123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523 |
- // SPDX-License-Identifier: GPL-2.0+
- /*
- * UEFI runtime variable services
- *
- * Copyright (c) 2017 Rob Clark
- */
- #define LOG_CATEGORY LOGC_EFI
- #include <common.h>
- #include <efi_loader.h>
- #include <efi_variable.h>
- #include <env.h>
- #include <env_internal.h>
- #include <hexdump.h>
- #include <log.h>
- #include <malloc.h>
- #include <rtc.h>
- #include <search.h>
- #include <uuid.h>
- #include <crypto/pkcs7_parser.h>
- #include <linux/compat.h>
- #include <u-boot/crc.h>
- #include <asm/sections.h>
- #ifdef CONFIG_EFI_SECURE_BOOT
- static u8 pkcs7_hdr[] = {
- /* SEQUENCE */
- 0x30, 0x82, 0x05, 0xc7,
- /* OID: pkcs7-signedData */
- 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x07, 0x02,
- /* Context Structured? */
- 0xa0, 0x82, 0x05, 0xb8,
- };
- /**
- * efi_variable_parse_signature - parse a signature in variable
- * @buf: Pointer to variable's value
- * @buflen: Length of @buf
- * @tmpbuf: Pointer to temporary buffer
- *
- * Parse a signature embedded in variable's value and instantiate
- * a pkcs7_message structure. Since pkcs7_parse_message() accepts only
- * pkcs7's signedData, some header needed be prepended for correctly
- * parsing authentication data, particularly for variable's.
- * A temporary buffer will be allocated if needed, and it should be
- * kept valid during the authentication because some data in the buffer
- * will be referenced by efi_signature_verify().
- *
- * Return: Pointer to pkcs7_message structure on success, NULL on error
- */
- static struct pkcs7_message *efi_variable_parse_signature(const void *buf,
- size_t buflen,
- u8 **tmpbuf)
- {
- u8 *ebuf;
- size_t ebuflen, len;
- struct pkcs7_message *msg;
- /*
- * This is the best assumption to check if the binary is
- * already in a form of pkcs7's signedData.
- */
- if (buflen > sizeof(pkcs7_hdr) &&
- !memcmp(&((u8 *)buf)[4], &pkcs7_hdr[4], 11)) {
- msg = pkcs7_parse_message(buf, buflen);
- if (IS_ERR(msg))
- return NULL;
- return msg;
- }
- /*
- * Otherwise, we should add a dummy prefix sequence for pkcs7
- * message parser to be able to process.
- * NOTE: EDK2 also uses similar hack in WrapPkcs7Data()
- * in CryptoPkg/Library/BaseCryptLib/Pk/CryptPkcs7VerifyCommon.c
- * TODO:
- * The header should be composed in a more refined manner.
- */
- EFI_PRINT("Makeshift prefix added to authentication data\n");
- ebuflen = sizeof(pkcs7_hdr) + buflen;
- if (ebuflen <= 0x7f) {
- EFI_PRINT("Data is too short\n");
- return NULL;
- }
- ebuf = malloc(ebuflen);
- if (!ebuf) {
- EFI_PRINT("Out of memory\n");
- return NULL;
- }
- memcpy(ebuf, pkcs7_hdr, sizeof(pkcs7_hdr));
- memcpy(ebuf + sizeof(pkcs7_hdr), buf, buflen);
- len = ebuflen - 4;
- ebuf[2] = (len >> 8) & 0xff;
- ebuf[3] = len & 0xff;
- len = ebuflen - 0x13;
- ebuf[0x11] = (len >> 8) & 0xff;
- ebuf[0x12] = len & 0xff;
- msg = pkcs7_parse_message(ebuf, ebuflen);
- if (IS_ERR(msg)) {
- free(ebuf);
- return NULL;
- }
- *tmpbuf = ebuf;
- return msg;
- }
- /**
- * efi_variable_authenticate - authenticate a variable
- * @variable: Variable name in u16
- * @vendor: Guid of variable
- * @data_size: Size of @data
- * @data: Pointer to variable's value
- * @given_attr: Attributes to be given at SetVariable()
- * @env_attr: Attributes that an existing variable holds
- * @time: signed time that an existing variable holds
- *
- * Called by efi_set_variable() to verify that the input is correct.
- * Will replace the given data pointer with another that points to
- * the actual data to store in the internal memory.
