1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3  * UEFI runtime variable services
4  *
5  * Copyright (c) 2017 Rob Clark
6  */
7 
8 #define LOG_CATEGORY LOGC_EFI
9 
10 #include <common.h>
11 #include <efi_loader.h>
12 #include <efi_variable.h>
13 #include <env.h>
14 #include <env_internal.h>
15 #include <hexdump.h>
16 #include <log.h>
17 #include <malloc.h>
18 #include <rtc.h>
19 #include <search.h>
20 #include <uuid.h>
21 #include <crypto/pkcs7_parser.h>
22 #include <linux/compat.h>
23 #include <u-boot/crc.h>
24 #include <asm/sections.h>
25 
26 #ifdef CONFIG_EFI_SECURE_BOOT
27 
28 /**
29  * efi_variable_authenticate - authenticate a variable
30  * @variable:	Variable name in u16
31  * @vendor:	Guid of variable
32  * @data_size:	Size of @data
33  * @data:	Pointer to variable's value
34  * @given_attr:	Attributes to be given at SetVariable()
35  * @env_attr:	Attributes that an existing variable holds
36  * @time:	signed time that an existing variable holds
37  *
38  * Called by efi_set_variable() to verify that the input is correct.
39  * Will replace the given data pointer with another that points to
40  * the actual data to store in the internal memory.
41  * On success, @data and @data_size will be replaced with variable's
42  * actual data, excluding authentication data, and its size, and variable's
43  * attributes and signed time will also be returned in @env_attr and @time,
44  * respectively.
45  *
46  * Return:	status code
47  */
efi_variable_authenticate(const u16 * variable,const efi_guid_t * vendor,efi_uintn_t * data_size,const void ** data,u32 given_attr,u32 * env_attr,u64 * time)48 static efi_status_t efi_variable_authenticate(const u16 *variable,
49 					      const efi_guid_t *vendor,
50 					      efi_uintn_t *data_size,
51 					      const void **data, u32 given_attr,
52 					      u32 *env_attr, u64 *time)
53 {
54 	const struct efi_variable_authentication_2 *auth;
55 	struct efi_signature_store *truststore, *truststore2;
56 	struct pkcs7_message *var_sig;
57 	struct efi_image_regions *regs;
58 	struct efi_time timestamp;
59 	struct rtc_time tm;
60 	u64 new_time;
61 	u8 *ebuf;
62 	enum efi_auth_var_type var_type;
63 	efi_status_t ret;
64 
65 	var_sig = NULL;
66 	truststore = NULL;
67 	truststore2 = NULL;
68 	regs = NULL;
69 	ebuf = NULL;
70 	ret = EFI_SECURITY_VIOLATION;
71 
72 	if (*data_size < sizeof(struct efi_variable_authentication_2))
73 		goto err;
74 
75 	/* authentication data */
76 	auth = *data;
77 	if (*data_size < (sizeof(auth->time_stamp)
78 				+ auth->auth_info.hdr.dwLength))
79 		goto err;
80 
81 	if (guidcmp(&auth->auth_info.cert_type, &efi_guid_cert_type_pkcs7))
82 		goto err;
83 
84 	memcpy(&timestamp, &auth->time_stamp, sizeof(timestamp));
85 	if (timestamp.pad1 || timestamp.nanosecond || timestamp.timezone ||
86 	    timestamp.daylight || timestamp.pad2)
87 		goto err;
88 
89 	*data += sizeof(auth->time_stamp) + auth->auth_info.hdr.dwLength;
90 	*data_size -= (sizeof(auth->time_stamp)
91 				+ auth->auth_info.hdr.dwLength);
92 
93 	memset(&tm, 0, sizeof(tm));
94 	tm.tm_year = timestamp.year;
95 	tm.tm_mon = timestamp.month;
96 	tm.tm_mday = timestamp.day;
97 	tm.tm_hour = timestamp.hour;
98 	tm.tm_min = timestamp.minute;
99 	tm.tm_sec = timestamp.second;
100 	new_time = rtc_mktime(&tm);
101 
102 	if (!efi_secure_boot_enabled()) {
