2 Implement authentication services for the authenticated variables.
4 Caution: This module requires additional review when modified.
5 This driver will have external input - variable data. It may be input in SMM mode.
6 This external input must be validated carefully to avoid security issue like
7 buffer overflow, integer overflow.
8 Variable attribute should also be checked to avoid authentication bypass.
9 The whole SMM authentication variable design relies on the integrity of flash part and SMM.
10 which is assumed to be protected by platform. All variable code and metadata in flash/SMM Memory
11 may not be modified without authorization. If platform fails to protect these resources,
12 the authentication service provided in this driver will be broken, and the behavior is undefined.
14 Copyright (c) 2015 - 2016, Intel Corporation. All rights reserved.<BR>
15 This program and the accompanying materials
16 are licensed and made available under the terms and conditions of the BSD License
17 which accompanies this distribution. The full text of the license may be found at
18 http://opensource.org/licenses/bsd-license.php
20 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
21 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
25 #include "AuthServiceInternal.h"
28 /// Global database array for scratch
31 UINT32 mMaxCertDbSize
;
33 UINT8 mVendorKeyState
;
35 EFI_GUID mSignatureSupport
[] = {EFI_CERT_SHA1_GUID
, EFI_CERT_SHA256_GUID
, EFI_CERT_RSA2048_GUID
, EFI_CERT_X509_GUID
};
38 // Hash context pointer
40 VOID
*mHashCtx
= NULL
;
42 VARIABLE_ENTRY_PROPERTY mAuthVarEntry
[] = {
44 &gEfiSecureBootEnableDisableGuid
,
45 EFI_SECURE_BOOT_ENABLE_NAME
,
47 VAR_CHECK_VARIABLE_PROPERTY_REVISION
,
49 VARIABLE_ATTRIBUTE_NV_BS
,
55 &gEfiCustomModeEnableGuid
,
58 VAR_CHECK_VARIABLE_PROPERTY_REVISION
,
60 VARIABLE_ATTRIBUTE_NV_BS
,
66 &gEfiVendorKeysNvGuid
,
67 EFI_VENDOR_KEYS_NV_VARIABLE_NAME
,
69 VAR_CHECK_VARIABLE_PROPERTY_REVISION
,
70 VAR_CHECK_VARIABLE_PROPERTY_READ_ONLY
,
71 VARIABLE_ATTRIBUTE_NV_BS_RT_AT
,
80 VAR_CHECK_VARIABLE_PROPERTY_REVISION
,
81 VAR_CHECK_VARIABLE_PROPERTY_READ_ONLY
,
82 VARIABLE_ATTRIBUTE_NV_BS_RT_AT
,
89 EFI_CERT_DB_VOLATILE_NAME
,
91 VAR_CHECK_VARIABLE_PROPERTY_REVISION
,
92 VAR_CHECK_VARIABLE_PROPERTY_READ_ONLY
,
93 VARIABLE_ATTRIBUTE_BS_RT_AT
,
100 VOID
**mAuthVarAddressPointer
[9];
102 AUTH_VAR_LIB_CONTEXT_IN
*mAuthVarLibContextIn
= NULL
;
105 Initialization for authenticated varibale services.
106 If this initialization returns error status, other APIs will not work
107 and expect to be not called then.
109 @param[in] AuthVarLibContextIn Pointer to input auth variable lib context.
110 @param[out] AuthVarLibContextOut Pointer to output auth variable lib context.
112 @retval EFI_SUCCESS Function successfully executed.
113 @retval EFI_INVALID_PARAMETER If AuthVarLibContextIn == NULL or AuthVarLibContextOut == NULL.
114 @retval EFI_OUT_OF_RESOURCES Fail to allocate enough resource.
115 @retval EFI_UNSUPPORTED Unsupported to process authenticated variable.
120 AuthVariableLibInitialize (
121 IN AUTH_VAR_LIB_CONTEXT_IN
*AuthVarLibContextIn
,
122 OUT AUTH_VAR_LIB_CONTEXT_OUT
*AuthVarLibContextOut
130 UINT8 SecureBootMode
;
131 UINT8 SecureBootEnable
;
135 if ((AuthVarLibContextIn
== NULL
) || (AuthVarLibContextOut
== NULL
)) {
136 return EFI_INVALID_PARAMETER
;
139 mAuthVarLibContextIn
= AuthVarLibContextIn
;
142 // Initialize hash context.
