2 Implement authentication services for the authenticated variables.
4 Caution: This module requires additional review when modified.
5 This driver will have external input - variable data. It may be input in SMM mode.
6 This external input must be validated carefully to avoid security issue like
7 buffer overflow, integer overflow.
8 Variable attribute should also be checked to avoid authentication bypass.
9 The whole SMM authentication variable design relies on the integrity of flash part and SMM.
10 which is assumed to be protected by platform. All variable code and metadata in flash/SMM Memory
11 may not be modified without authorization. If platform fails to protect these resources,
12 the authentication service provided in this driver will be broken, and the behavior is undefined.
14 Copyright (c) 2015 - 2016, Intel Corporation. All rights reserved.<BR>
15 This program and the accompanying materials
16 are licensed and made available under the terms and conditions of the BSD License
17 which accompanies this distribution. The full text of the license may be found at
18 http://opensource.org/licenses/bsd-license.php
20 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
21 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
25 #include "AuthServiceInternal.h"
28 /// Global database array for scratch
35 UINT32 mMaxCertDbSize
;
37 UINT8 mVendorKeyState
;
38 BOOLEAN mUserPhysicalPresent
;
40 EFI_GUID mSignatureSupport
[] = {EFI_CERT_SHA1_GUID
, EFI_CERT_SHA256_GUID
, EFI_CERT_RSA2048_GUID
, EFI_CERT_X509_GUID
};
43 // Hash context pointer
45 VOID
*mHashCtx
= NULL
;
47 VARIABLE_ENTRY_PROPERTY mAuthVarEntry
[] = {
49 &gEfiSecureBootEnableDisableGuid
,
50 EFI_SECURE_BOOT_ENABLE_NAME
,
52 VAR_CHECK_VARIABLE_PROPERTY_REVISION
,
54 VARIABLE_ATTRIBUTE_NV_BS
,
60 &gEfiCustomModeEnableGuid
,
63 VAR_CHECK_VARIABLE_PROPERTY_REVISION
,
65 VARIABLE_ATTRIBUTE_NV_BS
,
71 &gEfiVendorKeysNvGuid
,
72 EFI_VENDOR_KEYS_NV_VARIABLE_NAME
,
74 VAR_CHECK_VARIABLE_PROPERTY_REVISION
,
75 VAR_CHECK_VARIABLE_PROPERTY_READ_ONLY
,
76 VARIABLE_ATTRIBUTE_NV_BS_RT_AT
,
82 &gEfiAuthenticatedVariableGuid
,
85 VAR_CHECK_VARIABLE_PROPERTY_REVISION
,
86 VAR_CHECK_VARIABLE_PROPERTY_READ_ONLY
,
87 VARIABLE_ATTRIBUTE_NV_BS_RT_AW
,
96 VAR_CHECK_VARIABLE_PROPERTY_REVISION
,
97 VAR_CHECK_VARIABLE_PROPERTY_READ_ONLY
,
98 VARIABLE_ATTRIBUTE_NV_BS_RT_AT
,
105 EFI_CERT_DB_VOLATILE_NAME
,
107 VAR_CHECK_VARIABLE_PROPERTY_REVISION
,
108 VAR_CHECK_VARIABLE_PROPERTY_READ_ONLY
,
109 VARIABLE_ATTRIBUTE_BS_RT_AT
,
116 VOID
**mAuthVarAddressPointer
[10];
118 AUTH_VAR_LIB_CONTEXT_IN
*mAuthVarLibContextIn
= NULL
;
121 Initialization for authenticated varibale services.
122 If this initialization returns error status, other APIs will not work
123 and expect to be not called then.
125 @param[in] AuthVarLibContextIn Pointer to input auth variable lib context.
126 @param[out] AuthVarLibContextOut Pointer to output auth variable lib context.
128 @retval EFI_SUCCESS Function successfully executed.
129 @retval EFI_INVALID_PARAMETER If AuthVarLibContextIn == NULL or AuthVarLibContextOut == NULL.
130 @retval EFI_OUT_OF_RESOURCES Fail to allocate enough resource.
131 @retval EFI_UNSUPPORTED Unsupported to process authenticated variable.
136 AuthVariableLibInitialize (
137 IN AUTH_VAR_LIB_CONTEXT_IN
*AuthVarLibContextIn
,
138 OUT AUTH_VAR_LIB_CONTEXT_OUT
*AuthVarLibContextOut
147 UINT8 SecureBootMode
;
148 UINT8 SecureBootEnable
;
152 if ((AuthVarLibContextIn
== NULL
) || (AuthVarLibContextOut
== NULL
)) {
153 return EFI_INVALID_PARAMETER
;
156 mAuthVarLibContextIn
= AuthVarLibContextIn
;
159 // Initialize hash context.
