powerpc: Detect the secure boot mode of the system (1a8916ee) · Commits · 戴 / test

arch/powerpc/Kconfig

+10 −0

Original line number	Diff line number	Diff line
		@@ -934,6 +934,16 @@ config PPC_MEM_KEYS

		If unsure, say y.

		config PPC_SECURE_BOOT
		prompt "Enable secure boot support"
		bool
		depends on PPC_POWERNV
		help
		Systems with firmware secure boot enabled need to define security
		policies to extend secure boot to the OS. This config allows a user
		to enable OS secure boot on systems that have firmware support for
		it. If in doubt say N.

		endmenu

		config ISA_DMA_API

0 → 100644

+23 −0

Original line number	Diff line number	Diff line
		/* SPDX-License-Identifier: GPL-2.0 */
		/*
		* Secure boot definitions
		*
		* Copyright (C) 2019 IBM Corporation
		* Author: Nayna Jain
		*/
		#ifndef _ASM_POWER_SECURE_BOOT_H
		#define _ASM_POWER_SECURE_BOOT_H

		#ifdef CONFIG_PPC_SECURE_BOOT

		bool is_ppc_secureboot_enabled(void);

		#else

		static inline bool is_ppc_secureboot_enabled(void)
		{
		return false;
		}

		#endif
		#endif

+2 −0

Original line number	Diff line number	Diff line
		@@ -161,6 +161,8 @@ ifneq ($(CONFIG_PPC_POWERNV)$(CONFIG_PPC_SVM),)
		obj-y += ucall.o
		endif

		obj-$(CONFIG_PPC_SECURE_BOOT) += secure_boot.o

		# Disable GCOV, KCOV & sanitizers in odd or sensitive code
		GCOV_PROFILE_prom_init.o := n
		KCOV_INSTRUMENT_prom_init.o := n

0 → 100644

+35 −0

Original line number	Diff line number	Diff line
		// SPDX-License-Identifier: GPL-2.0
		/*
		* Copyright (C) 2019 IBM Corporation
		* Author: Nayna Jain
		*/
		#include <linux/types.h>
		#include <linux/of.h>
		#include <asm/secure_boot.h>

		static struct device_node *get_ppc_fw_sb_node(void)
		{
		static const struct of_device_id ids[] = {
		{ .compatible = "ibm,secureboot", },
		{ .compatible = "ibm,secureboot-v1", },
		{ .compatible = "ibm,secureboot-v2", },
		{},
		};

		return of_find_matching_node(NULL, ids);
		}

		bool is_ppc_secureboot_enabled(void)
		{
		struct device_node *node;
		bool enabled = false;

		node = get_ppc_fw_sb_node();
		enabled = of_property_read_bool(node, "os-secureboot-enforcing");

		of_node_put(node);

		pr_info("Secure boot mode %s\n", enabled ? "enabled" : "disabled");

		return enabled;
		}