103 		/* finished checking */
104 		*time = new_time;
105 		return EFI_SUCCESS;
106 	}
107 
108 	if (new_time <= *time)
109 		goto err;
110 
111 	/* data to be digested */
112 	regs = calloc(sizeof(*regs) + sizeof(struct image_region) * 5, 1);
113 	if (!regs)
114 		goto err;
115 	regs->max = 5;
116 	efi_image_region_add(regs, (uint8_t *)variable,
117 			     (uint8_t *)variable
118 				+ u16_strlen(variable) * sizeof(u16), 1);
119 	efi_image_region_add(regs, (uint8_t *)vendor,
120 			     (uint8_t *)vendor + sizeof(*vendor), 1);
121 	efi_image_region_add(regs, (uint8_t *)&given_attr,
122 			     (uint8_t *)&given_attr + sizeof(given_attr), 1);
123 	efi_image_region_add(regs, (uint8_t *)&timestamp,
124 			     (uint8_t *)&timestamp + sizeof(timestamp), 1);
125 	efi_image_region_add(regs, (uint8_t *)*data,
126 			     (uint8_t *)*data + *data_size, 1);
127 
128 	/* variable's signature list */
129 	if (auth->auth_info.hdr.dwLength < sizeof(auth->auth_info))
130 		goto err;
131 
132 	/* ebuf should be kept valid during the authentication */
133 	var_sig = efi_parse_pkcs7_header(auth->auth_info.cert_data,
134 					 auth->auth_info.hdr.dwLength
135 					 - sizeof(auth->auth_info),
136 					 &ebuf);
137 	if (!var_sig) {
138 		EFI_PRINT("Parsing variable's signature failed\n");
139 		goto err;
140 	}
141 
142 	/* signature database used for authentication */
143 	var_type = efi_auth_var_get_type(variable, vendor);
144 	switch (var_type) {
145 	case EFI_AUTH_VAR_PK:
146 	case EFI_AUTH_VAR_KEK:
147 		/* with PK */
148 		truststore = efi_sigstore_parse_sigdb(u"PK");
149 		if (!truststore)
150 			goto err;
151 		break;
152 	case EFI_AUTH_VAR_DB:
153 	case EFI_AUTH_VAR_DBX:
154 		/* with PK and KEK */
155 		truststore = efi_sigstore_parse_sigdb(u"KEK");
156 		truststore2 = efi_sigstore_parse_sigdb(u"PK");
157 		if (!truststore) {
158 			if (!truststore2)
159 				goto err;
160 
161 			truststore = truststore2;
162 			truststore2 = NULL;
163 		}
164 		break;
165 	default:
166 		/* TODO: support private authenticated variables */
167 		goto err;
168 	}
169 
170 	/* verify signature */
171 	if (efi_signature_verify(regs, var_sig, truststore, NULL)) {
172 		EFI_PRINT("Verified\n");
173 	} else {
174 		if (truststore2 &&
175 		    efi_signature_verify(regs, var_sig, truststore2, NULL)) {
176 			EFI_PRINT("Verified\n");
177 		} else {
178 			EFI_PRINT("Verifying variable's signature failed\n");
179 			goto err;
180 		}
181 	}
182 
183 	/* finished checking */
184 	*time = new_time;
185 	ret = EFI_SUCCESS;
186 
187 err:
188 	efi_sigstore_free(truststore);
189 	efi_sigstore_free(truststore2);
190 	pkcs7_free_message(var_sig);
191 	free(ebuf);
192 	free(regs);
193 
194 	return ret;
195 }
196 #else
efi_variable_authenticate(const u16 * variable,const efi_guid_t * vendor,efi_uintn_t * data_size,const void ** data,u32 given_attr,u32 * env_attr,u64 * time)197 static efi_status_t efi_variable_authenticate(const u16 *variable,
198 					      const efi_guid_t *vendor,
199 					      efi_uintn_t *data_size,
200 					      const void **data, u32 given_attr,
201 					      u32 *env_attr, u64 *time)
202 {
203 	return EFI_SUCCESS;
204 }
205 #endif /* CONFIG_EFI_SECURE_BOOT */
206 
207 efi_status_t __efi_runtime
