replacements.c 7.09 KB
Newer Older
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52
/*
 * shim - trivial UEFI first-stage bootloader
 *
 * Copyright 2012 Red Hat, Inc <mjg@redhat.com>
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * Redistributions of source code must retain the above copyright
 * notice, this list of conditions and the following disclaimer.
 *
 * Redistributions in binary form must reproduce the above copyright
 * notice, this list of conditions and the following disclaimer in the
 * documentation and/or other materials provided with the
 * distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
 * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 * OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 * Significant portions of this code are derived from Tianocore
 * (http://tianocore.sf.net) and are Copyright 2009-2012 Intel
 * Corporation.
 */

/*   Chemical agents lend themselves to covert use in sabotage against
 * which it is exceedingly difficult to visualize any really effective
 * defense... I will not dwell upon this use of CBW because, as one
 * pursues the possibilities of such covert uses, one discovers that the
 * scenarios resemble that in which the components of a nuclear weapon
 * are smuggled into New York City and assembled in the basement of the
 * Empire State Building.
 *   In other words, once the possibility is recognized to exist, about
 * all that one can do is worry about it.
 *   -- Dr. Ivan L Bennett, Jr., testifying before the Subcommittee on
 *      National Security Policy and Scientific Developments, November 20,
 *      1969.
 */

#include <efi.h>
#include <efiapi.h>
#include <efilib.h>
53

54 55 56 57
#include "shim.h"

static EFI_SYSTEM_TABLE *systab;

58 59 60 61 62 63 64 65
EFI_SYSTEM_TABLE *
get_active_systab(void)
{
	if (systab)
		return systab;
	return ST;
}

66
static typeof(systab->BootServices->LoadImage) system_load_image;
67 68 69 70
static typeof(systab->BootServices->StartImage) system_start_image;
static typeof(systab->BootServices->Exit) system_exit;
static typeof(systab->BootServices->ExitBootServices) system_exit_boot_services;

71 72
static EFI_HANDLE last_loaded_image;

73
void
74 75
unhook_system_services(void)
{
76 77 78
	if (!systab)
		return;

79
	systab->BootServices->LoadImage = system_load_image;
80 81
	systab->BootServices->StartImage = system_start_image;
	systab->BootServices->ExitBootServices = system_exit_boot_services;
82
	gBS = systab->BootServices;
83 84
}

85 86 87 88 89
static EFI_STATUS EFIAPI
load_image(BOOLEAN BootPolicy, EFI_HANDLE ParentImageHandle,
	EFI_DEVICE_PATH *DevicePath, VOID *SourceBuffer,
	UINTN SourceSize, EFI_HANDLE *ImageHandle)
{
90
	EFI_STATUS efi_status;
91

92 93 94
	unhook_system_services();
	efi_status = gBS->LoadImage(BootPolicy, ParentImageHandle, DevicePath,
				    SourceBuffer, SourceSize, ImageHandle);
95
	hook_system_services(systab);
96
	if (EFI_ERROR(efi_status))
97 98 99
		last_loaded_image = NULL;
	else
		last_loaded_image = *ImageHandle;
100
	return efi_status;
101 102
}

103
static EFI_STATUS EFIAPI
104
replacement_start_image(EFI_HANDLE image_handle, UINTN *exit_data_size, CHAR16 **exit_data)
105
{
106
	EFI_STATUS efi_status;
107
	unhook_system_services();
108 109 110 111 112

	if (image_handle == last_loaded_image) {
		loader_is_participating = 1;
		uninstall_shim_protocols();
	}
113 114
	efi_status = gBS->StartImage(image_handle, exit_data_size, exit_data);
	if (EFI_ERROR(efi_status)) {
115
		if (image_handle == last_loaded_image) {
116
			EFI_STATUS efi_status2 = install_shim_protocols();
117

