efi_variable.c 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523
  1. // SPDX-License-Identifier: GPL-2.0+
  2. /*
  3. * UEFI runtime variable services
  4. *
  5. * Copyright (c) 2017 Rob Clark
  6. */
  7. #define LOG_CATEGORY LOGC_EFI
  8. #include <common.h>
  9. #include <efi_loader.h>
  10. #include <efi_variable.h>
  11. #include <env.h>
  12. #include <env_internal.h>
  13. #include <hexdump.h>
  14. #include <log.h>
  15. #include <malloc.h>
  16. #include <rtc.h>
  17. #include <search.h>
  18. #include <uuid.h>
  19. #include <crypto/pkcs7_parser.h>
  20. #include <linux/compat.h>
  21. #include <u-boot/crc.h>
  22. #include <asm/sections.h>
  23. #ifdef CONFIG_EFI_SECURE_BOOT
  24. static u8 pkcs7_hdr[] = {
  25. /* SEQUENCE */
  26. 0x30, 0x82, 0x05, 0xc7,
  27. /* OID: pkcs7-signedData */
  28. 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x07, 0x02,
  29. /* Context Structured? */
  30. 0xa0, 0x82, 0x05, 0xb8,
  31. };
  32. /**
  33. * efi_variable_parse_signature - parse a signature in variable
  34. * @buf: Pointer to variable's value
  35. * @buflen: Length of @buf
  36. * @tmpbuf: Pointer to temporary buffer
  37. *
  38. * Parse a signature embedded in variable's value and instantiate
  39. * a pkcs7_message structure. Since pkcs7_parse_message() accepts only
  40. * pkcs7's signedData, some header needed be prepended for correctly
  41. * parsing authentication data, particularly for variable's.
  42. * A temporary buffer will be allocated if needed, and it should be
  43. * kept valid during the authentication because some data in the buffer
  44. * will be referenced by efi_signature_verify().
  45. *
  46. * Return: Pointer to pkcs7_message structure on success, NULL on error
  47. */
  48. static struct pkcs7_message *efi_variable_parse_signature(const void *buf,
  49. size_t buflen,
  50. u8 **tmpbuf)
  51. {
  52. u8 *ebuf;
  53. size_t ebuflen, len;
  54. struct pkcs7_message *msg;
  55. /*
  56. * This is the best assumption to check if the binary is
  57. * already in a form of pkcs7's signedData.
  58. */
  59. if (buflen > sizeof(pkcs7_hdr) &&
  60. !memcmp(&((u8 *)buf)[4], &pkcs7_hdr[4], 11)) {
  61. msg = pkcs7_parse_message(buf, buflen);
  62. if (IS_ERR(msg))
  63. return NULL;
  64. return msg;
  65. }
  66. /*
  67. * Otherwise, we should add a dummy prefix sequence for pkcs7
  68. * message parser to be able to process.
  69. * NOTE: EDK2 also uses similar hack in WrapPkcs7Data()
  70. * in CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyCommon.c
  71. * TODO:
  72. * The header should be composed in a more refined manner.
  73. */
  74. EFI_PRINT("Makeshift prefix added to authentication data\n");
  75. ebuflen = sizeof(pkcs7_hdr) + buflen;
  76. if (ebuflen <= 0x7f) {
  77. EFI_PRINT("Data is too short\n");
  78. return NULL;
  79. }
  80. ebuf = malloc(ebuflen);
  81. if (!ebuf) {
  82. EFI_PRINT("Out of memory\n");
  83. return NULL;
  84. }
  85. memcpy(ebuf, pkcs7_hdr, sizeof(pkcs7_hdr));
  86. memcpy(ebuf + sizeof(pkcs7_hdr), buf, buflen);
  87. len = ebuflen - 4;
  88. ebuf[2] = (len >> 8) & 0xff;
  89. ebuf[3] = len & 0xff;
  90. len = ebuflen - 0x13;
  91. ebuf[0x11] = (len >> 8) & 0xff;
  92. ebuf[0x12] = len & 0xff;
  93. msg = pkcs7_parse_message(ebuf, ebuflen);
  94. if (IS_ERR(msg)) {
  95. free(ebuf);
  96. return NULL;
  97. }
  98. *tmpbuf = ebuf;
  99. return msg;
  100. }
  101. /**
  102. * efi_variable_authenticate - authenticate a variable
  103. * @variable: Variable name in u16
  104. * @vendor: Guid of variable
  105. * @data_size: Size of @data
  106. * @data: Pointer to variable's value
  107. * @given_attr: Attributes to be given at SetVariable()
  108. * @env_attr: Attributes that an existing variable holds
  109. * @time: signed time that an existing variable holds
  110. *
  111. * Called by efi_set_variable() to verify that the input is correct.
  112. * Will replace the given data pointer with another that points to
  113. * the actual data to store in the internal memory.
  114. * On success, @data and @data_size will be replaced with variable's
  115. * actual data, excluding authentication data, and its size, and variable's
  116. * attributes and signed time will also be returned in @env_attr and @time,
  117. * respectively.
  118. *
  119. * Return: status code
  120. */
  121. static efi_status_t efi_variable_authenticate(u16 *variable,
  122. const efi_guid_t *vendor,
  123. efi_uintn_t *data_size,
  124. const void **data, u32 given_attr,
  125. u32 *env_attr, u64 *time)
  126. {
  127. const struct efi_variable_authentication_2 *auth;
  128. struct efi_signature_store *truststore, *truststore2;
  129. struct pkcs7_message *var_sig;
  130. struct efi_image_regions *regs;
  131. struct efi_time timestamp;
  132. struct rtc_time tm;
  133. u64 new_time;
  134. u8 *ebuf;
  135. enum efi_auth_var_type var_type;
  136. efi_status_t ret;
  137. var_sig = NULL;
  138. truststore = NULL;
  139. truststore2 = NULL;
  140. regs = NULL;
  141. ebuf = NULL;
  142. ret = EFI_SECURITY_VIOLATION;
  143. if (*data_size < sizeof(struct efi_variable_authentication_2))
  144. goto err;
  145. /* authentication data */
  146. auth = *data;
  147. if (*data_size < (sizeof(auth->time_stamp)
  148. + auth->auth_info.hdr.dwLength))
  149. goto err;
  150. if (guidcmp(&auth->auth_info.cert_type, &efi_guid_cert_type_pkcs7))
  151. goto err;
  152. memcpy(&timestamp, &auth->time_stamp, sizeof(timestamp));
  153. if (timestamp.pad1 || timestamp.nanosecond || timestamp.timezone ||
  154. timestamp.daylight || timestamp.pad2)
  155. goto err;
  156. *data += sizeof(auth->time_stamp) + auth->auth_info.hdr.dwLength;
  157. *data_size -= (sizeof(auth->time_stamp)
  158. + auth->auth_info.hdr.dwLength);
  159. memset(&tm, 0, sizeof(tm));
  160. tm.tm_year = timestamp.year;
  161. tm.tm_mon = timestamp.month;
  162. tm.tm_mday = timestamp.day;
  163. tm.tm_hour = timestamp.hour;
  164. tm.tm_min = timestamp.minute;
  165. tm.tm_sec = timestamp.second;
  166. new_time = rtc_mktime(&tm);
  167. if (!efi_secure_boot_enabled()) {
  168. /* finished checking */
  169. *time = new_time;
  170. return EFI_SUCCESS;
  171. }
  172. if (new_time <= *time)
  173. goto err;
  174. /* data to be digested */
  175. regs = calloc(sizeof(*regs) + sizeof(struct image_region) * 5, 1);
  176. if (!regs)
  177. goto err;
  178. regs->max = 5;
  179. efi_image_region_add(regs, (uint8_t *)variable,
  180. (uint8_t *)variable
  181. + u16_strlen(variable) * sizeof(u16), 1);
  182. efi_image_region_add(regs, (uint8_t *)vendor,
  183. (uint8_t *)vendor + sizeof(*vendor), 1);
  184. efi_image_region_add(regs, (uint8_t *)&given_attr,
  185. (uint8_t *)&given_attr + sizeof(given_attr), 1);
  186. efi_image_region_add(regs, (uint8_t *)&timestamp,
  187. (uint8_t *)&timestamp + sizeof(timestamp), 1);
  188. efi_image_region_add(regs, (uint8_t *)*data,
  189. (uint8_t *)*data + *data_size, 1);
  190. /* variable's signature list */
  191. if (auth->auth_info.hdr.dwLength < sizeof(auth->auth_info))
  192. goto err;
  193. /* ebuf should be kept valid during the authentication */
  194. var_sig = efi_variable_parse_signature(auth->auth_info.cert_data,
  195. auth->auth_info.hdr.dwLength
  196. - sizeof(auth->auth_info),
  197. &ebuf);
  198. if (!var_sig) {
  199. EFI_PRINT("Parsing variable's signature failed\n");
  200. goto err;
  201. }
  202. /* signature database used for authentication */
  203. var_type = efi_auth_var_get_type(variable, vendor);
  204. switch (var_type) {
  205. case EFI_AUTH_VAR_PK:
  206. case EFI_AUTH_VAR_KEK:
  207. /* with PK */
  208. truststore = efi_sigstore_parse_sigdb(L"PK");
  209. if (!truststore)
  210. goto err;
  211. break;
  212. case EFI_AUTH_VAR_DB:
  213. case EFI_AUTH_VAR_DBX:
  214. /* with PK and KEK */
  215. truststore = efi_sigstore_parse_sigdb(L"KEK");
  216. truststore2 = efi_sigstore_parse_sigdb(L"PK");
  217. if (!truststore) {
  218. if (!truststore2)
  219. goto err;
  220. truststore = truststore2;
  221. truststore2 = NULL;
  222. }
  223. break;
  224. default:
  225. /* TODO: support private authenticated variables */
  226. goto err;
  227. }
  228. /* verify signature */
  229. if (efi_signature_verify(regs, var_sig, truststore, NULL)) {
  230. EFI_PRINT("Verified\n");
  231. } else {
  232. if (truststore2 &&
  233. efi_signature_verify(regs, var_sig, truststore2, NULL)) {
  234. EFI_PRINT("Verified\n");
  235. } else {
  236. EFI_PRINT("Verifying variable's signature failed\n");
  237. goto err;
  238. }
  239. }
  240. /* finished checking */
  241. *time = new_time;
  242. ret = EFI_SUCCESS;
  243. err:
  244. efi_sigstore_free(truststore);
  245. efi_sigstore_free(truststore2);
  246. pkcs7_free_message(var_sig);
  247. free(ebuf);
  248. free(regs);
  249. return ret;
  250. }
  251. #else
  252. static efi_status_t efi_variable_authenticate(u16 *variable,
  253. const efi_guid_t *vendor,
  254. efi_uintn_t *data_size,
  255. const void **data, u32 given_attr,
  256. u32 *env_attr, u64 *time)
  257. {
  258. return EFI_SUCCESS;
  259. }
  260. #endif /* CONFIG_EFI_SECURE_BOOT */
  261. efi_status_t __efi_runtime
  262. efi_get_variable_int(u16 *variable_name, const efi_guid_t *vendor,
  263. u32 *attributes, efi_uintn_t *data_size, void *data,
  264. u64 *timep)
  265. {
  266. return efi_get_variable_mem(variable_name, vendor, attributes, data_size, data, timep);
  267. }
  268. efi_status_t __efi_runtime
  269. efi_get_next_variable_name_int(efi_uintn_t *variable_name_size,
  270. u16 *variable_name, efi_guid_t *vendor)
  271. {
  272. return efi_get_next_variable_name_mem(variable_name_size, variable_name, vendor);
  273. }
  274. efi_status_t efi_set_variable_int(u16 *variable_name, const efi_guid_t *vendor,
  275. u32 attributes, efi_uintn_t data_size,
  276. const void *data, bool ro_check)
  277. {
  278. struct efi_var_entry *var;
  279. efi_uintn_t ret;
  280. bool append, delete;
  281. u64 time = 0;
  282. enum efi_auth_var_type var_type;
  283. if (!variable_name || !*variable_name || !vendor ||
  284. ((attributes & EFI_VARIABLE_RUNTIME_ACCESS) &&
  285. !(attributes & EFI_VARIABLE_BOOTSERVICE_ACCESS)))
  286. return EFI_INVALID_PARAMETER;
  287. /* check if a variable exists */
  288. var = efi_var_mem_find(vendor, variable_name, NULL);
  289. append = !!(attributes & EFI_VARIABLE_APPEND_WRITE);
  290. attributes &= ~(u32)EFI_VARIABLE_APPEND_WRITE;
  291. delete = !append && (!data_size || !attributes);
  292. /* check attributes */
  293. var_type = efi_auth_var_get_type(variable_name, vendor);
  294. if (var) {
  295. if (ro_check && (var->attr & EFI_VARIABLE_READ_ONLY))
  296. return EFI_WRITE_PROTECTED;
  297. if (IS_ENABLED(CONFIG_EFI_VARIABLES_PRESEED)) {
  298. if (var_type != EFI_AUTH_VAR_NONE)
  299. return EFI_WRITE_PROTECTED;
  300. }
  301. /* attributes won't be changed */
  302. if (!delete &&
  303. ((ro_check && var->attr != attributes) ||
  304. (!ro_check && ((var->attr & ~(u32)EFI_VARIABLE_READ_ONLY)
  305. != (attributes & ~(u32)EFI_VARIABLE_READ_ONLY))))) {
  306. return EFI_INVALID_PARAMETER;
  307. }
  308. time = var->time;
  309. } else {
  310. if (delete || append)
  311. /*
  312. * Trying to delete or to update a non-existent
  313. * variable.
  314. */
  315. return EFI_NOT_FOUND;
  316. }
  317. if (var_type != EFI_AUTH_VAR_NONE) {
  318. /* authentication is mandatory */
  319. if (!(attributes &
  320. EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) {
  321. EFI_PRINT("%ls: TIME_BASED_AUTHENTICATED_WRITE_ACCESS required\n",
  322. variable_name);
  323. return EFI_INVALID_PARAMETER;
  324. }
  325. }
  326. /* authenticate a variable */
  327. if (IS_ENABLED(CONFIG_EFI_SECURE_BOOT)) {
  328. if (attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS)
  329. return EFI_INVALID_PARAMETER;
  330. if (attributes &
  331. EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) {
  332. u32 env_attr;
  333. ret = efi_variable_authenticate(variable_name, vendor,
  334. &data_size, &data,
  335. attributes, &env_attr,
  336. &time);
  337. if (ret != EFI_SUCCESS)
  338. return ret;
  339. /* last chance to check for delete */
  340. if (!data_size)
  341. delete = true;
  342. }
  343. } else {
  344. if (attributes &
  345. (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS |
  346. EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) {
  347. EFI_PRINT("Secure boot is not configured\n");
  348. return EFI_INVALID_PARAMETER;
  349. }
  350. }
  351. if (delete) {
  352. /* EFI_NOT_FOUND has been handled before */
  353. ret = EFI_SUCCESS;
  354. } else if (append) {
  355. u16 *old_data = var->name;
  356. for (; *old_data; ++old_data)
  357. ;
  358. ++old_data;
  359. ret = efi_var_mem_ins(variable_name, vendor, attributes,
  360. var->length, old_data, data_size, data,
  361. time);
  362. } else {
  363. ret = efi_var_mem_ins(variable_name, vendor, attributes,
  364. data_size, data, 0, NULL, time);
  365. }
  366. efi_var_mem_del(var);
  367. if (ret != EFI_SUCCESS)
  368. return ret;
  369. if (var_type == EFI_AUTH_VAR_PK)
  370. ret = efi_init_secure_state();
  371. else
  372. ret = EFI_SUCCESS;
  373. /* Write non-volatile EFI variables to file */
  374. if (attributes & EFI_VARIABLE_NON_VOLATILE &&
  375. ret == EFI_SUCCESS && efi_obj_list_initialized == EFI_SUCCESS)
  376. efi_var_to_file();
  377. return EFI_SUCCESS;
  378. }
  379. efi_status_t efi_query_variable_info_int(u32 attributes,
  380. u64 *maximum_variable_storage_size,
  381. u64 *remaining_variable_storage_size,
  382. u64 *maximum_variable_size)
  383. {
  384. *maximum_variable_storage_size = EFI_VAR_BUF_SIZE -
  385. sizeof(struct efi_var_file);
  386. *remaining_variable_storage_size = efi_var_mem_free();
  387. *maximum_variable_size = EFI_VAR_BUF_SIZE -
  388. sizeof(struct efi_var_file) -
  389. sizeof(struct efi_var_entry);
  390. return EFI_SUCCESS;
  391. }
  392. /**
  393. * efi_query_variable_info_runtime() - runtime implementation of
  394. * QueryVariableInfo()
  395. *
  396. * @attributes: bitmask to select variables to be
  397. * queried
  398. * @maximum_variable_storage_size: maximum size of storage area for the
  399. * selected variable types
  400. * @remaining_variable_storage_size: remaining size of storage are for the
  401. * selected variable types
  402. * @maximum_variable_size: maximum size of a variable of the
  403. * selected type
  404. * Returns: status code
  405. */
  406. efi_status_t __efi_runtime EFIAPI efi_query_variable_info_runtime(
  407. u32 attributes,
  408. u64 *maximum_variable_storage_size,
  409. u64 *remaining_variable_storage_size,
  410. u64 *maximum_variable_size)
  411. {
  412. return EFI_UNSUPPORTED;
  413. }
  414. /**
  415. * efi_set_variable_runtime() - runtime implementation of SetVariable()
  416. *
  417. * @variable_name: name of the variable
  418. * @vendor: vendor GUID
  419. * @attributes: attributes of the variable
  420. * @data_size: size of the buffer with the variable value
  421. * @data: buffer with the variable value
  422. * Return: status code
  423. */
  424. static efi_status_t __efi_runtime EFIAPI
  425. efi_set_variable_runtime(u16 *variable_name, const efi_guid_t *vendor,
  426. u32 attributes, efi_uintn_t data_size,
  427. const void *data)
  428. {
  429. return EFI_UNSUPPORTED;
  430. }
  431. /**
  432. * efi_variables_boot_exit_notify() - notify ExitBootServices() is called
  433. */
  434. void efi_variables_boot_exit_notify(void)
  435. {
  436. /* Switch variable services functions to runtime version */
  437. efi_runtime_services.get_variable = efi_get_variable_runtime;
  438. efi_runtime_services.get_next_variable_name =
  439. efi_get_next_variable_name_runtime;
  440. efi_runtime_services.set_variable = efi_set_variable_runtime;
  441. efi_runtime_services.query_variable_info =
  442. efi_query_variable_info_runtime;
  443. efi_update_table_header_crc32(&efi_runtime_services.hdr);
  444. }
  445. /**
  446. * efi_init_variables() - initialize variable services
  447. *
  448. * Return: status code
  449. */
  450. efi_status_t efi_init_variables(void)
  451. {
  452. efi_status_t ret;
  453. ret = efi_var_mem_init();
  454. if (ret != EFI_SUCCESS)
  455. return ret;
  456. if (IS_ENABLED(CONFIG_EFI_VARIABLES_PRESEED)) {
  457. ret = efi_var_restore((struct efi_var_file *)
  458. __efi_var_file_begin);
  459. if (ret != EFI_SUCCESS)
  460. log_err("Invalid EFI variable seed\n");
  461. }
  462. ret = efi_var_from_file();
  463. if (ret != EFI_SUCCESS)
  464. return ret;
  465. return efi_init_secure_state();
  466. }