efi_get_variable_int(const u16 * variable_name,const efi_guid_t * vendor,u32 * attributes,efi_uintn_t * data_size,void * data,u64 * timep)208 efi_get_variable_int(const u16 *variable_name, const efi_guid_t *vendor,
209 		     u32 *attributes, efi_uintn_t *data_size, void *data,
210 		     u64 *timep)
211 {
212 	return efi_get_variable_mem(variable_name, vendor, attributes, data_size, data, timep);
213 }
214 
215 efi_status_t __efi_runtime
efi_get_next_variable_name_int(efi_uintn_t * variable_name_size,u16 * variable_name,efi_guid_t * vendor)216 efi_get_next_variable_name_int(efi_uintn_t *variable_name_size,
217 			       u16 *variable_name, efi_guid_t *vendor)
218 {
219 	return efi_get_next_variable_name_mem(variable_name_size, variable_name, vendor);
220 }
221 
efi_set_variable_int(const u16 * variable_name,const efi_guid_t * vendor,u32 attributes,efi_uintn_t data_size,const void * data,bool ro_check)222 efi_status_t efi_set_variable_int(const u16 *variable_name,
223 				  const efi_guid_t *vendor,
224 				  u32 attributes, efi_uintn_t data_size,
225 				  const void *data, bool ro_check)
226 {
227 	struct efi_var_entry *var;
228 	efi_uintn_t ret;
229 	bool append, delete;
230 	u64 time = 0;
231 	enum efi_auth_var_type var_type;
232 
233 	if (!variable_name || !*variable_name || !vendor)
234 		return EFI_INVALID_PARAMETER;
235 
236 	if (data_size && !data)
237 		return EFI_INVALID_PARAMETER;
238 
239 	/* EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS is deprecated */
240 	if (attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS)
241 		return EFI_UNSUPPORTED;
242 
243 	/* Make sure if runtime bit is set, boot service bit is set also */
244 	if ((attributes &
245 	     (EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS)) ==
246 	    EFI_VARIABLE_RUNTIME_ACCESS)
247 		return EFI_INVALID_PARAMETER;
248 
249 	/* only EFI_VARIABLE_NON_VOLATILE attribute is invalid */
250 	if ((attributes & EFI_VARIABLE_MASK) == EFI_VARIABLE_NON_VOLATILE)
251 		return EFI_INVALID_PARAMETER;
252 
253 	/* Make sure HR is set with NV, BS and RT */
254 	if (attributes & EFI_VARIABLE_HARDWARE_ERROR_RECORD &&
255 	    (!(attributes & EFI_VARIABLE_NON_VOLATILE) ||
256 	     !(attributes & EFI_VARIABLE_RUNTIME_ACCESS) ||
257 	     !(attributes & EFI_VARIABLE_BOOTSERVICE_ACCESS)))
258 		return EFI_INVALID_PARAMETER;
259 
260 	/* check if a variable exists */
261 	var = efi_var_mem_find(vendor, variable_name, NULL);
262 	append = !!(attributes & EFI_VARIABLE_APPEND_WRITE);
263 	attributes &= ~(u32)EFI_VARIABLE_APPEND_WRITE;
264 	delete = !append && (!data_size || !attributes);
265 
266 	/* check attributes */
267 	var_type = efi_auth_var_get_type(variable_name, vendor);
268 	if (var) {
269 		if (ro_check && (var->attr & EFI_VARIABLE_READ_ONLY))
270 			return EFI_WRITE_PROTECTED;
271 
272 		if (IS_ENABLED(CONFIG_EFI_VARIABLES_PRESEED)) {
273 			if (var_type >= EFI_AUTH_VAR_PK)
274 				return EFI_WRITE_PROTECTED;
275 		}
276 
277 		/* attributes won't be changed */
278 		if (!delete &&
279 		    ((ro_check && var->attr != attributes) ||
280 		     (!ro_check && ((var->attr & ~(u32)EFI_VARIABLE_READ_ONLY)
281 				    != (attributes & ~(u32)EFI_VARIABLE_READ_ONLY))))) {
282 			return EFI_INVALID_PARAMETER;
283 		}
284 		time = var->time;
285 	} else {
286 		if (delete || append)
287 			/*
288 			 * Trying to delete or to update a non-existent
289 			 * variable.
