From patchwork Wed Jan 18 06:10:25 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andrew Donnellan X-Patchwork-Id: 4149 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:eb09:0:0:0:0:0 with SMTP id s9csp2175448wrn; Tue, 17 Jan 2023 22:35:52 -0800 (PST) X-Google-Smtp-Source: AMrXdXvOvuRLMKPRL9v4JEZWVczPWL5F4jH/KONfgt20YEFpMfP1GFPZ+4wkToNtvIIjM4TBN2Hi X-Received: by 2002:a17:902:aa82:b0:193:2f1a:65b1 with SMTP id d2-20020a170902aa8200b001932f1a65b1mr24616493plr.59.1674023752463; Tue, 17 Jan 2023 22:35:52 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1674023752; cv=none; d=google.com; s=arc-20160816; b=fGJqm57mJ6r4GymeFHvmXz8P8XZ2opk+LvA2dT1a5CI3PfmymRMe4J6xnBZ3zhldwF oU1p3Me01F2wxpF5G1B1HGJikE2d6wCb8m0zXXocQbeMcoAEsSNQZLzK926XRAM1eEVJ UA+99fhEttZDtWpyVMHcsJGeNpSkltWmI73/sGvg6VZCb9R2LtSTQczQuLebrbFQ1/It hFjCRVj6RPQS5yOhc2SgKYndQk3UL8ozN4BeXbfeq+h4jg1G3LVrE0gOqP68haw3e6tC sJPjWf8bhdSUlXW3jr52HsZzKjmkS+lPAEiUAjM4K8PJBCFEVuNLjRrKEjzVeh8xiII6 qjHQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:mime-version:content-transfer-encoding :message-id:date:subject:cc:to:from:dkim-signature; bh=dfnVYVY5V1BVtF6bk6/ezlFkujH1gUPSTLDFMGtXI8Y=; b=cIMX+UN+dNoYO/P9n8iuov49rDewQT3yB4L0JNsNGt1Tk5TY1nL4EpB1Rll9YE7KxC Quur15AVL9xQmW4vbYUuXLWtanqpTzK90Ob74CoMhClYSqayLT4f8w5GrhcZcJ6X5I0s HnckpG72J8XH322Ia6otgMc+Uxm5CrzvSw+FBvlgb2yxEddXshLN5WA82WIOz8/Vah5/ 5myb5QlF+JoC9GCeTczwEja9+VMFGPJ/1TucwRamTpTP0+u86udltvZjcjuQyMI7L2ek cLxwEunbNvpGNPrqGi6DCxXiAqwZ/q1RYdvZKR3dUPFjH84QFVnVhwZBQHOcDURiO8G0 k0BA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@ibm.com header.s=pp1 header.b=i7SQG7bJ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=NONE dis=NONE) header.from=ibm.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id o10-20020a170902d4ca00b00186e8c3782esi12690211plg.386.2023.01.17.22.35.40; Tue, 17 Jan 2023 22:35:52 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@ibm.com header.s=pp1 header.b=i7SQG7bJ; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=NONE dis=NONE) header.from=ibm.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229947AbjARGfM (ORCPT + 99 others); Wed, 18 Jan 2023 01:35:12 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54052 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229684AbjARGWB (ORCPT ); Wed, 18 Jan 2023 01:22:01 -0500 Received: from mx0b-001b2d01.pphosted.com (mx0b-001b2d01.pphosted.com [148.163.158.5]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 85DB84DCE6; Tue, 17 Jan 2023 22:11:25 -0800 (PST) Received: from pps.filterd (m0098417.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.17.1.19/8.17.1.19) with ESMTP id 30I4mMGU027640; Wed, 18 Jan 2023 06:11:15 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=from : to : cc : subject : date : message-id : content-transfer-encoding : mime-version; s=pp1; bh=dfnVYVY5V1BVtF6bk6/ezlFkujH1gUPSTLDFMGtXI8Y=; b=i7SQG7bJXaNo0M3XdE60ghJVFUugcac0eOxJT18qJJhxCutthdIH0ch2OEtFHc7G8f/s N5v8TQYZNLxI7CCz0OEZRuCp4+wlHb0Mi+6oY8qjwVB9Fcd/2m8kVc9vpW1rnPr7IqWf eLxRBnQexgdAhrdE6ykGeaoAv24ni5ZV4bQxMtci6vbUp7RvD01faDfeFWyc18Q7c6wY CMywrxQ5vb962Cq2PjwhQkTmOhpR0gCVELFItH5p/mXV04EYHlaitQzjwOOQpHZScdbR fcfSAaoNDdxi7S9VcecKL4FmeUeFihktnRDOJ9r6ErJd+9wUz1k6PhL064ojCJzSkjfu Aw== Received: from ppma03ams.nl.ibm.com (62.31.33a9.ip4.static.sl-reverse.com [169.51.49.98]) by mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 3n6a2m1djp-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 18 Jan 2023 06:11:15 +0000 Received: from pps.filterd (ppma03ams.nl.ibm.com [127.0.0.1]) by ppma03ams.nl.ibm.com (8.17.1.19/8.17.1.19) with ESMTP id 30HMJ28l023694; Wed, 18 Jan 2023 06:11:13 GMT Received: from smtprelay01.fra02v.mail.ibm.com ([9.218.2.227]) by ppma03ams.nl.ibm.com (PPS) with ESMTPS id 3n3m16mttb-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Wed, 18 Jan 2023 06:11:13 +0000 Received: from smtpav04.fra02v.mail.ibm.com (smtpav04.fra02v.mail.ibm.com [10.20.54.103]) by smtprelay01.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id 30I6BBW147186334 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 18 Jan 2023 06:11:11 GMT Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 04DFC2004F; Wed, 18 Jan 2023 06:11:11 +0000 (GMT) Received: from smtpav04.fra02v.mail.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 0CC9D20043; Wed, 18 Jan 2023 06:11:10 +0000 (GMT) Received: from ozlabs.au.ibm.com (unknown [9.192.253.14]) by smtpav04.fra02v.mail.ibm.com (Postfix) with ESMTP; Wed, 18 Jan 2023 06:11:10 +0000 (GMT) Received: from jarvis-ozlabs-ibm-com.ozlabs.ibm.com (haven.au.ibm.com [9.192.254.114]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.au.ibm.com (Postfix) with ESMTPSA id 0CF6F60306; Wed, 18 Jan 2023 17:11:08 +1100 (AEDT) From: Andrew Donnellan To: linuxppc-dev@lists.ozlabs.org, linux-integrity@vger.kernel.org Cc: gregkh@linuxfoundation.org, gcwilson@linux.ibm.com, linux-kernel@vger.kernel.org, nayna@linux.ibm.com, ruscur@russell.cc, zohar@linux.ibm.com, mpe@ellerman.id.au, gjoyce@linux.ibm.com, sudhakar@linux.ibm.com, bgray@linux.ibm.com, erichte@linux.ibm.com Subject: [PATCH v3 00/24] pSeries dynamic secure boot secvar interface + platform keyring loading Date: Wed, 18 Jan 2023 17:10:25 +1100 Message-Id: <20230118061049.1006141-1-ajd@linux.ibm.com> X-Mailer: git-send-email 2.39.0 X-TM-AS-GCONF: 00 X-Proofpoint-GUID: J1wknze5S8m04rW8ai4wFRweqbPqLH3O X-Proofpoint-ORIG-GUID: J1wknze5S8m04rW8ai4wFRweqbPqLH3O X-Proofpoint-UnRewURL: 0 URL was un-rewritten MIME-Version: 1.0 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.219,Aquarius:18.0.923,Hydra:6.0.562,FMLib:17.11.122.1 definitions=2023-01-18_01,2023-01-17_01,2022-06-22_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 mlxscore=0 adultscore=0 bulkscore=0 phishscore=0 clxscore=1011 spamscore=0 malwarescore=0 mlxlogscore=999 lowpriorityscore=0 suspectscore=0 priorityscore=1501 impostorscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2212070000 definitions=main-2301180051 X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_EF,RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1755341130176562412?= X-GMAIL-MSGID: =?utf-8?q?1755341130176562412?= This series exposes an interface to userspace for reading and writing secure variables contained within the PowerVM LPAR Platform KeyStore (PLPKS) for the purpose of configuring dynamic secure boot, and adds the glue required to load keys from the PLPKS into the platform keyring. This series builds on past work by Nayna Jain[0] in exposing PLPKS variables to userspace. Rather than being a generic interface for interacting with the keystore, however, we use the existing powerpc secvar infrastructure to only expose objects in the keystore used for dynamic secure boot. This has the benefit of leveraging an existing interface and making the implementation relatively minimal. This series integrates a previous series to fix some bugs in PLPKS and implement support for signed updates[1], and a cleanup patch from Michael Ellerman[2]. There are a few relevant details to note about the implementation: * New additions to the secvar API: format(), max_size(), config_attrs, var_names * New optional sysfs directory "config/" for arbitrary ASCII variables * Some OPAL-specific code has been relocated from secvar-sysfs.c to powernv platform code. Would appreciate any powernv testing! * Variable names are fixed and only those used for secure boot are exposed. This is not a generic PLPKS interface, but also doesn't preclude one being added in future. With this series, both powernv and pseries platforms support dynamic secure boot through the same interface. [0]: https://lore.kernel.org/linuxppc-dev/20221106210744.603240-1-nayna@linux.ibm.com/ [1]: https://lore.kernel.org/linuxppc-dev/20221220071626.1426786-1-ajd@linux.ibm.com/ [2]: https://lore.kernel.org/linuxppc-dev/20230112023819.1692452-1-mpe@ellerman.id.au/ v1: https://lore.kernel.org/linuxppc-dev/20221228072943.429266-1-ruscur@russell.cc/ v2: https://lore.kernel.org/linuxppc-dev/20221230042014.154483-1-ruscur@russell.cc/ ================= Changes in v3: Integrate Andrew's PLPKS bugfixes and enhancements series and Michael Ellerman's u64 cleanup patch into this series (and update the other patches to use u64) New patches to load keys from the PLPKS into the kernel's platform keyring (ruscur) New patches to pass PLPKS password to new kernels when kexecing (ruscur) Improve handling of format strings (ruscur) Clean up secvar error messages (ajd) Merge