* [PATCH v8 1/3] block:sed-opal: SED Opal keystore
2023-10-04 20:19 [PATCH v8 0/3] generic and PowerPC SED Opal keystore gjoyce
@ 2023-10-04 20:19 ` gjoyce
2023-10-04 20:19 ` [PATCH v8 2/3] block: sed-opal: keystore access for SED Opal keys gjoyce
` (3 subsequent siblings)
4 siblings, 0 replies; 7+ messages in thread
From: gjoyce @ 2023-10-04 20:19 UTC (permalink / raw)
To: linux-block, axboe
Cc: linuxppc-dev, jonathan.derrick, brking, msuchanek, mpe, nayna,
akpm, gjoyce, ndesaulniers, nathan, jarkko, okozina
From: Greg Joyce <gjoyce@linux.vnet.ibm.com>
Add read and write functions that allow SED Opal keys to stored
in a permanent keystore.
Signed-off-by: Greg Joyce <gjoyce@linux.vnet.ibm.com>
Reviewed-by: Jonathan Derrick <jonathan.derrick@linux.dev>
---
include/linux/sed-opal-key.h | 26 ++++++++++++++++++++++++++
1 file changed, 26 insertions(+)
create mode 100644 include/linux/sed-opal-key.h
diff --git a/include/linux/sed-opal-key.h b/include/linux/sed-opal-key.h
new file mode 100644
index 000000000000..0ca03054e8f6
--- /dev/null
+++ b/include/linux/sed-opal-key.h
@@ -0,0 +1,26 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * SED key operations.
+ *
+ * Copyright (C) 2023 IBM Corporation
+ *
+ * These are the accessor functions (read/write) for SED Opal
+ * keys. Specific keystores can provide overrides.
+ *
+ */
+
+#include <linux/kernel.h>
+
+#ifdef CONFIG_PSERIES_PLPKS_SED
+int sed_read_key(char *keyname, char *key, u_int *keylen);
+int sed_write_key(char *keyname, char *key, u_int keylen);
+#else
+static inline
+int sed_read_key(char *keyname, char *key, u_int *keylen) {
+ return -EOPNOTSUPP;
+}
+static inline
+int sed_write_key(char *keyname, char *key, u_int keylen) {
+ return -EOPNOTSUPP;
+}
+#endif
--
gjoyce@linux.vnet.ibm.com
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH v8 2/3] block: sed-opal: keystore access for SED Opal keys
2023-10-04 20:19 [PATCH v8 0/3] generic and PowerPC SED Opal keystore gjoyce
2023-10-04 20:19 ` [PATCH v8 1/3] block:sed-opal: " gjoyce
@ 2023-10-04 20:19 ` gjoyce
2023-10-04 20:19 ` [PATCH v8 3/3] powerpc/pseries: PLPKS SED Opal keystore support gjoyce
` (2 subsequent siblings)
4 siblings, 0 replies; 7+ messages in thread
From: gjoyce @ 2023-10-04 20:19 UTC (permalink / raw)
To: linux-block, axboe
Cc: linuxppc-dev, jonathan.derrick, brking, msuchanek, mpe, nayna,
akpm, gjoyce, ndesaulniers, nathan, jarkko, okozina
From: Greg Joyce <gjoyce@linux.vnet.ibm.com>
Allow for permanent SED authentication keys by
reading/writing to the SED Opal non-volatile keystore.
Signed-off-by: Greg Joyce <gjoyce@linux.vnet.ibm.com>
Reviewed-by: Jonathan Derrick <jonathan.derrick@linux.dev>
---
block/sed-opal.c | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
diff --git a/block/sed-opal.c b/block/sed-opal.c
index 6d7f25d1711b..fa23a6a60485 100644
--- a/block/sed-opal.c
+++ b/block/sed-opal.c
@@ -18,6 +18,7 @@
#include <linux/uaccess.h>
#include <uapi/linux/sed-opal.h>
#include <linux/sed-opal.h>
+#include <linux/sed-opal-key.h>
#include <linux/string.h>
#include <linux/kdev_t.h>
#include <linux/key.h>
@@ -3019,7 +3020,13 @@ static int opal_set_new_pw(struct opal_dev *dev, struct opal_new_pw *opal_pw)
if (ret)
return ret;
- /* update keyring with new password */
+ /* update keyring and key store with new password */
+ ret = sed_write_key(OPAL_AUTH_KEY,
+ opal_pw->new_user_pw.opal_key.key,
+ opal_pw->new_user_pw.opal_key.key_len);
+ if (ret != -EOPNOTSUPP)
+ pr_warn("error updating SED key: %d\n", ret);
+
ret = update_sed_opal_key(OPAL_AUTH_KEY,
opal_pw->new_user_pw.opal_key.key,
opal_pw->new_user_pw.opal_key.key_len);
@@ -3292,6 +3299,8 @@ EXPORT_SYMBOL_GPL(sed_ioctl);
static int __init sed_opal_init(void)
{
struct key *kr;
+ char init_sed_key[OPAL_KEY_MAX];
+ int keylen = OPAL_KEY_MAX - 1;
kr = keyring_alloc(".sed_opal",
GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, current_cred(),
@@ -3304,6 +3313,11 @@ static int __init sed_opal_init(void)
sed_opal_keyring = kr;
- return 0;
+ if (sed_read_key(OPAL_AUTH_KEY, init_sed_key, &keylen) < 0) {
+ memset(init_sed_key, '\0', sizeof(init_sed_key));
+ keylen = OPAL_KEY_MAX - 1;
+ }
+
+ return update_sed_opal_key(OPAL_AUTH_KEY, init_sed_key, keylen);
}
late_initcall(sed_opal_init);
--
gjoyce@linux.vnet.ibm.com
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH v8 3/3] powerpc/pseries: PLPKS SED Opal keystore support
2023-10-04 20:19 [PATCH v8 0/3] generic and PowerPC SED Opal keystore gjoyce
2023-10-04 20:19 ` [PATCH v8 1/3] block:sed-opal: " gjoyce
2023-10-04 20:19 ` [PATCH v8 2/3] block: sed-opal: keystore access for SED Opal keys gjoyce
@ 2023-10-04 20:19 ` gjoyce
2023-10-17 15:09 ` [PATCH v8 0/3] generic and PowerPC SED Opal keystore Greg Joyce
2023-10-17 15:24 ` Jens Axboe
4 siblings, 0 replies; 7+ messages in thread
From: gjoyce @ 2023-10-04 20:19 UTC (permalink / raw)
To: linux-block, axboe
Cc: linuxppc-dev, jonathan.derrick, brking, msuchanek, mpe, nayna,
akpm, gjoyce, ndesaulniers, nathan, jarkko, okozina
From: Greg Joyce <gjoyce@linux.vnet.ibm.com>
Define operations for SED Opal to read/write keys
from POWER LPAR Platform KeyStore(PLPKS). This allows
non-volatile storage of SED Opal keys.
