Tom Rini | 70df9d6 | 2018-05-07 17:02:21 -0400 | [diff] [blame] | 1 | // SPDX-License-Identifier: GPL-2.0+ |
Rob Clark | 15f3d74 | 2017-09-13 18:05:37 -0400 | [diff] [blame] | 2 | /* |
Heinrich Schuchardt | c69addd | 2020-03-19 17:15:18 +0000 | [diff] [blame] | 3 | * UEFI runtime variable services |
Rob Clark | 15f3d74 | 2017-09-13 18:05:37 -0400 | [diff] [blame] | 4 | * |
Heinrich Schuchardt | c69addd | 2020-03-19 17:15:18 +0000 | [diff] [blame] | 5 | * Copyright (c) 2017 Rob Clark |
Rob Clark | 15f3d74 | 2017-09-13 18:05:37 -0400 | [diff] [blame] | 6 | */ |
| 7 | |
Heinrich Schuchardt | 4b7d5c1 | 2020-07-14 21:25:28 +0200 | [diff] [blame] | 8 | #define LOG_CATEGORY LOGC_EFI |
| 9 | |
Heinrich Schuchardt | 147d5d3 | 2019-10-26 23:53:48 +0200 | [diff] [blame] | 10 | #include <common.h> |
Rob Clark | 15f3d74 | 2017-09-13 18:05:37 -0400 | [diff] [blame] | 11 | #include <efi_loader.h> |
Heinrich Schuchardt | 9827e84 | 2020-06-22 18:10:27 +0200 | [diff] [blame] | 12 | #include <efi_variable.h> |
Simon Glass | ed38aef | 2020-05-10 11:40:03 -0600 | [diff] [blame] | 13 | #include <env.h> |
Simon Glass | 9d1f619 | 2019-08-02 09:44:25 -0600 | [diff] [blame] | 14 | #include <env_internal.h> |
Heinrich Schuchardt | 147d5d3 | 2019-10-26 23:53:48 +0200 | [diff] [blame] | 15 | #include <hexdump.h> |
Heinrich Schuchardt | 4b7d5c1 | 2020-07-14 21:25:28 +0200 | [diff] [blame] | 16 | #include <log.h> |
Heinrich Schuchardt | 147d5d3 | 2019-10-26 23:53:48 +0200 | [diff] [blame] | 17 | #include <malloc.h> |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 18 | #include <rtc.h> |
AKASHI Takahiro | ad3f36c | 2019-01-21 12:43:13 +0100 | [diff] [blame] | 19 | #include <search.h> |
Simon Glass | 6f04498 | 2020-05-10 11:39:52 -0600 | [diff] [blame] | 20 | #include <uuid.h> |
AKASHI Takahiro | 6ec6767 | 2020-04-21 09:38:17 +0900 | [diff] [blame] | 21 | #include <crypto/pkcs7_parser.h> |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 22 | #include <linux/compat.h> |
Simon Glass | 48b6c6b | 2019-11-14 12:57:16 -0700 | [diff] [blame] | 23 | #include <u-boot/crc.h> |
Heinrich Schuchardt | 4b7d5c1 | 2020-07-14 21:25:28 +0200 | [diff] [blame] | 24 | #include <asm/sections.h> |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 25 | |
| 26 | #ifdef CONFIG_EFI_SECURE_BOOT |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 27 | |
| 28 | /** |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 29 | * efi_variable_authenticate - authenticate a variable |
| 30 | * @variable: Variable name in u16 |
| 31 | * @vendor: Guid of variable |
| 32 | * @data_size: Size of @data |
| 33 | * @data: Pointer to variable's value |
| 34 | * @given_attr: Attributes to be given at SetVariable() |
| 35 | * @env_attr: Attributes that an existing variable holds |
| 36 | * @time: signed time that an existing variable holds |
| 37 | * |
| 38 | * Called by efi_set_variable() to verify that the input is correct. |
| 39 | * Will replace the given data pointer with another that points to |
| 40 | * the actual data to store in the internal memory. |
| 41 | * On success, @data and @data_size will be replaced with variable's |
| 42 | * actual data, excluding authentication data, and its size, and variable's |
| 43 | * attributes and signed time will also be returned in @env_attr and @time, |
| 44 | * respectively. |
| 45 | * |
Heinrich Schuchardt | e2c43da | 2020-05-03 16:29:00 +0200 | [diff] [blame] | 46 | * Return: status code |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 47 | */ |
Heinrich Schuchardt | 1ad2f0d | 2021-09-09 07:12:14 +0200 | [diff] [blame] | 48 | static efi_status_t efi_variable_authenticate(const u16 *variable, |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 49 | const efi_guid_t *vendor, |
| 50 | efi_uintn_t *data_size, |
| 51 | const void **data, u32 given_attr, |
| 52 | u32 *env_attr, u64 *time) |
| 53 | { |
| 54 | const struct efi_variable_authentication_2 *auth; |
| 55 | struct efi_signature_store *truststore, *truststore2; |
| 56 | struct pkcs7_message *var_sig; |
| 57 | struct efi_image_regions *regs; |
| 58 | struct efi_time timestamp; |
| 59 | struct rtc_time tm; |
| 60 | u64 new_time; |
AKASHI Takahiro | 1bb6edf | 2020-08-12 09:37:50 +0900 | [diff] [blame] | 61 | u8 *ebuf; |
Heinrich Schuchardt | 3a28033 | 2020-07-15 12:40:35 +0200 | [diff] [blame] | 62 | enum efi_auth_var_type var_type; |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 63 | efi_status_t ret; |
| 64 | |
| 65 | var_sig = NULL; |
| 66 | truststore = NULL; |
| 67 | truststore2 = NULL; |
| 68 | regs = NULL; |
AKASHI Takahiro | 1bb6edf | 2020-08-12 09:37:50 +0900 | [diff] [blame] | 69 | ebuf = NULL; |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 70 | ret = EFI_SECURITY_VIOLATION; |
| 71 | |
| 72 | if (*data_size < sizeof(struct efi_variable_authentication_2)) |
| 73 | goto err; |
| 74 | |
| 75 | /* authentication data */ |
| 76 | auth = *data; |
| 77 | if (*data_size < (sizeof(auth->time_stamp) |
| 78 | + auth->auth_info.hdr.dwLength)) |
| 79 | goto err; |
| 80 | |
| 81 | if (guidcmp(&auth->auth_info.cert_type, &efi_guid_cert_type_pkcs7)) |
| 82 | goto err; |
| 83 | |
Heinrich Schuchardt | 7a76a3f | 2020-07-01 12:44:00 +0200 | [diff] [blame] | 84 | memcpy(×tamp, &auth->time_stamp, sizeof(timestamp)); |
| 85 | if (timestamp.pad1 || timestamp.nanosecond || timestamp.timezone || |
| 86 | timestamp.daylight || timestamp.pad2) |
| 87 | goto err; |
| 88 | |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 89 | *data += sizeof(auth->time_stamp) + auth->auth_info.hdr.dwLength; |
| 90 | *data_size -= (sizeof(auth->time_stamp) |
| 91 | + auth->auth_info.hdr.dwLength); |
| 92 | |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 93 | memset(&tm, 0, sizeof(tm)); |
| 94 | tm.tm_year = timestamp.year; |
| 95 | tm.tm_mon = timestamp.month; |
| 96 | tm.tm_mday = timestamp.day; |
| 97 | tm.tm_hour = timestamp.hour; |
| 98 | tm.tm_min = timestamp.minute; |
| 99 | tm.tm_sec = timestamp.second; |
| 100 | new_time = rtc_mktime(&tm); |
| 101 | |
| 102 | if (!efi_secure_boot_enabled()) { |
| 103 | /* finished checking */ |
| 104 | *time = new_time; |
| 105 | return EFI_SUCCESS; |
| 106 | } |
| 107 | |
| 108 | if (new_time <= *time) |
| 109 | goto err; |
| 110 | |
| 111 | /* data to be digested */ |
| 112 | regs = calloc(sizeof(*regs) + sizeof(struct image_region) * 5, 1); |
| 113 | if (!regs) |
| 114 | goto err; |
| 115 | regs->max = 5; |
| 116 | efi_image_region_add(regs, (uint8_t *)variable, |
| 117 | (uint8_t *)variable |
| 118 | + u16_strlen(variable) * sizeof(u16), 1); |
| 119 | efi_image_region_add(regs, (uint8_t *)vendor, |
| 120 | (uint8_t *)vendor + sizeof(*vendor), 1); |
