2 TCG MOR (Memory Overwrite Request) Lock Control support (SMM version).
4 This module initilizes MemoryOverwriteRequestControlLock variable.
5 This module adds Variable Hook and check MemoryOverwriteRequestControlLock.
7 Copyright (c) 2016 - 2017, Intel Corporation. All rights reserved.<BR>
8 This program and the accompanying materials
9 are licensed and made available under the terms and conditions of the BSD License
10 which accompanies this distribution. The full text of the license may be found at
11 http://opensource.org/licenses/bsd-license.php
13 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
14 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
19 #include <Guid/MemoryOverwriteControl.h>
20 #include <IndustryStandard/MemoryOverwriteRequestControlLock.h>
21 #include <Library/DebugLib.h>
22 #include <Library/BaseLib.h>
23 #include <Library/BaseMemoryLib.h>
24 #include <Library/UefiBootServicesTableLib.h>
32 VARIABLE_TYPE mMorVariableType
[] = {
33 {MEMORY_OVERWRITE_REQUEST_VARIABLE_NAME
, &gEfiMemoryOverwriteControlDataGuid
},
34 {MEMORY_OVERWRITE_REQUEST_CONTROL_LOCK_NAME
, &gEfiMemoryOverwriteRequestControlLockGuid
},
37 BOOLEAN mMorPassThru
= FALSE
;
39 #define MOR_LOCK_DATA_UNLOCKED 0x0
40 #define MOR_LOCK_DATA_LOCKED_WITHOUT_KEY 0x1
41 #define MOR_LOCK_DATA_LOCKED_WITH_KEY 0x2
43 #define MOR_LOCK_V1_SIZE 1
44 #define MOR_LOCK_V2_KEY_SIZE 8
47 MorLockStateUnlocked
= 0,
48 MorLockStateLocked
= 1,
51 BOOLEAN mMorLockInitializationRequired
= FALSE
;
52 UINT8 mMorLockKey
[MOR_LOCK_V2_KEY_SIZE
];
53 BOOLEAN mMorLockKeyEmpty
= TRUE
;
54 BOOLEAN mMorLockPassThru
= FALSE
;
55 MOR_LOCK_STATE mMorLockState
= MorLockStateUnlocked
;
58 Returns if this is MOR related variable.
60 @param VariableName the name of the vendor's variable, it's a Null-Terminated Unicode String
61 @param VendorGuid Unify identifier for vendor.
63 @retval TRUE The variable is MOR related.
64 @retval FALSE The variable is NOT MOR related.
68 IN CHAR16
*VariableName
,
69 IN EFI_GUID
*VendorGuid
74 for (Index
= 0; Index
< sizeof(mMorVariableType
)/sizeof(mMorVariableType
[0]); Index
++) {
75 if ((StrCmp (VariableName
, mMorVariableType
[Index
].VariableName
) == 0) &&
76 (CompareGuid (VendorGuid
, mMorVariableType
[Index
].VendorGuid
))) {
84 Returns if this is MOR lock variable.
86 @param VariableName the name of the vendor's variable, it's a Null-Terminated Unicode String
87 @param VendorGuid Unify identifier for vendor.
89 @retval TRUE The variable is MOR lock variable.
90 @retval FALSE The variable is NOT MOR lock variable.
94 IN CHAR16
*VariableName
,
95 IN EFI_GUID
*VendorGuid
98 if ((StrCmp (VariableName
, MEMORY_OVERWRITE_REQUEST_CONTROL_LOCK_NAME
) == 0) &&
99 (CompareGuid (VendorGuid
, &gEfiMemoryOverwriteRequestControlLockGuid
))) {
106 Set MOR lock variable.
108 @param Data MOR Lock variable data.
110 @retval EFI_SUCCESS The firmware has successfully stored the variable and its data as
111 defined by the Attributes.
112 @retval EFI_INVALID_PARAMETER An invalid combination of attribute bits was supplied, or the
113 DataSize exceeds the maximum allowed.
114 @retval EFI_INVALID_PARAMETER VariableName is an empty Unicode string.
115 @retval EFI_OUT_OF_RESOURCES Not enough storage is available to hold the variable and its data.
116 @retval EFI_DEVICE_ERROR The variable could not be saved due to a hardware failure.
117 @retval EFI_WRITE_PROTECTED The variable in question is read-only.
118 @retval EFI_WRITE_PROTECTED The variable in question cannot be deleted.
119 @retval EFI_SECURITY_VIOLATION The variable could not be written due to EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS
120 set but the AuthInfo does NOT pass the validation check carried
122 @retval EFI_NOT_FOUND The variable trying to be updated or deleted was not found.
131 mMorLockPassThru
= TRUE
;
132 Status
= VariableServiceSetVariable (
133 MEMORY_OVERWRITE_REQUEST_CONTROL_LOCK_NAME
,
134 &gEfiMemoryOverwriteRequestControlLockGuid
,
135 EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_RUNTIME_ACCESS
,
139 mMorLockPassThru
= FALSE
;
144 This service is an MorLock checker handler for the SetVariable().
146 @param VariableName the name of the vendor's variable, as a
147 Null-Terminated Unicode String
148 @param VendorGuid Unify identifier for vendor.
149 @param Attributes Point to memory location to return the attributes of variable. If the point
150 is NULL, the parameter would be ignored.
151 @param DataSize The size in bytes of Data-Buffer.
152 @param Data Point to the content of the variable.
154 @retval EFI_SUCCESS The MorLock check pass, and Variable driver can store the variable data.
155 @retval EFI_INVALID_PARAMETER The MorLock data or data size or attributes is not allowed.
156 @retval EFI_ACCESS_DENIED The MorLock is locked.
157 @retval EFI_WRITE_PROTECTED The MorLock deletion is not allowed.
158 @retval EFI_ALREADY_STARTED The MorLock variable is handled inside this function.
159 Variable driver can just return EFI_SUCCESS.
162 SetVariableCheckHandlerMorLock (
163 IN CHAR16
*VariableName
,
164 IN EFI_GUID
*VendorGuid
,
165 IN UINT32 Attributes
,
175 if (Attributes
== 0 || DataSize
== 0 || Data
== NULL
) {
177 // Permit deletion for passthru request, deny it otherwise.
179 return mMorLockPassThru
? EFI_SUCCESS
: EFI_WRITE_PROTECTED
;
182 if ((Attributes
!= (EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_RUNTIME_ACCESS
)) ||
183 ((DataSize
!= MOR_LOCK_V1_SIZE
) && (DataSize
!= MOR_LOCK_V2_KEY_SIZE
))) {
184 return EFI_INVALID_PARAMETER
;
188 // Do not check if the request is passthru.
190 if (mMorLockPassThru
) {
194 if (mMorLockState
== MorLockStateUnlocked
) {
198 if (DataSize
== MOR_LOCK_V1_SIZE
) {
200 // V1 - lock permanently
202 if (*(UINT8
*)Data
== MOR_LOCK_DATA_UNLOCKED
) {
206 Status
= SetMorLockVariable (MOR_LOCK_DATA_UNLOCKED
);
207 if (!EFI_ERROR (Status
)) {
209 // return EFI_ALREADY_STARTED to skip variable set.
211 return EFI_ALREADY_STARTED
;
218 } else if (*(UINT8
*)Data
== MOR_LOCK_DATA_LOCKED_WITHOUT_KEY
) {
222 Status
= SetMorLockVariable (MOR_LOCK_DATA_LOCKED_WITHOUT_KEY
);
223 if (!EFI_ERROR (Status
)) {
227 mMorLockState
= MorLockStateLocked
;
229 // return EFI_ALREADY_STARTED to skip variable set.
231 return EFI_ALREADY_STARTED
;
239 return EFI_INVALID_PARAMETER
;
241 } else if (DataSize
== MOR_LOCK_V2_KEY_SIZE
) {
243 // V2 lock and provision the key
247 // Need set here because the data value on flash is different
249 Status
= SetMorLockVariable (MOR_LOCK_DATA_LOCKED_WITH_KEY
);
250 if (EFI_ERROR(Status
)) {
252 // SetVar fail, do not provision the key
257 // Lock success, provision the key
259 mMorLockKeyEmpty
= FALSE
;
260 CopyMem (mMorLockKey
, Data
, MOR_LOCK_V2_KEY_SIZE
);
261 mMorLockState
= MorLockStateLocked
;
263 // return EFI_ALREADY_STARTED to skip variable set.
265 return EFI_ALREADY_STARTED
;
269 return EFI_OUT_OF_RESOURCES
;
275 if (mMorLockKeyEmpty
|| (DataSize
!= MOR_LOCK_V2_KEY_SIZE
)) {
276 return EFI_ACCESS_DENIED
;
278 if ((CompareMem (Data
, mMorLockKey
, MOR_LOCK_V2_KEY_SIZE
) == 0)) {
280 // Key match - unlock
284 // Need set here because the data value on flash is different
286 Status
= SetMorLockVariable (MOR_LOCK_DATA_UNLOCKED
);
287 if (EFI_ERROR (Status
)) {
296 mMorLockState
= MorLockStateUnlocked
;
297 mMorLockKeyEmpty
= TRUE
;
298 ZeroMem (mMorLockKey
, sizeof(mMorLockKey
));
300 // return EFI_ALREADY_STARTED to skip variable set.
302 return EFI_ALREADY_STARTED
;
306 // Key mismatch - Prevent Dictionary Attack
308 mMorLockState
= MorLockStateLocked
;
309 mMorLockKeyEmpty
= TRUE
;
310 ZeroMem (mMorLockKey
, sizeof(mMorLockKey
));
311 return EFI_ACCESS_DENIED
;
317 This service is an MOR/MorLock checker handler for the SetVariable().
319 @param[in] VariableName the name of the vendor's variable, as a
320 Null-Terminated Unicode String
321 @param[in] VendorGuid Unify identifier for vendor.
322 @param[in] Attributes Attributes bitmask to set for the variable.