- * On success, @data and @data_size will be replaced with variable's
- * actual data, excluding authentication data, and its size, and variable's
- * attributes and signed time will also be returned in @env_attr and @time,
- * respectively.
- *
- * Return: status code
- */
- static efi_status_t efi_variable_authenticate(u16 *variable,
- const efi_guid_t *vendor,
- efi_uintn_t *data_size,
- const void **data, u32 given_attr,
- u32 *env_attr, u64 *time)
- {
- const struct efi_variable_authentication_2 *auth;
- struct efi_signature_store *truststore, *truststore2;
- struct pkcs7_message *var_sig;
- struct efi_image_regions *regs;
- struct efi_time timestamp;
- struct rtc_time tm;
- u64 new_time;
- u8 *ebuf;
- enum efi_auth_var_type var_type;
- efi_status_t ret;
- var_sig = NULL;
- truststore = NULL;
- truststore2 = NULL;
- regs = NULL;
- ebuf = NULL;
- ret = EFI_SECURITY_VIOLATION;
- if (*data_size < sizeof(struct efi_variable_authentication_2))
- goto err;
- /* authentication data */
- auth = *data;
- if (*data_size < (sizeof(auth->time_stamp)
- + auth->auth_info.hdr.dwLength))
- goto err;
- if (guidcmp(&auth->auth_info.cert_type, &efi_guid_cert_type_pkcs7))
- goto err;
- memcpy(×tamp, &auth->time_stamp, sizeof(timestamp));
- if (timestamp.pad1 || timestamp.nanosecond || timestamp.timezone ||
- timestamp.daylight || timestamp.pad2)
- goto err;
- *data += sizeof(auth->time_stamp) + auth->auth_info.hdr.dwLength;
- *data_size -= (sizeof(auth->time_stamp)
- + auth->auth_info.hdr.dwLength);
- memset(&tm, 0, sizeof(tm));
- tm.tm_year = timestamp.year;
- tm.tm_mon = timestamp.month;
- tm.tm_mday = timestamp.day;
- tm.tm_hour = timestamp.hour;
- tm.tm_min = timestamp.minute;
- tm.tm_sec = timestamp.second;
- new_time = rtc_mktime(&tm);
- if (!efi_secure_boot_enabled()) {
- /* finished checking */
- *time = new_time;
- return EFI_SUCCESS;
- }
- if (new_time <= *time)
- goto err;
- /* data to be digested */
- regs = calloc(sizeof(*regs) + sizeof(struct image_region) * 5, 1);
- if (!regs)
- goto err;
- regs->max = 5;
- efi_image_region_add(regs, (uint8_t *)variable,
- (uint8_t *)variable
- + u16_strlen(variable) * sizeof(u16), 1);
- efi_image_region_add(regs, (uint8_t *)vendor,
- (uint8_t *)vendor + sizeof(*vendor), 1);
- efi_image_region_add(regs, (uint8_t *)&given_attr,
- (uint8_t *)&given_attr + sizeof(given_attr), 1);
- efi_image_region_add(regs, (uint8_t *)×tamp,
- (uint8_t *)×tamp + sizeof(timestamp), 1);
- efi_image_region_add(regs, (uint8_t *)*data,
- (uint8_t *)*data + *data_size, 1);
- /* variable's signature list */
- if (auth->auth_info.hdr.dwLength < sizeof(auth->auth_info))
- goto err;
- /* ebuf should be kept valid during the authentication */
- var_sig = efi_variable_parse_signature(auth->auth_info.cert_data,
- auth->auth_info.hdr.dwLength
- - sizeof(auth->auth_info),
- &ebuf);
- if (!var_sig) {
- EFI_PRINT("Parsing variable's signature failed\n");
- goto err;
- }
- /* signature database used for authentication */
- var_type = efi_auth_var_get_type(variable, vendor);
- switch (var_type) {
- case EFI_AUTH_VAR_PK:
- case EFI_AUTH_VAR_KEK:
- /* with PK */
- truststore = efi_sigstore_parse_sigdb(L"PK");
- if (!truststore)
- goto err;
- break;
- case EFI_AUTH_VAR_DB:
- case EFI_AUTH_VAR_DBX:
- /* with PK and KEK */
- truststore = efi_sigstore_parse_sigdb(L"KEK");
- truststore2 = efi_sigstore_parse_sigdb(L"PK");
- if (!truststore) {
- if (!truststore2)
- goto err;
- truststore = truststore2;
- truststore2 = NULL;
- }
- break;
- default:
- /* TODO: support private authenticated variables */
- goto err;
- }
- /* verify signature */
- if (efi_signature_verify(regs, var_sig, truststore, NULL)) {
- EFI_PRINT("Verified\n");
- } else {
- if (truststore2 &&
- efi_signature_verify(regs, var_sig, truststore2, NULL)) {
- EFI_PRINT("Verified\n");
- } else {
- EFI_PRINT("Verifying variable's signature failed\n");
- goto err;
- }
- }
- /* finished checking */
- *time = new_time;
- ret = EFI_SUCCESS;
- err:
- efi_sigstore_free(truststore);
- efi_sigstore_free(truststore2);
- pkcs7_free_message(var_sig);
- free(ebuf);
- free(regs);
- return ret;
- }
- #else
- static efi_status_t efi_variable_authenticate(u16 *variable,
- const efi_guid_t *vendor,
- efi_uintn_t *data_size,
- const void **data, u32 given_attr,
- u32 *env_attr, u64 *time)
- {
- return EFI_SUCCESS;
- }
- #endif /* CONFIG_EFI_SECURE_BOOT */
- efi_status_t __efi_runtime
- efi_get_variable_int(u16 *variable_name, const efi_guid_t *vendor,
- u32 *attributes, efi_uintn_t *data_size, void *data,
- u64 *timep)
- {
- return efi_get_variable_mem(variable_name, vendor, attributes, data_size, data, timep);
- }
- efi_status_t __efi_runtime
- efi_get_next_variable_name_int(efi_uintn_t *variable_name_size,
- u16 *variable_name, efi_guid_t *vendor)
- {
- return efi_get_next_variable_name_mem(variable_name_size, variable_name, vendor);
- }
- efi_status_t efi_set_variable_int(u16 *variable_name, const efi_guid_t *vendor,
- u32 attributes, efi_uintn_t data_size,
- const void *data, bool ro_check)
- {
- struct efi_var_entry *var;
- efi_uintn_t ret;
- bool append, delete;
- u64 time = 0;
- enum efi_auth_var_type var_type;
- if (!variable_name || !*variable_name || !vendor ||
- ((attributes & EFI_VARIABLE_RUNTIME_ACCESS) &&
- !(attributes & EFI_VARIABLE_BOOTSERVICE_ACCESS)))
- return EFI_INVALID_PARAMETER;
- /* check if a variable exists */
- var = efi_var_mem_find(vendor, variable_name, NULL);
- append = !!(attributes & EFI_VARIABLE_APPEND_WRITE);
- attributes &= ~(u32)EFI_VARIABLE_APPEND_WRITE;
- delete = !append && (!data_size || !attributes);
- /* check attributes */
- var_type = efi_auth_var_get_type(variable_name, vendor);
- if (var) {
- if (ro_check && (var->attr & EFI_VARIABLE_READ_ONLY))
- return EFI_WRITE_PROTECTED;
- if (IS_ENABLED(CONFIG_EFI_VARIABLES_PRESEED)) {
- if (var_type != EFI_AUTH_VAR_NONE)
- return EFI_WRITE_PROTECTED;
- }
- /* attributes won't be changed */
- if (!delete &&
- ((ro_check && var->attr != attributes) ||
- (!ro_check && ((var->attr & ~(u32)EFI_VARIABLE_READ_ONLY)
- != (attributes & ~(u32)EFI_VARIABLE_READ_ONLY))))) {
- return EFI_INVALID_PARAMETER;
- }
- time = var->time;
- } else {
- if (delete || append)
- /*
- * Trying to delete or to update a non-existent
- * variable.
- */
- return EFI_NOT_FOUND;
- }
- if (var_type != EFI_AUTH_VAR_NONE) {
- /* authentication is mandatory */
- if (!(attributes &
- EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) {
- EFI_PRINT("%ls: TIME_BASED_AUTHENTICATED_WRITE_ACCESS required\n",
- variable_name);
- return EFI_INVALID_PARAMETER;
- }
- }
- /* authenticate a variable */
- if (IS_ENABLED(CONFIG_EFI_SECURE_BOOT)) {
- if (attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS)
- return EFI_INVALID_PARAMETER;
- if (attributes &
- EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) {
- u32 env_attr;
- ret = efi_variable_authenticate(variable_name, vendor,
- &data_size, &data,
- attributes, &env_attr,
- &time);
- if (ret != EFI_SUCCESS)
- return ret;
- /* last chance to check for delete */
- if (!data_size)
- delete = true;
- }
- } else {
- if (attributes &
- (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS |
- EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) {
- EFI_PRINT("Secure boot is not configured\n");
- return EFI_INVALID_PARAMETER;
- }
- }
- if (delete) {
- /* EFI_NOT_FOUND has been handled before */
- ret = EFI_SUCCESS;
- } else if (append) {
- u16 *old_data = var->name;
- for (; *old_data; ++old_data)
- ;
- ++old_data;
- ret = efi_var_mem_ins(variable_name, vendor, attributes,
- var->length, old_data, data_size, data,
- time);
- } else {
- ret = efi_var_mem_ins(variable_name, vendor, attributes,
- data_size, data, 0, NULL, time);
- }
- efi_var_mem_del(var);
- if (ret != EFI_SUCCESS)
- return ret;
- if (var_type == EFI_AUTH_VAR_PK)
- ret = efi_init_secure_state();
- else
- ret = EFI_SUCCESS;
- /* Write non-volatile EFI variables to file */
- if (attributes & EFI_VARIABLE_NON_VOLATILE &&
- ret == EFI_SUCCESS && efi_obj_list_initialized == EFI_SUCCESS)
- efi_var_to_file();
- return EFI_SUCCESS;
- }
- efi_status_t efi_query_variable_info_int(u32 attributes,
- u64 *maximum_variable_storage_size,
- u64 *remaining_variable_storage_size,
- u64 *maximum_variable_size)
- {
- *maximum_variable_storage_size = EFI_VAR_BUF_SIZE -
- sizeof(struct efi_var_file);
- *remaining_variable_storage_size = efi_var_mem_free();
- *maximum_variable_size = EFI_VAR_BUF_SIZE -
- sizeof(struct efi_var_file) -
- sizeof(struct efi_var_entry);
- return EFI_SUCCESS;
- }
- /**
- * efi_query_variable_info_runtime() - runtime implementation of
- * QueryVariableInfo()
- *
- * @attributes: bitmask to select variables to be
- * queried
- * @maximum_variable_storage_size: maximum size of storage area for the
- * selected variable types
- * @remaining_variable_storage_size: remaining size of storage are for the
- * selected variable types
- * @maximum_variable_size: maximum size of a variable of the
- * selected type
- * Returns: status code
- */
- efi_status_t __efi_runtime EFIAPI efi_query_variable_info_runtime(
- u32 attributes,
- u64 *maximum_variable_storage_size,
- u64 *remaining_variable_storage_size,
- u64 *maximum_variable_size)
- {
- return EFI_UNSUPPORTED;
- }
- /**
- * efi_set_variable_runtime() - runtime implementation of SetVariable()
- *
- * @variable_name: name of the variable
- * @vendor: vendor GUID
- * @attributes: attributes of the variable
- * @data_size: size of the buffer with the variable value
- * @data: buffer with the variable value
- * Return: status code
- */
- static efi_status_t __efi_runtime EFIAPI
- efi_set_variable_runtime(u16 *variable_name, const efi_guid_t *vendor,
- u32 attributes, efi_uintn_t data_size,
- const void *data)
- {
- return EFI_UNSUPPORTED;
- }
- /**
- * efi_variables_boot_exit_notify() - notify ExitBootServices() is called
- */
- void efi_variables_boot_exit_notify(void)
- {
- /* Switch variable services functions to runtime version */
- efi_runtime_services.get_variable = efi_get_variable_runtime;
- efi_runtime_services.get_next_variable_name =
- efi_get_next_variable_name_runtime;
- efi_runtime_services.set_variable = efi_set_variable_runtime;
- efi_runtime_services.query_variable_info =
- efi_query_variable_info_runtime;
- efi_update_table_header_crc32(&efi_runtime_services.hdr);
- }
- /**
- * efi_init_variables() - initialize variable services
- *
- * Return: status code
- */
- efi_status_t efi_init_variables(void)
- {
- efi_status_t ret;
- ret = efi_var_mem_init();
- if (ret != EFI_SUCCESS)
- return ret;
- if (IS_ENABLED(CONFIG_EFI_VARIABLES_PRESEED)) {
- ret = efi_var_restore((struct efi_var_file *)
- __efi_var_file_begin);
- if (ret != EFI_SUCCESS)
- log_err("Invalid EFI variable seed\n");
- }
- ret = efi_var_from_file();
- if (ret != EFI_SUCCESS)
- return ret;
- return efi_init_secure_state();
- }
|