| 1 | |
| 2 | |
| 3 | * Copyright (C) 2018 IBM Corporation
|
| 4 |
|
| 5 | #include <linux/efi.h>
|
| 6 | #include <linux/secure_boot.h>
|
| 7 | #include <asm/efi.h>
|
| 8 |
|
| 9 | #ifndef arch_efi_boot_mode
|
| 10 | #define arch_efi_boot_mode efi_secureboot_mode_unset
|
| 11 | #endif
|
| 12 |
|
| 13 | static enum efi_secureboot_mode get_sb_mode(void)
|
| 14 | {
|
| 15 | enum efi_secureboot_mode mode;
|
| 16 |
|
| 17 | if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) {
|
| 18 | pr_info("integrity: secureboot mode unknown, no efi\n");
|
| 19 | return efi_secureboot_mode_unknown;
|
| 20 | }
|
| 21 |
|
| 22 | mode = efi_get_secureboot_mode(efi.get_variable);
|
| 23 | if (mode == efi_secureboot_mode_disabled)
|
| 24 | pr_info("integrity: secureboot mode disabled\n");
|
| 25 | else if (mode == efi_secureboot_mode_unknown)
|
| 26 | pr_info("integrity: secureboot mode unknown\n");
|
| 27 | else
|
| 28 | pr_info("integrity: secureboot mode enabled\n");
|
| 29 | return mode;
|
| 30 | }
|
| 31 |
|
| 32 | |
| 33 | * Query secure boot status
|
| 34 | *
|
| 35 | * Note don't call this function too early e.g. in __setup hook otherwise the
|
| 36 | * kernel may hang when calling efi_get_secureboot_mode.
|
| 37 | *
|
| 38 |
|
| 39 | bool arch_get_secureboot(void)
|
| 40 | {
|
| 41 | static enum efi_secureboot_mode sb_mode;
|
| 42 | static bool initialized;
|
| 43 |
|
| 44 | if (!initialized && efi_enabled(EFI_BOOT)) {
|
| 45 | sb_mode = arch_efi_boot_mode;
|
| 46 |
|
| 47 | if (sb_mode == efi_secureboot_mode_unset)
|
| 48 | sb_mode = get_sb_mode();
|
| 49 | initialized = true;
|
| 50 | }
|
| 51 |
|
| 52 | if (sb_mode == efi_secureboot_mode_enabled)
|
| 53 | return true;
|
| 54 | else
|
| 55 | return false;
|
| 56 | }
|