From cff4b0384f3de7725b2a22e0220c8b875b1724d3 Mon Sep 17 00:00:00 2001 From: Sven Schnelle Date: Wed, 20 Oct 2021 07:55:15 +0200 Subject: [PATCH] zipl: move secure boot verification into its own function MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Makes the code easier to read. Signed-off-by: Sven Schnelle Reviewed-by: Marc Hartmayer Reviewed-by: Stefan Haberland Signed-off-by: Jan Höppner --- zipl/boot/stage3.c | 30 ++++++++++++++++++------------ 1 file changed, 18 insertions(+), 12 deletions(-) diff --git a/zipl/boot/stage3.c b/zipl/boot/stage3.c index 9dbb45b3..4516e4cf 100644 --- a/zipl/boot/stage3.c +++ b/zipl/boot/stage3.c @@ -330,6 +330,21 @@ static void handle_environment(unsigned int len) free_page((unsigned long)items); } +static void verify_secure_boot(void) +{ + /* + * IPL process is secure we have to use default IPL values and + * check if the psw jump address is within at the start of a + * verified component. If it is not IPL is aborted. + */ + if (_stage3_parms.image_addr != IMAGE_LOAD_ADDRESS || + _stage3_parms.load_psw != DEFAULT_PSW_LOAD) + panic(ESECUREBOOT, "%s", msg_sipl_inval); + + if (!is_verified_address(_stage3_parms.load_psw & PSW32_ADDR_MASK)) + panic(ESECUREBOOT, "%s", msg_sipl_unverified); +} + void start(void) { unsigned int subchannel_id; @@ -337,19 +352,10 @@ void start(void) unsigned char *cmdline = (unsigned char *)COMMAND_LINE; unsigned int cmdline_len = 0, cextra_len = 0; - /* - * IPL process is secure we have to use default IPL values and - * check if the psw jump address is within at the start of a - * verified component. If it is not IPL is aborted. - */ - if (secure_boot_enabled()) { - if (_stage3_parms.image_addr != IMAGE_LOAD_ADDRESS || - _stage3_parms.load_psw != DEFAULT_PSW_LOAD) - panic(ESECUREBOOT, "%s", msg_sipl_inval); - if (!is_verified_address(_stage3_parms.load_psw & PSW32_ADDR_MASK)) - panic(ESECUREBOOT, "%s", msg_sipl_unverified); - } + if (secure_boot_enabled()) + verify_secure_boot(); + /* * cut the kernel header */