From nobody Wed Dec 17 03:13:16 2025 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BFFF779CF; Wed, 21 May 2025 10:58:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747825112; cv=none; b=H/DXXOYN9Aic16mdO4T4nABPUgJgYC1c9te/LysQQNJ07HfEZEpBsSZ3D2qBkQEZ/XmpxVfd0BDyURuuDFPdq6NhcIEsrS4jYiach7gXC9K72g7GROF7FkRvyHqHu9xVq/Z0l71UZKqhkh3pVA0y9LQ577SYGWnvtRaa5CwwDUs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747825112; c=relaxed/simple; bh=d/hH4YRKscfoJ3JNaunJOBbmXID5c/L62IMVrMbImKE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=sSOM+ik3U+lWYZE2TRYePqd+neJixsiuNeJzK7t1nJrxyVgoW59eYb82jMyMnNw9dxtVQwEg8jimyjqRF7VdpFQ/FQnoO3t2kajbn9gfN4/Eg87WyCI8fDjNOnNX/BZw9v89KV1qyfMqON3ZCdBhF0Heure+OrshrIeg16JCnaE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=Sbex4Tlj; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="Sbex4Tlj" Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 54L5wd21024505; Wed, 21 May 2025 10:58:10 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=h6nWBLUb3tJoieg6u MHTOlSkfwsqMXR5qlqotxgHTQo=; b=Sbex4TljDGiDecNEaRb6dxHGCYQP/g3dW TUqbFPuAETZC+UJjypi6sXe6NaBZXPB2Cogj/i17pPIZ1TAUnznprdyZmZRlp5+N GPghI11aeHQNBNeRN1EmbZkALiy0tCu+skJ/RtGmU3DK7aRZuYE/sz3c+F4SlZl5 m1Kh8lp46WVMott4CO2qqPYYzqruUVuXV3ThEZDHjliPRXBqZ6FF8VuCajI4Ka1p hZ8n64x9XFasJdLs5XSBPbGkxCAU/luu510rcaSwH6Cc+WDeG4XO8ouCK8sdeF7b WdPnsH7silYNDbnnQ5Fh5nq7E9PFHDNvR/fKrDASaJeanM6NHwGtA== Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 46rxaakwhy-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 21 May 2025 10:58:10 +0000 (GMT) Received: from m0353725.ppops.net (m0353725.ppops.net [127.0.0.1]) by pps.reinject (8.18.0.8/8.18.0.8) with ESMTP id 54LArS6U002824; Wed, 21 May 2025 10:58:09 GMT Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 46rxaakwhu-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 21 May 2025 10:58:09 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 54L9shZa024709; Wed, 21 May 2025 10:58:09 GMT Received: from smtprelay07.fra02v.mail.ibm.com ([9.218.2.229]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 46rwkr3tgb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 21 May 2025 10:58:08 +0000 Received: from smtpav02.fra02v.mail.ibm.com (smtpav02.fra02v.mail.ibm.com [10.20.54.101]) by smtprelay07.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 54LAw5Zs48038294 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 21 May 2025 10:58:05 GMT Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E59C620043; Wed, 21 May 2025 10:58:04 +0000 (GMT) Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8E0D020040; Wed, 21 May 2025 10:58:02 +0000 (GMT) Received: from li-fc74f8cc-3279-11b2-a85c-ef5828687581.in.ibm.com (unknown [9.204.203.112]) by smtpav02.fra02v.mail.ibm.com (Postfix) with ESMTP; Wed, 21 May 2025 10:58:02 +0000 (GMT) From: Srish Srinivasan To: linux-integrity@vger.kernel.org, linuxppc-dev@lists.ozlabs.org Cc: maddy@linux.ibm.com, mpe@ellerman.id.au, npiggin@gmail.com, christophe.leroy@csgroup.eu, naveen@kernel.org, ajd@linux.ibm.com, zohar@linux.ibm.com, nayna@linux.ibm.com, linux-kernel@vger.kernel.org Subject: [PATCH v2 1/3] powerpc/pseries: Correct secvar format representation for static key management Date: Wed, 21 May 2025 16:27:57 +0530 Message-ID: <20250521105759.8408-2-ssrish@linux.ibm.com> X-Mailer: git-send-email 2.49.0 In-Reply-To: <20250521105759.8408-1-ssrish@linux.ibm.com> References: <20250521105759.8408-1-ssrish@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=CMEqXQrD c=1 sm=1 tr=0 ts=682db1c2 cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=dt9VzEwgFbYA:10 a=VnNF1IyMAAAA:8 a=FNRAjOYsECM2cVzVVdoA:9 X-Proofpoint-ORIG-GUID: WoFquhr46etRrQkz54qW1eekvK2bJfxW X-Proofpoint-GUID: -uMCd_DnlEBKD0buM0YB2fYneUvtDYy_ X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwNTIxMDEwNSBTYWx0ZWRfXzA6lg5sQCEyM JtrDAbGZLs3St1/0fM8K5O+aTne39z0D110+hMTsN/FZD2UACBC/LI3Mdl6w3bpA5CgTTW3JaKU KEDKAdWpIPzROSFKLE5eb9110K7VTRiCDr3LSoXZ+fNo7jI9wOY7cFAChNZgAEVV9gUzgRZNVs7 ykGNblYb5Ah+2gbl7IV1vjAmgM67byihsr0hVYqCuTpHgksBvtj4fifu/cuCJXHcm2QI7PxfTAD iAs0D8EKx2f98Me95G+qM4gmxntxzDsRRmdjfHqIKJQFj4x5eTermCbPvXdzJHje9gesEGf/RA9 9KujTHCeXmHaeC5ViriJ4tYrGicEMLSYiULhtb7yzM5gJCMDkFpGcSqjmCZNJO4OrMyxXx2HTdA R7kZZCDJHwGqMaTG/GjODLh1zbDV1yfhLFG9gC47yCAnzaCCHi4JcZAwE50c7YaDTAuHO/ib X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.0.736,FMLib:17.12.80.40 definitions=2025-05-21_03,2025-05-20_03,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 mlxscore=0 phishscore=0 bulkscore=0 clxscore=1015 impostorscore=0 malwarescore=0 mlxlogscore=999 adultscore=0 suspectscore=0 priorityscore=1501 lowpriorityscore=0 classifier=spam authscore=0 authtc=n/a authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2505160000 definitions=main-2505210105 Content-Type: text/plain; charset="utf-8" On a PLPKS enabled PowerVM LPAR, the secvar format property for static key management is misrepresented as "ibm,plpks-sb-unknown", creating reason for confusion. Static key management mode uses fixed, built-in keys. Dynamic key management mode allows keys to be updated in production to handle security updates without firmware rebuilds. Define a function named plpks_get_sb_keymgmt_mode() to retrieve the key management mode based on the existence of the SB_VERSION property in the firmware. Set the secvar format property to either "ibm,plpks-sb-v" or "ibm,plpks-sb-v0" based on the key management mode, and return the length of the secvar format property. Co-developed-by: Souradeep Signed-off-by: Souradeep Signed-off-by: Srish Srinivasan Reviewed-by: Mimi Zohar Reviewed-by: Stefan Berger Reviewed-by: Nayna Jain Reviewed-by: Andrew Donnellan --- Documentation/ABI/testing/sysfs-secvar | 9 ++- arch/powerpc/platforms/pseries/plpks-secvar.c | 76 +++++++++++-------- 2 files changed, 52 insertions(+), 33 deletions(-) diff --git a/Documentation/ABI/testing/sysfs-secvar b/Documentation/ABI/tes= ting/sysfs-secvar index 857cf12b0904..45281888e520 100644 --- a/Documentation/ABI/testing/sysfs-secvar +++ b/Documentation/ABI/testing/sysfs-secvar @@ -22,9 +22,12 @@ Description: A string indicating which backend is in use= by the firmware. and is expected to be "ibm,edk2-compat-v1". =20 On pseries/PLPKS, this is generated by the kernel based on the - version number in the SB_VERSION variable in the keystore, and - has the form "ibm,plpks-sb-v", or - "ibm,plpks-sb-unknown" if there is no SB_VERSION variable. + version number in the SB_VERSION variable in the keystore. The + version numbering in the SB_VERSION variable starts from 1. The + format string takes the form "ibm,plpks-sb-v" in the + case of dynamic key management mode. Otherwise, for any error in + reading SB_VERSION it takes the form "ibm,plpks-sb-v0", + indicating that the key management mode is static. =20 What: /sys/firmware/secvar/vars/ Date: August 2019 diff --git a/arch/powerpc/platforms/pseries/plpks-secvar.c b/arch/powerpc/p= latforms/pseries/plpks-secvar.c index 257fd1f8bc19..767e5e8c6990 100644 --- a/arch/powerpc/platforms/pseries/plpks-secvar.c +++ b/arch/powerpc/platforms/pseries/plpks-secvar.c @@ -152,39 +152,55 @@ static int plpks_set_variable(const char *key, u64 ke= y_len, u8 *data, return rc; } =20 -// PLPKS dynamic secure boot doesn't give us a format string in the same w= ay OPAL does. -// Instead, report the format using the SB_VERSION variable in the keystor= e. -// The string is made up by us, and takes the form "ibm,plpks-sb-v" (or= "ibm,plpks-sb-unknown" -// if the SB_VERSION variable doesn't exist). Hypervisor defines the SB_VE= RSION variable as a -// "1 byte unsigned integer value". -static ssize_t plpks_secvar_format(char *buf, size_t bufsize) +/* + * Return the key management mode. + * + * SB_VERSION is defined as a "1 byte unsigned integer value", taking valu= es + * starting from 1. It is owned by the Partition Firmware and its presence + * indicates that the key management mode is dynamic. Any failure in + * reading SB_VERSION defaults the key management mode to static. The error + * codes -ENOENT or -EPERM are expected in static key management mode. An + * unexpected error code will have to be investigated. Only signed variabl= es + * have null bytes in their names, SB_VERSION does not. + * + * Return 0 to indicate that the key management mode is static. Otherwise + * return the SB_VERSION value to indicate that the key management mode is + * dynamic. + */ +static u8 plpks_get_sb_keymgmt_mode(void) { - struct plpks_var var =3D {0}; - ssize_t ret; - u8 version; - - var.component =3D NULL; - // Only the signed variables have null bytes in their names, this one doe= sn't - var.name =3D "SB_VERSION"; - var.namelen =3D strlen(var.name); - var.datalen =3D 1; - var.data =3D &version; - - // Unlike the other vars, SB_VERSION is owned by firmware instead of the = OS - ret =3D plpks_read_fw_var(&var); - if (ret) { - if (ret =3D=3D -ENOENT) { - ret =3D snprintf(buf, bufsize, "ibm,plpks-sb-unknown"); - } else { - pr_err("Error %ld reading SB_VERSION from firmware\n", ret); - ret =3D -EIO; - } - goto err; + u8 mode; + ssize_t rc; + struct plpks_var var =3D { + .component =3D NULL, + .name =3D "SB_VERSION", + .namelen =3D 10, + .datalen =3D 1, + .data =3D &mode, + }; + + rc =3D plpks_read_fw_var(&var); + if (rc) { + if (rc !=3D -ENOENT && rc !=3D -EPERM) + pr_info("Error %ld reading SB_VERSION from firmware\n", rc); + mode =3D 0; } + return mode; +} =20 - ret =3D snprintf(buf, bufsize, "ibm,plpks-sb-v%hhu", version); -err: - return ret; +/* + * PLPKS dynamic secure boot doesn't give us a format string in the same w= ay + * OPAL does. Instead, report the format using the SB_VERSION variable in = the + * keystore. The string, made up by us, takes the form of either + * "ibm,plpks-sb-v" or "ibm,plpks-sb-v0", based on the key management m= ode, + * and return the length of the secvar format property. + */ +static ssize_t plpks_secvar_format(char *buf, size_t bufsize) +{ + u8 mode; + + mode =3D plpks_get_sb_keymgmt_mode(); + return snprintf(buf, bufsize, "ibm,plpks-sb-v%hhu", mode); } =20 static int plpks_max_size(u64 *max_size) --=20 2.47.1 From nobody Wed Dec 17 03:13:16 2025 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3F5DA2620FA; Wed, 21 May 2025 10:58:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747825116; cv=none; b=hDxCUyVszXDRF2RowmNdht/2+lfwaAjmQQRNjfF6EZJnJmfkL0YcEnlsgV7//izeCWltP4lBuXAjW9l5Awh5vnvTTRuZyTuMwOJdLp15F1THEQkFepSUVq/UmRMUAgJjcetS8EXpG7nd06FPMGcaX5vAq1hoqBUOuaARyIWCuus= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747825116; c=relaxed/simple; bh=Yj5FESqYIA7ScGcVcpjZcFcYpZM3cIeXjw2DKRH2ckg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=F0z++MgohzewgIgB77MSDH/vF7yckxk5W7l62IpyB0kcs9N4TtifFj/6MQDO+bIJvYWWsPRK9WIiCdakjqAUXXDuQWCDgTkT9G9EyZxPikh2ilh0BSVNOa4MmObsEAQ1NVTugUyzhjIO4flWWaoKu28WoeheW+V+GX735oO/WTQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=kzjWMpCI; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="kzjWMpCI" Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 54L8phhu014686; Wed, 21 May 2025 10:58:13 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=+iv47Tf1NAy3MKg7J pMt0tSZMZNUHjGtMkJcRX2ZoxQ=; b=kzjWMpCI2yMJnJ2+8F9Q2uOymy+5O4LcM dogMhK1cYNMNfdv5VIHHlqxXnTu9vnyz0UrsMMZhsxKoQCsKgmH6rkHNL0pjWSIl PlrQmIkUh+l98LHMzwnkIrcSTj+jdOuy90cPR1rkfx2Hk/8qgEHWXSvYl0vhEzvn KPette/LmqGZffkdrpbjNq6Bt+EoQDJhVP2oxhcqYG9Cm3UWJkwJfO+goH066omT v6xzoeKcZyBxzUZrZukZ5f6VCpwjFCk76v3eBKxHHsIOFiMyXou/33BEgkZmY8dV vfV2te0E448moV+2OC2sat//+jtWxkhS6BuodTbCVN4Pkq6fh3IuA== Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 46sbph0j2n-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 21 May 2025 10:58:13 +0000 (GMT) Received: from m0360083.ppops.net (m0360083.ppops.net [127.0.0.1]) by pps.reinject (8.18.0.8/8.18.0.8) with ESMTP id 54LAsMH6025326; Wed, 21 May 2025 10:58:13 GMT Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 46sbph0j2g-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 21 May 2025 10:58:13 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 54L9gx4T010640; Wed, 21 May 2025 10:58:11 GMT Received: from smtprelay04.fra02v.mail.ibm.com ([9.218.2.228]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 46rwnmbt5g-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 21 May 2025 10:58:11 +0000 Received: from smtpav02.fra02v.mail.ibm.com (smtpav02.fra02v.mail.ibm.com [10.20.54.101]) by smtprelay04.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 54LAw7m130147158 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 21 May 2025 10:58:07 GMT Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 938C920043; Wed, 21 May 2025 10:58:07 +0000 (GMT) Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 3B88D20040; Wed, 21 May 2025 10:58:05 +0000 (GMT) Received: from li-fc74f8cc-3279-11b2-a85c-ef5828687581.in.ibm.com (unknown [9.204.203.112]) by smtpav02.fra02v.mail.ibm.com (Postfix) with ESMTP; Wed, 21 May 2025 10:58:05 +0000 (GMT) From: Srish Srinivasan To: linux-integrity@vger.kernel.org, linuxppc-dev@lists.ozlabs.org Cc: maddy@linux.ibm.com, mpe@ellerman.id.au, npiggin@gmail.com, christophe.leroy@csgroup.eu, naveen@kernel.org, ajd@linux.ibm.com, zohar@linux.ibm.com, nayna@linux.ibm.com, linux-kernel@vger.kernel.org Subject: [PATCH v2 2/3] powerpc/secvar: Expose secvars relevant to the key management mode Date: Wed, 21 May 2025 16:27:58 +0530 Message-ID: <20250521105759.8408-3-ssrish@linux.ibm.com> X-Mailer: git-send-email 2.49.0 In-Reply-To: <20250521105759.8408-1-ssrish@linux.ibm.com> References: <20250521105759.8408-1-ssrish@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwNTIxMDEwNSBTYWx0ZWRfXxj+Kr/SU8DGu 7cCuWAgvM3Wh88Nc9JjXMxjU5hz4F3VBsgjEKA2jQyrfRJFwRqsAsBJ/8SEzmCUi+DyVsOMoA6T ibhivpF6lol5UhjPIDQRNTpFGpb4aF7N8r/CtBHNg/ApAtu9oppIRpsJjKJi2dd8PcMjyeCzMcY 7QgcG8Y/jrxIEUGcS+2GRCDF71UNHtj70XXyjMJRiNtsZiB/cwnsYZ6LWNfDsnyfvAVqLPfUb2W TFF2ig7rkfHWPPWi8VhoNaXD2B/IKiap+XXxOydwsyCfhAWB5MUQlExMiatXq937BYcrJj4BvWT 3v94iLAS5Kck5RtFHhX6q6rZz+PSEeOlY67NMn4n866ElpK0yIvF/LYnAcJr3mwJTjQgLvZjBhH 0Vn1sWCmFmUl8SILKBoZryWG3jmVNy+HRIj+RImKLn20sZYXjVuFbgmgpR7DEt8kQrvxh5mI X-Proofpoint-ORIG-GUID: Vww7UlYtzeEycHD7TKb6YTyr59h6E1Iq X-Authority-Analysis: v=2.4 cv=L5kdQ/T8 c=1 sm=1 tr=0 ts=682db1c5 cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=dt9VzEwgFbYA:10 a=VnNF1IyMAAAA:8 a=tLxTvSBFvjwC67ZwczkA:9 X-Proofpoint-GUID: GHnn0WbiKF2p2z2DrVtQ5F2IFlZ2RgHo X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.0.736,FMLib:17.12.80.40 definitions=2025-05-21_03,2025-05-20_03,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 priorityscore=1501 lowpriorityscore=0 spamscore=0 clxscore=1015 mlxlogscore=999 suspectscore=0 phishscore=0 impostorscore=0 malwarescore=0 mlxscore=0 bulkscore=0 classifier=spam authscore=0 authtc=n/a authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2505160000 definitions=main-2505210105 Content-Type: text/plain; charset="utf-8" The PLPKS enabled PowerVM LPAR sysfs exposes all of the secure boot secvars irrespective of the key management mode. The PowerVM LPAR supports static and dynamic key management for secure boot. The key management option can be updated in the management console. Only in the dynamic key mode can the user modify the secure boot secvars db, dbx, grubdb, grubdbx, and sbat, which are exposed via the sysfs interface. But the sysfs interface exposes these secvars even in the static key mode. This could lead to errors when reading them or writing to them in the static key mode. Expose only PK, trustedcadb, and moduledb