From nobody Sat Oct 11 08:26:20 2025 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6612C283CBF; Tue, 10 Jun 2025 21:19:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1749590380; cv=none; b=REuUHh3MXxsS4QYhx5EUBofiKnRqmZaCpiE4Lhx4cycn+pmIzZcHUgBxZS/odyk7hSphOB/I+Fkhy3I1J14qFTRrQVK2ZB1SbHblIsx6FzcPhTKEQyUETKF3ugrN6k9OUq409glqJZgkXQcUAhnotd8v6ni02kiRqsQ0iPYTtSk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1749590380; c=relaxed/simple; bh=iM3m2zP+VBhWyWq7DNfWMJcMtnrc3pPdT5+05lOfW9Y=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=fP/8rx2FycP7UFcxWhvibjRMSr8hA/PE2NiI+3rtZNXviCrNTp3ureJRip2p9nNV0G96llu0WPYkwwbHUN6zGeSZGmtKuCtsUBzpo+OVgBr+sgJZWhILyF42A/soMpFOjJCQHr2flG/ONaDCRV54AGuItxjDiwPPmdMZOrquHUU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=djjF8bE5; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="djjF8bE5" Received: from pps.filterd (m0353729.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 55AIwPhi021397; Tue, 10 Jun 2025 21:19:22 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=wmzFqBJbcjrL+CWfY 0ZbYCONlwyjWQK7JNaPcqkMwyw=; b=djjF8bE5tSj2zmPaDWxJi6R0CwJ7KKEjH ZFKia4SWuQcoE6nMv/8X7KIj/23DHA8Fwt/KDLVQKlpIunhnPuVZbDxP4avZbToP Thb/T35SmVfgWp1njS8R+4vN4/vFhPgCmW+evf2aHu41C3LbWOqqOePI6eN8XxWi nGWD5iS2R+08hfmaNvmgblzmj+bwWa9dhvDKaEZiIBzkMoFpPjjUr7k3g6uw2hfw VUDAVS2IRZXCkP2qVk3A58VR5AVfiWWoLtOYRHPC/UzN/u4ln8MnDFto6PBkOpF1 6sPf8s4fEAbw2RRNAME3AfO3e1cJpe8UydBNRtrgsosmN4BGbnoBg== Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 474dv7grw7-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 10 Jun 2025 21:19:21 +0000 (GMT) Received: from m0353729.ppops.net (m0353729.ppops.net [127.0.0.1]) by pps.reinject (8.18.0.8/8.18.0.8) with ESMTP id 55ALJLpm024307; Tue, 10 Jun 2025 21:19:21 GMT Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 474dv7grw2-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 10 Jun 2025 21:19:21 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 55AJiV7I022352; Tue, 10 Jun 2025 21:19:19 GMT Received: from smtprelay07.fra02v.mail.ibm.com ([9.218.2.229]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 47504yvkfx-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 10 Jun 2025 21:19:19 +0000 Received: from smtpav02.fra02v.mail.ibm.com (smtpav02.fra02v.mail.ibm.com [10.20.54.101]) by smtprelay07.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 55ALJFMt47710598 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 10 Jun 2025 21:19:15 GMT Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 1C28320043; Tue, 10 Jun 2025 21:19:15 +0000 (GMT) Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id E478F2004E; Tue, 10 Jun 2025 21:19:11 +0000 (GMT) Received: from li-fc74f8cc-3279-11b2-a85c-ef5828687581.ibm.com.com (unknown [9.39.26.197]) by smtpav02.fra02v.mail.ibm.com (Postfix) with ESMTP; Tue, 10 Jun 2025 21:19:11 +0000 (GMT) From: Srish Srinivasan To: linux-integrity@vger.kernel.org, linuxppc-dev@lists.ozlabs.org Cc: maddy@linux.ibm.com, mpe@ellerman.id.au, npiggin@gmail.com, christophe.leroy@csgroup.eu, naveen@kernel.org, ajd@linux.ibm.com, zohar@linux.ibm.com, nayna@linux.ibm.com, rnsastry@linux.ibm.com, msuchanek@suse.de, linux-kernel@vger.kernel.org Subject: [PATCH v4 1/3] powerpc/pseries: Correct secvar format representation for static key management Date: Wed, 11 Jun 2025 02:49:05 +0530 Message-ID: <20250610211907.101384-2-ssrish@linux.ibm.com> X-Mailer: git-send-email 2.49.0 In-Reply-To: <20250610211907.101384-1-ssrish@linux.ibm.com> References: <20250610211907.101384-1-ssrish@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: wu7Yh1l6Ez2w4RlaZC1Zg3FNag7S-R38 X-Proofpoint-GUID: FWFqGftQl1wzBsRI1f94I_BCOU4hg9Mg X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwNjEwMDE3NCBTYWx0ZWRfX8aT+UVGDWCqj ihMtY6NvmbsC1onDw5P/0FD0iclkt/+k20o5YSUZ0SJzTA5KVjCRSI64juAvxcaoZRdPE/uXmIO nONTawWFscp6kSFgUlEAgLFVqHp88UouTKUd6aGgCi+5bbi4CihHromCQLYN5P/4v06zQ3Q1tS4 xmfpGmnebjws7R2u2uuryo1y474Bx4SXg/0Z/8LiWr+AUqxdoeP0/opJGgWG5Odhy2m9CmgLjrS a43pjrcULV3X0F6+X5ac/h18r3jFXyie9tA/liYRuCZGRGnzmyBq8k/+CfJ+QCCswAk+I32I0sL Efzopzb83l1swplP3SkfnrvwXpoqsrgLqW5EHhu8ONsQegSQVCXeDNi9eKFbahh5OC8ftwLaM/y tKN1lb2xADWFV1HkfDxsPiIeXfhS+3hOe5eUzvShU4JzvxsyIn48zfnJYK3Nby72wfbihrBV X-Authority-Analysis: v=2.4 cv=CfMI5Krl c=1 sm=1 tr=0 ts=6848a159 cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=6IFa9wvqVegA:10 a=VnNF1IyMAAAA:8 a=FNRAjOYsECM2cVzVVdoA:9 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.0.736,FMLib:17.12.80.40 definitions=2025-06-10_10,2025-06-10_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 spamscore=0 phishscore=0 priorityscore=1501 clxscore=1015 impostorscore=0 mlxscore=0 suspectscore=0 mlxlogscore=999 adultscore=0 malwarescore=0 lowpriorityscore=0 classifier=spam authscore=0 authtc=n/a authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2505280000 definitions=main-2506100174 Content-Type: text/plain; charset="utf-8" On a PLPKS enabled PowerVM LPAR, the secvar format property for static key management is misrepresented as "ibm,plpks-sb-unknown", creating reason for confusion. Static key management mode uses fixed, built-in keys. Dynamic key management mode allows keys to be updated in production to handle security updates without firmware rebuilds. Define a function named plpks_get_sb_keymgmt_mode() to retrieve the key management mode based on the existence of the SB_VERSION property in the firmware. Set the secvar format property to either "ibm,plpks-sb-v" or "ibm,plpks-sb-v0" based on the key management mode, and return the length of the secvar format property. Co-developed-by: Souradeep Signed-off-by: Souradeep Signed-off-by: Srish Srinivasan Reviewed-by: Mimi Zohar Reviewed-by: Stefan Berger Reviewed-by: Nayna Jain Reviewed-by: Andrew Donnellan Tested-by: R Nageswara Sastry --- Documentation/ABI/testing/sysfs-secvar | 10 ++- arch/powerpc/platforms/pseries/plpks-secvar.c | 76 +++++++++++-------- 2 files changed, 53 insertions(+), 33 deletions(-) diff --git a/Documentation/ABI/testing/sysfs-secvar b/Documentation/ABI/tes= ting/sysfs-secvar index 857cf12b0904..f001a4f4bd2e 100644 --- a/Documentation/ABI/testing/sysfs-secvar +++ b/Documentation/ABI/testing/sysfs-secvar @@ -22,9 +22,13 @@ Description: A string indicating which backend is in use= by the firmware. and is expected to be "ibm,edk2-compat-v1". =20 On pseries/PLPKS, this is generated by the kernel based on the - version number in the SB_VERSION variable in the keystore, and - has the form "ibm,plpks-sb-v", or - "ibm,plpks-sb-unknown" if there is no SB_VERSION variable. + version number in the SB_VERSION variable in the keystore. The + version numbering in the SB_VERSION variable starts from 1. The + format string takes the form "ibm,plpks-sb-v" in the + case of dynamic key management mode. If the SB_VERSION variable + does not exist (or there is an error while reading it), it takes + the form "ibm,plpks-sb-v0", indicating that the key management + mode is static. =20 What: /sys/firmware/secvar/vars/ Date: August 2019 diff --git a/arch/powerpc/platforms/pseries/plpks-secvar.c b/arch/powerpc/p= latforms/pseries/plpks-secvar.c index 257fd1f8bc19..767e5e8c6990 100644 --- a/arch/powerpc/platforms/pseries/plpks-secvar.c +++ b/arch/powerpc/platforms/pseries/plpks-secvar.c @@ -152,39 +152,55 @@ static int plpks_set_variable(const char *key, u64 ke= y_len, u8 *data, return rc; } =20 -// PLPKS dynamic secure boot doesn't give us a format string in the same w= ay OPAL does. -// Instead, report the format using the SB_VERSION variable in the keystor= e. -// The string is made up by us, and takes the form "ibm,plpks-sb-v" (or= "ibm,plpks-sb-unknown" -// if the SB_VERSION variable doesn't exist). Hypervisor defines the SB_VE= RSION variable as a -// "1 byte unsigned integer value". -static ssize_t plpks_secvar_format(char *buf, size_t bufsize) +/* + * Return the key management mode. + * + * SB_VERSION is defined as a "1 byte unsigned integer value", taking valu= es + * starting from 1. It is owned by the Partition Firmware and its presence + * indicates that the key management mode is dynamic. Any failure in + * reading SB_VERSION defaults the key management mode to static. The error + * codes -ENOENT or -EPERM are expected in static key management mode. An + * unexpected error code will have to be investigated. Only signed variabl= es + * have null bytes in their names, SB_VERSION does not. + * + * Return 0 to indicate that the key management mode is static. Otherwise + * return the SB_VERSION value to indicate that the key management mode is + * dynamic. + */ +static u8 plpks_get_sb_keymgmt_mode(void) { - struct plpks_var var =3D {0}; - ssize_t ret; - u8 version; - - var.component =3D NULL; - // Only the signed variables have null bytes in their names, this one doe= sn't - var.name =3D "SB_VERSION"; - var.namelen =3D strlen(var.name); - var.datalen =3D 1; - var.data =3D &version; - - // Unlike the other vars, SB_VERSION is owned by firmware instead of the = OS - ret =3D plpks_read_fw_var(&var); - if (ret) { - if (ret =3D=3D -ENOENT) { - ret =3D snprintf(buf, bufsize, "ibm,plpks-sb-unknown"); - } else { - pr_err("Error %ld reading SB_VERSION from firmware\n", ret); - ret =3D -EIO; - } - goto err; + u8 mode; + ssize_t rc; + struct plpks_var var =3D { + .component =3D NULL, + .name =3D "SB_VERSION", + .namelen =3D 10, + .datalen =3D 1, + .data =3D &mode, + }; + + rc =3D plpks_read_fw_var(&var); + if (rc) { + if (rc !=3D -ENOENT && rc !=3D -EPERM) + pr_info("Error %ld reading SB_VERSION from firmware\n", rc); + mode =3D 0; } + return mode; +} =20 - ret =3D snprintf(buf, bufsize, "ibm,plpks-sb-v%hhu", version); -err: - return ret; +/* + * PLPKS dynamic secure boot doesn't give us a format string in the same w= ay + * OPAL does. Instead, report the format using the SB_VERSION variable in = the + * keystore. The string, made up by us, takes the form of either + * "ibm,plpks-sb-v" or "ibm,plpks-sb-v0", based on the key management m= ode, + * and return the length of the secvar format property. + */ +static ssize_t plpks_secvar_format(char *buf, size_t bufsize) +{ + u8 mode; + + mode =3D plpks_get_sb_keymgmt_mode(); + return snprintf(buf, bufsize, "ibm,plpks-sb-v%hhu", mode); } =20 static int plpks_max_size(u64 *max_size) --=20 2.47.1 From nobody Sat Oct 11 08:26:20 2025 Received: from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com [148.163.156.1]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C9BCD283FC9; Tue, 10 Jun 2025 21:19:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.156.1 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1749590380; cv=none; b=NNICNG0SZFumLh/4rJOVcTEIXyPHAvKGtM4x5zCkF3L2gASRqJ3gmxrzlUa64XWkhvi09t+Rqb3InXspNlyo90K54L0Rc7VscAOlINMWgHlh2YHWgMrvg6RsgHpIcLgmfKJ9UTewl9LzenTC8wdJqRFI9vAq64fzj6yPCZ2BeGI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1749590380; c=relaxed/simple; bh=DZ8CM4S/wzyJFRF1yJfVXdaxaSJD+XG1lwmHyehtn0A=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=FdWWOYonkLFL/0APqNR2FepP+Mqtj4sktYYeb+vaKInPbY6c89CrOMcvw6hzV8IDCDNRMOm2ilGpmJ1/ooIuNEwzP/4UD1C35BOfitCxQ05dixQ3K2Sa5FBOsY2Q+IazghsytL4HlZmnQ0ep7sSvDurmWHuLN/c552a4OWCHXEY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=RFTFUzxS; arc=none smtp.client-ip=148.163.156.1 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="RFTFUzxS" Received: from pps.filterd (m0356517.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 55AKd0hn001143; Tue, 10 Jun 2025 21:19:24 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=Ror2umoeh/9LFHu5s OpmgQ+S2h8VWYq2WrP0ryPKE4w=; b=RFTFUzxSa6kPd20FtGdBPaCb9K2WpYd6H DttT6ZlnKh4wScd4N2ZvzE36UC/YsPVO2mLvsyKb4l8/x8kqqW37xxdGuBPzDYLl PjVSQFxwtkJbxoeCfXbk99OsT08TiQbdiDURWCq6GjjNvlNKyztd10/zU4sVgKQ8 2ttLBRkZaB25FTXLgZRQBQauS6Ejt7h3DfjuTE/lBzF1ZtImWKAeWR4bFsaapbBT tCqtO2vFjz29C3P1C7mRdatq0XJ2EAfNthgiJ6MTAIeWtL1EDuxh9Su6Gz4F11Bp ryWpMIX5PYt82JGcWl87a7OVNm2AoVsmLRlBRjhuH53Ie9WVUxSFg== Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4769wynhar-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 10 Jun 2025 21:19:24 +0000 (GMT) Received: from m0356517.ppops.net (m0356517.ppops.net [127.0.0.1]) by pps.reinject (8.18.0.8/8.18.0.8) with ESMTP id 55ALGsrF003360; Tue, 10 Jun 2025 21:19:24 GMT Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4769wynhak-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 10 Jun 2025 21:19:23 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 55AK684V021836; Tue, 10 Jun 2025 21:19:22 GMT Received: from smtprelay03.fra02v.mail.ibm.com ([9.218.2.224]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 47504yvkg4-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 10 Jun 2025 21:19:22 +0000 Received: from smtpav02.fra02v.mail.ibm.com (smtpav02.fra02v.mail.ibm.com [10.20.54.101]) by smtprelay03.