MdeModulePkg: Deprecate EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
[mirror_edk2.git] / MdeModulePkg / Universal / Variable / RuntimeDxe / TcgMorLockSmm.c
1 /** @file
2 TCG MOR (Memory Overwrite Request) Lock Control support (SMM version).
3
4 This module initilizes MemoryOverwriteRequestControlLock variable.
5 This module adds Variable Hook and check MemoryOverwriteRequestControlLock.
6
7 Copyright (c) 2016 - 2017, Intel Corporation. All rights reserved.<BR>
8 This program and the accompanying materials
9 are licensed and made available under the terms and conditions of the BSD License
10 which accompanies this distribution. The full text of the license may be found at
11 http://opensource.org/licenses/bsd-license.php
12
13 THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,
14 WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
15
16 **/
17
18 #include <PiDxe.h>
19 #include <Guid/MemoryOverwriteControl.h>
20 #include <IndustryStandard/MemoryOverwriteRequestControlLock.h>
21 #include <Library/DebugLib.h>
22 #include <Library/BaseLib.h>
23 #include <Library/BaseMemoryLib.h>
24 #include <Library/UefiBootServicesTableLib.h>
25 #include "Variable.h"
26
27 typedef struct {
28 CHAR16 *VariableName;
29 EFI_GUID *VendorGuid;
30 } VARIABLE_TYPE;
31
32 VARIABLE_TYPE mMorVariableType[] = {
33 {MEMORY_OVERWRITE_REQUEST_VARIABLE_NAME, &gEfiMemoryOverwriteControlDataGuid},
34 {MEMORY_OVERWRITE_REQUEST_CONTROL_LOCK_NAME, &gEfiMemoryOverwriteRequestControlLockGuid},
35 };
36
37 BOOLEAN mMorPassThru = FALSE;
38
39 #define MOR_LOCK_DATA_UNLOCKED 0x0
40 #define MOR_LOCK_DATA_LOCKED_WITHOUT_KEY 0x1
41 #define MOR_LOCK_DATA_LOCKED_WITH_KEY 0x2
42
43 #define MOR_LOCK_V1_SIZE 1
44 #define MOR_LOCK_V2_KEY_SIZE 8
45
46 typedef enum {
47 MorLockStateUnlocked = 0,
48 MorLockStateLocked = 1,
49 } MOR_LOCK_STATE;
50
51 BOOLEAN mMorLockInitializationRequired = FALSE;
52 UINT8 mMorLockKey[MOR_LOCK_V2_KEY_SIZE];
53 BOOLEAN mMorLockKeyEmpty = TRUE;
54 BOOLEAN mMorLockPassThru = FALSE;
55 MOR_LOCK_STATE mMorLockState = MorLockStateUnlocked;
56
57 /**
58 Returns if this is MOR related variable.
59
60 @param VariableName the name of the vendor's variable, it's a Null-Terminated Unicode String
61 @param VendorGuid Unify identifier for vendor.
62
63 @retval TRUE The variable is MOR related.
64 @retval FALSE The variable is NOT MOR related.
65 **/
66 BOOLEAN
67 IsAnyMorVariable (
68 IN CHAR16 *VariableName,
69 IN EFI_GUID *VendorGuid
70 )
71 {
72 UINTN Index;
73
74 for (Index = 0; Index < sizeof(mMorVariableType)/sizeof(mMorVariableType[0]); Index++) {
75 if ((StrCmp (VariableName, mMorVariableType[Index].VariableName) == 0) &&
76 (CompareGuid (VendorGuid, mMorVariableType[Index].VendorGuid))) {
77 return TRUE;
78 }
79 }
80 return FALSE;
81 }
82
83 /**
84 Returns if this is MOR lock variable.
85
86 @param VariableName the name of the vendor's variable, it's a Null-Terminated Unicode String
87 @param VendorGuid Unify identifier for vendor.
88
89 @retval TRUE The variable is MOR lock variable.
90 @retval FALSE The variable is NOT MOR lock variable.
91 **/
92 BOOLEAN
93 IsMorLockVariable (
94 IN CHAR16 *VariableName,
95 IN EFI_GUID *VendorGuid
96 )
97 {
98 if ((StrCmp (VariableName, MEMORY_OVERWRITE_REQUEST_CONTROL_LOCK_NAME) == 0) &&
99 (CompareGuid (VendorGuid, &gEfiMemoryOverwriteRequestControlLockGuid))) {
100 return TRUE;
101 }
102 return FALSE;
103 }
104
105 /**
106 Set MOR lock variable.
107
108 @param Data MOR Lock variable data.
109
110 @retval EFI_SUCCESS The firmware has successfully stored the variable and its data as
111 defined by the Attributes.
