Messages in this thread Patch in this message | | | From | Michael Ellerman <> | Subject | Re: [PATCH v7 3/8] powerpc: detect the trusted boot state of the system | Date | Tue, 15 Oct 2019 21:23:19 +1100 |
| |
Nayna Jain <nayna@linux.ibm.com> writes: > PowerNV systems enables the IMA measurement rules only if the > trusted boot is enabled on the system.
That confused me a lot. But the key is the distinction between appraisal rules vs measurement rules, right?
I think it would be clearer if it was phrased as a positive statement, eg:
On PowerNV systems when trusted boot is enabled, additional IMA rules are enabled to implement measurement.
Or something like that.
> This patch adds the function to detect if the system has trusted > boot enabled.
It would probably help people to briefly explain the difference between secure vs trusted boot.
> diff --git a/arch/powerpc/include/asm/secure_boot.h b/arch/powerpc/include/asm/secure_boot.h > index 23d2ef2f1f7b..ecd08515e301 100644 > --- a/arch/powerpc/include/asm/secure_boot.h > +++ b/arch/powerpc/include/asm/secure_boot.h > @@ -12,6 +12,7 @@ > > bool is_powerpc_os_secureboot_enabled(void); > struct device_node *get_powerpc_os_sb_node(void); > +bool is_powerpc_trustedboot_enabled(void); > > #else > > @@ -25,5 +26,10 @@ static inline struct device_node *get_powerpc_os_sb_node(void) > return NULL; > } > > +static inline bool is_powerpc_os_trustedboot_enabled(void)
That has an extra "_os" in it.
> +{ > + return false; > +} > + > #endif > #endif > diff --git a/arch/powerpc/kernel/secure_boot.c b/arch/powerpc/kernel/secure_boot.c > index 0488dbcab6b9..9d5ac1b39e46 100644 > --- a/arch/powerpc/kernel/secure_boot.c > +++ b/arch/powerpc/kernel/secure_boot.c > @@ -7,6 +7,27 @@ > #include <linux/of.h> > #include <asm/secure_boot.h> > > +static const char * const fwsecureboot_compat[] = { > + "ibm,secureboot-v1", > + "ibm,secureboot-v2", > + NULL, > +}; > + > +static struct device_node *get_powerpc_fw_sb_node(void) > +{ > + struct device_node *node; > + int i; > + > + for (i = 0; i < ARRAY_SIZE(fwsecureboot_compat); ++i) { > + node = of_find_compatible_node(NULL, NULL, > + fwsecureboot_compat[i]); > + if (node) > + return node; > + } > + > + return NULL; > +}
You shouldn't need to do that by hand, instead use of_find_matching_node(), eg:
static struct device_node *get_powerpc_fw_sb_node(void) { static const struct of_device_id ids[] = { { .compatible = "ibm,secureboot-v1", }, { .compatible = "ibm,secureboot-v2", }, {}, };
return of_find_matching_node(NULL, ids); }
> @@ -40,3 +61,17 @@ bool is_powerpc_os_secureboot_enabled(void) > pr_info("secureboot mode disabled\n"); > return false; > } > + > +bool is_powerpc_trustedboot_enabled(void) > +{ > + struct device_node *node; > + > + node = get_powerpc_fw_sb_node(); > + if (node && (of_find_property(node, "trusted-enabled", NULL))) {
Again this can use of_property_read_bool(), which copes with a NULL node also, so just:
+ if (of_property_read_bool(node, "trusted-enabled"))) {
> + pr_info("trustedboot mode enabled\n"); > + return true; > + } > + > + pr_info("trustedboot mode disabled\n"); > + return false; > +} > -- > 2.20.1
cheers
| |