lib/efi_loader/efi_variable.c

   1 // SPDX-License-Identifier: GPL-2.0+
   2 /*
   3  * UEFI runtime variable services
   4  *
   5  * Copyright (c) 2017 Rob Clark
   6  */
   7
   8 #define LOG_CATEGORY LOGC_EFI
   9
  10 #include <common.h>
  11 #include <efi_loader.h>
  12 #include <efi_variable.h>
  13 #include <env.h>
  14 #include <env_internal.h>
  15 #include <hexdump.h>
  16 #include <log.h>
  17 #include <malloc.h>
  18 #include <rtc.h>
  19 #include <search.h>
  20 #include <uuid.h>
  21 #include <crypto/pkcs7_parser.h>
  22 #include <linux/compat.h>
  23 #include <u-boot/crc.h>
  24 #include <asm/sections.h>
  25
  26 #ifdef CONFIG_EFI_SECURE_BOOT
  27 static u8 pkcs7_hdr[] = {
  28         /* SEQUENCE */
  29         0x30, 0x82, 0x05, 0xc7,
  30         /* OID: pkcs7-signedData */
  31         0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x07, 0x02,
  32         /* Context Structured? */
  33         0xa0, 0x82, 0x05, 0xb8,
  34 };
  35
  36 /**
  37  * efi_variable_parse_signature - parse a signature in variable
  38  * @buf:        Pointer to variable's value
  39  * @buflen:     Length of @buf
  40  * @tmpbuf:     Pointer to temporary buffer
  41  *
  42  * Parse a signature embedded in variable's value and instantiate
  43  * a pkcs7_message structure. Since pkcs7_parse_message() accepts only
  44  * pkcs7's signedData, some header needed be prepended for correctly
  45  * parsing authentication data, particularly for variable's.
  46  * A temporary buffer will be allocated if needed, and it should be
  47  * kept valid during the authentication because some data in the buffer
  48  * will be referenced by efi_signature_verify().
  49  *
  50  * Return:      Pointer to pkcs7_message structure on success, NULL on error
  51  */
  52 static struct pkcs7_message *efi_variable_parse_signature(const void *buf,
  53                                                           size_t buflen,
  54                                                           u8 **tmpbuf)
  55 {
  56         u8 *ebuf;
  57         size_t ebuflen, len;
  58         struct pkcs7_message *msg;
  59
  60         /*
  61          * This is the best assumption to check if the binary is
  62          * already in a form of pkcs7's signedData.
  63          */
  64         if (buflen > sizeof(pkcs7_hdr) &&
  65             !memcmp(&((u8 *)buf)[4], &pkcs7_hdr[4], 11)) {
  66                 msg = pkcs7_parse_message(buf, buflen);
  67                 if (IS_ERR(msg))
  68                         return NULL;
  69                 return msg;
  70         }
  71
  72         /*
  73          * Otherwise, we should add a dummy prefix sequence for pkcs7
  74          * message parser to be able to process.
  75          * NOTE: EDK2 also uses similar hack in WrapPkcs7Data()
  76          * in CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyCommon.c
  77          * TODO:
  78          * The header should be composed in a more refined manner.
  79          */
  80         EFI_PRINT("Makeshift prefix added to authentication data\n");
  81         ebuflen = sizeof(pkcs7_hdr) + buflen;
  82         if (ebuflen <= 0x7f) {
  83                 EFI_PRINT("Data is too short\n");
  84                 return NULL;
  85         }
  86
  87         ebuf = malloc(ebuflen);
  88         if (!ebuf) {
  89                 EFI_PRINT("Out of memory\n");
  90                 return NULL;
  91         }
  92
  93         memcpy(ebuf, pkcs7_hdr, sizeof(pkcs7_hdr));
  94         memcpy(ebuf + sizeof(pkcs7_hdr), buf, buflen);
  95         len = ebuflen - 4;
  96         ebuf[2] = (len >> 8) & 0xff;
  97         ebuf[3] = len & 0xff;
  98         len = ebuflen - 0x13;
  99         ebuf[0x11] = (len >> 8) & 0xff;
 100         ebuf[0x12] = len & 0xff;
 101
 102         msg = pkcs7_parse_message(ebuf, ebuflen);
 103
 104         if (IS_ERR(msg)) {
 105                 free(ebuf);
 106                 return NULL;
 107         }
 108
 109         *tmpbuf = ebuf;
 110         return msg;
 111 }
 112
 113 /**
 114  * efi_variable_authenticate - authenticate a variable
 115  * @variable:   Variable name in u16
 116  * @vendor:     Guid of variable
 117  * @data_size:  Size of @data
 118  * @data:       Pointer to variable's value
 119  * @given_attr: Attributes to be given at SetVariable()
 120  * @env_attr:   Attributes that an existing variable holds
 121  * @time:       signed time that an existing variable holds
 122  *
 123  * Called by efi_set_variable() to verify that the input is correct.
