Heinrich Schuchardt | 09a8d50 | 2020-03-19 18:21:58 +0000 | [diff] [blame] | 1 | // SPDX-License-Identifier: GPL-2.0+ |
| 2 | /* |
| 3 | * File interface for UEFI variables |
| 4 | * |
| 5 | * Copyright (c) 2020, Heinrich Schuchardt |
| 6 | */ |
| 7 | |
| 8 | #define LOG_CATEGORY LOGC_EFI |
| 9 | |
Heinrich Schuchardt | 09a8d50 | 2020-03-19 18:21:58 +0000 | [diff] [blame] | 10 | #include <charset.h> |
| 11 | #include <fs.h> |
| 12 | #include <log.h> |
| 13 | #include <malloc.h> |
| 14 | #include <mapmem.h> |
| 15 | #include <efi_loader.h> |
| 16 | #include <efi_variable.h> |
| 17 | #include <u-boot/crc.h> |
| 18 | |
| 19 | #define PART_STR_LEN 10 |
| 20 | |
Heinrich Schuchardt | dfa2278 | 2021-10-06 14:10:14 +0200 | [diff] [blame] | 21 | /* GUID used by Shim to store the MOK database */ |
| 22 | #define SHIM_LOCK_GUID \ |
| 23 | EFI_GUID(0x605dab50, 0xe046, 0x4300, \ |
| 24 | 0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23) |
| 25 | |
| 26 | static const efi_guid_t shim_lock_guid = SHIM_LOCK_GUID; |
| 27 | |
Heinrich Schuchardt | 09a8d50 | 2020-03-19 18:21:58 +0000 | [diff] [blame] | 28 | /** |
| 29 | * efi_set_blk_dev_to_system_partition() - select EFI system partition |
| 30 | * |
| 31 | * Set the EFI system partition as current block device. |
| 32 | * |
| 33 | * Return: status code |
| 34 | */ |
| 35 | static efi_status_t __maybe_unused efi_set_blk_dev_to_system_partition(void) |
| 36 | { |
| 37 | char part_str[PART_STR_LEN]; |
| 38 | int r; |
| 39 | |
Simon Glass | fada3f9 | 2022-09-17 09:00:09 -0600 | [diff] [blame] | 40 | if (efi_system_partition.uclass_id == UCLASS_INVALID) { |
Heinrich Schuchardt | 09a8d50 | 2020-03-19 18:21:58 +0000 | [diff] [blame] | 41 | log_err("No EFI system partition\n"); |
| 42 | return EFI_DEVICE_ERROR; |
| 43 | } |
Heinrich Schuchardt | 54f180d | 2021-05-25 18:00:13 +0200 | [diff] [blame] | 44 | snprintf(part_str, PART_STR_LEN, "%x:%x", |
Heinrich Schuchardt | 09a8d50 | 2020-03-19 18:21:58 +0000 | [diff] [blame] | 45 | efi_system_partition.devnum, efi_system_partition.part); |
Simon Glass | fada3f9 | 2022-09-17 09:00:09 -0600 | [diff] [blame] | 46 | r = fs_set_blk_dev(blk_get_uclass_name(efi_system_partition.uclass_id), |
Heinrich Schuchardt | 09a8d50 | 2020-03-19 18:21:58 +0000 | [diff] [blame] | 47 | part_str, FS_TYPE_ANY); |
| 48 | if (r) { |
| 49 | log_err("Cannot read EFI system partition\n"); |
| 50 | return EFI_DEVICE_ERROR; |
| 51 | } |
| 52 | return EFI_SUCCESS; |
| 53 | } |
| 54 | |
Heinrich Schuchardt | 09a8d50 | 2020-03-19 18:21:58 +0000 | [diff] [blame] | 55 | /** |
| 56 | * efi_var_to_file() - save non-volatile variables as file |
| 57 | * |
| 58 | * File ubootefi.var is created on the EFI system partion. |
| 59 | * |
| 60 | * Return: status code |
| 61 | */ |
| 62 | efi_status_t efi_var_to_file(void) |
| 63 | { |
| 64 | #ifdef CONFIG_EFI_VARIABLE_FILE_STORE |
| 65 | efi_status_t ret; |
| 66 | struct efi_var_file *buf; |
| 67 | loff_t len; |
| 68 | loff_t actlen; |
| 69 | int r; |
| 70 | |
Ilias Apalodimas | a4d1b1b | 2020-07-23 15:49:49 +0300 | [diff] [blame] | 71 | ret = efi_var_collect(&buf, &len, EFI_VARIABLE_NON_VOLATILE); |
Heinrich Schuchardt | 09a8d50 | 2020-03-19 18:21:58 +0000 | [diff] [blame] | 72 | if (ret != EFI_SUCCESS) |
| 73 | goto error; |
| 74 | |
| 75 | ret = efi_set_blk_dev_to_system_partition(); |
| 76 | if (ret != EFI_SUCCESS) |
| 77 | goto error; |
| 78 | |
| 79 | r = fs_write(EFI_VAR_FILE_NAME, map_to_sysmem(buf), 0, len, &actlen); |
| 80 | if (r || len != actlen) |
| 81 | ret = EFI_DEVICE_ERROR; |
| 82 | |
| 83 | error: |
| 84 | if (ret != EFI_SUCCESS) |
| 85 | log_err("Failed to persist EFI variables\n"); |
| 86 | free(buf); |
| 87 | return ret; |
| 88 | #else |
| 89 | return EFI_SUCCESS; |
| 90 | #endif |
| 91 | } |
| 92 | |
Heinrich Schuchardt | 211317c | 2021-08-25 19:13:24 +0200 | [diff] [blame] | 93 | efi_status_t efi_var_restore(struct efi_var_file *buf, bool safe) |
Heinrich Schuchardt | 09a8d50 | 2020-03-19 18:21:58 +0000 | [diff] [blame] | 94 | { |
| 95 | struct efi_var_entry *var, *last_var; |
Heinrich Schuchardt | 211317c | 2021-08-25 19:13:24 +0200 | [diff] [blame] | 96 | u16 *data; |
Heinrich Schuchardt | 09a8d50 | 2020-03-19 18:21:58 +0000 | [diff] [blame] | 97 | efi_status_t ret; |
| 98 | |
| 99 | if (buf->reserved || buf->magic != EFI_VAR_FILE_MAGIC || |
| 100 | buf->crc32 != crc32(0, (u8 *)buf->var, |
| 101 | buf->length - sizeof(struct efi_var_file))) { |
| 102 | log_err("Invalid EFI variables file\n"); |
| 103 | return EFI_INVALID_PARAMETER; |
| 104 | } |
| 105 | |
Heinrich Schuchardt | 09a8d50 | 2020-03-19 18:21:58 +0000 | [diff] [blame] | 106 | last_var = (struct efi_var_entry *)((u8 *)buf + buf->length); |
Heinrich Schuchardt | 211317c | 2021-08-25 19:13:24 +0200 | [diff] [blame] | 107 | for (var = buf->var; var < last_var; |
| 108 | var = (struct efi_var_entry *) |
| 109 | ALIGN((uintptr_t)data + var->length, 8)) { |
Heinrich Schuchardt | 09a8d50 | 2020-03-19 18:21:58 +0000 | [diff] [blame] | 110 | |
Heinrich Schuchardt | 211317c | 2021-08-25 19:13:24 +0200 | [diff] [blame] | 111 | data = var->name + u16_strlen(var->name) + 1; |
| 112 | |
| 113 | /* |
Heinrich Schuchardt | 50413bb | 2022-12-29 09:23:03 +0100 | [diff] [blame] | 114 | * Secure boot related and volatile variables shall only be |
Heinrich Schuchardt | 211317c | 2021-08-25 19:13:24 +0200 | [diff] [blame] | 115 | * restored from U-Boot's preseed. |
| 116 | */ |
| 117 | if (!safe && |
| 118 | (efi_auth_var_get_type(var->name, &var->guid) != |
| 119 | EFI_AUTH_VAR_NONE || |
