lib/efi_loader/efi_variable.c

   1 // SPDX-License-Identifier: GPL-2.0+
   2 /*
   3  * UEFI runtime variable services
   4  *
   5  * Copyright (c) 2017 Rob Clark
   6  */
   7
   8 #define LOG_CATEGORY LOGC_EFI
   9
  10 #include <common.h>
  11 #include <efi_loader.h>
  12 #include <efi_variable.h>
  13 #include <env.h>
  14 #include <env_internal.h>
  15 #include <hexdump.h>
  16 #include <log.h>
  17 #include <malloc.h>
  18 #include <rtc.h>
  19 #include <search.h>
  20 #include <uuid.h>
  21 #include <crypto/pkcs7_parser.h>
  22 #include <linux/compat.h>
  23 #include <u-boot/crc.h>
  24 #include <asm/sections.h>
  25
  26 #ifdef CONFIG_EFI_SECURE_BOOT
  27
  28 /**
  29  * efi_variable_authenticate - authenticate a variable
  30  * @variable:   Variable name in u16
  31  * @vendor:     Guid of variable
  32  * @data_size:  Size of @data
  33  * @data:       Pointer to variable's value
  34  * @given_attr: Attributes to be given at SetVariable()
  35  * @env_attr:   Attributes that an existing variable holds
  36  * @time:       signed time that an existing variable holds
  37  *
  38  * Called by efi_set_variable() to verify that the input is correct.
  39  * Will replace the given data pointer with another that points to
  40  * the actual data to store in the internal memory.
  41  * On success, @data and @data_size will be replaced with variable's
  42  * actual data, excluding authentication data, and its size, and variable's
  43  * attributes and signed time will also be returned in @env_attr and @time,
  44  * respectively.
  45  *
  46  * Return:      status code
  47  */
  48 static efi_status_t efi_variable_authenticate(const u16 *variable,
  49                                               const efi_guid_t *vendor,
  50                                               efi_uintn_t *data_size,
  51                                               const void **data, u32 given_attr,
  52                                               u32 *env_attr, u64 *time)
  53 {
  54         const struct efi_variable_authentication_2 *auth;
  55         struct efi_signature_store *truststore, *truststore2;
  56         struct pkcs7_message *var_sig;
  57         struct efi_image_regions *regs;
  58         struct efi_time timestamp;
  59         struct rtc_time tm;
  60         u64 new_time;
  61         u8 *ebuf;
  62         enum efi_auth_var_type var_type;
  63         efi_status_t ret;
  64
  65         var_sig = NULL;
  66         truststore = NULL;
  67         truststore2 = NULL;
  68         regs = NULL;
  69         ebuf = NULL;
  70         ret = EFI_SECURITY_VIOLATION;
  71
  72         if (*data_size < sizeof(struct efi_variable_authentication_2))
  73                 goto err;
  74
  75         /* authentication data */
  76         auth = *data;
  77         if (*data_size < (sizeof(auth->time_stamp)
  78                                 + auth->auth_info.hdr.dwLength))
  79                 goto err;
  80
  81         if (guidcmp(&auth->auth_info.cert_type, &efi_guid_cert_type_pkcs7))
  82                 goto err;
  83
  84         memcpy(&timestamp, &auth->time_stamp, sizeof(timestamp));
  85         if (timestamp.pad1 || timestamp.nanosecond || timestamp.timezone ||
  86             timestamp.daylight || timestamp.pad2)
  87                 goto err;
  88
  89         *data += sizeof(auth->time_stamp) + auth->auth_info.hdr.dwLength;
  90         *data_size -= (sizeof(auth->time_stamp)
  91                                 + auth->auth_info.hdr.dwLength);
  92
  93         memset(&tm, 0, sizeof(tm));
  94         tm.tm_year = timestamp.year;
  95         tm.tm_mon = timestamp.month;
  96         tm.tm_mday = timestamp.day;
  97         tm.tm_hour = timestamp.hour;
  98         tm.tm_min = timestamp.minute;
  99         tm.tm_sec = timestamp.second;
 100         new_time = rtc_mktime(&tm);
 101
 102         if (!efi_secure_boot_enabled()) {
 103                 /* finished checking */
 104                 *time = new_time;
 105                 return EFI_SUCCESS;
 106         }
 107
 108         if (new_time <= *time)
 109                 goto err;
 110
 111         /* data to be digested */
 112         regs = calloc(sizeof(*regs) + sizeof(struct image_region) * 5, 1);
 113         if (!regs)
 114                 goto err;
 115         regs->max = 5;
 116         efi_image_region_add(regs, (uint8_t *)variable,
 117                              (uint8_t *)variable
 118                                 + u16_strlen(variable) * sizeof(u16), 1);
 119         efi_image_region_add(regs, (uint8_t *)vendor,
 120                              (uint8_t *)vendor + sizeof(*vendor), 1);
 121         efi_image_region_add(regs, (uint8_t *)&given_attr,
 122                              (uint8_t *)&given_attr + sizeof(given_attr), 1);
 123         efi_image_region_add(regs, (uint8_t *)&timestamp,
 124                              (uint8_t *)&timestamp + sizeof(timestamp), 1);
 125         efi_image_region_add(regs, (uint8_t *)*data,
 126                              (uint8_t *)*data + *data_size, 1);
 127
 128         /* variable's signature list */
 129         if (auth->auth_info.hdr.dwLength < sizeof(auth->auth_info))
 130                 goto err;
 131
 132         /* ebuf should be kept valid during the authentication */
 133         var_sig = efi_parse_pkcs7_header(auth->auth_info.cert_data,
 134                                          auth->auth_info.hdr.dwLength
 135                                          - sizeof(auth->auth_info),
 136                                          &ebuf);
 137         if (!var_sig) {
 138                 EFI_PRINT("Parsing variable's signature failed\n");
 139                 goto err;
 140         }
 141
 142         /* signature database used for authentication */
 143         var_type = efi_auth_var_get_type(variable, vendor);
 144         switch (var_type) {
 145         case EFI_AUTH_VAR_PK:
 146         case EFI_AUTH_VAR_KEK:
 147                 /* with PK */
 148                 truststore = efi_sigstore_parse_sigdb(u"PK");
 149                 if (!truststore)
 150                         goto err;
 151                 break;
 152         case EFI_AUTH_VAR_DB:
 153         case EFI_AUTH_VAR_DBX:
 154                 /* with PK and KEK */
 155                 truststore = efi_sigstore_parse_sigdb(u"KEK");
 156                 truststore2 = efi_sigstore_parse_sigdb(u"PK");
 157                 if (!truststore) {
 158                         if (!truststore2)
 159                                 goto err;
 160
 161                         truststore = truststore2;
 162                         truststore2 = NULL;
 163                 }
 164                 break;
 165         default:
 166                 /* TODO: support private authenticated variables */
 167                 goto err;
 168         }
 169
 170         /* verify signature */
 171         if (efi_signature_verify(regs, var_sig, truststore, NULL)) {
 172                 EFI_PRINT("Verified\n");
 173         } else {
 174                 if (truststore2 &&
 175                     efi_signature_verify(regs, var_sig, truststore2, NULL)) {
 176                         EFI_PRINT("Verified\n");
 177                 } else {
 178                         EFI_PRINT("Verifying variable's signature failed\n");
 179                         goto err;
 180                 }
 181         }
 182
 183         /* finished checking */
 184         *time = new_time;
 185         ret = EFI_SUCCESS;
 186
 187 err:
 188         efi_sigstore_free(truststore);
 189         efi_sigstore_free(truststore2);
 190         pkcs7_free_message(var_sig);
 191         free(ebuf);
 192         free(regs);
 193
 194         return ret;
 195 }
 196 #else
 197 static efi_status_t efi_variable_authenticate(const u16 *variable,
 198                                               const efi_guid_t *vendor,
 199                                               efi_uintn_t *data_size,
 200                                               const void **data, u32 given_attr,
 201                                               u32 *env_attr, u64 *time)
 202 {
 203         return EFI_SUCCESS;
 204 }
 205 #endif /* CONFIG_EFI_SECURE_BOOT */
 206
 207 efi_status_t __efi_runtime
 208 efi_get_variable_int(const u16 *variable_name, const efi_guid_t *vendor,
 209                      u32 *attributes, efi_uintn_t *data_size, void *data,
 210                      u64 *timep)
 211 {
 212         return efi_get_variable_mem(variable_name, vendor, attributes, data_size, data, timep);
 213 }
 214
 215 efi_status_t __efi_runtime
 216 efi_get_next_variable_name_int(efi_uintn_t *variable_name_size,
 217                                u16 *variable_name, efi_guid_t *vendor)
 218 {
 219         return efi_get_next_variable_name_mem(variable_name_size, variable_name, vendor);
 220 }
 221
 222 efi_status_t efi_set_variable_int(const u16 *variable_name,
 223                                   const efi_guid_t *vendor,
 224                                   u32 attributes, efi_uintn_t data_size,
 225                                   const void *data, bool ro_check)
 226 {
 227         struct efi_var_entry *var;
 228         efi_uintn_t ret;
 229         bool append, delete;
 230         u64 time = 0;
 231         enum efi_auth_var_type var_type;
 232
 233         if (!variable_name || !*variable_name || !vendor ||
 234             ((attributes & EFI_VARIABLE_RUNTIME_ACCESS) &&
 235              !(attributes & EFI_VARIABLE_BOOTSERVICE_ACCESS)))
 236                 return EFI_INVALID_PARAMETER;
 237
 238         /* check if a variable exists */
 239         var = efi_var_mem_find(vendor, variable_name, NULL);
 240         append = !!(attributes & EFI_VARIABLE_APPEND_WRITE);
 241         attributes &= ~(u32)EFI_VARIABLE_APPEND_WRITE;
 242         delete = !append && (!data_size || !attributes);
 243
 244         /* check attributes */
 245         var_type = efi_auth_var_get_type(variable_name, vendor);
 246         if (var) {
 247                 if (ro_check && (var->attr & EFI_VARIABLE_READ_ONLY))
 248                         return EFI_WRITE_PROTECTED;
 249
 250                 if (IS_ENABLED(CONFIG_EFI_VARIABLES_PRESEED)) {
 251                         if (var_type >= EFI_AUTH_VAR_PK)
 252                                 return EFI_WRITE_PROTECTED;
 253                 }
 254
 255                 /* attributes won't be changed */
 256                 if (!delete &&
 257                     ((ro_check && var->attr != attributes) ||
 258                      (!ro_check && ((var->attr & ~(u32)EFI_VARIABLE_READ_ONLY)
 259                                     != (attributes & ~(u32)EFI_VARIABLE_READ_ONLY))))) {
 260                         return EFI_INVALID_PARAMETER;
 261                 }
 262                 time = var->time;
 263         } else {
 264                 if (delete || append)
 265                         /*
 266                          * Trying to delete or to update a non-existent
 267                          * variable.
 268                          */
 269                         return EFI_NOT_FOUND;
 270         }
 271
 272         if (var_type >= EFI_AUTH_VAR_PK) {
 273                 /* authentication is mandatory */
 274                 if (!(attributes &
 275                       EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) {
 276                         EFI_PRINT("%ls: TIME_BASED_AUTHENTICATED_WRITE_ACCESS required\n",
 277                                   variable_name);
 278                         return EFI_INVALID_PARAMETER;
 279                 }
 280         }
 281
 282         /* authenticate a variable */
 283         if (IS_ENABLED(CONFIG_EFI_SECURE_BOOT)) {
 284                 if (attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS)
 285                         return EFI_INVALID_PARAMETER;
 286                 if (attributes &
 287                     EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) {
 288                         u32 env_attr;
 289
 290                         ret = efi_variable_authenticate(variable_name, vendor,
 291                                                         &data_size, &data,
 292                                                         attributes, &env_attr,
 293                                                         &time);
 294                         if (ret != EFI_SUCCESS)
 295                                 return ret;
 296
 297                         /* last chance to check for delete */
 298                         if (!data_size)
 299                                 delete = true;
 300                 }
 301         } else {
 302                 if (attributes &
 303                     (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS |
 304                      EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) {
 305                         EFI_PRINT("Secure boot is not configured\n");
 306                         return EFI_INVALID_PARAMETER;
 307                 }
 308         }
 309
 310         if (delete) {
 311                 /* EFI_NOT_FOUND has been handled before */
 312                 attributes = var->attr;
 313                 ret = EFI_SUCCESS;
 314         } else if (append) {
 315                 u16 *old_data = var->name;
 316
 317                 for (; *old_data; ++old_data)
 318                         ;
 319                 ++old_data;
 320                 ret = efi_var_mem_ins(variable_name, vendor, attributes,
 321                                       var->length, old_data, data_size, data,
 322                                       time);
 323         } else {
 324                 ret = efi_var_mem_ins(variable_name, vendor, attributes,
 325                                       data_size, data, 0, NULL, time);
 326         }
 327         efi_var_mem_del(var);
 328
 329         if (ret != EFI_SUCCESS)
 330                 return ret;
 331
 332         if (var_type == EFI_AUTH_VAR_PK)
 333                 ret = efi_init_secure_state();
 334         else
 335                 ret = EFI_SUCCESS;
 336
 337         /*
 338          * Write non-volatile EFI variables to file
 339          * TODO: check if a value change has occured to avoid superfluous writes
 340          */
 341         if (attributes & EFI_VARIABLE_NON_VOLATILE)
 342                 efi_var_to_file();
 343
 344         return EFI_SUCCESS;
 345 }
 346
 347 efi_status_t efi_query_variable_info_int(u32 attributes,
 348                                          u64 *maximum_variable_storage_size,
 349                                          u64 *remaining_variable_storage_size,
 350                                          u64 *maximum_variable_size)
 351 {
 352         if (attributes == 0)
 353                 return EFI_INVALID_PARAMETER;
 354
 355         /* EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS is deprecated */
 356         if ((attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) ||
 357             ((attributes & EFI_VARIABLE_MASK) == 0))
 358                 return EFI_UNSUPPORTED;
 359
 360         if ((attributes & EFI_VARIABLE_MASK) == EFI_VARIABLE_NON_VOLATILE)
 361                 return EFI_INVALID_PARAMETER;
 362
 363         /* Make sure if runtime bit is set, boot service bit is set also. */
 364         if ((attributes &
 365              (EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS)) ==
 366             EFI_VARIABLE_RUNTIME_ACCESS)
 367                 return EFI_INVALID_PARAMETER;
 368
 369         if (attributes & ~(u32)EFI_VARIABLE_MASK)
 370                 return EFI_INVALID_PARAMETER;
 371
 372         *maximum_variable_storage_size = EFI_VAR_BUF_SIZE -
 373                                          sizeof(struct efi_var_file);
 374         *remaining_variable_storage_size = efi_var_mem_free();
 375         *maximum_variable_size = EFI_VAR_BUF_SIZE -
 376                                  sizeof(struct efi_var_file) -
 377                                  sizeof(struct efi_var_entry);
 378         return EFI_SUCCESS;
 379 }
 380
 381 /**
 382  * efi_query_variable_info_runtime() - runtime implementation of
 383  *                                     QueryVariableInfo()
 384  *
 385  * @attributes:                         bitmask to select variables to be
 386  *                                      queried
 387  * @maximum_variable_storage_size:      maximum size of storage area for the
 388  *                                      selected variable types
 389  * @remaining_variable_storage_size:    remaining size of storage are for the
 390  *                                      selected variable types
 391  * @maximum_variable_size:              maximum size of a variable of the
 392  *                                      selected type
 393  * Returns:                             status code
 394  */
 395 static efi_status_t __efi_runtime EFIAPI efi_query_variable_info_runtime(
 396                         u32 attributes,
 397                         u64 *maximum_variable_storage_size,
 398                         u64 *remaining_variable_storage_size,
 399                         u64 *maximum_variable_size)
 400 {
 401         return EFI_UNSUPPORTED;
 402 }
 403
 404 /**
 405  * efi_set_variable_runtime() - runtime implementation of SetVariable()
 406  *
 407  * @variable_name:      name of the variable
 408  * @vendor:             vendor GUID
 409  * @attributes:         attributes of the variable
 410  * @data_size:          size of the buffer with the variable value
 411  * @data:               buffer with the variable value
 412  * Return:              status code
 413  */
 414 static efi_status_t __efi_runtime EFIAPI
 415 efi_set_variable_runtime(u16 *variable_name, const efi_guid_t *vendor,
 416                          u32 attributes, efi_uintn_t data_size,
 417                          const void *data)
 418 {
 419         return EFI_UNSUPPORTED;
 420 }
 421
 422 /**
 423  * efi_variables_boot_exit_notify() - notify ExitBootServices() is called
 424  */
 425 void efi_variables_boot_exit_notify(void)
 426 {
 427         /* Switch variable services functions to runtime version */
 428         efi_runtime_services.get_variable = efi_get_variable_runtime;
 429         efi_runtime_services.get_next_variable_name =
 430                                 efi_get_next_variable_name_runtime;
 431         efi_runtime_services.set_variable = efi_set_variable_runtime;
 432         efi_runtime_services.query_variable_info =
 433                                 efi_query_variable_info_runtime;
 434         efi_update_table_header_crc32(&efi_runtime_services.hdr);
 435 }
 436
 437 /**
 438  * efi_init_variables() - initialize variable services
 439  *
 440  * Return:      status code
 441  */
 442 efi_status_t efi_init_variables(void)
 443 {
 444         efi_status_t ret;
 445
 446         ret = efi_var_mem_init();
 447         if (ret != EFI_SUCCESS)
 448                 return ret;
 449
 450         ret = efi_var_from_file();
 451         if (ret != EFI_SUCCESS)
 452                 return ret;
 453         if (IS_ENABLED(CONFIG_EFI_VARIABLES_PRESEED)) {
 454                 ret = efi_var_restore((struct efi_var_file *)
 455                                       __efi_var_file_begin, true);
 456                 if (ret != EFI_SUCCESS)
 457                         log_err("Invalid EFI variable seed\n");
 458         }
 459
 460
 461         return efi_init_secure_state();
 462 }