mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-01 06:33:07 +00:00
Code Issues Releases Wiki Activity

powerpc: Detect the trusted boot state of the system

Browse source 
While secure boot permits only properly verified signed kernels to be
booted, trusted boot calculates the file hash of the kernel image and
stores the measurement prior to boot, that can be subsequently
compared against good known values via attestation services.

This patch reads the trusted boot state of a PowerNV system. The state
is used to conditionally enable additional measurement rules in the
IMA arch-specific policies.

Signed-off-by: Nayna Jain <nayna@linux.ibm.com>
Signed-off-by: Eric Richter <erichte@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/e9eeee6b-b9bf-1e41-2954-61dbd6fbfbcf@linux.ibm.com
This commit is contained in:
Nayna Jain 2019-11-05 17:02:07 -06:00 committed by Michael Ellerman
parent 4238fad366
commit 2702809a4a
2 changed files with 21 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
arch/powerpc/include/asm/secure_boot.h
View file

@ -11,6 +11,7 @@
#ifdef CONFIG_PPC_SECURE_BOOT
bool is_ppc_secureboot_enabled(void);
bool is_ppc_trustedboot_enabled(void);
#else
@ -19,5 +20,10 @@ static inline bool is_ppc_secureboot_enabled(void)
return false;
}
static inline bool is_ppc_trustedboot_enabled(void)
{
return false;
}
#endif
#endif

15
arch/powerpc/kernel/secure_boot.c
View file

@ -33,3 +33,18 @@ bool is_ppc_secureboot_enabled(void)
return enabled;
}
bool is_ppc_trustedboot_enabled(void)
{
struct device_node *node;
bool enabled = false;
node = get_ppc_fw_sb_node();
enabled = of_property_read_bool(node, "trusted-enabled");
of_node_put(node);
pr_info("Trusted boot mode %s\n", enabled ? "enabled" : "disabled");
return enabled;
}