1 // SPDX-License-Identifier: GPL-2.0+
2 /*
3 * File interface for UEFI variables
4 *
5 * Copyright (c) 2020, Heinrich Schuchardt
6 */
7
8 #define LOG_CATEGORY LOGC_EFI
9
10 #include <common.h>
11 #include <charset.h>
12 #include <fs.h>
13 #include <log.h>
14 #include <malloc.h>
15 #include <mapmem.h>
16 #include <efi_loader.h>
17 #include <efi_variable.h>
18 #include <u-boot/crc.h>
19
20 #define PART_STR_LEN 10
21
22 /* GUID used by Shim to store the MOK database */
23 #define SHIM_LOCK_GUID \
24 EFI_GUID(0x605dab50, 0xe046, 0x4300, \
25 0xab, 0xb6, 0x3d, 0xd8, 0x10, 0xdd, 0x8b, 0x23)
26
27 static const efi_guid_t shim_lock_guid = SHIM_LOCK_GUID;
28
29 /**
30 * efi_set_blk_dev_to_system_partition() - select EFI system partition
31 *
32 * Set the EFI system partition as current block device.
33 *
34 * Return: status code
35 */
efi_set_blk_dev_to_system_partition(void)36 static efi_status_t __maybe_unused efi_set_blk_dev_to_system_partition(void)
37 {
38 char part_str[PART_STR_LEN];
39 int r;
40
41 if (!efi_system_partition.if_type) {
42 log_err("No EFI system partition\n");
43 return EFI_DEVICE_ERROR;
44 }
45 snprintf(part_str, PART_STR_LEN, "%x:%x",
46 efi_system_partition.devnum, efi_system_partition.part);
47 r = fs_set_blk_dev(blk_get_if_type_name(efi_system_partition.if_type),
48 part_str, FS_TYPE_ANY);
49 if (r) {
50 log_err("Cannot read EFI system partition\n");
51 return EFI_DEVICE_ERROR;
52 }
53 return EFI_SUCCESS;
54 }
55
efi_var_collect(struct efi_var_file ** bufp,loff_t * lenp,u32 check_attr_mask)56 efi_status_t __maybe_unused efi_var_collect(struct efi_var_file **bufp, loff_t *lenp,
57 u32 check_attr_mask)
58 {
59 size_t len = EFI_VAR_BUF_SIZE;
60 struct efi_var_file *buf;
61 struct efi_var_entry *var, *old_var;
62 size_t old_var_name_length = 2;
63
64 *bufp = NULL; /* Avoid double free() */
65 buf = calloc(1, len);
66 if (!buf)
67 return EFI_OUT_OF_RESOURCES;
68 var = buf->var;
69 old_var = var;
70 for (;;) {
71 efi_uintn_t data_length, var_name_length;
72 u8 *data;
73 efi_status_t ret;
74
75 if ((uintptr_t)buf + len <=
76 (uintptr_t)var->name + old_var_name_length)
77 return EFI_BUFFER_TOO_SMALL;
78
79 var_name_length = (uintptr_t)buf + len - (uintptr_t)var->name;
80 memcpy(var->name, old_var->name, old_var_name_length);
81 guidcpy(&var->guid, &old_var->guid);
82 ret = efi_get_next_variable_name_int(
83 &var_name_length, var->name, &var->guid);
84 if (ret == EFI_NOT_FOUND)
85 break;
86 if (ret != EFI_SUCCESS) {
87 free(buf);
88 return ret;
89 }
90 old_var_name_length = var_name_length;
91 old_var = var;
92
93 data = (u8 *)var->name + old_var_name_length;
94 data_length = (uintptr_t)buf + len - (uintptr_t)data;
95 ret = efi_get_variable_int(var->name, &var->guid,
96 &var->attr, &data_length, data,
97 &var->time);
98 if (ret != EFI_SUCCESS) {
99 free(buf);
100 return ret;
101 }
102 if ((var->attr & check_attr_mask) == check_attr_mask) {
103 var->length = data_length;
104 var = (struct efi_var_entry *)ALIGN((uintptr_t)data + data_length, 8);
105 }
106 }
107
108 buf->reserved = 0;
109 buf->magic = EFI_VAR_FILE_MAGIC;
110 len = (uintptr_t)var - (uintptr_t)buf;
111 buf->crc32 = crc32(0, (u8 *)buf->var,
112 len - sizeof(struct efi_var_file));
113 buf->length = len;
114 *bufp = buf;
115 *lenp = len;
116
117 return EFI_SUCCESS;
118 }
119
120 /**
121 * efi_var_to_file() - save non-volatile variables as file
122 *
123 * File ubootefi.var is created on the EFI system partion.
