lib/efi_loader/efi_variable.c

   1 // SPDX-License-Identifier: GPL-2.0+
   2 /*
   3  * UEFI runtime variable services
   4  *
   5  * Copyright (c) 2017 Rob Clark
   6  */
   7
   8 #define LOG_CATEGORY LOGC_EFI
   9
  10 #include <common.h>
  11 #include <efi_loader.h>
  12 #include <efi_variable.h>
  13 #include <env.h>
  14 #include <env_internal.h>
  15 #include <hexdump.h>
  16 #include <log.h>
  17 #include <malloc.h>
  18 #include <rtc.h>
  19 #include <search.h>
  20 #include <uuid.h>
  21 #include <crypto/pkcs7_parser.h>
  22 #include <linux/compat.h>
  23 #include <u-boot/crc.h>
  24 #include <asm/sections.h>
  25
  26 #ifdef CONFIG_EFI_SECURE_BOOT
  27
  28 /**
  29  * efi_variable_authenticate - authenticate a variable
  30  * @variable:   Variable name in u16
  31  * @vendor:     Guid of variable
  32  * @data_size:  Size of @data
  33  * @data:       Pointer to variable's value
  34  * @given_attr: Attributes to be given at SetVariable()
  35  * @env_attr:   Attributes that an existing variable holds
  36  * @time:       signed time that an existing variable holds
  37  *
  38  * Called by efi_set_variable() to verify that the input is correct.
  39  * Will replace the given data pointer with another that points to
  40  * the actual data to store in the internal memory.
  41  * On success, @data and @data_size will be replaced with variable's
  42  * actual data, excluding authentication data, and its size, and variable's
  43  * attributes and signed time will also be returned in @env_attr and @time,
  44  * respectively.
  45  *
  46  * Return:      status code
  47  */
  48 static efi_status_t efi_variable_authenticate(const u16 *variable,
  49                                               const efi_guid_t *vendor,
  50                                               efi_uintn_t *data_size,
  51                                               const void **data, u32 given_attr,
  52                                               u32 *env_attr, u64 *time)
  53 {
  54         const struct efi_variable_authentication_2 *auth;
  55         struct efi_signature_store *truststore, *truststore2;
  56         struct pkcs7_message *var_sig;
  57         struct efi_image_regions *regs;
  58         struct efi_time timestamp;
  59         struct rtc_time tm;
  60         u64 new_time;
  61         u8 *ebuf;
  62         enum efi_auth_var_type var_type;
  63         efi_status_t ret;
  64
  65         var_sig = NULL;
  66         truststore = NULL;
  67         truststore2 = NULL;
  68         regs = NULL;
  69         ebuf = NULL;
  70         ret = EFI_SECURITY_VIOLATION;
  71
  72         if (*data_size < sizeof(struct efi_variable_authentication_2))
  73                 goto err;
  74
  75         /* authentication data */
  76         auth = *data;
  77         if (*data_size < (sizeof(auth->time_stamp)
  78                                 + auth->auth_info.hdr.dwLength))
  79                 goto err;
  80
  81         if (guidcmp(&auth->auth_info.cert_type, &efi_guid_cert_type_pkcs7))
  82                 goto err;
  83
  84         memcpy(&timestamp, &auth->time_stamp, sizeof(timestamp));
  85         if (timestamp.pad1 || timestamp.nanosecond || timestamp.timezone ||
  86             timestamp.daylight || timestamp.pad2)
  87                 goto err;
  88
  89         *data += sizeof(auth->time_stamp) + auth->auth_info.hdr.dwLength;
  90         *data_size -= (sizeof(auth->time_stamp)
  91                                 + auth->auth_info.hdr.dwLength);
  92
  93         memset(&tm, 0, sizeof(tm));
  94         tm.tm_year = timestamp.year;
  95         tm.tm_mon = timestamp.month;
  96         tm.tm_mday = timestamp.day;
  97         tm.tm_hour = timestamp.hour;
  98         tm.tm_min = timestamp.minute;
  99         tm.tm_sec = timestamp.second;
 100         new_time = rtc_mktime(&tm);
 101
 102         if (!efi_secure_boot_enabled()) {
 103                 /* finished checking */
 104                 *time = new_time;
 105                 return EFI_SUCCESS;
