Skip to content

Commit 2617839

Browse files
author
Fox Snowpatch
committed
From patchwork series 485269
https://patchwork.ozlabs.org//project/linuxppc-dev/list/?series=485269
1 parent 85ff933 commit 2617839

File tree

20 files changed

+1182
-201
lines changed

20 files changed

+1182
-201
lines changed

‎Documentation/ABI/testing/sysfs-firmware-plpks‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
What: /sys/firmware/plpks/config
2+
Date: February 2023
3+
Contact: Nayna Jain <nayna@linux.ibm.com>
4+
Description: This optional directory contains read-only config attributes as
5+
defined by the PLPKS implementation. All data is in ASCII
6+
format.
7+
8+
What: /sys/firmware/plpks/config/version
9+
Date: February 2023
10+
Contact: Nayna Jain <nayna@linux.ibm.com>
11+
Description: Config version as reported by the hypervisor in ASCII decimal
12+
format.
13+
14+
What: /sys/firmware/plpks/config/max_object_size
15+
Date: February 2023
16+
Contact: Nayna Jain <nayna@linux.ibm.com>
17+
Description: Maximum allowed size of objects in the keystore in bytes,
18+
represented in ASCII decimal format.
19+
20+
This is not necessarily the same as the max size that can be
21+
written to an update file as writes can contain more than
22+
object data, you should use the size of the update file for
23+
that purpose.
24+
25+
What: /sys/firmware/plpks/config/total_size
26+
Date: February 2023
27+
Contact: Nayna Jain <nayna@linux.ibm.com>
28+
Description: Total size of the PLPKS in bytes, represented in ASCII decimal
29+
format.
30+
31+
What: /sys/firmware/plpks/config/used_space
32+
Date: February 2023
33+
Contact: Nayna Jain <nayna@linux.ibm.com>
34+
Description: Current space consumed by the key store, in bytes, represented
35+
in ASCII decimal format.
36+
37+
What: /sys/firmware/plpks/config/supported_policies
38+
Date: February 2023
39+
Contact: Nayna Jain <nayna@linux.ibm.com>
40+
Description: Bitmask of supported policy flags by the hypervisor, represented
41+
as an 8 byte hexadecimal ASCII string. Consult the hypervisor
42+
documentation for what these flags are.
43+
44+
What: /sys/firmware/plpks/config/signed_update_algorithms
45+
Date: February 2023
46+
Contact: Nayna Jain <nayna@linux.ibm.com>
47+
Description: Bitmask of flags indicating which algorithms the hypervisor
48+
supports for signed update of objects, represented as a 16 byte
49+
hexadecimal ASCII string. Consult the hypervisor documentation
50+
for what these flags mean.
51+
52+
What: /sys/firmware/plpks/config/wrapping_features
53+
Date: November 2025
54+
Contact: Srish Srinivasan <ssrish@linux.ibm.com>
55+
Description: Bitmask of the wrapping features indicating the wrapping
56+
algorithms that are supported for the H_PKS_WRAP_OBJECT requests
57+
, represented as a 8 byte hexadecimal ASCII string. Consult the
58+
hypervisor documentation for what these flags mean.

‎Documentation/ABI/testing/sysfs-secvar‎

Lines changed: 0 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -63,68 +63,3 @@ Contact: Nayna Jain <nayna@linux.ibm.com>
6363
Description: A write-only file that is used to submit the new value for the
6464
variable. The size of the file represents the maximum size of
6565
the variable data that can be written.
66-
67-
What: /sys/firmware/secvar/config
68-
Date: February 2023
69-
Contact: Nayna Jain <nayna@linux.ibm.com>
70-
Description: This optional directory contains read-only config attributes as
71-
defined by the secure variable implementation. All data is in
72-
ASCII format. The directory is only created if the backing
73-
implementation provides variables to populate it, which at
74-
present is only PLPKS on the pseries platform.
75-
76-
What: /sys/firmware/secvar/config/version
77-
Date: February 2023
78-
Contact: Nayna Jain <nayna@linux.ibm.com>
79-
Description: Config version as reported by the hypervisor in ASCII decimal
80-
format.
81-
82-
Currently only provided by PLPKS on the pseries platform.
83-
84-
What: /sys/firmware/secvar/config/max_object_size
85-
Date: February 2023
86-
Contact: Nayna Jain <nayna@linux.ibm.com>
87-
Description: Maximum allowed size of objects in the keystore in bytes,
88-
represented in ASCII decimal format.
89-
90-
This is not necessarily the same as the max size that can be
91-
written to an update file as writes can contain more than
92-
object data, you should use the size of the update file for
93-
that purpose.
94-
95-
Currently only provided by PLPKS on the pseries platform.
96-
97-
What: /sys/firmware/secvar/config/total_size
98-
Date: February 2023
99-
Contact: Nayna Jain <nayna@linux.ibm.com>
100-
Description: Total size of the PLPKS in bytes, represented in ASCII decimal
101-
format.
102-
103-
Currently only provided by PLPKS on the pseries platform.
104-
105-
What: /sys/firmware/secvar/config/used_space
106-
Date: February 2023
107-
Contact: Nayna Jain <nayna@linux.ibm.com>
108-
Description: Current space consumed by the key store, in bytes, represented
109-
in ASCII decimal format.
110-
111-
Currently only provided by PLPKS on the pseries platform.
112-
113-
What: /sys/firmware/secvar/config/supported_policies
114-
Date: February 2023
115-
Contact: Nayna Jain <nayna@linux.ibm.com>
116-
Description: Bitmask of supported policy flags by the hypervisor,
117-
represented as an 8 byte hexadecimal ASCII string. Consult the
118-
hypervisor documentation for what these flags are.
119-
120-
Currently only provided by PLPKS on the pseries platform.
121-
122-
What: /sys/firmware/secvar/config/signed_update_algorithms
123-
Date: February 2023
124-
Contact: Nayna Jain <nayna@linux.ibm.com>
125-
Description: Bitmask of flags indicating which algorithms the hypervisor
126-
supports for signed update of objects, represented as a 16 byte
127-
hexadecimal ASCII string. Consult the hypervisor documentation
128-
for what these flags mean.
129-
130-
Currently only provided by PLPKS on the pseries platform.

‎Documentation/admin-guide/kernel-parameters.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7633,6 +7633,7 @@
76337633
- "tee"
76347634
- "caam"
76357635
- "dcp"
7636+
- "pkwm"
76367637
If not specified then it defaults to iterating through
76377638
the trust source list starting with TPM and assigns the
76387639
first trust source as a backend which is initialized

‎Documentation/arch/powerpc/papr_hcalls.rst‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -300,6 +300,49 @@ H_HTM supports setup, configuration, control and dumping of Hardware Trace
300300
Macro (HTM) function and its data. HTM buffer stores tracing data for functions
301301
like core instruction, core LLAT and nest.
302302

303+
**H_PKS_GEN_KEY**
304+
305+
| Input: authorization, objectlabel, objectlabellen, policy, out, outlen
306+
| Out: *Hypervisor Generated Key, or None when the wrapping key policy is set*
307+
| Return Value: *H_SUCCESS, H_Function, H_State, H_R_State, H_Parameter, H_P2,
308+
H_P3, H_P4, H_P5, H_P6, H_Authority, H_Nomem, H_Busy, H_Resource,
309+
H_Aborted*
310+
311+
H_PKS_GEN_KEY is used to have the hypervisor generate a new random key.
312+
This key is stored as an object in the Power LPAR Platform KeyStore with
313+
the provided object label. With the wrapping key policy set the key is only
314+
visible to the hypervisor, while the key's label would still be visible to
315+
the user. Generation of wrapping keys is supported only for a key size of
316+
32 bytes.
317+
318+
**H_PKS_WRAP_OBJECT**
319+
320+
| Input: authorization, wrapkeylabel, wrapkeylabellen, objectwrapflags, in,
321+
| inlen, out, outlen, continue-token
322+
| Out: *continue-token, byte size of wrapped object, wrapped object*
323+
| Return Value: *H_SUCCESS, H_Function, H_State, H_R_State, H_Parameter, H_P2,
324+
H_P3, H_P4, H_P5, H_P6, H_P7, H_P8, H_P9, H_Authority, H_Invalid_Key,
325+
H_NOT_FOUND, H_Busy, H_LongBusy, H_Aborted*
326+
327+
H_PKS_WRAP_OBJECT is used to wrap an object using a wrapping key stored in the
328+
Power LPAR Platform KeyStore and return the wrapped object to the caller. The
329+
caller provides a label to a wrapping key with the 'wrapping key' policy set,
330+
which must have been previously created with H_PKS_GEN_KEY. The provided object
331+
is then encrypted with the wrapping key and additional metadata and the result
332+
is returned to the caller.
333+
334+
335+
**H_PKS_UNWRAP_OBJECT**
336+
337+
| Input: authorization, objectwrapflags, in, inlen, out, outlen, continue-token
338+
| Out: *continue-token, byte size of unwrapped object, unwrapped object*
339+
| Return Value: *H_SUCCESS, H_Function, H_State, H_R_State, H_Parameter, H_P2,
340+
H_P3, H_P4, H_P5, H_P6, H_P7, H_Authority, H_Unsupported, H_Bad_Data,
341+
H_NOT_FOUND, H_Invalid_Key, H_Busy, H_LongBusy, H_Aborted*
342+
343+
H_PKS_UNWRAP_OBJECT is used to unwrap an object that was previously warapped with
344+
H_PKS_WRAP_OBJECT.
345+
303346
References
304347
==========
305348
.. [1] "Power Architecture Platform Reference"

‎Documentation/security/keys/trusted-encrypted.rst‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,14 @@ safe.
5050
and the UNIQUE key. Default is to use the UNIQUE key, but selecting
5151
the OTP key can be done via a module parameter (dcp_use_otp_key).
5252

53+
(5) PKWM (PowerVM Key Wrapping Module: IBM PowerVM + Platform KeyStore)
54+
55+
Rooted to a unique, per-LPAR key, which is derived from a system-wide,
56+
randomly generated LPAR root key. Both the per-LPAR keys and the LPAR
57+
root key are stored in hypervisor-owned secure memory at runtime,
58+
and the LPAR root key is additionally persisted in secure locations
59+
such as the processor SEEPROMs and encrypted NVRAM.
60+
5361
* Execution isolation
5462

5563
(1) TPM
@@ -71,6 +79,14 @@ safe.
7179
environment. Only basic blob key encryption is executed there.
7280
The actual key sealing/unsealing is done on main processor/kernel space.
7381

82+
(5) PKWM (PowerVM Key Wrapping Module: IBM PowerVM + Platform KeyStore)
83+
84+
Fixed set of cryptographic operations done on on-chip hardware
85+
cryptographic acceleration unit NX. Keys for wrapping and unwrapping
86+
are managed by PowerVM Platform KeyStore, which stores keys in an
87+
isolated in-memory copy in secure hypervisor memory, as well as in a
88+
persistent copy in hypervisor-encrypted NVRAM.
89+
7490
* Optional binding to platform integrity state
7591

7692
(1) TPM
@@ -98,6 +114,11 @@ safe.
98114
Relies on Secure/Trusted boot process (called HAB by vendor) for
99115
platform integrity.
100116

117+
(5) PKWM (PowerVM Key Wrapping Module: IBM PowerVM + Platform KeyStore)
118+
119+
Relies on secure and trusted boot process of IBM Power systems for
120+
platform integrity.
121+
101122
* Interfaces and APIs
102123

103124
(1) TPM
@@ -118,6 +139,11 @@ safe.
118139
Vendor-specific API that is implemented as part of the DCP crypto driver in
119140
``drivers/crypto/mxs-dcp.c``.
120141

142+
(5) PKWM (PowerVM Key Wrapping Module: IBM PowerVM + Platform KeyStore)
143+
144+
Platform Keystore has well documented interfaces in PAPR document.
145+
Refer to ``Documentation/arch/powerpc/papr_hcalls.rst``
146+
121147
* Threat model
122148

123149
The strength and appropriateness of a particular trust source for a given
@@ -160,6 +186,10 @@ selected trust source:
160186
a dedicated hardware RNG that is independent from DCP which can be enabled
161187
to back the kernel RNG.
162188

189+
* PKWM (PowerVM Key Wrapping Module: IBM PowerVM + Platform KeyStore)
190+
191+
The normal kernel random number generator is used to generate keys.
192+
163193
Users may override this by specifying ``trusted.rng=kernel`` on the kernel
164194
command-line to override the used RNG with the kernel's random number pool.
165195

@@ -275,6 +305,26 @@ Usage::
275305
specific to this DCP key-blob implementation. The key length for new keys is
276306
always in bytes. Trusted Keys can be 32 - 128 bytes (256 - 1024 bits).
277307

308+
Trusted Keys usage: PKWM
309+
------------------------
310+
311+
Usage::
312+
313+
keyctl add trusted name "new keylen [options]" ring
314+
keyctl add trusted name "load hex_blob" ring
315+
keyctl print keyid
316+
317+
options:
318+
wrap_flags= ascii hex value of security policy requirement
319+
0x00: no secure boot requirement (default)
320+
0x01: require secure boot to be in either audit or
321+
enforced mode
322+
0x02: require secure boot to be in enforced mode
323+
324+
"keyctl print" returns an ASCII hex copy of the sealed key, which is in format
325+
specific to PKWM key-blob implementation. The key length for new keys is
326+
always in bytes. Trusted Keys can be 32 - 128 bytes (256 - 1024 bits).
327+
278328
Encrypted Keys usage
279329
--------------------
280330

‎MAINTAINERS‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13841,6 +13841,15 @@ S: Supported
1384113841
F: include/keys/trusted_dcp.h
1384213842
F: security/keys/trusted-keys/trusted_dcp.c
1384313843

13844+
KEYS-TRUSTED-PLPKS
13845+
M: Srish Srinivasan <ssrish@linux.ibm.com>
13846+
M: Nayna Jain <nayna@linux.ibm.com>
13847+
L: linux-integrity@vger.kernel.org
13848+
L: keyrings@vger.kernel.org
13849+
S: Supported
13850+
F: include/keys/trusted_plpks.h
13851+
F: security/keys/trusted-keys/trusted_pkwm.c
13852+
1384413853
KEYS-TRUSTED-TEE
1384513854
M: Sumit Garg <sumit.garg@kernel.org>
1384613855
L: linux-integrity@vger.kernel.org

‎arch/powerpc/include/asm/hvcall.h‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -360,7 +360,9 @@
360360
#define H_GUEST_RUN_VCPU 0x480
361361
#define H_GUEST_COPY_MEMORY 0x484
362362
#define H_GUEST_DELETE 0x488
363-
#define MAX_HCALL_OPCODE H_GUEST_DELETE
363+
#define H_PKS_WRAP_OBJECT 0x490
364+
#define H_PKS_UNWRAP_OBJECT 0x494
365+
#define MAX_HCALL_OPCODE H_PKS_UNWRAP_OBJECT
364366

365367
/* Scope args for H_SCM_UNBIND_ALL */
366368
#define H_UNBIND_SCOPE_ALL (0x1)

0 commit comments

Comments
 (0)