From nobody Sat Feb 7 16:46:41 2026 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D44AB27FD5D; Tue, 3 Jun 2025 09:58:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1748944685; cv=none; b=AtKn00KW+DCQAU3kUop2FMeoSiRv/fSjK/qZRE5T/bGfchWueRXQj190UvdU/ZCDCY8nS3B67QadfZ+SMUVql3j101fG8q19jzPFZ4Ij3qscneXhzj6pcwqn+DGGIgcHw13S2lx1uK9zsn4DN7Of+F6Wqhm166v7KWBt/Yrpemo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1748944685; c=relaxed/simple; bh=iM3m2zP+VBhWyWq7DNfWMJcMtnrc3pPdT5+05lOfW9Y=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Re8km1NIa3IyoLeSeWkzGBT0xUSOW+2MNeLy8UALO9eRfekVFnFtuurn+cA1u7LT95ex2/+kWCCsUtP4iVTFGj0+eUzs2BpQd5QowI5bXGr5nKhLW1sR0s24D2Z7yhMqKZF0/lYfhD7lrkCjQlkkNJul282SfVLE/DBfMlC4J18= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=PkhVd2Ud; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="PkhVd2Ud" Received: from pps.filterd (m0360083.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 553836Df019729; Tue, 3 Jun 2025 09:57:49 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=wmzFqBJbcjrL+CWfY 0ZbYCONlwyjWQK7JNaPcqkMwyw=; b=PkhVd2UdwIGFunXvbttTUKd4wDB/b0sm4 MJ85iSuoYEQwl5Sd5QrVCJhBcW/p+c5hjyv6ogPSeg4p2zmEIO2bFGjWyZjHjDCb FZLYpojxeg99aC0o8D63D94EHXUew+hMicaTnDIw4sfUp7fZPr8wW6PiFhC4Ssb+ jGtOPjsIUMGb0kq6FL3Saqw5toqAvQ+QCaKcJogfuR2ThaIZrGCaxpwoW9I6SgB5 jz0JtHM/YgqVahWeG8LtwXzomKKMRc554MAKibFFDGSCTpCoKfXJJSTxxQgDW070 LJKKxwytS0ImEar48K/02B6w05j1JTrwBSnfCQB9zovHmNMYRVykQ== Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 471geykmwc-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 03 Jun 2025 09:57:48 +0000 (GMT) Received: from m0360083.ppops.net (m0360083.ppops.net [127.0.0.1]) by pps.reinject (8.18.0.8/8.18.0.8) with ESMTP id 5539sInB027153; Tue, 3 Jun 2025 09:57:48 GMT Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 471geykmw4-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 03 Jun 2025 09:57:48 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 5535II2e022530; Tue, 3 Jun 2025 09:57:47 GMT Received: from smtprelay01.fra02v.mail.ibm.com ([9.218.2.227]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 470c3tacrm-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 03 Jun 2025 09:57:47 +0000 Received: from smtpav07.fra02v.mail.ibm.com (smtpav07.fra02v.mail.ibm.com [10.20.54.106]) by smtprelay01.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 5539vhjZ56885592 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 3 Jun 2025 09:57:43 GMT Received: from smtpav07.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 5E12220040; Tue, 3 Jun 2025 09:57:43 +0000 (GMT) Received: from smtpav07.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8C4462004D; Tue, 3 Jun 2025 09:57:40 +0000 (GMT) Received: from li-fc74f8cc-3279-11b2-a85c-ef5828687581.in.ibm.com (unknown [9.204.203.112]) by smtpav07.fra02v.mail.ibm.com (Postfix) with ESMTP; Tue, 3 Jun 2025 09:57:40 +0000 (GMT) From: Srish Srinivasan To: linux-integrity@vger.kernel.org, linuxppc-dev@lists.ozlabs.org Cc: maddy@linux.ibm.com, mpe@ellerman.id.au, npiggin@gmail.com, christophe.leroy@csgroup.eu, naveen@kernel.org, ajd@linux.ibm.com, zohar@linux.ibm.com, nayna@linux.ibm.com, rnsastry@linux.ibm.com, linux-kernel@vger.kernel.org Subject: [PATCH v3 1/3] powerpc/pseries: Correct secvar format representation for static key management Date: Tue, 3 Jun 2025 15:27:34 +0530 Message-ID: <20250603095736.99007-2-ssrish@linux.ibm.com> X-Mailer: git-send-email 2.49.0 In-Reply-To: <20250603095736.99007-1-ssrish@linux.ibm.com> References: <20250603095736.99007-1-ssrish@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=Pq2TbxM3 c=1 sm=1 tr=0 ts=683ec71c cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=6IFa9wvqVegA:10 a=VnNF1IyMAAAA:8 a=FNRAjOYsECM2cVzVVdoA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwNjAzMDA3OCBTYWx0ZWRfX24Dt9kdk0mi/ +gTkdg5SNgvkZOiN84fULAOwI9jI1s+bp5zHjisOCv5Ia+gX1bZPZj1tjFVszOck+ulVVh6J9g2 O1kALwUoN3RwStV2ETvoH+qTTwze+kwh4GOCZvdgsAIer71t3J6z4FJ5chd6YodN7YgfFAzHUFe eAf1sr7OB7zfulT9j10vfmc6HF3X2oCudhcVEvKY3yTO2ejXYjzyaFjs7qO2uLw6Ph2gpb0ROQ5 Qz8TSIkgK8nTNbF015arbHF375ipsyKZfDRvTD5I6XTvU3waGOwwxJZDlv06TYQhkrBIp1SY1bi ZdPQH5FW8R9QvEkRIRTI5HMZ6+EYBnJRf83mmtwrg/rCvlRbH8bAdlSqGIp3N2kHWJrP5Rd4NP5 YJ5DuK9v6mN0FCod9UiEGPgmZglnfVncqqyEvYbjjLSqrFf4e0bQuX8IO70tmWED6y5CFey8 X-Proofpoint-GUID: edzYsGddDcnJmr5AjWJHG-pJFPdI6BUK X-Proofpoint-ORIG-GUID: dD96C7PSr-dR13T_96mb_5395dLUa6u2 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.0.736,FMLib:17.12.80.40 definitions=2025-06-03_01,2025-06-02_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 lowpriorityscore=0 clxscore=1015 malwarescore=0 mlxlogscore=999 phishscore=0 bulkscore=0 spamscore=0 suspectscore=0 priorityscore=1501 mlxscore=0 adultscore=0 classifier=spam authscore=0 authtc=n/a authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2505280000 definitions=main-2506030078 Content-Type: text/plain; charset="utf-8" On a PLPKS enabled PowerVM LPAR, the secvar format property for static key management is misrepresented as "ibm,plpks-sb-unknown", creating reason for confusion. Static key management mode uses fixed, built-in keys. Dynamic key management mode allows keys to be updated in production to handle security updates without firmware rebuilds. Define a function named plpks_get_sb_keymgmt_mode() to retrieve the key management mode based on the existence of the SB_VERSION property in the firmware. Set the secvar format property to either "ibm,plpks-sb-v" or "ibm,plpks-sb-v0" based on the key management mode, and return the length of the secvar format property. Co-developed-by: Souradeep Signed-off-by: Souradeep Signed-off-by: Srish Srinivasan Reviewed-by: Mimi Zohar Reviewed-by: Stefan Berger Reviewed-by: Nayna Jain Reviewed-by: Andrew Donnellan --- Documentation/ABI/testing/sysfs-secvar | 10 ++- arch/powerpc/platforms/pseries/plpks-secvar.c | 76 +++++++++++-------- 2 files changed, 53 insertions(+), 33 deletions(-) diff --git a/Documentation/ABI/testing/sysfs-secvar b/Documentation/ABI/tes= ting/sysfs-secvar index 857cf12b0904..f001a4f4bd2e 100644 --- a/Documentation/ABI/testing/sysfs-secvar +++ b/Documentation/ABI/testing/sysfs-secvar @@ -22,9 +22,13 @@ Description: A string indicating which backend is in use= by the firmware. and is expected to be "ibm,edk2-compat-v1". =20 On pseries/PLPKS, this is