1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3 * UEFI runtime variable services
4 *
5 * Copyright (c) 2017 Rob Clark
6 */
7
8 #define LOG_CATEGORY LOGC_EFI
9
10 #include <common.h>
11 #include <efi_loader.h>
12 #include <efi_variable.h>
13 #include <env.h>
14 #include <env_internal.h>
15 #include <hexdump.h>
16 #include <log.h>
17 #include <malloc.h>
18 #include <rtc.h>
19 #include <search.h>
20 #include <uuid.h>
21 #include <crypto/pkcs7_parser.h>
22 #include <linux/compat.h>
23 #include <u-boot/crc.h>
24 #include <asm/sections.h>
25
26 #ifdef CONFIG_EFI_SECURE_BOOT
27
28 /**
29 * efi_variable_authenticate - authenticate a variable
30 * @variable: Variable name in u16
31 * @vendor: Guid of variable
32 * @data_size: Size of @data
33 * @data: Pointer to variable's value
34 * @given_attr: Attributes to be given at SetVariable()
35 * @env_attr: Attributes that an existing variable holds
36 * @time: signed time that an existing variable holds
37 *
38 * Called by efi_set_variable() to verify that the input is correct.
39 * Will replace the given data pointer with another that points to
40 * the actual data to store in the internal memory.
41 * On success, @data and @data_size will be replaced with variable's
42 * actual data, excluding authentication data, and its size, and variable's
43 * attributes and signed time will also be returned in @env_attr and @time,
44 * respectively.
45 *
46 * Return: status code
47 */
efi_variable_authenticate(u16 * variable,const efi_guid_t * vendor,efi_uintn_t * data_size,const void ** data,u32 given_attr,u32 * env_attr,u64 * time)48 static efi_status_t efi_variable_authenticate(u16 *variable,
49 const efi_guid_t *vendor,
50 efi_uintn_t *data_size,
51 const void **data, u32 given_attr,
52 u32 *env_attr, u64 *time)
53 {
54 const struct efi_variable_authentication_2 *auth;
55 struct efi_signature_store *truststore, *truststore2;
56 struct pkcs7_message *var_sig;
57 struct efi_image_regions *regs;
58 struct efi_time timestamp;
59 struct rtc_time tm;
60 u64 new_time;
61 u8 *ebuf;
62 enum efi_auth_var_type var_type;
63 efi_status_t ret;
64
65 var_sig = NULL;
66 truststore = NULL;
67 truststore2 = NULL;
68 regs = NULL;
69 ebuf = NULL;
70 ret = EFI_SECURITY_VIOLATION;
71
72 if (*data_size < sizeof(struct efi_variable_authentication_2))
73 goto err;
74
75 /* authentication data */
76 auth = *data;
77 if (*data_size < (sizeof(auth->time_stamp)
78 + auth->auth_info.hdr.dwLength))
79 goto err;
80
81 if (guidcmp(&auth->auth_info.cert_type, &efi_guid_cert_type_pkcs7))
82 goto err;
83
84 memcpy(×tamp, &auth->time_stamp, sizeof(timestamp));
85 if (timestamp.pad1 || timestamp.nanosecond || timestamp.timezone ||
86 timestamp.daylight || timestamp.pad2)
87 goto err;
88
89 *data += sizeof(auth->time_stamp) + auth->auth_info.hdr.dwLength;
90 *data_size -= (sizeof(auth->time_stamp)
91 + auth->auth_info.hdr.dwLength);
92
93 memset(&tm, 0, sizeof(tm));
94 tm.tm_year = timestamp.year;
95 tm.tm_mon = timestamp.month;
96 tm.tm_mday = timestamp.day;
97 tm.tm_hour = timestamp.hour;
98 tm.tm_min = timestamp.minute;
99 tm.tm_sec = timestamp.second;
100 new_time = rtc_mktime(&tm);
101
102 if (!efi_secure_boot_enabled()) {
103 /* finished checking */
104 *time = new_time;
105 return EFI_SUCCESS;
106 }
107
108 if (new_time <= *time)
109 goto err;
110
111 /* data to be digested */
112 regs = calloc(sizeof(*regs) + sizeof(struct image_region) * 5, 1);
113 if (!regs)
114 goto err;
115 regs->max = 5;
116 efi_image_region_add(regs, (uint8_t *)variable,
117 (uint8_t *)variable
118 + u16_strlen(variable) * sizeof(u16), 1);
119 efi_image_region_add(regs, (uint8_t *)vendor,
120 (uint8_t *)vendor + sizeof(*vendor), 1);
121 efi_image_region_add(regs, (uint8_t *)&given_attr,
122 (uint8_t *)&given_attr + sizeof(given_attr), 1);
123 efi_image_region_add(regs, (uint8_t *)×tamp,
124 (uint8_t *)×tamp + sizeof(timestamp), 1);
125 efi_image_region_add(regs, (uint8_t *)*data,
126 (uint8_t *)*data + *data_size, 1);
127
128 /* variable's signature list */
129 if (auth->auth_info.hdr.dwLength < sizeof(auth->auth_info))
130 goto err;
131
132 /* ebuf should be kept valid during the authentication */
133 var_sig = efi_parse_pkcs7_header(auth->auth_info.cert_data,
134 auth->auth_info.hdr.dwLength
135 - sizeof(auth->auth_info),
136 &ebuf);
137 if (!var_sig) {
138 EFI_PRINT("Parsing variable's signature failed\n");
139 goto err;
140 }
141
142 /* signature database used for authentication */
143 var_type = efi_auth_var_get_type(variable, vendor);
144 switch (var_type) {
145 case EFI_AUTH_VAR_PK:
146 case EFI_AUTH_VAR_KEK:
147 /* with PK */
148 truststore = efi_sigstore_parse_sigdb(L"PK");
149 if (!truststore)
150 goto err;
151 break;
152 case EFI_AUTH_VAR_DB:
153 case EFI_AUTH_VAR_DBX:
154 /* with PK and KEK */
155 truststore = efi_sigstore_parse_sigdb(L"KEK");
156 truststore2 = efi_sigstore_parse_sigdb(L"PK");
157 if (!truststore) {
158 if (!truststore2)
159 goto err;
160
161 truststore = truststore2;
162 truststore2 = NULL;
163 }
164 break;
165 default:
166 /* TODO: support private authenticated variables */
167 goto err;
168 }
169
170 /* verify signature */
171 if (efi_signature_verify(regs, var_sig, truststore, NULL)) {
172 EFI_PRINT("Verified\n");
173 } else {
174 if (truststore2 &&
175 efi_signature_verify(regs, var_sig, truststore2, NULL)) {
176 EFI_PRINT("Verified\n");
177 } else {
178 EFI_PRINT("Verifying variable's signature failed\n");
179 goto err;
180 }
181 }
182
183 /* finished checking */
184 *time = new_time;
185 ret = EFI_SUCCESS;
186
187 err:
188 efi_sigstore_free(truststore);
189 efi_sigstore_free(truststore2);
190 pkcs7_free_message(var_sig);
191 free(ebuf);
192 free(regs);
193
194 return ret;
195 }
196 #else
efi_variable_authenticate(u16 * variable,const efi_guid_t * vendor,efi_uintn_t * data_size,const void ** data,u32 given_attr,u32 * env_attr,u64 * time)197 static efi_status_t efi_variable_authenticate(u16 *variable,
198 const efi_guid_t *vendor,
199 efi_uintn_t *data_size,
200 const void **data, u32 given_attr,
201 u32 *env_attr, u64 *time)
202 {
203 return EFI_SUCCESS;
204 }
205 #endif /* CONFIG_EFI_SECURE_BOOT */
206
207 efi_status_t __efi_runtime
efi_get_variable_int(u16 * variable_name,const efi_guid_t * vendor,u32 * attributes,efi_uintn_t * data_size,void * data,u64 * timep)208 efi_get_variable_int(u16 *variable_name, const efi_guid_t *vendor,
209 u32 *attributes, efi_uintn_t *data_size, void *data,
210 u64 *timep)
211 {
212 return efi_get_variable_mem(variable_name, vendor, attributes, data_size, data, timep);
213 }
214
215 efi_status_t __efi_runtime
efi_get_next_variable_name_int(efi_uintn_t * variable_name_size,u16 * variable_name,efi_guid_t * vendor)216 efi_get_next_variable_name_int(efi_uintn_t *variable_name_size,
217 u16 *variable_name, efi_guid_t *vendor)
218 {
219 return efi_get_next_variable_name_mem(variable_name_size, variable_name, vendor);
220 }
221
efi_set_variable_int(u16 * variable_name,const efi_guid_t * vendor,u32 attributes,efi_uintn_t data_size,const void * data,bool ro_check)222 efi_status_t efi_set_variable_int(u16 *variable_name, const efi_guid_t *vendor,
