SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c

   1 /** @file
   2   Implement authentication services for the authenticated variable
   3   service in UEFI2.2.
   4
   5   Caution: This module requires additional review when modified.
   6   This driver will have external input - variable data. It may be input in SMM mode.
   7   This external input must be validated carefully to avoid security issue like
   8   buffer overflow, integer overflow.
   9   Variable attribute should also be checked to avoid authentication bypass.
  10      The whole SMM authentication variable design relies on the integrity of flash part and SMM.
  11   which is assumed to be protected by platform.  All variable code and metadata in flash/SMM Memory
  12   may not be modified without authorization. If platform fails to protect these resources,
  13   the authentication service provided in this driver will be broken, and the behavior is undefined.
  14
  15   ProcessVarWithPk(), ProcessVarWithKek() and ProcessVariable() are the function to do
  16   variable authentication.
  17
  18   VerifyTimeBasedPayload() and VerifyCounterBasedPayload() are sub function to do verification.
  19   They will do basic validation for authentication data structure, then call crypto library
  20   to verify the signature.
  21
  22 Copyright (c) 2009 - 2015, Intel Corporation. All rights reserved.<BR>
  23 This program and the accompanying materials
  24 are licensed and made available under the terms and conditions of the BSD License
  25 which accompanies this distribution.  The full text of the license may be found at
  26 http://opensource.org/licenses/bsd-license.php
  27
  28 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  29 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  30
  31 **/
  32
  33 #include "Variable.h"
  34 #include "AuthService.h"
  35
  36 ///
  37 /// Global database array for scratch
  38 ///
  39 UINT8    *mPubKeyStore;
  40 UINT32   mPubKeyNumber;
  41 UINT32   mMaxKeyNumber;
  42 UINT32   mMaxKeyDbSize;
  43 UINT8    *mCertDbStore;
  44 UINT32   mMaxCertDbSize;
  45 UINT32   mPlatformMode;
  46 UINT8    mVendorKeyState;
  47
  48 EFI_GUID mSignatureSupport[] = {EFI_CERT_SHA1_GUID, EFI_CERT_SHA256_GUID, EFI_CERT_RSA2048_GUID, EFI_CERT_X509_GUID};
  49 //
  50 // Public Exponent of RSA Key.
  51 //
  52 CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };
  53 //
  54 // Hash context pointer
  55 //
  56 VOID  *mHashCtx = NULL;
  57
  58 //
  59 // The serialization of the values of the VariableName, VendorGuid and Attributes
  60 // parameters of the SetVariable() call and the TimeStamp component of the
  61 // EFI_VARIABLE_AUTHENTICATION_2 descriptor followed by the variable's new value
  62 // i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data)
  63 //
  64 UINT8 *mSerializationRuntimeBuffer = NULL;
  65
  66 //
  67 // Requirement for different signature type which have been defined in UEFI spec.
  68 // These data are used to peform SignatureList format check while setting PK/KEK variable.
  69 //
  70 EFI_SIGNATURE_ITEM mSupportSigItem[] = {
  71 //{SigType,                       SigHeaderSize,   SigDataSize  }
  72   {EFI_CERT_SHA256_GUID,          0,               32           },
  73   {EFI_CERT_RSA2048_GUID,         0,               256          },
  74   {EFI_CERT_RSA2048_SHA256_GUID,  0,               256          },
  75   {EFI_CERT_SHA1_GUID,            0,               20           },
  76   {EFI_CERT_RSA2048_SHA1_GUID,    0,               256          },
  77   {EFI_CERT_X509_GUID,            0,               ((UINT32) ~0)},
  78   {EFI_CERT_SHA224_GUID,          0,               28           },
  79   {EFI_CERT_SHA384_GUID,          0,               48           },
  80   {EFI_CERT_SHA512_GUID,          0,               64           },
  81   {EFI_CERT_X509_SHA256_GUID,     0,               48           },
  82   {EFI_CERT_X509_SHA384_GUID,     0,               64           },
  83   {EFI_CERT_X509_SHA512_GUID,     0,               80           }
  84 };
  85
  86 /**
  87   Determine whether this operation needs a physical present user.
  88
  89   @param[in]      VariableName            Name of the Variable.
  90   @param[in]      VendorGuid              GUID of the Variable.
  91
  92   @retval TRUE      This variable is protected, only a physical present user could set this variable.
  93   @retval FALSE     This variable is not protected.
  94
  95 **/
  96 BOOLEAN
  97 NeedPhysicallyPresent(
  98   IN     CHAR16         *VariableName,
  99   IN     EFI_GUID       *VendorGuid
 100   )
 101 {
 102   if ((CompareGuid (VendorGuid, &gEfiSecureBootEnableDisableGuid) && (StrCmp (VariableName, EFI_SECURE_BOOT_ENABLE_NAME) == 0))
 103     || (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (VariableName, EFI_CUSTOM_MODE_NAME) == 0))) {
 104     return TRUE;
 105   }
 106
 107   return FALSE;
 108 }
 109
 110 /**
 111   Determine whether the platform is operating in Custom Secure Boot mode.
 112
 113   @retval TRUE           The platform is operating in Custom mode.
 114   @retval FALSE          The platform is operating in Standard mode.
 115
 116 **/
 117 BOOLEAN
 118 InCustomMode (
 119   VOID
 120   )
 121 {
 122   VARIABLE_POINTER_TRACK  Variable;
 123
 124   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 125   if (Variable.CurrPtr != NULL && *(GetVariableDataPtr (Variable.CurrPtr)) == CUSTOM_SECURE_BOOT_MODE) {
 126     return TRUE;
 127   }
 128
 129   return FALSE;
 130 }
 131
 132 /**
 133   Initializes for authenticated varibale service.
 134
 135   @retval EFI_SUCCESS           Function successfully executed.
 136   @retval EFI_OUT_OF_RESOURCES  Fail to allocate enough memory resources.
 137
 138 **/
 139 EFI_STATUS
 140 AutenticatedVariableServiceInitialize (
 141   VOID
 142   )
 143 {
 144   EFI_STATUS              Status;
 145   VARIABLE_POINTER_TRACK  Variable;
 146   VARIABLE_POINTER_TRACK  PkVariable;
 147   UINT8                   VarValue;
 148   UINT32                  VarAttr;
 149   UINT8                   *Data;
 150   UINTN                   DataSize;
 151   UINTN                   CtxSize;
 152   UINT8                   SecureBootMode;
 153   UINT8                   SecureBootEnable;
 154   UINT8                   CustomMode;
 155   UINT32                  ListSize;
 156
 157   //
 158   // Initialize hash context.
 159   //
 160   CtxSize   = Sha256GetContextSize ();
 161   mHashCtx  = AllocateRuntimePool (CtxSize);
 162   if (mHashCtx == NULL) {
 163     return EFI_OUT_OF_RESOURCES;
 164   }
 165
 166   //
 167   // Reserve runtime buffer for public key database. The size excludes variable header and name size.
 168   //
 169   mMaxKeyDbSize = PcdGet32 (PcdMaxVariableSize) - sizeof (VARIABLE_HEADER) - sizeof (AUTHVAR_KEYDB_NAME);
 170   mMaxKeyNumber = mMaxKeyDbSize / EFI_CERT_TYPE_RSA2048_SIZE;
 171   mPubKeyStore  = AllocateRuntimePool (mMaxKeyDbSize);
 172   if (mPubKeyStore == NULL) {
 173     return EFI_OUT_OF_RESOURCES;
 174   }
 175
 176   //
 177   // Reserve runtime buffer for certificate database. The size excludes variable header and name size.
 178   //
 179   mMaxCertDbSize = PcdGet32 (PcdMaxVariableSize) - sizeof (VARIABLE_HEADER) - sizeof (EFI_CERT_DB_NAME);
 180   mCertDbStore   = AllocateRuntimePool (mMaxCertDbSize);
 181   if (mCertDbStore == NULL) {
 182     return EFI_OUT_OF_RESOURCES;
 183   }
 184
 185   //
 186   // Prepare runtime buffer for serialized data of time-based authenticated
 187   // Variable, i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data).
 188   //
 189   mSerializationRuntimeBuffer = AllocateRuntimePool (PcdGet32 (PcdMaxVariableSize) + sizeof (EFI_GUID) + sizeof (UINT32) + sizeof (EFI_TIME));
 190   if (mSerializationRuntimeBuffer == NULL) {
 191     return EFI_OUT_OF_RESOURCES;
 192   }
 193
 194   //
 195   // Check "AuthVarKeyDatabase" variable's existence.
 196   // If it doesn't exist, create a new one with initial value of 0 and EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
 197   //
 198   Status = FindVariable (
 199              AUTHVAR_KEYDB_NAME,
 200              &gEfiAuthenticatedVariableGuid,
 201              &Variable,
 202              &mVariableModuleGlobal->VariableGlobal,
 203              FALSE
 204              );
 205
 206   if (Variable.CurrPtr == NULL) {
 207     VarAttr       = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 208     VarValue      = 0;
 209     mPubKeyNumber = 0;
 210     Status        = UpdateVariable (
 211                       AUTHVAR_KEYDB_NAME,
 212                       &gEfiAuthenticatedVariableGuid,
 213                       &VarValue,
 214                       sizeof(UINT8),
 215                       VarAttr,
 216                       0,
 217                       0,
 218                       &Variable,
 219                       NULL
 220                       );
 221     if (EFI_ERROR (Status)) {
 222       return Status;
 223     }
 224   } else {
 225     //
 226     // Load database in global variable for cache.
 227     //
 228     DataSize  = DataSizeOfVariable (Variable.CurrPtr);
 229     Data      = GetVariableDataPtr (Variable.CurrPtr);
 230     ASSERT ((DataSize != 0) && (Data != NULL));
 231     //
 232     // "AuthVarKeyDatabase" is an internal variable. Its DataSize is always ensured not to exceed mPubKeyStore buffer size(See definition before)
 233     //  Therefore, there is no memory overflow in underlying CopyMem.
 234     //
 235     CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
 236     mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
 237   }
 238
 239   FindVariable (EFI_PLATFORM_KEY_NAME, &gEfiGlobalVariableGuid, &PkVariable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 240   if (PkVariable.CurrPtr == NULL) {
 241     DEBUG ((EFI_D_INFO, "Variable %s does not exist.\n", EFI_PLATFORM_KEY_NAME));
 242   } else {
 243     DEBUG ((EFI_D_INFO, "Variable %s exists.\n", EFI_PLATFORM_KEY_NAME));
 244   }
 245
 246   //
 247   // Create "SetupMode" variable with BS+RT attribute set.
 248   //
 249   FindVariable (EFI_SETUP_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 250   if (PkVariable.CurrPtr == NULL) {
 251     mPlatformMode = SETUP_MODE;
 252   } else {
 253     mPlatformMode = USER_MODE;
 254   }
 255   Status = UpdateVariable (
 256              EFI_SETUP_MODE_NAME,
 257              &gEfiGlobalVariableGuid,
 258              &mPlatformMode,
 259              sizeof(UINT8),
 260              EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 261              0,
 262              0,
 263              &Variable,
 264              NULL
 265              );
 266   if (EFI_ERROR (Status)) {
 267     return Status;
 268   }
 269
 270   //
 271   // Create "SignatureSupport" variable with BS+RT attribute set.
