From patchwork Thu Jul 16 14:25:29 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Chun-Yi Lee X-Patchwork-Id: 6807421 X-Patchwork-Delegate: rjw@sisk.pl Return-Path: X-Original-To: patchwork-linux-pm@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 4B4999F3A0 for ; Thu, 16 Jul 2015 14:28:20 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 6FAE4205BA for ; Thu, 16 Jul 2015 14:28:19 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 6F32D205B5 for ; Thu, 16 Jul 2015 14:28:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755988AbbGPO16 (ORCPT ); Thu, 16 Jul 2015 10:27:58 -0400 Received: from mail-pd0-f170.google.com ([209.85.192.170]:32791 "EHLO mail-pd0-f170.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755934AbbGPO11 (ORCPT ); Thu, 16 Jul 2015 10:27:27 -0400 Received: by pdbqm3 with SMTP id qm3so45303810pdb.0; Thu, 16 Jul 2015 07:27:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=OCLhIpte/6Lnn2J3IFKK2mGY/L7Kxn1TIZZaU1z++Rg=; b=Nwt6x6/QQgNpbbjlPtQN1hSzckA6I56rFotno06t/dAgOei/wshikc+Ovvji8kZDlZ gybs5zKuG/whxG6XV+1+kpa/Pm8IlCA21iPdZ91L9811oWGdDB3U4mDU6wLx3R8Qk640 PCe72kF0/TCW5uj/G8K2eG2tauJHwfHSVVTwk8uljtgII/IisXSx9BxJhQYosru97awf 21b0iukGLVYjbzUzaNM+T/fzXMduWl/vMYtw0TuNuEse1l4H+BXoyW8WlpUcDItvnbR8 p4mYAVO1gryhbLLlba2XKIzgDP6HBKpPgvnbS+g/d9UMhTI60AU1RSNujFo3o4hqeBrS GDfA== X-Received: by 10.68.131.104 with SMTP id ol8mr19580928pbb.39.1437056847335; Thu, 16 Jul 2015 07:27:27 -0700 (PDT) Received: from linux-rxt1.site.site ([124.11.22.254]) by smtp.gmail.com with ESMTPSA id r4sm8219910pap.8.2015.07.16.07.27.24 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 16 Jul 2015 07:27:26 -0700 (PDT) From: "Lee, Chun-Yi" X-Google-Original-From: "Lee, Chun-Yi" To: linux-kernel@vger.kernel.org Cc: linux-efi@vger.kernel.org, linux-pm@vger.kernel.org, "Rafael J. Wysocki" , Matthew Garrett , Len Brown , Pavel Machek , Josh Boyer , Vojtech Pavlik , Matt Fleming , Jiri Kosina , "H. Peter Anvin" , "Lee, Chun-Yi" Subject: [RFC PATCH 15/16] PM / hibernate: Bypass verification logic on legacy BIOS Date: Thu, 16 Jul 2015 22:25:29 +0800 Message-Id: <1437056730-15247-16-git-send-email-jlee@suse.com> X-Mailer: git-send-email 1.8.4.5 In-Reply-To: <1437056730-15247-1-git-send-email-jlee@suse.com> References: <1437056730-15247-1-git-send-email-jlee@suse.com> Sender: linux-pm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-pm@vger.kernel.org X-Spam-Status: No, score=-8.1 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, T_DKIM_INVALID, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Current hibernate signature verification solution relies on EFI stub and efi boot service variable on x86 architecture. So the verification logic was bypassed on legacy BIOS through checking EFI_BOOT flag. Signed-off-by: Lee, Chun-Yi --- drivers/firmware/efi/efi-hibernate_keys.c | 3 +++ kernel/power/Kconfig | 3 ++- kernel/power/snapshot.c | 8 ++++++-- kernel/power/user.c | 6 +++++- 4 files changed, 16 insertions(+), 4 deletions(-) diff --git a/drivers/firmware/efi/efi-hibernate_keys.c b/drivers/firmware/efi/efi-hibernate_keys.c index 90ae912..f33bf70 100644 --- a/drivers/firmware/efi/efi-hibernate_keys.c +++ b/drivers/firmware/efi/efi-hibernate_keys.c @@ -21,6 +21,9 @@ void create_swsusp_key_regen_flag(void) struct efivar_entry *entry = NULL; int err = 0; + if (!efi_enabled(EFI_RUNTIME_SERVICES)) + return; + if (!set_swsusp_key_regen_flag) return; diff --git a/kernel/power/Kconfig b/kernel/power/Kconfig index 7a64bda..5b04ab9 100644 --- a/kernel/power/Kconfig +++ b/kernel/power/Kconfig @@ -78,7 +78,8 @@ config HIBERNATE_VERIFICATION This option provides support for generating and verifying the signature of memory snapshot image by HMAC-SHA1. Current mechanism relies on UEFI secure boot environment, EFI stub generates HMAC - key for hibernate verification. + key for hibernate verification. So, the verification logic will be + bypassed on legacy BIOS. config HIBERNATE_VERIFICATION_FORCE bool "Require hibernate snapshot image to be validly signed" diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c index 3eda715..0d64c3a 100644 --- a/kernel/power/snapshot.c +++ b/kernel/power/snapshot.c @@ -29,6 +29,7 @@ #include #include #include +#include #include #include @@ -1469,8 +1470,11 @@ error_digest: forward_ret: if (ret) pr_warn("PM: Signature verifying failed: %d\n", ret); - /* forward check result when verifying pass or not enforce verifying */ - if (!ret || !sigenforce) { + if (ret == -ENODEV && !efi_enabled(EFI_BOOT)) { + pr_warn("PM: Bypass verification on non-EFI machine\n"); + ret = 0; + } else if (!ret || !sigenforce) { + /* forward check result when verifying pass or not enforce verifying */ snapshot_fill_sig_forward_info(ret); ret = 0; } diff --git a/kernel/power/user.c b/kernel/power/user.c index 8bcb051..d7407ef 100644 --- a/kernel/power/user.c +++ b/kernel/power/user.c @@ -24,6 +24,7 @@ #include #include #include +#include #include @@ -390,7 +391,10 @@ static long snapshot_ioctl(struct file *filp, unsigned int cmd, break; case SNAPSHOT_REGENERATE_KEY: - set_swsusp_key_regen_flag = !!arg; + if (!efi_enabled(EFI_BOOT)) + error = -ENODEV; + else + set_swsusp_key_regen_flag = !!arg; break; default: