| Andrew Scull | b4b6d4a | 2019-01-02 15:54:55 +0000 | [diff] [blame] | 1 | /* |
| 2 | * Secure boot handling. |
| 3 | * |
| 4 | * Copyright (C) 2013,2014 Linaro Limited |
| 5 | * Roy Franz <roy.franz@linaro.org |
| 6 | * Copyright (C) 2013 Red Hat, Inc. |
| 7 | * Mark Salter <msalter@redhat.com> |
| 8 | * |
| 9 | * This file is part of the Linux kernel, and is made available under the |
| 10 | * terms of the GNU General Public License version 2. |
| 11 | */ |
| 12 | #include <linux/efi.h> |
| 13 | #include <asm/efi.h> |
| 14 | |
| 15 | #include "efistub.h" |
| 16 | |
| 17 | /* BIOS variables */ |
| 18 | static const efi_guid_t efi_variable_guid = EFI_GLOBAL_VARIABLE_GUID; |
| 19 | static const efi_char16_t efi_SecureBoot_name[] = L"SecureBoot"; |
| 20 | static const efi_char16_t efi_SetupMode_name[] = L"SetupMode"; |
| 21 | |
| 22 | /* SHIM variables */ |
| 23 | static const efi_guid_t shim_guid = EFI_SHIM_LOCK_GUID; |
| 24 | static const efi_char16_t shim_MokSBState_name[] = L"MokSBState"; |
| 25 | |
| 26 | #define get_efi_var(name, vendor, ...) \ |
| 27 | efi_call_runtime(get_variable, \ |
| 28 | (efi_char16_t *)(name), (efi_guid_t *)(vendor), \ |
| 29 | __VA_ARGS__); |
| 30 | |
| 31 | /* |
| 32 | * Determine whether we're in secure boot mode. |
| 33 | * |
| 34 | * Please keep the logic in sync with |
| 35 | * arch/x86/xen/efi.c:xen_efi_get_secureboot(). |
| 36 | */ |
| 37 | enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg) |
| 38 | { |
| 39 | u32 attr; |
| 40 | u8 secboot, setupmode, moksbstate; |
| 41 | unsigned long size; |
| 42 | efi_status_t status; |
| 43 | |
| 44 | size = sizeof(secboot); |
| 45 | status = get_efi_var(efi_SecureBoot_name, &efi_variable_guid, |
| 46 | NULL, &size, &secboot); |
| 47 | if (status == EFI_NOT_FOUND) |
| 48 | return efi_secureboot_mode_disabled; |
| 49 | if (status != EFI_SUCCESS) |
| 50 | goto out_efi_err; |
| 51 | |
| 52 | size = sizeof(setupmode); |
| 53 | status = get_efi_var(efi_SetupMode_name, &efi_variable_guid, |
| 54 | NULL, &size, &setupmode); |
| 55 | if (status != EFI_SUCCESS) |
| 56 | goto out_efi_err; |
| 57 | |
| 58 | if (secboot == 0 || setupmode == 1) |
| 59 | return efi_secureboot_mode_disabled; |
| 60 | |
| 61 | /* |
| 62 | * See if a user has put the shim into insecure mode. If so, and if the |
| 63 | * variable doesn't have the runtime attribute set, we might as well |
| 64 | * honor that. |
| 65 | */ |
| 66 | size = sizeof(moksbstate); |
| 67 | status = get_efi_var(shim_MokSBState_name, &shim_guid, |
| 68 | &attr, &size, &moksbstate); |
| 69 | |
| 70 | /* If it fails, we don't care why. Default to secure */ |
| 71 | if (status != EFI_SUCCESS) |
| 72 | goto secure_boot_enabled; |
| 73 | if (!(attr & EFI_VARIABLE_RUNTIME_ACCESS) && moksbstate == 1) |
| 74 | return efi_secureboot_mode_disabled; |
| 75 | |
| 76 | secure_boot_enabled: |
| 77 | pr_efi(sys_table_arg, "UEFI Secure Boot is enabled.\n"); |
| 78 | return efi_secureboot_mode_enabled; |
| 79 | |
| 80 | out_efi_err: |
| 81 | pr_efi_err(sys_table_arg, "Could not determine UEFI Secure Boot status.\n"); |
| 82 | return efi_secureboot_mode_unknown; |
| 83 | } |