From: Thomas Zimmermann <tzimmermann@suse.de>
To: Ard Biesheuvel <ardb@kernel.org>
Cc: tglx@linutronix.de, mingo@redhat.com, bp@alien8.de,
dave.hansen@linux.intel.com, x86@kernel.org, hpa@zytor.com,
bhelgaas@google.com, arnd@arndb.de, zohar@linux.ibm.com,
dmitry.kasatkin@gmail.com, paul@paul-moore.com,
jmorris@namei.org, serge@hallyn.com, javierm@redhat.com,
linux-arch@vger.kernel.org, linux-efi@vger.kernel.org,
linux-kernel@vger.kernel.org, linux-pci@vger.kernel.org,
linux-integrity@vger.kernel.org,
linux-security-module@vger.kernel.org
Subject: Re: [PATCH 2/3] arch/x86: Add <asm/ima-efi.h> for arch_ima_efi_boot_mode
Date: Fri, 15 Dec 2023 13:16:27 +0100 [thread overview]
Message-ID: <220f5a93-5eed-4a1d-8c84-e8e09adef6cf@suse.de> (raw)
In-Reply-To: <CAMj1kXHq5CxdNei24MOnX_78h70bJQYd8HMQnT80DSqwZkFuSQ@mail.gmail.com>
[-- Attachment #1.1: Type: text/plain, Size: 4880 bytes --]
Hi
Am 07.12.23 um 16:37 schrieb Ard Biesheuvel:
> On Wed, 6 Dec 2023 at 13:54, Thomas Zimmermann <tzimmermann@suse.de> wrote:
>>
>> The header file <asm/efi.h> contains the macro arch_ima_efi_boot_mode,
>> which expands to use struct boot_params from <asm/bootparams.h>. Many
>> drivers include <linux/efi.h>, but do not use boot parameters. Changes
>> to bootparam.h or its included headers can easily trigger large,
>> unnessary rebuilds of the kernel.
>>
>> Moving x86's arch_ima_efi_boot_mode to <asm/ima-efi.h> and including
>> <asm/bootparam.h> separates that dependency from the rest of the EFI
>> interfaces. The only user is in ima_efi.c. As the file already declares
>> a default value for arch_ima_efi_boot_mode, move this define into
>> asm-generic for all other architectures.
>>
>> With arch_ima_efi_boot_mode removed from efi.h, <asm/bootparam.h> can
>> later be removed from further x86 header files.
>>
>> Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
>> ---
>> arch/x86/include/asm/efi.h | 3 ---
>> arch/x86/include/asm/ima-efi.h | 12 ++++++++++++
>> include/asm-generic/Kbuild | 1 +
>> include/asm-generic/ima-efi.h | 16 ++++++++++++++++
>> security/integrity/ima/ima_efi.c | 5 +----
>> 5 files changed, 30 insertions(+), 7 deletions(-)
>> create mode 100644 arch/x86/include/asm/ima-efi.h
>> create mode 100644 include/asm-generic/ima-efi.h
>>
>> diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h
>> index c4555b269a1b..99f31176c892 100644
>> --- a/arch/x86/include/asm/efi.h
>> +++ b/arch/x86/include/asm/efi.h
>> @@ -418,9 +418,6 @@ extern int __init efi_memmap_split_count(efi_memory_desc_t *md,
>> extern void __init efi_memmap_insert(struct efi_memory_map *old_memmap,
>> void *buf, struct efi_mem_range *mem);
>>
>> -#define arch_ima_efi_boot_mode \
>> - ({ extern struct boot_params boot_params; boot_params.secure_boot; })
>> -
>> #ifdef CONFIG_EFI_RUNTIME_MAP
>> int efi_get_runtime_map_size(void);
>> int efi_get_runtime_map_desc_size(void);
>> diff --git a/arch/x86/include/asm/ima-efi.h b/arch/x86/include/asm/ima-efi.h
>> new file mode 100644
>> index 000000000000..3fe054937077
>> --- /dev/null
>> +++ b/arch/x86/include/asm/ima-efi.h
>> @@ -0,0 +1,12 @@
>> +/* SPDX-License-Identifier: GPL-2.0 */
>> +#ifndef _ASM_X86_IMA_EFI_H
>> +#define _ASM_X86_IMA_EFI_H
>> +
>> +#include <asm/bootparam.h>
>> +
>> +#define arch_ima_efi_boot_mode \
>> + ({ extern struct boot_params boot_params; boot_params.secure_boot; })
>> +
>
> Could you please check whether this kludge is still needed now that we
> no longer have conflicting declarations of boot_params? (i.e., drop
> the ({ }) and the extern declaration)
I dropped this and include setup.h instead. Appears to work.