223 u32 attributes, efi_uintn_t data_size,
224 const void *data, bool ro_check)
225 {
226 struct efi_var_entry *var;
227 efi_uintn_t ret;
228 bool append, delete;
229 u64 time = 0;
230 enum efi_auth_var_type var_type;
231
232 if (!variable_name || !*variable_name || !vendor ||
233 ((attributes & EFI_VARIABLE_RUNTIME_ACCESS) &&
234 !(attributes & EFI_VARIABLE_BOOTSERVICE_ACCESS)))
235 return EFI_INVALID_PARAMETER;
236
237 /* check if a variable exists */
238 var = efi_var_mem_find(vendor, variable_name, NULL);
239 append = !!(attributes & EFI_VARIABLE_APPEND_WRITE);
240 attributes &= ~(u32)EFI_VARIABLE_APPEND_WRITE;
241 delete = !append && (!data_size || !attributes);
242
243 /* check attributes */
244 var_type = efi_auth_var_get_type(variable_name, vendor);
245 if (var) {
246 if (ro_check && (var->attr & EFI_VARIABLE_READ_ONLY))
247 return EFI_WRITE_PROTECTED;
248
249 if (IS_ENABLED(CONFIG_EFI_VARIABLES_PRESEED)) {
250 if (var_type != EFI_AUTH_VAR_NONE)
251 return EFI_WRITE_PROTECTED;
252 }
253
254 /* attributes won't be changed */
255 if (!delete &&
256 ((ro_check && var->attr != attributes) ||
257 (!ro_check && ((var->attr & ~(u32)EFI_VARIABLE_READ_ONLY)
258 != (attributes & ~(u32)EFI_VARIABLE_READ_ONLY))))) {
259 return EFI_INVALID_PARAMETER;
260 }
261 time = var->time;
262 } else {
263 if (delete || append)
264 /*
265 * Trying to delete or to update a non-existent
266 * variable.
267 */
268 return EFI_NOT_FOUND;
269 }
270
271 if (var_type != EFI_AUTH_VAR_NONE) {
272 /* authentication is mandatory */
273 if (!(attributes &
274 EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) {
275 EFI_PRINT("%ls: TIME_BASED_AUTHENTICATED_WRITE_ACCESS required\n",
276 variable_name);
277 return EFI_INVALID_PARAMETER;
278 }
279 }
280
281 /* authenticate a variable */
282 if (IS_ENABLED(CONFIG_EFI_SECURE_BOOT)) {
283 if (attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS)
284 return EFI_INVALID_PARAMETER;
285 if (attributes &
286 EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) {
287 u32 env_attr;
288
289 ret = efi_variable_authenticate(variable_name, vendor,
290 &data_size, &data,
291 attributes, &env_attr,
292 &time);
293 if (ret != EFI_SUCCESS)
294 return ret;
295
296 /* last chance to check for delete */
297 if (!data_size)
298 delete = true;
299 }
300 } else {
301 if (attributes &
302 (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS |
303 EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) {
304 EFI_PRINT("Secure boot is not configured\n");
305 return EFI_INVALID_PARAMETER;
306 }
307 }
308
309 if (delete) {
310 /* EFI_NOT_FOUND has been handled before */
311 attributes = var->attr;
312 ret = EFI_SUCCESS;
313 } else if (append) {
314 u16 *old_data = var->name;
315
316 for (; *old_data; ++old_data)
317 ;
318 ++old_data;
319 ret = efi_var_mem_ins(variable_name, vendor, attributes,
320 var->length, old_data, data_size, data,
321 time);
322 } else {
323 ret = efi_var_mem_ins(variable_name, vendor, attributes,
324 data_size, data, 0, NULL, time);
325 }
326 efi_var_mem_del(var);
327
328 if (ret != EFI_SUCCESS)
329 return ret;
330
331 if (var_type == EFI_AUTH_VAR_PK)
332 ret = efi_init_secure_state();
333 else
334 ret = EFI_SUCCESS;
335
336 /* Write non-volatile EFI variables to file */
337 if (attributes & EFI_VARIABLE_NON_VOLATILE &&
338 ret == EFI_SUCCESS && efi_obj_list_initialized == EFI_SUCCESS)
339 efi_var_to_file();
340
341 return EFI_SUCCESS;
342 }
343
efi_query_variable_info_int(u32 attributes,u64 * maximum_variable_storage_size,u64 * remaining_variable_storage_size,u64 * maximum_variable_size)344 efi_status_t efi_query_variable_info_int(u32 attributes,
345 u64 *maximum_variable_storage_size,
346 u64 *remaining_variable_storage_size,
347 u64 *maximum_variable_size)
348 {
349 *maximum_variable_storage_size = EFI_VAR_BUF_SIZE -
350 sizeof(struct efi_var_file);
351 *remaining_variable_storage_size = efi_var_mem_free();
352 *maximum_variable_size = EFI_VAR_BUF_SIZE -
353 sizeof(struct efi_var_file) -
354 sizeof(struct efi_var_entry);
355 return EFI_SUCCESS;
356 }
357
358 /**
359 * efi_query_variable_info_runtime() - runtime implementation of
360 * QueryVariableInfo()
361 *
362 * @attributes: bitmask to select variables to be
363 * queried
364 * @maximum_variable_storage_size: maximum size of storage area for the
365 * selected variable types
366 * @remaining_variable_storage_size: remaining size of storage are for the
367 * selected variable types
368 * @maximum_variable_size: maximum size of a variable of the
369 * selected type
370 * Returns: status code
371 */
efi_query_variable_info_runtime(u32 attributes,u64 * maximum_variable_storage_size,u64 * remaining_variable_storage_size,u64 * maximum_variable_size)372 efi_status_t __efi_runtime EFIAPI efi_query_variable_info_runtime(
373 u32 attributes,
374 u64 *maximum_variable_storage_size,
375 u64 *remaining_variable_storage_size,
376 u64 *maximum_variable_size)
377 {
378 return EFI_UNSUPPORTED;
379 }
380
381 /**
382 * efi_set_variable_runtime() - runtime implementation of SetVariable()
383 *
384 * @variable_name: name of the variable
385 * @vendor: vendor GUID
386 * @attributes: attributes of the variable
387 * @data_size: size of the buffer with the variable value
388 * @data: buffer with the variable value
389 * Return: status code
390 */
391 static efi_status_t __efi_runtime EFIAPI
efi_set_variable_runtime(u16 * variable_name,const efi_guid_t * vendor,u32 attributes,efi_uintn_t data_size,const void * data)392 efi_set_variable_runtime(u16 *variable_name, const efi_guid_t *vendor,
393 u32 attributes, efi_uintn_t data_size,
394 const void *data)
395 {
396 return EFI_UNSUPPORTED;
397 }
398
399 /**
400 * efi_variables_boot_exit_notify() - notify ExitBootServices() is called
401 */
efi_variables_boot_exit_notify(void)402 void efi_variables_boot_exit_notify(void)
403 {
404 /* Switch variable services functions to runtime version */
405 efi_runtime_services.get_variable = efi_get_variable_runtime;
406 efi_runtime_services.get_next_variable_name =
407 efi_get_next_variable_name_runtime;
408 efi_runtime_services.set_variable = efi_set_variable_runtime;
409 efi_runtime_services.query_variable_info =
410 efi_query_variable_info_runtime;
411 efi_update_table_header_crc32(&efi_runtime_services.hdr);
412 }
413
414 /**
415 * efi_init_variables() - initialize variable services
416 *
417 * Return: status code
418 */
efi_init_variables(void)419 efi_status_t efi_init_variables(void)
420 {
421 efi_status_t ret;
422
423 ret = efi_var_mem_init();
424 if (ret != EFI_SUCCESS)
425 return ret;
426
427 if (IS_ENABLED(CONFIG_EFI_VARIABLES_PRESEED)) {
428 ret = efi_var_restore((struct efi_var_file *)
429 __efi_var_file_begin);
430 if (ret != EFI_SUCCESS)
431 log_err("Invalid EFI variable seed\n");
432 }
433
434 ret = efi_var_from_file();
435 if (ret != EFI_SUCCESS)
436 return ret;
437
438 return efi_init_secure_state();
439 }
440