1 /* 2 * Secure boot handling. 3 * 4 * Copyright (C) 2013,2014 Linaro Limited 5 * Roy Franz <roy.franz@linaro.org 6 * Copyright (C) 2013 Red Hat, Inc. 7 * Mark Salter <msalter@redhat.com> 8 * 9 * This file is part of the Linux kernel, and is made available under the 10 * terms of the GNU General Public License version 2. 11 */ 12 #include <linux/efi.h> 13 #include <asm/efi.h> 14 15 /* BIOS variables */ 16 static const efi_guid_t efi_variable_guid = EFI_GLOBAL_VARIABLE_GUID; 17 static const efi_char16_t const efi_SecureBoot_name[] = { 18 'S', 'e', 'c', 'u', 'r', 'e', 'B', 'o', 'o', 't', 0 19 }; 20 static const efi_char16_t const efi_SetupMode_name[] = { 21 'S', 'e', 't', 'u', 'p', 'M', 'o', 'd', 'e', 0 22 }; 23 24 #define get_efi_var(name, vendor, ...) \ 25 efi_call_runtime(get_variable, \ 26 (efi_char16_t *)(name), (efi_guid_t *)(vendor), \ 27 __VA_ARGS__); 28 29 /* 30 * Determine whether we're in secure boot mode. 31 */ 32 enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg) 33 { 34 u8 secboot, setupmode; 35 unsigned long size; 36 efi_status_t status; 37 38 size = sizeof(secboot); 39 status = get_efi_var(efi_SecureBoot_name, &efi_variable_guid, 40 NULL, &size, &secboot); 41 if (status != EFI_SUCCESS) 42 goto out_efi_err; 43 44 size = sizeof(setupmode); 45 status = get_efi_var(efi_SetupMode_name, &efi_variable_guid, 46 NULL, &size, &setupmode); 47 if (status != EFI_SUCCESS) 48 goto out_efi_err; 49 50 if (secboot == 0 || setupmode == 1) 51 return efi_secureboot_mode_disabled; 52 53 pr_efi(sys_table_arg, "UEFI Secure Boot is enabled.\n"); 54 return efi_secureboot_mode_enabled; 55 56 out_efi_err: 57 pr_efi_err(sys_table_arg, "Could not determine UEFI Secure Boot status.\n"); 58 if (status == EFI_NOT_FOUND) 59 return efi_secureboot_mode_disabled; 60 return efi_secureboot_mode_unknown; 61 } 62