generated by the kernel based on the - version number in the SB_VERSION variable in the keystore, and - has the form "ibm,plpks-sb-v", or - "ibm,plpks-sb-unknown" if there is no SB_VERSION variable. + version number in the SB_VERSION variable in the keystore. The + version numbering in the SB_VERSION variable starts from 1. The + format string takes the form "ibm,plpks-sb-v" in the + case of dynamic key management mode. If the SB_VERSION variable + does not exist (or there is an error while reading it), it takes + the form "ibm,plpks-sb-v0", indicating that the key management + mode is static. =20 What: /sys/firmware/secvar/vars/ Date: August 2019 diff --git a/arch/powerpc/platforms/pseries/plpks-secvar.c b/arch/powerpc/p= latforms/pseries/plpks-secvar.c index 257fd1f8bc19..767e5e8c6990 100644 --- a/arch/powerpc/platforms/pseries/plpks-secvar.c +++ b/arch/powerpc/platforms/pseries/plpks-secvar.c @@ -152,39 +152,55 @@ static int plpks_set_variable(const char *key, u64 ke= y_len, u8 *data, return rc; } =20 -// PLPKS dynamic secure boot doesn't give us a format string in the same w= ay OPAL does. -// Instead, report the format using the SB_VERSION variable in the keystor= e. -// The string is made up by us, and takes the form "ibm,plpks-sb-v" (or= "ibm,plpks-sb-unknown" -// if the SB_VERSION variable doesn't exist). Hypervisor defines the SB_VE= RSION variable as a -// "1 byte unsigned integer value". -static ssize_t plpks_secvar_format(char *buf, size_t bufsize) +/* + * Return the key management mode. + * + * SB_VERSION is defined as a "1 byte unsigned integer value", taking valu= es + * starting from 1. It is owned by the Partition Firmware and its presence + * indicates that the key management mode is dynamic. Any failure in + * reading SB_VERSION defaults the key management mode to static. The error + * codes -ENOENT or -EPERM are expected in static key management mode. An + * unexpected error code will have to be investigated. Only signed variabl= es + * have null bytes in their names, SB_VERSION does not. + * + * Return 0 to indicate that the key management mode is static. Otherwise + * return the SB_VERSION value to indicate that the key management mode is + * dynamic. + */ +static u8 plpks_get_sb_keymgmt_mode(void) { - struct plpks_var var =3D {0}; - ssize_t ret; - u8 version; - - var.component =3D NULL; - // Only the signed variables have null bytes in their names, this one doe= sn't - var.name =3D "SB_VERSION"; - var.namelen =3D strlen(var.name); - var.datalen =3D 1; - var.data =3D &version; - - // Unlike the other vars, SB_VERSION is owned by firmware instead of the = OS - ret =3D plpks_read_fw_var(&var); - if (ret) { - if (ret =3D=3D -ENOENT) { - ret =3D snprintf(buf, bufsize, "ibm,plpks-sb-unknown"); - } else { - pr_err("Error %ld reading SB_VERSION from firmware\n", ret); - ret =3D -EIO; - } - goto err; + u8 mode; + ssize_t rc; + struct plpks_var var =3D { + .component =3D NULL, + .name =3D "SB_VERSION", + .namelen =3D 10, + .datalen =3D 1, + .data =3D &mode, + }; + + rc =3D plpks_read_fw_var(&var); + if (rc) { + if (rc !=3D -ENOENT && rc !