SecurityPkg/VariableAuthenticated/RuntimeDxe/AuthService.c

   1 /** @file
   2   Implement authentication services for the authenticated variable
   3   service in UEFI2.2.
   4
   5   Caution: This module requires additional review when modified.
   6   This driver will have external input - variable data. It may be input in SMM mode.
   7   This external input must be validated carefully to avoid security issue like
   8   buffer overflow, integer overflow.
   9   Variable attribute should also be checked to avoid authentication bypass.
  10
  11   ProcessVarWithPk(), ProcessVarWithKek() and ProcessVariable() are the function to do
  12   variable authentication.
  13
  14   VerifyTimeBasedPayload() and VerifyCounterBasedPayload() are sub function to do verification.
  15   They will do basic validation for authentication data structure, then call crypto library
  16   to verify the signature.
  17
  18 Copyright (c) 2009 - 2013, Intel Corporation. All rights reserved.<BR>
  19 This program and the accompanying materials
  20 are licensed and made available under the terms and conditions of the BSD License
  21 which accompanies this distribution.  The full text of the license may be found at
  22 http://opensource.org/licenses/bsd-license.php
  23
  24 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
  25 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
  26
  27 **/
  28
  29 #include "Variable.h"
  30 #include "AuthService.h"
  31
  32 ///
  33 /// Global database array for scratch
  34 ///
  35 UINT8    mPubKeyStore[MAX_KEYDB_SIZE];
  36 UINT32   mPubKeyNumber;
  37 UINT8    mCertDbStore[MAX_CERTDB_SIZE];
  38 UINT32   mPlatformMode;
  39 UINT8    mVendorKeyState;
  40
  41 EFI_GUID mSignatureSupport[] = {EFI_CERT_SHA1_GUID, EFI_CERT_SHA256_GUID, EFI_CERT_RSA2048_GUID, EFI_CERT_X509_GUID};
  42 //
  43 // Public Exponent of RSA Key.
  44 //
  45 CONST UINT8 mRsaE[] = { 0x01, 0x00, 0x01 };
  46 //
  47 // Hash context pointer
  48 //
  49 VOID  *mHashCtx = NULL;
  50
  51 //
  52 // Pointer to runtime buffer.
  53 // For "Append" operation to an existing variable, a read/modify/write operation
  54 // is supported by firmware internally. Reserve runtime buffer to cache previous
  55 // variable data in runtime phase because memory allocation is forbidden in virtual mode.
  56 //
  57 VOID  *mStorageArea = NULL;
  58
  59 //
  60 // The serialization of the values of the VariableName, VendorGuid and Attributes
  61 // parameters of the SetVariable() call and the TimeStamp component of the
  62 // EFI_VARIABLE_AUTHENTICATION_2 descriptor followed by the variable's new value
  63 // i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data)
  64 //
  65 UINT8 *mSerializationRuntimeBuffer = NULL;
  66
  67 //
  68 // Requirement for different signature type which have been defined in UEFI spec.
  69 // These data are used to peform SignatureList format check while setting PK/KEK variable.
  70 //
  71 EFI_SIGNATURE_ITEM mSupportSigItem[] = {
  72 //{SigType,                       SigHeaderSize,   SigDataSize  }
  73   {EFI_CERT_SHA256_GUID,          0,               32           },
  74   {EFI_CERT_RSA2048_GUID,         0,               256          },
  75   {EFI_CERT_RSA2048_SHA256_GUID,  0,               256          },
  76   {EFI_CERT_SHA1_GUID,            0,               20           },
  77   {EFI_CERT_RSA2048_SHA1_GUID,    0,               256          },
  78   {EFI_CERT_X509_GUID,            0,               ((UINT32) ~0)},
  79   {EFI_CERT_SHA224_GUID,          0,               28           },
  80   {EFI_CERT_SHA384_GUID,          0,               48           },
  81   {EFI_CERT_SHA512_GUID,          0,               64           }
  82 };
  83
  84 /**
  85   Determine whether this operation needs a physical present user.
  86
  87   @param[in]      VariableName            Name of the Variable.
  88   @param[in]      VendorGuid              GUID of the Variable.
  89
  90   @retval TRUE      This variable is protected, only a physical present user could set this variable.
  91   @retval FALSE     This variable is not protected.
  92
  93 **/
  94 BOOLEAN
  95 NeedPhysicallyPresent(
  96   IN     CHAR16         *VariableName,
  97   IN     EFI_GUID       *VendorGuid
  98   )
  99 {
 100   if ((CompareGuid (VendorGuid, &gEfiSecureBootEnableDisableGuid) && (StrCmp (VariableName, EFI_SECURE_BOOT_ENABLE_NAME) == 0))
 101     || (CompareGuid (VendorGuid, &gEfiCustomModeEnableGuid) && (StrCmp (VariableName, EFI_CUSTOM_MODE_NAME) == 0))) {
 102     return TRUE;
 103   }
 104
 105   return FALSE;
 106 }
 107
 108 /**
 109   Determine whether the platform is operating in Custom Secure Boot mode.
 110
 111   @retval TRUE           The platform is operating in Custom mode.
 112   @retval FALSE          The platform is operating in Standard mode.
 113
 114 **/
 115 BOOLEAN
 116 InCustomMode (
 117   VOID
 118   )
 119 {
 120   VARIABLE_POINTER_TRACK  Variable;
 121
 122   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 123   if (Variable.CurrPtr != NULL && *(GetVariableDataPtr (Variable.CurrPtr)) == CUSTOM_SECURE_BOOT_MODE) {
 124     return TRUE;
 125   }
 126
 127   return FALSE;
 128 }
 129
 130
 131 /**
 132   Internal function to delete a Variable given its name and GUID, no authentication
 133   required.
 134
 135   @param[in]      VariableName            Name of the Variable.
 136   @param[in]      VendorGuid              GUID of the Variable.
 137
 138   @retval EFI_SUCCESS              Variable deleted successfully.
 139   @retval Others                   The driver failded to start the device.
 140
 141 **/
 142 EFI_STATUS
 143 DeleteVariable (
 144   IN  CHAR16                    *VariableName,
 145   IN  EFI_GUID                  *VendorGuid
 146   )
 147 {
 148   EFI_STATUS              Status;
 149   VARIABLE_POINTER_TRACK  Variable;
 150
 151   Status = FindVariable (VariableName, VendorGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 152   if (EFI_ERROR (Status)) {
 153     return EFI_SUCCESS;
 154   }
 155
 156   ASSERT (Variable.CurrPtr != NULL);
 157   return UpdateVariable (VariableName, VendorGuid, NULL, 0, 0, 0, 0, &Variable, NULL);
 158 }
 159
 160 /**
 161   Initializes for authenticated varibale service.
 162
 163   @retval EFI_SUCCESS           Function successfully executed.
 164   @retval EFI_OUT_OF_RESOURCES  Fail to allocate enough memory resources.
 165
 166 **/
 167 EFI_STATUS
 168 AutenticatedVariableServiceInitialize (
 169   VOID
 170   )
 171 {
 172   EFI_STATUS              Status;
 173   VARIABLE_POINTER_TRACK  Variable;
 174   VARIABLE_POINTER_TRACK  PkVariable;
 175   UINT8                   VarValue;
 176   UINT32                  VarAttr;
 177   UINT8                   *Data;
 178   UINTN                   DataSize;
 179   UINTN                   CtxSize;
 180   UINT8                   SecureBootMode;
 181   UINT8                   SecureBootEnable;
 182   UINT8                   CustomMode;
 183   UINT32                  ListSize;
 184
 185   //
 186   // Initialize hash context.
 187   //
 188   CtxSize   = Sha256GetContextSize ();
 189   mHashCtx  = AllocateRuntimePool (CtxSize);
 190   if (mHashCtx == NULL) {
 191     return EFI_OUT_OF_RESOURCES;
 192   }
 193
 194   //
 195   // Reserved runtime buffer for "Append" operation in virtual mode.
 196   //
 197   mStorageArea  = AllocateRuntimePool (MAX (PcdGet32 (PcdMaxVariableSize), PcdGet32 (PcdMaxHardwareErrorVariableSize)));
 198   if (mStorageArea == NULL) {
 199     return EFI_OUT_OF_RESOURCES;
 200   }
 201
 202   //
 203   // Prepare runtime buffer for serialized data of time-based authenticated
 204   // Variable, i.e. (VariableName, VendorGuid, Attributes, TimeStamp, Data).
 205   //
 206   mSerializationRuntimeBuffer = AllocateRuntimePool (PcdGet32 (PcdMaxVariableSize) + sizeof (EFI_GUID) + sizeof (UINT32) + sizeof (EFI_TIME));
 207   if (mSerializationRuntimeBuffer == NULL) {
 208     return EFI_OUT_OF_RESOURCES;
 209   }
 210
 211   //
 212   // Check "AuthVarKeyDatabase" variable's existence.
 213   // If it doesn't exist, create a new one with initial value of 0 and EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
 214   //
 215   Status = FindVariable (
 216              AUTHVAR_KEYDB_NAME,
 217              &gEfiAuthenticatedVariableGuid,
 218              &Variable,
 219              &mVariableModuleGlobal->VariableGlobal,
 220              FALSE
 221              );
 222
 223   if (Variable.CurrPtr == NULL) {
 224     VarAttr       = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS;
 225     VarValue      = 0;
 226     mPubKeyNumber = 0;
 227     Status        = UpdateVariable (
 228                       AUTHVAR_KEYDB_NAME,
 229                       &gEfiAuthenticatedVariableGuid,
 230                       &VarValue,
 231                       sizeof(UINT8),
 232                       VarAttr,
 233                       0,
 234                       0,
 235                       &Variable,
 236                       NULL
 237                       );
 238     if (EFI_ERROR (Status)) {
 239       return Status;
 240     }
 241   } else {
 242     //
 243     // Load database in global variable for cache.
 244     //
 245     DataSize  = DataSizeOfVariable (Variable.CurrPtr);
 246     Data      = GetVariableDataPtr (Variable.CurrPtr);
 247     ASSERT ((DataSize != 0) && (Data != NULL));
 248     CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
 249     mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
 250   }
 251
 252   FindVariable (EFI_PLATFORM_KEY_NAME, &gEfiGlobalVariableGuid, &PkVariable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 253   if (PkVariable.CurrPtr == NULL) {
 254     DEBUG ((EFI_D_INFO, "Variable %s does not exist.\n", EFI_PLATFORM_KEY_NAME));
 255   } else {
 256     DEBUG ((EFI_D_INFO, "Variable %s exists.\n", EFI_PLATFORM_KEY_NAME));
 257   }
 258
 259   //
 260   // Create "SetupMode" variable with BS+RT attribute set.
 261   //
 262   FindVariable (EFI_SETUP_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 263   if (PkVariable.CurrPtr == NULL) {
 264     mPlatformMode = SETUP_MODE;
 265   } else {
 266     mPlatformMode = USER_MODE;
 267   }
 268   Status = UpdateVariable (
 269              EFI_SETUP_MODE_NAME,
 270              &gEfiGlobalVariableGuid,
 271              &mPlatformMode,
 272              sizeof(UINT8),
 273              EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 274              0,
 275              0,
 276              &Variable,
 277              NULL
 278              );
 279   if (EFI_ERROR (Status)) {
 280     return Status;
 281   }
 282
 283   //
 284   // Create "SignatureSupport" variable with BS+RT attribute set.
