iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

integrity/powerpc: Support loading keys from PLPKS

Browse Source 
Add support for loading keys from the PLPKS on pseries machines, with the
"ibm,plpks-sb-v1" format.

The object format is expected to be the same, so there shouldn't be any
functional differences between objects retrieved on powernv or pseries.

Unlike on powernv, on pseries the format string isn't contained in the
device tree. Use secvar_ops->format() to fetch the format string in a
generic manner, rather than searching the device tree ourselves.

(The current code searches the device tree for a node compatible with
"ibm,edk2-compat-v1". This patch switches to calling secvar_ops->format(),
which in the case of OPAL/powernv means opal_secvar_format(), which
searches the device tree for a node compatible with "ibm,secvar-backend"
and checks its "format" property. These are equivalent, as skiboot creates
a node with both "ibm,edk2-compat-v1" and "ibm,secvar-backend" as
compatible strings.)

Signed-off-by: Russell Currey <ruscur@russell.cc>
Signed-off-by: Andrew Donnellan <ajd@linux.ibm.com>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20230210080401.345462-27-ajd@linux.ibm.com
This commit is contained in:
Russell Currey 2023-02-10 19:04:01 +11:00 committed by Michael Ellerman
parent 3c8069b0c3
commit 4b3e71e9a3
1 changed files with 10 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
security/integrity/platform_certs/load_powerpc.c
View File

@ -10,7 +10,6 @@
#include <linux/cred.h>
#include <linux/err.h>
#include <linux/slab.h>
#include <linux/of.h>
#include <asm/secure_boot.h>
#include <asm/secvar.h>
#include "keyring_handler.h"
@ -59,16 +58,22 @@ static int __init load_powerpc_certs(void)
void *db = NULL, *dbx = NULL;
u64 dbsize = 0, dbxsize = 0;
int rc = 0;
struct device_node *node;
ssize_t len;
char buf[32];
if (!secvar_ops)
return -ENODEV;
/* The following only applies for the edk2-compat backend. */
node = of_find_compatible_node(NULL, NULL, "ibm,edk2-compat-v1");
if (!node)
len = secvar_ops->format(buf, sizeof(buf));
if (len <= 0)
return -ENODEV;
// Check for known secure boot implementations from OPAL or PLPKS
if (strcmp("ibm,edk2-compat-v1", buf) && strcmp("ibm,plpks-sb-v1", buf)) {
pr_err("Unsupported secvar implementation \"%s\", not loading certs\n", buf);
return -ENODEV;
}
/*
* Get db, and dbx. They might not exist, so it isn't an error if we
* can't get them.
@ -103,8 +108,6 @@ static int __init load_powerpc_certs(void)
kfree(dbx);
}
of_node_put(node);
return rc;
}
late_initcall(load_powerpc_certs);