in the static key mode to enable loading of signed third-party kernel modules. Co-developed-by: Souradeep Signed-off-by: Souradeep Signed-off-by: Srish Srinivasan Reviewed-by: Mimi Zohar Reviewed-by: Stefan Berger Reviewed-by: Nayna Jain Reviewed-by: Andrew Donnellan --- Documentation/ABI/testing/sysfs-secvar | 6 ++++ arch/powerpc/platforms/pseries/plpks-secvar.c | 28 ++++++++++++++++--- 2 files changed, 30 insertions(+), 4 deletions(-) diff --git a/Documentation/ABI/testing/sysfs-secvar b/Documentation/ABI/tes= ting/sysfs-secvar index 45281888e520..948df3446a03 100644 --- a/Documentation/ABI/testing/sysfs-secvar +++ b/Documentation/ABI/testing/sysfs-secvar @@ -37,6 +37,12 @@ Description: Each secure variable is represented as a di= rectory named as representation. The data and size can be determined by reading their respective attribute files. =20 + Only secvars relevant to the key management mode are exposed. + Only in the dynamic key mode can the user modify the secure boot + secvars db, dbx, grubdb, grubdbx, and sbat. PK, trustedcadb and + moduledb are the secvars common to both static and dynamic key + management modes. + What: /sys/firmware/secvar/vars//size Date: August 2019 Contact: Nayna Jain diff --git a/arch/powerpc/platforms/pseries/plpks-secvar.c b/arch/powerpc/p= latforms/pseries/plpks-secvar.c index 767e5e8c6990..f9e9cc40c9d0 100644 --- a/arch/powerpc/platforms/pseries/plpks-secvar.c +++ b/arch/powerpc/platforms/pseries/plpks-secvar.c @@ -59,7 +59,14 @@ static u32 get_policy(const char *name) return PLPKS_SIGNEDUPDATE; } =20 -static const char * const plpks_var_names[] =3D { +static const char * const plpks_var_names_static[] =3D { + "PK", + "moduledb", + "trustedcadb", + NULL, +}; + +static const char * const plpks_var_names_dynamic[] =3D { "PK", "KEK", "db", @@ -213,21 +220,34 @@ static int plpks_max_size(u64 *max_size) return 0; } =20 +static const struct secvar_operations plpks_secvar_ops_static =3D { + .get =3D plpks_get_variable, + .set =3D plpks_set_variable, + .format =3D plpks_secvar_format, + .max_size =3D plpks_max_size, + .config_attrs =3D config_attrs, + .var_names =3D plpks_var_names_static, +}; =20 -static const struct secvar_operations plpks_secvar_ops =3D { +static const struct secvar_operations plpks_secvar_ops_dynamic =3D { .get =3D plpks_get_variable, .set =3D plpks_set_variable, .format =3D plpks_secvar_format, .max_size =3D plpks_max_size, .config_attrs =3D config_attrs, - .var_names =3D plpks_var_names, + .var_names =3D plpks_var_names_dynamic, }; =20 static int plpks_secvar_init(void) { + u8 mode; + if (!plpks_is_available()) return -ENODEV; =20 - return set_secvar_ops(&plpks_secvar_ops); + mode =3D plpks_get_sb_keymgmt_mode(); + if (mode) + return set_secvar_ops(&plpks_secvar_ops_dynamic); + return set_secvar_ops(&plpks_secvar_ops_static); } machine_device_initcall(pseries, plpks_secvar_init); --=20 2.47.1 From nobody Wed Dec 17 03:13:16 2025 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3F6432620FC; Wed, 21 May 2025 10:58:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747825115; cv=none; b=aHZTQzQWx7yhAIJnCB3/C80r5CG0Im6IRC91m8Nhmnf0i6VNdnrXNWgT6bDBYYGTE/NoEyDHqhFS45/+H7H4OkNoRtUC4/q8/yOAAD7Pwuw4L+/+0uhTFdVEP1A+2fMPXrqB4+aOQU0Nvc/PxR1pQdMQRplg5DCZmBlP2eu+Yw8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1747825115; c=relaxed/simple; bh=WH8RQf6bUZn016PysqDM75R3nB09GwE/tGFYUasp/ww=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=oCE8d0d7iR/IgG8HHFejYh9KiDJUZ9RlM88khjAPAHV+JUMukLsY1COE0G4oBBd2WzZP6DEG01zOBpBKdLrMgKu2hiD8yBrBgfYczwCSpoo6Y77p5dPBEI2RAgrG/F9FJ6ATdNaeZgRYjbO5WuC0q/LRk+teuxvyjnNlpEaGWis= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=Ft9qK69F; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="Ft9qK69F" Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 54L8pRJE014308; Wed, 21 May 2025 10:58:16 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=qwvXwgQXJIkG0QGSj 4RsHe537NK9WFzkfnyk5v2o2AI=; b=Ft9qK69Fuso5iibjRn/GxJn8vISX62iBk fuS9F+p1k9VAxxn06YI2lW8xzYpu0tan/+A9O4fkuX2+Azc9p9/Wt8jXcc2cDgyt J0j0/mLHL7UNhcPyr168gLDkZjurfV/BJ/iOadPFqSM+AWJcsanRFH5htPnjmZ0N jfNbrZlbHYYGWmogsgbTtvook0WotKBhl/3mdVUdaU77Uq5Bj7rxMs4hssR2/n3u WfYoMJ31PguNwnO0zgMkdX2l4LOSB8lE6qif7McX62hPEB+7/RgKoRLyh+Z1qf7T snGO6WUdblhTe7tJl5dRtunAJHZ2Arf+E7Kw4vdOfLJoRWrhX4ySg== Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 46sbph0j2y-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 21 May 2025 10:58:16 +0000 (GMT) Received: from m0360083.ppops.net (m0360083.ppops.net [127.0.0.1]) by pps.reinject (8.18.0.8/8.18.0.8) with ESMTP id 54LArXmJ023166; Wed, 21 May 2025 10:58:15 GMT Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 46sbph0j2t-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 21 May 2025 10:58:15 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 54L9d7a5031996; Wed, 21 May 2025 10:58:14 GMT Received: from smtprelay05.fra02v.mail.ibm.com ([9.218.2.225]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 46rwmq3t9e-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 21 May 2025 10:58:14 +0000 Received: from smtpav02.fra02v.mail.ibm.com (smtpav02.fra02v.mail.ibm.com [10.20.54.101]) by smtprelay05.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 54LAwA6P54460686 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 21 May 2025 10:58:10 GMT Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5978520043; Wed, 21 May 2025 10:58:10 +0000 (GMT) Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id DDEDC20040; Wed, 21 May 2025 10:58:07 +0000 (GMT) Received: from li-fc74f8cc-3279-11b2-a85c-ef5828687581.in.ibm.com (unknown [9.204.203.112]) by smtpav02.fra02v.mail.ibm.com (Postfix) with ESMTP; Wed, 21 May 2025 10:58:07 +0000 (GMT) From: Srish Srinivasan To: linux-integrity@vger.kernel.org, linuxppc-dev@lists.ozlabs.org Cc: maddy@linux.ibm.com, mpe@ellerman.id.au, npiggin@gmail.com, christophe.leroy@csgroup.eu, naveen@kernel.org, ajd@linux.ibm.com, zohar@linux.ibm.com, nayna@linux.ibm.com, linux-kernel@vger.kernel.org Subject: [PATCH v2 3/3] integrity/platform_certs: Allow loading of keys in the static key management mode Date: Wed, 21 May 2025 16:27:59 +0530 Message-ID: <20250521105759.8408-4-ssrish@linux.ibm.com> X-Mailer: git-send-email 2.49.0 In-Reply-To: <20250521105759.8408-1-ssrish@linux.ibm.com> References: <20250521105759.8408-1-ssrish@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwNTIxMDEwNSBTYWx0ZWRfX3GkG9UUHZUy9 livt8OcJDQIVDJMd/MNG3TiU2jLdlkx4oKtyR98xTsZPuEJJcnbUK+hUVW4bbIrAdauk6TrtVr2 TKfCYyqGw8Iw1JIaRf5Aj8vyhN3zu3y2skpU/1+yn+zYR0FkomTc/M3Xkw8ByX1mGUCVqLOAUYo +ZXyi8P0bO62OISNuYgyCBKaEQ43i3C4l9Ejad9HRFAs0oMYVRNTSSxlcQyce7DmmEs335017TK bOo4QOmmGu+tuarqxNm+qNIu2sotwo2gRjNBhOKio9+5pZb5U9/L7DSKkjIXJx/YKgFUPinUY/T 2VCQ4riJV0BvsXZT5S7CXKKyu3FpKpX6lXnMLmYpj+xV2HKCrfOMpfz6kLxKZltthkoo4x/xXSv t1WGhcCqofAQWpL5OiwgWw68sZue9gpwkq8x16QxLGEYyS9+Je9SY8n27fuT6F+5PQUb3zbP X-Proofpoint-ORIG-GUID: ZEowoLJegkq3_yvN2FQDjrR4hOkpLnUy X-Authority-Analysis: v=2.4 cv=L5kdQ/T8 c=1 sm=1 tr=0 ts=682db1c8 cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=dt9VzEwgFbYA:10 a=VnNF1IyMAAAA:8 a=AtMIOgTZpS777Q0Lz8kA:9 X-Proofpoint-GUID: 2iT4jmr_S-xxe10ezReX3mPakJehOwXr X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.0.736,FMLib:17.12.80.40 definitions=2025-05-21_03,2025-05-20_03,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 adultscore=0 priorityscore=1501 lowpriorityscore=0 spamscore=0 clxscore=1015 mlxlogscore=999 suspectscore=0 phishscore=0 impostorscore=0 malwarescore=0 mlxscore=0 bulkscore=0 classifier=spam authscore=0 authtc=n/a authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2505160000 definitions=main-2505210105 Content-Type: text/plain; charset="utf-8" On PLPKS enabled PowerVM LPAR, there is no provision to load signed third-party kernel modules when the key management mode is static. This is because keys from secure boot secvars are only loaded when the key management mode is dynamic. Allow loading of the trustedcadb and moduledb keys even in the static key management mode, where the secvar format string takes the form "ibm,plpks-sb-v0". Signed-off-by: Srish Srinivasan Reviewed-by: Mimi Zohar Reviewed-by: Stefan Berger Reviewed-by: Nayna Jain Reviewed-by: Andrew Donnellan --- security/integrity/platform_certs/load_powerpc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/security/integrity/platform_certs/load_powerpc.c b/security/in= tegrity/platform_certs/load_powerpc.c index c85febca3343..714c961a00f5 100644 --- a/security/integrity/platform_certs/load_powerpc.c +++ b/security/integrity/platform_certs/load_powerpc.c @@ -75,12 +75,13 @@ static int __init load_powerpc_certs(void) return -ENODEV; =20 // Check for known secure boot implementations from OPAL or PLPKS - if (strcmp("ibm,edk2-compat-v1", buf) && strcmp("ibm,plpks-sb-v1", buf)) { + if (strcmp("ibm,edk2-compat-v1", buf) && strcmp("ibm,plpks-sb-v1", buf) && + strcmp("ibm,plpks-sb-v0", buf)) { pr_err("Unsupported secvar implementation \"%s\", not loading certs\n", = buf); return -ENODEV; } =20 - if (strcmp("ibm,plpks-sb-v1", buf) =3D=3D 0) + if (strcmp("ibm,plpks-sb-v1", buf) =3D=3D 0 || strcmp("ibm,plpks-sb-v0", = buf) =3D=3D 0) /* PLPKS authenticated variables ESL data is prefixed with 8 bytes of ti= mestamp */ offset =3D 8; =20 --=20 2.47.1