 106         }
 107
 108         if (new_time <= *time)
 109                 goto err;
 110
 111         /* data to be digested */
 112         regs = calloc(sizeof(*regs) + sizeof(struct image_region) * 5, 1);
 113         if (!regs)
 114                 goto err;
 115         regs->max = 5;
 116         efi_image_region_add(regs, (uint8_t *)variable,
 117                              (uint8_t *)variable
 118                                 + u16_strlen(variable) * sizeof(u16), 1);
 119         efi_image_region_add(regs, (uint8_t *)vendor,
 120                              (uint8_t *)vendor + sizeof(*vendor), 1);
 121         efi_image_region_add(regs, (uint8_t *)&given_attr,
 122                              (uint8_t *)&given_attr + sizeof(given_attr), 1);
 123         efi_image_region_add(regs, (uint8_t *)&timestamp,
 124                              (uint8_t *)&timestamp + sizeof(timestamp), 1);
 125         efi_image_region_add(regs, (uint8_t *)*data,
 126                              (uint8_t *)*data + *data_size, 1);
 127
 128         /* variable's signature list */
 129         if (auth->auth_info.hdr.dwLength < sizeof(auth->auth_info))
 130                 goto err;
 131
 132         /* ebuf should be kept valid during the authentication */
 133         var_sig = efi_parse_pkcs7_header(auth->auth_info.cert_data,
 134                                          auth->auth_info.hdr.dwLength
 135                                          - sizeof(auth->auth_info),
 136                                          &ebuf);
 137         if (!var_sig) {
 138                 EFI_PRINT("Parsing variable's signature failed\n");
 139                 goto err;
 140         }
 141
 142         /* signature database used for authentication */
 143         var_type = efi_auth_var_get_type(variable, vendor);
 144         switch (var_type) {
 145         case EFI_AUTH_VAR_PK:
 146         case EFI_AUTH_VAR_KEK:
 147                 /* with PK */
 148                 truststore = efi_sigstore_parse_sigdb(u"PK");
 149                 if (!truststore)
 150                         goto err;
 151                 break;
 152         case EFI_AUTH_VAR_DB:
 153         case EFI_AUTH_VAR_DBX:
 154                 /* with PK and KEK */
 155                 truststore = efi_sigstore_parse_sigdb(u"KEK");
 156                 truststore2 = efi_sigstore_parse_sigdb(u"PK");
 157                 if (!truststore) {
 158                         if (!truststore2)
 159                                 goto err;
 160
 161                         truststore = truststore2;
 162                         truststore2 = NULL;
 163                 }
 164                 break;
 165         default:
 166                 /* TODO: support private authenticated variables */
 167                 goto err;
 168         }
 169
 170         /* verify signature */
 171         if (efi_signature_verify(regs, var_sig, truststore, NULL)) {
 172                 EFI_PRINT("Verified\n");
 173         } else {
 174                 if (truststore2 &&
 175                     efi_signature_verify(regs, var_sig, truststore2, NULL)) {
 176                         EFI_PRINT("Verified\n");
 177                 } else {
 178                         EFI_PRINT("Verifying variable's signature failed\n");
 179                         goto err;
 180                 }
 181         }
 182
 183         /* finished checking */
 184         *time = new_time;
 185         ret = EFI_SUCCESS;
 186
 187 err:
 188         efi_sigstore_free(truststore);
 189         efi_sigstore_free(truststore2);
 190         pkcs7_free_message(var_sig);
 191         free(ebuf);
 192         free(regs);
 193
 194         return ret;
 195 }
 196 #else
 197 static efi_status_t efi_variable_authenticate(const u16 *variable,
 198                                               const efi_guid_t *vendor,
 199                                               efi_uintn_t *data_size,
 200                                               const void **data, u32 given_attr,
 201                                               u32 *env_attr, u64 *time)
 202 {
 203         return EFI_SUCCESS;
 204 }
 205 #endif /* CONFIG_EFI_SECURE_BOOT */
 206
 207 efi_status_t __efi_runtime
 208 efi_get_variable_int(const u16 *variable_name, const efi_guid_t *vendor,
 209                      u32 *attributes, efi_uintn_t *data_size, void *data,
 210                      u64 *timep)
 211 {
 212         return efi_get_variable_mem(variable_name, vendor, attributes, data_size, data, timep);
 213 }
 214
 215 efi_status_t __efi_runtime
 216 efi_get_next_variable_name_int(efi_uintn_t *variable_name_size,
 217                                u16 *variable_name, efi_guid_t *vendor)
 218 {
 219         return efi_get_next_variable_name_mem(variable_name_size, variable_name, vendor);
 220 }
 221
 222 efi_status_t efi_set_variable_int(const u16 *variable_name,
 223                                   const efi_guid_t *vendor,
 224                                   u32 attributes, efi_uintn_t data_size,
 225                                   const void *data, bool ro_check)
 226 {
 227         struct efi_var_entry *var;
 228         efi_uintn_t ret;
 229         bool append, delete;
 230         u64 time = 0;
 231         enum efi_auth_var_type var_type;
 232
 233         if (!variable_name || !*variable_name || !vendor)
 234                 return EFI_INVALID_PARAMETER;
 235
 236         if (data_size && !data)
 237                 return EFI_INVALID_PARAMETER;
 238
 239         /* EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS is deprecated */
 240         if (attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS)
 241                 return EFI_UNSUPPORTED;
 242
 243         /* Make sure if runtime bit is set, boot service bit is set also */
 244         if ((attributes &
 245              (EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS)) ==
 246             EFI_VARIABLE_RUNTIME_ACCESS)
 247                 return EFI_INVALID_PARAMETER;
 248
 249         /* only EFI_VARIABLE_NON_VOLATILE attribute is invalid */
 250         if ((attributes & EFI_VARIABLE_MASK) == EFI_VARIABLE_NON_VOLATILE)
 251                 return EFI_INVALID_PARAMETER;
 252
 253         /* Make sure HR is set with NV, BS and RT */
 254         if (attributes & EFI_VARIABLE_HARDWARE_ERROR_RECORD &&
 255             (!(attributes & EFI_VARIABLE_NON_VOLATILE) ||
 256              !(attributes & EFI_VARIABLE_RUNTIME_ACCESS) ||
 257              !(attributes & EFI_VARIABLE_BOOTSERVICE_ACCESS)))
 258                 return EFI_INVALID_PARAMETER;
 259
 260         /* check if a variable exists */
 261         var = efi_var_mem_find(vendor, variable_name, NULL);
 262         append = !!(attributes & EFI_VARIABLE_APPEND_WRITE);
 263         attributes &= ~(u32)EFI_VARIABLE_APPEND_WRITE;
 264         delete = !append && (!data_size || !attributes);
 265
 266         /* check attributes */
 267         var_type = efi_auth_var_get_type(variable_name, vendor);
 268         if (var) {
 269                 if (ro_check && (var->attr & EFI_VARIABLE_READ_ONLY))
 270                         return EFI_WRITE_PROTECTED;
 271
 272                 if (IS_ENABLED(CONFIG_EFI_VARIABLES_PRESEED)) {
 273                         if (var_type >= EFI_AUTH_VAR_PK)
 274                                 return EFI_WRITE_PROTECTED;
 275                 }
 276
 277                 /* attributes won't be changed */
 278                 if (!delete &&
 279                     ((ro_check && var->attr != attributes) ||
 280                      (!ro_check && ((var->attr & ~(u32)EFI_VARIABLE_READ_ONLY)
 281                                     != (attributes & ~(u32)EFI_VARIABLE_READ_ONLY))))) {
 282                         return EFI_INVALID_PARAMETER;
 283                 }
 284                 time = var->time;
 285         } else {
 286                 if (delete || append)
 287                         /*
 288                          * Trying to delete or to update a non-existent
 289                          * variable.
 290                          */
 291                         return EFI_NOT_FOUND;
 292         }
 293
 294         if (var_type >= EFI_AUTH_VAR_PK) {
 295                 /* authentication is mandatory */
 296                 if (!(attributes &
 297                       EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) {
 298                         EFI_PRINT("%ls: TIME_BASED_AUTHENTICATED_WRITE_ACCESS required\n",
 299                                   variable_name);
 300                         return EFI_INVALID_PARAMETER;
 301                 }
 302         }
 303
 304         /* authenticate a variable */
 305         if (IS_ENABLED(CONFIG_EFI_SECURE_BOOT)) {
 306                 if (attributes &
 307                     EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) {
 308                         u32 env_attr;
 309
 310                         ret = efi_variable_authenticate(variable_name, vendor,
 311                                                         &data_size, &data,
 312                                                         attributes, &env_attr,
 313                                                         &time);
 314                         if (ret != EFI_SUCCESS)
 315                                 return ret;
 316
 317                         /* last chance to check for delete */
 318                         if (!data_size)
 319                                 delete = true;
 320                 }
 321         } else {
 322                 if (attributes &
 323                     EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) {
 324                         EFI_PRINT("Secure boot is not configured\n");
 325                         return EFI_INVALID_PARAMETER;
 326                 }
 327         }
 328
 329         if (delete) {
 330                 /* EFI_NOT_FOUND has been handled before */
 331                 attributes = var->attr;
 332                 ret = EFI_SUCCESS;
 333         } else if (append) {
 334                 u16 *old_data = var->name;
 335
 336                 for (; *old_data; ++old_data)
 337                         ;
 338                 ++old_data;
 339                 ret = efi_var_mem_ins(variable_name, vendor, attributes,
 340                                       var->length, old_data, data_size, data,
 341                                       time);
 342         } else {
 343                 ret = efi_var_mem_ins(variable_name, vendor, attributes,
 344                                       data_size, data, 0, NULL, time);
 345         }
 346         efi_var_mem_del(var);
 347
 348         if (ret != EFI_SUCCESS)
 349                 return ret;
 350
 351         if (var_type == EFI_AUTH_VAR_PK)
 352                 ret = efi_init_secure_state();
 353         else
 354                 ret = EFI_SUCCESS;
 355
 356         /*
 357          * Write non-volatile EFI variables to file
 358          * TODO: check if a value change has occured to avoid superfluous writes
 359          */
 360         if (attributes & EFI_VARIABLE_NON_VOLATILE)
 361                 efi_var_to_file();
 362
 363         return EFI_SUCCESS;
 364 }
 365
 366 efi_status_t efi_query_variable_info_int(u32 attributes,
 367                                          u64 *maximum_variable_storage_size,
 368                                          u64 *remaining_variable_storage_size,
 369                                          u64 *maximum_variable_size)
 370 {
 371         if (attributes == 0)
 372                 return EFI_INVALID_PARAMETER;
 373
 374         /* EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS is deprecated */
 375         if ((attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) ||
 376             ((attributes & EFI_VARIABLE_MASK) == 0))
 377                 return EFI_UNSUPPORTED;
 378
 379         if ((attributes & EFI_VARIABLE_MASK) == EFI_VARIABLE_NON_VOLATILE)
 380                 return EFI_INVALID_PARAMETER;
 381
 382         /* Make sure if runtime bit is set, boot service bit is set also. */
 383         if ((attributes &
