Re: [PATCH 01/24] efi: Add EFI_SECURE_BOOT bit
Ard Biesheuvel wrote:
> > @@ -1184,6 +1184,7 @@ void __init setup_arch(char **cmdline_p)
> > pr_info("Secure boot disabled\n");
> > break;
> > case efi_secureboot_mode_enabled:
> > + set_bit(EFI_SECURE_BOOT, &efi.flags);
> > pr_info("Secure boot enabled\n");
> > break;
> > default:
>
> Like I asked when this patch was sent round the last time: is there
> any reason for this not to live in generic code?
It's interpreting the x86 boot_params at this point. I suppose I could move
the following piece:
if (efi_enabled(EFI_BOOT)) {
switch (boot_params.secure_boot) {
case efi_secureboot_mode_disabled:
pr_info("Secure boot disabled\n");
break;
case efi_secureboot_mode_enabled:
pr_info("Secure boot enabled\n");
break;
default:
pr_info("Secure boot could not be determined\n");
break;
}
}
into generic code and pass in boot_params.secure_boot as an argument (since
that's x86-specific I believe. Any suggestions as to where? The same file as
efi_get_secureboot() would seem to be the wrong place since that gets linked
into the bootwrapper. I could put it into drivers/firmware/efi/secure_boot.c
and make that conditional in the Makefile.
David
Re: [PATCH 01/24] efi: Add EFI_SECURE_BOOT bit
On 5 April 2017 at 21:14, David Howells wrote:
> From: Josh Boyer
>
> UEFI machines can be booted in Secure Boot mode. Add a EFI_SECURE_BOOT bit
> that can be passed to efi_enabled() to find out whether secure boot is
> enabled.
>
> This will be used by the SysRq+x handler, registered by the x86 arch, to find
> out whether secure boot mode is enabled so that it can be disabled.
>
> Signed-off-by: Josh Boyer
> Signed-off-by: David Howells
> cc: linux-...@vger.kernel.org
> ---
>
> arch/x86/kernel/setup.c |1 +
> include/linux/efi.h |1 +
> 2 files changed, 2 insertions(+)
>
> diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
> index 4bf0c8926a1c..396285bddb93 100644
> --- a/arch/x86/kernel/setup.c
> +++ b/arch/x86/kernel/setup.c
> @@ -1184,6 +1184,7 @@ void __init setup_arch(char **cmdline_p)
> pr_info("Secure boot disabled\n");
> break;
> case efi_secureboot_mode_enabled:
> + set_bit(EFI_SECURE_BOOT, &efi.flags);
> pr_info("Secure boot enabled\n");
> break;
> default:
Like I asked when this patch was sent round the last time: is there
any reason for this not to live in generic code?
> diff --git a/include/linux/efi.h b/include/linux/efi.h
> index 94d34e0be24f..6049600e5475 100644
> --- a/include/linux/efi.h
> +++ b/include/linux/efi.h
> @@ -1069,6 +1069,7 @@ extern int __init efi_setup_pcdp_console(char *);
> #define EFI_DBG8 /* Print additional debug
> info at runtime */
> #define EFI_NX_PE_DATA 9 /* Can runtime data regions be mapped
> non-executable? */
> #define EFI_MEM_ATTR 10 /* Did firmware publish an
> EFI_MEMORY_ATTRIBUTES table? */
> +#define EFI_SECURE_BOOT11 /* Are we in Secure Boot
> mode? */
>
> #ifdef CONFIG_EFI
> /*
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-efi" in
> the body of a message to majord...@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
[PATCH 01/24] efi: Add EFI_SECURE_BOOT bit
From: Josh Boyer
UEFI machines can be booted in Secure Boot mode. Add a EFI_SECURE_BOOT bit
that can be passed to efi_enabled() to find out whether secure boot is
enabled.
This will be used by the SysRq+x handler, registered by the x86 arch, to find
out whether secure boot mode is enabled so that it can be disabled.
Signed-off-by: Josh Boyer
Signed-off-by: David Howells
cc: linux-...@vger.kernel.org
---
arch/x86/kernel/setup.c |1 +
include/linux/efi.h |1 +
2 files changed, 2 insertions(+)
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 4bf0c8926a1c..396285bddb93 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -1184,6 +1184,7 @@ void __init setup_arch(char **cmdline_p)
pr_info("Secure boot disabled\n");
break;
case efi_secureboot_mode_enabled:
+ set_bit(EFI_SECURE_BOOT, &efi.flags);
pr_info("Secure boot enabled\n");
break;
default:
diff --git a/include/linux/efi.h b/include/linux/efi.h
index 94d34e0be24f..6049600e5475 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -1069,6 +1069,7 @@ extern int __init efi_setup_pcdp_console(char *);
#define EFI_DBG8 /* Print additional debug info
at runtime */
#define EFI_NX_PE_DATA 9 /* Can runtime data regions be mapped
non-executable? */
#define EFI_MEM_ATTR 10 /* Did firmware publish an
EFI_MEMORY_ATTRIBUTES table? */
+#define EFI_SECURE_BOOT11 /* Are we in Secure Boot mode?
*/
#ifdef CONFIG_EFI
/*
[PATCH 01/24] efi: Add EFI_SECURE_BOOT bit
From: Josh Boyer
UEFI machines can be booted in Secure Boot mode. Add a EFI_SECURE_BOOT bit
that can be passed to efi_enabled() to find out whether secure boot is
enabled.
This will be used by the SysRq+x handler, registered by the x86 arch, to find
out whether secure boot mode is enabled so that it can be disabled.
Signed-off-by: Josh Boyer
Signed-off-by: David Howells
---
arch/x86/kernel/setup.c |1 +
include/linux/efi.h |1 +
2 files changed, 2 insertions(+)
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 4bf0c8926a1c..396285bddb93 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -1184,6 +1184,7 @@ void __init setup_arch(char **cmdline_p)
pr_info("Secure boot disabled\n");
break;
case efi_secureboot_mode_enabled:
+ set_bit(EFI_SECURE_BOOT, &efi.flags);
pr_info("Secure boot enabled\n");
break;
default:
diff --git a/include/linux/efi.h b/include/linux/efi.h
index 94d34e0be24f..6049600e5475 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -1069,6 +1069,7 @@ extern int __init efi_setup_pcdp_console(char *);
#define EFI_DBG8 /* Print additional debug info
at runtime */
#define EFI_NX_PE_DATA 9 /* Can runtime data regions be mapped
non-executable? */
#define EFI_MEM_ATTR 10 /* Did firmware publish an
EFI_MEMORY_ATTRIBUTES table? */
+#define EFI_SECURE_BOOT11 /* Are we in Secure Boot mode?
*/
#ifdef CONFIG_EFI
/*
[PATCH 01/24] efi: Add EFI_SECURE_BOOT bit
From: Josh Boyer
UEFI machines can be booted in Secure Boot mode. Add a EFI_SECURE_BOOT bit
that can be passed to efi_enabled() to find out whether secure boot is
enabled.
This will be used by the SysRq+x handler, registered by the x86 arch, to find
out whether secure boot mode is enabled so that it can be disabled.
Signed-off-by: Josh Boyer
Signed-off-by: David Howells
---
arch/x86/kernel/setup.c |1 +
include/linux/efi.h |1 +
2 files changed, 2 insertions(+)
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 4bf0c8926a1c..396285bddb93 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -1184,6 +1184,7 @@ void __init setup_arch(char **cmdline_p)
pr_info("Secure boot disabled\n");
break;
case efi_secureboot_mode_enabled:
+ set_bit(EFI_SECURE_BOOT, &efi.flags);
pr_info("Secure boot enabled\n");
break;
default:
diff --git a/include/linux/efi.h b/include/linux/efi.h
index 94d34e0be24f..6049600e5475 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -1069,6 +1069,7 @@ extern int __init efi_setup_pcdp_console(char *);
#define EFI_DBG8 /* Print additional debug info
at runtime */
#define EFI_NX_PE_DATA 9 /* Can runtime data regions be mapped
non-executable? */
#define EFI_MEM_ATTR 10 /* Did firmware publish an
EFI_MEMORY_ATTRIBUTES table? */
+#define EFI_SECURE_BOOT11 /* Are we in Secure Boot mode?
*/
#ifdef CONFIG_EFI
/*