 272   //
 273   FindVariable (EFI_SIGNATURE_SUPPORT_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 274   Status  = UpdateVariable (
 275               EFI_SIGNATURE_SUPPORT_NAME,
 276               &gEfiGlobalVariableGuid,
 277               mSignatureSupport,
 278               sizeof(mSignatureSupport),
 279               EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 280               0,
 281               0,
 282               &Variable,
 283               NULL
 284               );
 285   if (EFI_ERROR (Status)) {
 286     return Status;
 287   }
 288
 289   //
 290   // If "SecureBootEnable" variable exists, then update "SecureBoot" variable.
 291   // If "SecureBootEnable" variable is SECURE_BOOT_ENABLE and in USER_MODE, Set "SecureBoot" variable to SECURE_BOOT_MODE_ENABLE.
 292   // If "SecureBootEnable" variable is SECURE_BOOT_DISABLE, Set "SecureBoot" variable to SECURE_BOOT_MODE_DISABLE.
 293   //
 294   SecureBootEnable = SECURE_BOOT_DISABLE;
 295   FindVariable (EFI_SECURE_BOOT_ENABLE_NAME, &gEfiSecureBootEnableDisableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 296   if (Variable.CurrPtr != NULL) {
 297     SecureBootEnable = *(GetVariableDataPtr (Variable.CurrPtr));
 298   } else if (mPlatformMode == USER_MODE) {
 299     //
 300     // "SecureBootEnable" not exist, initialize it in USER_MODE.
 301     //
 302     SecureBootEnable = SECURE_BOOT_ENABLE;
 303     Status = UpdateVariable (
 304                EFI_SECURE_BOOT_ENABLE_NAME,
 305                &gEfiSecureBootEnableDisableGuid,
 306                &SecureBootEnable,
 307                sizeof (UINT8),
 308                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 309                0,
 310                0,
 311                &Variable,
 312                NULL
 313                );
 314     if (EFI_ERROR (Status)) {
 315       return Status;
 316     }
 317   }
 318
 319   //
 320   // Create "SecureBoot" variable with BS+RT attribute set.
 321   //
 322   if (SecureBootEnable == SECURE_BOOT_ENABLE && mPlatformMode == USER_MODE) {
 323     SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 324   } else {
 325     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 326   }
 327   FindVariable (EFI_SECURE_BOOT_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 328   Status = UpdateVariable (
 329              EFI_SECURE_BOOT_MODE_NAME,
 330              &gEfiGlobalVariableGuid,
 331              &SecureBootMode,
 332              sizeof (UINT8),
 333              EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 334              0,
 335              0,
 336              &Variable,
 337              NULL
 338              );
 339   if (EFI_ERROR (Status)) {
 340     return Status;
 341   }
 342
 343   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SETUP_MODE_NAME, mPlatformMode));
 344   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_MODE_NAME, SecureBootMode));
 345   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_ENABLE_NAME, SecureBootEnable));
 346
 347   //
 348   // Initialize "CustomMode" in STANDARD_SECURE_BOOT_MODE state.
 349   //
 350   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 351   CustomMode = STANDARD_SECURE_BOOT_MODE;
 352   Status = UpdateVariable (
 353              EFI_CUSTOM_MODE_NAME,
 354              &gEfiCustomModeEnableGuid,
 355              &CustomMode,
 356              sizeof (UINT8),
 357              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 358              0,
 359              0,
 360              &Variable,
 361              NULL
 362              );
 363   if (EFI_ERROR (Status)) {
 364     return Status;
 365   }
 366
 367   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_CUSTOM_MODE_NAME, CustomMode));
 368
 369   //
 370   // Check "certdb" variable's existence.
 371   // If it doesn't exist, then create a new one with
 372   // EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.
 373   //
 374   Status = FindVariable (
 375              EFI_CERT_DB_NAME,
 376              &gEfiCertDbGuid,
 377              &Variable,
 378              &mVariableModuleGlobal->VariableGlobal,
 379              FALSE
 380              );
 381
 382   if (Variable.CurrPtr == NULL) {
 383     VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
 384     ListSize = sizeof (UINT32);
 385     Status   = UpdateVariable (
 386                  EFI_CERT_DB_NAME,
 387                  &gEfiCertDbGuid,
 388                  &ListSize,
 389                  sizeof (UINT32),
 390                  VarAttr,
 391                  0,
 392                  0,
 393                  &Variable,
 394                  NULL
 395                  );
 396     if (EFI_ERROR (Status)) {
 397       return Status;
 398     }
 399   }
 400
 401   //
 402   // Check "VendorKeysNv" variable's existence and create "VendorKeys" variable accordingly.
 403   //
 404   FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 405   if (Variable.CurrPtr != NULL) {
 406     mVendorKeyState = *(GetVariableDataPtr (Variable.CurrPtr));
 407   } else {
 408     //
 409     // "VendorKeysNv" not exist, initialize it in VENDOR_KEYS_VALID state.
 410     //
 411     mVendorKeyState = VENDOR_KEYS_VALID;
 412     Status = UpdateVariable (
 413                EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
 414                &gEfiVendorKeysNvGuid,
 415                &mVendorKeyState,
 416                sizeof (UINT8),
 417                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS,
 418                0,
 419                0,
 420                &Variable,
 421                NULL
 422                );
 423     if (EFI_ERROR (Status)) {
 424       return Status;
 425     }
 426   }
 427
 428   //
 429   // Create "VendorKeys" variable with BS+RT attribute set.
 430   //
 431   FindVariable (EFI_VENDOR_KEYS_VARIABLE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 432   Status = UpdateVariable (
 433              EFI_VENDOR_KEYS_VARIABLE_NAME,
 434              &gEfiGlobalVariableGuid,
 435              &mVendorKeyState,
 436              sizeof (UINT8),
 437              EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 438              0,
 439              0,
 440              &Variable,
 441              NULL
 442              );
 443   if (EFI_ERROR (Status)) {
 444     return Status;
 445   }
 446
 447   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_VENDOR_KEYS_VARIABLE_NAME, mVendorKeyState));
 448
 449   return Status;
 450 }
 451
 452 /**
 453   Add public key in store and return its index.
 454
 455   @param[in]  PubKey                  Input pointer to Public Key data
 456   @param[in]  VariableDataEntry       The variable data entry
 457
 458   @return                             Index of new added item
 459
 460 **/
 461 UINT32
 462 AddPubKeyInStore (
 463   IN  UINT8                        *PubKey,
 464   IN  VARIABLE_ENTRY_CONSISTENCY   *VariableDataEntry
 465   )
 466 {
 467   EFI_STATUS                       Status;
 468   BOOLEAN                          IsFound;
 469   UINT32                           Index;
 470   VARIABLE_POINTER_TRACK           Variable;
 471   UINT8                            *Ptr;
 472   UINT8                            *Data;
 473   UINTN                            DataSize;
 474   VARIABLE_ENTRY_CONSISTENCY       PublicKeyEntry;
 475   UINT32                           Attributes;
 476
 477   if (PubKey == NULL) {
 478     return 0;
 479   }
 480
 481   Status = FindVariable (
 482              AUTHVAR_KEYDB_NAME,
 483              &gEfiAuthenticatedVariableGuid,
 484              &Variable,
 485              &mVariableModuleGlobal->VariableGlobal,
 486              FALSE
 487              );
 488   if (EFI_ERROR (Status)) {
 489     DEBUG ((EFI_D_ERROR, "Get public key database variable failure, Status = %r\n", Status));
 490     return 0;
 491   }
 492
 493   //
 494   // Check whether the public key entry does exist.
 495   //
 496   IsFound = FALSE;
 497   for (Ptr = mPubKeyStore, Index = 1; Index <= mPubKeyNumber; Index++) {
 498     if (CompareMem (Ptr, PubKey, EFI_CERT_TYPE_RSA2048_SIZE) == 0) {
 499       IsFound = TRUE;
 500       break;
 501     }
 502     Ptr += EFI_CERT_TYPE_RSA2048_SIZE;
 503   }
 504
 505   if (!IsFound) {
 506     //
 507     // Add public key in database.
 508     //
 509     if (mPubKeyNumber == mMaxKeyNumber) {
 510       //
 511       // Public key dadatase is full, try to reclaim invalid key.
 512       //
 513       if (AtRuntime ()) {
 514         //
 515         // NV storage can't reclaim at runtime.
 516         //
 517         return 0;
 518       }
 519
 520       Status = Reclaim (
 521                  mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase,
 522                  &mVariableModuleGlobal->NonVolatileLastVariableOffset,
 523                  FALSE,
 524                  NULL,
 525                  NULL,
 526                  0,
 527                  TRUE
 528                  );
 529       if (EFI_ERROR (Status)) {
 530         return 0;
 531       }
 532
 533       Status = FindVariable (
 534                  AUTHVAR_KEYDB_NAME,
 535                  &gEfiAuthenticatedVariableGuid,
 536                  &Variable,
 537                  &mVariableModuleGlobal->VariableGlobal,
 538                  FALSE
 539                  );
 540       if (EFI_ERROR (Status)) {
 541         DEBUG ((EFI_D_ERROR, "Get public key database variable failure, Status = %r\n", Status));
 542         return 0;
 543       }
 544
 545       DataSize  = DataSizeOfVariable (Variable.CurrPtr);
 546       Data      = GetVariableDataPtr (Variable.CurrPtr);
 547       ASSERT ((DataSize != 0) && (Data != NULL));
 548       //
 549       // "AuthVarKeyDatabase" is an internal used variable. Its DataSize is always ensured not to exceed mPubKeyStore buffer size(See definition before)
 550       //  Therefore, there is no memory overflow in underlying CopyMem.
 551       //
 552       CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
 553       mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
 554
 555       if (mPubKeyNumber == mMaxKeyNumber) {
 556         return 0;
 557       }
 558     }
 559
 560     //
 561     // Check the variable space for both public key and variable data.
 562     //
 563     PublicKeyEntry.VariableSize = (mPubKeyNumber + 1) * EFI_CERT_TYPE_RSA2048_SIZE;
 564     PublicKeyEntry.Guid         = &gEfiAuthenticatedVariableGuid;
 565     PublicKeyEntry.Name         = AUTHVAR_KEYDB_NAME;
 566     Attributes = VARIABLE_ATTRIBUTE_NV_BS_RT | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 567
 568     if (!CheckRemainingSpaceForConsistency (Attributes, &PublicKeyEntry, VariableDataEntry, NULL)) {
 569       //
 570       // No enough variable space.
 571       //
 572       return 0;
 573     }
 574
 575     CopyMem (mPubKeyStore + mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 576     Index = ++mPubKeyNumber;
 577     //
 578     // Update public key database variable.
 579     //
 580     Status = UpdateVariable (
 581                AUTHVAR_KEYDB_NAME,
 582                &gEfiAuthenticatedVariableGuid,
 583                mPubKeyStore,
 584                mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE,
 585                Attributes,
 586                0,
 587                0,
 588                &Variable,
 589                NULL
 590                );
 591     if (EFI_ERROR (Status)) {
 592       DEBUG ((EFI_D_ERROR, "Update public key database variable failure, Status = %r\n", Status));
 593       return 0;
 594     }
 595   }
 596
 597   return Index;
 598 }
 599
 600 /**
 601   Verify data payload with AuthInfo in EFI_CERT_TYPE_RSA2048_SHA256_GUID type.
 602   Follow the steps in UEFI2.2.
 603
 604   Caution: This function may receive untrusted input.
 605   This function may be invoked in SMM mode, and datasize and data are external input.
 606   This function will do basic validation, before parse the data.
 607   This function will parse the authentication carefully to avoid security issues, like
 608   buffer overflow, integer overflow.
 609
 610   @param[in]      Data                    Pointer to data with AuthInfo.
 611   @param[in]      DataSize                Size of Data.
 612   @param[in]      PubKey                  Public key used for verification.
 613
 614   @retval EFI_INVALID_PARAMETER       Invalid parameter.
 615   @retval EFI_SECURITY_VIOLATION      If authentication failed.
 616   @retval EFI_SUCCESS                 Authentication successful.
 617
 618 **/
 619 EFI_STATUS
 620 VerifyCounterBasedPayload (
 621   IN     UINT8          *Data,
 622   IN     UINTN          DataSize,
 623   IN     UINT8          *PubKey
 624   )
 625 {
 626   BOOLEAN                         Status;
 627   EFI_VARIABLE_AUTHENTICATION     *CertData;
 628   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
 629   UINT8                           Digest[SHA256_DIGEST_SIZE];
 630   VOID                            *Rsa;
 631   UINTN                           PayloadSize;
 632
 633   PayloadSize = DataSize - AUTHINFO_SIZE;
 634   Rsa         = NULL;
 635   CertData    = NULL;
 636   CertBlock   = NULL;
 637
 638   if (Data == NULL || PubKey == NULL) {
 639     return EFI_INVALID_PARAMETER;
 640   }
 641
 642   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
 643   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
 644
 645   //
 646   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
 647   // Cert type should be EFI_CERT_TYPE_RSA2048_SHA256_GUID.
 648   //
 649   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
 650       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertTypeRsa2048Sha256Guid)
 651         ) {
 652     //
 653     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
 654     //
 655     return EFI_SECURITY_VIOLATION;
 656   }
 657   //
 658   // Hash data payload with SHA256.
 659   //
 660   ZeroMem (Digest, SHA256_DIGEST_SIZE);
 661   Status  = Sha256Init (mHashCtx);
 662   if (!Status) {
 663     goto Done;
 664   }
 665   Status  = Sha256Update (mHashCtx, Data + AUTHINFO_SIZE, PayloadSize);
 666   if (!Status) {
 667     goto Done;
 668   }
 669   //
 670   // Hash Size.
 671   //
 672   Status  = Sha256Update (mHashCtx, &PayloadSize, sizeof (UINTN));
 673   if (!Status) {
 674     goto Done;
 675   }
 676   //
 677   // Hash Monotonic Count.
 678   //
 679   Status  = Sha256Update (mHashCtx, &CertData->MonotonicCount, sizeof (UINT64));
 680   if (!Status) {
 681     goto Done;
 682   }
 683   Status  = Sha256Final (mHashCtx, Digest);
 684   if (!Status) {
 685     goto Done;
 686   }
 687   //
 688   // Generate & Initialize RSA Context.
 689   //
 690   Rsa = RsaNew ();
 691   ASSERT (Rsa != NULL);
 692   //
 693   // Set RSA Key Components.
 694   // NOTE: Only N and E are needed to be set as RSA public key for signature verification.
 695   //
 696   Status = RsaSetKey (Rsa, RsaKeyN, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 697   if (!Status) {
 698     goto Done;
 699   }
 700   Status = RsaSetKey (Rsa, RsaKeyE, mRsaE, sizeof (mRsaE));
 701   if (!Status) {
 702     goto Done;
 703   }
 704   //
 705   // Verify the signature.
 706   //
 707   Status = RsaPkcs1Verify (
 708              Rsa,
 709              Digest,
 710              SHA256_DIGEST_SIZE,
 711              CertBlock->Signature,
 712              EFI_CERT_TYPE_RSA2048_SHA256_SIZE
 713              );
 714
 715 Done:
 716   if (Rsa != NULL) {
 717     RsaFree (Rsa);
 718   }
 719   if (Status) {
 720     return EFI_SUCCESS;
 721   } else {
 722     return EFI_SECURITY_VIOLATION;
 723   }
 724 }
 725
 726 /**
 727   Update platform mode.
 728
 729   @param[in]      Mode                    SETUP_MODE or USER_MODE.
 730
 731   @return EFI_INVALID_PARAMETER           Invalid parameter.
 732   @return EFI_SUCCESS                     Update platform mode successfully.
 733
 734 **/
 735 EFI_STATUS
 736 UpdatePlatformMode (
 737   IN  UINT32                    Mode
 738   )
 739 {
 740   EFI_STATUS              Status;
 741   VARIABLE_POINTER_TRACK  Variable;
 742   UINT8                   SecureBootMode;
 743   UINT8                   SecureBootEnable;
 744   UINTN                   VariableDataSize;
 745
 746   Status = FindVariable (
 747              EFI_SETUP_MODE_NAME,
 748              &gEfiGlobalVariableGuid,
 749              &Variable,
 750              &mVariableModuleGlobal->VariableGlobal,
 751              FALSE
 752              );
 753   if (EFI_ERROR (Status)) {
 754     return Status;
 755   }
 756
 757   //
 758   // Update the value of SetupMode variable by a simple mem copy, this could avoid possible
 759   // variable storage reclaim at runtime.
 760   //
 761   mPlatformMode = (UINT8) Mode;
 762   CopyMem (GetVariableDataPtr (Variable.CurrPtr), &mPlatformMode, sizeof(UINT8));
 763
 764   if (AtRuntime ()) {
 765     //
 766     // SecureBoot Variable indicates whether the platform firmware is operating
 767     // in Secure boot mode (1) or not (0), so we should not change SecureBoot
 768     // Variable in runtime.
 769     //
 770     return Status;
 771   }
 772
 773   //
 774   // Check "SecureBoot" variable's existence.
 775   // If it doesn't exist, firmware has no capability to perform driver signing verification,
 776   // then set "SecureBoot" to 0.
 777   //
 778   Status = FindVariable (
 779              EFI_SECURE_BOOT_MODE_NAME,
 780              &gEfiGlobalVariableGuid,
 781              &Variable,
 782              &mVariableModuleGlobal->VariableGlobal,
 783              FALSE
 784              );
 785   //
 786   // If "SecureBoot" variable exists, then check "SetupMode" variable update.
 787   // If "SetupMode" variable is USER_MODE, "SecureBoot" variable is set to 1.
 788   // If "SetupMode" variable is SETUP_MODE, "SecureBoot" variable is set to 0.
 789   //
 790   if (Variable.CurrPtr == NULL) {
 791     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 792   } else {
 793     if (mPlatformMode == USER_MODE) {
 794       SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 795     } else if (mPlatformMode == SETUP_MODE) {
 796       SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 797     } else {
 798       return EFI_NOT_FOUND;
 799     }
 800   }
 801
 802   Status  = UpdateVariable (
 803               EFI_SECURE_BOOT_MODE_NAME,
 804               &gEfiGlobalVariableGuid,
 805               &SecureBootMode,
 806               sizeof(UINT8),
 807               EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 808               0,
 809               0,
 810               &Variable,
 811               NULL
 812               );
 813   if (EFI_ERROR (Status)) {
 814     return Status;
 815   }
 816
 817   //
 818   // Check "SecureBootEnable" variable's existence. It can enable/disable secure boot feature.
 819   //
 820   Status = FindVariable (
 821              EFI_SECURE_BOOT_ENABLE_NAME,
 822              &gEfiSecureBootEnableDisableGuid,
 823              &Variable,
 824              &mVariableModuleGlobal->VariableGlobal,
 825              FALSE
 826              );
 827
 828   if (SecureBootMode == SECURE_BOOT_MODE_ENABLE) {
 829     //
 830     // Create the "SecureBootEnable" variable as secure boot is enabled.
 831     //
 832     SecureBootEnable = SECURE_BOOT_ENABLE;
 833     VariableDataSize = sizeof (SecureBootEnable);
 834   } else {
 835     //
 836     // Delete the "SecureBootEnable" variable if this variable exist as "SecureBoot"
 837     // variable is not in secure boot state.
 838     //
 839     if (Variable.CurrPtr == NULL || EFI_ERROR (Status)) {
 840       return EFI_SUCCESS;
 841     }
 842     SecureBootEnable = SECURE_BOOT_DISABLE;
 843     VariableDataSize = 0;
 844   }
 845
 846   Status = UpdateVariable (
 847              EFI_SECURE_BOOT_ENABLE_NAME,
 848              &gEfiSecureBootEnableDisableGuid,
 849              &SecureBootEnable,
 850              VariableDataSize,
 851              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 852              0,
 853              0,
 854              &Variable,
 855              NULL
 856              );
 857   return Status;
 858 }
 859
 860 /**
 861   Check input data form to make sure it is a valid EFI_SIGNATURE_LIST for PK/KEK/db/dbx/dbt variable.
 862
 863   @param[in]  VariableName                Name of Variable to be check.
 864   @param[in]  VendorGuid                  Variable vendor GUID.
 865   @param[in]  Data                        Point to the variable data to be checked.
 866   @param[in]  DataSize                    Size of Data.
 867
 868   @return EFI_INVALID_PARAMETER           Invalid signature list format.
 869   @return EFI_SUCCESS                     Passed signature list format check successfully.
 870
 871 **/
 872 EFI_STATUS
 873 CheckSignatureListFormat(
 874   IN  CHAR16                    *VariableName,
 875   IN  EFI_GUID                  *VendorGuid,
 876   IN  VOID                      *Data,
 877   IN  UINTN                     DataSize
 878   )
 879 {
 880   EFI_SIGNATURE_LIST     *SigList;
 881   UINTN                  SigDataSize;
 882   UINT32                 Index;
 883   UINT32                 SigCount;
 884   BOOLEAN                IsPk;
 885   VOID                   *RsaContext;
 886   EFI_SIGNATURE_DATA     *CertData;
 887   UINTN                  CertLen;
 888
 889   if (DataSize == 0) {
 890     return EFI_SUCCESS;
 891   }
 892
 893   ASSERT (VariableName != NULL && VendorGuid != NULL && Data != NULL);
 894
 895   if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_PLATFORM_KEY_NAME) == 0)){
 896     IsPk = TRUE;
 897   } else if ((CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0)) ||
 898              (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&
 899              ((StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0) || (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0) ||
 900               (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0)))) {
 901     IsPk = FALSE;
 902   } else {
 903     return EFI_SUCCESS;
 904   }
 905
 906   SigCount = 0;
 907   SigList  = (EFI_SIGNATURE_LIST *) Data;
 908   SigDataSize  = DataSize;
 909   RsaContext = NULL;
 910
 911   //
 912   // Walk throuth the input signature list and check the data format.
 913   // If any signature is incorrectly formed, the whole check will fail.
 914   //
 915   while ((SigDataSize > 0) && (SigDataSize >= SigList->SignatureListSize)) {
 916     for (Index = 0; Index < (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM)); Index++ ) {
 917       if (CompareGuid (&SigList->SignatureType, &mSupportSigItem[Index].SigType)) {
 918         //
 919         // The value of SignatureSize should always be 16 (size of SignatureOwner
 920         // component) add the data length according to signature type.
 921         //
 922         if (mSupportSigItem[Index].SigDataSize != ((UINT32) ~0) &&
 923           (SigList->SignatureSize - sizeof (EFI_GUID)) != mSupportSigItem[Index].SigDataSize) {
 924           return EFI_INVALID_PARAMETER;
 925         }
 926         if (mSupportSigItem[Index].SigHeaderSize != ((UINTN) ~0) &&
 927           SigList->SignatureHeaderSize != mSupportSigItem[Index].SigHeaderSize) {
 928           return EFI_INVALID_PARAMETER;
 929         }
 930         break;
 931       }
 932     }
 933
 934     if (Index == (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM))) {
 935       //
 936       // Undefined signature type.
 937       //
 938       return EFI_INVALID_PARAMETER;
 939     }
 940
 941     if (CompareGuid (&SigList->SignatureType, &gEfiCertX509Guid)) {
 942       //
 943       // Try to retrieve the RSA public key from the X.509 certificate.
 944       // If this operation fails, it's not a valid certificate.
 945       //
 946       RsaContext = RsaNew ();
 947       if (RsaContext == NULL) {
 948         return EFI_INVALID_PARAMETER;
 949       }
 950       CertData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigList + sizeof (EFI_SIGNATURE_LIST) + SigList->SignatureHeaderSize);
 951       CertLen = SigList->SignatureSize - sizeof (EFI_GUID);
 952       if (!RsaGetPublicKeyFromX509 (CertData->SignatureData, CertLen, &RsaContext)) {
 953         RsaFree (RsaContext);
 954         return EFI_INVALID_PARAMETER;
 955       }
 956       RsaFree (RsaContext);
 957     }
 958
 959     if ((SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) % SigList->SignatureSize != 0) {
 960       return EFI_INVALID_PARAMETER;
 961     }
 962     SigCount += (SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) / SigList->SignatureSize;
 963
 964     SigDataSize -= SigList->SignatureListSize;
 965     SigList = (EFI_SIGNATURE_LIST *) ((UINT8 *) SigList + SigList->SignatureListSize);
 966   }
 967
 968   if (((UINTN) SigList - (UINTN) Data) != DataSize) {
 969     return EFI_INVALID_PARAMETER;
 970   }
 971
 972   if (IsPk && SigCount > 1) {
 973     return EFI_INVALID_PARAMETER;
 974   }
 975
 976   return EFI_SUCCESS;
 977 }
 978
 979 /**
 980   Update "VendorKeys" variable to record the out of band secure boot key modification.
 981
 982   @return EFI_SUCCESS           Variable is updated successfully.
 983   @return Others                Failed to update variable.
 984
 985 **/
 986 EFI_STATUS
 987 VendorKeyIsModified (
 988   VOID
 989   )
 990 {
 991   EFI_STATUS              Status;
 992   VARIABLE_POINTER_TRACK  Variable;
 993
 994   if (mVendorKeyState == VENDOR_KEYS_MODIFIED) {
 995     return EFI_SUCCESS;
 996   }
 997   mVendorKeyState = VENDOR_KEYS_MODIFIED;
 998
 999   FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
1000   Status = UpdateVariable (
1001              EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
1002              &gEfiVendorKeysNvGuid,
1003              &mVendorKeyState,
1004              sizeof (UINT8),
1005              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS,
1006              0,
1007              0,
1008              &Variable,
1009              NULL
1010              );
1011   if (EFI_ERROR (Status)) {
1012     return Status;
1013   }
1014
1015   FindVariable (EFI_VENDOR_KEYS_VARIABLE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
1016   return UpdateVariable (
1017            EFI_VENDOR_KEYS_VARIABLE_NAME,
1018            &gEfiGlobalVariableGuid,
1019            &mVendorKeyState,
1020            sizeof (UINT8),
1021            EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
1022            0,
1023            0,
1024            &Variable,
1025            NULL
1026            );
1027 }
1028
1029 /**
1030   Process variable with platform key for verification.
1031
1032   Caution: This function may receive untrusted input.
1033   This function may be invoked in SMM mode, and datasize and data are external input.
1034   This function will do basic validation, before parse the data.
1035   This function will parse the authentication carefully to avoid security issues, like
1036   buffer overflow, integer overflow.
1037   This function will check attribute carefully to avoid authentication bypass.
1038
1039   @param[in]  VariableName                Name of Variable to be found.
1040   @param[in]  VendorGuid                  Variable vendor GUID.
1041   @param[in]  Data                        Data pointer.
1042   @param[in]  DataSize                    Size of Data found. If size is less than the
1043                                           data, this value contains the required size.
1044   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1045   @param[in]  Attributes                  Attribute value of the variable
1046   @param[in]  IsPk                        Indicate whether it is to process pk.
1047
1048   @return EFI_INVALID_PARAMETER           Invalid parameter.
1049   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation.
1050                                           check carried out by the firmware.
1051   @return EFI_SUCCESS                     Variable passed validation successfully.
1052
1053 **/
1054 EFI_STATUS
1055 ProcessVarWithPk (
1056   IN  CHAR16                    *VariableName,
1057   IN  EFI_GUID                  *VendorGuid,
1058   IN  VOID                      *Data,
1059   IN  UINTN                     DataSize,
1060   IN  VARIABLE_POINTER_TRACK    *Variable,
1061   IN  UINT32                    Attributes OPTIONAL,
1062   IN  BOOLEAN                   IsPk
1063   )
1064 {
1065   EFI_STATUS                  Status;
1066   BOOLEAN                     Del;
1067   UINT8                       *Payload;
1068   UINTN                       PayloadSize;
1069
1070   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1071       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1072     //
1073     // PK, KEK and db/dbx/dbt should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1074     // authenticated variable.
1075     //
1076     return EFI_INVALID_PARAMETER;
1077   }
1078
1079   Del = FALSE;
1080   if ((InCustomMode() && UserPhysicalPresent()) || (mPlatformMode == SETUP_MODE && !IsPk)) {
1081     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1082     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1083     if (PayloadSize == 0) {
1084       Del = TRUE;
1085     }
1086
1087     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
1088     if (EFI_ERROR (Status)) {
1089       return Status;
1090     }
1091
1092     Status = UpdateVariable (
1093                VariableName,
1094                VendorGuid,
1095                Payload,
1096                PayloadSize,
1097                Attributes,
1098                0,
1099                0,
1100                Variable,
1101                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1102                );
1103     if (EFI_ERROR(Status)) {
1104       return Status;
1105     }
1106
1107     if ((mPlatformMode != SETUP_MODE) || IsPk) {
1108       Status = VendorKeyIsModified ();
1109     }
1110   } else if (mPlatformMode == USER_MODE) {
1111     //
1112     // Verify against X509 Cert in PK database.
1113     //
1114     Status = VerifyTimeBasedPayload (
1115                VariableName,
1116                VendorGuid,
1117                Data,
1118                DataSize,
1119                Variable,
1120                Attributes,
1121                AuthVarTypePk,
1122                &Del
1123                );
1124   } else {
1125     //
1126     // Verify against the certificate in data payload.
1127     //
1128     Status = VerifyTimeBasedPayload (
1129                VariableName,
1130                VendorGuid,
1131                Data,
1132                DataSize,
1133                Variable,
1134                Attributes,
1135                AuthVarTypePayload,
1136                &Del
1137                );
1138   }
1139
1140   if (!EFI_ERROR(Status) && IsPk) {
1141     if (mPlatformMode == SETUP_MODE && !Del) {
1142       //
1143       // If enroll PK in setup mode, need change to user mode.
1144       //
1145       Status = UpdatePlatformMode (USER_MODE);
1146     } else if (mPlatformMode == USER_MODE && Del){
1147       //
1148       // If delete PK in user mode, need change to setup mode.
1149       //
1150       Status = UpdatePlatformMode (SETUP_MODE);
1151     }
1152   }
1153
1154   return Status;
1155 }
1156
1157 /**
1158   Process variable with key exchange key for verification.
1159
1160   Caution: This function may receive untrusted input.
1161   This function may be invoked in SMM mode, and datasize and data are external input.
1162   This function will do basic validation, before parse the data.
1163   This function will parse the authentication carefully to avoid security issues, like
1164   buffer overflow, integer overflow.
1165   This function will check attribute carefully to avoid authentication bypass.
1166
1167   @param[in]  VariableName                Name of Variable to be found.
1168   @param[in]  VendorGuid                  Variable vendor GUID.
1169   @param[in]  Data                        Data pointer.
1170   @param[in]  DataSize                    Size of Data found. If size is less than the
1171                                           data, this value contains the required size.
1172   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1173   @param[in]  Attributes                  Attribute value of the variable.
1174
1175   @return EFI_INVALID_PARAMETER           Invalid parameter.
1176   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
1177                                           check carried out by the firmware.
1178   @return EFI_SUCCESS                     Variable pass validation successfully.
1179
1180 **/
1181 EFI_STATUS
1182 ProcessVarWithKek (
1183   IN  CHAR16                               *VariableName,
1184   IN  EFI_GUID                             *VendorGuid,
1185   IN  VOID                                 *Data,
1186   IN  UINTN                                DataSize,
1187   IN  VARIABLE_POINTER_TRACK               *Variable,
1188   IN  UINT32                               Attributes OPTIONAL
1189   )
1190 {
1191   EFI_STATUS                      Status;
1192   UINT8                           *Payload;
1193   UINTN                           PayloadSize;
1194
1195   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1196       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1197     //
1198     // DB, DBX and DBT should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1199     // authenticated variable.
1200     //
1201     return EFI_INVALID_PARAMETER;
1202   }
1203
1204   Status = EFI_SUCCESS;
1205   if (mPlatformMode == USER_MODE && !(InCustomMode() && UserPhysicalPresent())) {
1206     //
1207     // Time-based, verify against X509 Cert KEK.
1208     //
1209     return VerifyTimeBasedPayload (
1210              VariableName,
1211              VendorGuid,
1212              Data,
1213              DataSize,
1214              Variable,
1215              Attributes,
1216              AuthVarTypeKek,
1217              NULL
1218              );
1219   } else {
1220     //
1221     // If in setup mode or custom secure boot mode, no authentication needed.
1222     //
1223     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1224     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1225
1226     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
1227     if (EFI_ERROR (Status)) {
1228       return Status;
1229     }
1230
1231     Status = UpdateVariable (
1232                VariableName,
1233                VendorGuid,
1234                Payload,
1235                PayloadSize,
1236                Attributes,
1237                0,
1238                0,
1239                Variable,
1240                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1241                );
1242     if (EFI_ERROR (Status)) {
1243       return Status;
1244     }
1245
1246     if (mPlatformMode != SETUP_MODE) {
1247       Status = VendorKeyIsModified ();
1248     }
1249   }
1250
1251   return Status;
1252 }
1253
1254 /**
1255   Check if it is to delete auth variable.
1256
1257   @param[in] Data               Data pointer.
1258   @param[in] DataSize           Size of Data.
1259   @param[in] Variable           The variable information which is used to keep track of variable usage.
1260   @param[in] Attributes         Attribute value of the variable.
1261
1262   @retval TRUE                  It is to delete auth variable.
1263   @retval FALSE                 It is not to delete auth variable.
1264
1265 **/
1266 BOOLEAN
1267 IsDeleteAuthVariable (
1268   IN  VOID                      *Data,
1269   IN  UINTN                     DataSize,
1270   IN  VARIABLE_POINTER_TRACK    *Variable,
1271   IN  UINT32                    Attributes
1272   )
1273 {
1274   BOOLEAN                       Del;
1275   UINT8                         *Payload;
1276   UINTN                         PayloadSize;
1277
1278   Del = FALSE;
1279
1280   //
1281   // To delete a variable created with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
1282   // or the EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS attribute,
1283   // SetVariable must be used with attributes matching the existing variable
1284   // and the DataSize set to the size of the AuthInfo descriptor.
1285   //
1286   if ((Variable->CurrPtr != NULL) &&
1287       (Attributes == Variable->CurrPtr->Attributes) &&
1288       ((Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)) {
1289     if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1290       Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1291       PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1292       if (PayloadSize == 0) {
1293         Del = TRUE;
1294       }
1295     } else {
1296       Payload = (UINT8 *) Data + AUTHINFO_SIZE;
1297       PayloadSize = DataSize - AUTHINFO_SIZE;
1298       if (PayloadSize == 0) {
1299         Del = TRUE;
1300       }
1301     }
1302   }
1303
1304   return Del;
1305 }
1306
1307 /**
1308   Process variable with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS/EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
1309
1310   Caution: This function may receive untrusted input.
1311   This function may be invoked in SMM mode, and datasize and data are external input.
1312   This function will do basic validation, before parse the data.
1313   This function will parse the authentication carefully to avoid security issues, like
1314   buffer overflow, integer overflow.
1315   This function will check attribute carefully to avoid authentication bypass.
1316
1317   @param[in]  VariableName                Name of Variable to be found.
1318   @param[in]  VendorGuid                  Variable vendor GUID.
1319
1320   @param[in]  Data                        Data pointer.
1321   @param[in]  DataSize                    Size of Data.
1322   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1323   @param[in]  Attributes                  Attribute value of the variable.
1324
1325   @return EFI_INVALID_PARAMETER           Invalid parameter.
1326   @return EFI_WRITE_PROTECTED             Variable is write-protected and needs authentication with
1327                                           EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1328   @return EFI_OUT_OF_RESOURCES            The Database to save the public key is full.
1329   @return EFI_SECURITY_VIOLATION          The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
1330                                           set, but the AuthInfo does NOT pass the validation
1331                                           check carried out by the firmware.
1332   @return EFI_SUCCESS                     Variable is not write-protected or pass validation successfully.
1333
1334 **/
1335 EFI_STATUS
1336 ProcessVariable (
1337   IN     CHAR16                             *VariableName,
1338   IN     EFI_GUID                           *VendorGuid,
1339   IN     VOID                               *Data,
1340   IN     UINTN                              DataSize,
1341   IN     VARIABLE_POINTER_TRACK             *Variable,
1342   IN     UINT32                             Attributes
1343   )
1344 {
1345   EFI_STATUS                      Status;
1346   BOOLEAN                         IsDeletion;
1347   BOOLEAN                         IsFirstTime;
1348   UINT8                           *PubKey;
1349   EFI_VARIABLE_AUTHENTICATION     *CertData;
1350   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
1351   UINT32                          KeyIndex;
1352   UINT64                          MonotonicCount;
1353   VARIABLE_ENTRY_CONSISTENCY      VariableDataEntry;
1354
1355   KeyIndex    = 0;
1356   CertData    = NULL;
1357   CertBlock   = NULL;
1358   PubKey      = NULL;
1359   IsDeletion  = FALSE;
1360
1361   if (UserPhysicalPresent()) {
1362     //
1363     // Allow the delete operation of common authenticated variable at user physical presence.
1364     //
1365     if (IsDeleteAuthVariable (Data, DataSize, Variable, Attributes)) {
1366       if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1367         Status = DeleteCertsFromDb (VariableName, VendorGuid);
1368       }
1369       if (!EFI_ERROR (Status)) {
1370         Status = UpdateVariable (
1371                    VariableName,
1372                    VendorGuid,
1373                    NULL,
1374                    0,
1375                    0,
1376                    0,
1377                    0,
1378                    Variable,
1379                    NULL
1380                    );
1381       }
1382       return Status;
1383     }
1384   } else {
1385     if (NeedPhysicallyPresent(VariableName, VendorGuid)) {
1386       //
1387       // This variable is protected, only physical present user could modify its value.
1388       //
1389       return EFI_SECURITY_VIOLATION;
1390     }
1391   }
1392
1393   //
1394   // A time-based authenticated variable and a count-based authenticated variable
1395   // can't be updated by each other.
1396   //
1397   if (Variable->CurrPtr != NULL) {
1398     if (((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) &&
1399         ((Variable->CurrPtr->Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0)) {
1400       return EFI_SECURITY_VIOLATION;
1401     }
1402
1403     if (((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) &&
1404         ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0)) {
1405       return EFI_SECURITY_VIOLATION;
1406     }
1407   }
1408
1409   //
1410   // Process Time-based Authenticated variable.
1411   //
1412   if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1413     return VerifyTimeBasedPayload (
1414              VariableName,
1415              VendorGuid,
1416              Data,
1417              DataSize,
1418              Variable,
1419              Attributes,
1420              AuthVarTypePriv,
1421              NULL
1422              );
1423   }
1424
1425   //
1426   // Determine if first time SetVariable with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS.
1427   //
1428   if ((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) {
1429     //
1430     // Determine current operation type.
1431     //
1432     if (DataSize == AUTHINFO_SIZE) {
1433       IsDeletion = TRUE;
1434     }
1435     //
1436     // Determine whether this is the first time with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1437     //
1438     if (Variable->CurrPtr == NULL) {
1439       IsFirstTime = TRUE;
1440     } else if ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) == 0) {
1441       IsFirstTime = TRUE;
1442     } else {
1443       KeyIndex   = Variable->CurrPtr->PubKeyIndex;
1444       IsFirstTime = FALSE;
1445     }
1446   } else if ((Variable->CurrPtr != NULL) &&
1447              ((Variable->CurrPtr->Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)
1448             ) {
1449     //
1450     // If the variable is already write-protected, it always needs authentication before update.
1451     //
1452     return EFI_WRITE_PROTECTED;
1453   } else {
1454     //
1455     // If without EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS, set and attributes collision.
1456     // That means it is not authenticated variable, just update variable as usual.
1457     //
1458     Status = UpdateVariable (VariableName, VendorGuid, Data, DataSize, Attributes, 0, 0, Variable, NULL);
1459     return Status;
1460   }
1461
1462   //
1463   // Get PubKey and check Monotonic Count value corresponding to the variable.
1464   //
1465   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
1466   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
1467   PubKey    = CertBlock->PublicKey;
1468
1469   //
1470   // Update Monotonic Count value.
1471   //
1472   MonotonicCount = CertData->MonotonicCount;
1473
1474   if (!IsFirstTime) {
1475     //
1476     // 2 cases need to check here
1477     //   1. Internal PubKey variable. PubKeyIndex is always 0
1478     //   2. Other counter-based AuthVariable. Check input PubKey.
1479     //
1480     if (KeyIndex == 0 || CompareMem (PubKey, mPubKeyStore + (KeyIndex - 1) * EFI_CERT_TYPE_RSA2048_SIZE, EFI_CERT_TYPE_RSA2048_SIZE) != 0) {
1481       return EFI_SECURITY_VIOLATION;
1482     }
1483     //
1484     // Compare the current monotonic count and ensure that it is greater than the last SetVariable
1485     // operation with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS attribute set.
1486     //
1487     if (CertData->MonotonicCount <= Variable->CurrPtr->MonotonicCount) {
1488       //
1489       // Monotonic count check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
1490       //
1491       return EFI_SECURITY_VIOLATION;
1492     }
1493   }
1494   //
1495   // Verify the certificate in Data payload.
1496   //
1497   Status = VerifyCounterBasedPayload (Data, DataSize, PubKey);
1498   if (EFI_ERROR (Status)) {
1499     return Status;
1500   }
1501
1502   //
1503   // Now, the signature has been verified!
1504   //
1505   if (IsFirstTime && !IsDeletion) {
1506     VariableDataEntry.VariableSize = DataSize - AUTHINFO_SIZE;
1507     VariableDataEntry.Guid         = VendorGuid;
1508     VariableDataEntry.Name         = VariableName;
1509
1510     //
1511     // Update public key database variable if need.
1512     //
1513     KeyIndex = AddPubKeyInStore (PubKey, &VariableDataEntry);
1514     if (KeyIndex == 0) {
1515       return EFI_OUT_OF_RESOURCES;
1516     }
1517   }
1518
1519   //
1520   // Verification pass.
1521   //
1522   return UpdateVariable (VariableName, VendorGuid, (UINT8*)Data + AUTHINFO_SIZE, DataSize - AUTHINFO_SIZE, Attributes, KeyIndex, MonotonicCount, Variable, NULL);
1523 }
1524
1525 /**
1526   Merge two buffers which formatted as EFI_SIGNATURE_LIST. Only the new EFI_SIGNATURE_DATA
1527   will be appended to the original EFI_SIGNATURE_LIST, duplicate EFI_SIGNATURE_DATA
1528   will be ignored.
1529
1530   @param[in, out]  Data              Pointer to original EFI_SIGNATURE_LIST.
1531   @param[in]       DataSize          Size of Data buffer.
1532   @param[in]       FreeBufSize       Size of free data buffer
1533   @param[in]       NewData           Pointer to new EFI_SIGNATURE_LIST to be appended.
1534   @param[in]       NewDataSize       Size of NewData buffer.
1535   @param[out]      MergedBufSize     Size of the merged buffer
1536
1537   @return EFI_BUFFER_TOO_SMALL if input Data buffer overflowed
1538
1539 **/
1540 EFI_STATUS
1541 AppendSignatureList (
1542   IN  OUT VOID            *Data,
1543   IN  UINTN               DataSize,
1544   IN  UINTN               FreeBufSize,
1545   IN  VOID                *NewData,
1546   IN  UINTN               NewDataSize,
1547   OUT UINTN               *MergedBufSize
1548   )
1549 {
1550   EFI_SIGNATURE_LIST  *CertList;
1551   EFI_SIGNATURE_DATA  *Cert;
1552   UINTN               CertCount;
1553   EFI_SIGNATURE_LIST  *NewCertList;
1554   EFI_SIGNATURE_DATA  *NewCert;
1555   UINTN               NewCertCount;
1556   UINTN               Index;
1557   UINTN               Index2;
1558   UINTN               Size;
1559   UINT8               *Tail;
1560   UINTN               CopiedCount;
1561   UINTN               SignatureListSize;
1562   BOOLEAN             IsNewCert;
1563
1564   Tail = (UINT8 *) Data + DataSize;
1565
1566   NewCertList = (EFI_SIGNATURE_LIST *) NewData;
1567   while ((NewDataSize > 0) && (NewDataSize >= NewCertList->SignatureListSize)) {
1568     NewCert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCertList + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1569     NewCertCount = (NewCertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - NewCertList->SignatureHeaderSize) / NewCertList->SignatureSize;
1570
1571     CopiedCount = 0;
1572     for (Index = 0; Index < NewCertCount; Index++) {
1573       IsNewCert = TRUE;
1574
1575       Size = DataSize;
1576       CertList = (EFI_SIGNATURE_LIST *) Data;
1577       while ((Size > 0) && (Size >= CertList->SignatureListSize)) {
1578         if (CompareGuid (&CertList->SignatureType, &NewCertList->SignatureType) &&
1579            (CertList->SignatureSize == NewCertList->SignatureSize)) {
1580           Cert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
1581           CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
1582           for (Index2 = 0; Index2 < CertCount; Index2++) {
1583             //
1584             // Iterate each Signature Data in this Signature List.