| 121 | efi_image_region_add(regs, (uint8_t *)&given_attr, |
| 122 | (uint8_t *)&given_attr + sizeof(given_attr), 1); |
| 123 | efi_image_region_add(regs, (uint8_t *)×tamp, |
| 124 | (uint8_t *)×tamp + sizeof(timestamp), 1); |
| 125 | efi_image_region_add(regs, (uint8_t *)*data, |
| 126 | (uint8_t *)*data + *data_size, 1); |
| 127 | |
| 128 | /* variable's signature list */ |
| 129 | if (auth->auth_info.hdr.dwLength < sizeof(auth->auth_info)) |
| 130 | goto err; |
AKASHI Takahiro | 1bb6edf | 2020-08-12 09:37:50 +0900 | [diff] [blame] | 131 | |
| 132 | /* ebuf should be kept valid during the authentication */ |
Sughosh Ganu | ea35008 | 2020-12-30 19:27:07 +0530 | [diff] [blame] | 133 | var_sig = efi_parse_pkcs7_header(auth->auth_info.cert_data, |
| 134 | auth->auth_info.hdr.dwLength |
| 135 | - sizeof(auth->auth_info), |
| 136 | &ebuf); |
Patrick Wildt | cd8a55b | 2020-05-07 02:13:18 +0200 | [diff] [blame] | 137 | if (!var_sig) { |
AKASHI Takahiro | 3712373 | 2020-06-09 14:09:34 +0900 | [diff] [blame] | 138 | EFI_PRINT("Parsing variable's signature failed\n"); |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 139 | goto err; |
| 140 | } |
| 141 | |
| 142 | /* signature database used for authentication */ |
Heinrich Schuchardt | 3a28033 | 2020-07-15 12:40:35 +0200 | [diff] [blame] | 143 | var_type = efi_auth_var_get_type(variable, vendor); |
| 144 | switch (var_type) { |
| 145 | case EFI_AUTH_VAR_PK: |
| 146 | case EFI_AUTH_VAR_KEK: |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 147 | /* with PK */ |
| 148 | truststore = efi_sigstore_parse_sigdb(L"PK"); |
| 149 | if (!truststore) |
| 150 | goto err; |
Heinrich Schuchardt | 3a28033 | 2020-07-15 12:40:35 +0200 | [diff] [blame] | 151 | break; |
| 152 | case EFI_AUTH_VAR_DB: |
| 153 | case EFI_AUTH_VAR_DBX: |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 154 | /* with PK and KEK */ |
| 155 | truststore = efi_sigstore_parse_sigdb(L"KEK"); |
| 156 | truststore2 = efi_sigstore_parse_sigdb(L"PK"); |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 157 | if (!truststore) { |
| 158 | if (!truststore2) |
| 159 | goto err; |
| 160 | |
| 161 | truststore = truststore2; |
| 162 | truststore2 = NULL; |
| 163 | } |
Heinrich Schuchardt | 3a28033 | 2020-07-15 12:40:35 +0200 | [diff] [blame] | 164 | break; |
| 165 | default: |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 166 | /* TODO: support private authenticated variables */ |
| 167 | goto err; |
| 168 | } |
| 169 | |
| 170 | /* verify signature */ |
AKASHI Takahiro | 14afd06 | 2020-07-21 19:35:22 +0900 | [diff] [blame] | 171 | if (efi_signature_verify(regs, var_sig, truststore, NULL)) { |
AKASHI Takahiro | 3712373 | 2020-06-09 14:09:34 +0900 | [diff] [blame] | 172 | EFI_PRINT("Verified\n"); |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 173 | } else { |
| 174 | if (truststore2 && |
AKASHI Takahiro | 14afd06 | 2020-07-21 19:35:22 +0900 | [diff] [blame] | 175 | efi_signature_verify(regs, var_sig, truststore2, NULL)) { |
AKASHI Takahiro | 3712373 | 2020-06-09 14:09:34 +0900 | [diff] [blame] | 176 | EFI_PRINT("Verified\n"); |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 177 | } else { |
AKASHI Takahiro | 3712373 | 2020-06-09 14:09:34 +0900 | [diff] [blame] | 178 | EFI_PRINT("Verifying variable's signature failed\n"); |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 179 | goto err; |