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 55ALJIao59703664 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 10 Jun 2025 21:19:18 GMT Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 861EB2004E; Tue, 10 Jun 2025 21:19:18 +0000 (GMT) Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8E7E020043; Tue, 10 Jun 2025 21:19:15 +0000 (GMT) Received: from li-fc74f8cc-3279-11b2-a85c-ef5828687581.ibm.com.com (unknown [9.39.26.197]) by smtpav02.fra02v.mail.ibm.com (Postfix) with ESMTP; Tue, 10 Jun 2025 21:19:15 +0000 (GMT) From: Srish Srinivasan To: linux-integrity@vger.kernel.org, linuxppc-dev@lists.ozlabs.org Cc: maddy@linux.ibm.com, mpe@ellerman.id.au, npiggin@gmail.com, christophe.leroy@csgroup.eu, naveen@kernel.org, ajd@linux.ibm.com, zohar@linux.ibm.com, nayna@linux.ibm.com, rnsastry@linux.ibm.com, msuchanek@suse.de, linux-kernel@vger.kernel.org Subject: [PATCH v4 2/3] powerpc/secvar: Expose secvars relevant to the key management mode Date: Wed, 11 Jun 2025 02:49:06 +0530 Message-ID: <20250610211907.101384-3-ssrish@linux.ibm.com> X-Mailer: git-send-email 2.49.0 In-Reply-To: <20250610211907.101384-1-ssrish@linux.ibm.com> References: <20250610211907.101384-1-ssrish@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: rV0kdsEIElMXerPPdLa6gv_mff9PxzjD X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwNjEwMDE3NCBTYWx0ZWRfX050Zr9yBr/fI n5qBXuyXN8n6Mk1nggrlj4wzCrkfnVTE4hgXisqiERwzo5RUFTm9feh/kcZ9FrMTqcHlgdvZMQI HGblqaxZUhbfjY4myzvcOg1BYuQufpbyteICBh/lV/78YbbaSvihnxmErCyyTeAoRsmaFtcpzMb xc9f4Jt5EfZXa7NhC0xcyoc1j9JNiFmd5iQwczVn8DxgWGshNAZupgqERBhBVKjwLTygAVK0E8u z0walBzkDuDRMspmYN5mWRyY6Iui4mlQkPzVcwJryAGMP/GdfHlec31sz6lL//YxF1lcDqq5mP3 TetqP7RScAADzyc0t3sg9qD1V2UAN/duwS4qMnHCQP2P2mKsr3E25RsVkOZ75U6axymZx1N6/2S FENU7xZ1Xj3g5nr31cCciekY3uSv44H3v9Cba32omBrWQXtv7FEoMbdHFMefAhf6RqfvGjs8 X-Authority-Analysis: v=2.4 cv=YKGfyQGx c=1 sm=1 tr=0 ts=6848a15c cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=6IFa9wvqVegA:10 a=VnNF1IyMAAAA:8 a=2qXihy3qlzCNzDExuI8A:9 X-Proofpoint-GUID: PIaYAC_5LnNIxIl-BvyJgG32MCmkBQEN X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.0.736,FMLib:17.12.80.40 definitions=2025-06-10_10,2025-06-10_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 clxscore=1015 malwarescore=0 bulkscore=0 priorityscore=1501 phishscore=0 mlxscore=0 lowpriorityscore=0 impostorscore=0 adultscore=0 mlxlogscore=999 suspectscore=0 classifier=spam authscore=0 authtc=n/a authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2505280000 definitions=main-2506100174 Content-Type: text/plain; charset="utf-8" The PLPKS enabled PowerVM LPAR sysfs exposes all of the secure boot secvars irrespective of the key management mode. The PowerVM LPAR supports static and dynamic key management for secure boot. The key management option can be updated in the management console. The secvars PK, trustedcadb, and moduledb can be consumed both in the static and dynamic key management modes for the loading of signed third-party kernel modules. However, other secvars i.e. KEK, grubdb, grubdbx, sbat, db and dbx, which are used to verify the grub and kernel images, are consumed only in the dynamic key management mode. Expose only PK, trustedcadb, and moduledb in the static key management mode. Co-developed-by: Souradeep Signed-off-by: Souradeep Signed-off-by: Srish Srinivasan Reviewed-by: Mimi Zohar Reviewed-by: Stefan Berger Reviewed-by: Nayna Jain Reviewed-by: Andrew Donnellan Tested-by: R Nageswara Sastry --- Documentation/ABI/testing/sysfs-secvar | 7 +++++ arch/powerpc/platforms/pseries/plpks-secvar.c | 28 ++++++++++++++++--- 2 files changed, 31 insertions(+), 4 deletions(-) diff --git a/Documentation/ABI/testing/sysfs-secvar b/Documentation/ABI/tes= ting/sysfs-secvar index f001a4f4bd2e..1016967a730f 100644 --- a/Documentation/ABI/testing/sysfs-secvar +++ b/Documentation/ABI/testing/sysfs-secvar @@ -38,6 +38,13 @@ Description: Each secure variable is represented as a di= rectory named as representation. The data and size can be determined by reading their respective attribute files. =20 + Only secvars relevant to the key management mode are exposed. + Only in the dynamic key management mode should the user have + access (read and write) to the secure boot secvars db, dbx, + grubdb, grubdbx, and sbat. These secvars are not consumed in the + static key management mode. PK, trustedcadb and moduledb are the + secvars common to both static and dynamic key management modes. + What: /sys/firmware/secvar/vars//size Date: August 2019 Contact: Nayna Jain diff --git a/arch/powerpc/platforms/pseries/plpks-secvar.c b/arch/powerpc/p= latforms/pseries/plpks-secvar.c index 767e5e8c6990..f9e9cc40c9d0 100644 --- a/arch/powerpc/platforms/pseries/plpks-secvar.c +++ b/arch/powerpc/platforms/pseries/plpks-secvar.c @@ -59,7 +59,14 @@ static u32 get_policy(const char *name) return PLPKS_SIGNEDUPDATE; } =20 -static const char * const plpks_var_names[] =3D { +static const char * const plpks_var_names_static[] =3D { + "PK", + "moduledb", + "trustedcadb", + NULL, +}; + +static const char * const plpks_var_names_dynamic[] =3D { "PK", "KEK", "db", @@ -213,21 +220,34 @@ static int plpks_max_size(u64 *max_size) return 0; } =20 +static const struct secvar_operations plpks_secvar_ops_static =3D { + .get =3D plpks_get_variable, + .set =3D plpks_set_variable, + .format =3D plpks_secvar_format, + .max_size =3D plpks_max_size, + .config_attrs =3D config_attrs, + .var_names =3D plpks_var_names_static, +}; =20 -static const struct secvar_operations plpks_secvar_ops =3D { +static const struct secvar_operations plpks_secvar_ops_dynamic =3D { .get =3D plpks_get_variable, .set =3D plpks_set_variable, .format =3D plpks_secvar_format, .max_size =3D plpks_max_size, .config_attrs =3D config_attrs, - .var_names =3D plpks_var_names, + .var_names =3D plpks_var_names_dynamic, }; =20 static int plpks_secvar_init(void) { + u8 mode; + if (!plpks_is_available()) return -ENODEV; =20 - return set_secvar_ops(&plpks_secvar_ops); + mode =3D plpks_get_sb_keymgmt_mode(); + if (mode) + return set_secvar_ops(&plpks_secvar_ops_dynamic); + return set_secvar_ops(&plpks_secvar_ops_static); } machine_device_initcall(pseries, plpks_secvar_init); --=20 2.47.1 From nobody Sat Oct 11 08:26:20 2025 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E02B5284B5F; Tue, 10 Jun 2025 