Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.0/patches/2175291/?format=api
{ "id": 2175291, "url": "http://patchwork.ozlabs.org/api/1.0/patches/2175291/?format=api", "project": { "id": 2, "url": "http://patchwork.ozlabs.org/api/1.0/projects/2/?format=api", "name": "Linux PPC development", "link_name": "linuxppc-dev", "list_id": "linuxppc-dev.lists.ozlabs.org", "list_email": "linuxppc-dev@lists.ozlabs.org", "web_url": "https://github.com/linuxppc/wiki/wiki", "scm_url": "https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git", "webscm_url": "https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git/" }, "msgid": "<20251217172505.112398-7-ssrish@linux.ibm.com>", "date": "2025-12-17T17:25:05", "name": "[v2,6/6] docs: trusted-encryped: add PKWM as a new trust source", "commit_ref": null, "pull_url": null, "state": "superseded", "archived": false, "hash": "d9df95d65e9669819c7657735fb591a2558f7b65", "submitter": { "id": 90762, "url": "http://patchwork.ozlabs.org/api/1.0/people/90762/?format=api", "name": "Srish Srinivasan", "email": "ssrish@linux.ibm.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/linuxppc-dev/patch/20251217172505.112398-7-ssrish@linux.ibm.com/mbox/", "series": [ { "id": 485734, "url": "http://patchwork.ozlabs.org/api/1.0/series/485734/?format=api", "date": "2025-12-17T17:24:59", "name": "Extend \"trusted\" keys to support a new trust source named the PowerVM Key Wrapping Module (PKWM)", "version": 2, "mbox": "http://patchwork.ozlabs.org/series/485734/mbox/" } ], "check": "fail", "checks": "http://patchwork.ozlabs.org/api/patches/2175291/checks/", "tags": {}, "headers": { "Return-Path": "\n <linuxppc-dev+bounces-14850-incoming=patchwork.ozlabs.org@lists.ozlabs.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "linuxppc-dev@lists.ozlabs.org" ], "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=ibm.com header.i=@ibm.com header.a=rsa-sha256\n header.s=pp1 header.b=Rwm9Aewd;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.ozlabs.org\n (client-ip=112.213.38.117; helo=lists.ozlabs.org;\n envelope-from=linuxppc-dev+bounces-14850-incoming=patchwork.ozlabs.org@lists.ozlabs.org;\n receiver=patchwork.ozlabs.org)", "lists.ozlabs.org;\n arc=none smtp.remote-ip=148.163.158.5", "lists.ozlabs.org;\n dmarc=pass (p=none dis=none) header.from=linux.ibm.com", "lists.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=ibm.com header.i=@ibm.com header.a=rsa-sha256\n header.s=pp1 header.b=Rwm9Aewd;\n\tdkim-atps=neutral", "lists.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=linux.ibm.com\n (client-ip=148.163.158.5; helo=mx0b-001b2d01.pphosted.com;\n envelope-from=ssrish@linux.ibm.com; receiver=lists.ozlabs.org)" ], "Received": [ "from lists.ozlabs.org (lists.ozlabs.org [112.213.38.117])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4dWggr0Wymz1y0P\n\tfor <incoming@patchwork.ozlabs.org>; Thu, 18 Dec 2025 04:26:16 +1100 (AEDT)", "from boromir.ozlabs.org (localhost [127.0.0.1])\n\tby lists.ozlabs.org (Postfix) with ESMTP id 4dWggH44Bvz3bfF;\n\tThu, 18 Dec 2025 04:25:47 +1100 (AEDT)", "from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com\n [148.163.158.5])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby lists.ozlabs.org (Postfix) with ESMTPS id 4dWggG5r5Cz30TL\n\tfor <linuxppc-dev@lists.ozlabs.org>; Thu, 18 Dec 2025 04:25:46 +1100 (AEDT)", "from pps.filterd (m0353725.ppops.net [127.0.0.1])\n\tby mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id\n 5BHAksvY006284;\n\tWed, 17 Dec 2025 17:25:35 GMT", "from pps.reinject (localhost [127.0.0.1])\n\tby mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4b0xjm5gm4-1\n\t(version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT);\n\tWed, 17 Dec 2025 17:25:35 +0000 (GMT)", "from m0353725.ppops.net (m0353725.ppops.net [127.0.0.1])\n\tby pps.reinject (8.18.1.12/8.18.0.8) with ESMTP id 5BHHKHj5026044;\n\tWed, 17 Dec 2025 17:25:35 GMT", "from ppma23.wdc07v.mail.ibm.com\n (5d.69.3da9.ip4.static.sl-reverse.com [169.61.105.93])\n\tby mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4b0xjm5gkx-1\n\t(version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT);\n\tWed, 17 Dec 2025 17:25:34 +0000 (GMT)", "from pps.filterd (ppma23.wdc07v.mail.ibm.com [127.0.0.1])\n\tby ppma23.wdc07v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id\n 5BHH9ZqO002960;\n\tWed, 17 Dec 2025 17:25:34 GMT", "from smtprelay04.fra02v.mail.ibm.com ([9.218.2.228])\n\tby ppma23.wdc07v.mail.ibm.com (PPS) with ESMTPS id 4b1kykuf9x-1\n\t(version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT);\n\tWed, 17 Dec 2025 17:25:34 +0000", "from smtpav01.fra02v.mail.ibm.com (smtpav01.fra02v.mail.ibm.com\n [10.20.54.100])\n\tby smtprelay04.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id\n 5BHHPUL529622806\n\t(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK);\n\tWed, 17 Dec 2025 17:25:30 GMT", "from smtpav01.fra02v.mail.ibm.com (unknown [127.0.0.1])\n\tby IMSVA (Postfix) with ESMTP id 0F34320043;\n\tWed, 17 Dec 2025 17:25:30 +0000 (GMT)", "from smtpav01.fra02v.mail.ibm.com (unknown [127.0.0.1])\n\tby IMSVA (Postfix) with ESMTP id F01C820040;\n\tWed, 17 Dec 2025 17:25:26 +0000 (GMT)", "from li-fc74f8cc-3279-11b2-a85c-ef5828687581.ibm.com.com (unknown\n [9.124.211.226])\n\tby smtpav01.fra02v.mail.ibm.com (Postfix) with ESMTP;\n\tWed, 17 Dec 2025 17:25:26 +0000 (GMT)" ], "ARC-Seal": "i=1; a=rsa-sha256; d=lists.ozlabs.org; s=201707; t=1765992347;\n\tcv=none;\n b=KyiFJnl3gUVq84rLYqZfqXJvXvLjL+pjHsuGaPqjfFs5FA4QH3EQ4zh6MuCN/fvRaqu03BQOvUEYBXIPhHEmRDlKdtROWkzFTLMYt11Vfml7vJUqycYk/zahLCZSQ++CihBol62CWMNtsc0KS5zavfrFVzqGlzHPu4bqSwaBbk2N8otFIUIEP++jiAi3V0/38/PuUm4J00ycyg7dg2FS8v3GyFiDDw1Mjw8MXn3g+YMg9LWqMzqCNAIm9Hvat61BGojNnw/wPkAtnb0CNrFoF6wmx6yR9mWJN54dCK/C6H+WNLmHZNWudbuZaqnUeEvMgT/5kUP/0N7c95O1mwPHXw==", "ARC-Message-Signature": "i=1; a=rsa-sha256; d=lists.ozlabs.org; s=201707;\n\tt=1765992347; c=relaxed/relaxed;\n\tbh=Bkv9uUW89YkDzEWaHv1ObgoIXGJD2YqlGrw2O8ISsIM=;\n\th=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:\n\t MIME-Version;\n b=jKqq53524saB9ZAvXRBPG1Toz/vVdCsQ8W/EIeraobJuANrRZ4AXv7lEDr+DCxiugXnGOJ1e+3U5pAqmWuAHi17/m9jostvW2aLak637mthW/AlUAfBzaxjUjKLXeRA7+bZn5sBqewZhycAs3qD4odXR45JtVdQKbsQcwEUmxLsIbRaoBzBu9DCzIAb/RQgust17J17RP6T0fFyQQAbAcbIUqYjKxYVs14/Zo0R919+KHZXQMZZH4Tr6OwptY/tO0aSwuaLzCecx0NmOCy/nUTvtQZaCthMoR/XrYbM4wuqlkxPSlL7RHqc3ep7YlU5tlluRyknlnxmSLVUsQqvsyg==", "ARC-Authentication-Results": "i=1; lists.ozlabs.org;\n dmarc=pass (p=none dis=none) header.from=linux.ibm.com;\n dkim=pass (2048-bit key;\n unprotected) header.d=ibm.com header.i=@ibm.com header.a=rsa-sha256\n header.s=pp1 header.b=Rwm9Aewd; dkim-atps=neutral;\n spf=pass (client-ip=148.163.158.5; helo=mx0b-001b2d01.pphosted.com;\n envelope-from=ssrish@linux.ibm.com;\n receiver=lists.ozlabs.org) smtp.mailfrom=linux.ibm.com", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc\n\t:content-transfer-encoding:date:from:in-reply-to:message-id\n\t:mime-version:references:subject:to; s=pp1; bh=Bkv9uUW89YkDzEWaH\n\tv1ObgoIXGJD2YqlGrw2O8ISsIM=; b=Rwm9AewdjgZ6PVtdnfehaWoypjOkFlRTq\n\tKkPumMFBEQH3TXVwFkA7pOdfrHqPQYtiXEnOwJZHfYvEtDAdNfgi8r20+aJdUv6B\n\tKeXyl4qJise6kXn4QvlYFbXj94JIGmuowXfYxM4Jlv+83lDhD3q4sxOFlh8btkOl\n\tD+yl7mbpbuX+pzxke7tqLnFOR+IPRQCGUUKO3+gjP1rqY/WyEEzc7tdxrlO0R9NN\n\tul6bkV1FdAgCXeat+M5dD1fK4EB3Sn5r+kvv3TFob4jBWJD5LQsok6EQq53ixvxK\n\tpnSvZeHUf7qmSX4k+hub1SRyg/cK22SqBjTlpfbrAt0BsSfKg9dTA==", "From": "Srish Srinivasan <ssrish@linux.ibm.com>", "To": "linux-integrity@vger.kernel.org, keyrings@vger.kernel.org,\n linuxppc-dev@lists.ozlabs.org", "Cc": "maddy@linux.ibm.com, mpe@ellerman.id.au, npiggin@gmail.com,\n christophe.leroy@csgroup.eu, James.Bottomley@HansenPartnership.com,\n jarkko@kernel.org, zohar@linux.ibm.com, nayna@linux.ibm.com,\n rnsastry@linux.ibm.com, linux-kernel@vger.kernel.org,\n linux-security-module@vger.kernel.org, ssrish@linux.ibm.com", "Subject": "[PATCH v2 6/6] docs: trusted-encryped: add PKWM as a new trust source", "Date": "Wed, 17 Dec 2025 22:55:05 +0530", "Message-ID": "<20251217172505.112398-7-ssrish@linux.ibm.com>", "X-Mailer": "git-send-email 2.52.0", "In-Reply-To": "<20251217172505.112398-1-ssrish@linux.ibm.com>", "References": "<20251217172505.112398-1-ssrish@linux.ibm.com>", "X-Mailing-List": "linuxppc-dev@lists.ozlabs.org", "List-Id": "<linuxppc-dev.lists.ozlabs.org>", "List-Help": "<mailto:linuxppc-dev+help@lists.ozlabs.org>", "List-Owner": "<mailto:linuxppc-dev+owner@lists.ozlabs.org>", "List-Post": "<mailto:linuxppc-dev@lists.ozlabs.org>", "List-Archive": "<https://lore.kernel.org/linuxppc-dev/>,\n <https://lists.ozlabs.org/pipermail/linuxppc-dev/>", "List-Subscribe": "<mailto:linuxppc-dev+subscribe@lists.ozlabs.org>,\n <mailto:linuxppc-dev+subscribe-digest@lists.ozlabs.org>,\n <mailto:linuxppc-dev+subscribe-nomail@lists.ozlabs.org>", "List-Unsubscribe": "<mailto:linuxppc-dev+unsubscribe@lists.ozlabs.org>", "Precedence": "list", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit", "X-TM-AS-GCONF": "00", "X-Proofpoint-ORIG-GUID": "ceeOyiP6uF2BvNLHd10ohXNW5vn1otzm", "X-Authority-Analysis": "v=2.4 cv=CLgnnBrD c=1 sm=1 tr=0 ts=6942e78f cx=c_pps\n a=3Bg1Hr4SwmMryq2xdFQyZA==:117 a=3Bg1Hr4SwmMryq2xdFQyZA==:17\n a=wP3pNCr1ah4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=VnNF1IyMAAAA:8\n a=T8Lk_pw-g3mOOJD1yd4A:9", "X-Proofpoint-GUID": "vOmHre_G-yGWxqiKVb5Ic0lRl4uaAeUZ", "X-Proofpoint-Spam-Details-Enc": "AW1haW4tMjUxMjEzMDAwOSBTYWx0ZWRfX+yNIHZ5fBBmo\n DmuJLc+Fr+H4Xxc07KwI4ji8pJzhohjS3GVMuqPh/MRk2QBZ7mWVgk1vvcUmNV4guytylTcluW4\n G5WJVi8pthzWmd8EvLI+XOVHFp8zj46CuFznMz1bSfNc+XP3bVi0M7D5GJ/WLrHyLiNXZMD551y\n Mk9eY3K3D3n2WKCUDdv3juvy0mZGrEDEGxvXCgtufl3T5rWJ7rYvDPr1ho+PJnY482ZoURA+z14\n nv6kWo00MdtKX2aRKn007yd4Nk1I9xY5CGGbCUD2L6wWMGFcPrRJNPrqoZSaUuYHK6XdCmr0LSH\n EgVMRDhDi5pyQyDXwd8qe2DJq0FE0os0/K1ooa9Y4sJA9Ret5SL+9JE7GAFPckTyqkqHCe+HnAC\n NAPI5niPw0eu1Mf/UuRFL/W/3l6Veg==", "X-Proofpoint-Virus-Version": "vendor=baseguard\n engine=ICAP:2.0.293,Aquarius:18.0.1121,Hydra:6.1.9,FMLib:17.12.100.49\n definitions=2025-12-17_03,2025-12-16_05,2025-10-01_01", "X-Proofpoint-Spam-Details": "rule=outbound_notspam policy=outbound score=0\n spamscore=0 clxscore=1015 lowpriorityscore=0 malwarescore=0 suspectscore=0\n phishscore=0 priorityscore=1501 bulkscore=0 impostorscore=0 adultscore=0\n classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0\n reason=mlx scancount=1 engine=8.19.0-2510240000 definitions=main-2512130009", "X-Spam-Status": "No, score=-0.7 required=3.0 tests=DKIM_SIGNED,DKIM_VALID,\n\tRCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H4,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,\n\tSPF_PASS autolearn=disabled version=4.0.1 OzLabs 8", "X-Spam-Checker-Version": "SpamAssassin 4.0.1 (2024-03-25) on lists.ozlabs.org" }, "content": "From: Nayna Jain <nayna@linux.ibm.com>\n\nUpdate Documentation/security/keys/trusted-encrypted.rst and Documentation/\nadmin-guide/kernel-parameters.txt with PowerVM Key Wrapping Module (PKWM)\nas a new trust source\n\nSigned-off-by: Nayna Jain <nayna@linux.ibm.com>\nSigned-off-by: Srish Srinivasan <ssrish@linux.ibm.com>\n---\n .../admin-guide/kernel-parameters.txt | 1 +\n .../security/keys/trusted-encrypted.rst | 50 +++++++++++++++++++\n 2 files changed, 51 insertions(+)", "diff": "diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt\nindex a8d0afde7f85..ccb9c2f502fb 100644\n--- a/Documentation/admin-guide/kernel-parameters.txt\n+++ b/Documentation/admin-guide/kernel-parameters.txt\n@@ -7755,6 +7755,7 @@ Kernel parameters\n \t\t\t- \"tee\"\n \t\t\t- \"caam\"\n \t\t\t- \"dcp\"\n+\t\t\t- \"pkwm\"\n \t\t\tIf not specified then it defaults to iterating through\n \t\t\tthe trust source list starting with TPM and assigns the\n \t\t\tfirst trust source as a backend which is initialized\ndiff --git a/Documentation/security/keys/trusted-encrypted.rst b/Documentation/security/keys/trusted-encrypted.rst\nindex eae6a36b1c9a..ddff7c7c2582 100644\n--- a/Documentation/security/keys/trusted-encrypted.rst\n+++ b/Documentation/security/keys/trusted-encrypted.rst\n@@ -81,6 +81,14 @@ safe.\n and the UNIQUE key. Default is to use the UNIQUE key, but selecting\n the OTP key can be done via a module parameter (dcp_use_otp_key).\n \n+ (5) PKWM (PowerVM Key Wrapping Module: IBM PowerVM + Platform KeyStore)\n+\n+ Rooted to a unique, per-LPAR key, which is derived from a system-wide,\n+ randomly generated LPAR root key. Both the per-LPAR keys and the LPAR\n+ root key are stored in hypervisor-owned secure memory at runtime,\n+ and the LPAR root key is additionally persisted in secure locations\n+ such as the processor SEEPROMs and encrypted NVRAM.\n+\n * Execution isolation\n \n (1) TPM\n@@ -102,6 +110,14 @@ safe.\n environment. Only basic blob key encryption is executed there.\n The actual key sealing/unsealing is done on main processor/kernel space.\n \n+ (5) PKWM (PowerVM Key Wrapping Module: IBM PowerVM + Platform KeyStore)\n+\n+ Fixed set of cryptographic operations done on on-chip hardware\n+ cryptographic acceleration unit NX. Keys for wrapping and unwrapping\n+ are managed by PowerVM Platform KeyStore, which stores keys in an\n+ isolated in-memory copy in secure hypervisor memory, as well as in a\n+ persistent copy in hypervisor-encrypted NVRAM.\n+\n * Optional binding to platform integrity state\n \n (1) TPM\n@@ -129,6 +145,11 @@ safe.\n Relies on Secure/Trusted boot process (called HAB by vendor) for\n platform integrity.\n \n+ (5) PKWM (PowerVM Key Wrapping Module: IBM PowerVM + Platform KeyStore)\n+\n+ Relies on secure and trusted boot process of IBM Power systems for\n+ platform integrity.\n+\n * Interfaces and APIs\n \n (1) TPM\n@@ -149,6 +170,11 @@ safe.\n Vendor-specific API that is implemented as part of the DCP crypto driver in\n ``drivers/crypto/mxs-dcp.c``.\n \n+ (5) PKWM (PowerVM Key Wrapping Module: IBM PowerVM + Platform KeyStore)\n+\n+ Platform Keystore has well documented interfaces in PAPR document.\n+ Refer to ``Documentation/arch/powerpc/papr_hcalls.rst``\n+\n * Threat model\n \n The strength and appropriateness of a particular trust source for a given\n@@ -191,6 +217,10 @@ selected trust source:\n a dedicated hardware RNG that is independent from DCP which can be enabled\n to back the kernel RNG.\n \n+ * PKWM (PowerVM Key Wrapping Module: IBM PowerVM + Platform KeyStore)\n+\n+ The normal kernel random number generator is used to generate keys.\n+\n Users may override this by specifying ``trusted.rng=kernel`` on the kernel\n command-line to override the used RNG with the kernel's random number pool.\n \n@@ -321,6 +351,26 @@ Usage::\n specific to this DCP key-blob implementation. The key length for new keys is\n always in bytes. Trusted Keys can be 32 - 128 bytes (256 - 1024 bits).\n \n+Trusted Keys usage: PKWM\n+------------------------\n+\n+Usage::\n+\n+ keyctl add trusted name \"new keylen [options]\" ring\n+ keyctl add trusted name \"load hex_blob\" ring\n+ keyctl print keyid\n+\n+ options:\n+ wrap_flags= ascii hex value of security policy requirement\n+ 0x00: no secure boot requirement (default)\n+ 0x01: require secure boot to be in either audit or\n+ enforced mode\n+ 0x02: require secure boot to be in enforced mode\n+\n+\"keyctl print\" returns an ASCII hex copy of the sealed key, which is in format\n+specific to PKWM key-blob implementation. The key length for new keys is\n+always in bytes. Trusted Keys can be 32 - 128 bytes (256 - 1024 bits).\n+\n Encrypted Keys usage\n --------------------\n \n", "prefixes": [ "v2", "6/6" ] }