From patchwork Wed Apr 30 09:03:48 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Srish Srinivasan X-Patchwork-Id: 2079357 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=ibm.com header.i=@ibm.com header.a=rsa-sha256 header.s=pp1 header.b=XLboUL3X; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ozlabs.org (client-ip=2404:9400:2:0:216:3eff:fee1:b9f1; helo=lists.ozlabs.org; envelope-from=linuxppc-dev+bounces-8179-incoming=patchwork.ozlabs.org@lists.ozlabs.org; receiver=patchwork.ozlabs.org) Received: from lists.ozlabs.org (lists.ozlabs.org [IPv6:2404:9400:2:0:216:3eff:fee1:b9f1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4ZnWSz0kgkz1ySm for ; Wed, 30 Apr 2025 19:04:03 +1000 (AEST) Received: from boromir.ozlabs.org (localhost [127.0.0.1]) by lists.ozlabs.org (Postfix) with ESMTP id 4ZnWTB3hnhz2yjV; Wed, 30 Apr 2025 19:04:14 +1000 (AEST) X-Original-To: linuxppc-dev@lists.ozlabs.org Authentication-Results: lists.ozlabs.org; arc=none smtp.remote-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=lists.ozlabs.org; s=201707; t=1746003854; cv=none; b=mxF0vAz+ULzbxN2MjCm6mnSAMwqR9fdfOdNZqVi2GBo0r28MFLpB3ox7wVUgPWIvfhu2qnW0IJZiN2CWocvSZ6XaEqWW3nL7rDrkMQBX/7mz3+jMpbMl+YvAyusm3iRQ6tgsawOI7pKVKbNUDUo5xGUSgz0XNs5rq0DMzGJo+Ys4to+VPpJBIiaxt44r3fuwDQa8fp3X6JsLy5PkMkBJNSAfeBeUWPyTlM9J0baQvgHKKXit3JFhgjfOy6Gc7h1I/8oVZIl9ySQMuT/aMPx9CnvFvkFWvedq26xNTQHHKvrTlxNMlr7GGUOU60OmrBFsO40fSUj1+n/OwKGUjLbCug== ARC-Message-Signature: i=1; a=rsa-sha256; d=lists.ozlabs.org; s=201707; t=1746003854; c=relaxed/relaxed; bh=Zumhz/f/NeuhysH9wnyORwBkCLTtfSiGRadpRGVjBfk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Cs0ynddVVSBytSiyMiCvxP/TjCHuzJMCM8e/UkPLLVctF1yBkBnP9tG0R5i4x4t4eIzgvTYYGZawx7JzsjeTH7Il1AGUjueZ8HXSkymp7oiZkZtOhvHrdwZokA7j3fbAbv2f0+LA3dj6RBoVMIL1F9JVyqxECFziTnpkM+ve8VvZFLSLjn6M9wb0HxcSZWe/3TZ3zoE2mMcnHftJDMdTlqtCB83+BW5pYrk3vXNiOQW57dPqNA+1aQ480LMFOWuIGt2vPc67VEWFV5BClu9dz0RWSzJmMxJt8W4x4weg3CBT9lsLacm3Bk3kF3O64Xs3aVjchrbeRhV/vSaI5D1Byg== ARC-Authentication-Results: i=1; lists.ozlabs.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; dkim=pass (2048-bit key; unprotected) header.d=ibm.com header.i=@ibm.com header.a=rsa-sha256 header.s=pp1 header.b=XLboUL3X; dkim-atps=neutral; spf=pass (client-ip=148.163.158.5; helo=mx0b-001b2d01.pphosted.com; envelope-from=ssrish@linux.ibm.com; receiver=lists.ozlabs.org) smtp.mailfrom=linux.ibm.com Authentication-Results: lists.ozlabs.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: lists.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=ibm.com header.i=@ibm.com header.a=rsa-sha256 header.s=pp1 header.b=XLboUL3X; dkim-atps=neutral Authentication-Results: lists.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=linux.ibm.com (client-ip=148.163.158.5; helo=mx0b-001b2d01.pphosted.com; envelope-from=ssrish@linux.ibm.com; receiver=lists.ozlabs.org) Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 4ZnWT94Nzxz3blg for ; Wed, 30 Apr 2025 19:04:13 +1000 (AEST) Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 53TNkP8p027617; Wed, 30 Apr 2025 09:04:02 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=Zumhz/f/NeuhysH9w nyORwBkCLTtfSiGRadpRGVjBfk=; b=XLboUL3X+nzBXTMaBGcZfaqjk3SZdWgZD UDLqy6F3ewOxq2kPhl3aOz2qdVgKu5kCnu3HufjwQUgcxg4nIG/huK9RoiK3EKw8 2IfpIHFUQOmxS/63HJoyTgthaDApAdfdacuPfE1jwVFQewH0jFx0Hhlsr3duSSI6 XNzSj3LAl5tvFXagIMjU6/HE2mcFUm1MwgyJcP+xCIqz4+aLEvJq+DdO2X6C4qbi r1zjOj8olqWynqlnnPZrFdGyXFZbyw7oGY8uLMyCB5Tcs/RdaLQBvcGRIoxYY/Iv C30hOfv7bGCJGWUbOq+o5jLUPl5RfsQzIONdhGAHyQMOC08u4i+NQ== Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 46b8r0sqm6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 30 Apr 2025 09:04:01 +0000 (GMT) Received: from m0353725.ppops.net (m0353725.ppops.net [127.0.0.1]) by pps.reinject (8.18.0.8/8.18.0.8) with ESMTP id 53U941h4020790; Wed, 30 Apr 2025 09:04:01 GMT Received: from ppma22.wdc07v.mail.ibm.com (5c.69.3da9.ip4.static.sl-reverse.com [169.61.105.92]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 46b8r0sqm2-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 30 Apr 2025 09:04:01 +0000 (GMT) Received: from pps.filterd (ppma22.wdc07v.mail.ibm.com [127.0.0.1]) by ppma22.wdc07v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 53U71dUj016584; Wed, 30 Apr 2025 09:04:00 GMT Received: from smtprelay06.fra02v.mail.ibm.com ([9.218.2.230]) by ppma22.wdc07v.mail.ibm.com (PPS) with ESMTPS id 469a70f8y1-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 30 Apr 2025 09:04:00 +0000 Received: from smtpav07.fra02v.mail.ibm.com (smtpav07.fra02v.mail.ibm.com [10.20.54.106]) by smtprelay06.