=3D -EPERM) + pr_info("Error %ld reading SB_VERSION from firmware\n", rc); + mode =3D 0; } + return mode; +} =20 - ret =3D snprintf(buf, bufsize, "ibm,plpks-sb-v%hhu", version); -err: - return ret; +/* + * PLPKS dynamic secure boot doesn't give us a format string in the same w= ay + * OPAL does. Instead, report the format using the SB_VERSION variable in = the + * keystore. The string, made up by us, takes the form of either + * "ibm,plpks-sb-v" or "ibm,plpks-sb-v0", based on the key management m= ode, + * and return the length of the secvar format property. + */ +static ssize_t plpks_secvar_format(char *buf, size_t bufsize) +{ + u8 mode; + + mode =3D plpks_get_sb_keymgmt_mode(); + return snprintf(buf, bufsize, "ibm,plpks-sb-v%hhu", mode); } =20 static int plpks_max_size(u64 *max_size) --=20 2.47.1 From nobody Sat Feb 7 16:46:41 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 98F852820BF; Tue, 3 Jun 2025 09:58:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1748944689; cv=none; b=QCa3w0vx+iVWFrwiZjIZTEBd+xDwkOD2aJ4jQXyP65fafIG7rWX8pkOYYP2k2FyQEOzgC+adMhBmkoildfCIIOhoJdAOxNDcVp+Nk6DunJJDkQ/BBh+qRsuw+YWaJ5EaK+py2yjDpbAzHmTuTViGlndsUiJt9/JF1B9vLzcTmvw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1748944689; c=relaxed/simple; bh=zrtXWZ5RJ4CLgoqCXafi32Ynxjt+ZIYjpAxJJAxv2SE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=pe7JNL/eiLHdIjHtHW7wAkfpqMvUje/o9jrjMKhjNv+VgvzZ4wBnIJ1km88Zf6E6vpUr8FH7goHyzz6a8S5LEtCmydX2+oTAhNDexpIZ2d1YljcITa//QMOvoqW1B0uWDMxCa8717VHc/w9KuAr5NFz71rHM11dTLQEu3iYhL2Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=H0kS8rzk; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="H0kS8rzk" Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 5535FLGY031521; Tue, 3 Jun 2025 09:57:54 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=aN2L+QD9iiyXLrjHz dhll0BOIFPz9sA1t35IhWtYHiU=; b=H0kS8rzkMb/XrjkqCp1zpxPQZawglJuMR iqMydBLtHzwhqT037sZx7yOFOheQNde+jwmML0mlggAiB+mjkNEvm6/oLLvnLXy5 q3f20PdmcM78GJ4iIwse3x+WSvwDyWvKkK86vIwgEikjjscp5Xd56/p1+tZ/driH jxKwHrAeKnRZ8jvR9wgyugX6qvUyDM+ycR+M4UxzBr6rX4w0GvQL2/aH/Itzzf3H D65v9vXJ2/nR8cwJnVIdYYyTSE0hAqXDt36azhhyVWe1NaAPOOh8vZioQwfmbw6F 3TqN0FpP2XmXvhBg/L3oglx0KZBr3OhIOd0n2rDPUH4ljMLbd9syQ== Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 471gf03hns-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 03 Jun 2025 09:57:54 +0000 (GMT) Received: from m0353725.ppops.net (m0353725.ppops.net [127.0.0.1]) by pps.reinject (8.18.0.8/8.18.0.8) with ESMTP id 5539vr2g007835; Tue, 3 Jun 2025 09:57:53 GMT Received: from ppma23.wdc07v.mail.ibm.com (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 471gf03hnn-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 03 Jun 2025 09:57:53 +0000 (GMT) Received: from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1]) by ppma23.wdc07v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 5535duuv024899; Tue, 3 Jun 2025 09:57:53 GMT Received: from smtprelay05.fra02v.mail.ibm.com ([9.218.2.225]) by ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 470dkma3r4-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 03 Jun 2025 09:57:52 +0000 Received: from smtpav07.fra02v.mail.ibm.com (smtpav07.fra02v.mail.ibm.com [10.20.54.106]) by smtprelay05.