Djam/u-boot
1
0
Fork 0
mirror of https://github.com/u-boot/u-boot.git synced 2025-05-08 19:11:53 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

efi_loader: variable: fix secure state initialization

Browse source 
Under the new file-based variable implementation, the secure state
is always and falsely set to 0 (hence, the secure boot gets disabled)
after the reboot even if PK (and other signature database) has already
been enrolled in the previous boot.

This is because the secure state is set up *before* loading non-volatile
variables' values from saved data.

This patch fixes the order of variable initialization and secure state
initialization.

Signed-off-by: AKASHI Takahiro <takahiro.akashi@linaro.org>
Fixes: 5f7dcf079d ("efi_loader: UEFI variable persistence")
This commit is contained in:
AKASHI Takahiro 2020-08-13 17:05:29 +09:00 • committed by Heinrich Schuchardt
parent e1174c566a
commit f68a6d5835
1 changed files with 5 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

10
lib/efi_loader/efi_variable.c
View file

@ -508,10 +508,6 @@ efi_status_t efi_init_variables(void)
if (ret != EFI_SUCCESS)
return ret;
ret = efi_init_secure_state();
if (ret != EFI_SUCCESS)
return ret;
if (IS_ENABLED(CONFIG_EFI_VARIABLES_PRESEED)) {
ret = efi_var_restore((struct efi_var_file *)
__efi_var_file_begin);
@ -519,5 +515,9 @@ efi_status_t efi_init_variables(void)
log_err("Invalid EFI variable seed\n");
}
return efi_var_from_file();
ret = efi_var_from_file();
if (ret != EFI_SUCCESS)
return ret;
return efi_init_secure_state();
}