Commit 1a8916ee authored by Nayna Jain's avatar Nayna Jain Committed by Michael Ellerman
Browse files

powerpc: Detect the secure boot mode of the system 



This patch defines a function to detect the secure boot state of a
PowerNV system.

The PPC_SECURE_BOOT config represents the base enablement of secure
boot for powerpc.

Signed-off-by: default avatarNayna Jain <nayna@linux.ibm.com>
Signed-off-by: default avatarEric Richter <erichte@linux.ibm.com>
[mpe: Fold in change from Nayna to add "ibm,secureboot" to ids]
Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/46b003b9-3225-6bf7-9101-ed6580bb748c@linux.ibm.com
parent da0c9ea1

arch/powerpc/Kconfig

+10 −0
Original line number Diff line number Diff line
@@ -934,6 +934,16 @@ config PPC_MEM_KEYS 


	  If unsure, say y.



config PPC_SECURE_BOOT

	prompt "Enable secure boot support"

	bool

	depends on PPC_POWERNV

	help

	  Systems with firmware secure boot enabled need to define security

	  policies to extend secure boot to the OS. This config allows a user

	  to enable OS secure boot on systems that have firmware support for

	  it. If in doubt say N.



endmenu



config ISA_DMA_API

arch/powerpc/include/asm/secure_boot.h

0 → 100644
+23 −0
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: GPL-2.0 */

/*

 * Secure boot definitions

 *

 * Copyright (C) 2019 IBM Corporation

 * Author: Nayna Jain

 */

#ifndef _ASM_POWER_SECURE_BOOT_H

#define _ASM_POWER_SECURE_BOOT_H



#ifdef CONFIG_PPC_SECURE_BOOT



bool is_ppc_secureboot_enabled(void);



#else



static inline bool is_ppc_secureboot_enabled(void)

{

	return false;

}



#endif

#endif

arch/powerpc/kernel/Makefile

+2 −0
Original line number Diff line number Diff line
@@ -161,6 +161,8 @@ ifneq ($(CONFIG_PPC_POWERNV)$(CONFIG_PPC_SVM),) 
obj-y				+= ucall.o

endif



obj-$(CONFIG_PPC_SECURE_BOOT)	+= secure_boot.o



# Disable GCOV, KCOV & sanitizers in odd or sensitive code

GCOV_PROFILE_prom_init.o := n

KCOV_INSTRUMENT_prom_init.o := n

arch/powerpc/kernel/secure_boot.c

0 → 100644
+35 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0

/*

 * Copyright (C) 2019 IBM Corporation

 * Author: Nayna Jain

 */

#include <linux/types.h>

#include <linux/of.h>

#include <asm/secure_boot.h>



static struct device_node *get_ppc_fw_sb_node(void)

{

	static const struct of_device_id ids[] = {

		{ .compatible = "ibm,secureboot", },

		{ .compatible = "ibm,secureboot-v1", },

		{ .compatible = "ibm,secureboot-v2", },

		{},

	};



	return of_find_matching_node(NULL, ids);

}



bool is_ppc_secureboot_enabled(void)

{

	struct device_node *node;

	bool enabled = false;



	node = get_ppc_fw_sb_node();

	enabled = of_property_read_bool(node, "os-secureboot-enforcing");



	of_node_put(node);



	pr_info("Secure boot mode %s\n", enabled ? "enabled" : "disabled");



	return enabled;

}