 124  * Will replace the given data pointer with another that points to
 125  * the actual data to store in the internal memory.
 126  * On success, @data and @data_size will be replaced with variable's
 127  * actual data, excluding authentication data, and its size, and variable's
 128  * attributes and signed time will also be returned in @env_attr and @time,
 129  * respectively.
 130  *
 131  * Return:      status code
 132  */
 133 static efi_status_t efi_variable_authenticate(u16 *variable,
 134                                               const efi_guid_t *vendor,
 135                                               efi_uintn_t *data_size,
 136                                               const void **data, u32 given_attr,
 137                                               u32 *env_attr, u64 *time)
 138 {
 139         const struct efi_variable_authentication_2 *auth;
 140         struct efi_signature_store *truststore, *truststore2;
 141         struct pkcs7_message *var_sig;
 142         struct efi_image_regions *regs;
 143         struct efi_time timestamp;
 144         struct rtc_time tm;
 145         u64 new_time;
 146         u8 *ebuf;
 147         enum efi_auth_var_type var_type;
 148         efi_status_t ret;
 149
 150         var_sig = NULL;
 151         truststore = NULL;
 152         truststore2 = NULL;
 153         regs = NULL;
 154         ebuf = NULL;
 155         ret = EFI_SECURITY_VIOLATION;
 156
 157         if (*data_size < sizeof(struct efi_variable_authentication_2))
 158                 goto err;
 159
 160         /* authentication data */
 161         auth = *data;
 162         if (*data_size < (sizeof(auth->time_stamp)
 163                                 + auth->auth_info.hdr.dwLength))
 164                 goto err;
 165
 166         if (guidcmp(&auth->auth_info.cert_type, &efi_guid_cert_type_pkcs7))
 167                 goto err;
 168
 169         memcpy(&timestamp, &auth->time_stamp, sizeof(timestamp));
 170         if (timestamp.pad1 || timestamp.nanosecond || timestamp.timezone ||
 171             timestamp.daylight || timestamp.pad2)
 172                 goto err;
 173
 174         *data += sizeof(auth->time_stamp) + auth->auth_info.hdr.dwLength;
 175         *data_size -= (sizeof(auth->time_stamp)
 176                                 + auth->auth_info.hdr.dwLength);
 177
 178         memset(&tm, 0, sizeof(tm));
 179         tm.tm_year = timestamp.year;
 180         tm.tm_mon = timestamp.month;
 181         tm.tm_mday = timestamp.day;
 182         tm.tm_hour = timestamp.hour;
 183         tm.tm_min = timestamp.minute;
 184         tm.tm_sec = timestamp.second;
 185         new_time = rtc_mktime(&tm);
 186
 187         if (!efi_secure_boot_enabled()) {
 188                 /* finished checking */
 189                 *time = new_time;
 190                 return EFI_SUCCESS;
 191         }
 192
 193         if (new_time <= *time)
 194                 goto err;
 195
 196         /* data to be digested */
 197         regs = calloc(sizeof(*regs) + sizeof(struct image_region) * 5, 1);
 198         if (!regs)
 199                 goto err;
 200         regs->max = 5;
 201         efi_image_region_add(regs, (uint8_t *)variable,
 202                              (uint8_t *)variable
 203                                 + u16_strlen(variable) * sizeof(u16), 1);
 204         efi_image_region_add(regs, (uint8_t *)vendor,
 205                              (uint8_t *)vendor + sizeof(*vendor), 1);
 206         efi_image_region_add(regs, (uint8_t *)&given_attr,
 207                              (uint8_t *)&given_attr + sizeof(given_attr), 1);
 208         efi_image_region_add(regs, (uint8_t *)&timestamp,
 209                              (uint8_t *)&timestamp + sizeof(timestamp), 1);
 210         efi_image_region_add(regs, (uint8_t *)*data,
 211                              (uint8_t *)*data + *data_size, 1);
 212
 213         /* variable's signature list */
 214         if (auth->auth_info.hdr.dwLength < sizeof(auth->auth_info))
 215                 goto err;
 216
 217         /* ebuf should be kept valid during the authentication */
 218         var_sig = efi_variable_parse_signature(auth->auth_info.cert_data,
 219                                                auth->auth_info.hdr.dwLength
