1 #include <dragonstub/dragonstub.h>
2
3 /* SHIM variables */
4 static const efi_guid_t shim_guid = EFI_SHIM_LOCK_GUID;
5 static const efi_char16_t shim_MokSBState_name[] = L"MokSBStateRT";
6
get_var(efi_char16_t * name,efi_guid_t * vendor,u32 * attr,unsigned long * data_size,void * data)7 static efi_status_t get_var(efi_char16_t *name, efi_guid_t *vendor, u32 *attr,
8 unsigned long *data_size, void *data)
9 {
10 return get_efi_var(name, vendor, attr, data_size, data);
11 }
12
13 /*
14 * Determine whether we're in secure boot mode.
15 */
efi_get_secureboot(void)16 enum efi_secureboot_mode efi_get_secureboot(void)
17 {
18 u32 attr;
19 unsigned long size;
20 enum efi_secureboot_mode mode;
21 efi_status_t status;
22 u8 moksbstate;
23
24 mode = efi_get_secureboot_mode(get_var);
25 if (mode == efi_secureboot_mode_unknown) {
26 efi_err("Could not determine UEFI Secure Boot status.\n");
27 return efi_secureboot_mode_unknown;
28 }
29 if (mode != efi_secureboot_mode_enabled)
30 return mode;
31
32 /*
33 * See if a user has put the shim into insecure mode. If so, and if the
34 * variable doesn't have the non-volatile attribute set, we might as
35 * well honor that.
36 */
37 size = sizeof(moksbstate);
38 status = get_efi_var(shim_MokSBState_name, &shim_guid, &attr, &size,
39 &moksbstate);
40
41 /* If it fails, we don't care why. Default to secure */
42 if (status != EFI_SUCCESS)
43 goto secure_boot_enabled;
44 if (!(attr & EFI_VARIABLE_NON_VOLATILE) && moksbstate == 1)
45 return efi_secureboot_mode_disabled;
46
47 secure_boot_enabled:
48 efi_info("UEFI Secure Boot is enabled.\n");
49 return efi_secureboot_mode_enabled;
50 }
51
52 /// @brief 打印efi_secureboot_mode
print_efi_secureboot_mode(enum efi_secureboot_mode mode)53 void print_efi_secureboot_mode(enum efi_secureboot_mode mode)
54 {
55 switch (mode) {
56 case efi_secureboot_mode_unknown:
57 efi_info("efi_secureboot_mode: efi_secureboot_mode_unknown\n");
58 break;
59 case efi_secureboot_mode_disabled:
60 efi_info("efi_secureboot_mode: efi_secureboot_mode_disabled\n");
61 break;
62 case efi_secureboot_mode_enabled:
63 efi_info("efi_secureboot_mode: efi_secureboot_mode_enabled\n");
64 break;
65 case efi_secureboot_mode_unset:
66 efi_info("efi_secureboot_mode: efi_secureboot_mode_unset\n");
67 break;
68 default:
69 break;
70 }
71 }