Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752784AbcD1KdA (ORCPT ); Thu, 28 Apr 2016 06:33:00 -0400 Received: from terminus.zytor.com ([198.137.202.10]:47366 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751534AbcD1Kc7 (ORCPT ); Thu, 28 Apr 2016 06:32:59 -0400 Date: Thu, 28 Apr 2016 03:31:57 -0700 From: tip-bot for Linn Crosetto Message-ID: Cc: hpa@zytor.com, ard.biesheuvel@linaro.org, mingo@kernel.org, linux-kernel@vger.kernel.org, bp@alien8.de, linn@hpe.com, peterz@infradead.org, roy.franz@linaro.org, mark.rutland@arm.com, tglx@linutronix.de, matt@codeblueprint.co.uk Reply-To: roy.franz@linaro.org, tglx@linutronix.de, mark.rutland@arm.com, matt@codeblueprint.co.uk, linn@hpe.com, bp@alien8.de, peterz@infradead.org, linux-kernel@vger.kernel.org, hpa@zytor.com, ard.biesheuvel@linaro.org, mingo@kernel.org In-Reply-To: <1461614832-17633-6-git-send-email-matt@codeblueprint.co.uk> References: <1461614832-17633-6-git-send-email-matt@codeblueprint.co.uk> To: linux-tip-commits@vger.kernel.org Subject: [tip:efi/core] efi/arm64: Check SetupMode when determining Secure Boot status Git-Commit-ID: 30d7bf034c034995f34dae265d96247f7f12044e X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2975 Lines: 87 Commit-ID: 30d7bf034c034995f34dae265d96247f7f12044e Gitweb: http://git.kernel.org/tip/30d7bf034c034995f34dae265d96247f7f12044e Author: Linn Crosetto AuthorDate: Mon, 25 Apr 2016 21:06:37 +0100 Committer: Ingo Molnar CommitDate: Thu, 28 Apr 2016 11:33:49 +0200 efi/arm64: Check SetupMode when determining Secure Boot status According to the UEFI specification (version 2.5 Errata A, page 87): The platform firmware is operating in secure boot mode if the value of the SetupMode variable is 0 and the SecureBoot variable is set to 1. A platform cannot operate in secure boot mode if the SetupMode variable is set to 1. Check the value of the SetupMode variable when determining the state of Secure Boot. Plus also do minor cleanup, change sizeof() use to match kernel style guidelines. Signed-off-by: Linn Crosetto Signed-off-by: Matt Fleming Reviewed-by: Ard Biesheuvel Acked-by: Mark Rutland Cc: Borislav Petkov Cc: Peter Zijlstra Cc: Roy Franz Cc: Thomas Gleixner Cc: linux-efi@vger.kernel.org Link: http://lkml.kernel.org/r/1461614832-17633-6-git-send-email-matt@codeblueprint.co.uk Signed-off-by: Ingo Molnar --- drivers/firmware/efi/libstub/arm-stub.c | 32 +++++++++++++++++++++++++------- 1 file changed, 25 insertions(+), 7 deletions(-) diff --git a/drivers/firmware/efi/libstub/arm-stub.c b/drivers/firmware/efi/libstub/arm-stub.c index 07f967c..1286325 100644 --- a/drivers/firmware/efi/libstub/arm-stub.c +++ b/drivers/firmware/efi/libstub/arm-stub.c @@ -22,21 +22,39 @@ bool __nokaslr; static int efi_get_secureboot(efi_system_table_t *sys_table_arg) { - static efi_guid_t const var_guid = EFI_GLOBAL_VARIABLE_GUID; - static efi_char16_t const var_name[] = { + static efi_char16_t const sb_var_name[] = { 'S', 'e', 'c', 'u', 'r', 'e', 'B', 'o', 'o', 't', 0 }; + static efi_char16_t const sm_var_name[] = { + 'S', 'e', 't', 'u', 'p', 'M', 'o', 'd', 'e', 0 }; + efi_guid_t var_guid = EFI_GLOBAL_VARIABLE_GUID; efi_get_variable_t *f_getvar = sys_table_arg->runtime->get_variable; - unsigned long size = sizeof(u8); - efi_status_t status; u8 val; + unsigned long size = sizeof(val); + efi_status_t status; - status = f_getvar((efi_char16_t *)var_name, (efi_guid_t *)&var_guid, + status = f_getvar((efi_char16_t *)sb_var_name, (efi_guid_t *)&var_guid, NULL, &size, &val); + if (status != EFI_SUCCESS) + goto out_efi_err; + + if (val == 0) + return 0; + + status = f_getvar((efi_char16_t *)sm_var_name, (efi_guid_t *)&var_guid, + NULL, &size, &val); + + if (status != EFI_SUCCESS) + goto out_efi_err; + + if (val == 1) + return 0; + + return 1; + +out_efi_err: switch (status) { - case EFI_SUCCESS: - return val; case EFI_NOT_FOUND: return 0; case EFI_DEVICE_ERROR: