1 /*
2  * EFI Test Driver for Runtime Services
3  *
4  * Copyright(C) 2012-2016 Canonical Ltd.
5  *
6  * This driver exports EFI runtime services interfaces into userspace, which
7  * allow to use and test UEFI runtime services provided by firmware.
8  *
9  */
10 
11 #include <linux/version.h>
12 #include <linux/miscdevice.h>
13 #include <linux/module.h>
14 #include <linux/init.h>
15 #include <linux/proc_fs.h>
16 #include <linux/efi.h>
17 #include <linux/slab.h>
18 #include <linux/uaccess.h>
19 
20 #include "efi_test.h"
21 
22 MODULE_AUTHOR("Ivan Hu <ivan.hu@canonical.com>");
23 MODULE_DESCRIPTION("EFI Test Driver");
24 MODULE_LICENSE("GPL");
25 
26 /*
27  * Count the bytes in 'str', including the terminating NULL.
28  *
29  * Note this function returns the number of *bytes*, not the number of
30  * ucs2 characters.
31  */
32 static inline size_t user_ucs2_strsize(efi_char16_t  __user *str)
33 {
34 	efi_char16_t *s = str, c;
35 	size_t len;
36 
37 	if (!str)
38 		return 0;
39 
40 	/* Include terminating NULL */
41 	len = sizeof(efi_char16_t);
42 
43 	if (get_user(c, s++)) {
44 		/* Can't read userspace memory for size */
45 		return 0;
46 	}
47 
48 	while (c != 0) {
49 		if (get_user(c, s++)) {
50 			/* Can't read userspace memory for size */
51 			return 0;
52 		}
53 		len += sizeof(efi_char16_t);
54 	}
55 	return len;
56 }
57 
58 /*
59  * Allocate a buffer and copy a ucs2 string from user space into it.
60  */
61 static inline int
62 copy_ucs2_from_user_len(efi_char16_t **dst, efi_char16_t __user *src,
63 			size_t len)
64 {
65 	efi_char16_t *buf;
66 
67 	if (!src) {
68 		*dst = NULL;
69 		return 0;
70 	}
71 
72 	if (!access_ok(VERIFY_READ, src, 1))
73 		return -EFAULT;
74 
75 	buf = kmalloc(len, GFP_KERNEL);
76 	if (!buf) {
77 		*dst = NULL;
78 		return -ENOMEM;
79 	}
80 	*dst = buf;
81 
82 	if (copy_from_user(*dst, src, len)) {
83 		kfree(buf);
84 		return -EFAULT;
85 	}
86 
87 	return 0;
88 }
89 
90 /*
91  * Count the bytes in 'str', including the terminating NULL.
92  *
93  * Just a wrap for user_ucs2_strsize
94  */
95 static inline int
96 get_ucs2_strsize_from_user(efi_char16_t __user *src, size_t *len)
97 {
98 	if (!access_ok(VERIFY_READ, src, 1))
99 		return -EFAULT;
100 
101 	*len = user_ucs2_strsize(src);
102 	if (*len == 0)
103 		return -EFAULT;
104 
105 	return 0;
106 }
107 
108 /*
109  * Calculate the required buffer allocation size and copy a ucs2 string
110  * from user space into it.
111  *
112  * This function differs from copy_ucs2_from_user_len() because it
113  * calculates the size of the buffer to allocate by taking the length of
114  * the string 'src'.
115  *
116  * If a non-zero value is returned, the caller MUST NOT access 'dst'.
117  *
118  * It is the caller's responsibility to free 'dst'.
119  */
120 static inline int
121 copy_ucs2_from_user(efi_char16_t **dst, efi_char16_t __user *src)
122 {
123 	size_t len;
124 
125 	if (!access_ok(VERIFY_READ, src, 1))
126 		return -EFAULT;
127 
128 	len = user_ucs2_strsize(src);
129 	if (len == 0)
130 		return -EFAULT;
131 	return copy_ucs2_from_user_len(dst, src, len);
132 }
133 
134 /*
135  * Copy a ucs2 string to a user buffer.
136  *
137  * This function is a simple wrapper around copy_to_user() that does
138  * nothing if 'src' is NULL, which is useful for reducing the amount of
139  * NULL checking the caller has to do.