1585             //
1586             if (CompareMem (NewCert, Cert, CertList->SignatureSize) == 0) {
1587               IsNewCert = FALSE;
1588               break;
1589             }
1590             Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
1591           }
1592         }
1593
1594         if (!IsNewCert) {
1595           break;
1596         }
1597         Size -= CertList->SignatureListSize;
1598         CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
1599       }
1600
1601       if (IsNewCert) {
1602         //
1603         // New EFI_SIGNATURE_DATA, append it.
1604         //
1605         if (CopiedCount == 0) {
1606           if (FreeBufSize < sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize) {
1607             return EFI_BUFFER_TOO_SMALL;
1608           }
1609
1610           //
1611           // Copy EFI_SIGNATURE_LIST header for only once.
1612           //
1613
1614           CopyMem (Tail, NewCertList, sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1615           Tail = Tail + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1616           FreeBufSize -= sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1617         }
1618
1619         if (FreeBufSize < NewCertList->SignatureSize) {
1620           return EFI_BUFFER_TOO_SMALL;
1621         }
1622         CopyMem (Tail, NewCert, NewCertList->SignatureSize);
1623         Tail += NewCertList->SignatureSize;
1624         FreeBufSize -= NewCertList->SignatureSize;
1625         CopiedCount++;
1626       }
1627
1628       NewCert = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCert + NewCertList->SignatureSize);
1629     }
1630
1631     //
1632     // Update SignatureListSize in newly appended EFI_SIGNATURE_LIST.
1633     //
1634     if (CopiedCount != 0) {
1635       SignatureListSize = sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize + (CopiedCount * NewCertList->SignatureSize);
1636       CertList = (EFI_SIGNATURE_LIST *) (Tail - SignatureListSize);
1637       CertList->SignatureListSize = (UINT32) SignatureListSize;
1638     }
1639
1640     NewDataSize -= NewCertList->SignatureListSize;
1641     NewCertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) NewCertList + NewCertList->SignatureListSize);
1642   }
1643
1644   *MergedBufSize = (Tail - (UINT8 *) Data);
1645   return EFI_SUCCESS;
1646 }
1647
1648 /**
1649   Compare two EFI_TIME data.
1650
1651
1652   @param FirstTime           A pointer to the first EFI_TIME data.
1653   @param SecondTime          A pointer to the second EFI_TIME data.
1654
1655   @retval  TRUE              The FirstTime is not later than the SecondTime.
1656   @retval  FALSE             The FirstTime is later than the SecondTime.
1657
1658 **/
1659 BOOLEAN
1660 CompareTimeStamp (
1661   IN EFI_TIME               *FirstTime,
1662   IN EFI_TIME               *SecondTime
1663   )
1664 {
1665   if (FirstTime->Year != SecondTime->Year) {
1666     return (BOOLEAN) (FirstTime->Year < SecondTime->Year);
1667   } else if (FirstTime->Month != SecondTime->Month) {
1668     return (BOOLEAN) (FirstTime->Month < SecondTime->Month);
1669   } else if (FirstTime->Day != SecondTime->Day) {
1670     return (BOOLEAN) (FirstTime->Day < SecondTime->Day);
1671   } else if (FirstTime->Hour != SecondTime->Hour) {
1672     return (BOOLEAN) (FirstTime->Hour < SecondTime->Hour);
1673   } else if (FirstTime->Minute != SecondTime->Minute) {
1674     return (BOOLEAN) (FirstTime->Minute < SecondTime->Minute);
1675   }
1676
1677   return (BOOLEAN) (FirstTime->Second <= SecondTime->Second);
1678 }
1679
1680 /**
1681   Find matching signer's certificates for common authenticated variable
1682   by corresponding VariableName and VendorGuid from "certdb".
1683
1684   The data format of "certdb":
1685   //
1686   //     UINT32 CertDbListSize;
1687   // /// AUTH_CERT_DB_DATA Certs1[];
1688   // /// AUTH_CERT_DB_DATA Certs2[];
1689   // /// ...
1690   // /// AUTH_CERT_DB_DATA Certsn[];
1691   //
1692
1693   @param[in]  VariableName   Name of authenticated Variable.
1694   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1695   @param[in]  Data           Pointer to variable "certdb".
1696   @param[in]  DataSize       Size of variable "certdb".
1697   @param[out] CertOffset     Offset of matching CertData, from starting of Data.
1698   @param[out] CertDataSize   Length of CertData in bytes.
1699   @param[out] CertNodeOffset Offset of matching AUTH_CERT_DB_DATA , from
1700                              starting of Data.
1701   @param[out] CertNodeSize   Length of AUTH_CERT_DB_DATA in bytes.
1702
1703   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1704   @retval  EFI_NOT_FOUND         Fail to find matching certs.
1705   @retval  EFI_SUCCESS           Find matching certs and output parameters.
1706
1707 **/
1708 EFI_STATUS
1709 FindCertsFromDb (
1710   IN     CHAR16           *VariableName,
1711   IN     EFI_GUID         *VendorGuid,
1712   IN     UINT8            *Data,
1713   IN     UINTN            DataSize,
1714   OUT    UINT32           *CertOffset,    OPTIONAL
1715   OUT    UINT32           *CertDataSize,  OPTIONAL
1716   OUT    UINT32           *CertNodeOffset,OPTIONAL
1717   OUT    UINT32           *CertNodeSize   OPTIONAL
1718   )
1719 {
1720   UINT32                  Offset;
1721   AUTH_CERT_DB_DATA       *Ptr;
1722   UINT32                  CertSize;
1723   UINT32                  NameSize;
1724   UINT32                  NodeSize;
1725   UINT32                  CertDbListSize;
1726
1727   if ((VariableName == NULL) || (VendorGuid == NULL) || (Data == NULL)) {
1728     return EFI_INVALID_PARAMETER;
1729   }
1730
1731   //
1732   // Check whether DataSize matches recorded CertDbListSize.
1733   //
1734   if (DataSize < sizeof (UINT32)) {
1735     return EFI_INVALID_PARAMETER;
1736   }
1737
1738   CertDbListSize = ReadUnaligned32 ((UINT32 *) Data);
1739
1740   if (CertDbListSize != (UINT32) DataSize) {
1741     return EFI_INVALID_PARAMETER;
1742   }
1743
1744   Offset = sizeof (UINT32);
1745
1746   //
1747   // Get corresponding certificates by VendorGuid and VariableName.
1748   //
1749   while (Offset < (UINT32) DataSize) {
1750     Ptr = (AUTH_CERT_DB_DATA *) (Data + Offset);
1751     //
1752     // Check whether VendorGuid matches.
1753     //
1754     if (CompareGuid (&Ptr->VendorGuid, VendorGuid)) {
1755       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1756       NameSize = ReadUnaligned32 (&Ptr->NameSize);
1757       CertSize = ReadUnaligned32 (&Ptr->CertDataSize);
1758
1759       if (NodeSize != sizeof (EFI_GUID) + sizeof (UINT32) * 3 + CertSize +
1760           sizeof (CHAR16) * NameSize) {
1761         return EFI_INVALID_PARAMETER;
1762       }
1763
1764       Offset = Offset + sizeof (EFI_GUID) + sizeof (UINT32) * 3;
1765       //
1766       // Check whether VariableName matches.
1767       //
1768       if ((NameSize == StrLen (VariableName)) &&
1769           (CompareMem (Data + Offset, VariableName, NameSize * sizeof (CHAR16)) == 0)) {
1770         Offset = Offset + NameSize * sizeof (CHAR16);
1771
1772         if (CertOffset != NULL) {
1773           *CertOffset = Offset;
1774         }
1775
1776         if (CertDataSize != NULL) {
1777           *CertDataSize = CertSize;
1778         }
1779
1780         if (CertNodeOffset != NULL) {
1781           *CertNodeOffset = (UINT32) ((UINT8 *) Ptr - Data);
1782         }
1783
1784         if (CertNodeSize != NULL) {
1785           *CertNodeSize = NodeSize;
1786         }
1787
1788         return EFI_SUCCESS;
1789       } else {
1790         Offset = Offset + NameSize * sizeof (CHAR16) + CertSize;
1791       }
1792     } else {
1793       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1794       Offset   = Offset + NodeSize;
1795     }
1796   }
1797
1798   return EFI_NOT_FOUND;
1799 }
1800
1801 /**
1802   Retrieve signer's certificates for common authenticated variable
1803   by corresponding VariableName and VendorGuid from "certdb".
1804
1805   @param[in]  VariableName   Name of authenticated Variable.
1806   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1807   @param[out] CertData       Pointer to signer's certificates.
1808   @param[out] CertDataSize   Length of CertData in bytes.
1809
1810   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1811   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1812   @retval  EFI_SUCCESS           Get signer's certificates successfully.
1813
1814 **/
1815 EFI_STATUS
1816 GetCertsFromDb (
1817   IN     CHAR16           *VariableName,
1818   IN     EFI_GUID         *VendorGuid,
1819   OUT    UINT8            **CertData,
1820   OUT    UINT32           *CertDataSize
1821   )
1822 {
1823   VARIABLE_POINTER_TRACK  CertDbVariable;
1824   EFI_STATUS              Status;
1825   UINT8                   *Data;
1826   UINTN                   DataSize;
1827   UINT32                  CertOffset;
1828
1829   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL) || (CertDataSize == NULL)) {
1830     return EFI_INVALID_PARAMETER;
1831   }
1832
1833   //
1834   // Get variable "certdb".
1835   //
1836   Status = FindVariable (
1837              EFI_CERT_DB_NAME,
1838              &gEfiCertDbGuid,
1839              &CertDbVariable,
1840              &mVariableModuleGlobal->VariableGlobal,
1841              FALSE
1842              );
1843   if (EFI_ERROR (Status)) {
1844     return Status;
1845   }
1846
1847   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1848   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1849   if ((DataSize == 0) || (Data == NULL)) {
1850     ASSERT (FALSE);
1851     return EFI_NOT_FOUND;
1852   }
1853
1854   Status = FindCertsFromDb (
1855              VariableName,
1856              VendorGuid,
1857              Data,
1858              DataSize,
1859              &CertOffset,
1860              CertDataSize,
1861              NULL,
1862              NULL
1863              );
1864
1865   if (EFI_ERROR (Status)) {
1866     return Status;
1867   }
1868
1869   *CertData = Data + CertOffset;
1870   return EFI_SUCCESS;
1871 }
1872
1873 /**
1874   Delete matching signer's certificates when deleting common authenticated
1875   variable by corresponding VariableName and VendorGuid from "certdb".
1876
1877   @param[in]  VariableName   Name of authenticated Variable.
1878   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1879
1880   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1881   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1882   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
1883   @retval  EFI_SUCCESS           The operation is completed successfully.
1884
1885 **/
1886 EFI_STATUS
1887 DeleteCertsFromDb (
1888   IN     CHAR16           *VariableName,
1889   IN     EFI_GUID         *VendorGuid
1890   )
1891 {
1892   VARIABLE_POINTER_TRACK  CertDbVariable;
1893   EFI_STATUS              Status;
1894   UINT8                   *Data;
1895   UINTN                   DataSize;
1896   UINT32                  VarAttr;
1897   UINT32                  CertNodeOffset;
1898   UINT32                  CertNodeSize;
1899   UINT8                   *NewCertDb;
1900   UINT32                  NewCertDbSize;
1901
1902   if ((VariableName == NULL) || (VendorGuid == NULL)) {
1903     return EFI_INVALID_PARAMETER;
1904   }
1905
1906   //
1907   // Get variable "certdb".
1908   //
1909   Status = FindVariable (
1910              EFI_CERT_DB_NAME,
1911              &gEfiCertDbGuid,
1912              &CertDbVariable,
1913              &mVariableModuleGlobal->VariableGlobal,
1914              FALSE
1915              );
1916   if (EFI_ERROR (Status)) {
1917     return Status;
1918   }
1919
1920   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1921   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1922   if ((DataSize == 0) || (Data == NULL)) {
1923     ASSERT (FALSE);
1924     return EFI_NOT_FOUND;
1925   }
1926
1927   if (DataSize == sizeof (UINT32)) {
1928     //
1929     // There is no certs in certdb.
1930     //
1931     return EFI_SUCCESS;
1932   }
1933
1934   //
1935   // Get corresponding cert node from certdb.
1936   //
1937   Status = FindCertsFromDb (
1938              VariableName,
1939              VendorGuid,
1940              Data,
1941              DataSize,
1942              NULL,
1943              NULL,
1944              &CertNodeOffset,
1945              &CertNodeSize
1946              );
1947
1948   if (EFI_ERROR (Status)) {
1949     return Status;
1950   }
1951
1952   if (DataSize < (CertNodeOffset + CertNodeSize)) {
1953     return EFI_NOT_FOUND;
1954   }
1955
1956   //
1957   // Construct new data content of variable "certdb".
1958   //
1959   NewCertDbSize = (UINT32) DataSize - CertNodeSize;
1960   NewCertDb     = (UINT8*) mCertDbStore;
1961
1962   //
1963   // Copy the DB entries before deleting node.
1964   //
1965   CopyMem (NewCertDb, Data, CertNodeOffset);
1966   //
1967   // Update CertDbListSize.
1968   //
1969   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
1970   //
1971   // Copy the DB entries after deleting node.
1972   //
1973   if (DataSize > (CertNodeOffset + CertNodeSize)) {
1974     CopyMem (
1975       NewCertDb + CertNodeOffset,
1976       Data + CertNodeOffset + CertNodeSize,
1977       DataSize - CertNodeOffset - CertNodeSize
1978       );
1979   }
1980
1981   //
1982   // Set "certdb".
1983   //
1984   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
1985   Status   = UpdateVariable (
1986                EFI_CERT_DB_NAME,
1987                &gEfiCertDbGuid,
1988                NewCertDb,
1989                NewCertDbSize,
1990                VarAttr,
1991                0,
1992                0,
1993                &CertDbVariable,
1994                NULL
1995                );
1996
1997   return Status;
1998 }
1999
2000 /**
2001   Insert signer's certificates for common authenticated variable with VariableName
2002   and VendorGuid in AUTH_CERT_DB_DATA to "certdb".
2003
2004   @param[in]  VariableName   Name of authenticated Variable.
2005   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
2006   @param[in]  CertData       Pointer to signer's certificates.
2007   @param[in]  CertDataSize   Length of CertData in bytes.
2008
2009   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
2010   @retval  EFI_ACCESS_DENIED     An AUTH_CERT_DB_DATA entry with same VariableName
2011                                  and VendorGuid already exists.
2012   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
2013   @retval  EFI_SUCCESS           Insert an AUTH_CERT_DB_DATA entry to "certdb"
2014
2015 **/
2016 EFI_STATUS
2017 InsertCertsToDb (
2018   IN     CHAR16           *VariableName,
2019   IN     EFI_GUID         *VendorGuid,
2020   IN     UINT8            *CertData,
2021   IN     UINTN            CertDataSize
2022   )
2023 {
2024   VARIABLE_POINTER_TRACK  CertDbVariable;
2025   EFI_STATUS              Status;
2026   UINT8                   *Data;
2027   UINTN                   DataSize;
2028   UINT32                  VarAttr;
2029   UINT8                   *NewCertDb;
2030   UINT32                  NewCertDbSize;
2031   UINT32                  CertNodeSize;
2032   UINT32                  NameSize;
2033   AUTH_CERT_DB_DATA       *Ptr;
2034
2035   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL)) {
2036     return EFI_INVALID_PARAMETER;
2037   }
2038
2039   //
2040   // Get variable "certdb".
2041   //
2042   Status = FindVariable (
2043              EFI_CERT_DB_NAME,
2044              &gEfiCertDbGuid,
2045              &CertDbVariable,
2046              &mVariableModuleGlobal->VariableGlobal,
2047              FALSE
2048              );
2049   if (EFI_ERROR (Status)) {
2050     return Status;
2051   }
2052
2053   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
2054   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
2055   if ((DataSize == 0) || (Data == NULL)) {
2056     ASSERT (FALSE);
2057     return EFI_NOT_FOUND;
2058   }
2059
2060   //
2061   // Find whether matching cert node already exists in "certdb".
2062   // If yes return error.
2063   //
2064   Status = FindCertsFromDb (
2065              VariableName,
2066              VendorGuid,
2067              Data,
2068              DataSize,
2069              NULL,
2070              NULL,
2071              NULL,
2072              NULL
2073              );
2074
2075   if (!EFI_ERROR (Status)) {
2076     ASSERT (FALSE);
2077     return EFI_ACCESS_DENIED;
2078   }
2079
2080   //
2081   // Construct new data content of variable "certdb".
2082   //
2083   NameSize      = (UINT32) StrLen (VariableName);
2084   CertNodeSize  = sizeof (AUTH_CERT_DB_DATA) + (UINT32) CertDataSize + NameSize * sizeof (CHAR16);
2085   NewCertDbSize = (UINT32) DataSize + CertNodeSize;
2086   if (NewCertDbSize > mMaxCertDbSize) {
2087     return EFI_OUT_OF_RESOURCES;
2088   }
2089   NewCertDb     = (UINT8*) mCertDbStore;
2090
2091   //
2092   // Copy the DB entries before deleting node.
2093   //
2094   CopyMem (NewCertDb, Data, DataSize);
2095   //
2096   // Update CertDbListSize.
2097   //
2098   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
2099   //
2100   // Construct new cert node.
2101   //
2102   Ptr = (AUTH_CERT_DB_DATA *) (NewCertDb + DataSize);
2103   CopyGuid (&Ptr->VendorGuid, VendorGuid);
2104   CopyMem (&Ptr->CertNodeSize, &CertNodeSize, sizeof (UINT32));
2105   CopyMem (&Ptr->NameSize, &NameSize, sizeof (UINT32));
2106   CopyMem (&Ptr->CertDataSize, &CertDataSize, sizeof (UINT32));
2107
2108   CopyMem (
2109     (UINT8 *) Ptr + sizeof (AUTH_CERT_DB_DATA),
2110     VariableName,
2111     NameSize * sizeof (CHAR16)
2112     );
2113
2114   CopyMem (
2115     (UINT8 *) Ptr +  sizeof (AUTH_CERT_DB_DATA) + NameSize * sizeof (CHAR16),
2116     CertData,
2117     CertDataSize
2118     );
2119
2120   //
2121   // Set "certdb".
2122   //
2123   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
2124   Status   = UpdateVariable (
2125                EFI_CERT_DB_NAME,
2126                &gEfiCertDbGuid,
2127                NewCertDb,
2128                NewCertDbSize,
2129                VarAttr,
2130                0,
2131                0,
2132                &CertDbVariable,
2133                NULL
2134                );
2135
2136   return Status;
2137 }
2138
2139 /**
2140   Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
2141
2142   Caution: This function may receive untrusted input.
2143   This function may be invoked in SMM mode, and datasize and data are external input.
2144   This function will do basic validation, before parse the data.
2145   This function will parse the authentication carefully to avoid security issues, like
2146   buffer overflow, integer overflow.
2147
2148   @param[in]  VariableName                Name of Variable to be found.
2149   @param[in]  VendorGuid                  Variable vendor GUID.
2150   @param[in]  Data                        Data pointer.
2151   @param[in]  DataSize                    Size of Data found. If size is less than the
2152                                           data, this value contains the required size.
2153   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
2154   @param[in]  Attributes                  Attribute value of the variable.
2155   @param[in]  AuthVarType                 Verify against PK, KEK database, private database or certificate in data payload.
2156   @param[out] VarDel                      Delete the variable or not.
2157
2158   @retval EFI_INVALID_PARAMETER           Invalid parameter.
2159   @retval EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
2160                                           check carried out by the firmware.
2161   @retval EFI_OUT_OF_RESOURCES            Failed to process variable due to lack
2162                                           of resources.
2163   @retval EFI_SUCCESS                     Variable pass validation successfully.
2164
2165 **/
2166 EFI_STATUS
2167 VerifyTimeBasedPayload (
2168   IN     CHAR16                             *VariableName,
2169   IN     EFI_GUID                           *VendorGuid,
2170   IN     VOID                               *Data,
2171   IN     UINTN                              DataSize,
2172   IN     VARIABLE_POINTER_TRACK             *Variable,
2173   IN     UINT32                             Attributes,
2174   IN     AUTHVAR_TYPE                       AuthVarType,
2175   OUT    BOOLEAN                            *VarDel
2176   )
2177 {
2178   UINT8                            *RootCert;
2179   UINT8                            *SigData;
2180   UINT8                            *PayloadPtr;
2181   UINTN                            RootCertSize;
2182   UINTN                            Index;
2183   UINTN                            CertCount;
2184   UINTN                            PayloadSize;
2185   UINT32                           Attr;
2186   UINT32                           SigDataSize;
2187   UINT32                           KekDataSize;
2188   BOOLEAN                          VerifyStatus;
2189   EFI_STATUS                       Status;
2190   EFI_SIGNATURE_LIST               *CertList;
2191   EFI_SIGNATURE_DATA               *Cert;
2192   VARIABLE_POINTER_TRACK           KekVariable;
2193   EFI_VARIABLE_AUTHENTICATION_2    *CertData;
2194   UINT8                            *NewData;
2195   UINTN                            NewDataSize;
2196   VARIABLE_POINTER_TRACK           PkVariable;
2197   UINT8                            *Buffer;
2198   UINTN                            Length;
2199   UINT8                            *SignerCerts;
2200   UINT8                            *WrapSigData;
2201   UINTN                            CertStackSize;
2202   UINT8                            *CertsInCertDb;
2203   UINT32                           CertsSizeinDb;
2204
2205   VerifyStatus           = FALSE;
2206   CertData               = NULL;
2207   NewData                = NULL;
2208   Attr                   = Attributes;
2209   WrapSigData            = NULL;
2210   SignerCerts            = NULL;
2211   RootCert               = NULL;
2212   CertsInCertDb          = NULL;
2213
2214   //
2215   // When the attribute EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS is
2216   // set, then the Data buffer shall begin with an instance of a complete (and serialized)
2217   // EFI_VARIABLE_AUTHENTICATION_2 descriptor. The descriptor shall be followed by the new
2218   // variable value and DataSize shall reflect the combined size of the descriptor and the new
2219   // variable value. The authentication descriptor is not part of the variable data and is not
2220   // returned by subsequent calls to GetVariable().