161 CtxSize
= Sha256GetContextSize ();
162 mHashCtx
= AllocateRuntimePool (CtxSize
);
163 if (mHashCtx
== NULL
) {
164 return EFI_OUT_OF_RESOURCES
;
168 // Reserve runtime buffer for public key database. The size excludes variable header and name size.
170 mMaxKeyDbSize
= (UINT32
) (mAuthVarLibContextIn
->MaxAuthVariableSize
- sizeof (AUTHVAR_KEYDB_NAME
));
171 mMaxKeyNumber
= mMaxKeyDbSize
/ sizeof (AUTHVAR_KEY_DB_DATA
);
172 mPubKeyStore
= AllocateRuntimePool (mMaxKeyDbSize
);
173 if (mPubKeyStore
== NULL
) {
174 return EFI_OUT_OF_RESOURCES
;
178 // Reserve runtime buffer for certificate database. The size excludes variable header and name size.
179 // Use EFI_CERT_DB_VOLATILE_NAME size since it is longer.
181 mMaxCertDbSize
= (UINT32
) (mAuthVarLibContextIn
->MaxAuthVariableSize
- sizeof (EFI_CERT_DB_VOLATILE_NAME
));
182 mCertDbStore
= AllocateRuntimePool (mMaxCertDbSize
);
183 if (mCertDbStore
== NULL
) {
184 return EFI_OUT_OF_RESOURCES
;
188 // Check "AuthVarKeyDatabase" variable's existence.
189 // If it doesn't exist, create a new one with initial value of 0 and EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
191 Status
= AuthServiceInternalFindVariable (
193 &gEfiAuthenticatedVariableGuid
,
197 if (EFI_ERROR (Status
)) {
198 VarAttr
= EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_RUNTIME_ACCESS
| EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
;
201 Status
= AuthServiceInternalUpdateVariable (
203 &gEfiAuthenticatedVariableGuid
,
208 if (EFI_ERROR (Status
)) {
213 // Load database in global variable for cache.
215 ASSERT ((DataSize
!= 0) && (Data
!= NULL
));
217 // "AuthVarKeyDatabase" is an internal variable. Its DataSize is always ensured not to exceed mPubKeyStore buffer size(See definition before)
218 // Therefore, there is no memory overflow in underlying CopyMem.
220 CopyMem (mPubKeyStore
, (UINT8
*) Data
, DataSize
);
221 mPubKeyNumber
= (UINT32
) (DataSize
/ sizeof (AUTHVAR_KEY_DB_DATA
));
224 Status
= AuthServiceInternalFindVariable (EFI_PLATFORM_KEY_NAME
, &gEfiGlobalVariableGuid
, (VOID
**) &Data
, &DataSize
);
225 if (EFI_ERROR (Status
)) {
226 DEBUG ((EFI_D_INFO
, "Variable %s does not exist.\n", EFI_PLATFORM_KEY_NAME
));
228 DEBUG ((EFI_D_INFO
, "Variable %s exists.\n", EFI_PLATFORM_KEY_NAME
));
232 // Create "SetupMode" variable with BS+RT attribute set.
234 if (EFI_ERROR (Status
)) {
235 mPlatformMode
= SETUP_MODE
;
237 mPlatformMode
= USER_MODE
;
239 Status
= AuthServiceInternalUpdateVariable (
241 &gEfiGlobalVariableGuid
,
244 EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_RUNTIME_ACCESS
246 if (EFI_ERROR (Status
)) {
251 // Create "SignatureSupport" variable with BS+RT attribute set.
253 Status
= AuthServiceInternalUpdateVariable (
254 EFI_SIGNATURE_SUPPORT_NAME
,
255 &gEfiGlobalVariableGuid
,
257 sizeof(mSignatureSupport
),
258 EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_RUNTIME_ACCESS
260 if (EFI_ERROR (Status
)) {
265 // If "SecureBootEnable" variable exists, then update "SecureBoot" variable.
266 // If "SecureBootEnable" variable is SECURE_BOOT_ENABLE and in USER_MODE, Set "SecureBoot" variable to SECURE_BOOT_MODE_ENABLE.
267 // If "SecureBootEnable" variable is SECURE_BOOT_DISABLE, Set "SecureBoot" variable to SECURE_BOOT_MODE_DISABLE.
269 SecureBootEnable
= SECURE_BOOT_DISABLE
;
270 Status
= AuthServiceInternalFindVariable (EFI_SECURE_BOOT_ENABLE_NAME
, &gEfiSecureBootEnableDisableGuid
, (VOID
**) &Data
, &DataSize
);
271 if (!EFI_ERROR (Status
)) {
272 if (mPlatformMode
== USER_MODE
){
273 SecureBootEnable
= *(UINT8
*) Data
;
275 } else if (mPlatformMode
== USER_MODE
) {
277 // "SecureBootEnable" not exist, initialize it in USER_MODE.
279 SecureBootEnable
= SECURE_BOOT_ENABLE
;
280 Status
= AuthServiceInternalUpdateVariable (
281 EFI_SECURE_BOOT_ENABLE_NAME
,
282 &gEfiSecureBootEnableDisableGuid
,
285 EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_BOOTSERVICE_ACCESS
287 if (EFI_ERROR (Status
)) {
293 // Create "SecureBoot" variable with BS+RT attribute set.
295 if (SecureBootEnable
== SECURE_BOOT_ENABLE
&& mPlatformMode
== USER_MODE
) {
296 SecureBootMode
= SECURE_BOOT_MODE_ENABLE
;
298 SecureBootMode
= SECURE_BOOT_MODE_DISABLE
;
300 Status
= AuthServiceInternalUpdateVariable (
301 EFI_SECURE_BOOT_MODE_NAME
,
302 &gEfiGlobalVariableGuid
,
305 EFI_VARIABLE_RUNTIME_ACCESS
| EFI_VARIABLE_BOOTSERVICE_ACCESS
307 if (EFI_ERROR (Status
)) {
311 DEBUG ((EFI_D_INFO
, "Variable %s is %x\n", EFI_SETUP_MODE_NAME
, mPlatformMode
));
312 DEBUG ((EFI_D_INFO
, "Variable %s is %x\n", EFI_SECURE_BOOT_MODE_NAME
, SecureBootMode
));
313 DEBUG ((EFI_D_INFO
, "Variable %s is %x\n", EFI_SECURE_BOOT_ENABLE_NAME
, SecureBootEnable
));
316 // Initialize "CustomMode" in STANDARD_SECURE_BOOT_MODE state.
318 CustomMode
= STANDARD_SECURE_BOOT_MODE
;
319 Status
= AuthServiceInternalUpdateVariable (
320 EFI_CUSTOM_MODE_NAME
,
321 &gEfiCustomModeEnableGuid
,
324 EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_BOOTSERVICE_ACCESS
326 if (EFI_ERROR (Status
)) {
330 DEBUG ((EFI_D_INFO
, "Variable %s is %x\n", EFI_CUSTOM_MODE_NAME
, CustomMode
));
333 // Check "certdb" variable's existence.
334 // If it doesn't exist, then create a new one with
335 // EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.
337 Status
= AuthServiceInternalFindVariable (
343 if (EFI_ERROR (Status
)) {
344 VarAttr
= EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_RUNTIME_ACCESS
| EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS
;
345 ListSize
= sizeof (UINT32
);
346 Status
= AuthServiceInternalUpdateVariable (
353 if (EFI_ERROR (Status
)) {
358 // Clean up Certs to make certDB & Time based auth variable consistent
360 Status
= CleanCertsFromDb();
361 if (EFI_ERROR (Status
)) {
362 DEBUG ((EFI_D_ERROR
, "Clean up CertDB fail! Status %x\n", Status
));
368 // Create "certdbv" variable with RT+BS+AT set.
370 VarAttr
= EFI_VARIABLE_RUNTIME_ACCESS
| EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS
;
371 ListSize
= sizeof (UINT32
);
372 Status
= AuthServiceInternalUpdateVariable (
373 EFI_CERT_DB_VOLATILE_NAME
,
379 if (EFI_ERROR (Status
)) {
384 // Check "VendorKeysNv" variable's existence and create "VendorKeys" variable accordingly.
386 Status
= AuthServiceInternalFindVariable (EFI_VENDOR_KEYS_NV_VARIABLE_NAME
, &gEfiVendorKeysNvGuid
, (VOID
**) &Data
, &DataSize
);
387 if (!EFI_ERROR (Status
)) {
388 mVendorKeyState
= *(UINT8
*)Data
;
391 // "VendorKeysNv" not exist, initialize it in VENDOR_KEYS_VALID state.
393 mVendorKeyState
= VENDOR_KEYS_VALID
;
394 Status
= AuthServiceInternalUpdateVariable (
395 EFI_VENDOR_KEYS_NV_VARIABLE_NAME
,
396 &gEfiVendorKeysNvGuid
,
399 EFI_VARIABLE_NON_VOLATILE
| EFI_VARIABLE_BOOTSERVICE_ACCESS
| EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS
401 if (EFI_ERROR (Status
)) {
407 // Create "VendorKeys" variable with BS+RT attribute set.
409 Status
= AuthServiceInternalUpdateVariable (
410 EFI_VENDOR_KEYS_VARIABLE_NAME
,
411 &gEfiGlobalVariableGuid
,
414 EFI_VARIABLE_RUNTIME_ACCESS
| EFI_VARIABLE_BOOTSERVICE_ACCESS
416 if (EFI_ERROR (Status
)) {
420 DEBUG ((EFI_D_INFO
, "Variable %s is %x\n", EFI_VENDOR_KEYS_VARIABLE_NAME
, mVendorKeyState
));
422 AuthVarLibContextOut
->StructVersion
= AUTH_VAR_LIB_CONTEXT_OUT_STRUCT_VERSION
;
423 AuthVarLibContextOut
->StructSize
= sizeof (AUTH_VAR_LIB_CONTEXT_OUT
);
424 AuthVarLibContextOut
->AuthVarEntry
= mAuthVarEntry
;
425 AuthVarLibContextOut
->AuthVarEntryCount
= sizeof (mAuthVarEntry
) / sizeof (mAuthVarEntry
[0]);
426 mAuthVarAddressPointer
[0] = (VOID
**) &mPubKeyStore
;
427 mAuthVarAddressPointer
[1] = (VOID
**) &mCertDbStore
;
428 mAuthVarAddressPointer
[2] = (VOID
**) &mHashCtx
;
429 mAuthVarAddressPointer
[3] = (VOID
**) &mAuthVarLibContextIn
;
430 mAuthVarAddressPointer
[4] = (VOID
**) &(mAuthVarLibContextIn
->FindVariable
),
431 mAuthVarAddressPointer
[5] = (VOID
**) &(mAuthVarLibContextIn
->FindNextVariable
),
432 mAuthVarAddressPointer
[6] = (VOID
**) &(mAuthVarLibContextIn
->UpdateVariable
),
433 mAuthVarAddressPointer
[7] = (VOID
**) &(mAuthVarLibContextIn
->GetScratchBuffer
),
434 mAuthVarAddressPointer
[8] = (VOID
**) &(mAuthVarLibContextIn
->CheckRemainingSpaceForConsistency
),
435 mAuthVarAddressPointer
[9] = (VOID
**) &(mAuthVarLibContextIn
->AtRuntime
),
436 AuthVarLibContextOut
->AddressPointer
= mAuthVarAddressPointer
;
437 AuthVarLibContextOut
->AddressPointerCount
= sizeof (mAuthVarAddressPointer
) / sizeof (mAuthVarAddressPointer
[0]);
440 // Cache UserPhysicalPresent State.
441 // Platform should report PhysicalPresent before this point
443 mUserPhysicalPresent
= UserPhysicalPresent();
449 Process variable with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS/EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS set.
451 @param[in] VariableName Name of the variable.
452 @param[in] VendorGuid Variable vendor GUID.
453 @param[in] Data Data pointer.
454 @param[in] DataSize Size of Data.
455 @param[in] Attributes Attribute value of the variable.
457 @retval EFI_SUCCESS The firmware has successfully stored the variable and its data as
458 defined by the Attributes.
459 @retval EFI_INVALID_PARAMETER Invalid parameter.
460 @retval EFI_WRITE_PROTECTED Variable is write-protected.
461 @retval EFI_OUT_OF_RESOURCES There is not enough resource.
462 @retval EFI_SECURITY_VIOLATION The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
463 or EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACESS
464 set, but the AuthInfo does NOT pass the validation
465 check carried out by the firmware.
466 @retval EFI_UNSUPPORTED Unsupported to process authenticated variable.
471 AuthVariableLibProcessVariable (
472 IN CHAR16
*VariableName
,
473 IN EFI_GUID
*VendorGuid
,
481 if (CompareGuid (VendorGuid
, &gEfiGlobalVariableGuid
) && (StrCmp (VariableName
, EFI_PLATFORM_KEY_NAME
) == 0)){
482 Status
= ProcessVarWithPk (VariableName
, VendorGuid
, Data
, DataSize
, Attributes
, TRUE
);
483 } else if (CompareGuid (VendorGuid
, &gEfiGlobalVariableGuid
) && (StrCmp (VariableName
, EFI_KEY_EXCHANGE_KEY_NAME
) == 0)) {
484 Status
= ProcessVarWithPk (VariableName
, VendorGuid
, Data
, DataSize
, Attributes
, FALSE
);
485 } else if (CompareGuid (VendorGuid
, &gEfiImageSecurityDatabaseGuid
) &&
486 ((StrCmp (VariableName
, EFI_IMAGE_SECURITY_DATABASE
) == 0) ||
487 (StrCmp (VariableName
, EFI_IMAGE_SECURITY_DATABASE1
) == 0) ||
488 (StrCmp (VariableName
, EFI_IMAGE_SECURITY_DATABASE2
) == 0)
490 Status
= ProcessVarWithPk (VariableName
, VendorGuid
, Data
, DataSize
, Attributes
, FALSE
);
491 if (EFI_ERROR (Status
)) {
492 Status
= ProcessVarWithKek (VariableName
, VendorGuid
, Data
, DataSize
, Attributes
);
495 Status
= ProcessVariable (VariableName
, VendorGuid
, Data
, DataSize
, Attributes
);