mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-11-01 08:58:07 +00:00
e9765680a3
This time, the set of changes for the EFI subsystem is much larger than usual. The main reasons are: - Get things cleaned up before EFI support for RISC-V arrives, which will increase the size of the validation matrix, and therefore the threshold to making drastic changes, - After years of defunct maintainership, the GRUB project has finally started to consider changes from the distros regarding UEFI boot, some of which are highly specific to the way x86 does UEFI secure boot and measured boot, based on knowledge of both shim internals and the layout of bootparams and the x86 setup header. Having this maintenance burden on other architectures (which don't need shim in the first place) is hard to justify, so instead, we are introducing a generic Linux/UEFI boot protocol. Summary of changes: - Boot time GDT handling changes (Arvind) - Simplify handling of EFI properties table on arm64 - Generic EFI stub cleanups, to improve command line handling, file I/O, memory allocation, etc. - Introduce a generic initrd loading method based on calling back into the firmware, instead of relying on the x86 EFI handover protocol or device tree. - Introduce a mixed mode boot method that does not rely on the x86 EFI handover protocol either, and could potentially be adopted by other architectures (if another one ever surfaces where one execution mode is a superset of another) - Clean up the contents of struct efi, and move out everything that doesn't need to be stored there. - Incorporate support for UEFI spec v2.8A changes that permit firmware implementations to return EFI_UNSUPPORTED from UEFI runtime services at OS runtime, and expose a mask of which ones are supported or unsupported via a configuration table. - Various documentation updates and minor code cleanups (Heinrich) - Partial fix for the lack of by-VA cache maintenance in the decompressor on 32-bit ARM. Note that these patches were deliberately put at the beginning so they can be used as a stable branch that will be shared with a PR containing the complete fix, which I will send to the ARM tree. -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEnNKg2mrY9zMBdeK7wjcgfpV0+n0FAl5S7WYACgkQwjcgfpV0 +n1jmQgAmwV3V8pbgB4mi4P2Mv8w5Zj5feUe6uXnTR2AFv5nygLcTzdxN+TU/6lc OmZv2zzdsAscYlhuUdI/4t4cXIjHAZI39+UBoNRuMqKbkbvXCFscZANLxvJjHjZv FFbgUk0DXkF0BCEDuSLNavidAv4b3gZsOmHbPfwuB8xdP05LbvbS2mf+2tWVAi2z ULfua/0o9yiwl19jSS6iQEPCvvLBeBzTLW7x5Rcm/S0JnotzB59yMaeqD7jO8JYP 5PvI4WM/l5UfVHnZp2k1R76AOjReALw8dQgqAsT79Q7+EH3sNNuIjU6omdy+DFf4 tnpwYfeLOaZ1SztNNfU87Hsgnn2CGw== =pDE3 -----END PGP SIGNATURE----- Merge tag 'efi-next' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi into efi/core Pull EFI updates for v5.7 from Ard Biesheuvel: This time, the set of changes for the EFI subsystem is much larger than usual. The main reasons are: - Get things cleaned up before EFI support for RISC-V arrives, which will increase the size of the validation matrix, and therefore the threshold to making drastic changes, - After years of defunct maintainership, the GRUB project has finally started to consider changes from the distros regarding UEFI boot, some of which are highly specific to the way x86 does UEFI secure boot and measured boot, based on knowledge of both shim internals and the layout of bootparams and the x86 setup header. Having this maintenance burden on other architectures (which don't need shim in the first place) is hard to justify, so instead, we are introducing a generic Linux/UEFI boot protocol. Summary of changes: - Boot time GDT handling changes (Arvind) - Simplify handling of EFI properties table on arm64 - Generic EFI stub cleanups, to improve command line handling, file I/O, memory