Bug#831827: linux: arm64 support for securelevel and Secure Boot

From	Ben Hutchings <ben@decadent.org.uk>
Newsgroups	linux.debian.bugs.dist, linux.debian.kernel
Subject	Bug#831827: linux: arm64 support for securelevel and Secure Boot
Date	2016-09-04 03:30 +0200
Message-ID	<sdupX-4nR-1@gated-at.bofh.it> (permalink)
References	<rWLQd-1rn-9@gated-at.bofh.it> <saTkR-1fy-5@gated-at.bofh.it> <sbBvz-3DB-9@gated-at.bofh.it> <sbVND-8n7-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Tue, 2016-08-30 at 11:15 -0700, Linn Crosetto wrote:
> On Mon, Aug 29, 2016 at 01:30:44PM -0700, Linn Crosetto wrote:
> > 
> > On Sat, Aug 27, 2016 at 10:22:52PM +0100, Ben Hutchings wrote:
> > > 
> > > Control: tag -1 pending
> > > 
> > > Applied, but:
> > > 
> > > > 
> > > > 
> > > > --- a/drivers/firmware/efi/libstub/fdt.c
> > > > +++ b/drivers/firmware/efi/libstub/fdt.c
> > > > @@ -139,6 +139,13 @@ efi_status_t update_fdt(efi_system_table_t
> > > > *sys_table, void *orig_fdt,
> > > >  			return efi_status;
> > > >  		}
> > > >  	}
> > > > +
> > > > +	fdt_val32 = efi_get_secureboot(sys_table);
> > > 
> > > Shouldn't there be a cpu_to_fdt32() conversion here?
> > 
> > Yes. When setting securelevel the check to see if secure_boot is
> > greater-than-zero behaves the same, but it should be byte-swapped
> > to preserve
> > the value returned by efi_get_secureboot(). I tested and validated
> > the
> > following change:
> > 
> > @@ -140,7 +140,7 @@ efi_status_t update_fdt(efi_system_table_t
> > *sys_table, void *orig_fdt,
> >                 }
> >         }
> >  
> > -       fdt_val32 = efi_get_secureboot(sys_table);
> > +       fdt_val32 = cpu_to_fdt32(efi_get_secureboot(sys_table));
> >         status = fdt_setprop(fdt, node, "linux,uefi-secure-boot",
> >                              &fdt_val32, sizeof(fdt_val32));
> >         if (status)
> 
> Attaching version 2 of the patches with the change.

This change is pending for the next unstable upload.

Ben.

-- 
Ben Hutchings
Once a job is fouled up, anything done to improve it makes it worse.

Thread

Bug#831827: linux: arm64 support for securelevel and Secure Boot Linn Crosetto <linn@hpe.com> - 2016-07-20 00:40 +0200
  Bug#831827: linux: arm64 support for securelevel and Secure Boot Ben Hutchings <ben@decadent.org.uk> - 2016-08-27 23:30 +0200
    Bug#831827: linux: arm64 support for securelevel and Secure Boot Linn Crosetto <linn@hpe.com> - 2016-08-29 22:40 +0200
      Bug#831827: linux: arm64 support for securelevel and Secure Boot Linn Crosetto <linn@hpe.com> - 2016-08-30 20:20 +0200
        Bug#831827: linux: arm64 support for securelevel and Secure Boot Ben Hutchings <ben@decadent.org.uk> - 2016-09-04 03:30 +0200
  Processed: Re: Bug#831827: linux: arm64 support for securelevel  and Secure Boot owner@bugs.debian.org (Debian Bug Tracking System) - 2016-08-27 23:30 +0200
  Processed: Re: Bug#831827: linux: arm64 support for securelevel  and Secure Boot owner@bugs.debian.org (Debian Bug Tracking System) - 2016-08-27 23:40 +0200
  Bug#831827: linux: arm64 support for securelevel and Secure Boot Ben Hutchings <ben@decadent.org.uk> - 2016-08-27 23:40 +0200

csiph-web