Loading...
Note: File does not exist in v3.1.
1// SPDX-License-Identifier: GPL-2.0
2/*
3 * mokvar-table.c
4 *
5 * Copyright (c) 2020 Red Hat
6 * Author: Lenny Szubowicz <lszubowi@redhat.com>
7 *
8 * This module contains the kernel support for the Linux EFI Machine
9 * Owner Key (MOK) variable configuration table, which is identified by
10 * the LINUX_EFI_MOK_VARIABLE_TABLE_GUID.
11 *
12 * This EFI configuration table provides a more robust alternative to
13 * EFI volatile variables by which an EFI boot loader can pass the
14 * contents of the Machine Owner Key (MOK) certificate stores to the
15 * kernel during boot. If both the EFI MOK config table and corresponding
16 * EFI MOK variables are present, the table should be considered as
17 * more authoritative.
18 *
19 * This module includes code that validates and maps the EFI MOK table,
20 * if it's presence was detected very early in boot.
21 *
22 * Kernel interface routines are provided to walk through all the
23 * entries in the MOK config table or to search for a specific named
24 * entry.
25 *
26 * The contents of the individual named MOK config table entries are
27 * made available to user space via read-only sysfs binary files under:
28 *
29 * /sys/firmware/efi/mok-variables/
30 *
31 */
32#define pr_fmt(fmt) "mokvar: " fmt
33
34#include <linux/capability.h>
35#include <linux/efi.h>
36#include <linux/init.h>
37#include <linux/io.h>
38#include <linux/kernel.h>
39#include <linux/kobject.h>
40#include <linux/list.h>
41#include <linux/slab.h>
42
43#include <asm/early_ioremap.h>
44
45/*
46 * The LINUX_EFI_MOK_VARIABLE_TABLE_GUID config table is a packed
47 * sequence of struct efi_mokvar_table_entry, one for each named
48 * MOK variable. The sequence is terminated by an entry with a
49 * completely NULL name and 0 data size.
50 *
51 * efi_mokvar_table_size is set to the computed size of the
52 * MOK config table by efi_mokvar_table_init(). This will be
53 * non-zero if and only if the table if present and has been
54 * validated by efi_mokvar_table_init().
55 */
56static size_t efi_mokvar_table_size;
57
58/*
59 * efi_mokvar_table_va is the kernel virtual address at which the
60 * EFI MOK config table has been mapped by efi_mokvar_sysfs_init().
61 */
62static struct efi_mokvar_table_entry *efi_mokvar_table_va;
63
64/*
65 * Each /sys/firmware/efi/mok-variables/ sysfs file is represented by
66 * an instance of struct efi_mokvar_sysfs_attr on efi_mokvar_sysfs_list.
67 * bin_attr.private points to the associated EFI MOK config table entry.
68 *
69 * This list is created during boot and then remains unchanged.
70 * So no synchronization is currently required to walk the list.
71 */
72struct efi_mokvar_sysfs_attr {
73 struct bin_attribute bin_attr;
74 struct list_head node;
75};
76
77static LIST_HEAD(efi_mokvar_sysfs_list);
78static struct kobject *mokvar_kobj;
79
80/*
81 * efi_mokvar_table_init() - Early boot validation of EFI MOK config table
82 *
83 * If present, validate and compute the size of the EFI MOK variable
84 * configuration table. This table may be provided by an EFI boot loader
85 * as an alternative to ordinary EFI variables, due to platform-dependent
86 * limitations. The memory occupied by this table is marked as reserved.
87 *
88 * This routine must be called before efi_free_boot_services() in order
89 * to guarantee that it can mark the table as reserved.
90 *
91 * Implicit inputs:
92 * efi.mokvar_table: Physical address of EFI MOK variable config table
93 * or special value that indicates no such table.
94 *
95 * Implicit outputs:
96 * efi_mokvar_table_size: Computed size of EFI MOK variable config table.
97 * The table is considered present and valid if this
98 * is non-zero.
99 */
100void __init efi_mokvar_table_init(void)
101{
102 efi_memory_desc_t md;
103 void *va = NULL;
104 unsigned long cur_offset = 0;
105 unsigned long offset_limit;
106 unsigned long map_size_needed = 0;
107 struct efi_mokvar_table_entry *mokvar_entry;
108 int err;
109
110 if (!efi_enabled(EFI_MEMMAP))
111 return;
112
113 if (efi.mokvar_table == EFI_INVALID_TABLE_ADDR)
114 return;
115 /*
116 * The EFI MOK config table must fit within a single EFI memory
117 * descriptor range.
118 */
119 err = efi_mem_desc_lookup(efi.mokvar_table, &md);
120 if (err) {
121 pr_warn("EFI MOKvar config table is not within the EFI memory map\n");
122 return;
123 }
124
125 offset_limit = efi_mem_desc_end(&md) - efi.mokvar_table;
126
127 /*
128 * Validate the MOK config table. Since there is no table header
129 * from which we could get the total size of the MOK config table,
130 * we compute the total size as we validate each variably sized
131 * entry, remapping as necessary.
132 */
133 err = -EINVAL;
134 while (cur_offset + sizeof(*mokvar_entry) <= offset_limit) {
135 if (va)
136 early_memunmap(va, sizeof(*mokvar_entry));
137 va = early_memremap(efi.mokvar_table + cur_offset, sizeof(*mokvar_entry));
138 if (!va) {
139 pr_err("Failed to map EFI MOKvar config table pa=0x%lx, size=%zu.\n",
140 efi.mokvar_table + cur_offset, sizeof(*mokvar_entry));
141 return;
142 }
143 mokvar_entry = va;
144
145 /* Check for last sentinel entry */
146 if (mokvar_entry->name[0] == '\0') {
147 if (mokvar_entry->data_size != 0)
148 break;
149 err = 0;
150 map_size_needed = cur_offset + sizeof(*mokvar_entry);
151 break;
152 }
153
154 /* Enforce that the name is NUL terminated */
155 mokvar_entry->name[sizeof(mokvar_entry->name) - 1] = '\0';
156
157 /* Advance to the next entry */
158 cur_offset += sizeof(*mokvar_entry) + mokvar_entry->data_size;
159 }
160
161 if (va)
162 early_memunmap(va, sizeof(*mokvar_entry));
163 if (err) {
164 pr_err("EFI MOKvar config table is not valid\n");
165 return;
166 }
167
168 if (md.type == EFI_BOOT_SERVICES_DATA)
169 efi_mem_reserve(efi.mokvar_table, map_size_needed);
170
171 efi_mokvar_table_size = map_size_needed;
172}
173
174/*
175 * efi_mokvar_entry_next() - Get next entry in the EFI MOK config table
176 *
177 * mokvar_entry: Pointer to current EFI MOK config table entry
178 * or null. Null indicates get first entry.
179 * Passed by reference. This is updated to the
180 * same value as the return value.
181 *
182 * Returns: Pointer to next EFI MOK config table entry
183 * or null, if there are no more entries.
184 * Same value is returned in the mokvar_entry
185 * parameter.
186 *
187 * This routine depends on the EFI MOK config table being entirely
188 * mapped with it's starting virtual address in efi_mokvar_table_va.
189 */
190struct efi_mokvar_table_entry *efi_mokvar_entry_next(
191 struct efi_mokvar_table_entry **mokvar_entry)
192{
193 struct efi_mokvar_table_entry *mokvar_cur;
194 struct efi_mokvar_table_entry *mokvar_next;
195 size_t size_cur;
196
197 mokvar_cur = *mokvar_entry;
198 *mokvar_entry = NULL;
199
200 if (efi_mokvar_table_va == NULL)
201 return NULL;
202
203 if (mokvar_cur == NULL) {
204 mokvar_next = efi_mokvar_table_va;
205 } else {
206 if (mokvar_cur->name[0] == '\0')
207 return NULL;
208 size_cur = sizeof(*mokvar_cur) + mokvar_cur->data_size;
209 mokvar_next = (void *)mokvar_cur + size_cur;
210 }
211
212 if (mokvar_next->name[0] == '\0')
213 return NULL;
214
215 *mokvar_entry = mokvar_next;
216 return mokvar_next;
217}
218
219/*
220 * efi_mokvar_entry_find() - Find EFI MOK config entry by name
221 *
222 * name: Name of the entry to look for.
223 *
224 * Returns: Pointer to EFI MOK config table entry if found;
225 * null otherwise.
226 *
227 * This routine depends on the EFI MOK config table being entirely
228 * mapped with it's starting virtual address in efi_mokvar_table_va.
