SecurityPkg/Tcg/MemoryOverwriteRequestControlLock/TcgMorLock.c

   1 /** @file
   2   TCG MOR (Memory Overwrite Request) Lock Control Driver.
   3
   4   This driver initilize MemoryOverwriteRequestControlLock variable.
   5   This module will add Variable Hook and allow MemoryOverwriteRequestControlLock variable set only once.
   6
   7 Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR>
   8 SPDX-License-Identifier: BSD-2-Clause-Patent
   9
  10 **/
  11
  12 #include <PiDxe.h>
  13 #include <Guid/MemoryOverwriteControl.h>
  14 #include <IndustryStandard/MemoryOverwriteRequestControlLock.h>
  15 #include <Library/DebugLib.h>
  16 #include <Library/BaseLib.h>
  17 #include <Library/BaseMemoryLib.h>
  18 #include "TcgMorLock.h"
  19
  20 typedef struct {
  21   CHAR16                                 *VariableName;
  22   EFI_GUID                               *VendorGuid;
  23 } VARIABLE_TYPE;
  24
  25 VARIABLE_TYPE  mMorVariableType[] = {
  26   {MEMORY_OVERWRITE_REQUEST_VARIABLE_NAME,      &gEfiMemoryOverwriteControlDataGuid},
  27   {MEMORY_OVERWRITE_REQUEST_CONTROL_LOCK_NAME,  &gEfiMemoryOverwriteRequestControlLockGuid},
  28 };
  29
  30 /**
  31   Returns if this is MOR related variable.
  32
  33   @param  VariableName the name of the vendor's variable, it's a Null-Terminated Unicode String
  34   @param  VendorGuid   Unify identifier for vendor.
  35
  36   @retval  TRUE            The variable is MOR related.
  37   @retval  FALSE           The variable is NOT MOR related.
  38 **/
  39 BOOLEAN
  40 IsAnyMorVariable (
  41   IN CHAR16                                 *VariableName,
  42   IN EFI_GUID                               *VendorGuid
  43   )
  44 {
  45   UINTN   Index;
  46
  47   for (Index = 0; Index < sizeof(mMorVariableType)/sizeof(mMorVariableType[0]); Index++) {
  48     if ((StrCmp (VariableName, mMorVariableType[Index].VariableName) == 0) &&
  49         (CompareGuid (VendorGuid, mMorVariableType[Index].VendorGuid))) {
  50       return TRUE;
  51     }
  52   }
  53   return FALSE;
  54 }
  55
  56 /**
  57   Returns if this is MOR lock variable.
  58
  59   @param  VariableName the name of the vendor's variable, it's a Null-Terminated Unicode String
  60   @param  VendorGuid   Unify identifier for vendor.
  61
  62   @retval  TRUE            The variable is MOR lock variable.
  63   @retval  FALSE           The variable is NOT MOR lock variable.
  64 **/
  65 BOOLEAN
  66 IsMorLockVariable (
  67   IN CHAR16                                 *VariableName,
  68   IN EFI_GUID                               *VendorGuid
  69   )
  70 {
  71   if ((StrCmp (VariableName, MEMORY_OVERWRITE_REQUEST_CONTROL_LOCK_NAME) == 0) &&
  72       (CompareGuid (VendorGuid, &gEfiMemoryOverwriteRequestControlLockGuid))) {
  73     return TRUE;
  74   }
  75   return FALSE;
  76 }
  77
  78 /**
  79   This service is a checker handler for the UEFI Runtime Service SetVariable()
  80
  81   @param  VariableName the name of the vendor's variable, as a
  82                        Null-Terminated Unicode String
  83   @param  VendorGuid   Unify identifier for vendor.
  84   @param  Attributes   Point to memory location to return the attributes of variable. If the point
  85                        is NULL, the parameter would be ignored.
  86   @param  DataSize     The size in bytes of Data-Buffer.
  87   @param  Data         Point to the content of the variable.
  88
  89   @retval  EFI_SUCCESS            The firmware has successfully stored the variable and its data as
  90                                   defined by the Attributes.
  91   @retval  EFI_INVALID_PARAMETER  An invalid combination of attribute bits was supplied, or the
  92                                   DataSize exceeds the maximum allowed.
  93   @retval  EFI_INVALID_PARAMETER  VariableName is an empty Unicode string.
  94   @retval  EFI_OUT_OF_RESOURCES   Not enough storage is available to hold the variable and its data.
  95   @retval  EFI_DEVICE_ERROR       The variable could not be saved due to a hardware failure.
  96   @retval  EFI_WRITE_PROTECTED    The variable in question is read-only.
  97   @retval  EFI_WRITE_PROTECTED    The variable in question cannot be deleted.
  98   @retval  EFI_SECURITY_VIOLATION The variable could not be written due to EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS
  99                                   set but the AuthInfo does NOT pass the validation check carried
 100                                   out by the firmware.
 101   @retval  EFI_NOT_FOUND          The variable trying to be updated or deleted was not found.
 102
 103 **/
 104 EFI_STATUS
 105 EFIAPI
 106 SetVariableCheckHandlerMor (
 107   IN CHAR16     *VariableName,
 108   IN EFI_GUID   *VendorGuid,
 109   IN UINT32     Attributes,
 110   IN UINTN      DataSize,
 111   IN VOID       *Data
 112   )
 113 {
 114   UINTN       MorLockDataSize;
 115   BOOLEAN     MorLock;
 116   EFI_STATUS  Status;
 117
 118   //
 119   // do not handle non-MOR variable
 120   //
 121   if (!IsAnyMorVariable (VariableName, VendorGuid)) {
 122     return EFI_SUCCESS;
 123   }
 124
 125   MorLockDataSize = sizeof(MorLock);
 126   Status = InternalGetVariable (
 127              MEMORY_OVERWRITE_REQUEST_CONTROL_LOCK_NAME,
 128              &gEfiMemoryOverwriteRequestControlLockGuid,
 129              NULL,
 130              &MorLockDataSize,
 131              &MorLock
 132              );
 133   if (!EFI_ERROR (Status) && MorLock) {
 134     //
 135     // If lock, deny access
 136     //
 137     return EFI_INVALID_PARAMETER;
 138   }
 139
 140   //
 141   // Delete not OK
 142   //
 143   if ((DataSize != sizeof(UINT8)) || (Data == NULL) || (Attributes == 0)) {
 144     return EFI_INVALID_PARAMETER;
 145   }
 146
 147   //
 148   // check format
 149   //
 150   if (IsMorLockVariable(VariableName, VendorGuid)) {
 151     //
 152     // set to any other value not OK
 153     //
 154     if ((*(UINT8 *)Data != 1) && (*(UINT8 *)Data != 0)) {
 155       return EFI_INVALID_PARAMETER;
 156     }
 157   }
 158   //
 159   // Or grant access
 160   //
 161   return EFI_SUCCESS;
 162 }
 163
 164 /**
 165   Entry Point for MOR Lock Control driver.
 166
 167   @param[in] ImageHandle  Image handle of this driver.
 168   @param[in] SystemTable  A Pointer to the EFI System Table.
 169
 170   @retval EFI_SUCEESS
 171   @return Others          Some error occurs.
 172 **/
 173 EFI_STATUS
 174 EFIAPI
 175 MorLockDriverInit (
 176   VOID
 177   )
 178 {
 179   EFI_STATUS  Status;
 180   UINT8       Data;
 181
 182   Data = 0;
 183   Status = InternalSetVariable (
 184              MEMORY_OVERWRITE_REQUEST_CONTROL_LOCK_NAME,
 185              &gEfiMemoryOverwriteRequestControlLockGuid,
 186              EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS,
 187              1,
 188              &Data
 189              );
 190   return Status;
 191 }