lkml.org 
[lkml]   [2022]   [Jan]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Subject[RFC PATCH 0/2] powerpc/pseries: add support for local secure storage called Platform Keystore(PKS)
Date
PowerVM provides an isolated Platform Keystore(PKS) storage allocation
for each partition with individually managed access controls to store
sensitive information securely. Linux Kernel can access this storage by
interfacing with hypervisor using a new set of hypervisor calls.

PowerVM guest secure boot intend to use Platform Keystore for the
purpose of storing public keys. Secure boot requires public keys to
be able to verify the grub and boot kernel. To allow authenticated
manipulation of keys, it supports variables to store key authorities
- PK/KEK and code signing keys - db. It also supports denied list to
disallow booting even if signed with valid key. This is done via
denied list database - dbx or sbat. These variables would be stored in
PKS, and are managed and controlled by firmware.

The purpose of this patchset is to add support for users to
read/write/add/delete variables required for secure boot on PowerVM.

Nayna Jain (2):
pseries: define driver for Platform Keystore
pseries: define sysfs interface to expose PKS variables

Documentation/ABI/testing/sysfs-pksvar | 77 +++
arch/powerpc/include/asm/hvcall.h | 13 +-
arch/powerpc/include/asm/pks.h | 84 +++
arch/powerpc/platforms/pseries/Kconfig | 17 +
arch/powerpc/platforms/pseries/Makefile | 2 +
arch/powerpc/platforms/pseries/pks.c | 494 ++++++++++++++++++
arch/powerpc/platforms/pseries/pksvar-sysfs.c | 356 +++++++++++++
7 files changed, 1042 insertions(+), 1 deletion(-)
create mode 100644 Documentation/ABI/testing/sysfs-pksvar
create mode 100644 arch/powerpc/include/asm/pks.h
create mode 100644 arch/powerpc/platforms/pseries/pks.c
create mode 100644 arch/powerpc/platforms/pseries/pksvar-sysfs.c

--
2.27.0

\
 
 \ /
  Last update: 2022-01-22 01:59    [W:0.068 / U:2.128 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site