144 CtxSize
= Sha256GetContextSize ();
145 mHashCtx
= AllocateRuntimePool (CtxSize
);
146 if (mHashCtx
== NULL
) {
147 return EFI_OUT_OF_RESOURCES
;
151 // Reserve runtime buffer for certificate database. The size excludes variable header and name size.
152 // Use EFI_CERT_DB_VOLATILE_NAME size since it is longer.
154 mMaxCertDbSize
= (UINT32
) (mAuthVarLibContextIn
->MaxAuthVariableSize
- sizeof (EFI_CERT_DB_VOLATILE_NAME
));
155 mCertDbStore
= AllocateRuntimePool (mMaxCertDbSize
);
156 if (mCertDbStore
== NULL
) {
157 return EFI_OUT_OF_RESOURCES
;
160 Status
= AuthServiceInternalFindVariable (EFI_PLATFORM_KEY_NAME
, &gEfiGlobalVariableGuid
, (VOID
**) &Data
, &DataSize
);
161 if (EFI_ERROR (Status
)) {
162 DEBUG ((EFI_D_INFO
, "Variable %s does not exist.\n", EFI_PLATFORM_KEY_NAME
));
164 DEBUG ((EFI_D_INFO
, "Variable %s exists.\n", EFI_PLATFORM_KEY_NAME
));
168 // Create "SetupMode" variable with BS+RT attribute set.
170 if (EFI_ERROR (Status
)) {
171 mPlatformMode
= SETUP_MODE
;
173 mPlatformMode
= USER_MODE
;
175 Status
= AuthServiceInternalUpdateVariable (
177 &gEfiGlobalVariableGuid
,
180 EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_RUNTIME_ACCESS
182 if (EFI_ERROR (Status
)) {
187 // Create "SignatureSupport" variable with BS+RT attribute set.
189 Status
= AuthServiceInternalUpdateVariable (
190 EFI_SIGNATURE_SUPPORT_NAME
,
191 &gEfiGlobalVariableGuid
,
193 sizeof(mSignatureSupport
),
194 EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_RUNTIME_ACCESS
196 if (EFI_ERROR (Status
)) {
201 // If "SecureBootEnable" variable exists, then update "SecureBoot" variable.
202 // If "SecureBootEnable" variable is SECURE_BOOT_ENABLE and in USER_MODE, Set "SecureBoot" variable to SECURE_BOOT_MODE_ENABLE.
203 // If "SecureBootEnable" variable is SECURE_BOOT_DISABLE, Set "SecureBoot" variable to SECURE_BOOT_MODE_DISABLE.
205 SecureBootEnable
= SECURE_BOOT_DISABLE
;
206 Status
= AuthServiceInternalFindVariable (EFI_SECURE_BOOT_ENABLE_NAME
, &gEfiSecureBootEnableDisableGuid
, (VOID
**) &Data
, &DataSize
);
207 if (!EFI_ERROR (Status
)) {
208 if (mPlatformMode
== USER_MODE
){
209 SecureBootEnable
= *(UINT8
*) Data
;
211 } else if (mPlatformMode
== USER_MODE
) {
213 // "SecureBootEnable" not exist, initialize it in USER_MODE.
215 SecureBootEnable
= SECURE_BOOT_ENABLE
;
216 Status
= AuthServiceInternalUpdateVariable (
217 EFI_SECURE_BOOT_ENABLE_NAME
,
218 &gEfiSecureBootEnableDisableGuid
,
221 EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_BOOTSERVICE_ACCESS
223 if (EFI_ERROR (Status
)) {
229 // Create "SecureBoot" variable with BS+RT attribute set.
