On 25 November 2016 at 13:00, David Howells <dhowells@xxxxxxxxxx> wrote: > Okay, how about the attached? > > Can these variables every be anything other than 1 or 0? E.g. should the > check on SetupMode be that it isn't 0 rather than it is 1? > The firmware will ensure that these variables only ever assume the documented values. > David > --- > commit 6d4bb08e376045e27706c2740c0fdff0a6ec43f7 > Author: David Howells <dhowells@xxxxxxxxxx> > Date: Fri Nov 25 11:52:05 2016 +0000 > > efi: Handle secure boot from UEFI-2.6 > > UEFI-2.6 adds a new variable, DeployedMode. If it exists, this must be 1 > if we're to engage lockdown mode. > > Reported-by: James Bottomley <James.Bottomley@xxxxxxxxxxxxxxxxxxxxx> > Signed-off-by: David Howells <dhowells@xxxxxxxxxx> > > diff --git a/drivers/firmware/efi/libstub/secureboot.c b/drivers/firmware/efi/libstub/secureboot.c > index ca643eba5a4b..157782d1c552 100644 > --- a/drivers/firmware/efi/libstub/secureboot.c > +++ b/drivers/firmware/efi/libstub/secureboot.c > @@ -22,6 +22,9 @@ static const efi_char16_t const efi_SecureBoot_name[] = { > static const efi_char16_t const efi_SetupMode_name[] = { > 'S', 'e', 't', 'u', 'p', 'M', 'o', 'd', 'e', 0 > }; > +static const efi_char16_t const efi_DeployedMode_name[] = { > + 'D', 'e', 'p', 'l', 'o', 'y', 'e', 'd', 'M', 'o', 'd', 'e', 0 > +}; > > /* SHIM variables */ > static const efi_guid_t shim_guid = EFI_SHIM_LOCK_GUID; > @@ -62,6 +65,17 @@ int efi_get_secureboot(efi_system_table_t *sys_table_arg) > if (val == 1) > return 0; > > + /* UEFI-2.6 requires DeployedMode to be 1. */ > + if (sys_table_arg->hdr.revision == EFI_2_60_SYSTEM_TABLE_REVISION) { >= > + status = get_efi_var(efi_DeployedMode_name, &efi_variable_guid, > + NULL, &size, &val); > + if (status != EFI_SUCCESS) > + goto out_efi_err; > + > + if (val != 1) > + return 0; val == 0 is better imo, since that will prevent unexpected values from being interpreted as 'secure boot disabled' > + } > + > /* See if a user has put shim into insecure mode. If so, and if the > * variable doesn't have the runtime attribute set, we might as well > * honor that. > diff --git a/include/linux/efi.h b/include/linux/efi.h > index 333d31bf55bf..563abb37f03f 100644 > --- a/include/linux/efi.h > +++ b/include/linux/efi.h > @@ -645,6 +645,10 @@ typedef struct { > > #define EFI_SYSTEM_TABLE_SIGNATURE ((u64)0x5453595320494249ULL) > > +#define EFI_2_60_SYSTEM_TABLE_REVISION ((2 << 16) | (60)) > +#define EFI_2_50_SYSTEM_TABLE_REVISION ((2 << 16) | (50)) > +#define EFI_2_40_SYSTEM_TABLE_REVISION ((2 << 16) | (40)) > +#define EFI_2_31_SYSTEM_TABLE_REVISION ((2 << 16) | (31)) > #define EFI_2_30_SYSTEM_TABLE_REVISION ((2 << 16) | (30)) > #define EFI_2_20_SYSTEM_TABLE_REVISION ((2 << 16) | (20)) > #define EFI_2_10_SYSTEM_TABLE_REVISION ((2 << 16) | (10)) -- To unsubscribe from this list: send the line "unsubscribe linux-efi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html