Best regards
Thomas
>
>
>
>> +#include <asm-generic/ima-efi.h>
>> +
>> +#endif /* _ASM_X86_IMA_EFI_H */
>> diff --git a/include/asm-generic/Kbuild b/include/asm-generic/Kbuild
>> index def242528b1d..4fd16e71e8cd 100644
>> --- a/include/asm-generic/Kbuild
>> +++ b/include/asm-generic/Kbuild
>> @@ -26,6 +26,7 @@ mandatory-y += ftrace.h
>> mandatory-y += futex.h
>> mandatory-y += hardirq.h
>> mandatory-y += hw_irq.h
>> +mandatory-y += ima-efi.h
>> mandatory-y += io.h
>> mandatory-y += irq.h
>> mandatory-y += irq_regs.h
>> diff --git a/include/asm-generic/ima-efi.h b/include/asm-generic/ima-efi.h
>> new file mode 100644
>> index 000000000000..f87f5edef440
>> --- /dev/null
>> +++ b/include/asm-generic/ima-efi.h
>> @@ -0,0 +1,16 @@
>> +/* SPDX-License-Identifier: GPL-2.0+ */
>> +
>> +#ifndef __ASM_GENERIC_IMA_EFI_H_
>> +#define __ASM_GENERIC_IMA_EFI_H_
>> +
>> +#include <linux/efi.h>
>> +
>> +/*
>> + * Only include this header file from your architecture's <asm/ima-efi.h>.
>> + */
>> +
>> +#ifndef arch_ima_efi_boot_mode
>> +#define arch_ima_efi_boot_mode efi_secureboot_mode_unset
>> +#endif
>> +
>> +#endif /* __ASM_GENERIC_FB_H_ */
>> diff --git a/security/integrity/ima/ima_efi.c b/security/integrity/ima/ima_efi.c
>> index 138029bfcce1..56bbee271cec 100644
>> --- a/security/integrity/ima/ima_efi.c
>> +++ b/security/integrity/ima/ima_efi.c
>> @@ -6,10 +6,7 @@
>> #include <linux/module.h>
>> #include <linux/ima.h>
>> #include <asm/efi.h>
>> -
>> -#ifndef arch_ima_efi_boot_mode
>> -#define arch_ima_efi_boot_mode efi_secureboot_mode_unset
>> -#endif
>> +#include <asm/ima-efi.h>
>>
>> static enum efi_secureboot_mode get_sb_mode(void)
>> {
>> --
>> 2.43.0
>>
--
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Frankenstrasse 146, 90461 Nuernberg, Germany
GF: Ivo Totev, Andrew Myers, Andrew McDonald, Boudien Moerman
HRB 36809 (AG Nuernberg)
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 840 bytes --]
next prev parent reply other threads:[~2023-12-15 12:16 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-12-06 12:38 [PATCH 0/3] arch/x86: Remove unnecessary dependencies on bootparam.h Thomas Zimmermann
2023-12-06 12:38 ` [PATCH 1/3] arch/x86: Move struct pci_setup_rom into pci_setup.h Thomas Zimmermann
2023-12-07 15:35 ` Ard Biesheuvel
2023-12-15 12:15 ` Thomas Zimmermann
2023-12-06 12:38 ` [PATCH 2/3] arch/x86: Add <asm/ima-efi.h> for arch_ima_efi_boot_mode Thomas Zimmermann
2023-12-07 15:37 ` Ard Biesheuvel
2023-12-15 12:16 ` Thomas Zimmermann [this message]
2023-12-06 12:38 ` [PATCH 3/3] arch/x86: Do not include <asm/bootparam.h> in several header files Thomas Zimmermann
2023-12-07 15:38 ` Ard Biesheuvel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=220f5a93-5eed-4a1d-8c84-e8e09adef6cf@suse.de \
--to=tzimmermann@suse.de \
--cc=ardb@kernel.org \
--cc=arnd@arndb.de \
--cc=bhelgaas@google.com \
--cc=bp@alien8.de \
--cc=dave.hansen@linux.intel.com \
--cc=dmitry.kasatkin@gmail.com \
--cc=hpa@zytor.com \
--cc=javierm@redhat.com \
--cc=jmorris@namei.org \
--cc=linux-arch@vger.kernel.org \
--cc=linux-efi@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pci@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=paul@paul-moore.com \
--cc=serge@hallyn.com \
--cc=tglx@linutronix.de \
--cc=x86@kernel.org \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).