Heinrich Schuchardt | dfa2278 | 2021-10-06 14:10:14 +0200 | [diff] [blame] | 120 | !guidcmp(&var->guid, &shim_lock_guid) || |
Heinrich Schuchardt | 211317c | 2021-08-25 19:13:24 +0200 | [diff] [blame] | 121 | !(var->attr & EFI_VARIABLE_NON_VOLATILE))) |
| 122 | continue; |
| 123 | if (!var->length) |
| 124 | continue; |
Ilias Apalodimas | 3a83082 | 2022-12-29 10:13:22 +0200 | [diff] [blame] | 125 | if (efi_var_mem_find(&var->guid, var->name, NULL)) |
| 126 | continue; |
Heinrich Schuchardt | 211317c | 2021-08-25 19:13:24 +0200 | [diff] [blame] | 127 | ret = efi_var_mem_ins(var->name, &var->guid, var->attr, |
| 128 | var->length, data, 0, NULL, |
| 129 | var->time); |
| 130 | if (ret != EFI_SUCCESS) |
| 131 | log_err("Failed to set EFI variable %ls\n", var->name); |
Heinrich Schuchardt | 09a8d50 | 2020-03-19 18:21:58 +0000 | [diff] [blame] | 132 | } |
| 133 | return EFI_SUCCESS; |
| 134 | } |
| 135 | |
| 136 | /** |
| 137 | * efi_var_from_file() - read variables from file |
| 138 | * |
| 139 | * File ubootefi.var is read from the EFI system partitions and the variables |
| 140 | * stored in the file are created. |
| 141 | * |
Heinrich Schuchardt | 6fde198 | 2023-11-13 15:50:16 +0100 | [diff] [blame] | 142 | * On first boot the file ubootefi.var does not exist yet. This is why we must |
| 143 | * return EFI_SUCCESS in this case. |
| 144 | * |
| 145 | * If the variable file is corrupted, e.g. incorrect CRC32, we do not want to |
| 146 | * stop the boot process. We deliberately return EFI_SUCCESS in this case, too. |
Heinrich Schuchardt | 09a8d50 | 2020-03-19 18:21:58 +0000 | [diff] [blame] | 147 | * |
| 148 | * Return: status code |
| 149 | */ |
| 150 | efi_status_t efi_var_from_file(void) |
| 151 | { |
| 152 | #ifdef CONFIG_EFI_VARIABLE_FILE_STORE |
| 153 | struct efi_var_file *buf; |
| 154 | loff_t len; |
| 155 | efi_status_t ret; |
| 156 | int r; |
| 157 | |
| 158 | buf = calloc(1, EFI_VAR_BUF_SIZE); |
| 159 | if (!buf) { |
| 160 | log_err("Out of memory\n"); |
| 161 | return EFI_OUT_OF_RESOURCES; |
| 162 | } |
| 163 | |
| 164 | ret = efi_set_blk_dev_to_system_partition(); |
| 165 | if (ret != EFI_SUCCESS) |
| 166 | goto error; |
| 167 | r = fs_read(EFI_VAR_FILE_NAME, map_to_sysmem(buf), 0, EFI_VAR_BUF_SIZE, |
| 168 | &len); |
| 169 | if (r || len < sizeof(struct efi_var_file)) { |
| 170 | log_err("Failed to load EFI variables\n"); |
| 171 | goto error; |
| 172 | } |
Heinrich Schuchardt | 211317c | 2021-08-25 19:13:24 +0200 | [diff] [blame] | 173 | if (buf->length != len || efi_var_restore(buf, false) != EFI_SUCCESS) |
Heinrich Schuchardt | 09a8d50 | 2020-03-19 18:21:58 +0000 | [diff] [blame] | 174 | log_err("Invalid EFI variables file\n"); |
| 175 | error: |
| 176 | free(buf); |
| 177 | #endif |
| 178 | return EFI_SUCCESS; |
| 179 | } |