efi_shim.c File Reference

UEFI shim special handling. More...

#include <string.h>
#include <stdlib.h>
#include <errno.h>
#include <ipxe/image.h>
#include <ipxe/efi/efi.h>
#include <ipxe/efi/efi_strings.h>
#include <ipxe/efi/efi_shim.h>
#include <ipxe/efi/Protocol/PxeBaseCode.h>
#include <ipxe/efi/Protocol/ShimLock.h>

Go to the source code of this file.

Functions
	FILE_LICENCE (GPL2_OR_LATER_OR_UBDL)
	FILE_SECBOOT (PERMITTED)
static int	efi_shim_is_sbatlevel (const CHAR16 *name, const EFI_GUID *guid)
	Check if variable is SbatLevel.
static void	efi_shim_unlock (void)
	Unlock UEFI shim.
static EFI_STATUS EFIAPI	efi_shim_set_variable (CHAR16 *name, EFI_GUID *guid, UINT32 attrs, UINTN len, VOID *data)
	Wrap SetVariable()
static EFI_STATUS EFIAPI	efi_shim_get_variable (CHAR16 *name, EFI_GUID *guid, UINT32 *attrs, UINTN *len, VOID *data)
	Wrap GetVariable()
static EFIAPI EFI_STATUS	efi_shim_get_memory_map (UINTN *len, EFI_MEMORY_DESCRIPTOR *map, UINTN *key, UINTN *desclen, UINT32 *descver)
	Wrap GetMemoryMap()
static int	efi_shim_inhibit_pxe (EFI_HANDLE handle)
	Inhibit use of PXE base code.
static int	efi_shim_cmdline (struct image *shim, wchar_t **cmdline)
	Update command line.
int	efi_shim_install (struct image *shim, EFI_HANDLE handle, wchar_t **cmdline)
	Install UEFI shim special handling.
void	efi_shim_uninstall (void)
	Uninstall UEFI shim special handling.

Variables
int	efi_shim_require_loader = 0
	Require use of a third party loader binary.
int	efi_shim_allow_pxe = 0
	Allow use of PXE base code protocol.
int	efi_shim_allow_sbat = 0
	Allow SBAT variable access.
struct image_tag efi_shim	__image_tag
	UEFI shim image.
static EFI_GET_MEMORY_MAP	efi_shim_orig_get_memory_map
	Original GetMemoryMap() function.
static EFI_SET_VARIABLE	efi_shim_orig_set_variable
	Original SetVariable() function.
static EFI_GET_VARIABLE	efi_shim_orig_get_variable
	Original GetVariable() function.
static int	efi_shim_sbatlevel_verify
	Verify read from SbatLevel variable.

Detailed Description

UEFI shim special handling.

Definition in file efi_shim.c.

Function Documentation

FILE_LICENCE()

FILE_LICENCE

(

GPL2_OR_LATER_OR_UBDL

)

FILE_SECBOOT()

FILE_SECBOOT

(

PERMITTED

)

efi_shim_is_sbatlevel()

int efi_shim_is_sbatlevel ( const CHAR16 * name, const EFI_GUID * guid )

static

Check if variable is SbatLevel.

Parameters

name	Variable name
guid	Variable namespace GUID

Return values

is_sbatlevel

Variable is SbatLevel

Definition at line 133 of file efi_shim.c.

                                                                              {
        static CHAR16 sbatlevel[] = L"SbatLevel";
        EFI_GUID *shimlock = &efi_shim_lock_protocol_guid;
 
        return ( ( memcmp ( name, sbatlevel, sizeof ( sbatlevel ) ) == 0 ) &&
                 ( memcmp ( guid, shimlock, sizeof ( *shimlock ) ) == 0 ) );
}

References efi_shim_lock_protocol_guid, guid, memcmp(), and name.

Referenced by efi_shim_get_variable(), and efi_shim_set_variable().

efi_shim_unlock()

void efi_shim_unlock ( void )

static

Unlock UEFI shim.

Definition at line 145 of file efi_shim.c.

                                     {
        EFI_BOOT_SERVICES *bs = efi_systab->BootServices;
        EFI_GUID *protocol = &efi_shim_lock_protocol_guid;
        EFI_SHIM_LOCK_PROTOCOL *lock;
        uint8_t empty[0];
        EFI_HANDLE *handles;
        UINTN num_handles;
        unsigned int i;
        EFI_STATUS efirc;
        int rc;
 
        /* Locate shim lock protocol(s) */
        if ( ( efirc = bs->LocateHandleBuffer ( ByProtocol, protocol,
                                                NULL, &num_handles,
                                                &handles ) ) != 0 ) {
                rc = -EEFI ( efirc );
                DBGC ( &efi_shim, "SHIM could not locate shim locks: %s\n",
                       strerror ( rc ) );
                goto err_locate;
        }
 
        /* Unlock each shim lock */
        for ( i = 0 ; i < num_handles ; i++ ) {
 
                /* Open shim lock protocol */
                if ( ( rc = efi_open ( handles[i], protocol, &lock ) ) != 0 ) {
                        DBGC ( &efi_shim, "SHIM could not open lock %d (%p): "
                               "%s\n", i, handles[i], strerror ( rc ) );
                        continue;
                }
 
                /* Unlock shim lock */
                lock->Verify ( empty, sizeof ( empty ) );
                DBGC ( &efi_shim, "SHIM unlocked lock %d (%p) via %p\n",
                       i, handles[i], lock );
        }
 
        bs->FreePool ( handles );
 err_locate:
        return;
}

References ByProtocol, DBGC, EEFI, EFI_HANDLE, efi_open, efi_shim_lock_protocol_guid, efi_systab, EFI_BOOT_SERVICES::FreePool, EFI_BOOT_SERVICES::LocateHandleBuffer, NULL, protocol, rc, strerror(), and _EFI_SHIM_LOCK_PROTOCOL::Verify.

Referenced by efi_shim_get_memory_map().

efi_shim_set_variable()

EFI_STATUS EFIAPI efi_shim_set_variable ( CHAR16 * name, EFI_GUID * guid, UINT32 attrs, UINTN len, VOID * data )

static

Wrap SetVariable()

Parameters

name	Variable name
guid	Variable namespace GUID
attrs	Attributes
len	Buffer size
data	Data buffer

Return values

efirc

EFI status code

Definition at line 198 of file efi_shim.c.

                                                {
        EFI_STATUS efirc;
 
        /* Call original SetVariable() */
        efirc = efi_shim_orig_set_variable ( name, guid, attrs, len, data );
 
        /* Allow verification of SbatLevel variable content */
        if ( efi_shim_is_sbatlevel ( name, guid ) && ( efirc == 0 ) ) {
                DBGC ( &efi_shim, "SHIM detected write to %ls:\n", name );
                DBGC_HDA ( &efi_shim, 0, data, len );
                efi_shim_sbatlevel_verify = 1;
        }
 
        return efirc;
}

References data, DBGC, DBGC_HDA, efi_shim_is_sbatlevel(), efi_shim_orig_set_variable, efi_shim_sbatlevel_verify, guid, len, name, and VOID.

Referenced by efi_shim_get_memory_map(), and efi_shim_install().

efi_shim_get_variable()

EFI_STATUS EFIAPI efi_shim_get_variable ( CHAR16 * name, EFI_GUID * guid, UINT32 * attrs, UINTN * len, VOID * data )

static

Wrap GetVariable()

Parameters

name	Variable name
guid	Variable namespace GUID
attrs	Attributes to fill in
len	Buffer size
data	Data buffer

Return values

efirc

EFI status code

Definition at line 226 of file efi_shim.c.

                                                 {
        char *value = data;
        EFI_STATUS efirc;
 
        /* Call original GetVariable() */
        efirc = efi_shim_orig_get_variable ( name, guid, attrs, len, data );
 
        /* Patch SbatLevel variable if applicable */
        if ( efi_shim_is_sbatlevel ( name, guid ) && data && ( efirc == 0 ) ) {
                if ( efi_shim_allow_sbat ) {
                        DBGC ( &efi_shim, "SHIM allowing read from %ls:\n",
                               name );
                } else if ( efi_shim_sbatlevel_verify ) {
                        DBGC ( &efi_shim, "SHIM allowing one read from %ls:\n",
                               name );
                        efi_shim_sbatlevel_verify = 0;
                } else {
                        DBGC ( &efi_shim, "SHIM patching read from %ls:\n",
                               name );
                        value[0] = '\0';
                }
                DBGC_HDA ( &efi_shim, 0, data, *len );
        }
 
        return efirc;
}

References data, DBGC, DBGC_HDA, efi_shim_allow_sbat, efi_shim_is_sbatlevel(), efi_shim_orig_get_variable, efi_shim_sbatlevel_verify, guid, len, name, value, and VOID.

Referenced by efi_shim_get_memory_map(), and efi_shim_install().

efi_shim_get_memory_map()

EFIAPI EFI_STATUS efi_shim_get_memory_map ( UINTN * len, EFI_MEMORY_DESCRIPTOR * map, UINTN * key, UINTN * desclen, UINT32 * descver )

static

Wrap GetMemoryMap()

Parameters

len	Memory map size
map	Memory map
key	Memory map key
desclen	Descriptor size
descver	Descriptor version

Return values

efirc

EFI status code

Definition at line 264 of file efi_shim.c.

                                                                     {
        EFI_RUNTIME_SERVICES *rs = efi_systab->RuntimeServices;
 
        /* Unlock shim */
        if ( ! efi_shim_require_loader )
                efi_shim_unlock();
 
        /* Uninstall runtime services wrappers, if still installed */
        if ( rs->SetVariable == efi_shim_set_variable ) {
                rs->SetVariable = efi_shim_orig_set_variable;
                DBGC ( &efi_shim, "SHIM uninstalled SetVariable() wrapper\n" );
        } else if ( rs->SetVariable != efi_shim_orig_set_variable ) {
                DBGC ( &efi_shim, "SHIM could not uninstall SetVariable() "
                       "wrapper!\n" );
        }
        if ( rs->GetVariable == efi_shim_get_variable ) {
                rs->GetVariable = efi_shim_orig_get_variable;
                DBGC ( &efi_shim, "SHIM uninstalled GetVariable() wrapper\n" );
        } else if ( rs->GetVariable != efi_shim_orig_get_variable ) {
                DBGC ( &efi_shim, "SHIM could not uninstall GetVariable() "
                       "wrapper!\n" );
        }
 
        /* Hand off to original GetMemoryMap() */
        return efi_shim_orig_get_memory_map ( len, map, key, desclen,
                                              descver );
}

References DBGC, efi_shim_get_variable(), efi_shim_orig_get_memory_map, efi_shim_orig_get_variable, efi_shim_orig_set_variable, efi_shim_require_loader, efi_shim_set_variable(), efi_shim_unlock(), efi_systab, EFIAPI, EFI_RUNTIME_SERVICES::GetVariable, key, len, map, and EFI_RUNTIME_SERVICES::SetVariable.

Referenced by efi_shim_install().

efi_shim_inhibit_pxe()

int efi_shim_inhibit_pxe ( EFI_HANDLE handle )

static

Inhibit use of PXE base code.

Parameters

handle

EFI handle

Return values

rc	Return status code

Definition at line 301 of file efi_shim.c.

                                                      {
        EFI_PXE_BASE_CODE_PROTOCOL *pxe;
        EFI_STATUS efirc;
        int rc;
 
        /* Locate PXE base code */
        if ( ( rc = efi_open ( handle, &efi_pxe_base_code_protocol_guid,
                               &pxe ) ) != 0 ) {
                DBGC ( &efi_shim, "SHIM could not open PXE base code: %s\n",
                       strerror ( rc ) );
                return rc;
        }
 
        /* Stop PXE base code */
        if ( ( efirc = pxe->Stop ( pxe ) ) != 0 ) {
                rc = -EEFI ( efirc );
                DBGC ( &efi_shim, "SHIM could not stop PXE base code: %s\n",
                       strerror ( rc ) );
                return rc;
        }
 
        DBGC ( &efi_shim, "SHIM stopped PXE base code\n" );
        return 0;
}

References DBGC, EEFI, EFI_HANDLE, efi_open, efi_pxe_base_code_protocol_guid, handle, rc, _EFI_PXE_BASE_CODE_PROTOCOL::Stop, and strerror().

Referenced by efi_shim_install().

efi_shim_cmdline()

int efi_shim_cmdline ( struct image * shim, wchar_t ** cmdline )

static

Update command line.

Parameters

shim	Shim image
cmdline	Command line to update

Return values

rc	Return status code

Definition at line 333 of file efi_shim.c.

                                                                      {
        wchar_t *shimcmdline;
        int len;
        int rc;
 
        /* Construct new command line */
        len = ( shim->cmdline ?
                efi_asprintf ( &shimcmdline, "%s %s", shim->name,
                               shim->cmdline ) :
                efi_asprintf ( &shimcmdline, "%s %ls", shim->name,
                               *cmdline ) );
        if ( len < 0 ) {
                rc = len;
                DBGC ( &efi_shim, "SHIM could not construct command line: "
                       "%s\n", strerror ( rc ) );
                return rc;
        }
 
        /* Replace command line */
        free ( *cmdline );
        *cmdline = shimcmdline;
 
        return 0;
}

References cmdline, DBGC, efi_asprintf(), free, len, rc, shim(), and strerror().

Referenced by efi_shim_install().

efi_shim_install()

int efi_shim_install	(	struct image *	shim,
		EFI_HANDLE	handle,
		wchar_t **	cmdline )

Install UEFI shim special handling.

Parameters

shim	Shim image
handle	EFI device handle
cmdline	Command line to update

Return values

rc	Return status code

Definition at line 366 of file efi_shim.c.

                                           {
        EFI_BOOT_SERVICES *bs = efi_systab->BootServices;
        EFI_RUNTIME_SERVICES *rs = efi_systab->RuntimeServices;
        int rc;
 
        /* Stop PXE base code */
        if ( ( ! efi_shim_allow_pxe ) &&
             ( ( rc = efi_shim_inhibit_pxe ( handle ) ) != 0 ) ) {
                return rc;
        }
 
        /* Update command line */
        if ( ( rc = efi_shim_cmdline ( shim, cmdline ) ) != 0 )
                return rc;
 
        /* Record original boot and runtime services functions */
        efi_shim_orig_get_memory_map = bs->GetMemoryMap;
        efi_shim_orig_set_variable = rs->SetVariable;
        efi_shim_orig_get_variable = rs->GetVariable;
 
        /* Wrap relevant boot and runtime services functions */
        bs->GetMemoryMap = efi_shim_get_memory_map;
        rs->SetVariable = efi_shim_set_variable;
        rs->GetVariable = efi_shim_get_variable;
        DBGC ( &efi_shim, "SHIM installed wrappers\n" );
 
        return 0;
}

References cmdline, DBGC, EFI_HANDLE, efi_shim_allow_pxe, efi_shim_cmdline(), efi_shim_get_memory_map(), efi_shim_get_variable(), efi_shim_inhibit_pxe(), efi_shim_orig_get_memory_map, efi_shim_orig_get_variable, efi_shim_orig_set_variable, efi_shim_set_variable(), efi_systab, EFI_BOOT_SERVICES::GetMemoryMap, EFI_RUNTIME_SERVICES::GetVariable, handle, rc, EFI_RUNTIME_SERVICES::SetVariable, and shim().

Referenced by efi_image_exec().

efi_shim_uninstall()

void efi_shim_uninstall

(

void

)

Uninstall UEFI shim special handling.

Definition at line 400 of file efi_shim.c.

                                 {
        EFI_BOOT_SERVICES *bs = efi_systab->BootServices;
        EFI_RUNTIME_SERVICES *rs = efi_systab->RuntimeServices;
 
        /* Restore original boot and runtime services functions */
        bs->GetMemoryMap = efi_shim_orig_get_memory_map;
        rs->SetVariable = efi_shim_orig_set_variable;
        rs->GetVariable = efi_shim_orig_get_variable;
        DBGC ( &efi_shim, "SHIM uninstalled wrappers\n" );
}

References DBGC, efi_shim_orig_get_memory_map, efi_shim_orig_get_variable, efi_shim_orig_set_variable, efi_systab, EFI_BOOT_SERVICES::GetMemoryMap, EFI_RUNTIME_SERVICES::GetVariable, and EFI_RUNTIME_SERVICES::SetVariable.