112 @retval EFI_INVALID_PARAMETER An invalid combination of attribute bits was supplied, or the
113 DataSize exceeds the maximum allowed.
114 @retval EFI_INVALID_PARAMETER VariableName is an empty Unicode string.
115 @retval EFI_OUT_OF_RESOURCES Not enough storage is available to hold the variable and its data.
116 @retval EFI_DEVICE_ERROR The variable could not be saved due to a hardware failure.
117 @retval EFI_WRITE_PROTECTED The variable in question is read-only.
118 @retval EFI_WRITE_PROTECTED The variable in question cannot be deleted.
119 @retval EFI_SECURITY_VIOLATION The variable could not be written due to EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS
120 set but the AuthInfo does NOT pass the validation check carried
121 out by the firmware.
122 @retval EFI_NOT_FOUND The variable trying to be updated or deleted was not found.
123 **/
124 EFI_STATUS
125 SetMorLockVariable (
126 IN UINT8 Data
127 )
128 {
129 EFI_STATUS Status;
130
131 mMorLockPassThru = TRUE;
132 Status = VariableServiceSetVariable (
133 MEMORY_OVERWRITE_REQUEST_CONTROL_LOCK_NAME,
134 &gEfiMemoryOverwriteRequestControlLockGuid,
135 EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
136 sizeof(Data),
137 &Data
138 );
139 mMorLockPassThru = FALSE;
140 return Status;
141 }
142
143 /**
144 This service is an MorLock checker handler for the SetVariable().
145
146 @param VariableName the name of the vendor's variable, as a
147 Null-Terminated Unicode String
148 @param VendorGuid Unify identifier for vendor.
149 @param Attributes Point to memory location to return the attributes of variable. If the point
150 is NULL, the parameter would be ignored.
151 @param DataSize The size in bytes of Data-Buffer.
152 @param Data Point to the content of the variable.
153
154 @retval EFI_SUCCESS The MorLock check pass, and Variable driver can store the variable data.
155 @retval EFI_INVALID_PARAMETER The MorLock data or data size or attributes is not allowed.
156 @retval EFI_ACCESS_DENIED The MorLock is locked.
157 @retval EFI_WRITE_PROTECTED The MorLock deletion is not allowed.
158 @retval EFI_ALREADY_STARTED The MorLock variable is handled inside this function.
159 Variable driver can just return EFI_SUCCESS.
160 **/
161 EFI_STATUS
162 SetVariableCheckHandlerMorLock (
163 IN CHAR16 *VariableName,
164 IN EFI_GUID *VendorGuid,
165 IN UINT32 Attributes,
166 IN UINTN DataSize,
167 IN VOID *Data
168 )
169 {
170 EFI_STATUS Status;
171
172 //
173 // Basic Check
174 //
175 if (Attributes == 0 || DataSize == 0 || Data == NULL) {
176 //
177 // Permit deletion for passthru request, deny it otherwise.
178 //
179 return mMorLockPassThru ? EFI_SUCCESS : EFI_WRITE_PROTECTED;
180 }
181
182 if ((Attributes != (EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS)) ||
183 ((DataSize != MOR_LOCK_V1_SIZE) && (DataSize != MOR_LOCK_V2_KEY_SIZE))) {
184 return EFI_INVALID_PARAMETER;
185 }
186
187 //
188 // Do not check if the request is passthru.
189 //
190 if (mMorLockPassThru) {
191 return EFI_SUCCESS;
192 }
193
194 if (mMorLockState == MorLockStateUnlocked) {
195 //
196 // In Unlocked State
197 //
198 if (DataSize == MOR_LOCK_V1_SIZE) {
199 //
200 // V1 - lock permanently
201 //
202 if (*(UINT8 *)Data == MOR_LOCK_DATA_UNLOCKED) {
203 //
204 // Unlock
205 //
206 Status = SetMorLockVariable (MOR_LOCK_DATA_UNLOCKED);
207 if (!EFI_ERROR (Status)) {
208 //
209 // return EFI_ALREADY_STARTED to skip variable set.
210 //
211 return EFI_ALREADY_STARTED;
212 } else {
213 //
214 // SetVar fail
215 //
216 return Status;
217 }
218 } else if (*(UINT8 *)Data == MOR_LOCK_DATA_LOCKED_WITHOUT_KEY) {
219 //
220 // Lock without key
221 //
222 Status = SetMorLockVariable (MOR_LOCK_DATA_LOCKED_WITHOUT_KEY);
223 if (!EFI_ERROR (Status)) {
224 //
225 // Lock success
226 //
227 mMorLockState = MorLockStateLocked;
228 //
229 // return EFI_ALREADY_STARTED to skip variable set.
230 //
231 return EFI_ALREADY_STARTED;
232 } else {
233 //
234 // SetVar fail
235 //
236 return Status;
237 }
238 } else {
239 return EFI_INVALID_PARAMETER;
240 }
241 } else if (DataSize == MOR_LOCK_V2_KEY_SIZE) {
242 //
243 // V2 lock and provision the key
244 //
245
246 //
247 // Need set here because the data value on flash is different
248 //
249 Status = SetMorLockVariable (MOR_LOCK_DATA_LOCKED_WITH_KEY);
250 if (EFI_ERROR(Status)) {
251 //
252 // SetVar fail, do not provision the key
253 //
254 return Status;
255 } else {
256 //
257 // Lock success, provision the key
258 //
259 mMorLockKeyEmpty = FALSE;
260 CopyMem (mMorLockKey, Data, MOR_LOCK_V2_KEY_SIZE);
261 mMorLockState = MorLockStateLocked;
262 //
263 // return EFI_ALREADY_STARTED to skip variable set.
264 //
265 return EFI_ALREADY_STARTED;
266 }
267 } else {
268 ASSERT (FALSE);
269 return EFI_OUT_OF_RESOURCES;
270 }
271 } else {
272 //
273 // In Locked State
274 //
275 if (mMorLockKeyEmpty || (DataSize != MOR_LOCK_V2_KEY_SIZE)) {
276 return EFI_ACCESS_DENIED;
277 }
278 if ((CompareMem (Data, mMorLockKey, MOR_LOCK_V2_KEY_SIZE) == 0)) {
279 //
280 // Key match - unlock
281 //
282
283 //
284 // Need set here because the data value on flash is different
285 //
286 Status = SetMorLockVariable (MOR_LOCK_DATA_UNLOCKED);
287 if (EFI_ERROR (Status)) {
288 //
289 // SetVar fail
290 //
291 return Status;
292 } else {
293 //
294 // Unlock Success
295 //
296 mMorLockState = MorLockStateUnlocked;
297 mMorLockKeyEmpty = TRUE;
298 ZeroMem (mMorLockKey, sizeof(mMorLockKey));
299 //
300 // return EFI_ALREADY_STARTED to skip variable set.
301 //
302 return EFI_ALREADY_STARTED;
303 }
304 } else {
305 //
306 // Key mismatch - Prevent Dictionary Attack
307 //
308 mMorLockState = MorLockStateLocked;
309 mMorLockKeyEmpty = TRUE;
310 ZeroMem (mMorLockKey, sizeof(mMorLockKey));
311 return EFI_ACCESS_DENIED;
312 }
313 }
314 }
315
316 /**
317 This service is an MOR/MorLock checker handler for the SetVariable().
318
319 @param[in] VariableName the name of the vendor's variable, as a
320 Null-Terminated Unicode String
321 @param[in] VendorGuid Unify identifier for vendor.
322 @param[in] Attributes Attributes bitmask to set for the variable.
323 @param[in] DataSize The size in bytes of Data-Buffer.
324 @param[in] Data Point to the content of the variable.
325
326 @retval EFI_SUCCESS The MOR/MorLock check pass, and Variable
327 driver can store the variable data.
328 @retval EFI_INVALID_PARAMETER The MOR/MorLock data or data size or
329 attributes is not allowed for MOR variable.
330 @retval EFI_ACCESS_DENIED The MOR/MorLock is locked.
331 @retval EFI_ALREADY_STARTED The MorLock variable is handled inside this
332 function. Variable driver can just return
333 EFI_SUCCESS.
334 **/
335 EFI_STATUS
336 SetVariableCheckHandlerMor (
337 IN CHAR16 *VariableName,
338 IN EFI_GUID *VendorGuid,
339 IN UINT32 Attributes,
340 IN UINTN DataSize,
341 IN VOID *Data
342 )
343 {
344 //
345 // do not handle non-MOR variable
346 //
347 if (!IsAnyMorVariable (VariableName, VendorGuid)) {
348 return EFI_SUCCESS;
349 }
350
351 //
352 // MorLock variable
353 //
354 if (IsMorLockVariable (VariableName, VendorGuid)) {
355 return SetVariableCheckHandlerMorLock (
356 VariableName,
357 VendorGuid,
358 Attributes,
359 DataSize,
360 Data
361 );
362 }
363
364 //
365 // Mor Variable
366 //
367
368 //
369 // Permit deletion for passthru request.
370 //
371 if (((Attributes == 0) || (DataSize == 0)) && mMorPassThru) {
372 return EFI_SUCCESS;
373 }
374
375 //
376 // Basic Check
377 //
378 if ((Attributes != (EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS)) ||
379 (DataSize != sizeof(UINT8)) ||
380 (Data == NULL)) {
381 return EFI_INVALID_PARAMETER;
382 }
383 if (mMorLockState == MorLockStateLocked) {
384 //
385 // If lock, deny access
386 //
387 return EFI_ACCESS_DENIED;
388 }
389 //
390 // grant access
391 //
392 return EFI_SUCCESS;
393 }
394
395 /**
396 Initialization for MOR Control Lock.
397
398 @retval EFI_SUCCESS MorLock initialization success.
399 @return Others Some error occurs.
400 **/
401 EFI_STATUS
402 MorLockInit (
403 VOID
404 )
405 {
406 mMorLockInitializationRequired = TRUE;
407 return EFI_SUCCESS;
408 }
409
410 /**
411 Delayed initialization for MOR Control Lock at EndOfDxe.
412
413 This function performs any operations queued by MorLockInit().
414 **/
415 VOID
416 MorLockInitAtEndOfDxe (
417 VOID
418 )
419 {
420 UINTN MorSize;
421 EFI_STATUS MorStatus;
422 EFI_STATUS TcgStatus;
423 VOID *TcgInterface;
424
425 if (!mMorLockInitializationRequired) {
426 //
427 // The EFI_SMM_FAULT_TOLERANT_WRITE_PROTOCOL has never been installed, thus
428 // the variable write service is unavailable. This should never happen.
429 //
430 ASSERT (FALSE);
431 return;
432 }
433
434 //
435 // Check if the MOR variable exists.
436 //
437 MorSize = 0;
438 MorStatus = VariableServiceGetVariable (
439 MEMORY_OVERWRITE_REQUEST_VARIABLE_NAME,
440 &gEfiMemoryOverwriteControlDataGuid,
441 NULL, // Attributes
442 &MorSize,
443 NULL // Data
444 );
445 //
446 // We provided a zero-sized buffer, so the above call can never succeed.
447 //
448 ASSERT (EFI_ERROR (MorStatus));
449
450 if (MorStatus == EFI_BUFFER_TOO_SMALL) {
451 //
452 // The MOR variable exists.
453 //
454 // Some OSes don't follow the TCG's Platform Reset Attack Mitigation spec
455 // in that the OS should never create the MOR variable, only read and write
456 // it -- these OSes (unintentionally) create MOR if the platform firmware
457 // does not produce it. Whether this is the case (from the last OS boot)
458 // can be deduced from the absence of the TCG / TCG2 protocols, as edk2's
459 // MOR implementation depends on (one of) those protocols.
460 //
461 TcgStatus = gBS->LocateProtocol (
462 &gEfiTcgProtocolGuid,
463 NULL, // Registration
464 &TcgInterface
465 );
466 if (EFI_ERROR (TcgStatus)) {
467 TcgStatus = gBS->LocateProtocol (
468 &gEfiTcg2ProtocolGuid,
469 NULL, // Registration
470 &TcgInterface
471 );
472 }
473
474 if (!EFI_ERROR (TcgStatus)) {
475 //
476 // The MOR variable originates from the platform firmware; set the MOR
477 // Control Lock variable to report the locking capability to the OS.
478 //
479 SetMorLockVariable (0);
480 return;
481 }
482
483 //
484 // The MOR variable's origin is inexplicable; delete it.
485 //
486 DEBUG ((
487 DEBUG_WARN,
488 "%a: deleting unexpected / unsupported variable %g:%s\n",
489 __FUNCTION__,
490 &gEfiMemoryOverwriteControlDataGuid,
491 MEMORY_OVERWRITE_REQUEST_VARIABLE_NAME
492 ));
493
494 mMorPassThru = TRUE;
495 VariableServiceSetVariable (
496 MEMORY_OVERWRITE_REQUEST_VARIABLE_NAME,
497 &gEfiMemoryOverwriteControlDataGuid,
498 0, // Attributes
499 0, // DataSize
500 NULL // Data
501 );
502 mMorPassThru = FALSE;
503 }
504
505 //
506 // The MOR variable is absent; the platform firmware does not support it.
507 // Lock the variable so that no other module may create it.
508 //
509 VariableLockRequestToLock (
510 NULL, // This
511 MEMORY_OVERWRITE_REQUEST_VARIABLE_NAME,
512 &gEfiMemoryOverwriteControlDataGuid
513 );
514
515 //
516 // Delete the MOR Control Lock variable too (should it exists for some
517 // reason) and prevent other modules from creating it.
518 //
519 mMorLockPassThru = TRUE;
520 VariableServiceSetVariable (
521 MEMORY_OVERWRITE_REQUEST_CONTROL_LOCK_NAME,
522 &gEfiMemoryOverwriteRequestControlLockGuid,
523 0, // Attributes
524 0, // DataSize
525 NULL // Data
526 );
527 mMorLockPassThru = FALSE;
528
529 VariableLockRequestToLock (
530 NULL, // This
531 MEMORY_OVERWRITE_REQUEST_CONTROL_LOCK_NAME,
532 &gEfiMemoryOverwriteRequestControlLockGuid
533 );
534 }