| 180 | } |
| 181 | } |
| 182 | |
| 183 | /* finished checking */ |
Heinrich Schuchardt | 5106dc7 | 2020-06-30 12:02:14 +0200 | [diff] [blame] | 184 | *time = new_time; |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 185 | ret = EFI_SUCCESS; |
| 186 | |
| 187 | err: |
| 188 | efi_sigstore_free(truststore); |
| 189 | efi_sigstore_free(truststore2); |
| 190 | pkcs7_free_message(var_sig); |
AKASHI Takahiro | 1bb6edf | 2020-08-12 09:37:50 +0900 | [diff] [blame] | 191 | free(ebuf); |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 192 | free(regs); |
| 193 | |
| 194 | return ret; |
| 195 | } |
| 196 | #else |
Heinrich Schuchardt | 1ad2f0d | 2021-09-09 07:12:14 +0200 | [diff] [blame] | 197 | static efi_status_t efi_variable_authenticate(const u16 *variable, |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 198 | const efi_guid_t *vendor, |
| 199 | efi_uintn_t *data_size, |
| 200 | const void **data, u32 given_attr, |
| 201 | u32 *env_attr, u64 *time) |
| 202 | { |
| 203 | return EFI_SUCCESS; |
| 204 | } |
| 205 | #endif /* CONFIG_EFI_SECURE_BOOT */ |
| 206 | |
Heinrich Schuchardt | 047276c | 2020-07-04 18:34:15 +0200 | [diff] [blame] | 207 | efi_status_t __efi_runtime |
Heinrich Schuchardt | 1ad2f0d | 2021-09-09 07:12:14 +0200 | [diff] [blame] | 208 | efi_get_variable_int(const u16 *variable_name, const efi_guid_t *vendor, |
Heinrich Schuchardt | 047276c | 2020-07-04 18:34:15 +0200 | [diff] [blame] | 209 | u32 *attributes, efi_uintn_t *data_size, void *data, |
| 210 | u64 *timep) |
Rob Clark | 15f3d74 | 2017-09-13 18:05:37 -0400 | [diff] [blame] | 211 | { |
Ilias Apalodimas | a4d1b1b | 2020-07-23 15:49:49 +0300 | [diff] [blame] | 212 | return efi_get_variable_mem(variable_name, vendor, attributes, data_size, data, timep); |
AKASHI Takahiro | ad3f36c | 2019-01-21 12:43:13 +0100 | [diff] [blame] | 213 | } |
| 214 | |
Heinrich Schuchardt | 047276c | 2020-07-04 18:34:15 +0200 | [diff] [blame] | 215 | efi_status_t __efi_runtime |
| 216 | efi_get_next_variable_name_int(efi_uintn_t *variable_name_size, |
| 217 | u16 *variable_name, efi_guid_t *vendor) |
Rob Clark | 15f3d74 | 2017-09-13 18:05:37 -0400 | [diff] [blame] | 218 | { |
Ilias Apalodimas | a4d1b1b | 2020-07-23 15:49:49 +0300 | [diff] [blame] | 219 | return efi_get_next_variable_name_mem(variable_name_size, variable_name, vendor); |
Rob Clark | 15f3d74 | 2017-09-13 18:05:37 -0400 | [diff] [blame] | 220 | } |
| 221 | |
Heinrich Schuchardt | 1ad2f0d | 2021-09-09 07:12:14 +0200 | [diff] [blame] | 222 | efi_status_t efi_set_variable_int(const u16 *variable_name, |
| 223 | const efi_guid_t *vendor, |
Heinrich Schuchardt | 9827e84 | 2020-06-22 18:10:27 +0200 | [diff] [blame] | 224 | u32 attributes, efi_uintn_t data_size, |
| 225 | const void *data, bool ro_check) |
Rob Clark | 15f3d74 | 2017-09-13 18:05:37 -0400 | [diff] [blame] | 226 | { |
Heinrich Schuchardt | 047276c | 2020-07-04 18:34:15 +0200 | [diff] [blame] | 227 | struct efi_var_entry *var; |
| 228 | efi_uintn_t ret; |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 229 | bool append, delete; |
| 230 | u64 time = 0; |
Heinrich Schuchardt | 3a28033 | 2020-07-15 12:40:35 +0200 | [diff] [blame] | 231 | enum efi_auth_var_type var_type; |
Rob Clark | 15f3d74 | 2017-09-13 18:05:37 -0400 | [diff] [blame] | 232 | |
