From patchwork Tue Aug 11 06:16:35 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Chun-Yi Lee X-Patchwork-Id: 6988821 Return-Path: X-Original-To: patchwork-linux-pm@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 7E3029F373 for ; Tue, 11 Aug 2015 06:20:10 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 925F22060B for ; Tue, 11 Aug 2015 06:20:09 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id A892620604 for ; Tue, 11 Aug 2015 06:20:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934129AbbHKGTd (ORCPT ); Tue, 11 Aug 2015 02:19:33 -0400 Received: from mail-pa0-f54.google.com ([209.85.220.54]:34412 "EHLO mail-pa0-f54.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S934111AbbHKGTb (ORCPT ); Tue, 11 Aug 2015 02:19:31 -0400 Received: by pawu10 with SMTP id u10so157040555paw.1; Mon, 10 Aug 2015 23:19:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=TSA2ersxJdmKUBfXUdX6sS7h8QuTgk/jxsABhJvmABY=; b=Wif240fDjxasQEH5VqBzyEq7F8o3DS6jwCmRMgFqadB/wd1HQuoE07vlONLC2Ec0P8 SrLNP77LEhPxnV97mpDyCAf3KfbbFVPUIK9GNbMpadDeq4kZ/nkms4yBCo07dzB74UF5 dm916ylohSWcuJYRDt+ZqgoXjXODwYMyOUtcxfGwcPgrlXOrX4llpTEuBHDKoQbI8n5S QCFYbd4sczKv0DhtSUyUlSRPRfaWBFOHmyQY9N74B9YFXS3xtkmIPsPPyBHnNumt9MrB Bt4FBxjpdglvtWGLj4hzw4994EQxwbN/FMqs/ohw4Mecjx7MqM1s/lK00Zn4Rm8/PrYV HExg== X-Received: by 10.68.253.195 with SMTP id ac3mr53445846pbd.159.1439273970911; Mon, 10 Aug 2015 23:19:30 -0700 (PDT) Received: from linux-rxt1.site ([130.57.30.250]) by smtp.gmail.com with ESMTPSA id qe3sm1082667pbc.73.2015.08.10.23.19.22 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 10 Aug 2015 23:19:30 -0700 (PDT) From: "Lee, Chun-Yi" X-Google-Original-From: "Lee, Chun-Yi" To: linux-kernel@vger.kernel.org Cc: linux-efi@vger.kernel.org, linux-pm@vger.kernel.org, "Rafael J. Wysocki" , Matthew Garrett , Len Brown , Pavel Machek , Josh Boyer , Vojtech Pavlik , Matt Fleming , Jiri Kosina , "H. Peter Anvin" , Ingo Molnar , "Lee, Chun-Yi" Subject: [PATCH v2 15/16] PM / hibernate: Bypass verification logic on legacy BIOS Date: Tue, 11 Aug 2015 14:16:35 +0800 Message-Id: <1439273796-25359-16-git-send-email-jlee@suse.com> X-Mailer: git-send-email 1.8.4.5 In-Reply-To: <1439273796-25359-1-git-send-email-jlee@suse.com> References: <1439273796-25359-1-git-send-email-jlee@suse.com> Sender: linux-pm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-pm@vger.kernel.org X-Spam-Status: No, score=-7.0 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, T_DKIM_INVALID, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Current hibernate signature verification solution relies on EFI stub and efi boot service variable on x86 architecture. So the verification logic was bypassed on legacy BIOS through checking EFI_BOOT flag. Reviewed-by: Jiri Kosina Tested-by: Jiri Kosina Signed-off-by: Lee, Chun-Yi --- drivers/firmware/efi/efi-hibernate_keys.c | 3 +++ kernel/power/Kconfig | 3 ++- kernel/power/snapshot.c | 8 ++++++-- kernel/power/user.c | 6 +++++- 4 files changed, 16 insertions(+), 4 deletions(-) diff --git a/drivers/firmware/efi/efi-hibernate_keys.c b/drivers/firmware/efi/efi-hibernate_keys.c index 8a50bf1..2125302 100644 --- a/drivers/firmware/efi/efi-hibernate_keys.c +++ b/drivers/firmware/efi/efi-hibernate_keys.c @@ -17,6 +17,9 @@ void create_hibernation_key_regen_flag(void) struct efivar_entry *entry = NULL; int err = 0; + if (!efi_enabled(EFI_RUNTIME_SERVICES)) + return; + if (!set_hibernation_key_regen_flag) return; diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig index 1a03777..c30598e 100644 --- a/kernel/power/Kconfig +++ b/kernel/power/Kconfig @@ -78,7 +78,8 @@ config HIBERNATE_VERIFICATION This option provides support for generating and verifying the signature of memory snapshot image by HMAC-SHA1. Current mechanism relies on UEFI secure boot environment, EFI stub generates HMAC - key for hibernate verification. + key for hibernate verification. So, the verification logic will be + bypassed on legacy BIOS. config HIBERNATE_VERIFICATION_FORCE bool "Require hibernate snapshot image to be validly signed" diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c index 486dd73..22b80b7 100644 --- a/kernel/power/snapshot.c +++ b/kernel/power/snapshot.c @@ -29,6 +29,7 @@ #include #include #include +#include #include #include @@ -1469,8 +1470,11 @@ error_digest: forward_ret: if (ret) pr_warn("PM: Signature verifying failed: %d\n", ret); - /* forward check result when verifying pass or not enforce verifying */ - if (!ret || !sigenforce) { + if (ret == -ENODEV && !efi_enabled(EFI_BOOT)) { + pr_warn("PM: Bypass verification on non-EFI machine\n"); + ret = 0; + } else if (!ret || !sigenforce) { + /* forward check result when verifying pass or not enforce verifying */ snapshot_fill_sig_forward_info(ret); ret = 0; } diff --git a/kernel/power/user.c b/kernel/power/user.c index a183abd..686d095 100644 --- a/kernel/power/user.c +++ b/kernel/power/user.c @@ -24,6 +24,7 @@ #include #include #include +#include #include @@ -393,7 +394,10 @@ static long snapshot_ioctl(struct file *filp, unsigned int cmd, break; case SNAPSHOT_REGENERATE_KEY: - set_hibernation_key_regen_flag = !!arg; + if (!efi_enabled(EFI_BOOT)) + error = -ENODEV; + else + set_hibernation_key_regen_flag = !!arg; break; default: