From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754551AbdCBIoj (ORCPT ); Thu, 2 Mar 2017 03:44:39 -0500 Received: from terminus.zytor.com ([65.50.211.136]:48642 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754223AbdCBInR (ORCPT ); Thu, 2 Mar 2017 03:43:17 -0500 Date: Wed, 1 Mar 2017 23:49:01 -0800 From: tip-bot for Ard Biesheuvel Message-ID: Cc: ard.biesheuvel@linaro.org, tglx@linutronix.de, mingo@kernel.org, peterz@infradead.org, hpa@zytor.com, matt@codeblueprint.co.uk, torvalds@linux-foundation.org, linux-kernel@vger.kernel.org Reply-To: matt@codeblueprint.co.uk, torvalds@linux-foundation.org, linux-kernel@vger.kernel.org, mingo@kernel.org, ard.biesheuvel@linaro.org, tglx@linutronix.de, peterz@infradead.org, hpa@zytor.com In-Reply-To: <1488395076-29712-2-git-send-email-ard.biesheuvel@linaro.org> References: <1488395076-29712-2-git-send-email-ard.biesheuvel@linaro.org> To: linux-tip-commits@vger.kernel.org Subject: [tip:efi/urgent] efi/libstub: Treat missing SecureBoot variable as Secure Boot disabled Git-Commit-ID: 52e51f16407b7b34e26affb500a21e250d9fce0b X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit-ID: 52e51f16407b7b34e26affb500a21e250d9fce0b Gitweb: http://git.kernel.org/tip/52e51f16407b7b34e26affb500a21e250d9fce0b Author: Ard Biesheuvel AuthorDate: Wed, 1 Mar 2017 19:04:35 +0000 Committer: Ingo Molnar CommitDate: Thu, 2 Mar 2017 08:11:18 +0100 efi/libstub: Treat missing SecureBoot variable as Secure Boot disabled The newly refactored code that infers the firmware's Secure Boot state prints the following error when the EFI variable 'SecureBoot' does not exist: EFI stub: ERROR: Could not determine UEFI Secure Boot status. However, this variable is only guaranteed to be defined on a system that is Secure Boot capable to begin with, and so it is not an error if it is missing. So report Secure Boot as being disabled in this case, without printing any error messages. Signed-off-by: Ard Biesheuvel Cc: Linus Torvalds Cc: Matt Fleming Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: linux-efi@vger.kernel.org Link: http://lkml.kernel.org/r/1488395076-29712-2-git-send-email-ard.biesheuvel@linaro.org Signed-off-by: Ingo Molnar --- drivers/firmware/efi/libstub/secureboot.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/firmware/efi/libstub/secureboot.c b/drivers/firmware/efi/libstub/secureboot.c index 6def402..5da36e5 100644 --- a/drivers/firmware/efi/libstub/secureboot.c +++ b/drivers/firmware/efi/libstub/secureboot.c @@ -45,6 +45,8 @@ enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg) size = sizeof(secboot); status = get_efi_var(efi_SecureBoot_name, &efi_variable_guid, NULL, &size, &secboot); + if (status == EFI_NOT_FOUND) + return efi_secureboot_mode_disabled; if (status != EFI_SUCCESS) goto out_efi_err; @@ -78,7 +80,5 @@ secure_boot_enabled: out_efi_err: pr_efi_err(sys_table_arg, "Could not determine UEFI Secure Boot status.\n"); - if (status == EFI_NOT_FOUND) - return efi_secureboot_mode_disabled; return efi_secureboot_mode_unknown; }