140  *
141  * 'len' specifies the number of bytes to copy.
142  */
143 static inline int
144 copy_ucs2_to_user_len(efi_char16_t __user *dst, efi_char16_t *src, size_t len)
145 {
146 	if (!src)
147 		return 0;
148 
149 	if (!access_ok(VERIFY_WRITE, dst, 1))
150 		return -EFAULT;
151 
152 	return copy_to_user(dst, src, len);
153 }
154 
155 static long efi_runtime_get_variable(unsigned long arg)
156 {
157 	struct efi_getvariable __user *getvariable_user;
158 	struct efi_getvariable getvariable;
159 	unsigned long datasize, prev_datasize, *dz;
160 	efi_guid_t vendor_guid, *vd = NULL;
161 	efi_status_t status;
162 	efi_char16_t *name = NULL;
163 	u32 attr, *at;
164 	void *data = NULL;
165 	int rv = 0;
166 
167 	getvariable_user = (struct efi_getvariable __user *)arg;
168 
169 	if (copy_from_user(&getvariable, getvariable_user,
170 			   sizeof(getvariable)))
171 		return -EFAULT;
172 	if (getvariable.data_size &&
173 	    get_user(datasize, getvariable.data_size))
174 		return -EFAULT;
175 	if (getvariable.vendor_guid) {
176 		if (copy_from_user(&vendor_guid, getvariable.vendor_guid,
177 					sizeof(vendor_guid)))
178 			return -EFAULT;
179 		vd = &vendor_guid;
180 	}
181 
182 	if (getvariable.variable_name) {
183 		rv = copy_ucs2_from_user(&name, getvariable.variable_name);
184 		if (rv)
185 			return rv;
186 	}
187 
188 	at = getvariable.attributes ? &attr : NULL;
189 	dz = getvariable.data_size ? &datasize : NULL;
190 
191 	if (getvariable.data_size && getvariable.data) {
192 		data = kmalloc(datasize, GFP_KERNEL);
193 		if (!data) {
194 			kfree(name);
195 			return -ENOMEM;
196 		}
197 	}
198 
199 	prev_datasize = datasize;
200 	status = efi.get_variable(name, vd, at, dz, data);
201 	kfree(name);
202 
203 	if (put_user(status, getvariable.status)) {
204 		rv = -EFAULT;
205 		goto out;
206 	}
207 
208 	if (status != EFI_SUCCESS) {
209 		if (status == EFI_BUFFER_TOO_SMALL) {
210 			if (dz && put_user(datasize, getvariable.data_size)) {
211 				rv = -EFAULT;
212 				goto out;
213 			}
214 		}
215 		rv = -EINVAL;
216 		goto out;
217 	}
218 
219 	if (prev_datasize < datasize) {
220 		rv = -EINVAL;
221 		goto out;
222 	}
223 
224 	if (data) {
225 		if (copy_to_user(getvariable.data, data, datasize)) {
226 			rv = -EFAULT;
227 			goto out;
228 		}
229 	}
230 
231 	if (at && put_user(attr, getvariable.attributes)) {
232 		rv = -EFAULT;
233 		goto out;
234 	}
235 
236 	if (dz && put_user(datasize, getvariable.data_size))
237 		rv = -EFAULT;
238 
239 out:
240 	kfree(data);
241 	return rv;
242 
243 }
244 
245 static long efi_runtime_set_variable(unsigned long arg)
246 {
247 	struct efi_setvariable __user *setvariable_user;
248 	struct efi_setvariable setvariable;
249 	efi_guid_t vendor_guid;
250 	efi_status_t status;
251 	efi_char16_t *name = NULL;
252 	void *data;
253 	int rv = 0;
254 
255 	setvariable_user = (struct efi_setvariable __user *)arg;
256 
257 	if (copy_from_user(&setvariable, setvariable_user, sizeof(setvariable)))
258 		return -EFAULT;
259 	if (copy_from_user(&vendor_guid, setvariable.vendor_guid,
260 				sizeof(vendor_guid)))
261 		return -EFAULT;
262 
263 	if (setvariable.variable_name) {
264 		rv = copy_ucs2_from_user(&name, setvariable.variable_name);
265 		if (rv)
266 			return rv;
267 	}
268 
269 	data = kmalloc(setvariable.data_size, GFP_KERNEL);
270 	if (!data) {
271 		kfree(name);
272 		return -ENOMEM;
273 	}
274 	if (copy_from_user(data, setvariable.data, setvariable.data_size)) {
275 		rv = -EFAULT;
276 		goto out;
277 	}
278 
279 	status = efi.set_variable(name, &vendor_guid,
280 				setvariable.attributes,
281 				setvariable.data_size, data);
282 
283 	if (put_user(status, setvariable.status)) {
284 		rv = -EFAULT;
285 		goto out;
286 	}
287 
288 	rv = status == EFI_SUCCESS ? 0 : -EINVAL;
289 
290 out:
291 	kfree(data);
292 	kfree(name);
293 
294 	return rv;
295 }
296 
297 static long efi_runtime_get_time(unsigned long arg)
298 {
299 	struct efi_gettime __user *gettime_user;
300 	struct efi_gettime  gettime;
301 	efi_status_t status;
302 	efi_time_cap_t cap;
303 	efi_time_t efi_time;
304 
305 	gettime_user = (struct efi_gettime __user *)arg;
306 	if (copy_from_user(&gettime, gettime_user, sizeof(gettime)))
307 		return -EFAULT;
308 
309 	status = efi.get_time(gettime.time ? &efi_time : NULL,
310 			      gettime.capabilities ? &cap : NULL);
311 
312 	if (put_user(status, gettime.status))
313 		return -EFAULT;
314 
315 	if (status != EFI_SUCCESS)
316 		return -EINVAL;
317 
318 	if (gettime.capabilities) {
319 		efi_time_cap_t __user *cap_local;
320 
321 		cap_local = (efi_time_cap_t *)gettime.capabilities;
322 		if (put_user(cap.resolution, &(cap_local->resolution)) ||
323 			put_user(cap.accuracy, &(cap_local->accuracy)) ||
324 			put_user(cap.sets_to_zero, &(cap_local->sets_to_zero)))
325 			return -EFAULT;
326 	}
327 	if (gettime.time) {
328 		if (copy_to_user(gettime.time, &efi_time, sizeof(efi_time_t)))
329 			return -EFAULT;
330 	}
331 
332 	return 0;
333 }
334 
335 static long efi_runtime_set_time(unsigned long arg)
336 {
337 	struct efi_settime __user *settime_user;
338 	struct efi_settime settime;
339 	efi_status_t status;
340 	efi_time_t efi_time;
341 
342 	settime_user = (struct efi_settime __user *)arg;
343 	if (copy_from_user(&settime, settime_user, sizeof(settime)))
344 		return -EFAULT;
345 	if (copy_from_user(&efi_time, settime.time,
346 					sizeof(efi_time_t)))
347 		return -EFAULT;
348 	status = efi.set_time(&efi_time);
349 
350 	if (put_user(status, settime.status))
351 		return -EFAULT;
352 
353 	return status == EFI_SUCCESS ? 0 : -EINVAL;
354 }
355 
356 static long efi_runtime_get_waketime(unsigned long arg)
357 {
358 	struct efi_getwakeuptime __user *getwakeuptime_user;
359 	struct efi_getwakeuptime getwakeuptime;
360 	efi_bool_t enabled, pending;
361 	efi_status_t status;
362 	efi_time_t efi_time;
363 
364 	getwakeuptime_user = (struct efi_getwakeuptime __user *)arg;
365 	if (copy_from_user(&getwakeuptime, getwakeuptime_user,
366 				sizeof(getwakeuptime)))
367 		return -EFAULT;
368 
369 	status = efi.get_wakeup_time(
370 		getwakeuptime.enabled ? (efi_bool_t *)&enabled : NULL,
371 		getwakeuptime.pending ? (efi_bool_t *)&pending : NULL,
372 		getwakeuptime.time ? &efi_time : NULL);
373 