229 */
230struct efi_mokvar_table_entry *efi_mokvar_entry_find(const char *name)
231{
232 struct efi_mokvar_table_entry *mokvar_entry = NULL;
233
234 while (efi_mokvar_entry_next(&mokvar_entry)) {
235 if (!strncmp(name, mokvar_entry->name,
236 sizeof(mokvar_entry->name)))
237 return mokvar_entry;
238 }
239 return NULL;
240}
241
242/*
243 * efi_mokvar_sysfs_read() - sysfs binary file read routine
244 *
245 * Returns: Count of bytes read.
246 *
247 * Copy EFI MOK config table entry data for this mokvar sysfs binary file
248 * to the supplied buffer, starting at the specified offset into mokvar table
249 * entry data, for the specified count bytes. The copy is limited by the
250 * amount of data in this mokvar config table entry.
251 */
252static ssize_t efi_mokvar_sysfs_read(struct file *file, struct kobject *kobj,
253 struct bin_attribute *bin_attr, char *buf,
254 loff_t off, size_t count)
255{
256 struct efi_mokvar_table_entry *mokvar_entry = bin_attr->private;
257
258 if (!capable(CAP_SYS_ADMIN))
259 return 0;
260
261 if (off >= mokvar_entry->data_size)
262 return 0;
263 if (count > mokvar_entry->data_size - off)
264 count = mokvar_entry->data_size - off;
265
266 memcpy(buf, mokvar_entry->data + off, count);
267 return count;
268}
269
270/*
271 * efi_mokvar_sysfs_init() - Map EFI MOK config table and create sysfs
272 *
273 * Map the EFI MOK variable config table for run-time use by the kernel
274 * and create the sysfs entries in /sys/firmware/efi/mok-variables/
275 *
276 * This routine just returns if a valid EFI MOK variable config table
277 * was not found earlier during boot.
278 *
279 * This routine must be called during a "middle" initcall phase, i.e.
280 * after efi_mokvar_table_init() but before UEFI certs are loaded
281 * during late init.
282 *
283 * Implicit inputs:
284 * efi.mokvar_table: Physical address of EFI MOK variable config table
285 * or special value that indicates no such table.
286 *
287 * efi_mokvar_table_size: Computed size of EFI MOK variable config table.
288 * The table is considered present and valid if this
289 * is non-zero.
290 *
291 * Implicit outputs:
292 * efi_mokvar_table_va: Start virtual address of the EFI MOK config table.
293 */
294static int __init efi_mokvar_sysfs_init(void)
295{
296 void *config_va;
297 struct efi_mokvar_table_entry *mokvar_entry = NULL;
298 struct efi_mokvar_sysfs_attr *mokvar_sysfs = NULL;
299 int err = 0;
300
301 if (efi_mokvar_table_size == 0)
302 return -ENOENT;
303
304 config_va = memremap(efi.mokvar_table, efi_mokvar_table_size,
305 MEMREMAP_WB);
306 if (!config_va) {
307 pr_err("Failed to map EFI MOKvar config table\n");
308 return -ENOMEM;
309 }
310 efi_mokvar_table_va = config_va;
311
312 mokvar_kobj = kobject_create_and_add("mok-variables", efi_kobj);
313 if (!mokvar_kobj) {
314 pr_err("Failed to create EFI mok-variables sysfs entry\n");
315 return -ENOMEM;
316 }
317
318 while (efi_mokvar_entry_next(&mokvar_entry)) {
319 mokvar_sysfs = kzalloc(sizeof(*mokvar_sysfs), GFP_KERNEL);
320 if (!mokvar_sysfs) {
321 err = -ENOMEM;
322 break;
323 }
324
325 sysfs_bin_attr_init(&mokvar_sysfs->bin_attr);
326 mokvar_sysfs->bin_attr.private = mokvar_entry;
327 mokvar_sysfs->bin_attr.attr.name = mokvar_entry->name;
328 mokvar_sysfs->bin_attr.attr.mode = 0400;
329 mokvar_sysfs->bin_attr.size = mokvar_entry->data_size;
330 mokvar_sysfs->bin_attr.read = efi_mokvar_sysfs_read;
331
332 err = sysfs_create_bin_file(mokvar_kobj,
333 &mokvar_sysfs->bin_attr);
334 if (err)
335 break;
336
337 list_add_tail(&mokvar_sysfs->node, &efi_mokvar_sysfs_list);
338 }
339
340 if (err) {
341 pr_err("Failed to create some EFI mok-variables sysfs entries\n");
342 kfree(mokvar_sysfs);
343 }
344 return err;
345}
346fs_initcall(efi_mokvar_sysfs_init);