• Russell Currey's avatar
    powerpc/pseries: Implement secvars for dynamic secure boot · ccadf154
    Russell Currey authored
    The pseries platform can support dynamic secure boot (i.e. secure boot
    using user-defined keys) using variables contained with the PowerVM LPAR
    Platform KeyStore (PLPKS).  Using the powerpc secvar API, expose the
    relevant variables for pseries dynamic secure boot through the existing
    secvar filesystem layout.
    
    The relevant variables for dynamic secure boot are signed in the
    keystore, and can only be modified using the H_PKS_SIGNED_UPDATE hcall.
    Object labels in the keystore are encoded using ucs2 format.  With our
    fixed variable names we don't have to care about encoding outside of the
    necessary byte padding.
    
    When a user writes to a variable, the first 8 bytes of data must contain
    the signed update flags as defined by the hypervisor.
    
    When a user reads a variable, the first 4 bytes of data contain the
    policies defined for the object.
    
    Limitations exist due to the underlying implementation of sysfs binary
    attributes, as is the case for the OPAL secvar implementation -
    partial writes are unsupported and writes cannot be larger than PAGE_SIZE.
    (Even when using bin_attributes, which can be larger than a single page,
    sysfs only gives us one page's worth of write buffer at a time, and the
    hypervisor does not expose an interface for partial writes.)
    Co-developed-by: default avatarNayna Jain <nayna@linux.ibm.com>
    Signed-off-by: default avatarNayna Jain <nayna@linux.ibm.com>
    Co-developed-by: default avatarAndrew Donnellan <ajd@linux.ibm.com>
    Signed-off-by: default avatarAndrew Donnellan <ajd@linux.ibm.com>
    Signed-off-by: default avatarRussell Currey <ruscur@russell.cc>
    [mpe: Add NLS dependency to fix build errors, squash fix from ajd]
    Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
    Link: https://lore.kernel.org/r/20230210080401.345462-25-ajd@linux.ibm.com
    ccadf154
sysfs-secvar 4.58 KB