From: Andrew Donnellan <ajd@linux.ibm.com> To: linuxppc-dev@lists.ozlabs.org, linux-integrity@vger.kernel.org Cc: gregkh@linuxfoundation.org, gcwilson@linux.ibm.com, linux-kernel@vger.kernel.org, nayna@linux.ibm.com, ruscur@russell.cc, zohar@linux.ibm.com, mpe@ellerman.id.au, gjoyce@linux.ibm.com, sudhakar@linux.ibm.com, bgray@linux.ibm.com, erichte@linux.ibm.com Subject: [PATCH v3 16/24] powerpc/pseries: Implement signed update for PLPKS objects Date: Wed, 18 Jan 2023 17:10:41 +1100 [thread overview] Message-ID: <20230118061049.1006141-17-ajd@linux.ibm.com> (raw) In-Reply-To: <20230118061049.1006141-1-ajd@linux.ibm.com> From: Nayna Jain <nayna@linux.ibm.com> The Platform Keystore provides a signed update interface which can be used to create, replace or append to certain variables in the PKS in a secure fashion, with the hypervisor requiring that the update be signed using the Platform Key. Implement an interface to the H_PKS_SIGNED_UPDATE hcall in the plpks driver to allow signed updates to PKS objects. (The plpks driver doesn't need to do any cryptography or otherwise handle the actual signed variable contents - that will be handled by userspace tooling.) Signed-off-by: Nayna Jain <nayna@linux.ibm.com> [ajd: split patch, add timeout handling and misc cleanups] Co-developed-by: Andrew Donnellan <ajd@linux.ibm.com> Signed-off-by: Andrew Donnellan <ajd@linux.ibm.com> Signed-off-by: Russell Currey <ruscur@russell.cc> --- v3: Merge plpks fixes and signed update series with secvar series Fix error code handling in plpks_confirm_object_flushed() (ruscur) Pass plpks_var struct to plpks_signed_update_var() by reference (mpe) Consistent constant naming scheme (ruscur) --- arch/powerpc/include/asm/hvcall.h | 3 +- arch/powerpc/include/asm/plpks.h | 5 ++ arch/powerpc/platforms/pseries/plpks.c | 71 ++++++++++++++++++++++++-- 3 files changed, 73 insertions(+), 6 deletions(-) diff --git a/arch/powerpc/include/asm/hvcall.h b/arch/powerpc/include/asm/hvcall.h index 95fd7f9485d5..33b26c0cb69b 100644 --- a/arch/powerpc/include/asm/hvcall.h +++ b/arch/powerpc/include/asm/hvcall.h @@ -336,7 +336,8 @@ #define H_SCM_FLUSH 0x44C #define H_GET_ENERGY_SCALE_INFO 0x450 #define H_WATCHDOG 0x45C -#define MAX_HCALL_OPCODE H_WATCHDOG +#define H_PKS_SIGNED_UPDATE 0x454 +#define MAX_HCALL_OPCODE H_PKS_SIGNED_UPDATE /* Scope args for H_SCM_UNBIND_ALL */ #define H_UNBIND_SCOPE_ALL (0x1) diff --git a/arch/powerpc/include/asm/plpks.h b/arch/powerpc/include/asm/plpks.h index 7c5f51a9af7c..e7204e6c0ca4 100644 --- a/arch/powerpc/include/asm/plpks.h +++ b/arch/powerpc/include/asm/plpks.h @@ -68,6 +68,11 @@ struct plpks_var_name_list { struct plpks_var_name varlist[]; }; +/** + * Updates the authenticated variable. It expects NULL as the component. + */ +int plpks_signed_update_var(struct plpks_var *var, u64 flags); + /** * Writes the specified var and its data to PKS. * Any caller of PKS driver should present a valid component type for diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c index 1189246b03dc..796ed5544ee5 100644 --- a/arch/powerpc/platforms/pseries/plpks.c +++ b/arch/powerpc/platforms/pseries/plpks.c @@ -81,6 +81,12 @@ static int pseries_status_to_err(int rc) err = -ENOENT; break; case H_BUSY: + case H_LONG_BUSY_ORDER_1_MSEC: + case H_LONG_BUSY_ORDER_10_MSEC: + case H_LONG_BUSY_ORDER_100_MSEC: + case H_LONG_BUSY_ORDER_1_SEC: + case H_LONG_BUSY_ORDER_10_SEC: + case H_LONG_BUSY_ORDER_100_SEC: err = -EBUSY; break; case H_AUTHORITY: @@ -184,14 +190,17 @@ static struct label *construct_label(char *component, u8 varos, u8 *name, u16 namelen) { struct label *label; - size_t slen; + size_t slen = 0; if (!name || namelen > PLPKS_MAX_NAME_SIZE) return ERR_PTR(-EINVAL); - slen = strlen(component); - if (component && slen > sizeof(label->attr.prefix)) - return ERR_PTR(-EINVAL); + // Support NULL component for signed updates + if (component) { + slen = strlen(component); + if (slen > sizeof(label->attr.prefix)) + return ERR_PTR(-EINVAL); + } // The label structure must not cross a page boundary, so we align to the next power of 2 label = kzalloc(roundup_pow_of_two(sizeof(*label)), GFP_KERNEL); @@ -397,6 +406,58 @@ static int plpks_confirm_object_flushed(struct label *label, return pseries_status_to_err(rc); } +int plpks_signed_update_var(struct plpks_var *var, u64 flags) +{ + unsigned long retbuf[PLPAR_HCALL9_BUFSIZE] = {0}; + int rc; + struct label *label; + struct plpks_auth *auth; + u64 continuetoken = 0; + u64 timeout = 0; + + if (!var->data || var->datalen <= 0 || var->namelen > PLPKS_MAX_NAME_SIZE) + return -EINVAL; + + if (!(var->policy & PLPKS_SIGNEDUPDATE)) + return -EINVAL; + + auth = construct_auth(PLPKS_OS_OWNER); + if (IS_ERR(auth)) + return PTR_ERR(auth); + + label = construct_label(var->component, var->os, var->name, var->namelen); + if (IS_ERR(label)) { + rc = PTR_ERR(label); + goto out; + } + + do { + rc = plpar_hcall9(H_PKS_SIGNED_UPDATE, retbuf, + virt_to_phys(auth), virt_to_phys(label), + label->size, var->policy, flags, + virt_to_phys(var->data), var->datalen, + continuetoken); + + continuetoken = retbuf[0]; + if (pseries_status_to_err(rc) == -EBUSY) { + int delay_ms = get_longbusy_msecs(rc); + mdelay(delay_ms); + timeout += delay_ms; + } + rc = pseries_status_to_err(rc); + } while (rc == -EBUSY && timeout < PLPKS_MAX_TIMEOUT); + + if (!rc) + rc = plpks_confirm_object_flushed(label, auth); + + kfree(label); +out: + kfree(auth); + + return rc; +} +EXPORT_SYMBOL(plpks_signed_update_var); + int plpks_write_var(struct plpks_var var) { unsigned long retbuf[PLPAR_HCALL_BUFSIZE] = { 0 }; @@ -443,7 +504,7 @@ int plpks_remove_var(char *component, u8 varos, struct plpks_var_name vname) struct label *label; int rc; - if (!component || vname.namelen > PLPKS_MAX_NAME_SIZE) + if (vname.namelen > PLPKS_MAX_NAME_SIZE) return -EINVAL; auth = construct_auth(PLPKS_OS_OWNER); -- 2.39.0
WARNING: multiple messages have this Message-ID (diff)
From: Andrew Donnellan <ajd@linux.ibm.com> To: linuxppc-dev@lists.ozlabs.org, linux-integrity@vger.kernel.org Cc: sudhakar@linux.ibm.com, bgray@linux.ibm.com, erichte@linux.ibm.com, gregkh@linuxfoundation.org, nayna@linux.ibm.com, linux-kernel@vger.kernel.org, zohar@linux.ibm.com, gjoyce@linux.ibm.com, gcwilson@linux.ibm.com Subject: [PATCH v3 16/24] powerpc/pseries: Implement signed update for PLPKS objects Date: Wed, 18 Jan 2023 17:10:41 +1100 [thread overview] Message-ID: <20230118061049.1006141-17-ajd@linux.ibm.com> (raw) In-Reply-To: <20230118061049.1006141-1-ajd@linux.ibm.com> From: Nayna Jain <nayna@linux.ibm.com> The Platform Keystore provides a signed update interface which can be used to create, replace or append to certain variables in the PKS in a secure fashion, with the hypervisor requiring