diff options
| author | Nayna Jain <nayna@linux.ibm.com> | 2020-09-16 11:21:13 -0500 |
|---|---|---|
| committer | Oliver O'Halloran <oohall@gmail.com> | 2020-10-01 13:44:06 +1000 |
| commit | f65d51cdfefec2efdcdd718137c097b4e8197753 (patch) | |
| tree | 64dc6a30cdb22632949ebe6d36f32a5f79f4d1e9 /core | |
| parent | 9cc5f24b72aba38e4e1bfb93806c4c2743fd9343 (diff) | |
| download | skiboot-f65d51cdfefec2efdcdd718137c097b4e8197753.zip skiboot-f65d51cdfefec2efdcdd718137c097b4e8197753.tar.gz skiboot-f65d51cdfefec2efdcdd718137c097b4e8197753.tar.bz2 | |
libstb/secureboot: OS Secure Boot is enabled only if FW secureboot is enabled
OS Secure Boot establishes a chain of trust from firmware to the OS.
However, OS Secure Boot can only be secure if the chain of trust
beneath it - from hardware to firmware - has been established by
Firmware Secure Boot. This patch ensures that OS Secure Boot is enabled
only if Firmware Secure Boot is enabled.
Signed-off-by: Nayna Jain <nayna@linux.ibm.com>
Signed-off-by: Eric Richter <erichte@linux.ibm.com>
Signed-off-by: Oliver O'Halloran <oohall@gmail.com>
Diffstat (limited to 'core')
| -rw-r--r-- | core/init.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/core/init.c b/core/init.c index 1289805..4cb8f98 100644 --- a/core/init.c +++ b/core/init.c @@ -1268,7 +1268,7 @@ void __noreturn __nomcount main_cpu_entry(const void *fdt) trustedboot_init(); /* Secure variables init, handled by platform */ - if (platform.secvar_init) + if (platform.secvar_init && is_fw_secureboot()) platform.secvar_init(); /* |