 384              (EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS)) ==
 385             EFI_VARIABLE_RUNTIME_ACCESS)
 386                 return EFI_INVALID_PARAMETER;
 387
 388         if (attributes & ~(u32)EFI_VARIABLE_MASK)
 389                 return EFI_INVALID_PARAMETER;
 390
 391         *maximum_variable_storage_size = EFI_VAR_BUF_SIZE -
 392                                          sizeof(struct efi_var_file);
 393         *remaining_variable_storage_size = efi_var_mem_free();
 394         *maximum_variable_size = EFI_VAR_BUF_SIZE -
 395                                  sizeof(struct efi_var_file) -
 396                                  sizeof(struct efi_var_entry);
 397         return EFI_SUCCESS;
 398 }
 399
 400 /**
 401  * efi_query_variable_info_runtime() - runtime implementation of
 402  *                                     QueryVariableInfo()
 403  *
 404  * @attributes:                         bitmask to select variables to be
 405  *                                      queried
 406  * @maximum_variable_storage_size:      maximum size of storage area for the
 407  *                                      selected variable types
 408  * @remaining_variable_storage_size:    remaining size of storage are for the
 409  *                                      selected variable types
 410  * @maximum_variable_size:              maximum size of a variable of the
 411  *                                      selected type
 412  * Returns:                             status code
 413  */
 414 static efi_status_t __efi_runtime EFIAPI efi_query_variable_info_runtime(
 415                         u32 attributes,
 416                         u64 *maximum_variable_storage_size,
 417                         u64 *remaining_variable_storage_size,
 418                         u64 *maximum_variable_size)
 419 {
 420         return EFI_UNSUPPORTED;
 421 }
 422
 423 /**
 424  * efi_set_variable_runtime() - runtime implementation of SetVariable()
 425  *
 426  * @variable_name:      name of the variable
 427  * @vendor:             vendor GUID
 428  * @attributes:         attributes of the variable
 429  * @data_size:          size of the buffer with the variable value
 430  * @data:               buffer with the variable value
 431  * Return:              status code
 432  */
 433 static efi_status_t __efi_runtime EFIAPI
 434 efi_set_variable_runtime(u16 *variable_name, const efi_guid_t *vendor,
 435                          u32 attributes, efi_uintn_t data_size,
 436                          const void *data)
 437 {
 438         return EFI_UNSUPPORTED;
 439 }
 440
 441 /**
 442  * efi_variables_boot_exit_notify() - notify ExitBootServices() is called
 443  */
 444 void efi_variables_boot_exit_notify(void)
 445 {
 446         /* Switch variable services functions to runtime version */
 447         efi_runtime_services.get_variable = efi_get_variable_runtime;
 448         efi_runtime_services.get_next_variable_name =
 449                                 efi_get_next_variable_name_runtime;
 450         efi_runtime_services.set_variable = efi_set_variable_runtime;
 451         efi_runtime_services.query_variable_info =
 452                                 efi_query_variable_info_runtime;
 453         efi_update_table_header_crc32(&efi_runtime_services.hdr);
 454 }
 455
 456 /**
 457  * efi_init_variables() - initialize variable services
 458  *
 459  * Return:      status code
 460  */
 461 efi_status_t efi_init_variables(void)
 462 {
 463         efi_status_t ret;
 464
 465         ret = efi_var_mem_init();
 466         if (ret != EFI_SUCCESS)
 467                 return ret;
 468
 469         ret = efi_var_from_file();
 470         if (ret != EFI_SUCCESS)
 471                 return ret;
 472         if (IS_ENABLED(CONFIG_EFI_VARIABLES_PRESEED)) {
 473                 ret = efi_var_restore((struct efi_var_file *)
 474                                       __efi_var_file_begin, true);
 475                 if (ret != EFI_SUCCESS)
 476                         log_err("Invalid EFI variable seed\n");
 477         }
 478
 479
 480         return efi_init_secure_state();
 481 }