Received: by 2002:a5b:505:0:0:0:0:0 with SMTP id o5csp5017851ybp; Mon, 7 Oct 2019 18:15:30 -0700 (PDT) X-Google-Smtp-Source: APXvYqxLaKqG1BNI0RyggND6g5qtNuEP3v+Q0FOBvpI7wAjia/5UaFtzXerouflkOUP5IY7ayKSm X-Received: by 2002:aa7:dc57:: with SMTP id g23mr32159527edu.38.1570497330181; Mon, 07 Oct 2019 18:15:30 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1570497330; cv=none; d=google.com; s=arc-20160816; b=XzfkpbpbgDRC8EYyUPnwkSR21ZpDZUyPlJJmRZDzUHC4+GRVHrYLpqlinpgDMeWMA+ GonZ5UQqfyXo+K/PeLYBnha5JL0ee4WjEBA2dslBOL+aGN73AA/9TerIqujY3kNTbacd 8jnFyehnNeX+qk9ZJwQPJH8oWAkhqo0sS42aV4IDEHwFH5WQDWViuqKkTpbwzCsZTRhD dddSqfgdhWW9yUiFoUQE6j/SXMKj/IIgT1fdO+pKtGGp+weeqD1ZvwXmi8p7+8wL1Y1K Hf+W91Yn3n/XT1NRj/zCTZv2CZ34yM87AQEhplrq4OeQpa7OtREX1RoNlGwvo77srykU GoSA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:message-id:references:in-reply-to:date :subject:cc:to:from; bh=bZEs197TpxVZh8T/BJL4lJL5+7GOmqkbYQFc3ai8z1k=; b=TFE5yLOg2KViLgPTr9xy+HXsetbXSHgFClLZ6Be4n9KZsgHx5LQUBS0UdI8XZVGaCd P1ePEO9Qm1EWpPn7gzhDdli5TfaSeAY2loT/bahu6bRRHN0rVQ5rKoXgkKPfMrEOtdOU Hmk3ieQyYo4XJNtNMhlmIpsKSJb81feQrlSs5OozgNpFZIW0U1DHEb1wQz/+i57yCglC 0LCorv/Xq+RVKHjT0Ktmencn/qoElbBKuzb6jMlJ888J8zzBhOsSzBuIzyNmPCvDV42P v752EwszkMtsrbI0hMw+6oRwLndwzfBGyoZJmcO3RFMMBxeqWrKbVwmo/zlebLdIv69Q igEg== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=ibm.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id d10si7916675ejb.259.2019.10.07.18.15.07; Mon, 07 Oct 2019 18:15:30 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=ibm.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729554AbfJHBO4 (ORCPT + 99 others); Mon, 7 Oct 2019 21:14:56 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:28748 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1729527AbfJHBOz (ORCPT ); Mon, 7 Oct 2019 21:14:55 -0400 Received: from pps.filterd (m0098417.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.27/8.16.0.27) with SMTP id x981C2lD104932 for ; Mon, 7 Oct 2019 21:14:55 -0400 Received: from e06smtp02.uk.ibm.com (e06smtp02.uk.ibm.com [195.75.94.98]) by mx0a-001b2d01.pphosted.com with ESMTP id 2vgd2c6247-1 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 07 Oct 2019 21:14:54 -0400 Received: from localhost by e06smtp02.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 8 Oct 2019 02:14:53 +0100 Received: from b06cxnps4076.portsmouth.uk.ibm.com (9.149.109.198) by e06smtp02.uk.ibm.com (192.168.101.132) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; (version=TLSv1/SSLv3 cipher=AES256-GCM-SHA384 bits=256/256) Tue, 8 Oct 2019 02:14:48 +0100 Received: from d06av25.portsmouth.uk.ibm.com (d06av25.portsmouth.uk.ibm.com [9.149.105.61]) by b06cxnps4076.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id x981Eljf51642598 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 8 Oct 2019 01:14:47 GMT Received: from d06av25.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0239C11C052; Tue, 8 Oct 2019 01:14:47 +0000 (GMT) Received: from d06av25.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 6BD5811C058; Tue, 8 Oct 2019 01:14:44 +0000 (GMT) Received: from swastik.ibm.com (unknown [9.80.231.8]) by d06av25.portsmouth.uk.ibm.com (Postfix) with ESMTP; Tue, 8 Oct 2019 01:14:44 +0000 (GMT) From: Nayna Jain To: linuxppc-dev@ozlabs.org, linux-efi@vger.kernel.org, linux-integrity@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Michael Ellerman , Benjamin Herrenschmidt , Paul Mackerras , Ard Biesheuvel , Jeremy Kerr , Matthew Garret , Mimi Zohar , Greg Kroah-Hartman , Claudio Carvalho , George Wilson , Elaine Palmer , Eric Ricther , "Oliver O'Halloran" , Nayna Jain Subject: [PATCH v7 1/8] powerpc: detect the secure boot mode of the system Date: Mon, 7 Oct 2019 21:14:20 -0400 X-Mailer: git-send-email 1.8.3.1 In-Reply-To: <1570497267-13672-1-git-send-email-nayna@linux.ibm.com> References: <1570497267-13672-1-git-send-email-nayna@linux.ibm.com> X-TM-AS-GCONF: 00 x-cbid: 19100801-0008-0000-0000-0000031EF972 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 19100801-0009-0000-0000-00004A3E0C48 Message-Id: <1570497267-13672-2-git-send-email-nayna@linux.