lkml.org 
[lkml]   [2022]   [Dec]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Subject[PATCH v2 0/7] pseries dynamic secure boot interface using secvar
    Date
    Changes in v2:

    Remove unnecessary config vars from sysfs and document the others,
    thanks to review from Greg. If we end up needing to expose more, we
    can add them later and update the docs.

    Use sysfs_emit() instead of sprintf() for all sysfs strings

    Change the size of the sysfs binary attributes to include the 8-byte
    flags header, preventing truncation of large writes.

    This series exposes an interface to userspace for reading and writing
    secure variables contained within the PowerVM LPAR Platform KeyStore
    (PLPKS) for the purpose of configuring dynamic secure boot.

    This series builds on past work by Nayna Jain[0] in exposing PLPKS
    variables to userspace. Rather than being a generic interface for
    interacting with the keystore, however, we use the existing powerpc
    secvar infrastructure to only expose objects in the keystore used
    for dynamic secure boot. This has the benefit of leveraging an
    existing interface and making the implementation relatively minimal.

    This series needs to be applied on top of Andrew's recent bugfix
    series[1].

    There are a few relevant details to note about the implementation:

    * New additions to the secvar API, format() and max_size()
    * New optional sysfs directory "config/" for arbitrary ASCII variables
    * Some OPAL-specific code has been relocated from secvar-sysfs.c to
    powernv platform code. Would appreciate any powernv testing!
    * Variable names are fixed and only those used for secure boot are
    exposed. This is not a generic PLPKS interface, but also
    doesn't preclude one being added in future.

    With this series, both powernv and pseries platforms support dynamic
    secure boot through the same interface.

    [0]: https://lore.kernel.org/linuxppc-dev/20221106210744.603240-1-nayna@linux.ibm.com/
    [1]: https://lore.kernel.org/linuxppc-dev/20221220071626.1426786-1-ajd@linux.ibm.com/

    v1: https://lore.kernel.org/linuxppc-dev/20221228072943.429266-1-ruscur@russell.cc/

    Russell Currey (7):
    powerpc/pseries: Log hcall return codes for PLPKS debug
    powerpc/secvar: WARN_ON_ONCE() if multiple secvar ops are set
    powerpc/secvar: Use sysfs_emit() instead of sprintf()
    powerpc/secvar: Handle format string in the consumer
    powerpc/secvar: Handle max object size in the consumer
    powerpc/secvar: Extend sysfs to include config vars
    powerpc/pseries: Implement secvars for dynamic secure boot

    Documentation/ABI/testing/sysfs-secvar | 67 ++++-
    arch/powerpc/include/asm/secvar.h | 5 +
    arch/powerpc/kernel/secvar-ops.c | 4 +-
    arch/powerpc/kernel/secvar-sysfs.c | 78 +++---
    arch/powerpc/platforms/powernv/opal-secvar.c | 44 ++++
    arch/powerpc/platforms/pseries/Kconfig | 13 +
    arch/powerpc/platforms/pseries/Makefile | 4 +-
    arch/powerpc/platforms/pseries/plpks-secvar.c | 245 ++++++++++++++++++
    arch/powerpc/platforms/pseries/plpks.c | 2 +
    9 files changed, 419 insertions(+), 43 deletions(-)
    create mode 100644 arch/powerpc/platforms/pseries/plpks-secvar.c

    --
    2.38.1

    \
     
     \ /
      Last update: 2023-03-26 23:23    [W:5.185 / U:0.240 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site