#include <common.h>
#include <efi_loader.h>
+#include <env.h>
#include <env_internal.h>
#include <hexdump.h>
#include <malloc.h>
#include <rtc.h>
#include <search.h>
+#include <uuid.h>
+#include <crypto/pkcs7_parser.h>
+#include <linux/bitops.h>
#include <linux/compat.h>
#include <u-boot/crc.h>
-#include "../lib/crypto/pkcs7_parser.h"
enum efi_secure_mode {
EFI_MODE_SETUP,
EFI_MODE_DEPLOYED,
};
-const efi_guid_t efi_guid_cert_type_pkcs7 = EFI_CERT_TYPE_PKCS7_GUID;
static bool efi_secure_boot;
-static int efi_secure_mode;
+static enum efi_secure_mode efi_secure_mode;
static u8 efi_vendor_keys;
#define READ_ONLY BIT(31)
+static efi_status_t efi_get_variable_common(u16 *variable_name,
+ const efi_guid_t *vendor,
+ u32 *attributes,
+ efi_uintn_t *data_size, void *data);
+
+static efi_status_t efi_set_variable_common(u16 *variable_name,
+ const efi_guid_t *vendor,
+ u32 attributes,
+ efi_uintn_t data_size,
+ const void *data,
+ bool ro_check);
+
/*
* Mapping between EFI variables and u-boot variables:
*
return str;
}
-static efi_status_t efi_set_variable_internal(u16 *variable_name,
- const efi_guid_t *vendor,
- u32 attributes,
- efi_uintn_t data_size,
- const void *data,
- bool ro_check);
+/**
+ * efi_set_secure_state - modify secure boot state variables
+ * @sec_boot: value of SecureBoot
+ * @setup_mode: value of SetupMode
+ * @audit_mode: value of AuditMode
+ * @deployed_mode: value of DeployedMode
+ *
+ * Modify secure boot stat-related variables as indicated.
+ *
+ * Return: status code
+ */
+static efi_status_t efi_set_secure_state(int sec_boot, int setup_mode,
+ int audit_mode, int deployed_mode)
+{
+ u32 attributes;
+ efi_status_t ret;
+
+ attributes = EFI_VARIABLE_BOOTSERVICE_ACCESS |
+ EFI_VARIABLE_RUNTIME_ACCESS |
+ READ_ONLY;
+ ret = efi_set_variable_common(L"SecureBoot", &efi_global_variable_guid,
+ attributes, sizeof(sec_boot), &sec_boot,
+ false);
+ if (ret != EFI_SUCCESS)
+ goto err;
+
+ ret = efi_set_variable_common(L"SetupMode", &efi_global_variable_guid,
+ attributes, sizeof(setup_mode),
+ &setup_mode, false);
+ if (ret != EFI_SUCCESS)
+ goto err;
+
+ ret = efi_set_variable_common(L"AuditMode", &efi_global_variable_guid,
+ attributes, sizeof(audit_mode),
+ &audit_mode, false);
+ if (ret != EFI_SUCCESS)
+ goto err;
+
+ ret = efi_set_variable_common(L"DeployedMode",
+ &efi_global_variable_guid, attributes,
+ sizeof(deployed_mode), &deployed_mode,
+ false);
+err:
+ return ret;
+}
/**
* efi_transfer_secure_state - handle a secure boot state transition
* @mode: new state
*
* Depending on @mode, secure boot related variables are updated.
- * Those variables are *read-only* for users, efi_set_variable_internal()
+ * Those variables are *read-only* for users, efi_set_variable_common()
* is called here.
*
- * Return: EFI_SUCCESS on success, status code (negative) on error
+ * Return: status code
*/
static efi_status_t efi_transfer_secure_state(enum efi_secure_mode mode)
{
- u32 attributes;
- u8 val;
efi_status_t ret;
- debug("Secure state from %d to %d\n", efi_secure_mode, mode);
+ debug("Switching secure state from %d to %d\n", efi_secure_mode, mode);
- attributes = EFI_VARIABLE_BOOTSERVICE_ACCESS |
- EFI_VARIABLE_RUNTIME_ACCESS;
if (mode == EFI_MODE_DEPLOYED) {
- val = 1;
- ret = efi_set_variable_internal(L"SecureBoot",
- &efi_global_variable_guid,
- attributes | READ_ONLY,
- sizeof(val), &val,
- false);
- if (ret != EFI_SUCCESS)
- goto err;
- val = 0;
- ret = efi_set_variable_internal(L"SetupMode",
- &efi_global_variable_guid,
- attributes | READ_ONLY,
- sizeof(val), &val,
- false);
- if (ret != EFI_SUCCESS)
- goto err;
- val = 0;
- ret = efi_set_variable_internal(L"AuditMode",
- &efi_global_variable_guid,
- attributes | READ_ONLY,
- sizeof(val), &val,
- false);
- if (ret != EFI_SUCCESS)
- goto err;
- val = 1;
- ret = efi_set_variable_internal(L"DeployedMode",
- &efi_global_variable_guid,
- attributes | READ_ONLY,
- sizeof(val), &val,
- false);
+ ret = efi_set_secure_state(1, 0, 0, 1);
if (ret != EFI_SUCCESS)
goto err;
efi_secure_boot = true;
} else if (mode == EFI_MODE_AUDIT) {
- ret = efi_set_variable_internal(L"PK",
- &efi_global_variable_guid,
- attributes,
- 0, NULL,
- false);
- if (ret != EFI_SUCCESS)
- goto err;
- val = 0;
- ret = efi_set_variable_internal(L"SecureBoot",
- &efi_global_variable_guid,
- attributes | READ_ONLY,
- sizeof(val), &val,
- false);
- if (ret != EFI_SUCCESS)
- goto err;
- val = 1;
- ret = efi_set_variable_internal(L"SetupMode",
- &efi_global_variable_guid,
- attributes | READ_ONLY,
- sizeof(val), &val,
- false);
+ ret = efi_set_variable_common(L"PK", &efi_global_variable_guid,
+ EFI_VARIABLE_BOOTSERVICE_ACCESS |
+ EFI_VARIABLE_RUNTIME_ACCESS,
+ 0, NULL, false);
if (ret != EFI_SUCCESS)
goto err;
- val = 1;
- ret = efi_set_variable_internal(L"AuditMode",
- &efi_global_variable_guid,
- attributes | READ_ONLY,
- sizeof(val), &val,
- false);
- if (ret != EFI_SUCCESS)
- goto err;
- val = 0;
- ret = efi_set_variable_internal(L"DeployedMode",
- &efi_global_variable_guid,
- attributes | READ_ONLY,
- sizeof(val), &val,
- false);
+
+ ret = efi_set_secure_state(0, 1, 1, 0);
if (ret != EFI_SUCCESS)
goto err;
efi_secure_boot = true;
} else if (mode == EFI_MODE_USER) {
- val = 1;
- ret = efi_set_variable_internal(L"SecureBoot",
- &efi_global_variable_guid,
- attributes | READ_ONLY,
- sizeof(val), &val,
- false);
- if (ret != EFI_SUCCESS)
- goto err;
- val = 0;
- ret = efi_set_variable_internal(L"SetupMode",
- &efi_global_variable_guid,
- attributes | READ_ONLY,
- sizeof(val), &val,
- false);
- if (ret != EFI_SUCCESS)
- goto err;
- val = 0;
- ret = efi_set_variable_internal(L"AuditMode",
- &efi_global_variable_guid,
- attributes,
- sizeof(val), &val,
- false);
- if (ret != EFI_SUCCESS)
- goto err;
- val = 0;
- ret = efi_set_variable_internal(L"DeployedMode",
- &efi_global_variable_guid,
- attributes,
- sizeof(val), &val,
- false);
+ ret = efi_set_secure_state(1, 0, 0, 0);
if (ret != EFI_SUCCESS)
goto err;
efi_secure_boot = true;
} else if (mode == EFI_MODE_SETUP) {
- val = 0;
- ret = efi_set_variable_internal(L"SecureBoot",
- &efi_global_variable_guid,
- attributes | READ_ONLY,
- sizeof(val), &val,
- false);
- if (ret != EFI_SUCCESS)
- goto err;
- val = 1;
- ret = efi_set_variable_internal(L"SetupMode",
- &efi_global_variable_guid,
- attributes | READ_ONLY,
- sizeof(val), &val,
- false);
- if (ret != EFI_SUCCESS)
- goto err;
- val = 0;
- ret = efi_set_variable_internal(L"AuditMode",
- &efi_global_variable_guid,
- attributes,
- sizeof(val), &val,
- false);
- if (ret != EFI_SUCCESS)
- goto err;
- val = 0;
- ret = efi_set_variable_internal(L"DeployedMode",
- &efi_global_variable_guid,
- attributes | READ_ONLY,
- sizeof(val), &val,
- false);
+ ret = efi_set_secure_state(0, 1, 0, 0);
if (ret != EFI_SUCCESS)
goto err;
} else {
/**
* efi_init_secure_state - initialize secure boot state
*
- * Return: EFI_SUCCESS on success, status code (negative) on error
+ * Return: status code
*/
static efi_status_t efi_init_secure_state(void)
{
*/
size = 0;
- ret = EFI_CALL(efi_get_variable(L"PK", &efi_global_variable_guid,
- NULL, &size, NULL));
+ ret = efi_get_variable_common(L"PK", &efi_global_variable_guid,
+ NULL, &size, NULL);
if (ret == EFI_BUFFER_TOO_SMALL) {
if (IS_ENABLED(CONFIG_EFI_SECURE_BOOT))
mode = EFI_MODE_USER;
ret = efi_transfer_secure_state(mode);
if (ret == EFI_SUCCESS)
- ret = efi_set_variable_internal(L"VendorKeys",
- &efi_global_variable_guid,
- EFI_VARIABLE_BOOTSERVICE_ACCESS
- | EFI_VARIABLE_RUNTIME_ACCESS
- | READ_ONLY,
- sizeof(efi_vendor_keys),
- &efi_vendor_keys,
- false);
+ ret = efi_set_variable_common(L"VendorKeys",
+ &efi_global_variable_guid,
+ EFI_VARIABLE_BOOTSERVICE_ACCESS |
+ EFI_VARIABLE_RUNTIME_ACCESS |
+ READ_ONLY,
+ sizeof(efi_vendor_keys),
+ &efi_vendor_keys, false);
err:
return ret;
* attributes and signed time will also be returned in @env_attr and @time,
* respectively.
*
- * Return: EFI_SUCCESS on success, status code (negative) on error
+ * Return: status code
*/
static efi_status_t efi_variable_authenticate(u16 *variable,
const efi_guid_t *vendor,
var_sig = efi_variable_parse_signature(auth->auth_info.cert_data,
auth->auth_info.hdr.dwLength
- sizeof(auth->auth_info));
- if (IS_ERR(var_sig)) {
+ if (!var_sig) {
debug("Parsing variable's signature failed\n");
- var_sig = NULL;
goto err;
}
}
#endif /* CONFIG_EFI_SECURE_BOOT */
-static
-efi_status_t EFIAPI efi_get_variable_common(u16 *variable_name,
+static efi_status_t efi_get_variable_common(u16 *variable_name,
const efi_guid_t *vendor,
u32 *attributes,
- efi_uintn_t *data_size, void *data,
- bool is_non_volatile)
+ efi_uintn_t *data_size, void *data)
{
char *native_name;
efi_status_t ret;
return ret;
}
-static
-efi_status_t EFIAPI efi_get_volatile_variable(u16 *variable_name,
- const efi_guid_t *vendor,
- u32 *attributes,
- efi_uintn_t *data_size,
- void *data)
-{
- return efi_get_variable_common(variable_name, vendor, attributes,
- data_size, data, false);
-}
-
-efi_status_t EFIAPI efi_get_nonvolatile_variable(u16 *variable_name,
- const efi_guid_t *vendor,
- u32 *attributes,
- efi_uintn_t *data_size,
- void *data)
-{
- return efi_get_variable_common(variable_name, vendor, attributes,
- data_size, data, true);
-}
-
/**
* efi_efi_get_variable() - retrieve value of a UEFI variable
*
EFI_ENTRY("\"%ls\" %pUl %p %p %p", variable_name, vendor, attributes,
data_size, data);
- ret = efi_get_volatile_variable(variable_name, vendor, attributes,
- data_size, data);
- if (ret == EFI_NOT_FOUND)
- ret = efi_get_nonvolatile_variable(variable_name, vendor,
- attributes, data_size, data);
-
+ ret = efi_get_variable_common(variable_name, vendor, attributes,
+ data_size, data);
return EFI_EXIT(ret);
}
/* guid */
c = *(name - 1);
*(name - 1) = '\0'; /* guid need be null-terminated here */
- uuid_str_to_bin(guid, (unsigned char *)vendor, UUID_STR_FORMAT_GUID);
+ if (uuid_str_to_bin(guid, (unsigned char *)vendor,
+ UUID_STR_FORMAT_GUID))
+ /* The only error would be EINVAL. */
+ return EFI_INVALID_PARAMETER;
*(name - 1) = c;
/* attributes */
return EFI_EXIT(ret);
}
-static
-efi_status_t EFIAPI efi_set_variable_common(u16 *variable_name,
+static efi_status_t efi_set_variable_common(u16 *variable_name,
const efi_guid_t *vendor,
u32 attributes,
efi_uintn_t data_size,
const void *data,
- bool ro_check,
- bool is_non_volatile)
+ bool ro_check)
{
char *native_name = NULL, *old_data = NULL, *val = NULL, *s;
efi_uintn_t old_size;
u32 attr;
efi_status_t ret = EFI_SUCCESS;
- debug("%s: set '%s'\n", __func__, native_name);
-
if (!variable_name || !*variable_name || !vendor ||
((attributes & EFI_VARIABLE_RUNTIME_ACCESS) &&
!(attributes & EFI_VARIABLE_BOOTSERVICE_ACCESS))) {
/* check if a variable exists */
old_size = 0;
attr = 0;
- ret = EFI_CALL(efi_get_variable(variable_name, vendor, &attr,
- &old_size, NULL));
- if (ret == EFI_BUFFER_TOO_SMALL) {
- if ((is_non_volatile && !(attr & EFI_VARIABLE_NON_VOLATILE)) ||
- (!is_non_volatile && (attr & EFI_VARIABLE_NON_VOLATILE))) {
- ret = EFI_INVALID_PARAMETER;
- goto err;
- }
- }
-
+ ret = efi_get_variable_common(variable_name, vendor, &attr,
+ &old_size, NULL);
append = !!(attributes & EFI_VARIABLE_APPEND_WRITE);
attributes &= ~(u32)EFI_VARIABLE_APPEND_WRITE;
delete = !append && (!data_size || !attributes);
if (append) {
old_data = malloc(old_size);
if (!old_data) {
- return EFI_OUT_OF_RESOURCES;
+ ret = EFI_OUT_OF_RESOURCES;
goto err;
}
- ret = EFI_CALL(efi_get_variable(variable_name, vendor,
- &attr, &old_size, old_data));
+ ret = efi_get_variable_common(variable_name, vendor,
+ &attr, &old_size, old_data);
if (ret != EFI_SUCCESS)
goto err;
} else {
/* update VendorKeys */
if (vendor_keys_modified & efi_vendor_keys) {
efi_vendor_keys = 0;
- ret = efi_set_variable_internal(
+ ret = efi_set_variable_common(
L"VendorKeys",
&efi_global_variable_guid,
EFI_VARIABLE_BOOTSERVICE_ACCESS
return ret;
}
-static
-efi_status_t EFIAPI efi_set_volatile_variable(u16 *variable_name,
- const efi_guid_t *vendor,
- u32 attributes,
- efi_uintn_t data_size,
- const void *data,
- bool ro_check)
-{
- return efi_set_variable_common(variable_name, vendor, attributes,
- data_size, data, ro_check, false);
-}
-
-efi_status_t EFIAPI efi_set_nonvolatile_variable(u16 *variable_name,
- const efi_guid_t *vendor,
- u32 attributes,
- efi_uintn_t data_size,
- const void *data,
- bool ro_check)
-{
- efi_status_t ret;
-
- ret = efi_set_variable_common(variable_name, vendor, attributes,
- data_size, data, ro_check, true);
-
- return ret;
-}
-
-static efi_status_t efi_set_variable_internal(u16 *variable_name,
- const efi_guid_t *vendor,
- u32 attributes,
- efi_uintn_t data_size,
- const void *data,
- bool ro_check)
-{
- efi_status_t ret;
-
- if (attributes & EFI_VARIABLE_NON_VOLATILE)
- ret = efi_set_nonvolatile_variable(variable_name, vendor,
- attributes,
- data_size, data, ro_check);
- else
- ret = efi_set_volatile_variable(variable_name, vendor,
- attributes, data_size, data,
- ro_check);
-
- return ret;
-}
-
/**
* efi_set_variable() - set value of a UEFI variable
*
/* READ_ONLY bit is not part of API */
attributes &= ~(u32)READ_ONLY;
- return EFI_EXIT(efi_set_variable_internal(variable_name, vendor,
- attributes, data_size, data,
- true));
+ return EFI_EXIT(efi_set_variable_common(variable_name, vendor,
+ attributes, data_size, data,
+ true));
}
/**
projects / oweals / u-boot.git / blobdiff