mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2024-12-23 16:09:57 +07:00
a7012bdbdf
Initialize UEFI secure boot state during dom0 boot. Otherwise the kernel may not even know that it runs on secure boot enabled platform. Note that part of drivers/firmware/efi/libstub/secureboot.c is duplicated by this patch, only in this case, it runs in the context of the kernel proper rather than UEFI boot context. The reason for the duplication is that maintaining the original code to run correctly on ARM/arm64 as well as on all the quirky x86 firmware we support is enough of a burden as it is, and adding the x86/Xen execution context to that mix just so we can reuse a single routine just isn't worth it. [ardb: explain rationale for code duplication] Signed-off-by: Daniel Kiper <daniel.kiper@oracle.com> Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Matt Fleming <matt@codeblueprint.co.uk> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: linux-efi@vger.kernel.org Link: http://lkml.kernel.org/r/20180504060003.19618-2-ard.biesheuvel@linaro.org Signed-off-by: Ingo Molnar <mingo@kernel.org>
84 lines
2.4 KiB
C
84 lines
2.4 KiB
C
/*
|
|
* Secure boot handling.
|
|
*
|
|
* Copyright (C) 2013,2014 Linaro Limited
|
|
* Roy Franz <roy.franz@linaro.org
|
|
* Copyright (C) 2013 Red Hat, Inc.
|
|
* Mark Salter <msalter@redhat.com>
|
|
*
|
|
* This file is part of the Linux kernel, and is made available under the
|
|
* terms of the GNU General Public License version 2.
|
|
*/
|
|
#include <linux/efi.h>
|
|
#include <asm/efi.h>
|
|
|
|
#include "efistub.h"
|
|
|
|
/* BIOS variables */
|
|
static const efi_guid_t efi_variable_guid = EFI_GLOBAL_VARIABLE_GUID;
|
|
static const efi_char16_t efi_SecureBoot_name[] = L"SecureBoot";
|
|
static const efi_char16_t efi_SetupMode_name[] = L"SetupMode";
|
|
|
|
/* SHIM variables */
|
|
static const efi_guid_t shim_guid = EFI_SHIM_LOCK_GUID;
|
|
static const efi_char16_t shim_MokSBState_name[] = L"MokSBState";
|
|
|
|
#define get_efi_var(name, vendor, ...) \
|
|
efi_call_runtime(get_variable, \
|
|
(efi_char16_t *)(name), (efi_guid_t *)(vendor), \
|
|
__VA_ARGS__);
|
|
|
|
/*
|
|
* Determine whether we're in secure boot mode.
|
|
*
|
|
* Please keep the logic in sync with
|
|
* arch/x86/xen/efi.c:xen_efi_get_secureboot().
|
|
*/
|
|
enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg)
|
|
{
|
|
u32 attr;
|
|
u8 secboot, setupmode, moksbstate;
|
|
unsigned long size;
|
|
efi_status_t status;
|
|
|
|
size = sizeof(secboot);
|
|
status = get_efi_var(efi_SecureBoot_name, &efi_variable_guid,
|
|
NULL, &size, &secboot);
|
|
if (status == EFI_NOT_FOUND)
|
|
return efi_secureboot_mode_disabled;
|
|
if (status != EFI_SUCCESS)
|
|
goto out_efi_err;
|
|
|
|
size = sizeof(setupmode);
|
|
status = get_efi_var(efi_SetupMode_name, &efi_variable_guid,
|
|
NULL, &size, &setupmode);
|
|
if (status != EFI_SUCCESS)
|
|
goto out_efi_err;
|
|
|
|
if (secboot == 0 || setupmode == 1)
|
|
return efi_secureboot_mode_disabled;
|
|
|
|
/*
|
|
* See if a user has put the shim into insecure mode. If so, and if the
|
|
* variable doesn't have the runtime attribute set, we might as well
|
|
* honor that.
|
|
*/
|
|
size = sizeof(moksbstate);
|
|
status = get_efi_var(shim_MokSBState_name, &shim_guid,
|
|
&attr, &size, &moksbstate);
|
|
|
|
/* If it fails, we don't care why. Default to secure */
|
|
if (status != EFI_SUCCESS)
|
|
goto secure_boot_enabled;
|
|
if (!(attr & EFI_VARIABLE_RUNTIME_ACCESS) && moksbstate == 1)
|
|
return efi_secureboot_mode_disabled;
|
|
|
|
secure_boot_enabled:
|
|
pr_efi(sys_table_arg, "UEFI Secure Boot is enabled.\n");
|
|
return efi_secureboot_mode_enabled;
|
|
|
|
out_efi_err:
|
|
pr_efi_err(sys_table_arg, "Could not determine UEFI Secure Boot status.\n");
|
|
return efi_secureboot_mode_unknown;
|
|
}
|