 662   Status  = Sha256Update (mHashCtx, &CertData->MonotonicCount, sizeof (UINT64));
 663   if (!Status) {
 664     goto Done;
 665   }
 666   Status  = Sha256Final (mHashCtx, Digest);
 667   if (!Status) {
 668     goto Done;
 669   }
 670   //
 671   // Generate & Initialize RSA Context.
 672   //
 673   Rsa = RsaNew ();
 674   ASSERT (Rsa != NULL);
 675   //
 676   // Set RSA Key Components.
 677   // NOTE: Only N and E are needed to be set as RSA public key for signature verification.
 678   //
 679   Status = RsaSetKey (Rsa, RsaKeyN, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 680   if (!Status) {
 681     goto Done;
 682   }
 683   Status = RsaSetKey (Rsa, RsaKeyE, mRsaE, sizeof (mRsaE));
 684   if (!Status) {
 685     goto Done;
 686   }
 687   //
 688   // Verify the signature.
 689   //
 690   Status = RsaPkcs1Verify (
 691              Rsa,
 692              Digest,
 693              SHA256_DIGEST_SIZE,
 694              CertBlock->Signature,
 695              EFI_CERT_TYPE_RSA2048_SHA256_SIZE
 696              );
 697
 698 Done:
 699   if (Rsa != NULL) {
 700     RsaFree (Rsa);
 701   }
 702   if (Status) {
 703     return EFI_SUCCESS;
 704   } else {
 705     return EFI_SECURITY_VIOLATION;
 706   }
 707 }
 708
 709 /**
 710   Update platform mode.
 711
 712   @param[in]      Mode                    SETUP_MODE or USER_MODE.
 713
 714   @return EFI_INVALID_PARAMETER           Invalid parameter.
 715   @return EFI_SUCCESS                     Update platform mode successfully.
 716
 717 **/
 718 EFI_STATUS
 719 UpdatePlatformMode (
 720   IN  UINT32                    Mode
 721   )
 722 {
 723   EFI_STATUS              Status;
 724   VARIABLE_POINTER_TRACK  Variable;
 725   UINT8                   SecureBootMode;
 726   UINT8                   SecureBootEnable;
 727   UINTN                   VariableDataSize;
 728
 729   Status = FindVariable (
 730              EFI_SETUP_MODE_NAME,
 731              &gEfiGlobalVariableGuid,
 732              &Variable,
 733              &mVariableModuleGlobal->VariableGlobal,
 734              FALSE
 735              );
 736   if (EFI_ERROR (Status)) {
 737     return Status;
 738   }
 739
 740   //
 741   // Update the value of SetupMode variable by a simple mem copy, this could avoid possible
 742   // variable storage reclaim at runtime.
 743   //
 744   mPlatformMode = (UINT8) Mode;
 745   CopyMem (GetVariableDataPtr (Variable.CurrPtr), &mPlatformMode, sizeof(UINT8));
 746
 747   if (AtRuntime ()) {
 748     //
 749     // SecureBoot Variable indicates whether the platform firmware is operating
 750     // in Secure boot mode (1) or not (0), so we should not change SecureBoot
 751     // Variable in runtime.
 752     //
 753     return Status;
 754   }
 755
 756   //
 757   // Check "SecureBoot" variable's existence.
 758   // If it doesn't exist, firmware has no capability to perform driver signing verification,
 759   // then set "SecureBoot" to 0.
 760   //
 761   Status = FindVariable (
 762              EFI_SECURE_BOOT_MODE_NAME,
 763              &gEfiGlobalVariableGuid,
 764              &Variable,
 765              &mVariableModuleGlobal->VariableGlobal,
 766              FALSE
 767              );
 768   //
 769   // If "SecureBoot" variable exists, then check "SetupMode" variable update.
 770   // If "SetupMode" variable is USER_MODE, "SecureBoot" variable is set to 1.
 771   // If "SetupMode" variable is SETUP_MODE, "SecureBoot" variable is set to 0.
 772   //
 773   if (Variable.CurrPtr == NULL) {
 774     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 775   } else {
 776     if (mPlatformMode == USER_MODE) {
 777       SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 778     } else if (mPlatformMode == SETUP_MODE) {
 779       SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 780     } else {
 781       return EFI_NOT_FOUND;
 782     }
 783   }
 784
 785   Status  = UpdateVariable (
 786               EFI_SECURE_BOOT_MODE_NAME,
 787               &gEfiGlobalVariableGuid,
 788               &SecureBootMode,
 789               sizeof(UINT8),
 790               EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 791               0,
 792               0,
 793               &Variable,
 794               NULL
 795               );
 796   if (EFI_ERROR (Status)) {
 797     return Status;
 798   }
 799
 800   //
 801   // Check "SecureBootEnable" variable's existence. It can enable/disable secure boot feature.
 802   //
 803   Status = FindVariable (
 804              EFI_SECURE_BOOT_ENABLE_NAME,
 805              &gEfiSecureBootEnableDisableGuid,
 806              &Variable,
 807              &mVariableModuleGlobal->VariableGlobal,
 808              FALSE
 809              );
 810
 811   if (SecureBootMode == SECURE_BOOT_MODE_ENABLE) {
 812     //
 813     // Create the "SecureBootEnable" variable as secure boot is enabled.
 814     //
 815     SecureBootEnable = SECURE_BOOT_ENABLE;
 816     VariableDataSize = sizeof (SecureBootEnable);
 817   } else {
 818     //
 819     // Delete the "SecureBootEnable" variable if this variable exist as "SecureBoot"
 820     // variable is not in secure boot state.
 821     //
 822     if (Variable.CurrPtr == NULL || EFI_ERROR (Status)) {
 823       return EFI_SUCCESS;
 824     }
 825     SecureBootEnable = SECURE_BOOT_DISABLE;
 826     VariableDataSize = 0;
 827   }
 828
 829   Status = UpdateVariable (
 830              EFI_SECURE_BOOT_ENABLE_NAME,
 831              &gEfiSecureBootEnableDisableGuid,
 832              &SecureBootEnable,
 833              VariableDataSize,
 834              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 835              0,
 836              0,
 837              &Variable,
 838              NULL
 839              );
 840   return Status;
 841 }
 842
 843 /**
 844   Check input data form to make sure it is a valid EFI_SIGNATURE_LIST for PK/KEK/db/dbx/dbt variable.
 845
 846   @param[in]  VariableName                Name of Variable to be check.
 847   @param[in]  VendorGuid                  Variable vendor GUID.
 848   @param[in]  Data                        Point to the variable data to be checked.
 849   @param[in]  DataSize                    Size of Data.
 850
 851   @return EFI_INVALID_PARAMETER           Invalid signature list format.
 852   @return EFI_SUCCESS                     Passed signature list format check successfully.
 853
 854 **/
 855 EFI_STATUS
 856 CheckSignatureListFormat(
 857   IN  CHAR16                    *VariableName,
 858   IN  EFI_GUID                  *VendorGuid,
 859   IN  VOID                      *Data,
 860   IN  UINTN                     DataSize
 861   )
 862 {
 863   EFI_SIGNATURE_LIST     *SigList;
 864   UINTN                  SigDataSize;
 865   UINT32                 Index;
 866   UINT32                 SigCount;
 867   BOOLEAN                IsPk;
 868   VOID                   *RsaContext;
 869   EFI_SIGNATURE_DATA     *CertData;
 870   UINTN                  CertLen;
 871
 872   if (DataSize == 0) {
 873     return EFI_SUCCESS;
 874   }
 875
 876   ASSERT (VariableName != NULL && VendorGuid != NULL && Data != NULL);
 877
 878   if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_PLATFORM_KEY_NAME) == 0)){
 879     IsPk = TRUE;
 880   } else if ((CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0)) ||
 881              (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&
 882              ((StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0) || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0) ||
 883               (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0)))) {
 884     IsPk = FALSE;
 885   } else {
 886     return EFI_SUCCESS;
 887   }
 888
 889   SigCount = 0;
 890   SigList  = (EFI_SIGNATURE_LIST *) Data;
 891   SigDataSize  = DataSize;
 892   RsaContext = NULL;
 893
 894   //
 895   // Walk throuth the input signature list and check the data format.
 896   // If any signature is incorrectly formed, the whole check will fail.
 897   //
 898   while ((SigDataSize > 0) && (SigDataSize >= SigList->SignatureListSize)) {
 899     for (Index = 0; Index < (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM)); Index++ ) {
 900       if (CompareGuid (&SigList->SignatureType, &mSupportSigItem[Index].SigType)) {
 901         //
 902         // The value of SignatureSize should always be 16 (size of SignatureOwner
 903         // component) add the data length according to signature type.
 904         //
 905         if (mSupportSigItem[Index].SigDataSize != ((UINT32) ~0) &&
 906           (SigList->SignatureSize - sizeof (EFI_GUID)) != mSupportSigItem[Index].SigDataSize) {
 907           return EFI_INVALID_PARAMETER;
 908         }
 909         if (mSupportSigItem[Index].SigHeaderSize != ((UINTN) ~0) &&
 910           SigList->SignatureHeaderSize != mSupportSigItem[Index].SigHeaderSize) {
 911           return EFI_INVALID_PARAMETER;
 912         }
 913         break;
 914       }
 915     }
 916
 917     if (Index == (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM))) {
 918       //
 919       // Undefined signature type.
 920       //
 921       return EFI_INVALID_PARAMETER;
 922     }
 923
 924     if (CompareGuid (&SigList->SignatureType, &gEfiCertX509Guid)) {
 925       //
 926       // Try to retrieve the RSA public key from the X.509 certificate.
 927       // If this operation fails, it's not a valid certificate.
 928       //
 929       RsaContext = RsaNew ();
 930       if (RsaContext == NULL) {
 931         return EFI_INVALID_PARAMETER;
 932       }
 933       CertData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigList + sizeof (EFI_SIGNATURE_LIST) + SigList->SignatureHeaderSize);
 934       CertLen = SigList->SignatureSize - sizeof (EFI_GUID);
 935       if (!RsaGetPublicKeyFromX509 (CertData->SignatureData, CertLen, &RsaContext)) {
 936         RsaFree (RsaContext);
 937         return EFI_INVALID_PARAMETER;
 938       }
 939       RsaFree (RsaContext);
 940     }
 941
 942     if ((SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) % SigList->SignatureSize != 0) {
 943       return EFI_INVALID_PARAMETER;
 944     }
 945     SigCount += (SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) / SigList->SignatureSize;
 946
 947     SigDataSize -= SigList->SignatureListSize;
 948     SigList = (EFI_SIGNATURE_LIST *) ((UINT8 *) SigList + SigList->SignatureListSize);
 949   }
 950
 951   if (((UINTN) SigList - (UINTN) Data) != DataSize) {
 952     return EFI_INVALID_PARAMETER;
 953   }
 954
 955   if (IsPk && SigCount > 1) {
 956     return EFI_INVALID_PARAMETER;
 957   }
 958
 959   return EFI_SUCCESS;
 960 }
 961
 962 /**
 963   Update "VendorKeys" variable to record the out of band secure boot key modification.
 964
 965   @return EFI_SUCCESS           Variable is updated successfully.
 966   @return Others                Failed to update variable.
 967
 968 **/
 969 EFI_STATUS
 970 VendorKeyIsModified (
 971   VOID
 972   )
 973 {
 974   EFI_STATUS              Status;
 975   VARIABLE_POINTER_TRACK  Variable;
 976
 977   if (mVendorKeyState == VENDOR_KEYS_MODIFIED) {
 978     return EFI_SUCCESS;
 979   }
 980   mVendorKeyState = VENDOR_KEYS_MODIFIED;
 981
 982   FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 983   Status = UpdateVariable (
 984              EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
 985              &gEfiVendorKeysNvGuid,
 986              &mVendorKeyState,
 987              sizeof (UINT8),
 988              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS,
 989              0,
 990              0,
 991              &Variable,
 992              NULL
 993              );
 994   if (EFI_ERROR (Status)) {
 995     return Status;
 996   }
 997
 998   FindVariable (EFI_VENDOR_KEYS_VARIABLE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 999   return UpdateVariable (
1000            EFI_VENDOR_KEYS_VARIABLE_NAME,
1001            &gEfiGlobalVariableGuid,
1002            &mVendorKeyState,
1003            sizeof (UINT8),
1004            EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
1005            0,
1006            0,
1007            &Variable,
1008            NULL
1009            );
1010 }
1011
1012 /**
1013   Process variable with platform key for verification.
1014
1015   Caution: This function may receive untrusted input.
1016   This function may be invoked in SMM mode, and datasize and data are external input.
1017   This function will do basic validation, before parse the data.
1018   This function will parse the authentication carefully to avoid security issues, like
1019   buffer overflow, integer overflow.
1020   This function will check attribute carefully to avoid authentication bypass.
1021
1022   @param[in]  VariableName                Name of Variable to be found.
1023   @param[in]  VendorGuid                  Variable vendor GUID.
1024   @param[in]  Data                        Data pointer.
1025   @param[in]  DataSize                    Size of Data found. If size is less than the
1026                                           data, this value contains the required size.
1027   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1028   @param[in]  Attributes                  Attribute value of the variable
1029   @param[in]  IsPk                        Indicate whether it is to process pk.
1030
1031   @return EFI_INVALID_PARAMETER           Invalid parameter.
1032   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation.
1033                                           check carried out by the firmware.
1034   @return EFI_SUCCESS                     Variable passed validation successfully.
1035
1036 **/
1037 EFI_STATUS
1038 ProcessVarWithPk (
1039   IN  CHAR16                    *VariableName,
1040   IN  EFI_GUID                  *VendorGuid,
1041   IN  VOID                      *Data,
1042   IN  UINTN                     DataSize,
1043   IN  VARIABLE_POINTER_TRACK    *Variable,
1044   IN  UINT32                    Attributes OPTIONAL,
1045   IN  BOOLEAN                   IsPk
1046   )
1047 {
1048   EFI_STATUS                  Status;
1049   BOOLEAN                     Del;
1050   UINT8                       *Payload;
1051   UINTN                       PayloadSize;
1052
1053   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1054       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1055     //
1056     // PK, KEK and db/dbx/dbt should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1057     // authenticated variable.
1058     //
1059     return EFI_INVALID_PARAMETER;
1060   }
1061
1062   Del = FALSE;
1063   if ((InCustomMode() && UserPhysicalPresent()) || (mPlatformMode == SETUP_MODE && !IsPk)) {
1064     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1065     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1066     if (PayloadSize == 0) {
1067       Del = TRUE;
1068     }
1069
1070     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
1071     if (EFI_ERROR (Status)) {
1072       return Status;
1073     }
1074
1075     Status = UpdateVariable (
1076                VariableName,
1077                VendorGuid,
1078                Payload,
1079                PayloadSize,
1080                Attributes,
1081                0,
1082                0,
1083                Variable,
1084                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1085                );
1086     if (EFI_ERROR(Status)) {
1087       return Status;
1088     }
1089
1090     if ((mPlatformMode != SETUP_MODE) || IsPk) {
1091       Status = VendorKeyIsModified ();
1092     }
1093   } else if (mPlatformMode == USER_MODE) {
1094     //
1095     // Verify against X509 Cert in PK database.
1096     //
1097     Status = VerifyTimeBasedPayload (
1098                VariableName,
1099                VendorGuid,
1100                Data,
1101                DataSize,
1102                Variable,
1103                Attributes,
1104                AuthVarTypePk,
1105                &Del
1106                );
1107   } else {
1108     //
1109     // Verify against the certificate in data payload.
1110     //
1111     Status = VerifyTimeBasedPayload (
1112                VariableName,
1113                VendorGuid,
1114                Data,
1115                DataSize,
1116                Variable,
1117                Attributes,
1118                AuthVarTypePayload,
1119                &Del
1120                );
1121   }
1122
1123   if (!EFI_ERROR(Status) && IsPk) {
1124     if (mPlatformMode == SETUP_MODE && !Del) {
1125       //
1126       // If enroll PK in setup mode, need change to user mode.
1127       //
1128       Status = UpdatePlatformMode (USER_MODE);
1129     } else if (mPlatformMode == USER_MODE && Del){
1130       //
1131       // If delete PK in user mode, need change to setup mode.
1132       //
1133       Status = UpdatePlatformMode (SETUP_MODE);
1134     }
1135   }
1136
1137   return Status;
1138 }
1139
1140 /**
1141   Process variable with key exchange key for verification.
1142
1143   Caution: This function may receive untrusted input.
1144   This function may be invoked in SMM mode, and datasize and data are external input.
1145   This function will do basic validation, before parse the data.
1146   This function will parse the authentication carefully to avoid security issues, like
1147   buffer overflow, integer overflow.
1148   This function will check attribute carefully to avoid authentication bypass.
1149
1150   @param[in]  VariableName                Name of Variable to be found.
1151   @param[in]  VendorGuid                  Variable vendor GUID.
1152   @param[in]  Data                        Data pointer.
1153   @param[in]  DataSize                    Size of Data found. If size is less than the
1154                                           data, this value contains the required size.
1155   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1156   @param[in]  Attributes                  Attribute value of the variable.
1157
1158   @return EFI_INVALID_PARAMETER           Invalid parameter.
1159   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
1160                                           check carried out by the firmware.
1161   @return EFI_SUCCESS                     Variable pass validation successfully.
1162
1163 **/
1164 EFI_STATUS
1165 ProcessVarWithKek (
1166   IN  CHAR16                               *VariableName,
1167   IN  EFI_GUID                             *VendorGuid,
1168   IN  VOID                                 *Data,
1169   IN  UINTN                                DataSize,
1170   IN  VARIABLE_POINTER_TRACK               *Variable,
1171   IN  UINT32                               Attributes OPTIONAL
1172   )
1173 {
1174   EFI_STATUS                      Status;
1175   UINT8                           *Payload;
1176   UINTN                           PayloadSize;
1177
1178   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1179       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1180     //
1181     // DB, DBX and DBT should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1182     // authenticated variable.
1183     //
1184     return EFI_INVALID_PARAMETER;
1185   }
1186
1187   Status = EFI_SUCCESS;
1188   if (mPlatformMode == USER_MODE && !(InCustomMode() && UserPhysicalPresent())) {
1189     //
1190     // Time-based, verify against X509 Cert KEK.
1191     //
1192     return VerifyTimeBasedPayload (
1193              VariableName,
1194              VendorGuid,
1195              Data,
1196              DataSize,
1197              Variable,
1198              Attributes,
1199              AuthVarTypeKek,
1200              NULL
1201              );
1202   } else {
1203     //
1204     // If in setup mode or custom secure boot mode, no authentication needed.
1205     //
1206     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1207     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1208
1209     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
1210     if (EFI_ERROR (Status)) {
1211       return Status;
1212     }
1213
1214     Status = UpdateVariable (
1215                VariableName,
1216                VendorGuid,
1217                Payload,
1218                PayloadSize,
1219                Attributes,
1220                0,
1221                0,
1222                Variable,
1223                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1224                );
1225     if (EFI_ERROR (Status)) {
1226       return Status;
1227     }
1228
1229     if (mPlatformMode != SETUP_MODE) {
1230       Status = VendorKeyIsModified ();
1231     }
1232   }
1233
1234   return Status;
1235 }
1236
1237 /**
1238   Check if it is to delete auth variable.
1239
1240   @param[in] Data               Data pointer.
1241   @param[in] DataSize           Size of Data.
1242   @param[in] Variable           The variable information which is used to keep track of variable usage.
1243   @param[in] Attributes         Attribute value of the variable.
1244
1245   @retval TRUE                  It is to delete auth variable.
1246   @retval FALSE                 It is not to delete auth variable.
1247
1248 **/
1249 BOOLEAN
1250 IsDeleteAuthVariable (
1251   IN  VOID                      *Data,
1252   IN  UINTN                     DataSize,
1253   IN  VARIABLE_POINTER_TRACK    *Variable,
1254   IN  UINT32                    Attributes
1255   )
1256 {
1257   BOOLEAN                       Del;
1258   UINTN                         PayloadSize;
1259
1260   Del = FALSE;
1261
1262   //
1263   // To delete a variable created with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
1264   // or the EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS attribute,
1265   // SetVariable must be used with attributes matching the existing variable
1266   // and the DataSize set to the size of the AuthInfo descriptor.
1267   //
1268   if ((Variable->CurrPtr != NULL) &&
1269       (Attributes == Variable->CurrPtr->Attributes) &&
1270       ((Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)) {
1271     if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1272       PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1273       if (PayloadSize == 0) {
1274         Del = TRUE;
1275       }
1276     } else {
1277       PayloadSize = DataSize - AUTHINFO_SIZE;
1278       if (PayloadSize == 0) {
1279         Del = TRUE;
1280       }
1281     }
1282   }
1283
1284   return Del;
1285 }
1286
1287 /**
1288   Process variable with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS/EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
1289
1290   Caution: This function may receive untrusted input.
1291   This function may be invoked in SMM mode, and datasize and data are external input.
1292   This function will do basic validation, before parse the data.
1293   This function will parse the authentication carefully to avoid security issues, like
1294   buffer overflow, integer overflow.
1295   This function will check attribute carefully to avoid authentication bypass.
1296
1297   @param[in]  VariableName                Name of Variable to be found.
1298   @param[in]  VendorGuid                  Variable vendor GUID.
1299
1300   @param[in]  Data                        Data pointer.
1301   @param[in]  DataSize                    Size of Data.
1302   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1303   @param[in]  Attributes                  Attribute value of the variable.
1304
1305   @return EFI_INVALID_PARAMETER           Invalid parameter.
1306   @return EFI_WRITE_PROTECTED             Variable is write-protected and needs authentication with
1307                                           EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1308   @return EFI_OUT_OF_RESOURCES            The Database to save the public key is full.
1309   @return EFI_SECURITY_VIOLATION          The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
1310                                           set, but the AuthInfo does NOT pass the validation
1311                                           check carried out by the firmware.
1312   @return EFI_SUCCESS                     Variable is not write-protected or pass validation successfully.
1313
1314 **/
1315 EFI_STATUS
1316 ProcessVariable (
1317   IN     CHAR16                             *VariableName,
1318   IN     EFI_GUID                           *VendorGuid,
1319   IN     VOID                               *Data,
1320   IN     UINTN                              DataSize,
1321   IN     VARIABLE_POINTER_TRACK             *Variable,
1322   IN     UINT32                             Attributes
1323   )
1324 {
1325   EFI_STATUS                      Status;
1326   BOOLEAN                         IsDeletion;
1327   BOOLEAN                         IsFirstTime;
1328   UINT8                           *PubKey;
1329   EFI_VARIABLE_AUTHENTICATION     *CertData;
1330   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
1331   UINT32                          KeyIndex;
1332   UINT64                          MonotonicCount;
1333   VARIABLE_ENTRY_CONSISTENCY      VariableDataEntry;
1334
1335   KeyIndex    = 0;
1336   CertData    = NULL;
1337   CertBlock   = NULL;
1338   PubKey      = NULL;
1339   IsDeletion  = FALSE;
1340   Status      = EFI_SUCCESS;
1341
1342   if (IsDeleteAuthVariable (Data, DataSize, Variable, Attributes) && UserPhysicalPresent()) {
1343     //
1344     // Allow the delete operation of common authenticated variable at user physical presence.
1345     //
1346     if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1347       Status = DeleteCertsFromDb (VariableName, VendorGuid);
1348     }
1349     if (!EFI_ERROR (Status)) {
1350       Status = UpdateVariable (
1351                  VariableName,
1352                  VendorGuid,
1353                  NULL,
1354                  0,
1355                  0,
1356                  0,
1357                  0,
1358                  Variable,
1359                  NULL
1360                  );
1361     }
1362     return Status;
1363   }
1364
1365   if (NeedPhysicallyPresent (VariableName, VendorGuid) && !UserPhysicalPresent()) {
1366     //
1367     // This variable is protected, only physical present user could modify its value.
1368     //
1369     return EFI_SECURITY_VIOLATION;
1370   }
1371
1372   //
1373   // A time-based authenticated variable and a count-based authenticated variable
1374   // can't be updated by each other.
1375   //
1376   if (Variable->CurrPtr != NULL) {
1377     if (((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) &&
1378         ((Variable->CurrPtr->Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0)) {
1379       return EFI_SECURITY_VIOLATION;
1380     }
1381
1382     if (((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) &&
1383         ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0)) {
1384       return EFI_SECURITY_VIOLATION;
1385     }
1386   }
1387
1388   //
1389   // Process Time-based Authenticated variable.
1390   //
1391   if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1392     return VerifyTimeBasedPayload (
1393              VariableName,
1394              VendorGuid,
1395              Data,
1396              DataSize,
1397              Variable,
1398              Attributes,
1399              AuthVarTypePriv,
1400              NULL
1401              );
1402   }
1403
1404   //
1405   // Determine if first time SetVariable with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS.
1406   //
1407   if ((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) {
1408     //
1409     // Determine current operation type.
1410     //
1411     if (DataSize == AUTHINFO_SIZE) {
1412       IsDeletion = TRUE;
1413     }
1414     //
1415     // Determine whether this is the first time with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1416     //
1417     if (Variable->CurrPtr == NULL) {
1418       IsFirstTime = TRUE;
1419     } else if ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) == 0) {
1420       IsFirstTime = TRUE;
1421     } else {
1422       KeyIndex   = Variable->CurrPtr->PubKeyIndex;
1423       IsFirstTime = FALSE;
1424     }
1425   } else if ((Variable->CurrPtr != NULL) &&
1426              ((Variable->CurrPtr->Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)
1427             ) {
1428     //
1429     // If the variable is already write-protected, it always needs authentication before update.
1430     //
1431     return EFI_WRITE_PROTECTED;
1432   } else {
1433     //
1434     // If without EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS, set and attributes collision.
1435     // That means it is not authenticated variable, just update variable as usual.
1436     //
1437     Status = UpdateVariable (VariableName, VendorGuid, Data, DataSize, Attributes, 0, 0, Variable, NULL);
1438     return Status;
1439   }
1440
1441   //
1442   // Get PubKey and check Monotonic Count value corresponding to the variable.
1443   //
1444   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
1445   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
1446   PubKey    = CertBlock->PublicKey;
1447
1448   //
1449   // Update Monotonic Count value.
1450   //
1451   MonotonicCount = CertData->MonotonicCount;
1452
1453   if (!IsFirstTime) {
1454     //
1455     // 2 cases need to check here
1456     //   1. Internal PubKey variable. PubKeyIndex is always 0
1457     //   2. Other counter-based AuthVariable. Check input PubKey.
1458     //
1459     if (KeyIndex == 0 || CompareMem (PubKey, mPubKeyStore + (KeyIndex - 1) * EFI_CERT_TYPE_RSA2048_SIZE, EFI_CERT_TYPE_RSA2048_SIZE) != 0) {
1460       return EFI_SECURITY_VIOLATION;
1461     }
1462     //
1463     // Compare the current monotonic count and ensure that it is greater than the last SetVariable
1464     // operation with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS attribute set.
1465     //
1466     if (CertData->MonotonicCount <= Variable->CurrPtr->MonotonicCount) {
1467       //
1468       // Monotonic count check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
1469       //
1470       return EFI_SECURITY_VIOLATION;
1471     }
1472   }
1473   //
1474   // Verify the certificate in Data payload.
1475   //
1476   Status = VerifyCounterBasedPayload (Data, DataSize, PubKey);
1477   if (EFI_ERROR (Status)) {
1478     return Status;
1479   }
1480
1481   //
1482   // Now, the signature has been verified!
1483   //
1484   if (IsFirstTime && !IsDeletion) {
1485     VariableDataEntry.VariableSize = DataSize - AUTHINFO_SIZE;
1486     VariableDataEntry.Guid         = VendorGuid;
1487     VariableDataEntry.Name         = VariableName;
1488
1489     //
1490     // Update public key database variable if need.
1491     //
1492     KeyIndex = AddPubKeyInStore (PubKey, &VariableDataEntry);
1493     if (KeyIndex == 0) {
1494       return EFI_OUT_OF_RESOURCES;
1495     }
1496   }
1497
1498   //
1499   // Verification pass.
1500   //
1501   return UpdateVariable (VariableName, VendorGuid, (UINT8*)Data + AUTHINFO_SIZE, DataSize - AUTHINFO_SIZE, Attributes, KeyIndex, MonotonicCount, Variable, NULL);
1502 }
1503
1504 /**
1505   Merge two buffers which formatted as EFI_SIGNATURE_LIST. Only the new EFI_SIGNATURE_DATA
1506   will be appended to the original EFI_SIGNATURE_LIST, duplicate EFI_SIGNATURE_DATA
1507   will be ignored.
1508
1509   @param[in, out]  Data              Pointer to original EFI_SIGNATURE_LIST.
1510   @param[in]       DataSize          Size of Data buffer.
1511   @param[in]       FreeBufSize       Size of free data buffer
1512   @param[in]       NewData           Pointer to new EFI_SIGNATURE_LIST to be appended.
1513   @param[in]       NewDataSize       Size of NewData buffer.
1514   @param[out]      MergedBufSize     Size of the merged buffer
1515
1516   @return EFI_BUFFER_TOO_SMALL if input Data buffer overflowed
1517
1518 **/
1519 EFI_STATUS
1520 AppendSignatureList (
1521   IN  OUT VOID            *Data,
1522   IN  UINTN               DataSize,
1523   IN  UINTN               FreeBufSize,
1524   IN  VOID                *NewData,
1525   IN  UINTN               NewDataSize,
1526   OUT UINTN               *MergedBufSize
1527   )
1528 {
1529   EFI_SIGNATURE_LIST  *CertList;
1530   EFI_SIGNATURE_DATA  *Cert;
1531   UINTN               CertCount;
1532   EFI_SIGNATURE_LIST  *NewCertList;
1533   EFI_SIGNATURE_DATA  *NewCert;
1534   UINTN               NewCertCount;
1535   UINTN               Index;
1536   UINTN               Index2;
1537   UINTN               Size;
1538   UINT8               *Tail;
1539   UINTN               CopiedCount;
1540   UINTN               SignatureListSize;
1541   BOOLEAN             IsNewCert;
1542
1543   Tail = (UINT8 *) Data + DataSize;
1544
1545   NewCertList = (EFI_SIGNATURE_LIST *) NewData;
1546   while ((NewDataSize > 0) && (NewDataSize >= NewCertList->SignatureListSize)) {
1547     NewCert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCertList + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1548     NewCertCount = (NewCertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - NewCertList->SignatureHeaderSize) / NewCertList->SignatureSize;
1549
1550     CopiedCount = 0;
1551     for (Index = 0; Index < NewCertCount; Index++) {
1552       IsNewCert = TRUE;
1553
1554       Size = DataSize;
1555       CertList = (EFI_SIGNATURE_LIST *) Data;
1556       while ((Size > 0) && (Size >= CertList->SignatureListSize)) {
1557         if (CompareGuid (&CertList->SignatureType, &NewCertList->SignatureType) &&
1558            (CertList->SignatureSize == NewCertList->SignatureSize)) {
1559           Cert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
1560           CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
1561           for (Index2 = 0; Index2 < CertCount; Index2++) {
1562             //
1563             // Iterate each Signature Data in this Signature List.
1564             //
1565             if (CompareMem (NewCert, Cert, CertList->SignatureSize) == 0) {
1566               IsNewCert = FALSE;
1567               break;
1568             }
1569             Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
1570           }
1571         }
1572
1573         if (!IsNewCert) {
1574           break;
1575         }
1576         Size -= CertList->SignatureListSize;
1577         CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
1578       }
1579
1580       if (IsNewCert) {
1581         //
1582         // New EFI_SIGNATURE_DATA, append it.
1583         //
1584         if (CopiedCount == 0) {
1585           if (FreeBufSize < sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize) {
1586             return EFI_BUFFER_TOO_SMALL;
1587           }
1588
1589           //
1590           // Copy EFI_SIGNATURE_LIST header for only once.