 220                                                    - sizeof(auth->auth_info),
 221                                                &ebuf);
 222         if (!var_sig) {
 223                 EFI_PRINT("Parsing variable's signature failed\n");
 224                 goto err;
 225         }
 226
 227         /* signature database used for authentication */
 228         var_type = efi_auth_var_get_type(variable, vendor);
 229         switch (var_type) {
 230         case EFI_AUTH_VAR_PK:
 231         case EFI_AUTH_VAR_KEK:
 232                 /* with PK */
 233                 truststore = efi_sigstore_parse_sigdb(L"PK");
 234                 if (!truststore)
 235                         goto err;
 236                 break;
 237         case EFI_AUTH_VAR_DB:
 238         case EFI_AUTH_VAR_DBX:
 239                 /* with PK and KEK */
 240                 truststore = efi_sigstore_parse_sigdb(L"KEK");
 241                 truststore2 = efi_sigstore_parse_sigdb(L"PK");
 242                 if (!truststore) {
 243                         if (!truststore2)
 244                                 goto err;
 245
 246                         truststore = truststore2;
 247                         truststore2 = NULL;
 248                 }
 249                 break;
 250         default:
 251                 /* TODO: support private authenticated variables */
 252                 goto err;
 253         }
 254
 255         /* verify signature */
 256         if (efi_signature_verify(regs, var_sig, truststore, NULL)) {
 257                 EFI_PRINT("Verified\n");
 258         } else {
 259                 if (truststore2 &&
 260                     efi_signature_verify(regs, var_sig, truststore2, NULL)) {
 261                         EFI_PRINT("Verified\n");
 262                 } else {
 263                         EFI_PRINT("Verifying variable's signature failed\n");
 264                         goto err;
 265                 }
 266         }
 267
 268         /* finished checking */
 269         *time = new_time;
 270         ret = EFI_SUCCESS;
 271
 272 err:
 273         efi_sigstore_free(truststore);
 274         efi_sigstore_free(truststore2);
 275         pkcs7_free_message(var_sig);
 276         free(ebuf);
 277         free(regs);
 278
 279         return ret;
 280 }
 281 #else
 282 static efi_status_t efi_variable_authenticate(u16 *variable,
 283                                               const efi_guid_t *vendor,
 284                                               efi_uintn_t *data_size,
 285                                               const void **data, u32 given_attr,
 286                                               u32 *env_attr, u64 *time)
 287 {
 288         return EFI_SUCCESS;
 289 }
 290 #endif /* CONFIG_EFI_SECURE_BOOT */
 291
 292 efi_status_t __efi_runtime
 293 efi_get_variable_int(u16 *variable_name, const efi_guid_t *vendor,
 294                      u32 *attributes, efi_uintn_t *data_size, void *data,
 295                      u64 *timep)
 296 {
 297         return efi_get_variable_mem(variable_name, vendor, attributes, data_size, data, timep);
 298 }
 299
 300 efi_status_t __efi_runtime
 301 efi_get_next_variable_name_int(efi_uintn_t *variable_name_size,
 302                                u16 *variable_name, efi_guid_t *vendor)
 303 {
 304         return efi_get_next_variable_name_mem(variable_name_size, variable_name, vendor);
 305 }
 306
 307 efi_status_t efi_set_variable_int(u16 *variable_name, const efi_guid_t *vendor,
 308                                   u32 attributes, efi_uintn_t data_size,
 309                                   const void *data, bool ro_check)
 310 {
 311         struct efi_var_entry *var;
 312         efi_uintn_t ret;
 313         bool append, delete;
 314         u64 time = 0;
 315         enum efi_auth_var_type var_type;
 316
 317         if (!variable_name || !*variable_name || !vendor ||
 318             ((attributes & EFI_VARIABLE_RUNTIME_ACCESS) &&
 319              !(attributes & EFI_VARIABLE_BOOTSERVICE_ACCESS)))
 320                 return EFI_INVALID_PARAMETER;
 321
 322         /* check if a variable exists */
 323         var = efi_var_mem_find(vendor, variable_name, NULL);
 324         append = !!(attributes & EFI_VARIABLE_APPEND_WRITE);
 325         attributes &= ~(u32)EFI_VARIABLE_APPEND_WRITE;
 326         delete = !append && (!data_size || !attributes);
 327
 328         /* check attributes */
 329         var_type = efi_auth_var_get_type(variable_name, vendor);
 330         if (var) {
 331                 if (ro_check && (var->attr & EFI_VARIABLE_READ_ONLY))
 332                         return EFI_WRITE_PROTECTED;
 333
 334                 if (IS_ENABLED(CONFIG_EFI_VARIABLES_PRESEED)) {
 335                         if (var_type != EFI_AUTH_VAR_NONE)
 336                                 return EFI_WRITE_PROTECTED;
 337                 }
 338
 339                 /* attributes won't be changed */
 340                 if (!delete &&
 341                     ((ro_check && var->attr != attributes) ||
 342                      (!ro_check && ((var->attr & ~(u32)EFI_VARIABLE_READ_ONLY)
 343                                     != (attributes & ~(u32)EFI_VARIABLE_READ_ONLY))))) {
 344                         return EFI_INVALID_PARAMETER;
 345                 }
 346                 time = var->time;
 347         } else {
 348                 if (delete || append)
 349                         /*
 350                          * Trying to delete or to update a non-existent
 351                          * variable.
 352                          */
 353                         return EFI_NOT_FOUND;
 354         }
 355
 356         if (var_type != EFI_AUTH_VAR_NONE) {
 357                 /* authentication is mandatory */
 358                 if (!(attributes &
 359                       EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) {
 360                         EFI_PRINT("%ls: TIME_BASED_AUTHENTICATED_WRITE_ACCESS required\n",
 361                                   variable_name);
 362                         return EFI_INVALID_PARAMETER;
 363                 }
 364         }
 365
 366         /* authenticate a variable */
 367         if (IS_ENABLED(CONFIG_EFI_SECURE_BOOT)) {
 368                 if (attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS)
 369                         return EFI_INVALID_PARAMETER;
 370                 if (attributes &
 371                     EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) {
 372                         u32 env_attr;
 373
 374                         ret = efi_variable_authenticate(variable_name, vendor,
 375                                                         &data_size, &data,
 376                                                         attributes, &env_attr,
 377                                                         &time);
 378                         if (ret != EFI_SUCCESS)
 379                                 return ret;
 380
 381                         /* last chance to check for delete */
 382                         if (!data_size)
 383                                 delete = true;
 384                 }
 385         } else {
 386                 if (attributes &
 387                     (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS |
 388                      EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) {
 389                         EFI_PRINT("Secure boot is not configured\n");
 390                         return EFI_INVALID_PARAMETER;
 391                 }
 392         }
 393
 394         if (delete) {
 395                 /* EFI_NOT_FOUND has been handled before */
 396                 ret = EFI_SUCCESS;
 397         } else if (append) {
 398                 u16 *old_data = var->name;
 399
 400                 for (; *old_data; ++old_data)
 401                         ;
 402                 ++old_data;
 403                 ret = efi_var_mem_ins(variable_name, vendor, attributes,
 404                                       var->length, old_data, data_size, data,
 405                                       time);
 406         } else {
 407                 ret = efi_var_mem_ins(variable_name, vendor, attributes,
 408                                       data_size, data, 0, NULL, time);
 409         }
 410         efi_var_mem_del(var);
 411
 412         if (ret != EFI_SUCCESS)
 413                 return ret;
 414
 415         if (var_type == EFI_AUTH_VAR_PK)
 416                 ret = efi_init_secure_state();
 417         else
 418                 ret = EFI_SUCCESS;
 419
 420         /* Write non-volatile EFI variables to file */
 421         if (attributes & EFI_VARIABLE_NON_VOLATILE &&
