From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751179AbdBCQHK (ORCPT ); Fri, 3 Feb 2017 11:07:10 -0500 Received: from mail-io0-f173.google.com ([209.85.223.173]:34848 "EHLO mail-io0-f173.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750953AbdBCQHH (ORCPT ); Fri, 3 Feb 2017 11:07:07 -0500 MIME-Version: 1.0 In-Reply-To: <148587565838.4026.2835771993519594392.stgit@warthog.procyon.org.uk> References: <148587558696.4026.16034622623568539004.stgit@warthog.procyon.org.uk> <148587565838.4026.2835771993519594392.stgit@warthog.procyon.org.uk> From: Ard Biesheuvel Date: Fri, 3 Feb 2017 16:07:06 +0000 Message-ID: Subject: Re: [PATCH 7/7] efi: Print the secure boot status in x86 setup_arch() [ver #7] To: David Howells Cc: Matt Fleming , "linux-efi@vger.kernel.org" , "linux-kernel@vger.kernel.org" , linux-security-module , keyrings@vger.kernel.org, "linux-arm-kernel@lists.infradead.org" Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 31 January 2017 at 15:14, David Howells wrote: > Print the secure boot status in the x86 setup_arch() but otherwise do > nothing more for now. More functionality will be added later, but this at > least allows for testing. > > Signed-off-by: David Howells > --- > > arch/x86/kernel/setup.c | 14 ++++++++++++++ > 1 file changed, 14 insertions(+) > > diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c > index 4cfba947d774..22e4b47a5c14 100644 > --- a/arch/x86/kernel/setup.c > +++ b/arch/x86/kernel/setup.c > @@ -1176,6 +1176,20 @@ void __init setup_arch(char **cmdline_p) > /* Allocate bigger log buffer */ > setup_log_buf(1); > > + if (IS_ENABLED(CONFIG_EFI)) { Shouldn't this be a runtime check? > + switch (boot_params.secure_boot) { > + case efi_secureboot_mode_disabled: > + pr_info("Secure boot disabled\n"); > + break; > + case efi_secureboot_mode_enabled: > + pr_info("Secure boot enabled\n"); > + break; > + default: > + pr_info("Secure boot could not be determined\n"); > + break; > + } > + } > + > reserve_initrd(); > > acpi_table_upgrade(); >