From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753573AbcBXAZz (ORCPT ); Tue, 23 Feb 2016 19:25:55 -0500 Received: from g9t1613g.houston.hp.com ([15.240.0.71]:43636 "EHLO g9t1613g.houston.hp.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752673AbcBXAZy (ORCPT ); Tue, 23 Feb 2016 19:25:54 -0500 From: Linn Crosetto To: matt@codeblueprint.co.uk, ard.biesheuvel@linaro.org, roy.franz@linaro.org, mingo@kernel.org, mark.rutland@arm.com Cc: linux-kernel@vger.kernel.org, Linn Crosetto Subject: [PATCH] arm64/efi: check SetupMode when determining Secure Boot status Date: Tue, 23 Feb 2016 17:25:09 -0700 Message-Id: <1456273509-25249-1-git-send-email-linn@hpe.com> X-Mailer: git-send-email 2.1.4 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org According to the UEFI specification, the platform is operating in secure boot mode if SetupMode is 0 and SecureBoot is 1, and cannot operate in secure boot mode if SetupMode is set to 1. Check the value of SetupMode when determining the state of Secure Boot. Signed-off-by: Linn Crosetto --- drivers/firmware/efi/libstub/arm-stub.c | 34 +++++++++++++++++++++------------ 1 file changed, 22 insertions(+), 12 deletions(-) diff --git a/drivers/firmware/efi/libstub/arm-stub.c b/drivers/firmware/efi/libstub/arm-stub.c index 3397902..7ef2e20 100644 --- a/drivers/firmware/efi/libstub/arm-stub.c +++ b/drivers/firmware/efi/libstub/arm-stub.c @@ -20,26 +20,36 @@ static int efi_secureboot_enabled(efi_system_table_t *sys_table_arg) { - static efi_guid_t const var_guid = EFI_GLOBAL_VARIABLE_GUID; - static efi_char16_t const var_name[] = { + static efi_char16_t const sb_var_name[] = { 'S', 'e', 'c', 'u', 'r', 'e', 'B', 'o', 'o', 't', 0 }; + static efi_char16_t const sm_var_name[] = { + 'S', 'e', 't', 'u', 'p', 'M', 'o', 'd', 'e', 0 }; + efi_guid_t var_guid = EFI_GLOBAL_VARIABLE_GUID; efi_get_variable_t *f_getvar = sys_table_arg->runtime->get_variable; - unsigned long size = sizeof(u8); - efi_status_t status; u8 val; + unsigned long size = sizeof(val); + efi_status_t status; - status = f_getvar((efi_char16_t *)var_name, (efi_guid_t *)&var_guid, + status = f_getvar((efi_char16_t *)sb_var_name, (efi_guid_t *)&var_guid, NULL, &size, &val); - switch (status) { - case EFI_SUCCESS: - return val; - case EFI_NOT_FOUND: + if (status != EFI_SUCCESS) return 0; - default: - return 1; - } + + if (val == 0) + return 0; + + status = f_getvar((efi_char16_t *)sm_var_name, (efi_guid_t *)&var_guid, + NULL, &size, &val); + + if (status != EFI_SUCCESS) + return 0; + + if (val == 1) + return 0; + + return 1; } efi_status_t efi_open_volume(efi_system_table_t *sys_table_arg, -- 2.1.4