 422             ret == EFI_SUCCESS && efi_obj_list_initialized == EFI_SUCCESS)
 423                 efi_var_to_file();
 424
 425         return EFI_SUCCESS;
 426 }
 427
 428 efi_status_t efi_query_variable_info_int(u32 attributes,
 429                                          u64 *maximum_variable_storage_size,
 430                                          u64 *remaining_variable_storage_size,
 431                                          u64 *maximum_variable_size)
 432 {
 433         *maximum_variable_storage_size = EFI_VAR_BUF_SIZE -
 434                                          sizeof(struct efi_var_file);
 435         *remaining_variable_storage_size = efi_var_mem_free();
 436         *maximum_variable_size = EFI_VAR_BUF_SIZE -
 437                                  sizeof(struct efi_var_file) -
 438                                  sizeof(struct efi_var_entry);
 439         return EFI_SUCCESS;
 440 }
 441
 442 /**
 443  * efi_query_variable_info_runtime() - runtime implementation of
 444  *                                     QueryVariableInfo()
 445  *
 446  * @attributes:                         bitmask to select variables to be
 447  *                                      queried
 448  * @maximum_variable_storage_size:      maximum size of storage area for the
 449  *                                      selected variable types
 450  * @remaining_variable_storage_size:    remaining size of storage are for the
 451  *                                      selected variable types
 452  * @maximum_variable_size:              maximum size of a variable of the
 453  *                                      selected type
 454  * Returns:                             status code
 455  */
 456 efi_status_t __efi_runtime EFIAPI efi_query_variable_info_runtime(
 457                         u32 attributes,
 458                         u64 *maximum_variable_storage_size,
 459                         u64 *remaining_variable_storage_size,
 460                         u64 *maximum_variable_size)
 461 {
 462         return EFI_UNSUPPORTED;
 463 }
 464
 465 /**
 466  * efi_set_variable_runtime() - runtime implementation of SetVariable()
 467  *
 468  * @variable_name:      name of the variable
 469  * @vendor:             vendor GUID
 470  * @attributes:         attributes of the variable
 471  * @data_size:          size of the buffer with the variable value
 472  * @data:               buffer with the variable value
 473  * Return:              status code
 474  */
 475 static efi_status_t __efi_runtime EFIAPI
 476 efi_set_variable_runtime(u16 *variable_name, const efi_guid_t *vendor,
 477                          u32 attributes, efi_uintn_t data_size,
 478                          const void *data)
 479 {
 480         return EFI_UNSUPPORTED;
 481 }
 482
 483 /**
 484  * efi_variables_boot_exit_notify() - notify ExitBootServices() is called
 485  */
 486 void efi_variables_boot_exit_notify(void)
 487 {
 488         /* Switch variable services functions to runtime version */
 489         efi_runtime_services.get_variable = efi_get_variable_runtime;
 490         efi_runtime_services.get_next_variable_name =
 491                                 efi_get_next_variable_name_runtime;
 492         efi_runtime_services.set_variable = efi_set_variable_runtime;
 493         efi_runtime_services.query_variable_info =
 494                                 efi_query_variable_info_runtime;
 495         efi_update_table_header_crc32(&efi_runtime_services.hdr);
 496 }
 497
 498 /**
 499  * efi_init_variables() - initialize variable services
 500  *
 501  * Return:      status code
 502  */
 503 efi_status_t efi_init_variables(void)
 504 {
 505         efi_status_t ret;
 506
 507         ret = efi_var_mem_init();
 508         if (ret != EFI_SUCCESS)
 509                 return ret;
 510
 511         if (IS_ENABLED(CONFIG_EFI_VARIABLES_PRESEED)) {
 512                 ret = efi_var_restore((struct efi_var_file *)
 513                                       __efi_var_file_begin);
 514                 if (ret != EFI_SUCCESS)
 515                         log_err("Invalid EFI variable seed\n");
 516         }
 517
 518         ret = efi_var_from_file();
 519         if (ret != EFI_SUCCESS)
 520                 return ret;
 521
 522         return efi_init_secure_state();
 523 }