374 	if (put_user(status, getwakeuptime.status))
375 		return -EFAULT;
376 
377 	if (status != EFI_SUCCESS)
378 		return -EINVAL;
379 
380 	if (getwakeuptime.enabled && put_user(enabled,
381 						getwakeuptime.enabled))
382 		return -EFAULT;
383 
384 	if (getwakeuptime.time) {
385 		if (copy_to_user(getwakeuptime.time, &efi_time,
386 				sizeof(efi_time_t)))
387 			return -EFAULT;
388 	}
389 
390 	return 0;
391 }
392 
393 static long efi_runtime_set_waketime(unsigned long arg)
394 {
395 	struct efi_setwakeuptime __user *setwakeuptime_user;
396 	struct efi_setwakeuptime setwakeuptime;
397 	efi_bool_t enabled;
398 	efi_status_t status;
399 	efi_time_t efi_time;
400 
401 	setwakeuptime_user = (struct efi_setwakeuptime __user *)arg;
402 
403 	if (copy_from_user(&setwakeuptime, setwakeuptime_user,
404 				sizeof(setwakeuptime)))
405 		return -EFAULT;
406 
407 	enabled = setwakeuptime.enabled;
408 	if (setwakeuptime.time) {
409 		if (copy_from_user(&efi_time, setwakeuptime.time,
410 					sizeof(efi_time_t)))
411 			return -EFAULT;
412 
413 		status = efi.set_wakeup_time(enabled, &efi_time);
414 	} else
415 		status = efi.set_wakeup_time(enabled, NULL);
416 
417 	if (put_user(status, setwakeuptime.status))
418 		return -EFAULT;
419 
420 	return status == EFI_SUCCESS ? 0 : -EINVAL;
421 }
422 
423 static long efi_runtime_get_nextvariablename(unsigned long arg)
424 {
425 	struct efi_getnextvariablename __user *getnextvariablename_user;
426 	struct efi_getnextvariablename getnextvariablename;
427 	unsigned long name_size, prev_name_size = 0, *ns = NULL;
428 	efi_status_t status;
429 	efi_guid_t *vd = NULL;
430 	efi_guid_t vendor_guid;
431 	efi_char16_t *name = NULL;
432 	int rv;
433 
434 	getnextvariablename_user = (struct efi_getnextvariablename __user *)arg;
435 
436 	if (copy_from_user(&getnextvariablename, getnextvariablename_user,
437 			   sizeof(getnextvariablename)))
438 		return -EFAULT;
439 
440 	if (getnextvariablename.variable_name_size) {
441 		if (get_user(name_size, getnextvariablename.variable_name_size))
442 			return -EFAULT;
443 		ns = &name_size;
444 		prev_name_size = name_size;
445 	}
446 
447 	if (getnextvariablename.vendor_guid) {
448 		if (copy_from_user(&vendor_guid,
449 				getnextvariablename.vendor_guid,
450 				sizeof(vendor_guid)))
451 			return -EFAULT;
452 		vd = &vendor_guid;
453 	}
454 
455 	if (getnextvariablename.variable_name) {
456 		size_t name_string_size = 0;
457 
458 		rv = get_ucs2_strsize_from_user(
459 				getnextvariablename.variable_name,
460 				&name_string_size);
461 		if (rv)
462 			return rv;
463 		/*
464 		 * The name_size may be smaller than the real buffer size where
465 		 * variable name located in some use cases. The most typical
466 		 * case is passing a 0 to get the required buffer size for the
467 		 * 1st time call. So we need to copy the content from user
468 		 * space for at least the string size of variable name, or else
469 		 * the name passed to UEFI may not be terminated as we expected.
470 		 */
471 		rv = copy_ucs2_from_user_len(&name,
472 				getnextvariablename.variable_name,
473 				prev_name_size > name_string_size ?
474 				prev_name_size : name_string_size);
475 		if (rv)
476 			return rv;
477 	}
478 
479 	status = efi.get_next_variable(ns, name, vd);
480 
481 	if (put_user(status, getnextvariablename.status)) {
482 		rv = -EFAULT;
483 		goto out;
484 	}
485 
486 	if (status != EFI_SUCCESS) {
487 		if (status == EFI_BUFFER_TOO_SMALL) {
488 			if (ns && put_user(*ns,
489 				getnextvariablename.variable_name_size)) {
490 				rv = -EFAULT;
491 				goto out;
492 			}
493 		}
494 		rv = -EINVAL;
495 		goto out;
496 	}
497 
498 	if (name) {
499 		if (copy_ucs2_to_user_len(getnextvariablename.variable_name,
500 						name, prev_name_size)) {
501 			rv = -EFAULT;
502 			goto out;
503 		}
504 	}
505 
506 	if (ns) {
507 		if (put_user(*ns, getnextvariablename.variable_name_size)) {
508 			rv = -EFAULT;
509 			goto out;
510 		}
511 	}
512 
513 	if (vd) {
514 		if (copy_to_user(getnextvariablename.vendor_guid, vd,
515 							sizeof(efi_guid_t)))
516 			rv = -EFAULT;
517 	}
518 
519 out:
520 	kfree(name);
521 	return rv;
522 }
523 
524 static long efi_runtime_get_nexthighmonocount(unsigned long arg)
525 {
526 	struct efi_getnexthighmonotoniccount __user *getnexthighmonocount_user;
527 	struct efi_getnexthighmonotoniccount getnexthighmonocount;
528 	efi_status_t status;
529 	u32 count;
530 
531 	getnexthighmonocount_user = (struct
532 			efi_getnexthighmonotoniccount __user *)arg;
533 
534 	if (copy_from_user(&getnexthighmonocount,
535 			   getnexthighmonocount_user,
536 			   sizeof(getnexthighmonocount)))
537 		return -EFAULT;
538 
539 	status = efi.get_next_high_mono_count(
540 		getnexthighmonocount.high_count ? &count : NULL);
541 
542 	if (put_user(status, getnexthighmonocount.status))
543 		return -EFAULT;
544 
545 	if (status != EFI_SUCCESS)
546 		return -EINVAL;
547 
548 	if (getnexthighmonocount.high_count &&
549 	    put_user(count, getnexthighmonocount.high_count))
550 		return -EFAULT;
551 
552 	return 0;
553 }
554 
555 static long efi_runtime_query_variableinfo(unsigned long arg)
556 {
557 	struct efi_queryvariableinfo __user *queryvariableinfo_user;
558 	struct efi_queryvariableinfo queryvariableinfo;
559 	efi_status_t status;
560 	u64 max_storage, remaining, max_size;
561 
562 	queryvariableinfo_user = (struct efi_queryvariableinfo __user *)arg;
563 
564 	if (copy_from_user(&queryvariableinfo, queryvariableinfo_user,
565 			   sizeof(queryvariableinfo)))
566 		return -EFAULT;
567 
568 	status = efi.query_variable_info(queryvariableinfo.attributes,
569 					 &max_storage, &remaining, &max_size);
570 
571 	if (put_user(status, queryvariableinfo.status))
572 		return -EFAULT;
573 
574 	if (status != EFI_SUCCESS)
575 		return -EINVAL;
576 
577 	if (put_user(max_storage,
578 		     queryvariableinfo.maximum_variable_storage_size))
579 		return -EFAULT;
580 
581 	if (put_user(remaining,
582 		     queryvariableinfo.remaining_variable_storage_size))
583 		return -EFAULT;
584 
585 	if (put_user(max_size, queryvariableinfo.maximum_variable_size))
586 		return -EFAULT;
587 
588 	return 0;
589 }
590 
591 static long efi_runtime_query_capsulecaps(unsigned long arg)
592 {
593 	struct efi_querycapsulecapabilities __user *qcaps_user;
594 	struct efi_querycapsulecapabilities qcaps;
595 	efi_capsule_header_t *capsules;
596 	efi_status_t status;
597 	u64 max_size;
598 	int i, reset_type;
599 	int rv = 0;
600 
601 	qcaps_user = (struct efi_querycapsulecapabilities __user *)arg;
602 
603 	if (copy_from_user(&qcaps, qcaps_user, sizeof(qcaps)))
604 		return -EFAULT;
605 
606 	capsules = kcalloc(qcaps.capsule_count + 1,
607 			   sizeof(efi_capsule_header_t), GFP_KERNEL);
608 	if (!capsules)
609 		return -ENOMEM;
610 
611 	for (i = 0; i < qcaps.capsule_count; i++) {
612 		efi_capsule_header_t *c;
613 		/*
614 		 * We cannot dereference qcaps.capsule_header_array directly to
615 		 * obtain the address of the capsule as it resides in the
616 		 * user space
617 		 */
618 		if (get_user(c, qcaps.capsule_header_array + i)) {
619 			rv = -EFAULT;
620 			goto out;
621 		}
622 		if (copy_from_user(&capsules[i], c,
623 				sizeof(efi_capsule_header_t))) {
624 			rv = -EFAULT;
625 			goto out;
626 		}
627 	}
628 
629 	qcaps.capsule_header_array = &capsules;
630 
631 	status = efi.query_capsule_caps((efi_capsule_header_t **)
632 					qcaps.capsule_header_array,
633 					qcaps.capsule_count,
634 					&max_size, &reset_type);
635 
636 	if (put_user(status, qcaps.status)) {
637 		rv = -EFAULT;
638 		goto out;
639 	}
640 
641 	if (status != EFI_SUCCESS) {
642 		rv = -EINVAL;
643 		goto out;
644 	}
645 
646 	if (put_user(max_size, qcaps.maximum_capsule_size)) {
647 		rv = -EFAULT;
648 		goto out;
649 	}
650 
651 	if (put_user(reset_type, qcaps.reset_type))
652 		rv = -EFAULT;
653 
654 out:
655 	kfree(capsules);
656 	return rv;
657 }
658 
659 static long efi_test_ioctl(struct file *file, unsigned int cmd,
660 							unsigned long arg)
661 {
662 	switch (cmd) {
663 	case EFI_RUNTIME_GET_VARIABLE:
664 		return efi_runtime_get_variable(arg);
665 
666 	case EFI_RUNTIME_SET_VARIABLE:
667 		return efi_runtime_set_variable(arg);
668 
669 	case EFI_RUNTIME_GET_TIME:
670 		return efi_runtime_get_time(arg);
671 
672 	case EFI_RUNTIME_SET_TIME:
673 		return efi_runtime_set_time(arg);
674 
675 	case EFI_RUNTIME_GET_WAKETIME:
676 		return efi_runtime_get_waketime(arg);
677 
678 	case EFI_RUNTIME_SET_WAKETIME:
679 		return efi_runtime_set_waketime(arg);
680 
681 	case EFI_RUNTIME_GET_NEXTVARIABLENAME:
682 		return efi_runtime_get_nextvariablename(arg);
683 
684 	case EFI_RUNTIME_GET_NEXTHIGHMONOTONICCOUNT:
685 		return efi_runtime_get_nexthighmonocount(arg);
686 
687 	case EFI_RUNTIME_QUERY_VARIABLEINFO:
688 		return efi_runtime_query_variableinfo(arg);
689 
690 	case EFI_RUNTIME_QUERY_CAPSULECAPABILITIES:
691 		return efi_runtime_query_capsulecaps(arg);
692 	}
693 
694 	return -ENOTTY;
695 }
696 
697 static int efi_test_open(struct inode *inode, struct file *file)
698 {
699 	/*
700 	 * nothing special to do here
701 	 * We do accept multiple open files at the same time as we
702 	 * synchronize on the per call operation.
703 	 */
704 	return 0;
705 }
706 
707 static int efi_test_close(struct inode *inode, struct file *file)
708 {
709 	return 0;
710 }
711 
712 /*
713  *	The various file operations we support.
714  */
715 static const struct file_operations efi_test_fops = {
716 	.owner		= THIS_MODULE,
717 	.unlocked_ioctl	= efi_test_ioctl,
718 	.open		= efi_test_open,
719 	.release	= efi_test_close,
720 	.llseek		= no_llseek,
721 };
722 
723 static struct miscdevice efi_test_dev = {
724 	MISC_DYNAMIC_MINOR,
725 	"efi_test",
726 	&efi_test_fops
727 };
728 
729 static int __init efi_test_init(void)
730 {
731 	int ret;
732 
733 	ret = misc_register(&efi_test_dev);
734 	if (ret) {
735 		pr_err("efi_test: can't misc_register on minor=%d\n",
736 			MISC_DYNAMIC_MINOR);
737 		return ret;
738 	}
739 
740 	return 0;
741 }
742 
743 static void __exit efi_test_exit(void)
744 {
745 	misc_deregister(&efi_test_dev);
746 }
747 
748 module_init(efi_test_init);
749 module_exit(efi_test_exit);
750