 285   //
 286   FindVariable (EFI_SIGNATURE_SUPPORT_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 287   Status  = UpdateVariable (
 288               EFI_SIGNATURE_SUPPORT_NAME,
 289               &gEfiGlobalVariableGuid,
 290               mSignatureSupport,
 291               sizeof(mSignatureSupport),
 292               EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 293               0,
 294               0,
 295               &Variable,
 296               NULL
 297               );
 298   if (EFI_ERROR (Status)) {
 299     return Status;
 300   }
 301
 302   //
 303   // If "SecureBootEnable" variable exists, then update "SecureBoot" variable.
 304   // If "SecureBootEnable" variable is SECURE_BOOT_ENABLE and in USER_MODE, Set "SecureBoot" variable to SECURE_BOOT_MODE_ENABLE.
 305   // If "SecureBootEnable" variable is SECURE_BOOT_DISABLE, Set "SecureBoot" variable to SECURE_BOOT_MODE_DISABLE.
 306   //
 307   SecureBootEnable = SECURE_BOOT_DISABLE;
 308   FindVariable (EFI_SECURE_BOOT_ENABLE_NAME, &gEfiSecureBootEnableDisableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 309   if (Variable.CurrPtr != NULL) {
 310     SecureBootEnable = *(GetVariableDataPtr (Variable.CurrPtr));
 311   } else if (mPlatformMode == USER_MODE) {
 312     //
 313     // "SecureBootEnable" not exist, initialize it in USER_MODE.
 314     //
 315     SecureBootEnable = SECURE_BOOT_ENABLE;
 316     Status = UpdateVariable (
 317                EFI_SECURE_BOOT_ENABLE_NAME,
 318                &gEfiSecureBootEnableDisableGuid,
 319                &SecureBootEnable,
 320                sizeof (UINT8),
 321                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 322                0,
 323                0,
 324                &Variable,
 325                NULL
 326                );
 327     if (EFI_ERROR (Status)) {
 328       return Status;
 329     }
 330   }
 331
 332   //
 333   // Create "SecureBoot" variable with BS+RT attribute set.
 334   //
 335   if (SecureBootEnable == SECURE_BOOT_ENABLE && mPlatformMode == USER_MODE) {
 336     SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 337   } else {
 338     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 339   }
 340   FindVariable (EFI_SECURE_BOOT_MODE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 341   Status = UpdateVariable (
 342              EFI_SECURE_BOOT_MODE_NAME,
 343              &gEfiGlobalVariableGuid,
 344              &SecureBootMode,
 345              sizeof (UINT8),
 346              EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 347              0,
 348              0,
 349              &Variable,
 350              NULL
 351              );
 352   if (EFI_ERROR (Status)) {
 353     return Status;
 354   }
 355
 356   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SETUP_MODE_NAME, mPlatformMode));
 357   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_MODE_NAME, SecureBootMode));
 358   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_SECURE_BOOT_ENABLE_NAME, SecureBootEnable));
 359
 360   //
 361   // Initialize "CustomMode" in STANDARD_SECURE_BOOT_MODE state.
 362   //
 363   FindVariable (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 364   CustomMode = STANDARD_SECURE_BOOT_MODE;
 365   Status = UpdateVariable (
 366              EFI_CUSTOM_MODE_NAME,
 367              &gEfiCustomModeEnableGuid,
 368              &CustomMode,
 369              sizeof (UINT8),
 370              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 371              0,
 372              0,
 373              &Variable,
 374              NULL
 375              );
 376   if (EFI_ERROR (Status)) {
 377     return Status;
 378   }
 379
 380   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_CUSTOM_MODE_NAME, CustomMode));
 381
 382   //
 383   // Check "certdb" variable's existence.
 384   // If it doesn't exist, then create a new one with
 385   // EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.
 386   //
 387   Status = FindVariable (
 388              EFI_CERT_DB_NAME,
 389              &gEfiCertDbGuid,
 390              &Variable,
 391              &mVariableModuleGlobal->VariableGlobal,
 392              FALSE
 393              );
 394
 395   if (Variable.CurrPtr == NULL) {
 396     VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
 397     ListSize = sizeof (UINT32);
 398     Status   = UpdateVariable (
 399                  EFI_CERT_DB_NAME,
 400                  &gEfiCertDbGuid,
 401                  &ListSize,
 402                  sizeof (UINT32),
 403                  VarAttr,
 404                  0,
 405                  0,
 406                  &Variable,
 407                  NULL
 408                  );
 409     if (EFI_ERROR (Status)) {
 410       return Status;
 411     }
 412   }
 413
 414   //
 415   // Check "VendorKeysNv" variable's existence and create "VendorKeys" variable accordingly.
 416   //
 417   FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 418   if (Variable.CurrPtr != NULL) {
 419     mVendorKeyState = *(GetVariableDataPtr (Variable.CurrPtr));
 420   } else {
 421     //
 422     // "VendorKeysNv" not exist, initialize it in VENDOR_KEYS_VALID state.
 423     //
 424     mVendorKeyState = VENDOR_KEYS_VALID;
 425     Status = UpdateVariable (
 426                EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
 427                &gEfiVendorKeysNvGuid,
 428                &mVendorKeyState,
 429                sizeof (UINT8),
 430                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS,
 431                0,
 432                0,
 433                &Variable,
 434                NULL
 435                );
 436     if (EFI_ERROR (Status)) {
 437       return Status;
 438     }
 439   }
 440
 441   //
 442   // Create "VendorKeys" variable with BS+RT attribute set.
 443   //
 444   FindVariable (EFI_VENDOR_KEYS_VARIABLE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 445   Status = UpdateVariable (
 446              EFI_VENDOR_KEYS_VARIABLE_NAME,
 447              &gEfiGlobalVariableGuid,
 448              &mVendorKeyState,
 449              sizeof (UINT8),
 450              EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 451              0,
 452              0,
 453              &Variable,
 454              NULL
 455              );
 456   if (EFI_ERROR (Status)) {
 457     return Status;
 458   }
 459
 460   DEBUG ((EFI_D_INFO, "Variable %s is %x\n", EFI_VENDOR_KEYS_VARIABLE_NAME, mVendorKeyState));
 461
 462   return Status;
 463 }
 464
 465 /**
 466   Add public key in store and return its index.
 467
 468   @param[in]  PubKey                  Input pointer to Public Key data
 469
 470   @return                             Index of new added item
 471
 472 **/
 473 UINT32
 474 AddPubKeyInStore (
 475   IN  UINT8               *PubKey
 476   )
 477 {
 478   EFI_STATUS              Status;
 479   BOOLEAN                 IsFound;
 480   UINT32                  Index;
 481   VARIABLE_POINTER_TRACK  Variable;
 482   UINT8                   *Ptr;
 483   UINT8                   *Data;
 484   UINTN                   DataSize;
 485
 486   if (PubKey == NULL) {
 487     return 0;
 488   }
 489
 490   Status = FindVariable (
 491              AUTHVAR_KEYDB_NAME,
 492              &gEfiAuthenticatedVariableGuid,
 493              &Variable,
 494              &mVariableModuleGlobal->VariableGlobal,
 495              FALSE
 496              );
 497   ASSERT_EFI_ERROR (Status);
 498   if (EFI_ERROR (Status)) {
 499     return 0;
 500   }
 501
 502   //
 503   // Check whether the public key entry does exist.
 504   //
 505   IsFound = FALSE;
 506   for (Ptr = mPubKeyStore, Index = 1; Index <= mPubKeyNumber; Index++) {
 507     if (CompareMem (Ptr, PubKey, EFI_CERT_TYPE_RSA2048_SIZE) == 0) {
 508       IsFound = TRUE;
 509       break;
 510     }
 511     Ptr += EFI_CERT_TYPE_RSA2048_SIZE;
 512   }
 513
 514   if (!IsFound) {
 515     //
 516     // Add public key in database.
 517     //
 518     if (mPubKeyNumber == MAX_KEY_NUM) {
 519       //
 520       // Public key dadatase is full, try to reclaim invalid key.
 521       //
 522       if (AtRuntime ()) {
 523         //
 524         // NV storage can't reclaim at runtime.
 525         //
 526         return 0;
 527       }
 528
 529       Status = Reclaim (
 530                  mVariableModuleGlobal->VariableGlobal.NonVolatileVariableBase,
 531                  &mVariableModuleGlobal->NonVolatileLastVariableOffset,
 532                  FALSE,
 533                  NULL,
 534                  NULL,
 535                  0,
 536                  TRUE
 537                  );
 538       if (EFI_ERROR (Status)) {
 539         return 0;
 540       }
 541
 542       Status = FindVariable (
 543                  AUTHVAR_KEYDB_NAME,
 544                  &gEfiAuthenticatedVariableGuid,
 545                  &Variable,
 546                  &mVariableModuleGlobal->VariableGlobal,
 547                  FALSE
 548                  );
 549       ASSERT_EFI_ERROR (Status);
 550       if (EFI_ERROR (Status)) {
 551         return 0;
 552       }
 553
 554       DataSize  = DataSizeOfVariable (Variable.CurrPtr);
 555       Data      = GetVariableDataPtr (Variable.CurrPtr);
 556       ASSERT ((DataSize != 0) && (Data != NULL));
 557       CopyMem (mPubKeyStore, (UINT8 *) Data, DataSize);
 558       mPubKeyNumber = (UINT32) (DataSize / EFI_CERT_TYPE_RSA2048_SIZE);
 559
 560       if (mPubKeyNumber == MAX_KEY_NUM) {
 561         return 0;
 562       }
 563     }
 564
 565     CopyMem (mPubKeyStore + mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 566     Index = ++mPubKeyNumber;
 567     //
 568     // Update public key database variable.
 569     //
 570     Status = UpdateVariable (
 571                AUTHVAR_KEYDB_NAME,
 572                &gEfiAuthenticatedVariableGuid,
 573                mPubKeyStore,
 574                mPubKeyNumber * EFI_CERT_TYPE_RSA2048_SIZE,
 575                EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS,
 576                0,
 577                0,
 578                &Variable,
 579                NULL
 580                );
 581     ASSERT_EFI_ERROR (Status);
 582   }
 583
 584   return Index;
 585 }
 586
 587 /**
 588   Verify data payload with AuthInfo in EFI_CERT_TYPE_RSA2048_SHA256_GUID type.
 589   Follow the steps in UEFI2.2.
 590
 591   Caution: This function may receive untrusted input.
 592   This function may be invoked in SMM mode, and datasize and data are external input.
 593   This function will do basic validation, before parse the data.
 594   This function will parse the authentication carefully to avoid security issues, like
 595   buffer overflow, integer overflow.
 596
 597   @param[in]      Data                    Pointer to data with AuthInfo.
 598   @param[in]      DataSize                Size of Data.
 599   @param[in]      PubKey                  Public key used for verification.
 600
 601   @retval EFI_INVALID_PARAMETER       Invalid parameter.
 602   @retval EFI_SECURITY_VIOLATION      If authentication failed.
 603   @retval EFI_SUCCESS                 Authentication successful.
 604
 605 **/
 606 EFI_STATUS
 607 VerifyCounterBasedPayload (
 608   IN     UINT8          *Data,
 609   IN     UINTN          DataSize,
 610   IN     UINT8          *PubKey
 611   )
 612 {
 613   BOOLEAN                         Status;
 614   EFI_VARIABLE_AUTHENTICATION     *CertData;
 615   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
 616   UINT8                           Digest[SHA256_DIGEST_SIZE];
 617   VOID                            *Rsa;
 618   UINTN                           PayloadSize;
 619
 620   PayloadSize = DataSize - AUTHINFO_SIZE;
 621   Rsa         = NULL;
 622   CertData    = NULL;
 623   CertBlock   = NULL;
 624
 625   if (Data == NULL || PubKey == NULL) {
 626     return EFI_INVALID_PARAMETER;
 627   }
 628
 629   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
 630   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
 631
 632   //
 633   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
 634   // Cert type should be EFI_CERT_TYPE_RSA2048_SHA256_GUID.
 635   //
 636   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
 637       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertTypeRsa2048Sha256Guid)
 638         ) {
 639     //
 640     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
 641     //
 642     return EFI_SECURITY_VIOLATION;
 643   }
 644   //
 645   // Hash data payload with SHA256.
 646   //
 647   ZeroMem (Digest, SHA256_DIGEST_SIZE);
 648   Status  = Sha256Init (mHashCtx);
 649   if (!Status) {
 650     goto Done;
 651   }
 652   Status  = Sha256Update (mHashCtx, Data + AUTHINFO_SIZE, PayloadSize);
 653   if (!Status) {
 654     goto Done;
 655   }
 656   //
 657   // Hash Size.
 658   //
 659   Status  = Sha256Update (mHashCtx, &PayloadSize, sizeof (UINTN));
 660   if (!Status) {
 661     goto Done;
 662   }
 663   //
 664   // Hash Monotonic Count.
 665   //
 666   Status  = Sha256Update (mHashCtx, &CertData->MonotonicCount, sizeof (UINT64));
 667   if (!Status) {
 668     goto Done;
 669   }
 670   Status  = Sha256Final (mHashCtx, Digest);
 671   if (!Status) {
 672     goto Done;
 673   }
 674   //
 675   // Generate & Initialize RSA Context.
 676   //
 677   Rsa = RsaNew ();
 678   ASSERT (Rsa != NULL);
 679   //
 680   // Set RSA Key Components.
 681   // NOTE: Only N and E are needed to be set as RSA public key for signature verification.
 682   //
 683   Status = RsaSetKey (Rsa, RsaKeyN, PubKey, EFI_CERT_TYPE_RSA2048_SIZE);
 684   if (!Status) {
 685     goto Done;
 686   }
 687   Status = RsaSetKey (Rsa, RsaKeyE, mRsaE, sizeof (mRsaE));
 688   if (!Status) {
 689     goto Done;
 690   }
 691   //
 692   // Verify the signature.
 693   //
 694   Status = RsaPkcs1Verify (
 695              Rsa,
 696              Digest,
 697              SHA256_DIGEST_SIZE,
 698              CertBlock->Signature,
 699              EFI_CERT_TYPE_RSA2048_SHA256_SIZE
 700              );
 701
 702 Done:
 703   if (Rsa != NULL) {
 704     RsaFree (Rsa);
 705   }
 706   if (Status) {
 707     return EFI_SUCCESS;
 708   } else {
 709     return EFI_SECURITY_VIOLATION;
 710   }
 711 }
 712
 713 /**
 714   Update platform mode.
 715
 716   @param[in]      Mode                    SETUP_MODE or USER_MODE.
 717
 718   @return EFI_INVALID_PARAMETER           Invalid parameter.
 719   @return EFI_SUCCESS                     Update platform mode successfully.
 720
 721 **/
 722 EFI_STATUS
 723 UpdatePlatformMode (
 724   IN  UINT32                    Mode
 725   )
 726 {
 727   EFI_STATUS              Status;
 728   VARIABLE_POINTER_TRACK  Variable;
 729   UINT8                   SecureBootMode;
 730   UINT8                   SecureBootEnable;
 731   UINTN                   VariableDataSize;
 732
 733   Status = FindVariable (
 734              EFI_SETUP_MODE_NAME,
 735              &gEfiGlobalVariableGuid,
 736              &Variable,
 737              &mVariableModuleGlobal->VariableGlobal,
 738              FALSE
 739              );
 740   if (EFI_ERROR (Status)) {
 741     return Status;
 742   }
 743
 744   //
 745   // Update the value of SetupMode variable by a simple mem copy, this could avoid possible
 746   // variable storage reclaim at runtime.
 747   //
 748   mPlatformMode = (UINT8) Mode;
 749   CopyMem (GetVariableDataPtr (Variable.CurrPtr), &mPlatformMode, sizeof(UINT8));
 750
 751   if (AtRuntime ()) {
 752     //
 753     // SecureBoot Variable indicates whether the platform firmware is operating
 754     // in Secure boot mode (1) or not (0), so we should not change SecureBoot
 755     // Variable in runtime.
 756     //
 757     return Status;
 758   }
 759
 760   //
 761   // Check "SecureBoot" variable's existence.
 762   // If it doesn't exist, firmware has no capability to perform driver signing verification,
 763   // then set "SecureBoot" to 0.
 764   //
 765   Status = FindVariable (
 766              EFI_SECURE_BOOT_MODE_NAME,
 767              &gEfiGlobalVariableGuid,
 768              &Variable,
 769              &mVariableModuleGlobal->VariableGlobal,
 770              FALSE
 771              );
 772   //
 773   // If "SecureBoot" variable exists, then check "SetupMode" variable update.
 774   // If "SetupMode" variable is USER_MODE, "SecureBoot" variable is set to 1.
 775   // If "SetupMode" variable is SETUP_MODE, "SecureBoot" variable is set to 0.
 776   //
 777   if (Variable.CurrPtr == NULL) {
 778     SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 779   } else {
 780     if (mPlatformMode == USER_MODE) {
 781       SecureBootMode = SECURE_BOOT_MODE_ENABLE;
 782     } else if (mPlatformMode == SETUP_MODE) {
 783       SecureBootMode = SECURE_BOOT_MODE_DISABLE;
 784     } else {
 785       return EFI_NOT_FOUND;
 786     }
 787   }
 788
 789   Status  = UpdateVariable (
 790               EFI_SECURE_BOOT_MODE_NAME,
 791               &gEfiGlobalVariableGuid,
 792               &SecureBootMode,
 793               sizeof(UINT8),
 794               EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 795               0,
 796               0,
 797               &Variable,
 798               NULL
 799               );
 800   if (EFI_ERROR (Status)) {
 801     return Status;
 802   }
 803
 804   //
 805   // Check "SecureBootEnable" variable's existence. It can enable/disable secure boot feature.
 806   //
 807   Status = FindVariable (
 808              EFI_SECURE_BOOT_ENABLE_NAME,
 809              &gEfiSecureBootEnableDisableGuid,
 810              &Variable,
 811              &mVariableModuleGlobal->VariableGlobal,
 812              FALSE
 813              );
 814
 815   if (SecureBootMode == SECURE_BOOT_MODE_ENABLE) {
 816     //
 817     // Create the "SecureBootEnable" variable as secure boot is enabled.
 818     //
 819     SecureBootEnable = SECURE_BOOT_ENABLE;
 820     VariableDataSize = sizeof (SecureBootEnable);
 821   } else {
 822     //
 823     // Delete the "SecureBootEnable" variable if this variable exist as "SecureBoot"
 824     // variable is not in secure boot state.
 825     //
 826     if (Variable.CurrPtr == NULL || EFI_ERROR (Status)) {
 827       return EFI_SUCCESS;
 828     }
 829     SecureBootEnable = SECURE_BOOT_DISABLE;
 830     VariableDataSize = 0;
 831   }
 832
 833   Status = UpdateVariable (
 834              EFI_SECURE_BOOT_ENABLE_NAME,
 835              &gEfiSecureBootEnableDisableGuid,
 836              &SecureBootEnable,
 837              VariableDataSize,
 838              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
 839              0,
 840              0,
 841              &Variable,
 842              NULL
 843              );
 844   return Status;
 845 }
 846
 847 /**
 848   Check input data form to make sure it is a valid EFI_SIGNATURE_LIST for PK/KEK/db/dbx variable.
 849
 850   @param[in]  VariableName                Name of Variable to be check.
 851   @param[in]  VendorGuid                  Variable vendor GUID.
 852   @param[in]  Data                        Point to the variable data to be checked.
 853   @param[in]  DataSize                    Size of Data.
 854
 855   @return EFI_INVALID_PARAMETER           Invalid signature list format.
 856   @return EFI_SUCCESS                     Passed signature list format check successfully.
 857
 858 **/
 859 EFI_STATUS
 860 CheckSignatureListFormat(
 861   IN  CHAR16                    *VariableName,
 862   IN  EFI_GUID                  *VendorGuid,
 863   IN  VOID                      *Data,
 864   IN  UINTN                     DataSize
 865   )
 866 {
 867   EFI_SIGNATURE_LIST     *SigList;
 868   UINTN                  SigDataSize;
 869   UINT32                 Index;
 870   UINT32                 SigCount;
 871   BOOLEAN                IsPk;
 872   VOID                   *RsaContext;
 873   EFI_SIGNATURE_DATA     *CertData;
 874   UINTN                  CertLen;
 875
 876   if (DataSize == 0) {
 877     return EFI_SUCCESS;
 878   }
 879
 880   ASSERT (VariableName != NULL && VendorGuid != NULL && Data != NULL);
 881
 882   if (CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && (StrCmp (VariableName, EFI_PLATFORM_KEY_NAME) == 0)){
 883     IsPk = TRUE;
 884   } else if ((CompareGuid (VendorGuid, &gEfiGlobalVariableGuid) && StrCmp (VariableName, EFI_KEY_EXCHANGE_KEY_NAME) == 0) ||
 885              (CompareGuid (VendorGuid, &gEfiImageSecurityDatabaseGuid) &&
 886               (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE) == 0 || StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE1) == 0))){
 887     IsPk = FALSE;
 888   } else {
 889     return EFI_SUCCESS;
 890   }
 891
 892   SigCount = 0;
 893   SigList  = (EFI_SIGNATURE_LIST *) Data;
 894   SigDataSize  = DataSize;
 895   RsaContext = NULL;
 896
 897   //
 898   // Walk throuth the input signature list and check the data format.
 899   // If any signature is incorrectly formed, the whole check will fail.
 900   //
 901   while ((SigDataSize > 0) && (SigDataSize >= SigList->SignatureListSize)) {
 902     for (Index = 0; Index < (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM)); Index++ ) {
 903       if (CompareGuid (&SigList->SignatureType, &mSupportSigItem[Index].SigType)) {
 904         //
 905         // The value of SignatureSize should always be 16 (size of SignatureOwner
 906         // component) add the data length according to signature type.