Referenced by efi_image_exec().

Variable Documentation

efi_shim_require_loader

int efi_shim_require_loader = 0

Require use of a third party loader binary.

The UEFI shim is gradually becoming less capable of directly executing a Linux kernel image, due to an ever increasing list of assumptions that it will only ever be used in conjunction with a second stage loader binary such as GRUB.

For example: shim will erroneously complain if the image that it loads and executes does not in turn call in to the "shim lock protocol" to verify a separate newly loaded binary before calling ExitBootServices(), even if no such separate binary is used or required.

Experience shows that there is unfortunately no point in trying to get a fix for this upstreamed into shim. We therefore default to reducing the Secure Boot attack surface by removing, where possible, this spurious requirement for the use of an additional second stage loader.

This option may be used to require the use of an additional second stage loader binary, in case this behaviour is ever desirable.

Definition at line 69 of file efi_shim.c.

Referenced by efi_shim_get_memory_map(), FILE_SECBOOT(), and shim().

efi_shim_allow_pxe

int efi_shim_allow_pxe = 0

Allow use of PXE base code protocol.

We provide shim with access to all of the relevant downloaded files via our EFI_SIMPLE_FILE_SYSTEM_PROTOCOL interface. However, shim will instead try to redownload the files via TFTP since it prefers to use the EFI_PXE_BASE_CODE_PROTOCOL installed on the same handle.

Experience shows that there is unfortunately no point in trying to get a fix for this upstreamed into shim. We therefore default to working around this undesirable behaviour by stopping the PXE base code protocol before invoking shim.

This option may be used to allow shim to use the PXE base code protocol, in case this behaviour is ever desirable.

Definition at line 87 of file efi_shim.c.

Referenced by efi_shim_install(), FILE_SECBOOT(), and shim().

efi_shim_allow_sbat

int efi_shim_allow_sbat = 0

Allow SBAT variable access.

The UEFI shim implements a fairly nicely designed revocation mechanism designed around the concept of security generations. Unfortunately nobody in the shim community has thus far added the relevant metadata to the Linux kernel, with the result that current versions of shim are incapable of booting current versions of the Linux kernel.

Experience shows that there is unfortunately no point in trying to get a fix for this upstreamed into shim. We therefore default to working around this undesirable behaviour by patching data read from the "SbatLevel" variable used to hold SBAT configuration.

This option may be used to allow shim unpatched access to the "SbatLevel" variable, in case this behaviour is ever desirable.

Definition at line 107 of file efi_shim.c.

Referenced by efi_shim_get_variable(), FILE_SECBOOT(), and shim().

__image_tag

struct image_tag efi_shim __image_tag

Initial value:

= {
        .name = "SHIM",
}

UEFI shim image.

The downloaded flattened device tree tag.

Definition at line 110 of file efi_shim.c.

                                        {
        .name = "SHIM",
};

efi_shim_orig_get_memory_map

EFI_GET_MEMORY_MAP efi_shim_orig_get_memory_map

static

Original GetMemoryMap() function.

Definition at line 115 of file efi_shim.c.

Referenced by efi_shim_get_memory_map(), efi_shim_install(), and efi_shim_uninstall().

efi_shim_orig_set_variable

EFI_SET_VARIABLE efi_shim_orig_set_variable

static

Original SetVariable() function.

Definition at line 118 of file efi_shim.c.

Referenced by efi_shim_get_memory_map(), efi_shim_install(), efi_shim_set_variable(), and efi_shim_uninstall().

efi_shim_orig_get_variable

EFI_GET_VARIABLE efi_shim_orig_get_variable

static

Original GetVariable() function.

Definition at line 121 of file efi_shim.c.

Referenced by efi_shim_get_memory_map(), efi_shim_get_variable(), efi_shim_install(), and efi_shim_uninstall().

efi_shim_sbatlevel_verify

int efi_shim_sbatlevel_verify

static

Verify read from SbatLevel variable.

Definition at line 124 of file efi_shim.c.

Referenced by efi_shim_get_variable(), and efi_shim_set_variable().