On Tue, 3 Nov 2020 at 19:49, Mimi Zohar [off-list ref] wrote:

On Mon, 2020-11-02 at 23:37 +0100, Ard Biesheuvel wrote:

quoted

From: Chester Lin <redacted>

Generalize the efi_get_secureboot() function so not only efistub but also
other subsystems can use it.

Note that the MokSbState handling is not factored out: the variable is
boot time only, and so it cannot be parameterized as easily. Also, the
IMA code will switch to this version in a future patch, and it does not
incorporate the MokSbState exception in the first place.

Note that the new efi_get_secureboot_mode() helper treats any failures
to read SetupMode as setup mode being disabled.

Co-developed-by: Chester Lin <redacted>
Signed-off-by: Chester Lin <redacted>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>

Thanks, Ard.  Other than one minor thing inline below, the patch looks
good.  I haven't done any testing yet.

quoted

diff --git a/include/linux/efi.h b/include/linux/efi.h
index bd9d83a94173..79b2d4de62e0 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h

@@ -1082,7 +1082,28 @@ enum efi_secureboot_mode {
      efi_secureboot_mode_disabled,
      efi_secureboot_mode_enabled,
 };
-enum efi_secureboot_mode efi_get_secureboot(void);
+
+static inline
+enum efi_secureboot_mode efi_get_secureboot_mode(efi_get_variable_t *get_var)

get_var() should be defined as "efi_status_t".   If this is being
upstreamed via integrity, I can make the change.

No, get_var is a pointer to a function returning efi_status_t, check
include/linux/efi.h for details.