290 			 */
291 			return EFI_NOT_FOUND;
292 	}
293 
294 	if (var_type >= EFI_AUTH_VAR_PK) {
295 		/* authentication is mandatory */
296 		if (!(attributes &
297 		      EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) {
298 			EFI_PRINT("%ls: TIME_BASED_AUTHENTICATED_WRITE_ACCESS required\n",
299 				  variable_name);
300 			return EFI_INVALID_PARAMETER;
301 		}
302 	}
303 
304 	/* authenticate a variable */
305 	if (IS_ENABLED(CONFIG_EFI_SECURE_BOOT)) {
306 		if (attributes &
307 		    EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) {
308 			u32 env_attr;
309 
310 			ret = efi_variable_authenticate(variable_name, vendor,
311 							&data_size, &data,
312 							attributes, &env_attr,
313 							&time);
314 			if (ret != EFI_SUCCESS)
315 				return ret;
316 
317 			/* last chance to check for delete */
318 			if (!data_size)
319 				delete = true;
320 		}
321 	} else {
322 		if (attributes &
323 		    EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) {
324 			EFI_PRINT("Secure boot is not configured\n");
325 			return EFI_INVALID_PARAMETER;
326 		}
327 	}
328 
329 	if (delete) {
330 		/* EFI_NOT_FOUND has been handled before */
331 		attributes = var->attr;
332 		ret = EFI_SUCCESS;
333 	} else if (append) {
334 		u16 *old_data = var->name;
335 
336 		for (; *old_data; ++old_data)
337 			;
338 		++old_data;
339 		ret = efi_var_mem_ins(variable_name, vendor, attributes,
340 				      var->length, old_data, data_size, data,
341 				      time);
342 	} else {
343 		ret = efi_var_mem_ins(variable_name, vendor, attributes,
344 				      data_size, data, 0, NULL, time);
345 	}
346 	efi_var_mem_del(var);
347 
348 	if (ret != EFI_SUCCESS)
349 		return ret;
350 
351 	if (var_type == EFI_AUTH_VAR_PK)
352 		ret = efi_init_secure_state();
353 	else
354 		ret = EFI_SUCCESS;
355 
356 	/*
357 	 * Write non-volatile EFI variables to file
358 	 * TODO: check if a value change has occured to avoid superfluous writes
359 	 */
360 	if (attributes & EFI_VARIABLE_NON_VOLATILE)
361 		efi_var_to_file();
362 
363 	return EFI_SUCCESS;
364 }
365 
efi_query_variable_info_int(u32 attributes,u64 * maximum_variable_storage_size,u64 * remaining_variable_storage_size,u64 * maximum_variable_size)366 efi_status_t efi_query_variable_info_int(u32 attributes,
367 					 u64 *maximum_variable_storage_size,
368 					 u64 *remaining_variable_storage_size,
369 					 u64 *maximum_variable_size)
370 {
371 	if (attributes == 0)
372 		return EFI_INVALID_PARAMETER;
373 
374 	/* EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS is deprecated */
375 	if ((attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) ||
376 	    ((attributes & EFI_VARIABLE_MASK) == 0))
377 		return EFI_UNSUPPORTED;
378 
379 	if ((attributes & EFI_VARIABLE_MASK) == EFI_VARIABLE_NON_VOLATILE)
380 		return EFI_INVALID_PARAMETER;
381 
382 	/* Make sure if runtime bit is set, boot service bit is set also. */
383 	if ((attributes &
384 	     (EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS)) ==
385 	    EFI_VARIABLE_RUNTIME_ACCESS)
386 		return EFI_INVALID_PARAMETER;
387 
388 	if (attributes & ~(u32)EFI_VARIABLE_MASK)
389 		return EFI_INVALID_PARAMETER;
390 
391 	*maximum_variable_storage_size = EFI_VAR_BUF_SIZE -
