1 /* 2 * Secure boot handling. 3 * 4 * Copyright (C) 2013,2014 Linaro Limited 5 * Roy Franz <roy.franz@linaro.org 6 * Copyright (C) 2013 Red Hat, Inc. 7 * Mark Salter <msalter@redhat.com> 8 * 9 * This file is part of the Linux kernel, and is made available under the 10 * terms of the GNU General Public License version 2. 11 */ 12 #include <linux/efi.h> 13 #include <asm/efi.h> 14 15 #include "efistub.h" 16 17 /* BIOS variables */ 18 static const efi_guid_t efi_variable_guid = EFI_GLOBAL_VARIABLE_GUID; 19 static const efi_char16_t efi_SecureBoot_name[] = L"SecureBoot"; 20 static const efi_char16_t efi_SetupMode_name[] = L"SetupMode"; 21 22 /* SHIM variables */ 23 static const efi_guid_t shim_guid = EFI_SHIM_LOCK_GUID; 24 static const efi_char16_t shim_MokSBState_name[] = L"MokSBState"; 25 26 #define get_efi_var(name, vendor, ...) \ 27 efi_call_runtime(get_variable, \ 28 (efi_char16_t *)(name), (efi_guid_t *)(vendor), \ 29 __VA_ARGS__); 30 31 /* 32 * Determine whether we're in secure boot mode. 33 */ 34 enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg) 35 { 36 u32 attr; 37 u8 secboot, setupmode, moksbstate; 38 unsigned long size; 39 efi_status_t status; 40 41 size = sizeof(secboot); 42 status = get_efi_var(efi_SecureBoot_name, &efi_variable_guid, 43 NULL, &size, &secboot); 44 if (status == EFI_NOT_FOUND) 45 return efi_secureboot_mode_disabled; 46 if (status != EFI_SUCCESS) 47 goto out_efi_err; 48 49 size = sizeof(setupmode); 50 status = get_efi_var(efi_SetupMode_name, &efi_variable_guid, 51 NULL, &size, &setupmode); 52 if (status != EFI_SUCCESS) 53 goto out_efi_err; 54 55 if (secboot == 0 || setupmode == 1) 56 return efi_secureboot_mode_disabled; 57 58 /* 59 * See if a user has put the shim into insecure mode. If so, and if the 60 * variable doesn't have the runtime attribute set, we might as well 61 * honor that. 62 */ 63 size = sizeof(moksbstate); 64 status = get_efi_var(shim_MokSBState_name, &shim_guid, 65 &attr, &size, &moksbstate); 66 67 /* If it fails, we don't care why. Default to secure */ 68 if (status != EFI_SUCCESS) 69 goto secure_boot_enabled; 70 if (!(attr & EFI_VARIABLE_RUNTIME_ACCESS) && moksbstate == 1) 71 return efi_secureboot_mode_disabled; 72 73 secure_boot_enabled: 74 pr_efi(sys_table_arg, "UEFI Secure Boot is enabled.\n"); 75 return efi_secureboot_mode_enabled; 76 77 out_efi_err: 78 pr_efi_err(sys_table_arg, "Could not determine UEFI Secure Boot status.\n"); 79 return efi_secureboot_mode_unknown; 80 } 81