|
 |
64d7ab |
From 9a2dd0a945720634b9f3608c3b3dfb99fafd4465 Mon Sep 17 00:00:00 2001
|
|
|
64d7ab |
From: Patrick Uiterwijk <patrick@puiterwijk.org>
|
|
|
64d7ab |
Date: Thu, 6 Dec 2018 10:08:45 +0100
|
|
|
64d7ab |
Subject: [PATCH] Make EFI variable copying fatal only on secureboot enabled
|
|
|
64d7ab |
systems
|
|
|
64d7ab |
|
|
|
64d7ab |
I have come across systems that are unwilling to reserve enough memory for
|
|
|
64d7ab |
a MokListRT big enough for big certificates.
|
|
|
64d7ab |
This seems to be the case with firmware implementations that do not support
|
|
|
64d7ab |
secureboot, which is probably the reason they went with much lower variable
|
|
|
64d7ab |
storage.
|
|
|
64d7ab |
|
|
|
64d7ab |
This patch set makes sure we can still boot on those systems, by only
|
|
|
64d7ab |
making the copy action fatal if the system has secure boot enabled, or if
|
|
|
64d7ab |
the error was anything other than EFI_INVALID_PARAMETER.
|
|
|
64d7ab |
|
|
|
64d7ab |
Signed-off-by: Patrick Uiterwijk <patrick@puiterwijk.org>
|
|
|
64d7ab |
---
|
|
|
64d7ab |
shim.c | 14 +++++++++++---
|
|
|
64d7ab |
1 file changed, 11 insertions(+), 3 deletions(-)
|
|
|
64d7ab |
|
|
|
64d7ab |
diff --git a/shim.c b/shim.c
|
|
|
64d7ab |
index fcc11eb3..89ef0036 100644
|
|
|
64d7ab |
--- a/shim.c
|
|
|
64d7ab |
+++ b/shim.c
|
|
|
64d7ab |
@@ -2632,9 +2632,17 @@ efi_main (EFI_HANDLE passed_image_handle, EFI_SYSTEM_TABLE *passed_systab)
|
|
|
64d7ab |
die:
|
|
|
64d7ab |
console_print(L"Something has gone seriously wrong: %s: %r\n",
|
|
|
64d7ab |
msgs[msg], efi_status);
|
|
|
64d7ab |
- msleep(5000000);
|
|
|
64d7ab |
- gRT->ResetSystem(EfiResetShutdown, EFI_SECURITY_VIOLATION,
|
|
|
64d7ab |
- 0, NULL);
|
|
|
64d7ab |
+ /*
|
|
|
64d7ab |
+ * Make copy failures fatal only if secure_mode is enabled, or
|
|
|
64d7ab |
+ * the error was anything else than EFI_INVALID_PARAMETER.
|
|
|
64d7ab |
+ * There are non-secureboot firmware implementations that don't
|
|
|
64d7ab |
+ * reserve enough EFI variable memory to fit the variable.
|
|
|
64d7ab |
+ */
|
|
|
64d7ab |
+ if (secure_mode() || efi_status != EFI_INVALID_PARAMETER) {
|
|
|
64d7ab |
+ msleep(5000000);
|
|
|
64d7ab |
+ gRT->ResetSystem(EfiResetShutdown, EFI_SECURITY_VIOLATION,
|
|
|
64d7ab |
+ 0, NULL);
|
|
|
64d7ab |
+ }
|
|
|
64d7ab |
}
|
|
|
64d7ab |
|
|
|
64d7ab |
efi_status = shim_init();
|
|
|
64d7ab |
|