392 					 sizeof(struct efi_var_file);
393 	*remaining_variable_storage_size = efi_var_mem_free();
394 	*maximum_variable_size = EFI_VAR_BUF_SIZE -
395 				 sizeof(struct efi_var_file) -
396 				 sizeof(struct efi_var_entry);
397 	return EFI_SUCCESS;
398 }
399 
400 /**
401  * efi_query_variable_info_runtime() - runtime implementation of
402  *				       QueryVariableInfo()
403  *
404  * @attributes:				bitmask to select variables to be
405  *					queried
406  * @maximum_variable_storage_size:	maximum size of storage area for the
407  *					selected variable types
408  * @remaining_variable_storage_size:	remaining size of storage are for the
409  *					selected variable types
410  * @maximum_variable_size:		maximum size of a variable of the
411  *					selected type
412  * Returns:				status code
413  */
efi_query_variable_info_runtime(u32 attributes,u64 * maximum_variable_storage_size,u64 * remaining_variable_storage_size,u64 * maximum_variable_size)414 static efi_status_t __efi_runtime EFIAPI efi_query_variable_info_runtime(
415 			u32 attributes,
416 			u64 *maximum_variable_storage_size,
417 			u64 *remaining_variable_storage_size,
418 			u64 *maximum_variable_size)
419 {
420 	return EFI_UNSUPPORTED;
421 }
422 
423 /**
424  * efi_set_variable_runtime() - runtime implementation of SetVariable()
425  *
426  * @variable_name:	name of the variable
427  * @vendor:		vendor GUID
428  * @attributes:		attributes of the variable
429  * @data_size:		size of the buffer with the variable value
430  * @data:		buffer with the variable value
431  * Return:		status code
432  */
433 static efi_status_t __efi_runtime EFIAPI
efi_set_variable_runtime(u16 * variable_name,const efi_guid_t * vendor,u32 attributes,efi_uintn_t data_size,const void * data)434 efi_set_variable_runtime(u16 *variable_name, const efi_guid_t *vendor,
435 			 u32 attributes, efi_uintn_t data_size,
436 			 const void *data)
437 {
438 	return EFI_UNSUPPORTED;
439 }
440 
441 /**
442  * efi_variables_boot_exit_notify() - notify ExitBootServices() is called
443  */
efi_variables_boot_exit_notify(void)444 void efi_variables_boot_exit_notify(void)
445 {
446 	/* Switch variable services functions to runtime version */
447 	efi_runtime_services.get_variable = efi_get_variable_runtime;
448 	efi_runtime_services.get_next_variable_name =
449 				efi_get_next_variable_name_runtime;
450 	efi_runtime_services.set_variable = efi_set_variable_runtime;
451 	efi_runtime_services.query_variable_info =
452 				efi_query_variable_info_runtime;
453 	efi_update_table_header_crc32(&efi_runtime_services.hdr);
454 }
455 
456 /**
457  * efi_init_variables() - initialize variable services
458  *
459  * Return:	status code
460  */
efi_init_variables(void)461 efi_status_t efi_init_variables(void)
462 {
463 	efi_status_t ret;
464 
465 	ret = efi_var_mem_init();
466 	if (ret != EFI_SUCCESS)
467 		return ret;
468 
469 	ret = efi_var_from_file();
470 	if (ret != EFI_SUCCESS)
471 		return ret;
472 	if (IS_ENABLED(CONFIG_EFI_VARIABLES_PRESEED)) {
473 		ret = efi_var_restore((struct efi_var_file *)
474 				      __efi_var_file_begin, true);
475 		if (ret != EFI_SUCCESS)
476 			log_err("Invalid EFI variable seed\n");
477 	}
478 
479 
480 	return efi_init_secure_state();
481 }
482