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:,, definitions=2019-10-07_05:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1015 lowpriorityscore=0 mlxscore=0 impostorscore=0 mlxlogscore=999 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1908290000 definitions=main-1910080011 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Secure boot on PowerNV defines different IMA policies based on the secure boot state of the system. This patch defines a function to detect the secure boot state of the system. The PPC_SECURE_BOOT config represents the base enablement of secureboot on POWER. Signed-off-by: Nayna Jain --- arch/powerpc/Kconfig | 10 ++++++ arch/powerpc/include/asm/secure_boot.h | 29 ++++++++++++++++++ arch/powerpc/kernel/Makefile | 2 ++ arch/powerpc/kernel/secure_boot.c | 42 ++++++++++++++++++++++++++ 4 files changed, 83 insertions(+) create mode 100644 arch/powerpc/include/asm/secure_boot.h create mode 100644 arch/powerpc/kernel/secure_boot.c diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig index 3e56c9c2f16e..b4a221886fcf 100644 --- a/arch/powerpc/Kconfig +++ b/arch/powerpc/Kconfig @@ -934,6 +934,16 @@ config PPC_MEM_KEYS If unsure, say y. +config PPC_SECURE_BOOT + prompt "Enable secure boot support" + bool + depends on PPC_POWERNV + help + Systems with firmware secure boot enabled needs to define security + policies to extend secure boot to the OS. This config allows user + to enable OS secure boot on systems that have firmware support for + it. If in doubt say N. + endmenu config ISA_DMA_API diff --git a/arch/powerpc/include/asm/secure_boot.h b/arch/powerpc/include/asm/secure_boot.h new file mode 100644 index 000000000000..23d2ef2f1f7b --- /dev/null +++ b/arch/powerpc/include/asm/secure_boot.h @@ -0,0 +1,29 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Secure boot definitions + * + * Copyright (C) 2019 IBM Corporation + * Author: Nayna Jain + */ +#ifndef _ASM_POWER_SECURE_BOOT_H +#define _ASM_POWER_SECURE_BOOT_H + +#ifdef CONFIG_PPC_SECURE_BOOT + +bool is_powerpc_os_secureboot_enabled(void); +struct device_node *get_powerpc_os_sb_node(void); + +#else + +static inline bool is_powerpc_os_secureboot_enabled(void) +{ + return false; +} + +static inline struct device_node *get_powerpc_os_sb_node(void) +{ + return NULL; +} + +#endif +#endif diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile index a7ca8fe62368..e2a54fa240ac 100644 --- a/arch/powerpc/kernel/Makefile +++ b/arch/powerpc/kernel/Makefile @@ -161,6 +161,8 @@ ifneq ($(CONFIG_PPC_POWERNV)$(CONFIG_PPC_SVM),) obj-y += ucall.o endif +obj-$(CONFIG_PPC_SECURE_BOOT) += secure_boot.o + # Disable GCOV, KCOV & sanitizers in odd or sensitive code GCOV_PROFILE_prom_init.o := n KCOV_INSTRUMENT_prom_init.o := n diff --git a/arch/powerpc/kernel/secure_boot.c b/arch/powerpc/kernel/secure_boot.c new file mode 100644 index 000000000000..0488dbcab6b9 --- /dev/null +++ b/arch/powerpc/kernel/secure_boot.c @@ -0,0 +1,42 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (C) 2019 IBM Corporation + * Author: Nayna Jain + */ +#include +#include +#include + +struct device_node *get_powerpc_os_sb_node(void) +{ + return of_find_compatible_node(NULL, NULL, "ibm,secvar-v1"); +} + +bool is_powerpc_os_secureboot_enabled(void) +{ + struct device_node *node; + + node = get_powerpc_os_sb_node(); + if (!node) + goto disabled; + + if (!of_device_is_available(node)) { + pr_err("Secure variables support is in error state, fail secure\n"); + goto enabled; + } + + /* + * secureboot is enabled if os-secure-enforcing property exists, + * else disabled. + */ + if (!of_find_property(node, "os-secure-enforcing", NULL)) + goto disabled; + +enabled: + pr_info("secureboot mode enabled\n"); + return true; + +disabled: + pr_info("secureboot mode disabled\n"); + return false; +} -- 2.20.1