On Thu, Dec 08, 2016 at 08:16:21AM +0000, David Howells wrote:
> +/*
> + * Determine whether we're in secure boot mode.
> + */
> +enum efi_secureboot_mode efi_get_secureboot(efi_system_table_t
> *sys_table_arg)
> +{
> + u8 secboot, setupmode;
> + unsigned long size;
> + efi_status_t status;
> +
> + size = sizeof(secboot);
> + status = get_efi_var(efi_SecureBoot_name, &efi_variable_guid,
> + NULL, &size, &secboot);
> + if (status != EFI_SUCCESS)
> + goto out_efi_err;
> +
> + size = sizeof(setupmode);
> + status = get_efi_var(efi_SetupMode_name, &efi_variable_guid,
> + NULL, &size, &setupmode);
> + if (status != EFI_SUCCESS)
> + goto out_efi_err;
> +
> + if (secboot == 0 || setupmode == 1)
> + return efi_secureboot_mode_disabled;
> +
> + pr_efi(sys_table_arg, "UEFI Secure Boot is enabled.\n");
> + return efi_secureboot_mode_enabled;
> +
> +out_efi_err:
> + pr_efi_err(sys_table_arg, "Could not determine UEFI Secure Boot
> status.\n");
> + if (status == EFI_NOT_FOUND)
> + return efi_secureboot_mode_disabled;
> + return efi_secureboot_mode_unknown;
> +}
In the out_efi_err path, the if-statement needs to come before the
pr_efi_err() call. Otherwise it would be a change of behaviour for
ARM to what we have now.
Also, minor nit, I'd expect Matt to ask for a newline between the
if-statement and the following statements, so:
out_efi_err:
if (status == EFI_NOT_FOUND)
return efi_secureboot_mode_disabled;
pr_efi_err(sys_table_arg, "Could not determine UEFI Secure Boot
status.\n");
return efi_secureboot_mode_unknown;
The error message doesn't say what the consequence is of the
failure to determine the status, but IIUC this differs between
x86 and ARM, is that correct? (If I remember the discussion
correctly, x86 defaults to disabled, ARM to enabled.)
Thanks,
Lukas