that the update be signed using the Platform Key. Implement an interface to the H_PKS_SIGNED_UPDATE hcall in the plpks driver to allow signed updates to PKS objects. (The plpks driver doesn't need to do any cryptography or otherwise handle the actual signed variable contents - that will be handled by userspace tooling.) Signed-off-by: Nayna Jain <nayna@linux.ibm.com> [ajd: split patch, add timeout handling and misc cleanups] Co-developed-by: Andrew Donnellan <ajd@linux.ibm.com> Signed-off-by: Andrew Donnellan <ajd@linux.ibm.com> Signed-off-by: Russell Currey <ruscur@russell.cc> --- v3: Merge plpks fixes and signed update series with secvar series Fix error code handling in plpks_confirm_object_flushed() (ruscur) Pass plpks_var struct to plpks_signed_update_var() by reference (mpe) Consistent constant naming scheme (ruscur) --- arch/powerpc/include/asm/hvcall.h | 3 +- arch/powerpc/include/asm/plpks.h | 5 ++ arch/powerpc/platforms/pseries/plpks.c | 71 ++++++++++++++++++++++++-- 3 files changed, 73 insertions(+), 6 deletions(-) diff --git a/arch/powerpc/include/asm/hvcall.h b/arch/powerpc/include/asm/hvcall.h index 95fd7f9485d5..33b26c0cb69b 100644 --- a/arch/powerpc/include/asm/hvcall.h +++ b/arch/powerpc/include/asm/hvcall.h @@ -336,7 +336,8 @@ #define H_SCM_FLUSH 0x44C #define H_GET_ENERGY_SCALE_INFO 0x450 #define H_WATCHDOG 0x45C -#define MAX_HCALL_OPCODE H_WATCHDOG +#define H_PKS_SIGNED_UPDATE 0x454 +#define MAX_HCALL_OPCODE H_PKS_SIGNED_UPDATE /* Scope args for H_SCM_UNBIND_ALL */ #define H_UNBIND_SCOPE_ALL (0x1) diff --git a/arch/powerpc/include/asm/plpks.h b/arch/powerpc/include/asm/plpks.h index 7c5f51a9af7c..e7204e6c0ca4 100644 --- a/arch/powerpc/include/asm/plpks.h +++ b/arch/powerpc/include/asm/plpks.h @@ -68,6 +68,11 @@ struct plpks_var_name_list { struct plpks_var_name varlist[]; }; +/** + * Updates the authenticated variable. It expects NULL as the component. + */ +int plpks_signed_update_var(struct plpks_var *var, u64 flags); + /** * Writes the specified var and its data to PKS. * Any caller of PKS driver should present a valid component type for diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c index 1189246b03dc..796ed5544ee5 100644 --- a/arch/powerpc/platforms/pseries/plpks.c +++ b/arch/powerpc/platforms/pseries/plpks.c @@ -81,6 +81,12 @@ static int pseries_status_to_err(int rc) err = -ENOENT; break; case H_BUSY: + case H_LONG_BUSY_ORDER_1_MSEC: + case H_LONG_BUSY_ORDER_10_MSEC: + case H_LONG_BUSY_ORDER_100_MSEC: + case H_LONG_BUSY_ORDER_1_SEC: + case H_LONG_BUSY_ORDER_10_SEC: + case H_LONG_BUSY_ORDER_100_SEC: err = -EBUSY; break; case H_AUTHORITY: @@ -184,14 +190,17 @@ static struct label *construct_label(char *component, u8 varos, u8 *name, u16 namelen) { struct label *label; - size_t slen; + size_t slen = 0; if (!name || namelen > PLPKS_MAX_NAME_SIZE) return ERR_PTR(-EINVAL); - slen = strlen(component); - if (component && slen > sizeof(label->attr.prefix)) - return ERR_PTR(-EINVAL); + // Support NULL component for signed updates + if (component) { + slen = strlen(component); + if (slen > sizeof(label->attr.prefix)) + return ERR_PTR(-EINVAL); + } // The label structure must not cross a page boundary, so we align to the next power of 2 label = kzalloc(roundup_pow_of_two(sizeof(*label)), GFP_KERNEL); @@ -397,6 +406,58 @@ static int plpks_confirm_object_flushed(struct label *label, return pseries_status_to_err(rc); } +int plpks_signed_update_var(struct plpks_var *var, u64 flags) +{ + unsigned long retbuf[PLPAR_HCALL9_BUFSIZE] = {0}; + int rc; + struct label *label; + struct plpks_auth *auth; + u64 continuetoken = 0; + u64 timeout = 0; + + if (!var->data || var->datalen <= 0 || var->namelen > PLPKS_MAX_NAME_SIZE) + return -EINVAL; + + if (!(var->policy & PLPKS_SIGNEDUPDATE)) + return -EINVAL; + + auth = construct_auth(PLPKS_OS_OWNER); + if (IS_ERR(auth)) + return PTR_ERR(auth); + + label = construct_label(var->component, var->os, var->name, var->namelen); + if (IS_ERR(label)) { + rc = PTR_ERR(label); + goto out; + } + + do { + rc = plpar_hcall9(H_PKS_SIGNED_UPDATE, retbuf, + virt_to_phys(auth), virt_to_phys(label), + label->size, var->policy, flags, + virt_to_phys(var->data), var->datalen, + continuetoken); + + continuetoken = retbuf[0]; + if (pseries_status_to_err(rc) == -EBUSY) { + int delay_ms = get_longbusy_msecs(rc); + mdelay(delay_ms); + timeout += delay_ms; + } + rc = pseries_status_to_err(rc); + } while (rc == -EBUSY && timeout < PLPKS_MAX_TIMEOUT); + + if (!rc) + rc = plpks_confirm_object_flushed(label, auth); + + kfree(label); +out: + kfree(auth); + + return rc; +} +EXPORT_SYMBOL(plpks_signed_update_var); + int plpks_write_var(struct plpks_var var) { unsigned long retbuf[PLPAR_HCALL_BUFSIZE] = { 0 }; @@ -443,7 +504,7 @@ int plpks_remove_var(char *component, u8 varos, struct plpks_var_name vname) struct label *label; int rc; - if (!component || vname.namelen > PLPKS_MAX_NAME_SIZE) + if (vname.namelen > PLPKS_MAX_NAME_SIZE) return -EINVAL; auth = construct_auth(PLPKS_OS_OWNER); -- 2.39.0
next prev parent reply other threads:[~2023-01-18 6:33 UTC|newest] Thread overview: 72+ messages / expand[flat|nested] mbox.gz Atom feed top 2023-01-18 6:10 [PATCH v3 00/24] pSeries dynamic secure boot secvar interface + platform keyring loading Andrew Donnellan 2023-01-18 6:10 ` Andrew Donnellan 2023-01-18 6:10 ` [PATCH v3 01/24] powerpc/secvar: Use u64 in secvar_operations Andrew Donnellan 2023-01-18 6:10 ` Andrew Donnellan 2023-01-18 6:10 ` [PATCH v3 02/24] powerpc/secvar: WARN_ON_ONCE() if multiple secvar ops are set Andrew Donnellan 2023-01-18 6:10 ` Andrew Donnellan 2023-01-19 0:59 ` Nicholas Piggin 2023-01-19 0:59 ` Nicholas Piggin 2023-01-18 6:10 ` [PATCH v3 03/24] powerpc/secvar: Use sysfs_emit() instead of sprintf() Andrew Donnellan 2023-01-18 6:10 ` Andrew Donnellan 2023-01-18 6:10 ` [PATCH v3 04/24] powerpc/secvar: Handle format string in the consumer Andrew Donnellan 2023-01-18 6:10 ` Andrew Donnellan 2023-01-19 1:02 ` Nicholas Piggin 2023-01-19 1:02 ` Nicholas Piggin 2023-01-19 1:17 ` Nicholas Piggin 2023-01-19 1:17 ` Nicholas Piggin 2023-01-20 0:51 ` Russell Currey 2023-01-20 0:51 ` Russell Currey 2023-01-18 6:10 ` [PATCH v3 05/24] powerpc/secvar: Handle max object size " Andrew Donnellan 2023-01-18 6:10 ` Andrew Donnellan 2023-01-19 21:18 ` Greg Joyce 2023-01-19 21:18 ` Greg Joyce 2023-01-18 6:10 ` [PATCH v3 06/24] powerpc/secvar: Clean up init error messages Andrew Donnellan 2023-01-18 6:10 ` Andrew Donnellan 2023-01-18 6:10 ` [PATCH v3 07/24] powerpc/secvar: Extend sysfs to include config vars Andrew Donnellan 2023-01-18 6:10 ` Andrew Donnellan 2023-01-18 6:10 ` [PATCH v3 08/24] powerpc/secvar: Allow backend to populate static list of variable names Andrew Donnellan 2023-01-18 6:10 ` Andrew Donnellan 2023-01-19 1:10 ` Nicholas Piggin 2023-01-19 1:10 ` Nicholas Piggin 2023-01-20 6:20 ` Andrew Donnellan 2023-01-20 6:20 ` Andrew Donnellan 2023-01-18 6:10 ` [PATCH v3 09/24] powerpc/secvar: Warn when PAGE_SIZE is smaller than max object size Andrew Donnellan 2023-01-18 6:10 ` Andrew Donnellan 2023-01-18 6:10 ` [PATCH v3 10/24] powerpc/secvar: Don't print error on ENOENT when reading variables Andrew Donnellan 2023-01-18 6:10 ` Andrew Donnellan 2023-01-18 6:10 ` [PATCH v3 11/24] powerpc/pseries: Move plpks.h to include directory Andrew Donnellan 2023-01-18 6:10 ` Andrew Donnellan 2023-01-18 6:10 ` [PATCH v3 12/24] powerpc/pseries: Move PLPKS constants to header file Andrew Donnellan 2023-01-18 6:10 ` Andrew Donnellan 2023-01-18 6:10 ` [PATCH v3 13/24] powerpc/pseries: Fix handling of PLPKS object flushing timeout Andrew Donnellan 2023-01-18 6:10 ` Andrew Donnellan 2023-01-19 1:15 ` Nicholas Piggin 2023-01-19 1:15 ` Nicholas Piggin 2023-01-18 6:10 ` [PATCH v3 14/24] powerpc/pseries: Fix alignment of PLPKS structures and buffers Andrew Donnellan 2023-01-18 6:10 ` Andrew Donnellan 2023-01-18 6:10 ` [PATCH v3 15/24] powerpc/pseries: Expose PLPKS config values, support additional fields Andrew Donnellan 2023-01-18 6:10 ` Andrew Donnellan 2023-01-18 6:10 ` Andrew Donnellan [this message] 2023-01-18 6:10 ` [PATCH v3 16/24] powerpc/pseries: Implement signed update for PLPKS objects Andrew Donnellan 2023-01-19 1:12 ` Nicholas Piggin 2023-01-19 1:12 ` Nicholas Piggin 2023-01-18 6:10 ` [PATCH v3 17/24] powerpc/pseries: Log hcall return codes for PLPKS debug Andrew Donnellan 2023-01-18 6:10 ` Andrew Donnellan 2023-01-18 6:10 ` [PATCH v3 18/24] powerpc/pseries: Make caller pass buffer to plpks_read_var() Andrew Donnellan 2023-01-18 6:10 ` Andrew Donnellan 2023-01-18 6:10 ` [PATCH v3 19/24] powerpc/pseries: Turn PSERIES_PLPKS into a hidden option Andrew Donnellan 2023-01-18 6:10 ` Andrew Donnellan 2023-01-18 6:10 ` [PATCH v3 20/24] powerpc/pseries: Add helpers to get PLPKS password Andrew Donnellan 2023-01-18 6:10 ` Andrew Donnellan 2023-01-18 6:10 ` [PATCH v3 21/24] powerpc/pseries: Pass PLPKS password on kexec Andrew Donnellan 2023-01-18 6:10 ` Andrew Donnellan 2023-01-18 11:52 ` Andrew Donnellan 2023-01-18 11:52 ` Andrew Donnellan 2023-01-18 6:10 ` [PATCH v3 22/24] powerpc/pseries: Implement secvars for dynamic secure boot Andrew Donnellan 2023-01-18 6:10 ` Andrew Donnellan 2023-01-18 13:06 ` Stefan Berger 2023-01-18 13:06 ` Stefan Berger 2023-01-18 6:10 ` [PATCH v3 23/24] integrity/powerpc: Improve error handling & reporting when loading certs Andrew Donnellan 2023-01-18 6:10 ` Andrew Donnellan 2023-01-18 6:10 ` [PATCH v3 24/24] integrity/powerpc: Support loading keys from pseries secvar Andrew Donnellan 2023-01-18 6:10 ` Andrew Donnellan
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20230118061049.1006141-17-ajd@linux.ibm.com \ --to=ajd@linux.ibm.com \ --cc=bgray@linux.ibm.com \ --cc=erichte@linux.ibm.com \ --cc=gcwilson@linux.ibm.com \ --cc=gjoyce@linux.ibm.com \ --cc=gregkh@linuxfoundation.org \ --cc=linux-integrity@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linuxppc-dev@lists.ozlabs.org \ --cc=mpe@ellerman.id.au \ --cc=nayna@linux.ibm.com \ --cc=ruscur@russell.cc \ --cc=sudhakar@linux.ibm.com \ --cc=zohar@linux.ibm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.