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 5539vlsg46596464 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 3 Jun 2025 09:57:47 GMT Received: from smtpav07.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 705A72004D; Tue, 3 Jun 2025 09:57:46 +0000 (GMT) Received: from smtpav07.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B5C5F20040; Tue, 3 Jun 2025 09:57:43 +0000 (GMT) Received: from li-fc74f8cc-3279-11b2-a85c-ef5828687581.in.ibm.com (unknown [9.204.203.112]) by smtpav07.fra02v.mail.ibm.com (Postfix) with ESMTP; Tue, 3 Jun 2025 09:57:43 +0000 (GMT) From: Srish Srinivasan To: linux-integrity@vger.kernel.org, linuxppc-dev@lists.ozlabs.org Cc: maddy@linux.ibm.com, mpe@ellerman.id.au, npiggin@gmail.com, christophe.leroy@csgroup.eu, naveen@kernel.org, ajd@linux.ibm.com, zohar@linux.ibm.com, nayna@linux.ibm.com, rnsastry@linux.ibm.com, linux-kernel@vger.kernel.org Subject: [PATCH v3 2/3] powerpc/secvar: Expose secvars relevant to the key management mode Date: Tue, 3 Jun 2025 15:27:35 +0530 Message-ID: <20250603095736.99007-3-ssrish@linux.ibm.com> X-Mailer: git-send-email 2.49.0 In-Reply-To: <20250603095736.99007-1-ssrish@linux.ibm.com> References: <20250603095736.99007-1-ssrish@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: tJICFi2K2wvm58jh31xqfv7FsTSDc0Uz X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwNjAzMDA4MyBTYWx0ZWRfX/asJThoifncl XIIUHXHOmAz2rw4REXK58OFYlBYHZukuvxs7mNzhK27XjNoihvv0HLVfLKJwomJ9zlRbiDHlNGO UVCVmUVy/GccoZUxujXhxBP4XF6zeEqQM/5fbFDmkzjppa4/NY6BvS1jE37DKErukOwIE91KbMt GUxLbm7Kf0ZyE+RB4cE0nrr9KGusTj+p0hF2CSCTh1UGsNsY91RioENWbYGsKFPR9ayqosOL/Pw KXVj9gPcRQ4Isyb0RHHyDlxDdPvk3khCINOVOHxwuw0+q9NNEDLCgJS43C+/L2gBLwtWstgj+C+ BlJJmsdh85VzN+eAYE0F2V8rt1c9/NNDyr/nBFFKOu17YQ67uBOD9CvxPY2YEbbOkMVk+1WJ1YB D3a2X2/2yGnlE8FsXe9qpUO/dF3qwHywFLLRDTteZX9yCOGIGT6McRs0V88fyRekeGM6Gfpu X-Proofpoint-ORIG-GUID: CtHEvqjboBysUFxb-c28F7Jty0ws_Vy9 X-Authority-Analysis: v=2.4 cv=c+WrQQ9l c=1 sm=1 tr=0 ts=683ec722 cx=c_pps a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17 a=6IFa9wvqVegA:10 a=VnNF1IyMAAAA:8 a=tLxTvSBFvjwC67ZwczkA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.0.736,FMLib:17.12.80.40 definitions=2025-06-03_01,2025-06-02_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 mlxscore=0 spamscore=0 priorityscore=1501 mlxlogscore=999 phishscore=0 adultscore=0 clxscore=1015 lowpriorityscore=0 malwarescore=0 suspectscore=0 bulkscore=0 impostorscore=0 classifier=spam authscore=0 authtc=n/a authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2505280000 definitions=main-2506030083 Content-Type: text/plain; charset="utf-8" The PLPKS enabled PowerVM LPAR sysfs exposes all of the secure boot secvars irrespective of the key management mode. The PowerVM LPAR supports static and dynamic key management for secure boot. The key management option can be updated in the management console. Only in the dynamic key mode can the user modify the secure boot secvars db, dbx, grubdb, grubdbx, and sbat, which are exposed via the sysfs interface. But the sysfs interface exposes these secvars even in the static key mode. This could lead to errors when reading them or writing to them in the static key mode. Expose only PK, trustedcadb, and moduledb in the static key mode to enable loading of signed third-party kernel modules. Co-developed-by: Souradeep Signed-off-by: Souradeep Signed-off-by: Srish Srinivasan Reviewed-by: Mimi Zohar Reviewed-by: Stefan Berger Reviewed-by: Nayna Jain Reviewed-by: Andrew Donnellan --- Documentation/ABI/testing/sysfs-secvar | 6 ++++ arch/powerpc/platforms/pseries/plpks-secvar.c | 28 ++++++++++++++++--- 2 files changed, 30 insertions(+), 4 deletions(-) diff --git a/Documentation/ABI/testing/sysfs-secvar b/Documentation/ABI/tes= ting/sysfs-secvar index f001a4f4bd2e..0df2979e27f8 100644 --- a/Documentation/ABI/testing/sysfs-secvar +++ b/Documentation/ABI/testing/sysfs-secvar @@ -38,6 +38,12 @@ Description: Each secure variable is represented as a di= rectory named as representation. The data and size can be determined by reading their respective attribute files. =20 + Only secvars relevant to the key management mode are exposed. + Only in the dynamic key mode can the user modify the secure boot + secvars db, dbx, grubdb, grubdbx, and sbat. PK, trustedcadb and + moduledb are the secvars common to both static and dynamic key + management modes. + What: /sys/firmware/secvar/vars//size Date: August 2019 Contact: Nayna Jain diff --git a/arch/powerpc/platforms/pseries/plpks-secvar.c b/arch/powerpc/p= latforms/pseries/plpks-secvar.c index 767e5e8c6990..f9e9cc40c9d0 100644 --- a/arch/powerpc/platforms/pseries/plpks-secvar.c +++ b/arch/powerpc/platforms/pseries/plpks-secvar.c @@ -59,7 +59,14 @@ static u32 get_policy(const char *name) return PLPKS_SIGNEDUPDATE; } =20 -static const char * const plpks_var_names[] =3D { +static const char * const plpks_var_names_static[] =3D { + "PK", + "moduledb", + "trustedcadb", + NULL, +}; + +static const char * const plpks_var_names_dynamic[] =3D { "PK", "KEK", "db", @@ -213,21 +220,34 @@ static int plpks_max_size(u64 *max_size) return 0; } =20 +static const struct secvar_operations plpks_secvar_ops_static =3D { + .get =3D plpks_get_variable, + .set =3D plpks_set_variable, + .format =3D plpks_secvar_format, + .max_size =3D plpks_max_size, + .config_attrs =3D config_attrs, + .var_names =3D plpks_var_names_static, +}; =20 -static const struct secvar_operations plpks_secvar_ops =3D { +static const struct secvar_operations plpks_secvar_ops_dynamic =3D { .get =3D plpks_get_variable, .set =3D plpks_set_variable, .format =3D plpks_secvar_format, .max_size =3D plpks_max_size, .config_attrs =3D config_attrs, - .var_names =3D plpks_var_names, + .var_names =3D plpks_var_names_dynamic, }; =20 static int plpks_secvar_init(void) { + u8 mode; + if (!plpks_is_available()) return -ENODEV; =20 - return set_secvar_ops(&plpks_secvar_ops); + mode =3D plpks_get_sb_keymgmt_mode(); + if (mode) + return set_secvar_ops(&plpks_secvar_ops_dynamic); + return set_secvar_ops(&plpks_secvar_ops_static); } machine_device_initcall(pseries, plpks_secvar_init); --=20 2.47.1 From nobody Sat Feb 7 16:46:41 2026 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 84B66283FF9; Tue, 3 Jun 2025 