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 53U93udV20513234 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 30 Apr 2025 09:03:56 GMT Received: from smtpav07.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7EC9D20065; Wed, 30 Apr 2025 09:03:56 +0000 (GMT) Received: from smtpav07.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id B86FA20043; Wed, 30 Apr 2025 09:03:53 +0000 (GMT) Received: from li-fc74f8cc-3279-11b2-a85c-ef5828687581.ibm.com.com (unknown [9.39.31.221]) by smtpav07.fra02v.mail.ibm.com (Postfix) with ESMTP; Wed, 30 Apr 2025 09:03:53 +0000 (GMT) From: Srish Srinivasan To: linux-integrity@vger.kernel.org, linuxppc-dev@lists.ozlabs.org Cc: maddy@linux.ibm.com, mpe@ellerman.id.au, npiggin@gmail.com, christophe.leroy@csgroup.eu, naveen@kernel.org, ajd@linux.ibm.com, zohar@linux.ibm.com, nayna@linux.ibm.com, linux-kernel@vger.kernel.org Subject: [PATCH 1/3] powerpc/pseries: Correct secvar format representation for static key management Date: Wed, 30 Apr 2025 14:33:48 +0530 Message-ID: <20250430090350.30023-2-ssrish@linux.ibm.com> X-Mailer: git-send-email 2.49.0 In-Reply-To: <20250430090350.30023-1-ssrish@linux.ibm.com> References: <20250430090350.30023-1-ssrish@linux.ibm.com> X-Mailing-List: linuxppc-dev@lists.ozlabs.org List-Id: List-Help: List-Owner: List-Post: List-Archive: , List-Subscribe: , , List-Unsubscribe: Precedence: list MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwNDMwMDA2MCBTYWx0ZWRfX+13vK5Gh/K/O n4H5UJgNIhNxU6Zfnfiy7DxWBznYrqX3dyDGDShB1Yj7yNdk/k6EB3YMb8kB2HxX+CvC7wWLiU6 UeczulnXHn4KjQRbvWfB6WWWfaxUYfHCxy+zv98owRN1d29/z/sCZzZdZeH8pg2a670DDEyhiYd stDJ9HA2U7Q8B84EivqmOGg1JRUsr7ZKIrWTTmN5hXBOkvizeSVACNM0WKIt87Ft0ViBPOyeKg8 c/E6Rh2LmQkZkY0xEG9WO3YpNe+KJM09GYOK03V2/J35SYiwWadUIiqvzKt1NmqjvW1VF5BAdd6 4kACtKBFViIldVDItglnR2Zh8inACBTVKfgm7QZIkc/plXyJ2dW7BTsj/Zvbjb+6hkaEOnUVqTx 5DKS9nbn7GOaHtVet72YEffFVL7GJgW0xb3lQz/BlfLplaUR8BVubvTz05kRtTBFszO04+iJ X-Authority-Analysis: v=2.4 cv=OqdPyz/t c=1 sm=1 tr=0 ts=6811e781 cx=c_pps a=5BHTudwdYE3Te8bg5FgnPg==:117 a=5BHTudwdYE3Te8bg5FgnPg==:17 a=XR8D0OoHHMoA:10 a=VnNF1IyMAAAA:8 a=bBRBZpPUCD0QNnH9FkMA:9 X-Proofpoint-GUID: BAHk3Ggd2D9hfL-yeVeOSX-T_peAdEW8 X-Proofpoint-ORIG-GUID: dcBnhR0V-OfBfJo4CYr5TItUhOVk5CVe X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.0.736,FMLib:17.12.80.40 definitions=2025-04-30_02,2025-04-24_02,2025-02-21_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 suspectscore=0 malwarescore=0 priorityscore=1501 bulkscore=0 mlxscore=0 lowpriorityscore=0 adultscore=0 clxscore=1011 spamscore=0 mlxlogscore=999 phishscore=0 classifier=spam authscore=0 authtc=n/a authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2504070000 definitions=main-2504300060 X-Spam-Status: No, score=-1.7 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE, SPF_PASS autolearn=disabled version=4.0.1 OzLabs 8 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-25) on lists.ozlabs.org On a PLPKS enabled PowerVM LPAR, the secvar format property for static key management is misrepresented as "ibm,plpks-sb-unknown", creating reason for confusion. Static key management mode uses fixed, built-in keys. Dynamic key management mode allows keys to be updated in production to handle security updates without firmware rebuilds. Define a function named plpks_get_sb_keymgmt_mode() to retrieve the key management mode based on the existence of the SB_VERSION property in the