323 @param[in] DataSize The size in bytes of Data-Buffer.
324 @param[in] Data Point to the content of the variable.
326 @retval EFI_SUCCESS The MOR/MorLock check pass, and Variable
327 driver can store the variable data.
328 @retval EFI_INVALID_PARAMETER The MOR/MorLock data or data size or
329 attributes is not allowed for MOR variable.
330 @retval EFI_ACCESS_DENIED The MOR/MorLock is locked.
331 @retval EFI_ALREADY_STARTED The MorLock variable is handled inside this
332 function. Variable driver can just return
336 SetVariableCheckHandlerMor (
337 IN CHAR16
*VariableName
,
338 IN EFI_GUID
*VendorGuid
,
339 IN UINT32 Attributes
,
345 // do not handle non-MOR variable
347 if (!IsAnyMorVariable (VariableName
, VendorGuid
)) {
354 if (IsMorLockVariable (VariableName
, VendorGuid
)) {
355 return SetVariableCheckHandlerMorLock (
369 // Permit deletion for passthru request.
371 if (((Attributes
== 0) || (DataSize
== 0)) && mMorPassThru
) {
378 if ((Attributes
!= (EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_RUNTIME_ACCESS
)) ||
379 (DataSize
!= sizeof(UINT8
)) ||
381 return EFI_INVALID_PARAMETER
;
383 if (mMorLockState
== MorLockStateLocked
) {
385 // If lock, deny access
387 return EFI_ACCESS_DENIED
;
396 Initialization for MOR Control Lock.
398 @retval EFI_SUCCESS MorLock initialization success.
399 @return Others Some error occurs.
406 mMorLockInitializationRequired
= TRUE
;
411 Delayed initialization for MOR Control Lock at EndOfDxe.
413 This function performs any operations queued by MorLockInit().
416 MorLockInitAtEndOfDxe (
421 EFI_STATUS MorStatus
;
422 EFI_STATUS TcgStatus
;
425 if (!mMorLockInitializationRequired
) {
427 // The EFI_SMM_FAULT_TOLERANT_WRITE_PROTOCOL has never been installed, thus
428 // the variable write service is unavailable. This should never happen.
435 // Check if the MOR variable exists.
438 MorStatus
= VariableServiceGetVariable (
439 MEMORY_OVERWRITE_REQUEST_VARIABLE_NAME
,
440 &gEfiMemoryOverwriteControlDataGuid
,
446 // We provided a zero-sized buffer, so the above call can never succeed.
448 ASSERT (EFI_ERROR (MorStatus
));
450 if (MorStatus
== EFI_BUFFER_TOO_SMALL
) {
452 // The MOR variable exists.
454 // Some OSes don't follow the TCG's Platform Reset Attack Mitigation spec
455 // in that the OS should never create the MOR variable, only read and write
456 // it -- these OSes (unintentionally) create MOR if the platform firmware
457 // does not produce it. Whether this is the case (from the last OS boot)
458 // can be deduced from the absence of the TCG / TCG2 protocols, as edk2's
459 // MOR implementation depends on (one of) those protocols.
461 TcgStatus
= gBS
->LocateProtocol (
462 &gEfiTcgProtocolGuid
,
463 NULL
, // Registration
466 if (EFI_ERROR (TcgStatus
)) {
467 TcgStatus
= gBS
->LocateProtocol (
468 &gEfiTcg2ProtocolGuid
,
469 NULL
, // Registration
474 if (!EFI_ERROR (TcgStatus
)) {
476 // The MOR variable originates from the platform firmware; set the MOR
477 // Control Lock variable to report the locking capability to the OS.
479 SetMorLockVariable (0);
484 // The MOR variable's origin is inexplicable; delete it.
488 "%a: deleting unexpected / unsupported variable %g:%s\n",
490 &gEfiMemoryOverwriteControlDataGuid
,
491 MEMORY_OVERWRITE_REQUEST_VARIABLE_NAME
495 VariableServiceSetVariable (
496 MEMORY_OVERWRITE_REQUEST_VARIABLE_NAME
,
497 &gEfiMemoryOverwriteControlDataGuid
,
502 mMorPassThru
= FALSE
;
506 // The MOR variable is absent; the platform firmware does not support it.
507 // Lock the variable so that no other module may create it.
509 VariableLockRequestToLock (
511 MEMORY_OVERWRITE_REQUEST_VARIABLE_NAME
,
512 &gEfiMemoryOverwriteControlDataGuid
516 // Delete the MOR Control Lock variable too (should it exists for some
517 // reason) and prevent other modules from creating it.
519 mMorLockPassThru
= TRUE
;
520 VariableServiceSetVariable (
521 MEMORY_OVERWRITE_REQUEST_CONTROL_LOCK_NAME
,
522 &gEfiMemoryOverwriteRequestControlLockGuid
,
527 mMorLockPassThru
= FALSE
;
529 VariableLockRequestToLock (
531 MEMORY_OVERWRITE_REQUEST_CONTROL_LOCK_NAME
,
532 &gEfiMemoryOverwriteRequestControlLockGuid