allocation, etc. - Introduce a generic initrd loading method based on calling back into the firmware, instead of relying on the x86 EFI handover protocol or device tree. - Introduce a mixed mode boot method that does not rely on the x86 EFI handover protocol either, and could potentially be adopted by other architectures (if another one ever surfaces where one execution mode is a superset of another) - Clean up the contents of struct efi, and move out everything that doesn't need to be stored there. - Incorporate support for UEFI spec v2.8A changes that permit firmware implementations to return EFI_UNSUPPORTED from UEFI runtime services at OS runtime, and expose a mask of which ones are supported or unsupported via a configuration table. - Various documentation updates and minor code cleanups (Heinrich) - Partial fix for the lack of by-VA cache maintenance in the decompressor on 32-bit ARM. Note that these patches were deliberately put at the beginning so they can be used as a stable branch that will be shared with a PR containing the complete fix, which I will send to the ARM tree. Signed-off-by: Ingo Molnar <mingo@kernel.org>
94 lines
2.3 KiB
C
94 lines
2.3 KiB
C
/* SPDX-License-Identifier: GPL-2.0+ */
|
|
/*
|
|
* Copyright (C) 2018 IBM Corporation
|
|
*/
|
|
#include <linux/efi.h>
|
|
#include <linux/module.h>
|
|
#include <linux/ima.h>
|
|
|
|
extern struct boot_params boot_params;
|
|
|
|
static enum efi_secureboot_mode get_sb_mode(void)
|
|
{
|
|
efi_guid_t efi_variable_guid = EFI_GLOBAL_VARIABLE_GUID;
|
|
efi_status_t status;
|
|
unsigned long size;
|
|
u8 secboot, setupmode;
|
|
|
|
size = sizeof(secboot);
|
|
|
|
if (!efi_rt_services_supported(EFI_RT_SUPPORTED_GET_VARIABLE)) {
|
|
pr_info("ima: secureboot mode unknown, no efi\n");
|
|
return efi_secureboot_mode_unknown;
|
|
}
|
|
|
|
/* Get variable contents into buffer */
|
|
status = efi.get_variable(L"SecureBoot", &efi_variable_guid,
|
|
NULL, &size, &secboot);
|
|
if (status == EFI_NOT_FOUND) {
|
|
pr_info("ima: secureboot mode disabled\n");
|
|
return efi_secureboot_mode_disabled;
|
|
}
|
|
|
|
if (status != EFI_SUCCESS) {
|
|
pr_info("ima: secureboot mode unknown\n");
|
|
return efi_secureboot_mode_unknown;
|
|
}
|
|
|
|
size = sizeof(setupmode);
|
|
status = efi.get_variable(L"SetupMode", &efi_variable_guid,
|
|
NULL, &size, &setupmode);
|
|
|
|
if (status != EFI_SUCCESS) /* ignore unknown SetupMode */
|
|
setupmode = 0;
|
|
|
|
if (secboot == 0 || setupmode == 1) {
|
|
pr_info("ima: secureboot mode disabled\n");
|
|
return efi_secureboot_mode_disabled;
|
|
}
|
|
|
|
pr_info("ima: secureboot mode enabled\n");
|
|
return efi_secureboot_mode_enabled;
|
|
}
|
|
|
|
bool arch_ima_get_secureboot(void)
|
|
{
|
|
static enum efi_secureboot_mode sb_mode;
|
|
static bool initialized;
|
|
|
|
if (!initialized && efi_enabled(EFI_BOOT)) {
|
|
sb_mode = boot_params.secure_boot;
|
|
|
|
if (sb_mode == efi_secureboot_mode_unset)
|
|
sb_mode = get_sb_mode();
|
|
initialized = true;
|
|
}
|
|
|
|
if (sb_mode == efi_secureboot_mode_enabled)
|
|
return true;
|
|
else
|
|
return false;
|
|
}
|
|
|
|
/* secureboot arch rules */
|
|
static const char * const sb_arch_rules[] = {
|
|
#if !IS_ENABLED(CONFIG_KEXEC_SIG)
|
|
"appraise func=KEXEC_KERNEL_CHECK appraise_type=imasig",
|
|
#endif /* CONFIG_KEXEC_SIG */
|
|
"measure func=KEXEC_KERNEL_CHECK",
|
|
#if !IS_ENABLED(CONFIG_MODULE_SIG)
|
|
"appraise func=MODULE_CHECK appraise_type=imasig",
|
|
#endif
|
|
"measure func=MODULE_CHECK",
|
|
NULL
|
|
};
|
|
|
|
const char * const *arch_get_ima_policy(void)
|
|
{
|
|
if (IS_ENABLED(CONFIG_IMA_ARCH_POLICY) && arch_ima_get_secureboot()) {
|
|
if (IS_ENABLED(CONFIG_MODULE_SIG))
|
|
set_module_sig_enforced();
|
|
return sb_arch_rules;
|
|
}
|
|
return NULL;
|
|
}
|