Heinrich Schuchardt | adba396 | 2019-06-12 23:28:42 +0200 | [diff] [blame] | 233 | if (!variable_name || !*variable_name || !vendor || |
| 234 | ((attributes & EFI_VARIABLE_RUNTIME_ACCESS) && |
Heinrich Schuchardt | 047276c | 2020-07-04 18:34:15 +0200 | [diff] [blame] | 235 | !(attributes & EFI_VARIABLE_BOOTSERVICE_ACCESS))) |
| 236 | return EFI_INVALID_PARAMETER; |
Rob Clark | 15f3d74 | 2017-09-13 18:05:37 -0400 | [diff] [blame] | 237 | |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 238 | /* check if a variable exists */ |
Heinrich Schuchardt | 047276c | 2020-07-04 18:34:15 +0200 | [diff] [blame] | 239 | var = efi_var_mem_find(vendor, variable_name, NULL); |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 240 | append = !!(attributes & EFI_VARIABLE_APPEND_WRITE); |
| 241 | attributes &= ~(u32)EFI_VARIABLE_APPEND_WRITE; |
| 242 | delete = !append && (!data_size || !attributes); |
| 243 | |
| 244 | /* check attributes */ |
Heinrich Schuchardt | 4b7d5c1 | 2020-07-14 21:25:28 +0200 | [diff] [blame] | 245 | var_type = efi_auth_var_get_type(variable_name, vendor); |
Heinrich Schuchardt | 047276c | 2020-07-04 18:34:15 +0200 | [diff] [blame] | 246 | if (var) { |
| 247 | if (ro_check && (var->attr & EFI_VARIABLE_READ_ONLY)) |
| 248 | return EFI_WRITE_PROTECTED; |
AKASHI Takahiro | e5023b7 | 2019-09-06 15:09:52 +0900 | [diff] [blame] | 249 | |
Heinrich Schuchardt | 4b7d5c1 | 2020-07-14 21:25:28 +0200 | [diff] [blame] | 250 | if (IS_ENABLED(CONFIG_EFI_VARIABLES_PRESEED)) { |
Heinrich Schuchardt | 65b616f | 2021-08-26 04:30:24 +0200 | [diff] [blame] | 251 | if (var_type >= EFI_AUTH_VAR_PK) |
Heinrich Schuchardt | 4b7d5c1 | 2020-07-14 21:25:28 +0200 | [diff] [blame] | 252 | return EFI_WRITE_PROTECTED; |
| 253 | } |
| 254 | |
AKASHI Takahiro | e5023b7 | 2019-09-06 15:09:52 +0900 | [diff] [blame] | 255 | /* attributes won't be changed */ |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 256 | if (!delete && |
Heinrich Schuchardt | 047276c | 2020-07-04 18:34:15 +0200 | [diff] [blame] | 257 | ((ro_check && var->attr != attributes) || |
| 258 | (!ro_check && ((var->attr & ~(u32)EFI_VARIABLE_READ_ONLY) |
Heinrich Schuchardt | 9827e84 | 2020-06-22 18:10:27 +0200 | [diff] [blame] | 259 | != (attributes & ~(u32)EFI_VARIABLE_READ_ONLY))))) { |
Heinrich Schuchardt | 047276c | 2020-07-04 18:34:15 +0200 | [diff] [blame] | 260 | return EFI_INVALID_PARAMETER; |
AKASHI Takahiro | e5023b7 | 2019-09-06 15:09:52 +0900 | [diff] [blame] | 261 | } |
Heinrich Schuchardt | 047276c | 2020-07-04 18:34:15 +0200 | [diff] [blame] | 262 | time = var->time; |
AKASHI Takahiro | e5023b7 | 2019-09-06 15:09:52 +0900 | [diff] [blame] | 263 | } else { |
Heinrich Schuchardt | 047276c | 2020-07-04 18:34:15 +0200 | [diff] [blame] | 264 | if (delete || append) |
Heinrich Schuchardt | 8021bbe | 2019-09-26 21:40:18 +0200 | [diff] [blame] | 265 | /* |
| 266 | * Trying to delete or to update a non-existent |
| 267 | * variable. |
| 268 | */ |
Heinrich Schuchardt | 047276c | 2020-07-04 18:34:15 +0200 | [diff] [blame] | 269 | return EFI_NOT_FOUND; |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 270 | } |
AKASHI Takahiro | e5023b7 | 2019-09-06 15:09:52 +0900 | [diff] [blame] | 271 | |
Heinrich Schuchardt | 65b616f | 2021-08-26 04:30:24 +0200 | [diff] [blame] | 272 | if (var_type >= EFI_AUTH_VAR_PK) { |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 273 | /* authentication is mandatory */ |
| 274 | if (!(attributes & |
| 275 | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) { |
Heinrich Schuchardt | 047276c | 2020-07-04 18:34:15 +0200 | [diff] [blame] | 276 | EFI_PRINT("%ls: TIME_BASED_AUTHENTICATED_WRITE_ACCESS required\n", |
AKASHI Takahiro | 3712373 | 2020-06-09 14:09:34 +0900 | [diff] [blame] | 277 | variable_name); |
Heinrich Schuchardt | 047276c | 2020-07-04 18:34:15 +0200 | [diff] [blame] | 278 | return EFI_INVALID_PARAMETER; |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 279 | } |
| 280 | } |
| 281 | |
| 282 | /* authenticate a variable */ |
| 283 | if (IS_ENABLED(CONFIG_EFI_SECURE_BOOT)) { |
Heinrich Schuchardt | 047276c | 2020-07-04 18:34:15 +0200 | [diff] [blame] | 284 | if (attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS) |
| 285 | return EFI_INVALID_PARAMETER; |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 286 | if (attributes & |
| 287 | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS) { |
Heinrich Schuchardt | 047276c | 2020-07-04 18:34:15 +0200 | [diff] [blame] | 288 | u32 env_attr; |
| 289 | |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 290 | ret = efi_variable_authenticate(variable_name, vendor, |
| 291 | &data_size, &data, |
Heinrich Schuchardt | 047276c | 2020-07-04 18:34:15 +0200 | [diff] [blame] | 292 | attributes, &env_attr, |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 293 | &time); |
| 294 | if (ret != EFI_SUCCESS) |
Heinrich Schuchardt | 047276c | 2020-07-04 18:34:15 +0200 | [diff] [blame] | 295 | return ret; |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 296 | |
| 297 | /* last chance to check for delete */ |
| 298 | if (!data_size) |
| 299 | delete = true; |
| 300 | } |
| 301 | } else { |
| 302 | if (attributes & |
| 303 | (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | |
| 304 | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) { |
AKASHI Takahiro | 3712373 | 2020-06-09 14:09:34 +0900 | [diff] [blame] | 305 | EFI_PRINT("Secure boot is not configured\n"); |
Heinrich Schuchardt | 047276c | 2020-07-04 18:34:15 +0200 | [diff] [blame] | 306 | return EFI_INVALID_PARAMETER; |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 307 | } |
| 308 | } |
| 309 | |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 310 | if (delete) { |
Heinrich Schuchardt | 047276c | 2020-07-04 18:34:15 +0200 | [diff] [blame] | 311 | /* EFI_NOT_FOUND has been handled before */ |
Heinrich Schuchardt | 0f7a680 | 2020-11-02 19:32:24 +0100 | [diff] [blame] | 312 | attributes = var->attr; |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 313 | ret = EFI_SUCCESS; |
Heinrich Schuchardt | 047276c | 2020-07-04 18:34:15 +0200 | [diff] [blame] | 314 | } else if (append) { |
| 315 | u16 *old_data = var->name; |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 316 | |
Heinrich Schuchardt | 047276c | 2020-07-04 18:34:15 +0200 | [diff] [blame] | 317 | for (; *old_data; ++old_data) |
| 318 | ; |
| 319 | ++old_data; |
| 320 | ret = efi_var_mem_ins(variable_name, vendor, attributes, |
| 321 | var->length, old_data, data_size, data, |
| 322 | time); |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 323 | } else { |
Heinrich Schuchardt | 047276c | 2020-07-04 18:34:15 +0200 | [diff] [blame] | 324 | ret = efi_var_mem_ins(variable_name, vendor, attributes, |
| 325 | data_size, data, 0, NULL, time); |
Rob Clark | 15f3d74 | 2017-09-13 18:05:37 -0400 | [diff] [blame] | 326 | } |
Heinrich Schuchardt | 047276c | 2020-07-04 18:34:15 +0200 | [diff] [blame] | 327 | efi_var_mem_del(var); |
Rob Clark | 15f3d74 | 2017-09-13 18:05:37 -0400 | [diff] [blame] | 328 | |
Heinrich Schuchardt | 047276c | 2020-07-04 18:34:15 +0200 | [diff] [blame] | 329 | if (ret != EFI_SUCCESS) |
| 330 | return ret; |
Rob Clark | 15f3d74 | 2017-09-13 18:05:37 -0400 | [diff] [blame] | 331 | |
Heinrich Schuchardt | 3a28033 | 2020-07-15 12:40:35 +0200 | [diff] [blame] | 332 | if (var_type == EFI_AUTH_VAR_PK) |
Heinrich Schuchardt | 047276c | 2020-07-04 18:34:15 +0200 | [diff] [blame] | 333 | ret = efi_init_secure_state(); |
| 334 | else |
| 335 | ret = EFI_SUCCESS; |
Rob Clark | 15f3d74 | 2017-09-13 18:05:37 -0400 | [diff] [blame] | 336 | |
Heinrich Schuchardt | 09a8d50 | 2020-03-19 18:21:58 +0000 | [diff] [blame] | 337 | /* Write non-volatile EFI variables to file */ |
| 338 | if (attributes & EFI_VARIABLE_NON_VOLATILE && |
| 339 | ret == EFI_SUCCESS && efi_obj_list_initialized == EFI_SUCCESS) |
| 340 | efi_var_to_file(); |
| 341 | |
Heinrich Schuchardt | 047276c | 2020-07-04 18:34:15 +0200 | [diff] [blame] | 342 | return EFI_SUCCESS; |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 343 | } |
| 344 | |
Heinrich Schuchardt | 276c61d | 2020-06-26 17:57:48 +0200 | [diff] [blame] | 345 | efi_status_t efi_query_variable_info_int(u32 attributes, |
| 346 | u64 *maximum_variable_storage_size, |
| 347 | u64 *remaining_variable_storage_size, |
| 348 | u64 *maximum_variable_size) |
| 349 | { |
Heinrich Schuchardt | 047276c | 2020-07-04 18:34:15 +0200 | [diff] [blame] | 350 | *maximum_variable_storage_size = EFI_VAR_BUF_SIZE - |
| 351 | sizeof(struct efi_var_file); |
| 352 | *remaining_variable_storage_size = efi_var_mem_free(); |
| 353 | *maximum_variable_size = EFI_VAR_BUF_SIZE - |
| 354 | sizeof(struct efi_var_file) - |
| 355 | sizeof(struct efi_var_entry); |
| 356 | return EFI_SUCCESS; |
Heinrich Schuchardt | 276c61d | 2020-06-26 17:57:48 +0200 | [diff] [blame] | 357 | } |
| 358 | |
AKASHI Takahiro | b0f49ee | 2020-04-14 11:51:41 +0900 | [diff] [blame] | 359 | /** |
Heinrich Schuchardt | 276c61d | 2020-06-26 17:57:48 +0200 | [diff] [blame] | 360 | * efi_query_variable_info_runtime() - runtime implementation of |
| 361 | * QueryVariableInfo() |
Heinrich Schuchardt | 9b19dae | 2019-06-20 12:13:05 +0200 | [diff] [blame] | 362 | * |
| 363 | * @attributes: bitmask to select variables to be |
| 364 | * queried |
| 365 | * @maximum_variable_storage_size: maximum size of storage area for the |
| 366 | * selected variable types |
| 367 | * @remaining_variable_storage_size: remaining size of storage are for the |
| 368 | * selected variable types |
| 369 | * @maximum_variable_size: maximum size of a variable of the |
| 370 | * selected type |
| 371 | * Returns: status code |
| 372 | */ |
Heinrich Schuchardt | 276c61d | 2020-06-26 17:57:48 +0200 | [diff] [blame] | 373 | efi_status_t __efi_runtime EFIAPI efi_query_variable_info_runtime( |
Heinrich Schuchardt | 9b19dae | 2019-06-20 12:13:05 +0200 | [diff] [blame] | 374 | u32 attributes, |
| 375 | u64 *maximum_variable_storage_size, |
| 376 | u64 *remaining_variable_storage_size, |
| 377 | u64 *maximum_variable_size) |
| 378 | { |
| 379 | return EFI_UNSUPPORTED; |
| 380 | } |
Heinrich Schuchardt | cf3b118 | 2019-06-20 13:52:16 +0200 | [diff] [blame] | 381 | |
| 382 | /** |
Heinrich Schuchardt | 2ac6258 | 2019-06-20 15:25:48 +0200 | [diff] [blame] | 383 | * efi_set_variable_runtime() - runtime implementation of SetVariable() |
Heinrich Schuchardt | ee1f0e4 | 2019-07-14 12:11:16 +0200 | [diff] [blame] | 384 | * |
| 385 | * @variable_name: name of the variable |
| 386 | * @vendor: vendor GUID |
| 387 | * @attributes: attributes of the variable |
| 388 | * @data_size: size of the buffer with the variable value |
| 389 | * @data: buffer with the variable value |
| 390 | * Return: status code |
Heinrich Schuchardt | 2ac6258 | 2019-06-20 15:25:48 +0200 | [diff] [blame] | 391 | */ |
| 392 | static efi_status_t __efi_runtime EFIAPI |
| 393 | efi_set_variable_runtime(u16 *variable_name, const efi_guid_t *vendor, |
| 394 | u32 attributes, efi_uintn_t data_size, |
| 395 | const void *data) |
| 396 | { |
| 397 | return EFI_UNSUPPORTED; |
| 398 | } |
| 399 | |
| 400 | /** |
| 401 | * efi_variables_boot_exit_notify() - notify ExitBootServices() is called |
| 402 | */ |
| 403 | void efi_variables_boot_exit_notify(void) |
| 404 | { |
Heinrich Schuchardt | 09a8d50 | 2020-03-19 18:21:58 +0000 | [diff] [blame] | 405 | /* Switch variable services functions to runtime version */ |
Heinrich Schuchardt | 2ac6258 | 2019-06-20 15:25:48 +0200 | [diff] [blame] | 406 | efi_runtime_services.get_variable = efi_get_variable_runtime; |
| 407 | efi_runtime_services.get_next_variable_name = |
| 408 | efi_get_next_variable_name_runtime; |
| 409 | efi_runtime_services.set_variable = efi_set_variable_runtime; |
Heinrich Schuchardt | 276c61d | 2020-06-26 17:57:48 +0200 | [diff] [blame] | 410 | efi_runtime_services.query_variable_info = |
| 411 | efi_query_variable_info_runtime; |
Heinrich Schuchardt | 2ac6258 | 2019-06-20 15:25:48 +0200 | [diff] [blame] | 412 | efi_update_table_header_crc32(&efi_runtime_services.hdr); |
| 413 | } |
| 414 | |
| 415 | /** |
Heinrich Schuchardt | cf3b118 | 2019-06-20 13:52:16 +0200 | [diff] [blame] | 416 | * efi_init_variables() - initialize variable services |
| 417 | * |
| 418 | * Return: status code |
| 419 | */ |
| 420 | efi_status_t efi_init_variables(void) |
| 421 | { |
AKASHI Takahiro | c78dc19 | 2020-04-14 11:51:42 +0900 | [diff] [blame] | 422 | efi_status_t ret; |
| 423 | |
Heinrich Schuchardt | 047276c | 2020-07-04 18:34:15 +0200 | [diff] [blame] | 424 | ret = efi_var_mem_init(); |
| 425 | if (ret != EFI_SUCCESS) |
| 426 | return ret; |
| 427 | |
Heinrich Schuchardt | 4b7d5c1 | 2020-07-14 21:25:28 +0200 | [diff] [blame] | 428 | if (IS_ENABLED(CONFIG_EFI_VARIABLES_PRESEED)) { |
| 429 | ret = efi_var_restore((struct efi_var_file *) |
Heinrich Schuchardt | 211317c | 2021-08-25 19:13:24 +0200 | [diff] [blame] | 430 | __efi_var_file_begin, true); |
Heinrich Schuchardt | 4b7d5c1 | 2020-07-14 21:25:28 +0200 | [diff] [blame] | 431 | if (ret != EFI_SUCCESS) |
| 432 | log_err("Invalid EFI variable seed\n"); |
| 433 | } |
| 434 | |
AKASHI Takahiro | 2e0d94a | 2020-08-13 17:05:29 +0900 | [diff] [blame] | 435 | ret = efi_var_from_file(); |
| 436 | if (ret != EFI_SUCCESS) |
| 437 | return ret; |
| 438 | |
| 439 | return efi_init_secure_state(); |
Heinrich Schuchardt | cf3b118 | 2019-06-20 13:52:16 +0200 | [diff] [blame] | 440 | } |