firmware. Set the secvar format property to either "ibm,plpks-sb-v1" or "ibm,plpks-sb-v0" based on the key management mode, and return the length of the secvar format property. Co-developed-by: Souradeep Signed-off-by: Souradeep Signed-off-by: Srish Srinivasan Reviewed-by: Mimi Zohar Reviewed-by: Stefan Berger Reviewed-by: Nayna Jain --- arch/powerpc/platforms/pseries/plpks-secvar.c | 70 +++++++++++-------- 1 file changed, 40 insertions(+), 30 deletions(-) diff --git a/arch/powerpc/platforms/pseries/plpks-secvar.c b/arch/powerpc/platforms/pseries/plpks-secvar.c index 257fd1f8bc19..d57067a733ab 100644 --- a/arch/powerpc/platforms/pseries/plpks-secvar.c +++ b/arch/powerpc/platforms/pseries/plpks-secvar.c @@ -152,39 +152,49 @@ static int plpks_set_variable(const char *key, u64 key_len, u8 *data, return rc; } -// PLPKS dynamic secure boot doesn't give us a format string in the same way OPAL does. -// Instead, report the format using the SB_VERSION variable in the keystore. -// The string is made up by us, and takes the form "ibm,plpks-sb-v" (or "ibm,plpks-sb-unknown" -// if the SB_VERSION variable doesn't exist). Hypervisor defines the SB_VERSION variable as a -// "1 byte unsigned integer value". -static ssize_t plpks_secvar_format(char *buf, size_t bufsize) +/* + * Return the key management mode. + * + * SB_VERSION is defined as a "1 byte unsigned integer value". It is owned by + * the Partition Firmware and its presence indicates that the key management + * mode is dynamic. Only signed variables have null bytes in their names. + * SB_VERSION does not. + * + * Return 1 to indicate that the key management mode is dynamic. Otherwise + * return 0, indicating that the key management mode is static. + */ +static u8 plpks_get_sb_keymgmt_mode(void) { - struct plpks_var var = {0}; - ssize_t ret; - u8 version; - - var.component = NULL; - // Only the signed variables have null bytes in their names, this one doesn't - var.name = "SB_VERSION"; - var.namelen = strlen(var.name); - var.datalen = 1; - var.data = &version; - - // Unlike the other vars, SB_VERSION is owned by firmware instead of the OS - ret = plpks_read_fw_var(&var); - if (ret) { - if (ret == -ENOENT) { - ret = snprintf(buf, bufsize, "ibm,plpks-sb-unknown"); - } else { - pr_err("Error %ld reading SB_VERSION from firmware\n", ret); - ret = -EIO; - } - goto err; + u8 mode; + ssize_t rc; + struct plpks_var var = { + .component = NULL, + .name = "SB_VERSION", + .namelen = 10, + .datalen = 1, + .data = &mode, + }; + + rc = plpks_read_fw_var(&var); + if (rc) { + pr_info("Error %ld reading SB_VERSION from firmware\n", rc); + mode = 0; } + return mode; +} - ret = snprintf(buf, bufsize, "ibm,plpks-sb-v%hhu", version); -err: - return ret; +// PLPKS dynamic secure boot doesn't give us a format string in the same way +// OPAL does. Instead, report the format using the SB_VERSION variable in the +// keystore. The string, made up by us, takes the form "ibm,plpks-sb-v".Set +// the secvar format property to either "ibm,plpks-sb-v1" or "ibm,plpks-sb-v0", +// based on the key management mode, and return the length of the secvar format +// property. +static ssize_t plpks_secvar_format(char *buf, size_t bufsize) +{ + u8 mode; + + mode = plpks_get_sb_keymgmt_mode(); + return snprintf(buf, bufsize, "ibm,plpks-sb-v%hhu", mode); } static int plpks_max_size(u64 *max_size) From patchwork Wed Apr 30 09:03:49 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Srish Srinivasan X-Patchwork-Id: 2079358 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=ibm.com header.i=@ibm.com header.a=rsa-sha256 header.s=pp1 header.b=afba0zdj; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ozlabs.org (client-ip=2404:9400:2:0:216:3eff:fee1:b9f1; helo=lists.ozlabs.org; envelope-from=linuxppc-dev+bounces-8180-incoming=patchwork.ozlabs.org@lists.ozlabs.org; receiver=patchwork.ozlabs.org) Received: from lists.ozlabs.org (lists.ozlabs.org [IPv6:2404:9400:2:0:216:3eff:fee1:b9f1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4ZnWT53m9Wz1yMf