korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-12-19 09:04:51 +08:00
Code Issues Packages Projects Releases Wiki Activity

selftests/kexec: Enable secureboot tests for PowerPC

Browse Source 
Existing test cases determine secureboot state using efi variable, which
is available only on x86 architecture.  Add support for determining
secureboot state using device tree property on PowerNV architecture.

Signed-off-by: Nageswara R Sastry <rnsastry@linux.ibm.com>
Reviewed-by: Nayna Jain <nayna@linux.ibm.com>
Tested-by: Nayna Jain <nayna@linux.ibm.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
This commit is contained in:
Nageswara R Sastry 2021-11-24 12:38:01 +05:30 committed by Mimi Zohar
parent 520451e90c
commit 65e38e32a9
3 changed files with 39 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
tools/testing/selftests/kexec/Makefile
View File

@ -4,7 +4,7 @@
uname_M := $(shell uname -m 2>/dev/null || echo not)
ARCH ?= $(shell echo $(uname_M) | sed -e s/i.86/x86/ -e s/x86_64/x86/)
ifeq ($(ARCH),x86)
ifeq ($(ARCH),$(filter $(ARCH),x86 ppc64le))
TEST_PROGS := test_kexec_load.sh test_kexec_file_load.sh
TEST_FILES := kexec_common_lib.sh

38
tools/testing/selftests/kexec/kexec_common_lib.sh
View File

@ -91,6 +91,27 @@ get_efi_var_secureboot_mode()
return 0;
}
# On powerpc platform, check device-tree property
# /proc/device-tree/ibm,secureboot/os-secureboot-enforcing
# to detect secureboot state.
get_ppc64_secureboot_mode()
{
local secure_boot_file="/proc/device-tree/ibm,secureboot/os-secureboot-enforcing"
# Check for secure boot file existence
if [ -f $secure_boot_file ]; then
log_info "Secureboot is enabled (Device tree)"
return 1;
fi
log_info "Secureboot is not enabled (Device tree)"
return 0;
}
# Return the architecture of the system
get_arch()
{
echo $(arch)
}
# Check efivar SecureBoot-$(the UUID) and SetupMode-$(the UUID).
# The secure boot mode can be accessed either as the last integer
# of "od -An -t u1 /sys/firmware/efi/efivars/SecureBoot-*" or from
@ -100,14 +121,19 @@ get_efi_var_secureboot_mode()
get_secureboot_mode()
{
local secureboot_mode=0
local system_arch=$(get_arch)
get_efivarfs_secureboot_mode
secureboot_mode=$?
# fallback to using the efi_var files
if [ $secureboot_mode -eq 0 ]; then
get_efi_var_secureboot_mode
if [ "$system_arch" == "ppc64le" ]; then
get_ppc64_secureboot_mode
secureboot_mode=$?
else
get_efivarfs_secureboot_mode
secureboot_mode=$?
# fallback to using the efi_var files
if [ $secureboot_mode -eq 0 ]; then
get_efi_var_secureboot_mode
secureboot_mode=$?
fi
fi
if [ $secureboot_mode -eq 0 ]; then

8
tools/testing/selftests/kexec/test_kexec_file_load.sh
View File

@ -226,8 +226,12 @@ get_secureboot_mode
secureboot=$?
# Are there pe and ima signatures
check_for_pesig
pe_signed=$?
if [ "$(get_arch)" == 'ppc64le' ]; then
pe_signed=0
else
check_for_pesig
pe_signed=$?
fi
check_for_imasig
ima_signed=$?