09:58:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1748944690; cv=none; b=E4MVD5xwzkGW7q7hNB5np09Uwwz4oLfJNJzA84tx46otz8jq97vx6JMt9tncQ7oR58ZLgJQ0cLIcvgQsdoFmpgiQEyojZiXnXLlgWOH/yZmjGRf8+JDjp4OAN6szijG6hG16BNe6zCcvXPrrNBMeYby9JlvYFo0pI3dcUGR2Y7Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1748944690; c=relaxed/simple; bh=WH8RQf6bUZn016PysqDM75R3nB09GwE/tGFYUasp/ww=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=b6k/whdos8o+MuAm42zhoW17Qx6iqgzFCPHfCpem6Y7NVfhBNcKi1xMeBTGUrqPQpL3PCIy8DOksYxDweNRKRjb/wBcssQKZenLbOkwCELBKtnsoGRhGOx7OJa8n74Q6k42LjgOgkma7XUFNl8afHay/Ovf4zn7LG0jETiiusnk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=AEOL+8Qx; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="AEOL+8Qx" Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 5534d8Il000689; Tue, 3 Jun 2025 09:57:55 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=qwvXwgQXJIkG0QGSj 4RsHe537NK9WFzkfnyk5v2o2AI=; b=AEOL+8QxQt+Zrax5XBMmylvX7mzzYt4LM RhE1iXRLzjb//M06WV0Z2HAEFHb6i4DOvQGHS6KusfY9x993HBnYYYDNTmd/8hT1 UcPSsR1IZtEQEqAnpS12Lsivy4TPBDOzvfXMOOwJniELm3VnKr7NV8TJ41QDAo93 YNuTw8wbI8dOwtZCyYlrgcXZncE4Bp6oznI0iJijV+WwEha7gX+Balr72mmb4AvE skXGV586vsJrs2UcjjG71Pb5TPZFi8MN3h2qKEYvhSsNjscG5Al81hw7aJSWT/WK xPp6L1yf5Q7TkP5Uya0rAf3JTxLIn47Pp2Cvo21kkn8JF2094Wdzg== Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 471gf03hnw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 03 Jun 2025 09:57:55 +0000 (GMT) Received: from m0353725.ppops.net (m0353725.ppops.net [127.0.0.1]) by pps.reinject (8.18.0.8/8.18.0.8) with ESMTP id 5539aCUg025256; Tue, 3 Jun 2025 09:57:54 GMT Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 471gf03hnt-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 03 Jun 2025 09:57:54 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 5535RMEV019873; Tue, 3 Jun 2025 09:57:54 GMT Received: from smtprelay02.fra02v.mail.ibm.com ([9.218.2.226]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 470d3nt75d-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 03 Jun 2025 09:57:53 +0000 Received: from smtpav07.fra02v.mail.ibm.com (smtpav07.fra02v.mail.ibm.com [10.20.54.106]) by smtprelay02.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 5539vnta46662098 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 3 Jun 2025 09:57:50 GMT Received: from smtpav07.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9A5AC2004D; Tue, 3 Jun 2025 09:57:49 +0000 (GMT) Received: from smtpav07.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id BB9CE20040; Tue, 3 Jun 2025 09:57:46 +0000 (GMT) Received: from li-fc74f8cc-3279-11b2-a85c-ef5828687581.in.ibm.com (unknown [9.204.203.112]) by smtpav07.fra02v.mail.ibm.com (Postfix) with ESMTP; Tue, 3 Jun 2025 09:57:46 +0000 (GMT) From: Srish Srinivasan To: linux-integrity@vger.kernel.org, linuxppc-dev@lists.ozlabs.org Cc: maddy@linux.ibm.com, mpe@ellerman.id.au, npiggin@gmail.com, christophe.leroy@csgroup.eu, naveen@kernel.org, ajd@linux.ibm.com, zohar@linux.ibm.com, nayna@linux.ibm.com, rnsastry@linux.ibm.com, linux-kernel@vger.kernel.org Subject: [PATCH v3 3/3] integrity/platform_certs: Allow loading of keys in the static key management mode Date: Tue, 3 Jun 2025 15:27:36 +0530 Message-ID: <20250603095736.99007-4-ssrish@linux.ibm.com> X-Mailer: git-send-email 2.49.0 In-Reply-To: <20250603095736.99007-1-ssrish@linux.ibm.com> References: <20250603095736.99007-1-ssrish@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-GUID: k7BGXRP6qLCd5wkz9DgtxlUZ3WpFPrgB X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwNjAzMDA4MyBTYWx0ZWRfX0Yvv+lOciByz iYBFUyGXkXVUWC35EULbkvkDkoVG+bc9NJt5xT6Ojvf1yQSDbKAiIRmnvPhxT4t7W0ctJNQOnDT 6icjWJqHPw+gWOI4KAODSFjR78AVr3iSaVRNbv5pL3lS5zgwqdosrpoFQc/2tWVHynmwDk7in2s wGwPC2K4Znj5d6fg9sm1zO2Na9VmGGgwpnxvKIb16jyrcXQv29NDi6rpOPr1U13btBmRlIHalJo XM4wv8quUfXfi0v0nDj5dje2VovSjnmLFR3JOQPLdF5oRIdfBLFux/4uriXQFWxHmDiYGXSUkOg z6KFx58IJwu5qjbDZPGm8nwW7/3JKlOWV20DXDX8MSSiXJ/gTImXTDCBGCxRiFnrntFj2K5X0UC 0ZdfoAaD5Ojsj4F7SrraKF+ivEf/7DuAIsM2tw06H4HK8UmRK7jXjVIiuBo3szynFZziEfUz X-Proofpoint-ORIG-GUID: XRA8SA7UjyBlR1MLEP4gI_GefYfVtAY0 X-Authority-Analysis: v=2.4 cv=c+WrQQ9l c=1 sm=1 tr=0 ts=683ec723 cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=6IFa9wvqVegA:10 a=VnNF1IyMAAAA:8 a=AtMIOgTZpS777Q0Lz8kA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.0.736,FMLib:17.12.80.40 definitions=2025-06-03_01,2025-06-02_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 mlxscore=0 spamscore=0 priorityscore=1501 mlxlogscore=999 phishscore=0 adultscore=0 clxscore=1015 lowpriorityscore=0 malwarescore=0 suspectscore=0 bulkscore=0 impostorscore=0 classifier=spam authscore=0 authtc=n/a authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2505280000 definitions=main-2506030083 Content-Type: text/plain; charset="utf-8" On PLPKS enabled PowerVM LPAR, there is no provision to load signed third-party kernel modules when the key management mode is static. This is because keys from secure boot secvars are only loaded when the key management mode is dynamic. Allow loading of the trustedcadb and moduledb keys even in the static key management mode, where the secvar format string takes the form "ibm,plpks-sb-v0". Signed-off-by: Srish Srinivasan Reviewed-by: Mimi Zohar Reviewed-by: Stefan Berger Reviewed-by: Nayna Jain Reviewed-by: Andrew Donnellan --- security/integrity/platform_certs/load_powerpc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/security/integrity/platform_certs/load_powerpc.c b/security/in= tegrity/platform_certs/load_powerpc.c index c85febca3343..714c961a00f5 100644 --- a/security/integrity/platform_certs/load_powerpc.c +++ b/security/integrity/platform_certs/load_powerpc.c @@ -75,12 +75,13 @@ static int __init load_powerpc_certs(void) return -ENODEV; =20 // Check for known secure boot implementations from OPAL or PLPKS - if (strcmp("ibm,edk2-compat-v1", buf) && strcmp("ibm,plpks-sb-v1", buf)) { + if (strcmp("ibm,edk2-compat-v1", buf) && strcmp("ibm,plpks-sb-v1", buf) && + strcmp("ibm,plpks-sb-v0", buf)) { pr_err("Unsupported secvar implementation \"%s\", not loading certs\n", = buf); return -ENODEV; } =20 - if (strcmp("ibm,plpks-sb-v1", buf) =3D=3D 0) + if (strcmp("ibm,plpks-sb-v1", buf) =3D=3D 0 || strcmp("ibm,plpks-sb-v0", = buf) =3D=3D 0) /* PLPKS authenticated variables ESL data is prefixed with 8 bytes of ti= mestamp */ offset =3D 8; =20 --=20 2.47.1