231 if (SecureBootEnable
== SECURE_BOOT_ENABLE
&& mPlatformMode
== USER_MODE
) {
232 SecureBootMode
= SECURE_BOOT_MODE_ENABLE
;
234 SecureBootMode
= SECURE_BOOT_MODE_DISABLE
;
236 Status
= AuthServiceInternalUpdateVariable (
237 EFI_SECURE_BOOT_MODE_NAME
,
238 &gEfiGlobalVariableGuid
,
241 EFI_VARIABLE_RUNTIME_ACCESS
| EFI_VARIABLE_BOOTSERVICE_ACCESS
243 if (EFI_ERROR (Status
)) {
247 DEBUG ((EFI_D_INFO
, "Variable %s is %x\n", EFI_SETUP_MODE_NAME
, mPlatformMode
));
248 DEBUG ((EFI_D_INFO
, "Variable %s is %x\n", EFI_SECURE_BOOT_MODE_NAME
, SecureBootMode
));
249 DEBUG ((EFI_D_INFO
, "Variable %s is %x\n", EFI_SECURE_BOOT_ENABLE_NAME
, SecureBootEnable
));
252 // Initialize "CustomMode" in STANDARD_SECURE_BOOT_MODE state.
254 CustomMode
= STANDARD_SECURE_BOOT_MODE
;
255 Status
= AuthServiceInternalUpdateVariable (
256 EFI_CUSTOM_MODE_NAME
,
257 &gEfiCustomModeEnableGuid
,
260 EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_BOOTSERVICE_ACCESS
262 if (EFI_ERROR (Status
)) {
266 DEBUG ((EFI_D_INFO
, "Variable %s is %x\n", EFI_CUSTOM_MODE_NAME
, CustomMode
));
269 // Check "certdb" variable's existence.
270 // If it doesn't exist, then create a new one with
271 // EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.
273 Status
= AuthServiceInternalFindVariable (
279 if (EFI_ERROR (Status
)) {
280 VarAttr
= EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_RUNTIME_ACCESS
| EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS
;
281 ListSize
= sizeof (UINT32
);
282 Status
= AuthServiceInternalUpdateVariable (
289 if (EFI_ERROR (Status
)) {
294 // Clean up Certs to make certDB & Time based auth variable consistent
296 Status
= CleanCertsFromDb();
297 if (EFI_ERROR (Status
)) {
298 DEBUG ((EFI_D_ERROR
, "Clean up CertDB fail! Status %x\n", Status
));
304 // Create "certdbv" variable with RT+BS+AT set.
306 VarAttr
= EFI_VARIABLE_RUNTIME_ACCESS
| EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS
;
307 ListSize
= sizeof (UINT32
);
308 Status
= AuthServiceInternalUpdateVariable (
309 EFI_CERT_DB_VOLATILE_NAME
,
315 if (EFI_ERROR (Status
)) {
320 // Check "VendorKeysNv" variable's existence and create "VendorKeys" variable accordingly.
322 Status
= AuthServiceInternalFindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME
, &gEfiVendorKeysNvGuid
, (VOID
**) &Data
, &DataSize
);
323 if (!EFI_ERROR (Status
)) {
324 mVendorKeyState
= *(UINT8
*)Data
;
327 // "VendorKeysNv" not exist, initialize it in VENDOR_KEYS_VALID state.
329 mVendorKeyState
= VENDOR_KEYS_VALID
;
330 Status
= AuthServiceInternalUpdateVariable (
331 EFI_VENDOR_KEYS_NV_VARIABLE_NAME
,
332 &gEfiVendorKeysNvGuid
,
335 EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS
337 if (EFI_ERROR (Status
)) {
343 // Create "VendorKeys" variable with BS+RT attribute set.
345 Status
= AuthServiceInternalUpdateVariable (
346 EFI_VENDOR_KEYS_VARIABLE_NAME
,
347 &gEfiGlobalVariableGuid
,
350 EFI_VARIABLE_RUNTIME_ACCESS
| EFI_VARIABLE_BOOTSERVICE_ACCESS
352 if (EFI_ERROR (Status
)) {
356 DEBUG ((EFI_D_INFO
, "Variable %s is %x\n", EFI_VENDOR_KEYS_VARIABLE_NAME
, mVendorKeyState
));
358 AuthVarLibContextOut
->StructVersion
= AUTH_VAR_LIB_CONTEXT_OUT_STRUCT_VERSION
;
359 AuthVarLibContextOut
->StructSize
= sizeof (AUTH_VAR_LIB_CONTEXT_OUT
);
360 AuthVarLibContextOut
->AuthVarEntry
= mAuthVarEntry
;
361 AuthVarLibContextOut
->AuthVarEntryCount
= ARRAY_SIZE (mAuthVarEntry
);
362 mAuthVarAddressPointer
[0] = (VOID
**) &mCertDbStore
;
363 mAuthVarAddressPointer
[1] = (VOID
**) &mHashCtx
;
364 mAuthVarAddressPointer
[2] = (VOID
**) &mAuthVarLibContextIn
;
365 mAuthVarAddressPointer
[3] = (VOID
**) &(mAuthVarLibContextIn
->FindVariable
),
366 mAuthVarAddressPointer
[4] = (VOID
**) &(mAuthVarLibContextIn
->FindNextVariable
),
367 mAuthVarAddressPointer
[5] = (VOID
**) &(mAuthVarLibContextIn
->UpdateVariable
),
368 mAuthVarAddressPointer
[6] = (VOID
**) &(mAuthVarLibContextIn
->GetScratchBuffer
),
369 mAuthVarAddressPointer
[7] = (VOID
**) &(mAuthVarLibContextIn
->CheckRemainingSpaceForConsistency
),
370 mAuthVarAddressPointer
[8] = (VOID
**) &(mAuthVarLibContextIn
->AtRuntime
),
371 AuthVarLibContextOut
->AddressPointer
= mAuthVarAddressPointer
;
372 AuthVarLibContextOut
->AddressPointerCount
= ARRAY_SIZE (mAuthVarAddressPointer
);
378 Process variable with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.
380 @param[in] VariableName Name of the variable.
381 @param[in] VendorGuid Variable vendor GUID.
382 @param[in] Data Data pointer.
383 @param[in] DataSize Size of Data.
384 @param[in] Attributes Attribute value of the variable.
386 @retval EFI_SUCCESS The firmware has successfully stored the variable and its data as
387 defined by the Attributes.
388 @retval EFI_INVALID_PARAMETER Invalid parameter.
389 @retval EFI_WRITE_PROTECTED Variable is write-protected.
390 @retval EFI_OUT_OF_RESOURCES There is not enough resource.
391 @retval EFI_SECURITY_VIOLATION The variable is with EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACESS
392 set, but the AuthInfo does NOT pass the validation
393 check carried out by the firmware.
394 @retval EFI_UNSUPPORTED Unsupported to process authenticated variable.
399 AuthVariableLibProcessVariable (
400 IN CHAR16
*VariableName
,
401 IN EFI_GUID
*VendorGuid
,
409 if (CompareGuid (VendorGuid
, &gEfiGlobalVariableGuid
) && (StrCmp (VariableName
, EFI_PLATFORM_KEY_NAME
) == 0)){
410 Status
= ProcessVarWithPk (VariableName
, VendorGuid
, Data
, DataSize
, Attributes
, TRUE
);
411 } else if (CompareGuid (VendorGuid
, &gEfiGlobalVariableGuid
) && (StrCmp (VariableName
, EFI_KEY_EXCHANGE_KEY_NAME
) == 0)) {
412 Status
= ProcessVarWithPk (VariableName
, VendorGuid
, Data
, DataSize
, Attributes
, FALSE
);
413 } else if (CompareGuid (VendorGuid
, &gEfiImageSecurityDatabaseGuid
) &&
414 ((StrCmp (VariableName
, EFI_IMAGE_SECURITY_DATABASE
) == 0) ||
415 (StrCmp (VariableName
, EFI_IMAGE_SECURITY_DATABASE1
) == 0) ||
416 (StrCmp (VariableName
, EFI_IMAGE_SECURITY_DATABASE2
) == 0)
418 Status
= ProcessVarWithPk (VariableName
, VendorGuid
, Data
, DataSize
, Attributes
, FALSE
);
419 if (EFI_ERROR (Status
)) {
420 Status
= ProcessVarWithKek (VariableName
, VendorGuid
, Data
, DataSize
, Attributes
);
423 Status
= ProcessVariable (VariableName
, VendorGuid
, Data
, DataSize
, Attributes
);