2221   //
2222   CertData = (EFI_VARIABLE_AUTHENTICATION_2 *) Data;
2223
2224   //
2225   // Verify that Pad1, Nanosecond, TimeZone, Daylight and Pad2 components of the
2226   // TimeStamp value are set to zero.
2227   //
2228   if ((CertData->TimeStamp.Pad1 != 0) ||
2229       (CertData->TimeStamp.Nanosecond != 0) ||
2230       (CertData->TimeStamp.TimeZone != 0) ||
2231       (CertData->TimeStamp.Daylight != 0) ||
2232       (CertData->TimeStamp.Pad2 != 0)) {
2233     return EFI_SECURITY_VIOLATION;
2234   }
2235
2236   if ((Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
2237     if (CompareTimeStamp (&CertData->TimeStamp, &Variable->CurrPtr->TimeStamp)) {
2238       //
2239       // TimeStamp check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
2240       //
2241       return EFI_SECURITY_VIOLATION;
2242     }
2243   }
2244
2245   //
2246   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
2247   // Cert type should be EFI_CERT_TYPE_PKCS7_GUID.
2248   //
2249   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
2250       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertPkcs7Guid)) {
2251     //
2252     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
2253     //
2254     return EFI_SECURITY_VIOLATION;
2255   }
2256
2257   //
2258   // Find out Pkcs7 SignedData which follows the EFI_VARIABLE_AUTHENTICATION_2 descriptor.
2259   // AuthInfo.Hdr.dwLength is the length of the entire certificate, including the length of the header.
2260   //
2261   SigData = CertData->AuthInfo.CertData;
2262   SigDataSize = CertData->AuthInfo.Hdr.dwLength - (UINT32) (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData));
2263
2264   //
2265   // Find out the new data payload which follows Pkcs7 SignedData directly.
2266   //
2267   PayloadPtr = SigData + SigDataSize;
2268   PayloadSize = DataSize - OFFSET_OF_AUTHINFO2_CERT_DATA - (UINTN) SigDataSize;
2269
2270   //
2271   // Construct a buffer to fill with (VariableName, VendorGuid, Attributes, TimeStamp, Data).
2272   //
2273   NewDataSize = PayloadSize + sizeof (EFI_TIME) + sizeof (UINT32) +
2274                 sizeof (EFI_GUID) + StrSize (VariableName) - sizeof (CHAR16);
2275   NewData = mSerializationRuntimeBuffer;
2276
2277   Buffer = NewData;
2278   Length = StrLen (VariableName) * sizeof (CHAR16);
2279   CopyMem (Buffer, VariableName, Length);
2280   Buffer += Length;
2281
2282   Length = sizeof (EFI_GUID);
2283   CopyMem (Buffer, VendorGuid, Length);
2284   Buffer += Length;
2285
2286   Length = sizeof (UINT32);
2287   CopyMem (Buffer, &Attr, Length);
2288   Buffer += Length;
2289
2290   Length = sizeof (EFI_TIME);
2291   CopyMem (Buffer, &CertData->TimeStamp, Length);
2292   Buffer += Length;
2293
2294   CopyMem (Buffer, PayloadPtr, PayloadSize);
2295
2296   if (AuthVarType == AuthVarTypePk) {
2297     //
2298     // Verify that the signature has been made with the current Platform Key (no chaining for PK).
2299     // First, get signer's certificates from SignedData.
2300     //
2301     VerifyStatus = Pkcs7GetSigners (
2302                      SigData,
2303                      SigDataSize,
2304                      &SignerCerts,
2305                      &CertStackSize,
2306                      &RootCert,
2307                      &RootCertSize
2308                      );
2309     if (!VerifyStatus) {
2310       goto Exit;
2311     }
2312
2313     //
2314     // Second, get the current platform key from variable. Check whether it's identical with signer's certificates
2315     // in SignedData. If not, return error immediately.
2316     //
2317     Status = FindVariable (
2318                EFI_PLATFORM_KEY_NAME,
2319                &gEfiGlobalVariableGuid,
2320                &PkVariable,
2321                &mVariableModuleGlobal->VariableGlobal,
2322                FALSE
2323                );
2324     if (EFI_ERROR (Status)) {
2325       VerifyStatus = FALSE;
2326       goto Exit;
2327     }
2328     CertList = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (PkVariable.CurrPtr);
2329     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2330     if ((RootCertSize != (CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1))) ||
2331         (CompareMem (Cert->SignatureData, RootCert, RootCertSize) != 0)) {
2332       VerifyStatus = FALSE;
2333       goto Exit;
2334     }
2335
2336     //
2337     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2338     //
2339     VerifyStatus = Pkcs7Verify (
2340                      SigData,
2341                      SigDataSize,
2342                      RootCert,
2343                      RootCertSize,
2344                      NewData,
2345                      NewDataSize
2346                      );
2347
2348   } else if (AuthVarType == AuthVarTypeKek) {
2349
2350     //
2351     // Get KEK database from variable.
2352     //
2353     Status = FindVariable (
2354                EFI_KEY_EXCHANGE_KEY_NAME,
2355                &gEfiGlobalVariableGuid,
2356                &KekVariable,
2357                &mVariableModuleGlobal->VariableGlobal,
2358                FALSE
2359                );
2360     if (EFI_ERROR (Status)) {
2361       return Status;
2362     }
2363
2364     //
2365     // Ready to verify Pkcs7 SignedData. Go through KEK Signature Database to find out X.509 CertList.
2366     //
2367     KekDataSize      = KekVariable.CurrPtr->DataSize;
2368     CertList         = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (KekVariable.CurrPtr);
2369     while ((KekDataSize > 0) && (KekDataSize >= CertList->SignatureListSize)) {
2370       if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {
2371         Cert       = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2372         CertCount  = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
2373         for (Index = 0; Index < CertCount; Index++) {
2374           //
2375           // Iterate each Signature Data Node within this CertList for a verify
2376           //
2377           RootCert      = Cert->SignatureData;
2378           RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2379
2380           //
2381           // Verify Pkcs7 SignedData via Pkcs7Verify library.
2382           //
2383           VerifyStatus = Pkcs7Verify (
2384                            SigData,
2385                            SigDataSize,
2386                            RootCert,
2387                            RootCertSize,
2388                            NewData,
2389                            NewDataSize
2390                            );
2391           if (VerifyStatus) {
2392             goto Exit;
2393           }
2394           Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
2395         }
2396       }
2397       KekDataSize -= CertList->SignatureListSize;
2398       CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
2399     }
2400   } else if (AuthVarType == AuthVarTypePriv) {
2401
2402     //
2403     // Process common authenticated variable except PK/KEK/DB/DBX/DBT.
2404     // Get signer's certificates from SignedData.
2405     //
2406     VerifyStatus = Pkcs7GetSigners (
2407                      SigData,
2408                      SigDataSize,
2409                      &SignerCerts,
2410                      &CertStackSize,
2411                      &RootCert,
2412                      &RootCertSize
2413                      );
2414     if (!VerifyStatus) {
2415       goto Exit;
2416     }
2417
2418     //
2419     // Get previously stored signer's certificates from certdb for existing
2420     // variable. Check whether they are identical with signer's certificates
2421     // in SignedData. If not, return error immediately.
2422     //
2423     if ((Variable->CurrPtr != NULL)) {
2424       VerifyStatus = FALSE;
2425
2426       Status = GetCertsFromDb (VariableName, VendorGuid, &CertsInCertDb, &CertsSizeinDb);
2427       if (EFI_ERROR (Status)) {
2428         goto Exit;
2429       }
2430
2431       if ((CertStackSize != CertsSizeinDb) ||
2432           (CompareMem (SignerCerts, CertsInCertDb, CertsSizeinDb) != 0)) {
2433         goto Exit;
2434       }
2435     }
2436
2437     VerifyStatus = Pkcs7Verify (
2438                      SigData,
2439                      SigDataSize,
2440                      RootCert,
2441                      RootCertSize,
2442                      NewData,
2443                      NewDataSize
2444                      );
2445     if (!VerifyStatus) {
2446       goto Exit;
2447     }
2448
2449     //
2450     // Delete signer's certificates when delete the common authenticated variable.
2451     //
2452     if ((PayloadSize == 0) && (Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
2453       Status = DeleteCertsFromDb (VariableName, VendorGuid);
2454       if (EFI_ERROR (Status)) {
2455         VerifyStatus = FALSE;
2456         goto Exit;
2457       }
2458     } else if (Variable->CurrPtr == NULL && PayloadSize != 0) {
2459       //
2460       // Insert signer's certificates when adding a new common authenticated variable.
2461       //
2462       Status = InsertCertsToDb (VariableName, VendorGuid, SignerCerts, CertStackSize);
2463       if (EFI_ERROR (Status)) {
2464         VerifyStatus = FALSE;
2465         goto Exit;
2466       }
2467     }
2468   } else if (AuthVarType == AuthVarTypePayload) {
2469     CertList = (EFI_SIGNATURE_LIST *) PayloadPtr;
2470     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2471     RootCert      = Cert->SignatureData;
2472     RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2473
2474     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2475     //
2476     VerifyStatus = Pkcs7Verify (
2477                      SigData,
2478                      SigDataSize,
2479                      RootCert,
2480                      RootCertSize,
2481                      NewData,
2482                      NewDataSize
2483                      );
2484   } else {
2485     return EFI_SECURITY_VIOLATION;
2486   }
2487
2488 Exit:
2489
2490   if (AuthVarType == AuthVarTypePk || AuthVarType == AuthVarTypePriv) {
2491     Pkcs7FreeSigners (RootCert);
2492     Pkcs7FreeSigners (SignerCerts);
2493   }
2494
2495   if (!VerifyStatus) {
2496     return EFI_SECURITY_VIOLATION;
2497   }
2498
2499   Status = CheckSignatureListFormat(VariableName, VendorGuid, PayloadPtr, PayloadSize);
2500   if (EFI_ERROR (Status)) {
2501     return Status;
2502   }
2503
2504   if ((PayloadSize == 0) && (VarDel != NULL)) {
2505     *VarDel = TRUE;
2506   }
2507
2508   //
2509   // Final step: Update/Append Variable if it pass Pkcs7Verify
2510   //
2511   return UpdateVariable (
2512            VariableName,
2513            VendorGuid,
2514            PayloadPtr,
2515            PayloadSize,
2516            Attributes,
2517            0,
2518            0,
2519            Variable,
2520            &CertData->TimeStamp
2521            );
2522 }