21:19:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1749590386; cv=none; b=AcZCiafOvSeAC35FJ6hk/ixdKsMQMV6mn7MdVWIR5uEoMg7qTR0+KVipPNKaV5T+HMxOuzv6Bfge5lSL8Vd9bpHWUOWdmWnCL14a5UKsy0VIedp5fZtCfo6fqMWORfuXppB1QoFhYFn+XVKpuiWvaCSoxiQ7EQ1uJplb/VTPjKA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1749590386; c=relaxed/simple; bh=WH8RQf6bUZn016PysqDM75R3nB09GwE/tGFYUasp/ww=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Wc1p4/H4/zPU/nFmmHbbMHuYk1T4qJ+eK7ndukMA+imB2SX54cKuOT1t1kKd0qWwXyt/3y/WoURIfKrbzwPoH9uqRoRWJ/0Iel8Az5W0vL/gLM0raB33K+P3e4ioMlD/8JCn9J3fXLeWc6kLPIVDb0T7VKqxb+8xwx5GbIC81jw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; spf=pass smtp.mailfrom=linux.ibm.com; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b=OidWgXIS; arc=none smtp.client-ip=148.163.158.5 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.ibm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=ibm.com header.i=@ibm.com header.b="OidWgXIS" Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 55AGFtYw008154; Tue, 10 Jun 2025 21:19:26 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=qwvXwgQXJIkG0QGSj 4RsHe537NK9WFzkfnyk5v2o2AI=; b=OidWgXIS7o+r7++GArplKJ7P6K+PIM2sK UuRkz9EVD63L0Q9uM8JUfJ0SOJR1jJf3D8v0JF5ISc2t5NI54ymv/4hfk1lTm2ce G8kZIiPWcZfPoi87TMrxwpGwgv3fvnVCeZuanlTxUSLRwfDwSJzfeoInkCVQK591 Wp4aqS/Je9WcAmyl//JJcm3DW/KJRHCLkr4PnCLG62FrYtT/0tn1yzbiTWVDcTSB MqBtFBdq1ZTOTs43JLDyLrf5/D0osdWup7J+65AXhAUZ0vaRUBhyw2XkW7HMTz3M Dbjh/7oOtRfZpAOPHJDz+NOFttTGCHWfMkdhcuWAOKpdEvNyIXbSg== Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 474x4m60pu-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 10 Jun 2025 21:19:26 +0000 (GMT) Received: from m0360072.ppops.net (m0360072.ppops.net [127.0.0.1]) by pps.reinject (8.18.0.8/8.18.0.8) with ESMTP id 55ALDuet019150; Tue, 10 Jun 2025 21:19:26 GMT Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 474x4m60pq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 10 Jun 2025 21:19:26 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 55AJnWJr015186; Tue, 10 Jun 2025 21:19:25 GMT Received: from smtprelay06.fra02v.mail.ibm.com ([9.218.2.230]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 474yrtcqbb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 10 Jun 2025 21:19:25 +0000 Received: from smtpav02.fra02v.mail.ibm.com (smtpav02.fra02v.mail.ibm.com [10.20.54.101]) by smtprelay06.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 55ALJLFc29426324 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Tue, 10 Jun 2025 21:19:21 GMT Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id BC91D2004E; Tue, 10 Jun 2025 21:19:21 +0000 (GMT) Received: from smtpav02.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id DDA4520043; Tue, 10 Jun 2025 21:19:18 +0000 (GMT) Received: from li-fc74f8cc-3279-11b2-a85c-ef5828687581.ibm.com.com (unknown [9.39.26.197]) by smtpav02.fra02v.mail.ibm.com (Postfix) with ESMTP; Tue, 10 Jun 2025 21:19:18 +0000 (GMT) From: Srish Srinivasan To: linux-integrity@vger.kernel.org, linuxppc-dev@lists.ozlabs.org Cc: maddy@linux.ibm.com, mpe@ellerman.id.au, npiggin@gmail.com, christophe.leroy@csgroup.eu, naveen@kernel.org, ajd@linux.ibm.com, zohar@linux.ibm.com, nayna@linux.ibm.com, rnsastry@linux.ibm.com, msuchanek@suse.de, linux-kernel@vger.kernel.org Subject: [PATCH v4 3/3] integrity/platform_certs: Allow loading of keys in the static key management mode Date: Wed, 11 Jun 2025 02:49:07 +0530 Message-ID: <20250610211907.101384-4-ssrish@linux.ibm.com> X-Mailer: git-send-email 2.49.0 In-Reply-To: <20250610211907.101384-1-ssrish@linux.ibm.com> References: <20250610211907.101384-1-ssrish@linux.ibm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-TM-AS-GCONF: 00 X-Authority-Analysis: v=2.4 cv=Y4X4sgeN c=1 sm=1 tr=0 ts=6848a15e cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=6IFa9wvqVegA:10 a=VnNF1IyMAAAA:8 a=AtMIOgTZpS777Q0Lz8kA:9 X-Proofpoint-GUID: q4zdhWag_zhb8L3Jjsh8UOPm_I5jTCnc X-Proofpoint-ORIG-GUID: WBQR6cdcqVUld135lsKeaseqYHLNtSzL X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwNjEwMDE3NCBTYWx0ZWRfX7+ftWgf99YPY s2K6Uk+PpWPaMygwPvgeoCzzIXnkyurHiVVjmEwFS7moS/HSu4153k+AKN1GRNR8+tBQYtPwKrR jgs3l55QijI04p69N2XKzlfGTtjwSyCBxMbeiZtA+J+hfqvwM4vv+0+p9H4ow3VSZOL3K5Q6Iw2 hbv+BE8O45e0I5rlk4/7/KSbaCcqcRUFv6U/4SiAoZute6BPojSi09czWmlNNks1nVVGLjeeHMa 5lAILmToOqBtA1b6kNEzwFnibV8lQVIu1z/5YqJY6pA1HVDm8Bndooc3PkBt5svotLN939pT8dZ OYSFkFuWm7xl46EtMx6/buRojMKfqF5KAqjVmH539//OVRGYzRxgFYDGIRyjLjd5Xxprg9BBgKt D03J3G9XZHhNzIEIECEJh5Pt5+hywxfCKVtrkXWVGoD9DIPHEWIXkE9i6QPU7ZDQCaIE2wTS X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.0.736,FMLib:17.12.80.40 definitions=2025-06-10_10,2025-06-10_01,2025-03-28_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 mlxlogscore=999 spamscore=0 clxscore=1015 lowpriorityscore=0 malwarescore=0 bulkscore=0 adultscore=0 impostorscore=0 suspectscore=0 phishscore=0 mlxscore=0 priorityscore=1501 classifier=spam authscore=0 authtc=n/a authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2505280000 definitions=main-2506100174 Content-Type: text/plain; charset="utf-8" On PLPKS enabled PowerVM LPAR, there is no provision to load signed third-party kernel modules when the key management mode is static. This is because keys from secure boot secvars are only loaded when the key management mode is dynamic. Allow loading of the trustedcadb and moduledb keys even in the static key management mode, where the secvar format string takes the form "ibm,plpks-sb-v0". Signed-off-by: Srish Srinivasan Reviewed-by: Mimi Zohar Reviewed-by: Stefan Berger Reviewed-by: Nayna Jain Reviewed-by: Andrew Donnellan --- security/integrity/platform_certs/load_powerpc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/security/integrity/platform_certs/load_powerpc.c b/security/in= tegrity/platform_certs/load_powerpc.c index c85febca3343..714c961a00f5 100644 --- a/security/integrity/platform_certs/load_powerpc.c +++ b/security/integrity/platform_certs/load_powerpc.c @@ -75,12 +75,13 @@ static int __init load_powerpc_certs(void) return -ENODEV; =20 // Check for known secure boot implementations from OPAL or PLPKS - if (strcmp("ibm,edk2-compat-v1", buf) && strcmp("ibm,plpks-sb-v1", buf)) { + if (strcmp("ibm,edk2-compat-v1", buf) && strcmp("ibm,plpks-sb-v1", buf) && + strcmp("ibm,plpks-sb-v0", buf)) { pr_err("Unsupported secvar implementation \"%s\", not loading certs\n", = buf); return -ENODEV; } =20 - if (strcmp("ibm,plpks-sb-v1", buf) =3D=3D 0) + if (strcmp("ibm,plpks-sb-v1", buf) =3D=3D 0 || strcmp("ibm,plpks-sb-v0", = buf) =3D=3D 0) /* PLPKS authenticated variables ESL data is prefixed with 8 bytes of ti= mestamp */ offset =3D 8; =20 --=20 2.47.1