1 /* 2 * Secure boot handling. 3 * 4 * Copyright (C) 2013,2014 Linaro Limited 5 * Roy Franz <roy.franz@linaro.org 6 * Copyright (C) 2013 Red Hat, Inc. 7 * Mark Salter <msalter@redhat.com> 8 * 9 * This file is part of the Linux kernel, and is made available under the 10 * terms of the GNU General Public License version 2. 11 */ 12 #include <linux/efi.h> 13 #include <asm/efi.h> 14 15 #include "efistub.h" 16 17 /* BIOS variables */ 18 static const efi_guid_t efi_variable_guid = EFI_GLOBAL_VARIABLE_GUID; 19 static const efi_char16_t efi_SecureBoot_name[] = L"SecureBoot"; 20 static const efi_char16_t efi_SetupMode_name[] = L"SetupMode"; 21 22 /* SHIM variables */ 23 static const efi_guid_t shim_guid = EFI_SHIM_LOCK_GUID; 24 static const efi_char16_t shim_MokSBState_name[] = L"MokSBState"; 25 26 #define get_efi_var(name, vendor, ...) \ 27 efi_call_runtime(get_variable, \ 28 (efi_char16_t *)(name), (efi_guid_t *)(vendor), \ 29 __VA_ARGS__); 30 31 /* 32 * Determine whether we're in secure boot mode. 33 * 34 * Please keep the logic in sync with 35 * arch/x86/xen/efi.c:xen_efi_get_secureboot(). 36 */ 37 enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg) 38 { 39 u32 attr; 40 u8 secboot, setupmode, moksbstate; 41 unsigned long size; 42 efi_status_t status; 43 44 size = sizeof(secboot); 45 status = get_efi_var(efi_SecureBoot_name, &efi_variable_guid, 46 NULL, &size, &secboot); 47 if (status == EFI_NOT_FOUND) 48 return efi_secureboot_mode_disabled; 49 if (status != EFI_SUCCESS) 50 goto out_efi_err; 51 52 size = sizeof(setupmode); 53 status = get_efi_var(efi_SetupMode_name, &efi_variable_guid, 54 NULL, &size, &setupmode); 55 if (status != EFI_SUCCESS) 56 goto out_efi_err; 57 58 if (secboot == 0 || setupmode == 1) 59 return efi_secureboot_mode_disabled; 60 61 /* 62 * See if a user has put the shim into insecure mode. If so, and if the 63 * variable doesn't have the runtime attribute set, we might as well 64 * honor that. 65 */ 66 size = sizeof(moksbstate); 67 status = get_efi_var(shim_MokSBState_name, &shim_guid, 68 &attr, &size, &moksbstate); 69 70 /* If it fails, we don't care why. Default to secure */ 71 if (status != EFI_SUCCESS) 72 goto secure_boot_enabled; 73 if (!(attr & EFI_VARIABLE_RUNTIME_ACCESS) && moksbstate == 1) 74 return efi_secureboot_mode_disabled; 75 76 secure_boot_enabled: 77 pr_efi(sys_table_arg, "UEFI Secure Boot is enabled.\n"); 78 return efi_secureboot_mode_enabled; 79 80 out_efi_err: 81 pr_efi_err(sys_table_arg, "Could not determine UEFI Secure Boot status.\n"); 82 return efi_secureboot_mode_unknown; 83 } 84