for ; Wed, 30 Apr 2025 19:04:09 +1000 (AEST) Received: from boromir.ozlabs.org (localhost [127.0.0.1]) by lists.ozlabs.org (Postfix) with ESMTP id 4ZnWTQ1YHyz3bmy; Wed, 30 Apr 2025 19:04:26 +1000 (AEST) X-Original-To: linuxppc-dev@lists.ozlabs.org Authentication-Results: lists.ozlabs.org; arc=none smtp.remote-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=lists.ozlabs.org; s=201707; t=1746003866; cv=none; b=TvwTFvhgriPRhvirG+AyQzj185QFaHtq2+71xB0ZdbuXS/nCyq6rpLk02bXk7N24AAVFcdmuM04euF+6NXc+BhmtJKkbLXzpn+asB3ilkw4sWs76zslpzg+MXRNxhUb5bdCuU6xHOeSWP804nCc6vCNAfrbrra33U8qn3HiQC2N21S8f5WwBpL+L207uoEsfx6BFI9R/vzBjdnSLLmjGoO8xxv6wYJdjIRqxwh+8aNExs3YfGmvCRYTH91s631o+LTsVjlg4ot2Yj7t7P3HZuu9hL6GbiZgvoQKQ8LY9a+kaZUVTRfhOf6px6gPFSYw/Zi4Rq8itvZKfr9blh9rBpw== ARC-Message-Signature: i=1; a=rsa-sha256; d=lists.ozlabs.org; s=201707; t=1746003866; c=relaxed/relaxed; bh=Af7hM+o5bpWc9MvFAbHaQIhEEvdEeKQ66beJNFdxsHk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=RRtBAGFA1jOkdCPBwUJPWMbS0HnnHsNNpG/CS2steulRt7vODAmuP5Yys5UnyxpRqA5i4TLBUOxX92uUZHNkCOF651OaJUA+3Uo0BDghyZ2Bwtfuh4R7w/4TrmGRcpjCw8mKEQIdJH+dwWWqopmA7uJXKqrVQCJC3abVZ7KNbPTh/GZOCG9w0hldz4MHomGlJviM4ECZgKkLL4bRk4PfshVcX9HqzHjeVKdFBMW+vYmegDo4+8HApJnVQqtD1RzhcIDLVMtCkT/ALIJi0eu/oStRSIvSBfXzcCIu1vbXuBmt6ojaeSTQMgcCS8FWLjAm4GN4nP6oT0lR5xdv8fq5Gg== ARC-Authentication-Results: i=1; lists.ozlabs.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; dkim=pass (2048-bit key; unprotected) header.d=ibm.com header.i=@ibm.com header.a=rsa-sha256 header.s=pp1 header.b=afba0zdj; dkim-atps=neutral; spf=pass (client-ip=148.163.158.5; helo=mx0b-001b2d01.pphosted.com; envelope-from=ssrish@linux.ibm.com; receiver=lists.ozlabs.org) smtp.mailfrom=linux.ibm.com Authentication-Results: lists.ozlabs.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: lists.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=ibm.com header.i=@ibm.com header.a=rsa-sha256 header.s=pp1 header.b=afba0zdj; dkim-atps=neutral Authentication-Results: lists.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=linux.ibm.com (client-ip=148.163.158.5; helo=mx0b-001b2d01.pphosted.com; envelope-from=ssrish@linux.ibm.com; receiver=lists.ozlabs.org) Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 4ZnWTP22pMz3blg for ; Wed, 30 Apr 2025 19:04:25 +1000 (AEST) Received: from pps.filterd (m0360072.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 53TLhQX2026023; Wed, 30 Apr 2025 09:04:12 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=Af7hM+o5bpWc9MvFA bHaQIhEEvdEeKQ66beJNFdxsHk=; b=afba0zdjdBrJLWkf/GGYyPXOCvYIaENvX vKXn+xSyzGI+T+Z+bMVyl3+WxaoeerZR+BySiiUtczX/4UJZR0LgwFvfxsSqEiaW FClb8watnoF/1B8DmLveVgp0ytGnJFWJxh64nhO36jMJkjZNg2ziNL/IaTs95x34 EH0RZ6O+w7dfEljm5aIfX5H7j4/BAuKcoUL1JtQOt66YIj+VxOPaBNWGdC2k0Ejj WceIqSiP7kNwIF3keP5a22D5+fIcPhNc/3gyv5+2nw30fMA2xcMqD9yZjCr9Xqcm ayV9GuRPeqeSRet709myK3wYQH/XCZoL37rASHP45e6PNnOCuizvg== Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 46b6wwa1t6-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 30 Apr 2025 09:04:11 +0000 (GMT) Received: from m0360072.ppops.net (m0360072.ppops.net [127.0.0.1]) by pps.reinject (8.18.0.8/8.18.0.8) with ESMTP id 53U91E2I012583; Wed, 30 Apr 2025 09:04:11 GMT Received: from ppma21.wdc07v.mail.ibm.com (5b.69.3da9.ip4.static.sl-reverse.com [169.61.105.91]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 46b6wwa1t2-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 30 Apr 2025 09:04:11 +0000 (GMT) Received: from pps.filterd (ppma21.wdc07v.mail.ibm.com [127.0.0.1]) by ppma21.wdc07v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 53U8aFh5000678; Wed, 30 Apr 2025 09:04:10 GMT Received: from smtprelay03.fra02v.mail.ibm.com ([9.218.2.224]) by ppma21.wdc07v.mail.ibm.com (PPS) with ESMTPS id 469atpf5m3-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 30 Apr 2025 09:04:10 +0000 Received: from smtpav07.fra02v.mail.ibm.com (smtpav07.fra02v.mail.ibm.com [10.20.54.106]) by smtprelay03.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 53U946fO58327354 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 30 Apr 2025 09:04:06 GMT Received: from smtpav07.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 7B55E20043; Wed, 30 Apr 2025 09:04:06 +0000 (GMT) Received: from smtpav07.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CE67620065; Wed, 30 Apr 2025 09:03:56 +0000 (GMT) Received: from li-fc74f8cc-3279-11b2-a85c-ef5828687581.ibm.com.com (unknown [9.39.31.221]) by smtpav07.fra02v.mail.ibm.com (Postfix) with ESMTP; Wed, 30 Apr 2025 09:03:56 +0000 (GMT) From: Srish Srinivasan To: linux-integrity@vger.kernel.org, linuxppc-dev@lists.ozlabs.org Cc: maddy@linux.ibm.com, mpe@ellerman.id.au, npiggin@gmail.com, christophe.leroy@csgroup.eu, naveen@kernel.org, ajd@linux.ibm.com, zohar@linux.ibm.com, nayna@linux.ibm.com, linux-kernel@vger.kernel.org Subject: [PATCH 2/3] powerpc/secvar: Expose secvars relevant to the key management mode Date: Wed, 30 Apr 2025 14:33:49 +0530 Message-ID: <20250430090350.30023-3-ssrish@linux.ibm.com> X-Mailer: git-send-email 2.49.0 In-Reply-To: <20250430090350.30023-1-ssrish@linux.ibm.com> References: <20250430090350.30023-1-ssrish@linux.ibm.com> X-Mailing-List: linuxppc-dev@lists.ozlabs.org List-Id: List-Help: List-Owner: List-Post: List-Archive: , List-Subscribe: , , List-Unsubscribe: Precedence: list MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-ORIG-GUID: HD6ROCfALFyy9gATbSPO3Jd7KORgYwTo X-Proofpoint-GUID: OU_ClCn2_gVoDQT8tHZjhYJer90zulYY X-Authority-Analysis: v=2.4 cv=GOIIEvNK c=1 sm=1 tr=0 ts=6811e78b cx=c_pps a=GFwsV6G8L6GxiO2Y/PsHdQ==:117 a=GFwsV6G8L6GxiO2Y/PsHdQ==:17 a=XR8D0OoHHMoA:10 a=VnNF1IyMAAAA:8 a=tLxTvSBFvjwC67ZwczkA:9 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwNDMwMDA2MCBTYWx0ZWRfX1LKC90iBEGGX QJDEfPI3bgC7YFFRZ5SkBM48J446orIzFUrKL5q8HbFnQiVokXsHi0I4yf/Q2DeCTcJTS84JBCu 3H09acg3xZd7X/0AlkcEcwIPrIYk1nQkjMOnWd2M1uROY1m+4s4yAuzKfhY7rcR6c1Tpmh/hQwy rGVGrMH6Z0TE4JQb8svm9gIA6Dt7NbefamTJFqIL+737JHdmDIHQk2ywlxs6jEzIe7cxKDqR+dX dB1RpMVGDnmLufDaU7XM865pyxBeMnKb3WayfccEu3FFR3a35/JQnIxbN+j2/Z2aujOvfr+FV9M 8sld+8i0EfHn3lpDyQJtJfHO4HTGr6+cAUc6dlPMZAsvAfUW3/8C0hdAPxnfGDut590EtHVakIa x6PQBzkb8RRkNnCgzLRrmWJEyPRPKOcmYjr7S68tJ5rRjWUhSfF18WaUdWUzb2NRLtoMSkHH X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.0.736,FMLib:17.12.80.40 definitions=2025-04-30_02,2025-04-24_02,2025-02-21_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 lowpriorityscore=0 clxscore=1011 impostorscore=0 phishscore=0 mlxscore=0 malwarescore=0 bulkscore=0 adultscore=0 priorityscore=1501 suspectscore=0 mlxlogscore=999 spamscore=0 classifier=spam authscore=0 authtc=n/a authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2504070000 definitions=main-2504300060 X-Spam-Status: No, score=-1.7 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE, SPF_PASS autolearn=disabled version=4.0.1 OzLabs 8 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-25) on lists.ozlabs.org The PLPKS enabled PowerVM LPAR sysfs exposes all of the secure boot secvars irrespective of the key management mode. The PowerVM LPAR supports static and dynamic key management for secure boot. The key management option can be updated in the management console. Only in the dynamic key mode can the user modify the secure boot secvars db, dbx, grubdb, grubdbx, and sbat, which are exposed via the sysfs interface. But the sysfs interface exposes these secvars even in the static key mode. This could lead to errors when reading them or writing to them in the static key mode. Expose only PK, trustedcadb, and moduledb in the static key mode to enable loading of signed third-party kernel modules. Co-developed-by: Souradeep Signed-off-by: Souradeep Signed-off-by: Srish Srinivasan Reviewed-by: Mimi Zohar Reviewed-by: Stefan Berger Reviewed-by: Nayna Jain Reviewed-by: Andrew Donnellan --- Documentation/ABI/testing/sysfs-secvar | 9 ++++-- arch/powerpc/platforms/pseries/plpks-secvar.c | 28 ++++++++++++++++--- 2 files changed, 30 insertions(+), 7 deletions(-) diff --git a/Documentation/ABI/testing/sysfs-secvar b/Documentation/ABI/testing/sysfs-secvar index 857cf12b0904..2bdc7d9c0c10 100644 --- a/Documentation/ABI/testing/sysfs-secvar +++ b/Documentation/ABI/testing/sysfs-secvar @@ -22,9 +22,12 @@ Description: A string indicating which backend is in use by the firmware. and is expected to be "ibm,edk2-compat-v1". On pseries/PLPKS, this is generated by the kernel based on the - version number in the SB_VERSION variable in the keystore, and - has the form "ibm,plpks-sb-v", or - "ibm,plpks-sb-unknown" if there is no SB_VERSION variable. + existence of the SB_VERSION property in firmware. This string + takes the form "ibm,plpks-sb-v1" in the presence of SB_VERSION, + indicating the key management mode is dynamic. Otherwise it + takes the form "ibm,plpks-sb-v0" in the static key management + mode. Only secvars relevant to the key management mode are + exposed. What: /sys/firmware/secvar/vars/ Date: August 2019 diff --git a/arch/powerpc/platforms/pseries/plpks-secvar.c b/arch/powerpc/platforms/pseries/plpks-secvar.c index d57067a733ab..cbcb2c356f2a 100644 --- a/arch/powerpc/platforms/pseries/plpks-secvar.c +++ b/arch/powerpc/platforms/pseries/plpks-secvar.c @@ -59,7 +59,14 @@ static u32 get_policy(const char *name) return PLPKS_SIGNEDUPDATE; } -static const char * const plpks_var_names[] = { +static const char * const plpks_var_names_static[] = { + "PK", + "moduledb", + "trustedcadb", + NULL, +}; + +static const char * const plpks_var_names_dynamic[] = { "PK", "KEK", "db", @@ -207,21 +214,34 @@ static int plpks_max_size(u64 *max_size) return 0; } +static const struct secvar_operations plpks_secvar_ops_static = { + .get = plpks_get_variable, + .set = plpks_set_variable, + .format = plpks_secvar_format, + .max_size = plpks_max_size, + .config_attrs = config_attrs, + .var_names = plpks_var_names_static, +}; -static const struct secvar_operations plpks_secvar_ops = { +static const struct secvar_operations plpks_secvar_ops_dynamic = { .get = plpks_get_variable, .set = plpks_set_variable, .format = plpks_secvar_format, .max_size = plpks_max_size, .config_attrs = config_attrs, - .var_names = plpks_var_names, + .var_names = plpks_var_names_dynamic, }; static int plpks_secvar_init(void) { + u8 mode; + if (!plpks_is_available()) return -ENODEV; - return set_secvar_ops(&plpks_secvar_ops); + mode = plpks_get_sb_keymgmt_mode(); + if (mode) + return set_secvar_ops(&plpks_secvar_ops_dynamic); + return set_secvar_ops(&plpks_secvar_ops_static); } machine_device_initcall(pseries, plpks_secvar_init); From patchwork Wed Apr 30 09:03:50 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Srish Srinivasan X-Patchwork-Id: 2079359 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=ibm.com header.i=@ibm.com header.a=rsa-sha256 header.s=pp1 header.b=JXA0JVx9; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ozlabs.org (client-ip=2404:9400:2:0:216:3eff:fee1:b9f1; helo=lists.ozlabs.org; envelope-from=linuxppc-dev+bounces-8181-incoming=patchwork.ozlabs.org@lists.ozlabs.org; receiver=patchwork.ozlabs.org) Received: from lists.ozlabs.org (lists.ozlabs.org [IPv6:2404:9400:2:0:216:3eff:fee1:b9f1]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4ZnWTC4D4Pz1yMf for ; Wed, 30 Apr 2025 19:04:15 +1000 (AEST) Received: from boromir.ozlabs.org (localhost [127.0.0.1]) by lists.ozlabs.org (Postfix) with ESMTP id 4ZnWTQ3czjz3bn8; Wed, 30 Apr 2025 19:04:26 +1000 (AEST) X-Original-To: linuxppc-dev@lists.ozlabs.org Authentication-Results: lists.ozlabs.org; arc=none smtp.remote-ip=148.163.158.5 ARC-Seal: i=1; a=rsa-sha256; d=lists.ozlabs.org; s=201707; t=1746003866; cv=none; b=QTB2gEyAq5EN7y0oY5DUl86WOJu1wakwk5xUt0JgT9vHhr5Yvw/vctHjq7Jop88z7oSQIuMzko79g85ZgCxTWitLeSseSwwHF3XYHBKoIOpLJF7AAae7u9kdhzM25Oz9RT0GNkpETQpQkrqQ26+KUdP/yO6Qlw4XYNZzoPIwHetJt+nyx7yEI7lD/QNkeianMX/IAYoPnHQG+0yWuUMoMe82SvwVm+Go8nBUf+Mg9w3r/gIMvFihrKrrh9ZcCO3bVtHDRP2n+dMGoNPTrDQDk+364+h6OeQtHfIjlkEwgO8mPRYCK16I6tXX1K/hhomxcoQPl6YjDxAgDDrHEw9XcA== ARC-Message-Signature: i=1; a=rsa-sha256; d=lists.ozlabs.org; s=201707; t=1746003866; c=relaxed/relaxed; bh=kZmvUAuKXTdsxm2nVPwxC8EqEMZqr7IelCZT3bJXADk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ADkp2UFE+mt3G+SSyd3RLI5AUoM5cWilH5BU9qbh3kLD0pw3fnISwxjh6wuCt4Iiv8CQwuLgfZLdScaUSll9MT0+dNBwNmOlhPA1qJuTcaruTGspLhIqGB5SYSLkjGtQZSoq5neKEHovOSltURS7vBzXRWHMY4tWQXmUZ0IGWTDeNonq6J1/BQopO5EEfxyQN3CEL4J7aAZgC4/IJyYa4RNPdChnpepKOSC67D9Xwf/PRAn6JCPIlEaXTukow/mPHQo8UflOVCLRp7kylDhre8cbKpMvjWoCmJtmdeVUtuWdw/X353Vt3nc65EKL1mHueg+5YGvLUcMxNAYzaasQQw== ARC-Authentication-Results: i=1; lists.ozlabs.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com; dkim=pass (2048-bit key; unprotected) header.d=ibm.com header.i=@ibm.com header.a=rsa-sha256 header.s=pp1 header.b=JXA0JVx9; dkim-atps=neutral; spf=pass (client-ip=148.163.158.5; helo=mx0b-001b2d01.pphosted.com; envelope-from=ssrish@linux.ibm.com; receiver=lists.ozlabs.org) smtp.mailfrom=linux.ibm.com Authentication-Results: lists.ozlabs.org; dmarc=pass (p=none dis=none) header.from=linux.ibm.com Authentication-Results: lists.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=ibm.com header.i=@ibm.com header.a=rsa-sha256 header.s=pp1 header.b=JXA0JVx9; dkim-atps=neutral Authentication-Results: lists.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=linux.ibm.com (client-ip=148.163.158.5; helo=mx0b-001b2d01.pphosted.com; envelope-from=ssrish@linux.ibm.com; receiver=lists.ozlabs.org) Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 4ZnWTP2xz2z3bmC for ; Wed, 30 Apr 2025 19:04:25 +1000 (AEST) Received: from pps.filterd (m0353725.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id 53TNkg4F028053; Wed, 30 Apr 2025 09:04:15 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc :content-transfer-encoding:date:from:in-reply-to:message-id :mime-version:references:subject:to; s=pp1; bh=kZmvUAuKXTdsxm2nV PwxC8EqEMZqr7IelCZT3bJXADk=; b=JXA0JVx93qGUJGvtmm/AnnbZX4LED35xe paeYvkAN3mYlCKrJWBqDcs74Ycttl4IV2aYrnALji5Y0m37+mepzbpb3wE5vbCla NgERwXeFmms25HXhabg2LqcVogVbMDVEQiG1quPW2bivtE8fTsDHt3xeeZ3pcrdZ Ouq6TXzTlXUvY7KB18UJr7pWY+un1Ccoa8l6T4ixDseyEqbFNY0KdS0pijhD3Zhe TstKGGqUgk2u/cCesNTX5WClVjUY+Frh5pcMEhjTPZq1hunncyfZ77vtxEXkLVor 12hF2lmGQMFip7x7Wyn+WETU+9oZkny28r6SpeS3yvAnQJtzef4Qg== Received: from pps.reinject (localhost [127.0.0.1]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 46b8r0sqmy-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 30 Apr 2025 09:04:14 +0000 (GMT) Received: from m0353725.ppops.net (m0353725.ppops.net [127.0.0.1]) by pps.reinject (8.18.0.8/8.18.0.8) with ESMTP id 53U941h6020790; Wed, 30 Apr 2025 09:04:14 GMT Received: from ppma12.dal12v.mail.ibm.com (dc.9e.1632.ip4.static.sl-reverse.com [50.22.158.220]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 46b8r0sqmw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 30 Apr 2025 09:04:14 +0000 (GMT) Received: from pps.filterd (ppma12.dal12v.mail.ibm.com [127.0.0.1]) by ppma12.dal12v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id 53U7Ugv1031628; Wed, 30 Apr 2025 09:04:13 GMT Received: from smtprelay01.fra02v.mail.ibm.com ([9.218.2.227]) by ppma12.dal12v.mail.ibm.com (PPS) with ESMTPS id 4699tu79x9-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 30 Apr 2025 09:04:13 +0000 Received: from smtpav07.fra02v.mail.ibm.com (smtpav07.fra02v.mail.ibm.com [10.20.54.106]) by smtprelay01.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 53U9497N58917316 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 30 Apr 2025 09:04:09 GMT Received: from smtpav07.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 9964820079; Wed, 30 Apr 2025 09:04:09 +0000 (GMT) Received: from smtpav07.