 907         //
 908         if (mSupportSigItem[Index].SigDataSize != ((UINT32) ~0) &&
 909           (SigList->SignatureSize - sizeof (EFI_GUID)) != mSupportSigItem[Index].SigDataSize) {
 910           return EFI_INVALID_PARAMETER;
 911         }
 912         if (mSupportSigItem[Index].SigHeaderSize != ((UINTN) ~0) &&
 913           SigList->SignatureHeaderSize != mSupportSigItem[Index].SigHeaderSize) {
 914           return EFI_INVALID_PARAMETER;
 915         }
 916         break;
 917       }
 918     }
 919
 920     if (Index == (sizeof (mSupportSigItem) / sizeof (EFI_SIGNATURE_ITEM))) {
 921       //
 922       // Undefined signature type.
 923       //
 924       return EFI_INVALID_PARAMETER;
 925     }
 926
 927     if (CompareGuid (&SigList->SignatureType, &gEfiCertX509Guid)) {
 928       //
 929       // Try to retrieve the RSA public key from the X.509 certificate.
 930       // If this operation fails, it's not a valid certificate.
 931       //
 932       RsaContext = RsaNew ();
 933       if (RsaContext == NULL) {
 934         return EFI_INVALID_PARAMETER;
 935       }
 936       CertData = (EFI_SIGNATURE_DATA *) ((UINT8 *) SigList + sizeof (EFI_SIGNATURE_LIST) + SigList->SignatureHeaderSize);
 937       CertLen = SigList->SignatureSize - sizeof (EFI_GUID);
 938       if (!RsaGetPublicKeyFromX509 (CertData->SignatureData, CertLen, &RsaContext)) {
 939         RsaFree (RsaContext);
 940         return EFI_INVALID_PARAMETER;
 941       }
 942       RsaFree (RsaContext);
 943     }
 944
 945     if ((SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) % SigList->SignatureSize != 0) {
 946       return EFI_INVALID_PARAMETER;
 947     }
 948     SigCount += (SigList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - SigList->SignatureHeaderSize) / SigList->SignatureSize;
 949
 950     SigDataSize -= SigList->SignatureListSize;
 951     SigList = (EFI_SIGNATURE_LIST *) ((UINT8 *) SigList + SigList->SignatureListSize);
 952   }
 953
 954   if (((UINTN) SigList - (UINTN) Data) != DataSize) {
 955     return EFI_INVALID_PARAMETER;
 956   }
 957
 958   if (IsPk && SigCount > 1) {
 959     return EFI_INVALID_PARAMETER;
 960   }
 961
 962   return EFI_SUCCESS;
 963 }
 964
 965 /**
 966   Update "VendorKeys" variable to record the out of band secure boot key modification.
 967
 968   @return EFI_SUCCESS           Variable is updated successfully.
 969   @return Others                Failed to update variable.
 970
 971 **/
 972 EFI_STATUS
 973 VendorKeyIsModified (
 974   VOID
 975   )
 976 {
 977   EFI_STATUS              Status;
 978   VARIABLE_POINTER_TRACK  Variable;
 979
 980   if (mVendorKeyState == VENDOR_KEYS_MODIFIED) {
 981     return EFI_SUCCESS;
 982   }
 983   mVendorKeyState = VENDOR_KEYS_MODIFIED;
 984
 985   FindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME, &gEfiVendorKeysNvGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
 986   Status = UpdateVariable (
 987              EFI_VENDOR_KEYS_NV_VARIABLE_NAME,
 988              &gEfiVendorKeysNvGuid,
 989              &mVendorKeyState,
 990              sizeof (UINT8),
 991              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS,
 992              0,
 993              0,
 994              &Variable,
 995              NULL
 996              );
 997   if (EFI_ERROR (Status)) {
 998     return Status;
 999   }
1000
1001   FindVariable (EFI_VENDOR_KEYS_VARIABLE_NAME, &gEfiGlobalVariableGuid, &Variable, &mVariableModuleGlobal->VariableGlobal, FALSE);
1002   return UpdateVariable (
1003            EFI_VENDOR_KEYS_VARIABLE_NAME,
1004            &gEfiGlobalVariableGuid,
1005            &mVendorKeyState,
1006            sizeof (UINT8),
1007            EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
1008            0,
1009            0,
1010            &Variable,
1011            NULL
1012            );
1013 }
1014
1015 /**
1016   Process variable with platform key for verification.
1017
1018   Caution: This function may receive untrusted input.
1019   This function may be invoked in SMM mode, and datasize and data are external input.
1020   This function will do basic validation, before parse the data.
1021   This function will parse the authentication carefully to avoid security issues, like
1022   buffer overflow, integer overflow.
1023   This function will check attribute carefully to avoid authentication bypass.
1024
1025   @param[in]  VariableName                Name of Variable to be found.
1026   @param[in]  VendorGuid                  Variable vendor GUID.
1027   @param[in]  Data                        Data pointer.
1028   @param[in]  DataSize                    Size of Data found. If size is less than the
1029                                           data, this value contains the required size.
1030   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1031   @param[in]  Attributes                  Attribute value of the variable
1032   @param[in]  IsPk                        Indicate whether it is to process pk.
1033
1034   @return EFI_INVALID_PARAMETER           Invalid parameter.
1035   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation.
1036                                           check carried out by the firmware.
1037   @return EFI_SUCCESS                     Variable passed validation successfully.
1038
1039 **/
1040 EFI_STATUS
1041 ProcessVarWithPk (
1042   IN  CHAR16                    *VariableName,
1043   IN  EFI_GUID                  *VendorGuid,
1044   IN  VOID                      *Data,
1045   IN  UINTN                     DataSize,
1046   IN  VARIABLE_POINTER_TRACK    *Variable,
1047   IN  UINT32                    Attributes OPTIONAL,
1048   IN  BOOLEAN                   IsPk
1049   )
1050 {
1051   EFI_STATUS                  Status;
1052   BOOLEAN                     Del;
1053   UINT8                       *Payload;
1054   UINTN                       PayloadSize;
1055
1056   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1057       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1058     //
1059     // PK, KEK and db/dbx should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1060     // authenticated variable.
1061     //
1062     return EFI_INVALID_PARAMETER;
1063   }
1064
1065   Del = FALSE;
1066   if ((InCustomMode() && UserPhysicalPresent()) || (mPlatformMode == SETUP_MODE && !IsPk)) {
1067     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1068     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1069     if (PayloadSize == 0) {
1070       Del = TRUE;
1071     }
1072
1073     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
1074     if (EFI_ERROR (Status)) {
1075       return Status;
1076     }
1077
1078     Status = UpdateVariable (
1079                VariableName,
1080                VendorGuid,
1081                Payload,
1082                PayloadSize,
1083                Attributes,
1084                0,
1085                0,
1086                Variable,
1087                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1088                );
1089     if (EFI_ERROR(Status)) {
1090       return Status;
1091     }
1092
1093     if ((mPlatformMode != SETUP_MODE) || IsPk) {
1094       Status = VendorKeyIsModified ();
1095     }
1096   } else if (mPlatformMode == USER_MODE) {
1097     //
1098     // Verify against X509 Cert in PK database.
1099     //
1100     Status = VerifyTimeBasedPayload (
1101                VariableName,
1102                VendorGuid,
1103                Data,
1104                DataSize,
1105                Variable,
1106                Attributes,
1107                AuthVarTypePk,
1108                &Del
1109                );
1110   } else {
1111     //
1112     // Verify against the certificate in data payload.
1113     //
1114     Status = VerifyTimeBasedPayload (
1115                VariableName,
1116                VendorGuid,
1117                Data,
1118                DataSize,
1119                Variable,
1120                Attributes,
1121                AuthVarTypePayload,
1122                &Del
1123                );
1124   }
1125
1126   if (!EFI_ERROR(Status) && IsPk) {
1127     if (mPlatformMode == SETUP_MODE && !Del) {
1128       //
1129       // If enroll PK in setup mode, need change to user mode.
1130       //
1131       Status = UpdatePlatformMode (USER_MODE);
1132     } else if (mPlatformMode == USER_MODE && Del){
1133       //
1134       // If delete PK in user mode, need change to setup mode.
1135       //
1136       Status = UpdatePlatformMode (SETUP_MODE);
1137     }
1138   }
1139
1140   return Status;
1141 }
1142
1143 /**
1144   Process variable with key exchange key for verification.
1145
1146   Caution: This function may receive untrusted input.
1147   This function may be invoked in SMM mode, and datasize and data are external input.
1148   This function will do basic validation, before parse the data.
1149   This function will parse the authentication carefully to avoid security issues, like
1150   buffer overflow, integer overflow.
1151   This function will check attribute carefully to avoid authentication bypass.
1152
1153   @param[in]  VariableName                Name of Variable to be found.
1154   @param[in]  VendorGuid                  Variable vendor GUID.
1155   @param[in]  Data                        Data pointer.
1156   @param[in]  DataSize                    Size of Data found. If size is less than the
1157                                           data, this value contains the required size.
1158   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1159   @param[in]  Attributes                  Attribute value of the variable.
1160
1161   @return EFI_INVALID_PARAMETER           Invalid parameter.
1162   @return EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
1163                                           check carried out by the firmware.
1164   @return EFI_SUCCESS                     Variable pass validation successfully.
1165
1166 **/
1167 EFI_STATUS
1168 ProcessVarWithKek (
1169   IN  CHAR16                               *VariableName,
1170   IN  EFI_GUID                             *VendorGuid,
1171   IN  VOID                                 *Data,
1172   IN  UINTN                                DataSize,
1173   IN  VARIABLE_POINTER_TRACK               *Variable,
1174   IN  UINT32                               Attributes OPTIONAL
1175   )
1176 {
1177   EFI_STATUS                      Status;
1178   UINT8                           *Payload;
1179   UINTN                           PayloadSize;
1180
1181   if ((Attributes & EFI_VARIABLE_NON_VOLATILE) == 0 ||
1182       (Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) == 0) {
1183     //
1184     // DB and DBX should set EFI_VARIABLE_NON_VOLATILE attribute and should be a time-based
1185     // authenticated variable.
1186     //
1187     return EFI_INVALID_PARAMETER;
1188   }
1189
1190   Status = EFI_SUCCESS;
1191   if (mPlatformMode == USER_MODE && !(InCustomMode() && UserPhysicalPresent())) {
1192     //
1193     // Time-based, verify against X509 Cert KEK.
1194     //
1195     return VerifyTimeBasedPayload (
1196              VariableName,
1197              VendorGuid,
1198              Data,
1199              DataSize,
1200              Variable,
1201              Attributes,
1202              AuthVarTypeKek,
1203              NULL
1204              );
1205   } else {
1206     //
1207     // If in setup mode or custom secure boot mode, no authentication needed.
1208     //
1209     Payload = (UINT8 *) Data + AUTHINFO2_SIZE (Data);
1210     PayloadSize = DataSize - AUTHINFO2_SIZE (Data);
1211
1212     Status = CheckSignatureListFormat(VariableName, VendorGuid, Payload, PayloadSize);
1213     if (EFI_ERROR (Status)) {
1214       return Status;
1215     }
1216
1217     Status = UpdateVariable (
1218                VariableName,
1219                VendorGuid,
1220                Payload,
1221                PayloadSize,
1222                Attributes,
1223                0,
1224                0,
1225                Variable,
1226                &((EFI_VARIABLE_AUTHENTICATION_2 *) Data)->TimeStamp
1227                );
1228     if (EFI_ERROR (Status)) {
1229       return Status;
1230     }
1231
1232     if (mPlatformMode != SETUP_MODE) {
1233       Status = VendorKeyIsModified ();
1234     }
1235   }
1236
1237   return Status;
1238 }
1239
1240 /**
1241   Process variable with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS/EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
1242
1243   Caution: This function may receive untrusted input.
1244   This function may be invoked in SMM mode, and datasize and data are external input.
1245   This function will do basic validation, before parse the data.
1246   This function will parse the authentication carefully to avoid security issues, like
1247   buffer overflow, integer overflow.
1248   This function will check attribute carefully to avoid authentication bypass.
1249
1250   @param[in]  VariableName                Name of Variable to be found.
1251   @param[in]  VendorGuid                  Variable vendor GUID.
1252
1253   @param[in]  Data                        Data pointer.
1254   @param[in]  DataSize                    Size of Data found. If size is less than the
1255                                           data, this value contains the required size.
1256   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
1257   @param[in]  Attributes                  Attribute value of the variable.
1258
1259   @return EFI_INVALID_PARAMETER           Invalid parameter.
1260   @return EFI_WRITE_PROTECTED             Variable is write-protected and needs authentication with
1261                                           EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1262   @return EFI_OUT_OF_RESOURCES            The Database to save the public key is full.
1263   @return EFI_SECURITY_VIOLATION          The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
1264                                           set, but the AuthInfo does NOT pass the validation
1265                                           check carried out by the firmware.
1266   @return EFI_SUCCESS                     Variable is not write-protected or pass validation successfully.
1267
1268 **/
1269 EFI_STATUS
1270 ProcessVariable (
1271   IN     CHAR16                             *VariableName,
1272   IN     EFI_GUID                           *VendorGuid,
1273   IN     VOID                               *Data,
1274   IN     UINTN                              DataSize,
1275   IN     VARIABLE_POINTER_TRACK             *Variable,
1276   IN     UINT32                             Attributes
1277   )
1278 {
1279   EFI_STATUS                      Status;
1280   BOOLEAN                         IsDeletion;
1281   BOOLEAN                         IsFirstTime;
1282   UINT8                           *PubKey;
1283   EFI_VARIABLE_AUTHENTICATION     *CertData;
1284   EFI_CERT_BLOCK_RSA_2048_SHA256  *CertBlock;
1285   UINT32                          KeyIndex;
1286   UINT64                          MonotonicCount;
1287
1288   KeyIndex    = 0;
1289   CertData    = NULL;
1290   CertBlock   = NULL;
1291   PubKey      = NULL;
1292   IsDeletion  = FALSE;
1293
1294   if (NeedPhysicallyPresent(VariableName, VendorGuid) && !UserPhysicalPresent()) {
1295     //
1296     // This variable is protected, only physical present user could modify its value.
1297     //
1298     return EFI_SECURITY_VIOLATION;
1299   }
1300
1301   //
1302   // A time-based authenticated variable and a count-based authenticated variable
1303   // can't be updated by each other.
1304   //
1305   if (Variable->CurrPtr != NULL) {
1306     if (((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) &&
1307         ((Variable->CurrPtr->Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0)) {
1308       return EFI_SECURITY_VIOLATION;
1309     }
1310
1311     if (((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) &&
1312         ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0)) {
1313       return EFI_SECURITY_VIOLATION;
1314     }
1315   }
1316
1317   //
1318   // Process Time-based Authenticated variable.
1319   //
1320   if ((Attributes & EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) != 0) {
1321     return VerifyTimeBasedPayload (
1322              VariableName,
1323              VendorGuid,
1324              Data,
1325              DataSize,
1326              Variable,
1327              Attributes,
1328              AuthVarTypePriv,
1329              NULL
1330              );
1331   }
1332
1333   //
1334   // Determine if first time SetVariable with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS.
1335   //
1336   if ((Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) != 0) {
1337     //
1338     // Determine current operation type.
1339     //
1340     if (DataSize == AUTHINFO_SIZE) {
1341       IsDeletion = TRUE;
1342     }
1343     //
1344     // Determine whether this is the first time with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
1345     //
1346     if (Variable->CurrPtr == NULL) {
1347       IsFirstTime = TRUE;
1348     } else if ((Variable->CurrPtr->Attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) == 0) {
1349       IsFirstTime = TRUE;
1350     } else {
1351       KeyIndex   = Variable->CurrPtr->PubKeyIndex;
1352       IsFirstTime = FALSE;
1353     }
1354   } else if ((Variable->CurrPtr != NULL) &&
1355              ((Variable->CurrPtr->Attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) != 0)
1356             ) {
1357     //
1358     // If the variable is already write-protected, it always needs authentication before update.
1359     //
1360     return EFI_WRITE_PROTECTED;
1361   } else {
1362     //
1363     // If without EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS, set and attributes collision.
1364     // That means it is not authenticated variable, just update variable as usual.
1365     //
1366     Status = UpdateVariable (VariableName, VendorGuid, Data, DataSize, Attributes, 0, 0, Variable, NULL);
1367     return Status;
1368   }
1369
1370   //
1371   // Get PubKey and check Monotonic Count value corresponding to the variable.
1372   //
1373   CertData  = (EFI_VARIABLE_AUTHENTICATION *) Data;
1374   CertBlock = (EFI_CERT_BLOCK_RSA_2048_SHA256 *) (CertData->AuthInfo.CertData);
1375   PubKey    = CertBlock->PublicKey;
1376
1377   //
1378   // Update Monotonic Count value.
1379   //
1380   MonotonicCount = CertData->MonotonicCount;
1381
1382   if (!IsFirstTime) {
1383     //
1384     // Check input PubKey.
1385     //
1386     if (CompareMem (PubKey, mPubKeyStore + (KeyIndex - 1) * EFI_CERT_TYPE_RSA2048_SIZE, EFI_CERT_TYPE_RSA2048_SIZE) != 0) {
1387       return EFI_SECURITY_VIOLATION;
1388     }
1389     //
1390     // Compare the current monotonic count and ensure that it is greater than the last SetVariable
1391     // operation with the EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS attribute set.
1392     //
1393     if (CertData->MonotonicCount <= Variable->CurrPtr->MonotonicCount) {
1394       //
1395       // Monotonic count check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
1396       //
1397       return EFI_SECURITY_VIOLATION;
1398     }
1399   }
1400   //
1401   // Verify the certificate in Data payload.
1402   //
1403   Status = VerifyCounterBasedPayload (Data, DataSize, PubKey);
1404   if (EFI_ERROR (Status)) {
1405     return Status;
1406   }
1407
1408   //
1409   // Now, the signature has been verified!
1410   //
1411   if (IsFirstTime && !IsDeletion) {
1412     //
1413     // Update public key database variable if need.
1414     //
1415     KeyIndex = AddPubKeyInStore (PubKey);
1416     if (KeyIndex == 0) {
1417       return EFI_OUT_OF_RESOURCES;
1418     }
1419   }
1420
1421   //
1422   // Verification pass.
1423   //
1424   return UpdateVariable (VariableName, VendorGuid, (UINT8*)Data + AUTHINFO_SIZE, DataSize - AUTHINFO_SIZE, Attributes, KeyIndex, MonotonicCount, Variable, NULL);
1425 }
1426
1427 /**
1428   Merge two buffers which formatted as EFI_SIGNATURE_LIST. Only the new EFI_SIGNATURE_DATA
1429   will be appended to the original EFI_SIGNATURE_LIST, duplicate EFI_SIGNATURE_DATA
1430   will be ignored.
1431
1432   @param[in, out]  Data              Pointer to original EFI_SIGNATURE_LIST.
1433   @param[in]       DataSize          Size of Data buffer.
1434   @param[in]       FreeBufSize       Size of free data buffer
1435   @param[in]       NewData           Pointer to new EFI_SIGNATURE_LIST to be appended.
1436   @param[in]       NewDataSize       Size of NewData buffer.
1437   @param[out]      MergedBufSize     Size of the merged buffer
1438
1439   @return EFI_BUFFER_TOO_SMALL if input Data buffer overflowed
1440
1441 **/
1442 EFI_STATUS
1443 AppendSignatureList (
1444   IN  OUT VOID            *Data,
1445   IN  UINTN               DataSize,
1446   IN  UINTN               FreeBufSize,
1447   IN  VOID                *NewData,
1448   IN  UINTN               NewDataSize,
1449   OUT UINTN               *MergedBufSize
1450   )
1451 {
1452   EFI_SIGNATURE_LIST  *CertList;
1453   EFI_SIGNATURE_DATA  *Cert;
1454   UINTN               CertCount;
1455   EFI_SIGNATURE_LIST  *NewCertList;
1456   EFI_SIGNATURE_DATA  *NewCert;
1457   UINTN               NewCertCount;
1458   UINTN               Index;
1459   UINTN               Index2;
1460   UINTN               Size;
1461   UINT8               *Tail;
1462   UINTN               CopiedCount;
1463   UINTN               SignatureListSize;
1464   BOOLEAN             IsNewCert;
1465
1466   Tail = (UINT8 *) Data + DataSize;
1467
1468   NewCertList = (EFI_SIGNATURE_LIST *) NewData;
1469   while ((NewDataSize > 0) && (NewDataSize >= NewCertList->SignatureListSize)) {
1470     NewCert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCertList + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1471     NewCertCount = (NewCertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - NewCertList->SignatureHeaderSize) / NewCertList->SignatureSize;
1472
1473     CopiedCount = 0;
1474     for (Index = 0; Index < NewCertCount; Index++) {
1475       IsNewCert = TRUE;
1476
1477       Size = DataSize;
1478       CertList = (EFI_SIGNATURE_LIST *) Data;
1479       while ((Size > 0) && (Size >= CertList->SignatureListSize)) {
1480         if (CompareGuid (&CertList->SignatureType, &NewCertList->SignatureType) &&
1481            (CertList->SignatureSize == NewCertList->SignatureSize)) {
1482           Cert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
1483           CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
1484           for (Index2 = 0; Index2 < CertCount; Index2++) {
1485             //
1486             // Iterate each Signature Data in this Signature List.
1487             //
1488             if (CompareMem (NewCert, Cert, CertList->SignatureSize) == 0) {
1489               IsNewCert = FALSE;
1490               break;
1491             }
1492             Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
1493           }
1494         }
1495
1496         if (!IsNewCert) {
1497           break;
1498         }
1499         Size -= CertList->SignatureListSize;
1500         CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
1501       }
1502
1503       if (IsNewCert) {
1504         //
1505         // New EFI_SIGNATURE_DATA, append it.
1506         //
1507         if (CopiedCount == 0) {
1508           if (FreeBufSize < sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize) {
1509             return EFI_BUFFER_TOO_SMALL;
1510           }
1511
1512           //
1513           // Copy EFI_SIGNATURE_LIST header for only once.
1514           //
1515
1516           CopyMem (Tail, NewCertList, sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize);
1517           Tail = Tail + sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1518           FreeBufSize -= sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize;
1519         }
1520
1521         if (FreeBufSize < NewCertList->SignatureSize) {
1522           return EFI_BUFFER_TOO_SMALL;
1523         }
1524         CopyMem (Tail, NewCert, NewCertList->SignatureSize);
1525         Tail += NewCertList->SignatureSize;
1526         FreeBufSize -= NewCertList->SignatureSize;
1527         CopiedCount++;
1528       }
1529
1530       NewCert = (EFI_SIGNATURE_DATA *) ((UINT8 *) NewCert + NewCertList->SignatureSize);
1531     }
1532
1533     //
1534     // Update SignatureListSize in newly appended EFI_SIGNATURE_LIST.
1535     //
1536     if (CopiedCount != 0) {
1537       SignatureListSize = sizeof (EFI_SIGNATURE_LIST) + NewCertList->SignatureHeaderSize + (CopiedCount * NewCertList->SignatureSize);
1538       CertList = (EFI_SIGNATURE_LIST *) (Tail - SignatureListSize);
1539       CertList->SignatureListSize = (UINT32) SignatureListSize;
1540     }
1541
1542     NewDataSize -= NewCertList->SignatureListSize;
1543     NewCertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) NewCertList + NewCertList->SignatureListSize);
1544   }
1545
1546   *MergedBufSize = (Tail - (UINT8 *) Data);
1547   return EFI_SUCCESS;
1548 }
1549
1550 /**
1551   Compare two EFI_TIME data.
1552
1553
1554   @param FirstTime           A pointer to the first EFI_TIME data.
1555   @param SecondTime          A pointer to the second EFI_TIME data.
1556
1557   @retval  TRUE              The FirstTime is not later than the SecondTime.
1558   @retval  FALSE             The FirstTime is later than the SecondTime.
1559
1560 **/
1561 BOOLEAN
1562 CompareTimeStamp (
1563   IN EFI_TIME               *FirstTime,
1564   IN EFI_TIME               *SecondTime
1565   )
1566 {
1567   if (FirstTime->Year != SecondTime->Year) {
1568     return (BOOLEAN) (FirstTime->Year < SecondTime->Year);
1569   } else if (FirstTime->Month != SecondTime->Month) {
1570     return (BOOLEAN) (FirstTime->Month < SecondTime->Month);
1571   } else if (FirstTime->Day != SecondTime->Day) {
1572     return (BOOLEAN) (FirstTime->Day < SecondTime->Day);
1573   } else if (FirstTime->Hour != SecondTime->Hour) {
1574     return (BOOLEAN) (FirstTime->Hour < SecondTime->Hour);
1575   } else if (FirstTime->Minute != SecondTime->Minute) {
1576     return (BOOLEAN) (FirstTime->Minute < SecondTime->Minute);
1577   }
1578
1579   return (BOOLEAN) (FirstTime->Second <= SecondTime->Second);
1580 }
1581
1582 /**
1583   Find matching signer's certificates for common authenticated variable
1584   by corresponding VariableName and VendorGuid from "certdb".
1585
1586   The data format of "certdb":
1587   //
1588   //     UINT32 CertDbListSize;
1589   // /// AUTH_CERT_DB_DATA Certs1[];
1590   // /// AUTH_CERT_DB_DATA Certs2[];
1591   // /// ...
1592   // /// AUTH_CERT_DB_DATA Certsn[];
1593   //
1594
1595   @param[in]  VariableName   Name of authenticated Variable.
1596   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1597   @param[in]  Data           Pointer to variable "certdb".
1598   @param[in]  DataSize       Size of variable "certdb".
1599   @param[out] CertOffset     Offset of matching CertData, from starting of Data.
1600   @param[out] CertDataSize   Length of CertData in bytes.
1601   @param[out] CertNodeOffset Offset of matching AUTH_CERT_DB_DATA , from
1602                              starting of Data.
1603   @param[out] CertNodeSize   Length of AUTH_CERT_DB_DATA in bytes.
1604
1605   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1606   @retval  EFI_NOT_FOUND         Fail to find matching certs.
1607   @retval  EFI_SUCCESS           Find matching certs and output parameters.
1608
1609 **/
1610 EFI_STATUS
1611 FindCertsFromDb (
1612   IN     CHAR16           *VariableName,
1613   IN     EFI_GUID         *VendorGuid,
1614   IN     UINT8            *Data,
1615   IN     UINTN            DataSize,
1616   OUT    UINT32           *CertOffset,    OPTIONAL
1617   OUT    UINT32           *CertDataSize,  OPTIONAL
1618   OUT    UINT32           *CertNodeOffset,OPTIONAL
1619   OUT    UINT32           *CertNodeSize   OPTIONAL
1620   )
1621 {
1622   UINT32                  Offset;
1623   AUTH_CERT_DB_DATA       *Ptr;
1624   UINT32                  CertSize;
1625   UINT32                  NameSize;
1626   UINT32                  NodeSize;
1627   UINT32                  CertDbListSize;
1628
1629   if ((VariableName == NULL) || (VendorGuid == NULL) || (Data == NULL)) {
1630     return EFI_INVALID_PARAMETER;
1631   }
1632
1633   //
1634   // Check whether DataSize matches recorded CertDbListSize.
1635   //
1636   if (DataSize < sizeof (UINT32)) {
1637     return EFI_INVALID_PARAMETER;
1638   }
1639
1640   CertDbListSize = ReadUnaligned32 ((UINT32 *) Data);
1641
1642   if (CertDbListSize != (UINT32) DataSize) {
1643     return EFI_INVALID_PARAMETER;
1644   }
1645
1646   Offset = sizeof (UINT32);
1647
1648   //
1649   // Get corresponding certificates by VendorGuid and VariableName.
1650   //
1651   while (Offset < (UINT32) DataSize) {
1652     Ptr = (AUTH_CERT_DB_DATA *) (Data + Offset);
1653     //
1654     // Check whether VendorGuid matches.
1655     //
1656     if (CompareGuid (&Ptr->VendorGuid, VendorGuid)) {
1657       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1658       NameSize = ReadUnaligned32 (&Ptr->NameSize);
1659       CertSize = ReadUnaligned32 (&Ptr->CertDataSize);
1660
1661       if (NodeSize != sizeof (EFI_GUID) + sizeof (UINT32) * 3 + CertSize +
1662           sizeof (CHAR16) * NameSize) {
1663         return EFI_INVALID_PARAMETER;
1664       }
1665
1666       Offset = Offset + sizeof (EFI_GUID) + sizeof (UINT32) * 3;
1667       //
1668       // Check whether VariableName matches.
1669       //
1670       if ((NameSize == StrLen (VariableName)) &&
1671           (CompareMem (Data + Offset, VariableName, NameSize * sizeof (CHAR16)) == 0)) {
1672         Offset = Offset + NameSize * sizeof (CHAR16);
1673
1674         if (CertOffset != NULL) {
1675           *CertOffset = Offset;
1676         }
1677
1678         if (CertDataSize != NULL) {
1679           *CertDataSize = CertSize;
1680         }
1681
1682         if (CertNodeOffset != NULL) {
1683           *CertNodeOffset = (UINT32) ((UINT8 *) Ptr - Data);
1684         }
1685
1686         if (CertNodeSize != NULL) {
1687           *CertNodeSize = NodeSize;
1688         }
1689
1690         return EFI_SUCCESS;
1691       } else {
1692         Offset = Offset + NameSize * sizeof (CHAR16) + CertSize;
1693       }
1694     } else {
1695       NodeSize = ReadUnaligned32 (&Ptr->CertNodeSize);
1696       Offset   = Offset + NodeSize;
1697     }
1698   }
1699
1700   return EFI_NOT_FOUND;
1701 }
1702
1703 /**
1704   Retrieve signer's certificates for common authenticated variable
1705   by corresponding VariableName and VendorGuid from "certdb".
1706
1707   @param[in]  VariableName   Name of authenticated Variable.
1708   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1709   @param[out] CertData       Pointer to signer's certificates.
1710   @param[out] CertDataSize   Length of CertData in bytes.
1711
1712   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1713   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1714   @retval  EFI_SUCCESS           Get signer's certificates successfully.
1715
1716 **/
1717 EFI_STATUS
1718 GetCertsFromDb (
1719   IN     CHAR16           *VariableName,
1720   IN     EFI_GUID         *VendorGuid,
1721   OUT    UINT8            **CertData,
1722   OUT    UINT32           *CertDataSize
1723   )
1724 {
1725   VARIABLE_POINTER_TRACK  CertDbVariable;
1726   EFI_STATUS              Status;
1727   UINT8                   *Data;
1728   UINTN                   DataSize;
1729   UINT32                  CertOffset;
1730
1731   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL) || (CertDataSize == NULL)) {
1732     return EFI_INVALID_PARAMETER;
1733   }
1734
1735   //
1736   // Get variable "certdb".
1737   //
1738   Status = FindVariable (
1739              EFI_CERT_DB_NAME,
1740              &gEfiCertDbGuid,
1741              &CertDbVariable,
1742              &mVariableModuleGlobal->VariableGlobal,
1743              FALSE
1744              );
1745   if (EFI_ERROR (Status)) {
1746     return Status;
1747   }
1748
1749   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1750   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1751   if ((DataSize == 0) || (Data == NULL)) {
1752     ASSERT (FALSE);
1753     return EFI_NOT_FOUND;
1754   }
1755
1756   Status = FindCertsFromDb (
1757              VariableName,
1758              VendorGuid,
1759              Data,
1760              DataSize,
1761              &CertOffset,
1762              CertDataSize,
1763              NULL,
1764              NULL
1765              );
1766
1767   if (EFI_ERROR (Status)) {
1768     return Status;
1769   }
1770
1771   *CertData = Data + CertOffset;
1772   return EFI_SUCCESS;
1773 }
1774
1775 /**
1776   Delete matching signer's certificates when deleting common authenticated
1777   variable by corresponding VariableName and VendorGuid from "certdb".
1778
1779   @param[in]  VariableName   Name of authenticated Variable.
1780   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1781
1782   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1783   @retval  EFI_NOT_FOUND         Fail to find "certdb" or matching certs.
1784   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
1785   @retval  EFI_SUCCESS           The operation is completed successfully.
1786
1787 **/
1788 EFI_STATUS
1789 DeleteCertsFromDb (
1790   IN     CHAR16           *VariableName,
1791   IN     EFI_GUID         *VendorGuid
1792   )
1793 {
1794   VARIABLE_POINTER_TRACK  CertDbVariable;
1795   EFI_STATUS              Status;
1796   UINT8                   *Data;
1797   UINTN                   DataSize;
1798   UINT32                  VarAttr;
1799   UINT32                  CertNodeOffset;
1800   UINT32                  CertNodeSize;
1801   UINT8                   *NewCertDb;
1802   UINT32                  NewCertDbSize;
1803
1804   if ((VariableName == NULL) || (VendorGuid == NULL)) {
1805     return EFI_INVALID_PARAMETER;
1806   }
1807
1808   //
1809   // Get variable "certdb".
1810   //
1811   Status = FindVariable (
1812              EFI_CERT_DB_NAME,
1813              &gEfiCertDbGuid,
1814              &CertDbVariable,
1815              &mVariableModuleGlobal->VariableGlobal,
1816              FALSE
1817              );
1818   if (EFI_ERROR (Status)) {
1819     return Status;
1820   }
1821
1822   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1823   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1824   if ((DataSize == 0) || (Data == NULL)) {
1825     ASSERT (FALSE);
1826     return EFI_NOT_FOUND;
1827   }
1828
1829   if (DataSize == sizeof (UINT32)) {
1830     //
1831     // There is no certs in certdb.
1832     //
1833     return EFI_SUCCESS;
1834   }
1835
1836   //
1837   // Get corresponding cert node from certdb.
1838   //
1839   Status = FindCertsFromDb (
1840              VariableName,
1841              VendorGuid,
1842              Data,
1843              DataSize,
1844              NULL,
1845              NULL,
1846              &CertNodeOffset,
1847              &CertNodeSize
1848              );
1849
1850   if (EFI_ERROR (Status)) {
1851     return Status;
1852   }
1853
1854   if (DataSize < (CertNodeOffset + CertNodeSize)) {
1855     return EFI_NOT_FOUND;
1856   }
1857
1858   //
1859   // Construct new data content of variable "certdb".
1860   //
1861   NewCertDbSize = (UINT32) DataSize - CertNodeSize;
1862   NewCertDb     = (UINT8*) mCertDbStore;
1863
1864   //
1865   // Copy the DB entries before deleting node.
1866   //
1867   CopyMem (NewCertDb, Data, CertNodeOffset);
1868   //
1869   // Update CertDbListSize.
1870   //
1871   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
1872   //
1873   // Copy the DB entries after deleting node.
1874   //
1875   if (DataSize > (CertNodeOffset + CertNodeSize)) {
1876     CopyMem (
1877       NewCertDb + CertNodeOffset,
1878       Data + CertNodeOffset + CertNodeSize,
1879       DataSize - CertNodeOffset - CertNodeSize
1880       );
1881   }
1882
1883   //
1884   // Set "certdb".
1885   //
1886   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
1887   Status   = UpdateVariable (
1888                EFI_CERT_DB_NAME,
1889                &gEfiCertDbGuid,
1890                NewCertDb,
1891                NewCertDbSize,
1892                VarAttr,
1893                0,
1894                0,
1895                &CertDbVariable,
1896                NULL
1897                );
1898
1899   return Status;
1900 }
1901
1902 /**
1903   Insert signer's certificates for common authenticated variable with VariableName
1904   and VendorGuid in AUTH_CERT_DB_DATA to "certdb".
1905
1906   @param[in]  VariableName   Name of authenticated Variable.
1907   @param[in]  VendorGuid     Vendor GUID of authenticated Variable.
1908   @param[in]  CertData       Pointer to signer's certificates.
1909   @param[in]  CertDataSize   Length of CertData in bytes.
1910
1911   @retval  EFI_INVALID_PARAMETER Any input parameter is invalid.
1912   @retval  EFI_ACCESS_DENIED     An AUTH_CERT_DB_DATA entry with same VariableName
1913                                  and VendorGuid already exists.
1914   @retval  EFI_OUT_OF_RESOURCES  The operation is failed due to lack of resources.
1915   @retval  EFI_SUCCESS           Insert an AUTH_CERT_DB_DATA entry to "certdb"
1916
1917 **/
1918 EFI_STATUS
1919 InsertCertsToDb (
1920   IN     CHAR16           *VariableName,
1921   IN     EFI_GUID         *VendorGuid,
1922   IN     UINT8            *CertData,
1923   IN     UINTN            CertDataSize
1924   )
1925 {
1926   VARIABLE_POINTER_TRACK  CertDbVariable;
1927   EFI_STATUS              Status;
1928   UINT8                   *Data;
1929   UINTN                   DataSize;
1930   UINT32                  VarAttr;
1931   UINT8                   *NewCertDb;
1932   UINT32                  NewCertDbSize;
1933   UINT32                  CertNodeSize;
1934   UINT32                  NameSize;
1935   AUTH_CERT_DB_DATA       *Ptr;
1936
1937   if ((VariableName == NULL) || (VendorGuid == NULL) || (CertData == NULL)) {
1938     return EFI_INVALID_PARAMETER;
1939   }
1940
1941   //
1942   // Get variable "certdb".
1943   //
1944   Status = FindVariable (
1945              EFI_CERT_DB_NAME,
1946              &gEfiCertDbGuid,
1947              &CertDbVariable,
1948              &mVariableModuleGlobal->VariableGlobal,
1949              FALSE
1950              );
1951   if (EFI_ERROR (Status)) {
1952     return Status;
1953   }
1954
1955   DataSize  = DataSizeOfVariable (CertDbVariable.CurrPtr);
1956   Data      = GetVariableDataPtr (CertDbVariable.CurrPtr);
1957   if ((DataSize == 0) || (Data == NULL)) {
1958     ASSERT (FALSE);
1959     return EFI_NOT_FOUND;
1960   }
1961
1962   //
1963   // Find whether matching cert node already exists in "certdb".
1964   // If yes return error.
1965   //
1966   Status = FindCertsFromDb (
1967              VariableName,
1968              VendorGuid,
1969              Data,
1970              DataSize,
1971              NULL,
1972              NULL,
1973              NULL,
1974              NULL
1975              );
1976
1977   if (!EFI_ERROR (Status)) {
1978     ASSERT (FALSE);
1979     return EFI_ACCESS_DENIED;
1980   }
1981
1982   //
1983   // Construct new data content of variable "certdb".
1984   //
1985   NameSize      = (UINT32) StrLen (VariableName);
1986   CertNodeSize  = sizeof (AUTH_CERT_DB_DATA) + (UINT32) CertDataSize + NameSize * sizeof (CHAR16);
1987   NewCertDbSize = (UINT32) DataSize + CertNodeSize;
1988   if (NewCertDbSize > MAX_CERTDB_SIZE) {
1989     return EFI_OUT_OF_RESOURCES;
1990   }
1991   NewCertDb     = (UINT8*) mCertDbStore;
1992
1993   //
1994   // Copy the DB entries before deleting node.
1995   //
1996   CopyMem (NewCertDb, Data, DataSize);
1997   //
1998   // Update CertDbListSize.
1999   //
2000   CopyMem (NewCertDb, &NewCertDbSize, sizeof (UINT32));
2001   //
2002   // Construct new cert node.
2003   //
2004   Ptr = (AUTH_CERT_DB_DATA *) (NewCertDb + DataSize);
2005   CopyGuid (&Ptr->VendorGuid, VendorGuid);
2006   CopyMem (&Ptr->CertNodeSize, &CertNodeSize, sizeof (UINT32));
2007   CopyMem (&Ptr->NameSize, &NameSize, sizeof (UINT32));
2008   CopyMem (&Ptr->CertDataSize, &CertDataSize, sizeof (UINT32));
2009
2010   CopyMem (
2011     (UINT8 *) Ptr + sizeof (AUTH_CERT_DB_DATA),
2012     VariableName,
2013     NameSize * sizeof (CHAR16)
2014     );
2015
2016   CopyMem (
2017     (UINT8 *) Ptr +  sizeof (AUTH_CERT_DB_DATA) + NameSize * sizeof (CHAR16),
2018     CertData,
2019     CertDataSize
2020     );
2021
2022   //
2023   // Set "certdb".
2024   //
2025   VarAttr  = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
2026   Status   = UpdateVariable (
2027                EFI_CERT_DB_NAME,
2028                &gEfiCertDbGuid,
2029                NewCertDb,
2030                NewCertDbSize,
2031                VarAttr,
2032                0,
2033                0,
2034                &CertDbVariable,
2035                NULL
2036                );
2037
2038   return Status;
2039 }
2040
2041 /**
2042   Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set
2043
2044   Caution: This function may receive untrusted input.
2045   This function may be invoked in SMM mode, and datasize and data are external input.
2046   This function will do basic validation, before parse the data.
2047   This function will parse the authentication carefully to avoid security issues, like
2048   buffer overflow, integer overflow.
2049
2050   @param[in]  VariableName                Name of Variable to be found.
2051   @param[in]  VendorGuid                  Variable vendor GUID.
2052   @param[in]  Data                        Data pointer.
2053   @param[in]  DataSize                    Size of Data found. If size is less than the
2054                                           data, this value contains the required size.
2055   @param[in]  Variable                    The variable information which is used to keep track of variable usage.
2056   @param[in]  Attributes                  Attribute value of the variable.
2057   @param[in]  AuthVarType                 Verify against PK, KEK database, private database or certificate in data payload.
2058   @param[out] VarDel                      Delete the variable or not.
2059
2060   @retval EFI_INVALID_PARAMETER           Invalid parameter.
2061   @retval EFI_SECURITY_VIOLATION          The variable does NOT pass the validation
2062                                           check carried out by the firmware.
2063   @retval EFI_OUT_OF_RESOURCES            Failed to process variable due to lack
2064                                           of resources.
2065   @retval EFI_SUCCESS                     Variable pass validation successfully.
2066
2067 **/
2068 EFI_STATUS
2069 VerifyTimeBasedPayload (
2070   IN     CHAR16                             *VariableName,
2071   IN     EFI_GUID                           *VendorGuid,
2072   IN     VOID                               *Data,
2073   IN     UINTN                              DataSize,
2074   IN     VARIABLE_POINTER_TRACK             *Variable,
2075   IN     UINT32                             Attributes,
2076   IN     AUTHVAR_TYPE                       AuthVarType,
2077   OUT    BOOLEAN                            *VarDel
2078   )
2079 {
2080   UINT8                            *RootCert;
2081   UINT8                            *SigData;
2082   UINT8                            *PayloadPtr;
2083   UINTN                            RootCertSize;
2084   UINTN                            Index;
2085   UINTN                            CertCount;
2086   UINTN                            PayloadSize;
2087   UINT32                           Attr;
2088   UINT32                           SigDataSize;
2089   UINT32                           KekDataSize;
2090   BOOLEAN                          VerifyStatus;
2091   EFI_STATUS                       Status;
2092   EFI_SIGNATURE_LIST               *CertList;
2093   EFI_SIGNATURE_DATA               *Cert;
2094   VARIABLE_POINTER_TRACK           KekVariable;
2095   EFI_VARIABLE_AUTHENTICATION_2    *CertData;
2096   UINT8                            *NewData;
2097   UINTN                            NewDataSize;
2098   VARIABLE_POINTER_TRACK           PkVariable;
2099   UINT8                            *Buffer;
2100   UINTN                            Length;
2101   UINT8                            *SignerCerts;
2102   UINT8                            *WrapSigData;
2103   UINTN                            CertStackSize;
2104   UINT8                            *CertsInCertDb;
2105   UINT32                           CertsSizeinDb;
2106
2107   VerifyStatus           = FALSE;
2108   CertData               = NULL;
2109   NewData                = NULL;
2110   Attr                   = Attributes;
2111   WrapSigData            = NULL;
2112   SignerCerts            = NULL;
2113   RootCert               = NULL;
2114
2115   //
2116   // When the attribute EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS is
2117   // set, then the Data buffer shall begin with an instance of a complete (and serialized)
2118   // EFI_VARIABLE_AUTHENTICATION_2 descriptor. The descriptor shall be followed by the new
2119   // variable value and DataSize shall reflect the combined size of the descriptor and the new
2120   // variable value. The authentication descriptor is not part of the variable data and is not
2121   // returned by subsequent calls to GetVariable().
2122   //
2123   CertData = (EFI_VARIABLE_AUTHENTICATION_2 *) Data;
2124
2125   //
2126   // Verify that Pad1, Nanosecond, TimeZone, Daylight and Pad2 components of the
2127   // TimeStamp value are set to zero.
2128   //
2129   if ((CertData->TimeStamp.Pad1 != 0) ||
2130       (CertData->TimeStamp.Nanosecond != 0) ||
2131       (CertData->TimeStamp.TimeZone != 0) ||
2132       (CertData->TimeStamp.Daylight != 0) ||
2133       (CertData->TimeStamp.Pad2 != 0)) {
2134     return EFI_SECURITY_VIOLATION;
2135   }
2136
2137   if ((Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
2138     if (CompareTimeStamp (&CertData->TimeStamp, &Variable->CurrPtr->TimeStamp)) {
2139       //
2140       // TimeStamp check fail, suspicious replay attack, return EFI_SECURITY_VIOLATION.
2141       //
2142       return EFI_SECURITY_VIOLATION;
2143     }
2144   }
2145
2146   //
2147   // wCertificateType should be WIN_CERT_TYPE_EFI_GUID.
2148   // Cert type should be EFI_CERT_TYPE_PKCS7_GUID.
2149   //
2150   if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
2151       !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertPkcs7Guid)) {
2152     //
2153     // Invalid AuthInfo type, return EFI_SECURITY_VIOLATION.
2154     //
2155     return EFI_SECURITY_VIOLATION;
2156   }
2157
2158   //
2159   // Find out Pkcs7 SignedData which follows the EFI_VARIABLE_AUTHENTICATION_2 descriptor.
2160   // AuthInfo.Hdr.dwLength is the length of the entire certificate, including the length of the header.
2161   //
2162   SigData = CertData->AuthInfo.CertData;
2163   SigDataSize = CertData->AuthInfo.Hdr.dwLength - (UINT32) (OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData));
2164
2165   //
2166   // Find out the new data payload which follows Pkcs7 SignedData directly.
2167   //
2168   PayloadPtr = SigData + SigDataSize;
2169   PayloadSize = DataSize - OFFSET_OF_AUTHINFO2_CERT_DATA - (UINTN) SigDataSize;
2170
2171   //
2172   // Construct a buffer to fill with (VariableName, VendorGuid, Attributes, TimeStamp, Data).
2173   //
2174   NewDataSize = PayloadSize + sizeof (EFI_TIME) + sizeof (UINT32) +
2175                 sizeof (EFI_GUID) + StrSize (VariableName) - sizeof (CHAR16);
2176   NewData = mSerializationRuntimeBuffer;
2177
2178   Buffer = NewData;
2179   Length = StrLen (VariableName) * sizeof (CHAR16);
2180   CopyMem (Buffer, VariableName, Length);
2181   Buffer += Length;
2182
2183   Length = sizeof (EFI_GUID);
2184   CopyMem (Buffer, VendorGuid, Length);
2185   Buffer += Length;
2186
2187   Length = sizeof (UINT32);
2188   CopyMem (Buffer, &Attr, Length);
2189   Buffer += Length;
2190
2191   Length = sizeof (EFI_TIME);
2192   CopyMem (Buffer, &CertData->TimeStamp, Length);
2193   Buffer += Length;
2194
2195   CopyMem (Buffer, PayloadPtr, PayloadSize);
2196
2197   if (AuthVarType == AuthVarTypePk) {
2198     //
2199     // Verify that the signature has been made with the current Platform Key (no chaining for PK).
2200     // First, get signer's certificates from SignedData.
2201     //
2202     VerifyStatus = Pkcs7GetSigners (
2203                      SigData,
2204                      SigDataSize,
2205                      &SignerCerts,
2206                      &CertStackSize,
2207                      &RootCert,
2208                      &RootCertSize
2209                      );
2210     if (!VerifyStatus) {
2211       goto Exit;
2212     }
2213
2214     //
2215     // Second, get the current platform key from variable. Check whether it's identical with signer's certificates
2216     // in SignedData. If not, return error immediately.
2217     //
2218     Status = FindVariable (
2219                EFI_PLATFORM_KEY_NAME,
2220                &gEfiGlobalVariableGuid,
2221                &PkVariable,
2222                &mVariableModuleGlobal->VariableGlobal,
2223                FALSE
2224                );
2225     if (EFI_ERROR (Status)) {
2226       VerifyStatus = FALSE;
2227       goto Exit;
2228     }
2229     CertList = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (PkVariable.CurrPtr);
2230     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2231     if ((RootCertSize != (CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1))) ||
2232         (CompareMem (Cert->SignatureData, RootCert, RootCertSize) != 0)) {
2233       VerifyStatus = FALSE;
2234       goto Exit;
2235     }
2236
2237     //
2238     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2239     //
2240     VerifyStatus = Pkcs7Verify (
2241                      SigData,
2242                      SigDataSize,
2243                      RootCert,
2244                      RootCertSize,
2245                      NewData,
2246                      NewDataSize
2247                      );
2248
2249   } else if (AuthVarType == AuthVarTypeKek) {
2250
2251     //
2252     // Get KEK database from variable.
2253     //
2254     Status = FindVariable (
2255                EFI_KEY_EXCHANGE_KEY_NAME,
2256                &gEfiGlobalVariableGuid,
2257                &KekVariable,
2258                &mVariableModuleGlobal->VariableGlobal,
2259                FALSE
2260                );
2261     if (EFI_ERROR (Status)) {
2262       return Status;
2263     }
2264
2265     //
2266     // Ready to verify Pkcs7 SignedData. Go through KEK Signature Database to find out X.509 CertList.
2267     //
2268     KekDataSize      = KekVariable.CurrPtr->DataSize;
2269     CertList         = (EFI_SIGNATURE_LIST *) GetVariableDataPtr (KekVariable.CurrPtr);
2270     while ((KekDataSize > 0) && (KekDataSize >= CertList->SignatureListSize)) {
2271       if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid)) {
2272         Cert       = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2273         CertCount  = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
2274         for (Index = 0; Index < CertCount; Index++) {
2275           //
2276           // Iterate each Signature Data Node within this CertList for a verify
2277           //
2278           RootCert      = Cert->SignatureData;
2279           RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2280
2281           //
2282           // Verify Pkcs7 SignedData via Pkcs7Verify library.
2283           //
2284           VerifyStatus = Pkcs7Verify (
2285                            SigData,
2286                            SigDataSize,
2287                            RootCert,
2288                            RootCertSize,
2289                            NewData,
2290                            NewDataSize
2291                            );
2292           if (VerifyStatus) {
2293             goto Exit;
2294           }
2295           Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
2296         }
2297       }
2298       KekDataSize -= CertList->SignatureListSize;
2299       CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
2300     }
2301   } else if (AuthVarType == AuthVarTypePriv) {
2302
2303     //
2304     // Process common authenticated variable except PK/KEK/DB/DBX.
2305     // Get signer's certificates from SignedData.
2306     //
2307     VerifyStatus = Pkcs7GetSigners (
2308                      SigData,
2309                      SigDataSize,
2310                      &SignerCerts,
2311                      &CertStackSize,
2312                      &RootCert,
2313                      &RootCertSize
2314                      );
2315     if (!VerifyStatus) {
2316       goto Exit;
2317     }
2318
2319     //
2320     // Get previously stored signer's certificates from certdb for existing
2321     // variable. Check whether they are identical with signer's certificates
2322     // in SignedData. If not, return error immediately.
2323     //
2324     if ((Variable->CurrPtr != NULL)) {
2325       VerifyStatus = FALSE;
2326
2327       Status = GetCertsFromDb (VariableName, VendorGuid, &CertsInCertDb, &CertsSizeinDb);
2328       if (EFI_ERROR (Status)) {
2329         goto Exit;
2330       }
2331
2332       if ((CertStackSize != CertsSizeinDb) ||
2333           (CompareMem (SignerCerts, CertsInCertDb, CertsSizeinDb) != 0)) {
2334         goto Exit;
2335       }
2336     }
2337
2338     VerifyStatus = Pkcs7Verify (
2339                      SigData,
2340                      SigDataSize,
2341                      RootCert,
2342                      RootCertSize,
2343                      NewData,
2344                      NewDataSize
2345                      );
2346     if (!VerifyStatus) {
2347       goto Exit;
2348     }
2349
2350     //
2351     // Delete signer's certificates when delete the common authenticated variable.
2352     //
2353     if ((PayloadSize == 0) && (Variable->CurrPtr != NULL) && ((Attributes & EFI_VARIABLE_APPEND_WRITE) == 0)) {
2354       Status = DeleteCertsFromDb (VariableName, VendorGuid);
2355       if (EFI_ERROR (Status)) {
2356         VerifyStatus = FALSE;
2357         goto Exit;
2358       }
2359     } else if (Variable->CurrPtr == NULL && PayloadSize != 0) {
2360       //
2361       // Insert signer's certificates when adding a new common authenticated variable.
2362       //
2363       Status = InsertCertsToDb (VariableName, VendorGuid, SignerCerts, CertStackSize);
2364       if (EFI_ERROR (Status)) {
2365         VerifyStatus = FALSE;
2366         goto Exit;
2367       }
2368     }
2369   } else if (AuthVarType == AuthVarTypePayload) {
2370     CertList = (EFI_SIGNATURE_LIST *) PayloadPtr;
2371     Cert     = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
2372     RootCert      = Cert->SignatureData;
2373     RootCertSize  = CertList->SignatureSize - (sizeof (EFI_SIGNATURE_DATA) - 1);
2374
2375     // Verify Pkcs7 SignedData via Pkcs7Verify library.
2376     //
2377     VerifyStatus = Pkcs7Verify (
2378                      SigData,
2379                      SigDataSize,
2380                      RootCert,
2381                      RootCertSize,
2382                      NewData,
2383                      NewDataSize
2384                      );
2385   } else {
2386     return EFI_SECURITY_VIOLATION;
2387   }
2388
2389 Exit:
2390
2391   if (AuthVarType == AuthVarTypePk || AuthVarType == AuthVarTypePriv) {
2392     Pkcs7FreeSigners (RootCert);
2393     Pkcs7FreeSigners (SignerCerts);
2394   }
2395
2396   if (!VerifyStatus) {
2397     return EFI_SECURITY_VIOLATION;
2398   }
2399
2400   Status = CheckSignatureListFormat(VariableName, VendorGuid, PayloadPtr, PayloadSize);
2401   if (EFI_ERROR (Status)) {
2402     return Status;
2403   }
2404
2405   if ((PayloadSize == 0) && (VarDel != NULL)) {
2406     *VarDel = TRUE;
2407   }
2408
2409   //
2410   // Final step: Update/Append Variable if it pass Pkcs7Verify
2411   //
2412   return UpdateVariable (
2413            VariableName,
2414            VendorGuid,
2415            PayloadPtr,
2416            PayloadSize,
2417            Attributes,
2418            0,
2419            0,
2420            Variable,
2421            &CertData->TimeStamp
2422            );
2423 }
2424