config attributes into secvar_operations (mpe) Add a new static variable names API rather than (ab)using get_next() (ajd/mpe) Warning message when PAGE_SIZE is smaller than the max object size (ajd) Move plpks.h to the include directory, and move a bunch of constants in there with a consistent naming scheme Refresh PLPKS config values whenever plpks_get_usedspace() is called (ajd) Extra validation on PLPKS config values (ruscur) Return maxobjlabelsize to userspace as is without subtracting overhead (ruscur) Fix error code handling in plpks_confirm_object_flushed() (ruscur) Pass plpks_var struct to plpks_signed_update_var() by reference (mpe) Make the data buffer in plpks_read_var() caller-allocated to reduce number of allocations/copies (mpe) Rework the Kconfig options so that PSERIES_PLPKS is a hidden option, turned on by enabling PPC_SECURE_BOOT, and the PLPKS secvar code is activated by PPC_SECVAR_SYSFS to match powernv (ajd) Use machine_arch_initcall() rather than device_initcall() so we don't break powernv (mpe) Improve ABI documentation (mpe) Return -EIO on most read errors (mpe) Add "grubdbx" variable (Sudhakar) Use utf8s_to_utf16s() rather than our own "UCS-2" conversion code (mpe) Fix SB_VERSION data length (ruscur) Stop prepending policy data on read (ruscur) Don't print errors to the kernel log when reading non-existent variables (Sudhakar) Miscellaneous code style, checkpatch cleanups Changes in v2: Remove unnecessary config vars from sysfs and document the others, thanks to review from Greg. If we end up needing to expose more, we can add them later and update the docs. Use sysfs_emit() instead of sprintf() for all sysfs strings Change the size of the sysfs binary attributes to include the 8-byte flags header, preventing truncation of large writes. Andrew Donnellan (8): powerpc/secvar: Clean up init error messages powerpc/secvar: Allow backend to populate static list of variable names powerpc/secvar: Warn when PAGE_SIZE is smaller than max object size powerpc/secvar: Don't print error on ENOENT when reading variables powerpc/pseries: Fix handling of PLPKS object flushing timeout powerpc/pseries: Fix alignment of PLPKS structures and buffers powerpc/pseries: Make caller pass buffer to plpks_read_var() powerpc/pseries: Turn PSERIES_PLPKS into a hidden option Michael Ellerman (1): powerpc/secvar: Use u64 in secvar_operations Nayna Jain (2): powerpc/pseries: Expose PLPKS config values, support additional fields powerpc/pseries: Implement signed update for PLPKS objects Russell Currey (13): powerpc/secvar: WARN_ON_ONCE() if multiple secvar ops are set powerpc/secvar: Use sysfs_emit() instead of sprintf() powerpc/secvar: Handle format string in the consumer powerpc/secvar: Handle max object size in the consumer powerpc/secvar: Extend sysfs to include config vars powerpc/pseries: Move plpks.h to include directory powerpc/pseries: Move PLPKS constants to header file powerpc/pseries: Log hcall return codes for PLPKS debug powerpc/pseries: Add helpers to get PLPKS password powerpc/pseries: Pass PLPKS password on kexec powerpc/pseries: Implement secvars for dynamic secure boot integrity/powerpc: Improve error handling & reporting when loading certs integrity/powerpc: Support loading keys from pseries secvar Documentation/ABI/testing/sysfs-secvar | 75 +++- arch/powerpc/Kconfig | 1 + arch/powerpc/include/asm/hvcall.h | 3 +- arch/powerpc/include/asm/plpks.h | 187 ++++++++++ arch/powerpc/include/asm/secvar.h | 19 +- arch/powerpc/kernel/secvar-ops.c | 4 +- arch/powerpc/kernel/secvar-sysfs.c | 168 +++++---- arch/powerpc/kexec/file_load_64.c | 17 +- arch/powerpc/platforms/powernv/opal-secvar.c | 53 ++- arch/powerpc/platforms/pseries/Kconfig | 11 +- arch/powerpc/platforms/pseries/Makefile | 4 +- arch/powerpc/platforms/pseries/plpks-secvar.c | 214 +++++++++++ arch/powerpc/platforms/pseries/plpks.c | 338 ++++++++++++++---- arch/powerpc/platforms/pseries/plpks.h | 71 ---- .../integrity/platform_certs/load_powerpc.c | 47 ++- 15 files changed, 965 insertions(+), 247 deletions(-) create mode 100644 arch/powerpc/include/asm/plpks.h create mode 100644 arch/powerpc/platforms/pseries/plpks-secvar.c delete mode 100644 arch/powerpc/platforms/pseries/plpks.h