projects / mirror_ubuntu-artful-kernel.git / blame
| Commit | Line | Data |
|---|---|---|
| de8cb458 DH |
1 | /* |
| 2 | * Secure boot handling. | |
| 3 | * | |
| 4 | * Copyright (C) 2013,2014 Linaro Limited | |
| 5 | * Roy Franz <roy.franz@linaro.org | |
| 6 | * Copyright (C) 2013 Red Hat, Inc. | |
| 7 | * Mark Salter <msalter@redhat.com> | |
| 8 | * | |
| 9 | * This file is part of the Linux kernel, and is made available under the | |
| 10 | * terms of the GNU General Public License version 2. | |
| 11 | */ | |
| 12 | #include <linux/efi.h> | |
| 13 | #include <asm/efi.h> | |
| 14 | ||
| 15 | /* BIOS variables */ | |
| 16 | static const efi_guid_t efi_variable_guid = EFI_GLOBAL_VARIABLE_GUID; | |
| 17 | static const efi_char16_t const efi_SecureBoot_name[] = { | |
| 18 | 'S', 'e', 'c', 'u', 'r', 'e', 'B', 'o', 'o', 't', 0 | |
| 19 | }; | |
| 20 | static const efi_char16_t const efi_SetupMode_name[] = { | |
| 21 | 'S', 'e', 't', 'u', 'p', 'M', 'o', 'd', 'e', 0 | |
| 22 | }; | |
| 23 | ||
| f3cf6f74 JB |
24 | /* SHIM variables */ |
| 25 | static const efi_guid_t shim_guid = EFI_SHIM_LOCK_GUID; | |
| 26 | static efi_char16_t const shim_MokSBState_name[] = { | |
| 27 | 'M', 'o', 'k', 'S', 'B', 'S', 't', 'a', 't', 'e', 0 | |
| 28 | }; | |
| 29 | ||
| de8cb458 DH |
30 | #define get_efi_var(name, vendor, ...) \ |
| 31 | efi_call_runtime(get_variable, \ | |
| 32 | (efi_char16_t *)(name), (efi_guid_t *)(vendor), \ | |
| 33 | __VA_ARGS__); | |
| 34 | ||
| 35 | /* | |
| 36 | * Determine whether we're in secure boot mode. | |
| 37 | */ | |
| 38 | enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg) | |
| 39 | { | |
| f3cf6f74 JB |
40 | u32 attr; |
| 41 | u8 secboot, setupmode, moksbstate; | |
| de8cb458 DH |
42 | unsigned long size; |
| 43 | efi_status_t status; | |
| 44 | ||
| 45 | size = sizeof(secboot); | |
| 46 | status = get_efi_var(efi_SecureBoot_name, &efi_variable_guid, | |
| 47 | NULL, &size, &secboot); | |
| 52e51f16 AB |
48 | if (status == EFI_NOT_FOUND) |
| 49 | return efi_secureboot_mode_disabled; | |
| de8cb458 DH |
50 | if (status != EFI_SUCCESS) |
| 51 | goto out_efi_err; | |
| 52 | ||
| 53 | size = sizeof(setupmode); | |
| 54 | status = get_efi_var(efi_SetupMode_name, &efi_variable_guid, | |
| 55 | NULL, &size, &setupmode); | |
| 56 | if (status != EFI_SUCCESS) | |
| 57 | goto out_efi_err; | |
| 58 | ||
| 59 | if (secboot == 0 || setupmode == 1) | |
| 60 | return efi_secureboot_mode_disabled; | |
| 61 | ||
| f3cf6f74 JB |
62 | /* |
| 63 | * See if a user has put the shim into insecure mode. If so, and if the | |
| 64 | * variable doesn't have the runtime attribute set, we might as well | |
| 65 | * honor that. | |
| 66 | */ | |
| 67 | size = sizeof(moksbstate); | |
| 68 | status = get_efi_var(shim_MokSBState_name, &shim_guid, | |
| 69 | &attr, &size, &moksbstate); | |
| 70 | ||
| 71 | /* If it fails, we don't care why. Default to secure */ | |
| 72 | if (status != EFI_SUCCESS) | |
| 73 | goto secure_boot_enabled; | |
| 74 | if (!(attr & EFI_VARIABLE_RUNTIME_ACCESS) && moksbstate == 1) | |
| 75 | return efi_secureboot_mode_disabled; | |
| 76 | ||
| 77 | secure_boot_enabled: | |
| de8cb458 DH |
78 | pr_efi(sys_table_arg, "UEFI Secure Boot is enabled.\n"); |
| 79 | return efi_secureboot_mode_enabled; | |
| 80 | ||
| 81 | out_efi_err: | |
| 82 | pr_efi_err(sys_table_arg, "Could not determine UEFI Secure Boot status.\n"); | |
| de8cb458 DH |
83 | return efi_secureboot_mode_unknown; |
| 84 | } |