124 *
125 * Return: status code
126 */
efi_var_to_file(void)127 efi_status_t efi_var_to_file(void)
128 {
129 #ifdef CONFIG_EFI_VARIABLE_FILE_STORE
130 efi_status_t ret;
131 struct efi_var_file *buf;
132 loff_t len;
133 loff_t actlen;
134 int r;
135
136 ret = efi_var_collect(&buf, &len, EFI_VARIABLE_NON_VOLATILE);
137 if (ret != EFI_SUCCESS)
138 goto error;
139
140 ret = efi_set_blk_dev_to_system_partition();
141 if (ret != EFI_SUCCESS)
142 goto error;
143
144 r = fs_write(EFI_VAR_FILE_NAME, map_to_sysmem(buf), 0, len, &actlen);
145 if (r || len != actlen)
146 ret = EFI_DEVICE_ERROR;
147
148 error:
149 if (ret != EFI_SUCCESS)
150 log_err("Failed to persist EFI variables\n");
151 free(buf);
152 return ret;
153 #else
154 return EFI_SUCCESS;
155 #endif
156 }
157
efi_var_restore(struct efi_var_file * buf,bool safe)158 efi_status_t efi_var_restore(struct efi_var_file *buf, bool safe)
159 {
160 struct efi_var_entry *var, *last_var;
161 u16 *data;
162 efi_status_t ret;
163
164 if (buf->reserved || buf->magic != EFI_VAR_FILE_MAGIC ||
165 buf->crc32 != crc32(0, (u8 *)buf->var,
166 buf->length - sizeof(struct efi_var_file))) {
167 log_err("Invalid EFI variables file\n");
168 return EFI_INVALID_PARAMETER;
169 }
170
171 last_var = (struct efi_var_entry *)((u8 *)buf + buf->length);
172 for (var = buf->var; var < last_var;
173 var = (struct efi_var_entry *)
174 ALIGN((uintptr_t)data + var->length, 8)) {
175
176 data = var->name + u16_strlen(var->name) + 1;
177
178 /*
179 * Secure boot related and non-volatile variables shall only be
180 * restored from U-Boot's preseed.
181 */
182 if (!safe &&
183 (efi_auth_var_get_type(var->name, &var->guid) !=
184 EFI_AUTH_VAR_NONE ||
185 !guidcmp(&var->guid, &shim_lock_guid) ||
186 !(var->attr & EFI_VARIABLE_NON_VOLATILE)))
187 continue;
188 if (!var->length)
189 continue;
190 ret = efi_var_mem_ins(var->name, &var->guid, var->attr,
191 var->length, data, 0, NULL,
192 var->time);
193 if (ret != EFI_SUCCESS)
194 log_err("Failed to set EFI variable %ls\n", var->name);
195 }
196 return EFI_SUCCESS;
197 }
198
199 /**
200 * efi_var_from_file() - read variables from file
201 *
202 * File ubootefi.var is read from the EFI system partitions and the variables
203 * stored in the file are created.
204 *
205 * In case the file does not exist yet or a variable cannot be set EFI_SUCCESS
206 * is returned.
207 *
208 * Return: status code
209 */
efi_var_from_file(void)210 efi_status_t efi_var_from_file(void)
211 {
212 #ifdef CONFIG_EFI_VARIABLE_FILE_STORE
213 struct efi_var_file *buf;
214 loff_t len;
215 efi_status_t ret;
216 int r;
217
218 buf = calloc(1, EFI_VAR_BUF_SIZE);
219 if (!buf) {
220 log_err("Out of memory\n");
221 return EFI_OUT_OF_RESOURCES;
222 }
223
224 ret = efi_set_blk_dev_to_system_partition();
225 if (ret != EFI_SUCCESS)
226 goto error;
227 r = fs_read(EFI_VAR_FILE_NAME, map_to_sysmem(buf), 0, EFI_VAR_BUF_SIZE,
228 &len);
229 if (r || len < sizeof(struct efi_var_file)) {
230 log_err("Failed to load EFI variables\n");
231 goto error;
232 }
233 if (buf->length != len || efi_var_restore(buf, false) != EFI_SUCCESS)
234 log_err("Invalid EFI variables file\n");
235 error:
236 free(buf);
237 #endif
238 return EFI_SUCCESS;
239 }
240