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id CE65B20065; Wed, 30 Apr 2025 09:04:06 +0000 (GMT) Received: from li-fc74f8cc-3279-11b2-a85c-ef5828687581.ibm.com.com (unknown [9.39.31.221]) by smtpav07.fra02v.mail.ibm.com (Postfix) with ESMTP; Wed, 30 Apr 2025 09:04:06 +0000 (GMT) From: Srish Srinivasan To: linux-integrity@vger.kernel.org, linuxppc-dev@lists.ozlabs.org Cc: maddy@linux.ibm.com, mpe@ellerman.id.au, npiggin@gmail.com, christophe.leroy@csgroup.eu, naveen@kernel.org, ajd@linux.ibm.com, zohar@linux.ibm.com, nayna@linux.ibm.com, linux-kernel@vger.kernel.org Subject: [PATCH 3/3] integrity/platform_certs: Allow loading of keys in static key management mode Date: Wed, 30 Apr 2025 14:33:50 +0530 Message-ID: <20250430090350.30023-4-ssrish@linux.ibm.com> X-Mailer: git-send-email 2.49.0 In-Reply-To: <20250430090350.30023-1-ssrish@linux.ibm.com> References: <20250430090350.30023-1-ssrish@linux.ibm.com> X-Mailing-List: linuxppc-dev@lists.ozlabs.org List-Id: List-Help: List-Owner: List-Post: List-Archive: , List-Subscribe: , , List-Unsubscribe: Precedence: list MIME-Version: 1.0 X-TM-AS-GCONF: 00 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjUwNDMwMDA2MCBTYWx0ZWRfXxkwx/pBELxXi PUkHSRULFE+jO/gPAFl3QyEU+/snpcLYfpHt8hJ9aIlfM2HZk8MGREWd42y5l/df8XxBRX80kXD 4lCF4PAoAUskv9sGZ6yus8rFTfTmQpXqoiPMm2aApe79zfhBGFmlToCGWtKGbleZRMVKyPHUz6m 7x3d+NqWPhrtmOnZU5fcgGhzqsnc/ppYDBdcLZnJA/tCDeyMKcBJLE89sO2AS8KmuUFlqeyZmjq eN+LzuV+fVSI/NmnYQO0dg9dA0F5ADVTuwsXd8ucBt/IROhmDbPPtWXc6NwivQ2pq3exihsjF7Z xCn8THK1T6nijoo2SFooJqQ5alsFJjTIS9Rrh6LKUpMgRvCqPjT0tI4bFCcfz0ivKxbHskkzdau li/xFQg2NeCFik9BNKBmxXD5RTMo3HtiqqKFSmwaNMJE3cJ81UFrDCJHZiyOMMavFi++OO/h X-Authority-Analysis: v=2.4 cv=OqdPyz/t c=1 sm=1 tr=0 ts=6811e78e cx=c_pps a=bLidbwmWQ0KltjZqbj+ezA==:117 a=bLidbwmWQ0KltjZqbj+ezA==:17 a=XR8D0OoHHMoA:10 a=VnNF1IyMAAAA:8 a=AtMIOgTZpS777Q0Lz8kA:9 X-Proofpoint-GUID: YUFNTwMgtxTxrtbS7pwWlX3I7nRR7VGC X-Proofpoint-ORIG-GUID: DnfyhYWRTC1PWnK5XbqbXaZbp3tDUmfB X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1099,Hydra:6.0.736,FMLib:17.12.80.40 definitions=2025-04-30_02,2025-04-24_02,2025-02-21_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 suspectscore=0 malwarescore=0 priorityscore=1501 bulkscore=0 mlxscore=0 lowpriorityscore=0 adultscore=0 clxscore=1015 spamscore=0 mlxlogscore=999 phishscore=0 classifier=spam authscore=0 authtc=n/a authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.19.0-2504070000 definitions=main-2504300060 X-Spam-Status: No, score=-1.7 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, RCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE, SPF_PASS autolearn=disabled version=4.0.1 OzLabs 8 X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-25) on lists.ozlabs.org On PLPKS enabled PowerVM LPAR, there is no provision to load signed third-party kernel modules when the key management mode is static. This is because keys from secure boot secvars are only loaded when the key management mode is dynamic. Allow loading of the trustedcadb and moduledb keys even in the static key management mode, where the secvar format string takes the form "ibm,plpks-sb-v0". Signed-off-by: Srish Srinivasan Reviewed-by: Mimi Zohar Reviewed-by: Stefan Berger Reviewed-by: Nayna Jain Reviewed-by: Andrew Donnellan --- security/integrity/platform_certs/load_powerpc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/security/integrity/platform_certs/load_powerpc.c b/security/integrity/platform_certs/load_powerpc.c index c85febca3343..714c961a00f5 100644 --- a/security/integrity/platform_certs/load_powerpc.c +++ b/security/integrity/platform_certs/load_powerpc.c @@ -75,12 +75,13 @@ static int __init load_powerpc_certs(void) return -ENODEV; // Check for known secure boot implementations from OPAL or PLPKS - if (strcmp("ibm,edk2-compat-v1", buf) && strcmp("ibm,plpks-sb-v1", buf)) { + if (strcmp("ibm,edk2-compat-v1", buf) && strcmp("ibm,plpks-sb-v1", buf) && + strcmp("ibm,plpks-sb-v0", buf)) { pr_err("Unsupported secvar implementation \"%s\", not loading certs\n", buf); return -ENODEV; } - if (strcmp("ibm,plpks-sb-v1", buf) == 0) + if (strcmp("ibm,plpks-sb-v1", buf) == 0 || strcmp("ibm,plpks-sb-v0", buf) == 0) /* PLPKS authenticated variables ESL data is prefixed with 8 bytes of timestamp */ offset = 8;