mirror of
https://github.com/torvalds/linux.git
synced 2026-03-08 01:04:41 +01:00
c99fcb0d73
The wrapping key does not exist by default and is generated by the hypervisor as a part of PKWM initialization. This key is then persisted by the hypervisor and is used to wrap trusted keys. These are variable length symmetric keys, which in the case of PowerVM Key Wrapping Module (PKWM) are generated using the kernel RNG. PKWM can be used as a trust source through the following example keyctl commands: keyctl add trusted my_trusted_key "new 32" @u Use the wrap_flags command option to set the secure boot requirement for the wrapping request through the following keyctl commands case1: no secure boot requirement. (default) keyctl usage: keyctl add trusted my_trusted_key "new 32" @u OR keyctl add trusted my_trusted_key "new 32 wrap_flags=0x00" @u case2: secure boot required to in either audit or enforce mode. set bit 0 keyctl usage: keyctl add trusted my_trusted_key "new 32 wrap_flags=0x01" @u case3: secure boot required to be in enforce mode. set bit 1 keyctl usage: keyctl add trusted my_trusted_key "new 32 wrap_flags=0x02" @u NOTE: -> Setting the secure boot requirement is NOT a must. -> Only either of the secure boot requirement options should be set. Not both. -> All the other bits are required to be not set. -> Set the kernel parameter trusted.source=pkwm to choose PKWM as the backend for trusted keys implementation. -> CONFIG_PSERIES_PLPKS must be enabled to build PKWM. Add PKWM, which is a combination of IBM PowerVM and Power LPAR Platform KeyStore, as a new trust source for trusted keys. Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com> Tested-by: Nayna Jain <nayna@linux.ibm.com> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com> Reviewed-by: Nayna Jain <nayna@linux.ibm.com> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260127145228.48320-6-ssrish@linux.ibm.com
105 lines
2.3 KiB
C
105 lines
2.3 KiB
C
/* SPDX-License-Identifier: GPL-2.0-only */
|
|
/*
|
|
* Copyright (C) 2010 IBM Corporation
|
|
* Author: David Safford <safford@us.ibm.com>
|
|
*/
|
|
|
|
#ifndef _KEYS_TRUSTED_TYPE_H
|
|
#define _KEYS_TRUSTED_TYPE_H
|
|
|
|
#include <linux/key.h>
|
|
#include <linux/rcupdate.h>
|
|
#include <linux/tpm.h>
|
|
|
|
#ifdef pr_fmt
|
|
#undef pr_fmt
|
|
#endif
|
|
|
|
#define pr_fmt(fmt) "trusted_key: " fmt
|
|
|
|
#define MIN_KEY_SIZE 32
|
|
#define MAX_KEY_SIZE 128
|
|
#if IS_ENABLED(CONFIG_TRUSTED_KEYS_PKWM)
|
|
#define MAX_BLOB_SIZE 1152
|
|
#else
|
|
#define MAX_BLOB_SIZE 512
|
|
#endif
|
|
#define MAX_PCRINFO_SIZE 64
|
|
#define MAX_DIGEST_SIZE 64
|
|
|
|
struct trusted_key_payload {
|
|
struct rcu_head rcu;
|
|
unsigned int key_len;
|
|
unsigned int blob_len;
|
|
unsigned char migratable;
|
|
unsigned char old_format;
|
|
unsigned char key[MAX_KEY_SIZE + 1];
|
|
unsigned char blob[MAX_BLOB_SIZE];
|
|
};
|
|
|
|
struct trusted_key_options {
|
|
uint16_t keytype;
|
|
uint32_t keyhandle;
|
|
unsigned char keyauth[TPM_DIGEST_SIZE];
|
|
uint32_t blobauth_len;
|
|
unsigned char blobauth[TPM_DIGEST_SIZE];
|
|
uint32_t pcrinfo_len;
|
|
unsigned char pcrinfo[MAX_PCRINFO_SIZE];
|
|
int pcrlock;
|
|
uint32_t hash;
|
|
uint32_t policydigest_len;
|
|
unsigned char policydigest[MAX_DIGEST_SIZE];
|
|
uint32_t policyhandle;
|
|
void *private;
|
|
};
|
|
|
|
struct trusted_key_ops {
|
|
/*
|
|
* flag to indicate if trusted key implementation supports migration
|
|
* or not.
|
|
*/
|
|
unsigned char migratable;
|
|
|
|
/* Initialize key interface. */
|
|
int (*init)(void);
|
|
|
|
/* Seal a key. */
|
|
int (*seal)(struct trusted_key_payload *p, char *datablob);
|
|
|
|
/* Unseal a key. */
|
|
int (*unseal)(struct trusted_key_payload *p, char *datablob);
|
|
|
|
/* Optional: Get a randomized key. */
|
|
int (*get_random)(unsigned char *key, size_t key_len);
|
|
|
|
/* Exit key interface. */
|
|
void (*exit)(void);
|
|
};
|
|
|
|
struct trusted_key_source {
|
|
char *name;
|
|
struct trusted_key_ops *ops;
|
|
};
|
|
|
|
extern struct key_type key_type_trusted;
|
|
|
|
#define TRUSTED_DEBUG 0
|
|
|
|
#if TRUSTED_DEBUG
|
|
static inline void dump_payload(struct trusted_key_payload *p)
|
|
{
|
|
pr_info("key_len %d\n", p->key_len);
|
|
print_hex_dump(KERN_INFO, "key ", DUMP_PREFIX_NONE,
|
|
16, 1, p->key, p->key_len, 0);
|
|
pr_info("bloblen %d\n", p->blob_len);
|
|
print_hex_dump(KERN_INFO, "blob ", DUMP_PREFIX_NONE,
|
|
16, 1, p->blob, p->blob_len, 0);
|
|
pr_info("migratable %d\n", p->migratable);
|
|
}
|
|
#else
|
|
static inline void dump_payload(struct trusted_key_payload *p)
|
|
{
|
|
}
|
|
#endif
|
|
|
|
#endif /* _KEYS_TRUSTED_TYPE_H */
|