From patchwork Thu Aug 31 07:24:40 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Claudio Carvalho X-Patchwork-Id: 808095 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.ozlabs.org (lists.ozlabs.org [IPv6:2401:3900:2:1::3]) (using TLSv1.2 with cipher ADH-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3xjYpp2R5Fz9sNc for ; Thu, 31 Aug 2017 17:26:58 +1000 (AEST) Received: from lists.ozlabs.org (lists.ozlabs.org [IPv6:2401:3900:2:1::3]) by lists.ozlabs.org (Postfix) with ESMTP id 3xjYpp1bFxzDqXj for ; Thu, 31 Aug 2017 17:26:58 +1000 (AEST) X-Original-To: skiboot@lists.ozlabs.org Delivered-To: skiboot@lists.ozlabs.org Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 3xjYmr6JgKzDqXh for ; Thu, 31 Aug 2017 17:25:16 +1000 (AEST) Received: from pps.filterd (m0098404.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.21/8.16.0.21) with SMTP id v7V7NikG073789 for ; Thu, 31 Aug 2017 03:25:15 -0400 Received: from e18.ny.us.ibm.com (e18.ny.us.ibm.com [129.33.205.208]) by mx0a-001b2d01.pphosted.com with ESMTP id 2cp98rt19p-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Thu, 31 Aug 2017 03:25:15 -0400 Received: from localhost by e18.ny.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Thu, 31 Aug 2017 03:25:13 -0400 Received: from b01cxnp23032.gho.pok.ibm.com (9.57.198.27) by e18.ny.us.ibm.com (146.89.104.205) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Thu, 31 Aug 2017 03:25:10 -0400 Received: from b01ledav004.gho.pok.ibm.com (b01ledav004.gho.pok.ibm.com [9.57.199.109]) by b01cxnp23032.gho.pok.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id v7V7PAwl25231364 for ; Thu, 31 Aug 2017 07:25:10 GMT Received: from localhost (unknown [127.0.0.1]) by IMSVA (Postfix) with SMTP id 1DE81112040 for ; Thu, 31 Aug 2017 03:24:56 -0400 (EDT) X-IMSS-HAND-OFF-DIRECTIVE: 127.0.0.1:10026 Received: from legolas.ibm.com (unknown [9.85.193.48]) by b01ledav004.gho.pok.ibm.com (Postfix) with ESMTP id 30475112047; Thu, 31 Aug 2017 03:24:55 -0400 (EDT) From: Claudio Carvalho To: skiboot@lists.ozlabs.org Date: Thu, 31 Aug 2017 04:24:40 -0300 X-Mailer: git-send-email 2.7.4 In-Reply-To: <1504164285-15095-1-git-send-email-cclaudio@linux.vnet.ibm.com> References: <1504164285-15095-1-git-send-email-cclaudio@linux.vnet.ibm.com> X-TM-AS-GCONF: 00 x-cbid: 17083107-0044-0000-0000-00000385D467 X-IBM-SpamModules-Scores: X-IBM-SpamModules-Versions: BY=3.00007640; HX=3.00000241; KW=3.00000007; PH=3.00000004; SC=3.00000226; SDB=6.00910098; UDB=6.00456511; IPR=6.00690378; BA=6.00005562; NDR=6.00000001; ZLA=6.00000005; ZF=6.00000009; ZB=6.00000000; ZP=6.00000000; ZH=6.00000000; ZU=6.00000002; MB=3.00016938; XFM=3.00000015; UTC=2017-08-31 07:25:12 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17083107-0045-0000-0000-000007B3ED75 Message-Id: <1504164285-15095-10-git-send-email-cclaudio@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-08-31_02:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=1 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1707230000 definitions=main-1708310114 Subject: [Skiboot] [PATCH v2 09/14] libstb: clean up the force-secure-mode and force-trusted-mode from nvram X-BeenThere: skiboot@lists.ozlabs.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: Mailing list for skiboot development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: skiboot-bounces+incoming=patchwork.ozlabs.org@lists.ozlabs.org Sender: "Skiboot" This just renames the ibm_secureboot variable to node and organize the code that checks the force-secure-mode and force-trusted-mode from nvram. Signed-off-by: Claudio Carvalho --- libstb/stb.c | 34 ++++++++++++++-------------------- 1 file changed, 14 insertions(+), 20 deletions(-) diff --git a/libstb/stb.c b/libstb/stb.c index eb77038..a238378 100644 --- a/libstb/stb.c +++ b/libstb/stb.c @@ -90,41 +90,35 @@ static void sb_enforce(void) void stb_init(void) { - struct dt_node *ibm_secureboot; - /* - * The ibm,secureboot device tree properties are documented in - * 'doc/device-tree/ibm,secureboot.rst' - */ - ibm_secureboot = dt_find_by_path(dt_root, "/ibm,secureboot"); - if (ibm_secureboot == NULL) { + struct dt_node *node; + + node = dt_find_by_path(dt_root, "/ibm,secureboot"); + if (!node) { prlog(PR_NOTICE,"STB: secure and trusted boot not supported\n"); return; } - secure_mode = dt_has_node_property(ibm_secureboot, "secure-enabled", - NULL); - if (nvram_query_eq("force-secure-mode", "always")) { - prlog(PR_NOTICE, "STB: secure mode on (FORCED by nvram)\n"); secure_mode = true; - } else if (secure_mode) { - prlog(PR_NOTICE, "STB: secure mode on.\n"); + prlog(PR_NOTICE, "STB: secure mode on (FORCED by nvram)\n"); } else { - prlog(PR_NOTICE, "STB: secure mode off\n"); + secure_mode = dt_has_node_property(node, "secure-enabled", NULL); + prlog(PR_NOTICE, "STB: secure mode %s\n", + secure_mode ? "on" : "off"); } - trusted_mode = dt_has_node_property(ibm_secureboot, "trusted-enabled", - NULL); if (nvram_query_eq("force-trusted-mode", "true")) { - prlog(PR_NOTICE, "STB: trusted mode ON (from NVRAM)\n"); trusted_mode = true; + prlog(PR_NOTICE, "STB: trusted mode on (FORCED by nvram)\n"); + } else { + trusted_mode = dt_has_node_property(node, "trusted-enabled", NULL); + prlog(PR_NOTICE, "STB: trusted mode %s\n", + trusted_mode ? "on" : "off"); } - prlog(PR_NOTICE, "STB: trusted mode %s\n", - trusted_mode ? "on" : "off"); if (!secure_mode && !trusted_mode) return; - c1vc = rom_init(ibm_secureboot); + c1vc = rom_init(node); if (secure_mode && !c1vc) { prlog(PR_EMERG, "STB: compatible romcode driver not found\n"); sb_enforce();