118 119 120 121
			if (EFI_ERROR(efi_status2)) {
				console_print(L"Something has gone seriously wrong: %r\n",
					      efi_status2);
				console_print(L"shim cannot continue, sorry.\n");
122
				msleep(5000000);
123 124 125
				gRT->ResetSystem(EfiResetShutdown,
						 EFI_SECURITY_VIOLATION,
						 0, NULL);
126 127
			}
		}
128
		hook_system_services(systab);
129 130
		loader_is_participating = 0;
	}
131
	return efi_status;
132 133 134 135 136
}

static EFI_STATUS EFIAPI
exit_boot_services(EFI_HANDLE image_key, UINTN map_key)
{
137 138
	if (loader_is_participating ||
	    verification_method == VERIFIED_BY_HASH) {
139
		unhook_system_services();
140 141 142
		EFI_STATUS efi_status;
		efi_status = gBS->ExitBootServices(image_key, map_key);
		if (EFI_ERROR(efi_status))
143
			hook_system_services(systab);
144
		return efi_status;
145 146
	}

147 148
	console_print(L"Bootloader has not verified loaded image.\n");
	console_print(L"System is compromised.  halting.\n");
149
	msleep(5000000);
150
	gRT->ResetSystem(EfiResetShutdown, EFI_SECURITY_VIOLATION, 0, NULL);
151 152 153 154
	return EFI_SECURITY_VIOLATION;
}

static EFI_STATUS EFIAPI
155
do_exit(EFI_HANDLE ImageHandle, EFI_STATUS ExitStatus,
156
	UINTN ExitDataSize, CHAR16 *ExitData)
157
{
158
	EFI_STATUS efi_status;
159

160 161
	shim_fini();

162 163 164 165
	efi_status = gBS->Exit(ImageHandle, ExitStatus,
			       ExitDataSize, ExitData);
	if (EFI_ERROR(efi_status)) {
		EFI_STATUS efi_status2 = shim_init();
166

167 168 169 170
		if (EFI_ERROR(efi_status2)) {
			console_print(L"Something has gone seriously wrong: %r\n",
				      efi_status2);
			console_print(L"shim cannot continue, sorry.\n");
171
			msleep(5000000);
172 173
			gRT->ResetSystem(EfiResetShutdown,
					 EFI_SECURITY_VIOLATION, 0, NULL);
174 175
		}
	}
176
	return efi_status;
177 178 179 180 181 182
}

void
hook_system_services(EFI_SYSTEM_TABLE *local_systab)
{
	systab = local_systab;
183
	gBS = systab->BootServices;
184 185 186

	/* We need to hook various calls to make this work... */

187 188 189
	/* We need LoadImage() hooked so that fallback.c can load shim
	 * without having to fake LoadImage as well.  This allows it
	 * to call the system LoadImage(), and have us track the output
190 191 192
	 * and mark loader_is_participating in replacement_start_image.  This
	 * means anything added by fallback has to be verified by the system
	 * db, which we want to preserve anyway, since that's all launching
193 194 195 196
	 * through BDS gives us. */
	system_load_image = systab->BootServices->LoadImage;
	systab->BootServices->LoadImage = load_image;

197 198 199
	/* we need StartImage() so that we can allow chain booting to an
	 * image trusted by the firmware */
	system_start_image = systab->BootServices->StartImage;
200
	systab->BootServices->StartImage = replacement_start_image;
201 202 203 204 205

	/* we need to hook ExitBootServices() so a) we can enforce the policy
	 * and b) we can unwrap when we're done. */
	system_exit_boot_services = systab->BootServices->ExitBootServices;
	systab->BootServices->ExitBootServices = exit_boot_services;
206 207 208 209 210 211
}

void
unhook_exit(void)
{
	systab->BootServices->Exit = system_exit;
212
	gBS = systab->BootServices;
213 214 215 216 217 218
}

void
hook_exit(EFI_SYSTEM_TABLE *local_systab)
{
	systab = local_systab;
219
	gBS = local_systab->BootServices;
220 221 222 223 224

	/* we need to hook Exit() so that we can allow users to quit the
	 * bootloader and still e.g. start a new one or run an internal
	 * shell. */
	system_exit = systab->BootServices->Exit;
225
	systab->BootServices->Exit = do_exit;
226
}