1591           //
1592
1593           CopyMem (Tail, NewCertList, sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1594           Tail = Tail + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1595           FreeBufSize -= sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1596         }
1597
1598         if (FreeBufSize < NewCertList->SignatureSize) {
1599           return EFI_BUFFER_TOO_SMALL;
1600         }
1601         CopyMem (Tail, NewCert, NewCertList->SignatureSize);
1602         Tail += NewCertList->SignatureSize;
1603         FreeBufSize -= NewCertList->SignatureSize;
1604         CopiedCount++;
1605       }
1606
1607       NewCert = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCert + NewCertList->SignatureSize);
1608     }
1609
1610     //
1611     // Update SignatureListSize in newly appended EFI_SIGNATURE_LIST.
1612     //
1613     if (CopiedCount != 0) {
1614       SignatureListSize = sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize + (CopiedCount * NewCertList->SignatureSize);
1615       CertList = (EFI_SIGNATURE_LIST *) (Tail - SignatureListSize);
1616       CertList->SignatureListSize = (UINT32) SignatureListSize;
1617     }
1618
1619     NewDataSize -= NewCertList->SignatureListSize;
1620     NewCertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) NewCertList + NewCertList->SignatureListSize);
1621   }
1622
1623   *MergedBufSize = (Tail - (UINT8 *) Data);
1624   return EFI_SUCCESS;
1625 }
1626
1627 /**
1628   Compare two EFI_TIME data.
1629
1630
1631   @param FirstTime           A pointer to the first EFI_TIME data.
1632   @param SecondTime          A pointer to the second EFI_TIME data.
1633
1634   @retval  TRUE              The FirstTime is not later than the SecondTime.
1635   @retval  FALSE             The FirstTime is later than the SecondTime.
1636
1637 **/
1638 BOOLEAN
1639 CompareTimeStamp (
1640   IN EFI_TIME               *FirstTime,
1641   IN EFI_TIME               *SecondTime
1642   )
1643 {
1644   if (FirstTime->Year != SecondTime->Year) {
1645     return (BOOLEAN) (FirstTime->Year < SecondTime->Year);
1646   } else if (FirstTime->Month != SecondTime->Month) {
1647     return (BOOLEAN) (FirstTime->Month < SecondTime->Month);
1648   } else if (FirstTime->Day != SecondTime->Day) {
1649     return (BOOLEAN) (FirstTime->Day < SecondTime->Day);
1650   } else if (FirstTime->Hour != SecondTime->Hour) {
1651     return (BOOLEAN) (FirstTime->Hour < SecondTime->Hour);
1652   } else if (FirstTime->Minute != SecondTime->Minute) {
1653     return (BOOLEAN) (FirstTime->Minute < SecondTime->Minute);
1654   }
1655
1656   return (BOOLEAN) (FirstTime->Second <= SecondTime->Second);
1657 }
1658
1659 /**
1660   Find matching signer's certificates for common authenticated variable
1661   by corresponding VariableName and VendorGuid from "certdb".
1662
1663   The data format of "certdb":
1664   //
1665   //     UINT32 CertDbListSize;
1666   // /// AUTH_CERT_DB_DATA Certs1[];
1667   // /// AUTH_CERT_DB_DATA Certs2[];
1668   // /// ...
1669   // /// AUTH_CERT_DB_DATA Certsn[];
1670   //
1671
1672   @param[in]  VariableName   Name of authenticated Variable.
1673   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1674   @param[in]  Data           Pointer to variable "certdb".
1675   @param[in]  DataSize       Size of variable "certdb".
1676   @param[out] CertOffset     Offset of matching CertData, from starting of Data.
1677   @param[out] CertDataSize   Length of CertData in bytes.
1678   @param[out] CertNodeOffset Offset of matching AUTH_CERT_DB_DATA , from
1679                              starting of Data.
1680   @param[out] CertNodeSize   Length of AUTH_CERT_DB_DATA in bytes.
1681
1682   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1683   @retval  EFI_NOT_FOUND         Fail to find matching certs.
1684   @retval  EFI_SUCCESS           Find matching certs and output parameters.
1685
1686 **/
1687 EFI_STATUS
1688 FindCertsFromDb (
1689   IN     CHAR16           *VariableName,
1690   IN     EFI_GUID         *VendorGuid,
1691   IN     UINT8            *Data,
1692   IN     UINTN            DataSize,
1693   OUT    UINT32           *CertOffset,    OPTIONAL
1694   OUT    UINT32           *CertDataSize,  OPTIONAL
1695   OUT    UINT32           *CertNodeOffset,OPTIONAL
1696   OUT    UINT32           *CertNodeSize   OPTIONAL
1697   )
1698 {
1699   UINT32                  Offset;
1700   AUTH_CERT_DB_DATA       *Ptr;
1701   UINT32                  CertSize;
1702   UINT32                  NameSize;
1703   UINT32                  NodeSize;
1704   UINT32                  CertDbListSize;
1705
1706   if ((VariableName == NULL) || (VendorGuid == NULL) || (Data == NULL)) {
1707     return EFI_INVALID_PARAMETER;
1708   }
1709
1710   //
1711   // Check whether DataSize matches recorded CertDbListSize.
1712   //
1713   if (DataSize < sizeof (UINT32)) {
1714     return EFI_INVALID_PARAMETER;
1715   }
1716
1717   CertDbListSize = ReadUnaligned32 ((UINT32 *) Data);
1718
1719   if (CertDbListSize != (UINT32) DataSize) {
1720     return EFI_INVALID_PARAMETER;
1721   }
1722
1723   Offset = sizeof (UINT32);
1724
1725   //
1726   // Get corresponding certificates by VendorGuid and VariableName.
1727   //
1728   while (Offset < (UINT32) DataSize) {
1729     Ptr = (AUTH_CERT_DB_DATA *) (Data + Offset);
1730     //
1731     // Check whether VendorGuid matches.
1732     //
1733     if (CompareGuid (&Ptr->VendorGuid, VendorGuid)) {
1734       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1735       NameSize = ReadUnaligned32 (&Ptr->NameSize);
1736       CertSize = ReadUnaligned32 (&Ptr->CertDataSize);
1737
1738       if (NodeSize != sizeof (EFI_GUID) + sizeof (UINT32) * 3 + CertSize +
1739           sizeof (CHAR16) * NameSize) {
1740         return EFI_INVALID_PARAMETER;
1741       }
1742
1743       Offset = Offset + sizeof (EFI_GUID) + sizeof (UINT32) * 3;
1744       //
1745       // Check whether VariableName matches.
1746       //
1747       if ((NameSize == StrLen (VariableName)) &&
1748           (CompareMem (Data + Offset, VariableName, NameSize * sizeof (CHAR16)) == 0)) {
1749         Offset = Offset + NameSize * sizeof (CHAR16);
1750
1751         if (CertOffset != NULL) {
1752           *CertOffset = Offset;
1753         }
1754
1755         if (CertDataSize != NULL) {
1756           *CertDataSize = CertSize;
1757         }
1758
1759         if (CertNodeOffset != NULL) {
1760           *CertNodeOffset = (UINT32) ((UINT8 *) Ptr - Data);
1761         }
1762
1763         if (CertNodeSize != NULL) {
1764           *CertNodeSize = NodeSize;
1765         }
1766
1767         return EFI_SUCCESS;
1768       } else {
1769         Offset = Offset + NameSize * sizeof (CHAR16) + CertSize;
1770       }
1771     } else {
1772       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1773       Offset   = Offset + NodeSize;
1774     }
1775   }
1776
1777   return EFI_NOT_FOUND;
1778 }
1779
1780 /**
1781   Retrieve signer's certificates for common authenticated variable
1782   by corresponding VariableName and VendorGuid from "certdb".
1783
1784   @param[in]  VariableName   Name of authenticated Variable.
1785   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1786   @param[out] CertData       Pointer to signer's certificates.
1787   @param[out] CertDataSize   Length of CertData in bytes.
1788
1789   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1790   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1791   @retval  EFI_SUCCESS           Get signer's certificates successfully.
1792
1793 **/
1794 EFI_STATUS
1795 GetCertsFromDb (
1796   IN     CHAR16           *VariableName,
1797   IN     EFI_GUID         *VendorGuid,
1798   OUT    UINT8            **CertData,
1799   OUT    UINT32           *CertDataSize
1800   )
1801 {
1802   VARIABLE_POINTER_TRACK  CertDbVariable;
1803   EFI_STATUS              Status;
1804   UINT8                   *Data;
1805   UINTN                   DataSize;
1806   UINT32                  CertOffset;
1807
1808   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL) || (CertDataSize == NULL)) {
1809     return EFI_INVALID_PARAMETER;
1810   }
1811
1812   //
1813   // Get variable "certdb".
1814   //
1815   Status = FindVariable (
1816              EFI_CERT_DB_NAME,
1817              &gEfiCertDbGuid,
1818              &CertDbVariable,
1819              &mVariableModuleGlobal->VariableGlobal,
1820              FALSE
1821              );
1822   if (EFI_ERROR (Status)) {
1823     return Status;
1824   }
1825
1826   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1827   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1828   if ((DataSize == 0) || (Data == NULL)) {
1829     ASSERT (FALSE);
1830     return EFI_NOT_FOUND;
1831   }
1832
1833   Status = FindCertsFromDb (
1834              VariableName,
1835              VendorGuid,
1836              Data,
1837              DataSize,
1838              &CertOffset,
1839              CertDataSize,
1840              NULL,
1841              NULL
1842              );
1843
1844   if (EFI_ERROR (Status)) {
1845     return Status;
1846   }
1847
1848   *CertData = Data + CertOffset;
1849   return EFI_SUCCESS;
1850 }
1851
1852 /**
1853   Delete matching signer's certificates when deleting common authenticated
1854   variable by corresponding VariableName and VendorGuid from "certdb".
1855
1856   @param[in]  VariableName   Name of authenticated Variable.
1857   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1858
1859   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1860   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1861   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
1862   @retval  EFI_SUCCESS           The operation is completed successfully.
1863
1864 **/
1865 EFI_STATUS
1866 DeleteCertsFromDb (
1867   IN     CHAR16           *VariableName,
1868   IN     EFI_GUID         *VendorGuid
1869   )
1870 {
1871   VARIABLE_POINTER_TRACK  CertDbVariable;
1872   EFI_STATUS              Status;
1873   UINT8                   *Data;
1874   UINTN                   DataSize;
1875   UINT32                  VarAttr;
1876   UINT32                  CertNodeOffset;
1877   UINT32                  CertNodeSize;
1878   UINT8                   *NewCertDb;
1879   UINT32                  NewCertDbSize;
1880
1881   if ((VariableName == NULL) || (VendorGuid == NULL)) {
1882     return EFI_INVALID_PARAMETER;
1883   }
1884
1885   //
1886   // Get variable "certdb".
1887   //
1888   Status = FindVariable (
1889              EFI_CERT_DB_NAME,
1890              &gEfiCertDbGuid,
1891              &CertDbVariable,
1892              &mVariableModuleGlobal->VariableGlobal,
1893              FALSE
1894              );
1895   if (EFI_ERROR (Status)) {
1896     return Status;
1897   }
1898
1899   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1900   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1901   if ((DataSize == 0) || (Data == NULL)) {
1902     ASSERT (FALSE);
1903     return EFI_NOT_FOUND;
1904   }
1905
1906   if (DataSize == sizeof (UINT32)) {
1907     //
1908     // There is no certs in certdb.
1909     //
1910     return EFI_SUCCESS;
1911   }
1912
1913   //
1914   // Get corresponding cert node from certdb.
1915   //
1916   Status = FindCertsFromDb (
1917              VariableName,
1918              VendorGuid,
1919              Data,
1920              DataSize,
1921              NULL,
1922              NULL,
1923              &CertNodeOffset,
1924              &CertNodeSize
1925              );
1926
1927   if (EFI_ERROR (Status)) {
1928     return Status;
1929   }
1930
1931   if (DataSize < (CertNodeOffset + CertNodeSize)) {
1932     return EFI_NOT_FOUND;
1933   }
1934
1935   //
1936   // Construct new data content of variable "certdb".
1937   //
1938   NewCertDbSize = (UINT32) DataSize - CertNodeSize;
1939   NewCertDb     = (UINT8*) mCertDbStore;
1940
1941   //
1942   // Copy the DB entries before deleting node.
1943   //
1944   CopyMem (NewCertDb, Data, CertNodeOffset);
1945   //
1946   // Update CertDbListSize.
1947   //
1948   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
1949   //
1950   // Copy the DB entries after deleting node.
1951   //
1952   if (DataSize > (CertNodeOffset + CertNodeSize)) {
1953     CopyMem (
1954       NewCertDb + CertNodeOffset,
1955       Data + CertNodeOffset + CertNodeSize,
1956       DataSize - CertNodeOffset - CertNodeSize
1957       );
1958   }
1959
1960   //
1961   // Set "certdb".
1962   //
1963   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
1964   Status   = UpdateVariable (
1965                EFI_CERT_DB_NAME,
1966                &gEfiCertDbGuid,
1967                NewCertDb,
1968                NewCertDbSize,
1969                VarAttr,
1970                0,
1971                0,
1972                &CertDbVariable,
1973                NULL
1974                );
1975
1976   return Status;
1977 }
1978
1979 /**
1980   Insert signer's certificates for common authenticated variable with VariableName
1981   and VendorGuid in AUTH_CERT_DB_DATA to "certdb".
1982
1983   @param[in]  VariableName   Name of authenticated Variable.
1984   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1985   @param[in]  CertData       Pointer to signer's certificates.
1986   @param[in]  CertDataSize   Length of CertData in bytes.
1987
1988   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1989   @retval  EFI_ACCESS_DENIED     An AUTH_CERT_DB_DATA entry with same VariableName
1990                                  and VendorGuid already exists.
1991   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
1992   @retval  EFI_SUCCESS           Insert an AUTH_CERT_DB_DATA entry to "certdb"
1993
1994 **/
1995 EFI_STATUS
1996 InsertCertsToDb (
1997   IN     CHAR16           *VariableName,
1998   IN     EFI_GUID         *VendorGuid,
1999   IN     UINT8            *CertData,
2000   IN     UINTN            CertDataSize
2001   )
2002 {
2003   VARIABLE_POINTER_TRACK  CertDbVariable;
2004   EFI_STATUS              Status;
2005   UINT8                   *Data;
2006   UINTN                   DataSize;
2007   UINT32                  VarAttr;
2008   UINT8                   *NewCertDb;
2009   UINT32                  NewCertDbSize;
2010   UINT32                  CertNodeSize;
2011   UINT32                  NameSize;
2012   AUTH_CERT_DB_DATA       *Ptr;
2013
2014   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL)) {
2015     return EFI_INVALID_PARAMETER;
2016   }
2017
2018   //
2019   // Get variable "certdb".
2020   //
2021   Status = FindVariable (
2022              EFI_CERT_DB_NAME,
2023              &gEfiCertDbGuid,
2024              &CertDbVariable,
2025              &mVariableModuleGlobal->VariableGlobal,
2026              FALSE
2027              );
2028   if (EFI_ERROR (Status)) {
2029     return Status;
2030   }
2031
2032   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
2033   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
2034   if ((DataSize == 0) || (Data == NULL)) {
2035     ASSERT (FALSE);
2036     return EFI_NOT_FOUND;
2037   }
2038
2039   //
2040   // Find whether matching cert node already exists in "certdb".
2041   // If yes return error.
2042   //
2043   Status = FindCertsFromDb (
2044              VariableName,
2045              VendorGuid,
2046              Data,
2047              DataSize,
2048              NULL,
2049              NULL,
2050              NULL,
2051              NULL
2052              );
2053
2054   if (!EFI_ERROR (Status)) {
2055     ASSERT (FALSE);
2056     return EFI_ACCESS_DENIED;
2057   }
2058
2059   //
2060   // Construct new data content of variable "certdb".
2061   //
2062   NameSize      = (UINT32) StrLen (VariableName);
2063   CertNodeSize  = sizeof (AUTH_CERT_DB_DATA) + (UINT32) CertDataSize + NameSize * sizeof (CHAR16);
2064   NewCertDbSize = (UINT32) DataSize + CertNodeSize;
2065   if (NewCertDbSize > mMaxCertDbSize) {
2066     return EFI_OUT_OF_RESOURCES;
2067   }
2068   NewCertDb     = (UINT8*) mCertDbStore;
2069
2070   //
2071   // Copy the DB entries before deleting node.
2072   //
2073   CopyMem (NewCertDb, Data, DataSize);
2074   //
2075   // Update CertDbListSize.
2076   //
2077   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
2078   //
2079   // Construct new cert node.
2080   //
2081   Ptr = (AUTH_CERT_DB_DATA *) (NewCertDb + DataSize);
2082   CopyGuid (&Ptr->VendorGuid, VendorGuid);
2083   CopyMem (&Ptr->CertNodeSize, &CertNodeSize, sizeof (UINT32));
2084   CopyMem (&Ptr->NameSize, &NameSize, sizeof (UINT32));
2085   CopyMem (&Ptr->CertDataSize, &CertDataSize, sizeof (UINT32));
2086
2087   CopyMem (
2088     (UINT8 *) Ptr + sizeof (AUTH_CERT_DB_DATA),
2089     VariableName,
2090     NameSize * sizeof (CHAR16)
2091     );
2092
2093   CopyMem (
2094     (UINT8 *) Ptr +  sizeof (AUTH_CERT_DB_DATA) + NameSize * sizeof (CHAR16),
2095     CertData,
2096     CertDataSize
2097     );
2098
2099   //
2100   // Set "certdb".
2101   //
2102   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
2103   Status   = UpdateVariable (
2104                EFI_CERT_DB_NAME,
2105                &gEfiCertDbGuid,
2106                NewCertDb,
2107                NewCertDbSize,
2108                VarAttr,
2109                0,
2110                0,
2111                &CertDbVariable,
2112                NULL
2113                );
2114
2115   return Status;
2116 }
2117
2118 /**
2119   Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
2120
2121   Caution: This function may receive untrusted input.
2122   This function may be invoked in SMM mode, and datasize and data are external input.
2123   This function will do basic validation, before parse the data.
2124   This function will parse the authentication carefully to avoid security issues, like
2125   buffer overflow, integer overflow.
2126
2127   @param[in]  VariableName                Name of Variable to be found.
2128   @param[in]  VendorGuid                  Variable vendor GUID.
2129   @param[in]  Data                        Data pointer.
2130   @param[in]  DataSize                    Size of Data found. If size is less than the
2131                                           data, this value contains the required size.
2132   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
2133   @param[in]  Attributes                  Attribute value of the variable.
2134   @param[in]  AuthVarType                 Verify against PK, KEK database, private database or certificate in data payload.
2135   @param[out] VarDel                      Delete the variable or not.
2136
2137   @retval EFI_INVALID_PARAMETER           Invalid parameter.
2138   @retval EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
2139                                           check carried out by the firmware.
2140   @retval EFI_OUT_OF_RESOURCES            Failed to process variable due to lack
2141                                           of resources.
2142   @retval EFI_SUCCESS                     Variable pass validation successfully.
2143
2144 **/
2145 EFI_STATUS
2146 VerifyTimeBasedPayload (
2147   IN     CHAR16                             *VariableName,
2148   IN     EFI_GUID                           *VendorGuid,
2149   IN     VOID                               *Data,
2150   IN     UINTN                              DataSize,
2151   IN     VARIABLE_POINTER_TRACK             *Variable,
2152   IN     UINT32                             Attributes,
2153   IN     AUTHVAR_TYPE                       AuthVarType,
2154   OUT    BOOLEAN                            *VarDel
2155   )
2156 {
2157   UINT8                            *RootCert;
2158   UINT8                            *SigData;
2159   UINT8                            *PayloadPtr;
2160   UINTN                            RootCertSize;
2161   UINTN                            Index;
2162   UINTN                            CertCount;
2163   UINTN                            PayloadSize;
2164   UINT32                           Attr;
2165   UINT32                           SigDataSize;
2166   UINT32                           KekDataSize;
2167   BOOLEAN                          VerifyStatus;
2168   EFI_STATUS                       Status;
2169   EFI_SIGNATURE_LIST               *CertList;
2170   EFI_SIGNATURE_DATA               *Cert;
2171   VARIABLE_POINTER_TRACK           KekVariable;
2172   EFI_VARIABLE_AUTHENTICATION_2    *CertData;
2173   UINT8                            *NewData;
2174   UINTN                            NewDataSize;
2175   VARIABLE_POINTER_TRACK           PkVariable;
2176   UINT8                            *Buffer;
2177   UINTN                            Length;
2178   UINT8                            *SignerCerts;
2179   UINTN                            CertStackSize;
2180   UINT8                            *CertsInCertDb;
2181   UINT32                           CertsSizeinDb;
2182
2183   VerifyStatus           = FALSE;
2184   CertData               = NULL;
2185   NewData                = NULL;
2186   Attr                   = Attributes;
2187   SignerCerts            = NULL;
2188   RootCert               = NULL;
2189   CertsInCertDb          = NULL;
2190
2191   //
2192   // When the attribute EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS is
2193   // set, then the Data buffer shall begin with an instance of a complete (and serialized)
2194   // EFI_VARIABLE_AUTHENTICATION_2 descriptor. The descriptor shall be followed by the new
2195   // variable value and DataSize shall reflect the combined size of the descriptor and the new
2196   // variable value. The authentication descriptor is not part of the variable data and is not
2197   // returned by subsequent calls to GetVariable().
2198   //
2199   CertData = (EFI_VARIABLE_AUTHENTICATION_2 *) Data;
2200
2201   //
2202   // Verify that Pad1, Nanosecond, TimeZone, Daylight and Pad2 components of the
2203   // TimeStamp value are set to zero.
2204   //
2205   if ((CertData->TimeStamp.Pad1 != 0) ||
2206       (CertData->TimeStamp.Nanosecond != 0) ||
2207       (CertData->TimeStamp.TimeZone != 0) ||
2208       (CertData->TimeStamp.Daylight != 0) ||
2209       (CertData->TimeStamp.Pad2 != 0)) {
2210     return EFI_SECURITY_VIOLATION;
2211   }
2212
2213   if ((Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
2214     if (CompareTimeStamp (&CertData->TimeStamp, &Variable->CurrPtr->TimeStamp)) {
2215       //
2216       // TimeStamp check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
2217       //
2218       return EFI_SECURITY_VIOLATION;
2219     }
2220   }
2221
2222   //
2223   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
2224   // Cert type should be EFI_CERT_TYPE_PKCS7_GUID.
2225   //
2226   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
2227       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertPkcs7Guid)) {
2228     //
2229     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
2230     //
2231     return EFI_SECURITY_VIOLATION;
2232   }
2233
2234   //
2235   // Find out Pkcs7 SignedData which follows the EFI_VARIABLE_AUTHENTICATION_2 descriptor.
2236   // AuthInfo.Hdr.dwLength is the length of the entire certificate, including the length of the header.
2237   //
2238   SigData = CertData->AuthInfo.CertData;
2239   SigDataSize = CertData->AuthInfo.Hdr.dwLength - (UINT32) (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData));
2240
2241   //
2242   // Find out the new data payload which follows Pkcs7 SignedData directly.
2243   //
2244   PayloadPtr = SigData + SigDataSize;
2245   PayloadSize = DataSize - OFFSET_OF_AUTHINFO2_CERT_DATA - (UINTN) SigDataSize;
2246
2247   //
2248   // Construct a serialization buffer of the values of the VariableName, VendorGuid and Attributes
2249   // parameters of the SetVariable() call and the TimeStamp component of the
2250   // EFI_VARIABLE_AUTHENTICATION_2 descriptor followed by the variable's new value
2251   // i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data)
2252   //
2253   NewDataSize = PayloadSize + sizeof (EFI_TIME) + sizeof (UINT32) +
2254                 sizeof (EFI_GUID) + StrSize (VariableName) - sizeof (CHAR16);
2255   //
2256   // Here is to reuse scratch data area(at the end of volatile variable store)
2257   // to reduce SMRAM consumption for SMM variable driver.
2258   // The scratch buffer is enough to hold the serialized data and safe to use,
2259   // because it will be used at here to do verification only first
2260   // and then used in UpdateVariable() for a time based auth variable set.
2261   //
2262   NewData = (UINT8 *) GetEndPointer ((VARIABLE_STORE_HEADER *) ((UINTN) mVariableModuleGlobal->VariableGlobal.VolatileVariableBase));
2263
2264   Buffer = NewData;
2265   Length = StrLen (VariableName) * sizeof (CHAR16);
2266   CopyMem (Buffer, VariableName, Length);
2267   Buffer += Length;
2268
2269   Length = sizeof (EFI_GUID);
2270   CopyMem (Buffer, VendorGuid, Length);
2271   Buffer += Length;
2272
2273   Length = sizeof (UINT32);
2274   CopyMem (Buffer, &Attr, Length);
2275   Buffer += Length;
2276
2277   Length = sizeof (EFI_TIME);
2278   CopyMem (Buffer, &CertData->TimeStamp, Length);
2279   Buffer += Length;
2280
2281   CopyMem (Buffer, PayloadPtr, PayloadSize);
2282
2283   if (AuthVarType == AuthVarTypePk) {
2284     //
2285     // Verify that the signature has been made with the current Platform Key (no chaining for PK).
2286     // First, get signer's certificates from SignedData.
2287     //
2288     VerifyStatus = Pkcs7GetSigners (
2289                      SigData,
2290                      SigDataSize,
2291                      &SignerCerts,
2292                      &CertStackSize,
2293                      &RootCert,
2294                      &RootCertSize
2295                      );
2296     if (!VerifyStatus) {
2297       goto Exit;
2298     }
2299
2300     //
2301     // Second, get the current platform key from variable. Check whether it's identical with signer's certificates
2302     // in SignedData. If not, return error immediately.
2303     //
2304     Status = FindVariable (
2305                EFI_PLATFORM_KEY_NAME,
2306                &gEfiGlobalVariableGuid,
2307                &PkVariable,
2308                &mVariableModuleGlobal->VariableGlobal,
2309                FALSE
2310                );
2311     if (EFI_ERROR (Status)) {
2312       VerifyStatus = FALSE;
2313       goto Exit;
2314     }
2315     CertList = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (PkVariable.CurrPtr);
2316     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2317     if ((RootCertSize != (CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1))) ||
2318         (CompareMem (Cert->SignatureData, RootCert, RootCertSize) != 0)) {
2319       VerifyStatus = FALSE;
2320       goto Exit;
2321     }
2322
2323     //
2324     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2325     //
2326     VerifyStatus = Pkcs7Verify (
2327                      SigData,
2328                      SigDataSize,
2329                      RootCert,
2330                      RootCertSize,
2331                      NewData,
2332                      NewDataSize
2333                      );
2334
2335   } else if (AuthVarType == AuthVarTypeKek) {
2336
2337     //
2338     // Get KEK database from variable.
2339     //
2340     Status = FindVariable (
2341                EFI_KEY_EXCHANGE_KEY_NAME,
2342                &gEfiGlobalVariableGuid,
2343                &KekVariable,
2344                &mVariableModuleGlobal->VariableGlobal,
2345                FALSE
2346                );
2347     if (EFI_ERROR (Status)) {
2348       return Status;
2349     }
2350
2351     //
2352     // Ready to verify Pkcs7 SignedData. Go through KEK Signature Database to find out X.509 CertList.
2353     //
2354     KekDataSize      = KekVariable.CurrPtr->DataSize;
2355     CertList         = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (KekVariable.CurrPtr);
2356     while ((KekDataSize > 0) && (KekDataSize >= CertList->SignatureListSize)) {
2357       if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {
2358         Cert       = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2359         CertCount  = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
2360         for (Index = 0; Index < CertCount; Index++) {
2361           //
2362           // Iterate each Signature Data Node within this CertList for a verify
2363           //
2364           RootCert      = Cert->SignatureData;
2365           RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2366
2367           //
2368           // Verify Pkcs7 SignedData via Pkcs7Verify library.
2369           //
2370           VerifyStatus = Pkcs7Verify (
2371                            SigData,
2372                            SigDataSize,
2373                            RootCert,
2374                            RootCertSize,
2375                            NewData,
2376                            NewDataSize
2377                            );
2378           if (VerifyStatus) {
2379             goto Exit;
2380           }
2381           Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
2382         }
2383       }
2384       KekDataSize -= CertList->SignatureListSize;
2385       CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
2386     }
2387   } else if (AuthVarType == AuthVarTypePriv) {
2388
2389     //
2390     // Process common authenticated variable except PK/KEK/DB/DBX/DBT.
2391     // Get signer's certificates from SignedData.
2392     //
2393     VerifyStatus = Pkcs7GetSigners (
2394                      SigData,
2395                      SigDataSize,
2396                      &SignerCerts,
2397                      &CertStackSize,
2398                      &RootCert,
2399                      &RootCertSize
2400                      );
2401     if (!VerifyStatus) {
2402       goto Exit;
2403     }
2404
2405     //
2406     // Get previously stored signer's certificates from certdb for existing
2407     // variable. Check whether they are identical with signer's certificates
2408     // in SignedData. If not, return error immediately.
2409     //
2410     if ((Variable->CurrPtr != NULL)) {
2411       VerifyStatus = FALSE;
2412
2413       Status = GetCertsFromDb (VariableName, VendorGuid, &CertsInCertDb, &CertsSizeinDb);
2414       if (EFI_ERROR (Status)) {
2415         goto Exit;
2416       }
2417
2418       if ((CertStackSize != CertsSizeinDb) ||
2419           (CompareMem (SignerCerts, CertsInCertDb, CertsSizeinDb) != 0)) {
2420         goto Exit;
2421       }
2422     }
2423
2424     VerifyStatus = Pkcs7Verify (
2425                      SigData,
2426                      SigDataSize,
2427                      RootCert,
2428                      RootCertSize,
2429                      NewData,
2430                      NewDataSize
2431                      );
2432     if (!VerifyStatus) {
2433       goto Exit;
2434     }
2435
2436     //
2437     // Delete signer's certificates when delete the common authenticated variable.
2438     //
2439     if ((PayloadSize == 0) && (Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
2440       Status = DeleteCertsFromDb (VariableName, VendorGuid);
2441       if (EFI_ERROR (Status)) {
2442         VerifyStatus = FALSE;
2443         goto Exit;
2444       }
2445     } else if (Variable->CurrPtr == NULL && PayloadSize != 0) {
2446       //
2447       // Insert signer's certificates when adding a new common authenticated variable.
2448       //
2449       Status = InsertCertsToDb (VariableName, VendorGuid, SignerCerts, CertStackSize);
2450       if (EFI_ERROR (Status)) {
2451         VerifyStatus = FALSE;
2452         goto Exit;
2453       }
2454     }
2455   } else if (AuthVarType == AuthVarTypePayload) {
2456     CertList = (EFI_SIGNATURE_LIST *) PayloadPtr;
2457     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2458     RootCert      = Cert->SignatureData;
2459     RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2460
2461     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2462     //
2463     VerifyStatus = Pkcs7Verify (
2464                      SigData,
2465                      SigDataSize,
2466                      RootCert,
2467                      RootCertSize,
2468                      NewData,
2469                      NewDataSize
2470                      );
2471   } else {
2472     return EFI_SECURITY_VIOLATION;
2473   }
2474
2475 Exit:
2476
2477   if (AuthVarType == AuthVarTypePk || AuthVarType == AuthVarTypePriv) {
2478     Pkcs7FreeSigners (RootCert);
2479     Pkcs7FreeSigners (SignerCerts);
2480   }
2481
2482   if (!VerifyStatus) {
2483     return EFI_SECURITY_VIOLATION;
2484   }
2485
2486   Status = CheckSignatureListFormat(VariableName, VendorGuid, PayloadPtr, PayloadSize);
2487   if (EFI_ERROR (Status)) {
2488     return Status;
2489   }
2490
2491   if ((PayloadSize == 0) && (VarDel != NULL)) {
2492     *VarDel = TRUE;
2493   }
2494
2495   //
2496   // Final step: Update/Append Variable if it pass Pkcs7Verify
2497   //
2498   return UpdateVariable (
2499            VariableName,
2500            VendorGuid,
2501            PayloadPtr,
2502            PayloadSize,
2503            Attributes,
2504            0,
2505            0,
2506            Variable,
2507            &CertData->TimeStamp
2508            );
2509 }