Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1343614

[PATCH v2 1/2] arm64/efi: report unexpected errors when determining Secure Boot status

Show all headers | View raw

Certain code in the boot path may require the ability to determine whether
UEFI Secure Boot is definitely enabled, for example printing status to the
console. Other code may need to know when UEFI Secure Boot is definitely
disabled, for example restricting use of kernel parameters.

If an unexpected error is returned from GetVariable when querying the
status of UEFI Secure Boot, return an error to the caller. This allows the
caller to determine the definite state, and to take appropriate action if
an expected error is returned.

Signed-off-by: Linn Crosetto <linn@hpe.com>
---
New patch in v2 based on feedback from v1:

 - Maintain existing behavior to allow 'dtb=' parameter only when UEFI
   Secure Boot is disabled and not in an unknown state. (Mark Rutland)

 drivers/firmware/efi/libstub/arm-stub.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/drivers/firmware/efi/libstub/arm-stub.c b/drivers/firmware/efi/libstub/arm-stub.c
index 3397902..b1bb133 100644
--- a/drivers/firmware/efi/libstub/arm-stub.c
+++ b/drivers/firmware/efi/libstub/arm-stub.c
@@ -18,7 +18,7 @@
 
 #include "efistub.h"
 
-static int efi_secureboot_enabled(efi_system_table_t *sys_table_arg)
+static int efi_get_secureboot(efi_system_table_t *sys_table_arg)
 {
 	static efi_guid_t const var_guid = EFI_GLOBAL_VARIABLE_GUID;
 	static efi_char16_t const var_name[] = {
@@ -37,8 +37,12 @@ static int efi_secureboot_enabled(efi_system_table_t *sys_table_arg)
 		return val;
 	case EFI_NOT_FOUND:
 		return 0;
+	case EFI_DEVICE_ERROR:
+		return -EIO;
+	case EFI_SECURITY_VIOLATION:
+		return -EACCES;
 	default:
-		return 1;
+		return -EINVAL;
 	}
 }
 
@@ -183,6 +187,7 @@ unsigned long efi_entry(void *handle, efi_system_table_t *sys_table,
 	efi_guid_t loaded_image_proto = LOADED_IMAGE_PROTOCOL_GUID;
 	unsigned long reserve_addr = 0;
 	unsigned long reserve_size = 0;
+	int secure_boot = 0;
 
 	/* Check if we were booted by the EFI firmware */
 	if (sys_table->hdr.signature != EFI_SYSTEM_TABLE_SIGNATURE)
@@ -231,13 +236,15 @@ unsigned long efi_entry(void *handle, efi_system_table_t *sys_table,
 	if (status != EFI_SUCCESS)
 		pr_efi_err(sys_table, "Failed to parse EFI cmdline options\n");
 
+	secure_boot = efi_get_secureboot(sys_table);
+	if (secure_boot > 0)
+		pr_efi(sys_table, "UEFI Secure Boot is enabled.\n");
+
 	/*
 	 * Unauthenticated device tree data is a security hazard, so
 	 * ignore 'dtb=' unless UEFI Secure Boot is disabled.
 	 */
-	if (efi_secureboot_enabled(sys_table)) {
-		pr_efi(sys_table, "UEFI Secure Boot is enabled.\n");
-	} else {
+	if (secure_boot == 0) {
 		status = handle_cmdline_files(sys_table, image, cmdline_ptr,
 					      "dtb=",
 					      ~0UL, &fdt_addr, &fdt_size);
-- 
2.1.4

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH] arm64/efi: check SetupMode when determining Secure Boot status Linn Crosetto <linn@hpe.com> - 2016-02-24 01:30 +0100
  Re: [PATCH] arm64/efi: check SetupMode when determining Secure Boot  status Mark Rutland <mark.rutland@arm.com> - 2016-02-24 12:30 +0100
  [PATCH v2 2/2] arm64/efi: check SetupMode when determining Secure Boot status Linn Crosetto <linn@hpe.com> - 2016-02-26 01:20 +0100
  [PATCH v2 0/2] arm64/efi: query Secure Boot status according to UEFI spec Linn Crosetto <linn@hpe.com> - 2016-02-26 01:20 +0100
    [PATCH v2 1/2] arm64/efi: report unexpected errors when determining Secure Boot status Linn Crosetto <linn@hpe.com> - 2016-02-26 01:20 +0100
      Re: [PATCH v2 1/2] arm64/efi: report unexpected errors when  determining Secure Boot status Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2016-03-03 09:10 +0100
    Re: [PATCH v2 0/2] arm64/efi: query Secure Boot status according to  UEFI spec Matt Fleming <matt@codeblueprint.co.uk> - 2016-03-02 14:40 +0100
    [PATCH v3 2/2] arm64/efi: check SetupMode when determining Secure Boot status Linn Crosetto <linn@hpe.com> - 2016-03-03 22:50 +0100
      Re: [PATCH v3 2/2] arm64/efi: check SetupMode when determining Secure  Boot status Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2016-03-04 09:10 +0100
    [PATCH v3 0/2] arm64/efi: query Secure Boot status according to UEFI spec Linn Crosetto <linn@hpe.com> - 2016-03-03 22:50 +0100
      [PATCH v3 1/2] arm64/efi: report unexpected errors when determining Secure Boot status Linn Crosetto <linn@hpe.com> - 2016-03-03 22:50 +0100
        Re: [PATCH v3 1/2] arm64/efi: report unexpected errors when  determining Secure Boot status Ard Biesheuvel <ard.biesheuvel@linaro.org> - 2016-03-04 09:00 +0100

csiph-web