Commit 52e51f16 authored by Ard Biesheuvel's avatar Ard Biesheuvel Committed by Ingo Molnar

efi/libstub: Treat missing SecureBoot variable as Secure Boot disabled

The newly refactored code that infers the firmware's Secure Boot state
prints the following error when the EFI variable 'SecureBoot' does not
exist:

  EFI stub: ERROR: Could not determine UEFI Secure Boot status.

However, this variable is only guaranteed to be defined on a system that
is Secure Boot capable to begin with, and so it is not an error if it is
missing. So report Secure Boot as being disabled in this case, without
printing any error messages.
Signed-off-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Matt Fleming <matt@codeblueprint.co.uk>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-efi@vger.kernel.org
Link: http://lkml.kernel.org/r/1488395076-29712-2-git-send-email-ard.biesheuvel@linaro.orgSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
parent 4977ab6e
...@@ -45,6 +45,8 @@ enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg) ...@@ -45,6 +45,8 @@ enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg)
size = sizeof(secboot); size = sizeof(secboot);
status = get_efi_var(efi_SecureBoot_name, &efi_variable_guid, status = get_efi_var(efi_SecureBoot_name, &efi_variable_guid,
NULL, &size, &secboot); NULL, &size, &secboot);
if (status == EFI_NOT_FOUND)
return efi_secureboot_mode_disabled;
if (status != EFI_SUCCESS) if (status != EFI_SUCCESS)
goto out_efi_err; goto out_efi_err;
...@@ -78,7 +80,5 @@ enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg) ...@@ -78,7 +80,5 @@ enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t *sys_table_arg)
out_efi_err: out_efi_err:
pr_efi_err(sys_table_arg, "Could not determine UEFI Secure Boot status.\n"); pr_efi_err(sys_table_arg, "Could not determine UEFI Secure Boot status.\n");
if (status == EFI_NOT_FOUND)
return efi_secureboot_mode_disabled;
return efi_secureboot_mode_unknown; return efi_secureboot_mode_unknown;
} }
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment