Re: [PATCH 3/3] x86/ima: retry detecting secure boot mode

2019-03-08 Thread Matthew Garrett
On Fri, Mar 8, 2019 at 10:43 AM Mimi Zohar wrote: > FYI, efi_printk() works before exit_boot(), but not afterwards. The > system hangs. efi_printk() uses boot services to print, so that's not unexpected :) It would probably be sensible to return an error rather than crash, though…

Re: [PATCH 3/3] x86/ima: retry detecting secure boot mode

2019-03-08 Thread Mimi Zohar
On Fri, 2019-03-08 at 09:51 -0800, Matthew Garrett wrote: > On Fri, Mar 8, 2019 at 5:40 AM Mimi Zohar wrote: > > > > On Thu, 2019-03-07 at 14:50 -0800, Matthew Garrett wrote: > > > Is the issue that it gives incorrect results on the first read, or is > > > the issue that it gives incorrect results

Re: [PATCH 3/3] x86/ima: retry detecting secure boot mode

2019-03-08 Thread Matthew Garrett
On Fri, Mar 8, 2019 at 5:40 AM Mimi Zohar wrote: > > On Thu, 2019-03-07 at 14:50 -0800, Matthew Garrett wrote: > > Is the issue that it gives incorrect results on the first read, or is > > the issue that it gives incorrect results before ExitBootServices() is > > called? If the former then we shou

Re: [PATCH 3/3] x86/ima: retry detecting secure boot mode

2019-03-08 Thread Mimi Zohar
On Thu, 2019-03-07 at 14:50 -0800, Matthew Garrett wrote: > On Thu, Mar 7, 2019 at 2:48 PM Mimi Zohar wrote: > > I added this last attempt because I'm seeing this on my laptop, with > > some older, buggy firmware. > > Is the issue that it gives incorrect results on the first read, or is > the iss

Re: [PATCH 3/3] x86/ima: retry detecting secure boot mode

2019-03-07 Thread Matthew Garrett
On Thu, Mar 7, 2019 at 2:48 PM Mimi Zohar wrote: > I added this last attempt because I'm seeing this on my laptop, with > some older, buggy firmware. Is the issue that it gives incorrect results on the first read, or is the issue that it gives incorrect results before ExitBootServices() is called

Re: [PATCH 3/3] x86/ima: retry detecting secure boot mode

2019-03-07 Thread Mimi Zohar
On Thu, 2019-03-07 at 14:44 -0800, Matthew Garrett wrote: > On Thu, Mar 7, 2019 at 2:38 PM Justin Forbes wrote: > > On Thu, Mar 7, 2019 at 4:29 PM Matthew Garrett wrote: > >> > >> On Mon, Nov 19, 2018 at 11:57 AM Mimi Zohar wrote: > >> > > >> > The secure boot mode may not be detected on boot fo

Re: [PATCH 3/3] x86/ima: retry detecting secure boot mode

2019-03-07 Thread Matthew Garrett
On Thu, Mar 7, 2019 at 2:38 PM Justin Forbes wrote: > On Thu, Mar 7, 2019 at 4:29 PM Matthew Garrett wrote: >> >> On Mon, Nov 19, 2018 at 11:57 AM Mimi Zohar wrote: >> > >> > The secure boot mode may not be detected on boot for some reason (eg. >> > buggy firmware). This patch attempts one more

Re: [PATCH 3/3] x86/ima: retry detecting secure boot mode

2019-03-07 Thread Matthew Garrett
On Mon, Nov 19, 2018 at 11:57 AM Mimi Zohar wrote: > > The secure boot mode may not be detected on boot for some reason (eg. > buggy firmware). This patch attempts one more time to detect the > secure boot mode. Do we have cases where this has actually been seen? I'm not sure what the circumstan