diff options
| author | Gary Lin <glin@suse.com> | 2021-05-11 10:41:43 +0800 |
|---|---|---|
| committer | Steve McIntyre <48764113+steve-mcintyre@users.noreply.github.com> | 2021-06-23 23:09:33 +0100 |
| commit | 9f973e4e95b1136b8c98051dbbdb1773072cc998 (patch) | |
| tree | d00bb84359660a7dd2a072fe2132e8afb62d08d6 | |
| parent | 05875f3aed1c90fe071c66de05744ca2bcbc2b9e (diff) | |
| download | efi-boot-shim-9f973e4e95b1136b8c98051dbbdb1773072cc998.tar.gz efi-boot-shim-9f973e4e95b1136b8c98051dbbdb1773072cc998.zip | |
Relax the check for import_mok_state()
An openSUSE user reported(*) that shim 15.4 failed to boot the system
with the following message:
"Could not create MokListXRT: Out of Resources"
In the beginning, I thought it's caused by the growing size of
vendor-dbx. However, we found the following messages after set
SHIM_VERBOSE:
max_var_sz:8000 remaining_sz:85EC max_storage_sz:9000
SetVariable(“MokListXRT”, ... varsz=0x1404) = Out of Resources
Even though the firmware claimed the remaining storage size is 0x85EC
and the maximum variable size is 0x8000, it still rejected MokListXRT
with size 0x1404. It seems that the return values from QueryVariableInfo()
are not reliable. Since this firmware didn't really support Secure Boot,
the variable mirroring is not so critical, so we can just accept the
failure of import_mok_state() and continue boot.
(*) https://bugzilla.suse.com/show_bug.cgi?id=1185261
Signed-off-by: Gary Lin <glin@suse.com>
| -rw-r--r-- | shim.c | 7 |
1 files changed, 5 insertions, 2 deletions
@@ -1973,10 +1973,13 @@ efi_main (EFI_HANDLE passed_image_handle, EFI_SYSTEM_TABLE *passed_systab) * boot-services-only state variables are what we think they are. */ efi_status = import_mok_state(image_handle); - if (!secure_mode() && efi_status == EFI_INVALID_PARAMETER) { + if (!secure_mode() && + (efi_status == EFI_INVALID_PARAMETER || + efi_status == EFI_OUT_OF_RESOURCES)) { /* * Make copy failures fatal only if secure_mode is enabled, or - * the error was anything else than EFI_INVALID_PARAMETER. + * the error was anything else than EFI_INVALID_PARAMETER or + * EFI_OUT_OF_RESOURCES. * There are non-secureboot firmware implementations that don't * reserve enough EFI variable memory to fit the variable. */ |