Signed-off-by: Greg Joyce <gjoyce@linux.vnet.ibm.com>
Reviewed-by: Jonathan Derrick <jonathan.derrick@linux.dev>
---
arch/powerpc/platforms/pseries/Kconfig | 6 +
arch/powerpc/platforms/pseries/Makefile | 1 +
.../powerpc/platforms/pseries/plpks_sed_ops.c | 131 ++++++++++++++++++
block/Kconfig | 1 +
4 files changed, 139 insertions(+)
create mode 100644 arch/powerpc/platforms/pseries/plpks_sed_ops.c
diff --git a/arch/powerpc/platforms/pseries/Kconfig b/arch/powerpc/platforms/pseries/Kconfig
index 4ebf2ef2845d..afc0f6a61337 100644
--- a/arch/powerpc/platforms/pseries/Kconfig
+++ b/arch/powerpc/platforms/pseries/Kconfig
@@ -164,6 +164,12 @@ config PSERIES_PLPKS
# This option is selected by in-kernel consumers that require
# access to the PKS.
+config PSERIES_PLPKS_SED
+ depends on PPC_PSERIES
+ bool
+ # This option is selected by in-kernel consumers that require
+ # access to the SED PKS keystore.
+
config PAPR_SCM
depends on PPC_PSERIES && MEMORY_HOTPLUG && LIBNVDIMM
tristate "Support for the PAPR Storage Class Memory interface"
diff --git a/arch/powerpc/platforms/pseries/Makefile b/arch/powerpc/platforms/pseries/Makefile
index 53c3b91af2f7..1476c5e4433c 100644
--- a/arch/powerpc/platforms/pseries/Makefile
+++ b/arch/powerpc/platforms/pseries/Makefile
@@ -29,6 +29,7 @@ obj-$(CONFIG_PPC_SVM) += svm.o
obj-$(CONFIG_FA_DUMP) += rtas-fadump.o
obj-$(CONFIG_PSERIES_PLPKS) += plpks.o
obj-$(CONFIG_PPC_SECURE_BOOT) += plpks-secvar.o
+obj-$(CONFIG_PSERIES_PLPKS_SED) += plpks_sed_ops.o
obj-$(CONFIG_SUSPEND) += suspend.o
obj-$(CONFIG_PPC_VAS) += vas.o vas-sysfs.o
diff --git a/arch/powerpc/platforms/pseries/plpks_sed_ops.c b/arch/powerpc/platforms/pseries/plpks_sed_ops.c
new file mode 100644
index 000000000000..7c873c9589ef
--- /dev/null
+++ b/arch/powerpc/platforms/pseries/plpks_sed_ops.c
@@ -0,0 +1,131 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * POWER Platform specific code for non-volatile SED key access
+ * Copyright (C) 2022 IBM Corporation
+ *
+ * Define operations for SED Opal to read/write keys
+ * from POWER LPAR Platform KeyStore(PLPKS).
+ *
+ * Self Encrypting Drives(SED) key storage using PLPKS
+ */
+
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/ioctl.h>
+#include <linux/sed-opal-key.h>
+#include <asm/plpks.h>
+
+static bool plpks_sed_initialized = false;
+static bool plpks_sed_available = false;
+
+/*
+ * structure that contains all SED data
+ */
+struct plpks_sed_object_data {
+ u_char version;
+ u_char pad1[7];
+ u_long authority;
+ u_long range;
+ u_int key_len;
+ u_char key[32];
+};
+
+#define PLPKS_SED_OBJECT_DATA_V0 0
+#define PLPKS_SED_MANGLED_LABEL "/default/pri"
+#define PLPKS_SED_COMPONENT "sed-opal"
+#define PLPKS_SED_KEY "opal-boot-pin"
+
+/*
+ * authority is admin1 and range is global
+ */
+#define PLPKS_SED_AUTHORITY 0x0000000900010001
+#define PLPKS_SED_RANGE 0x0000080200000001
+
+static void plpks_init_var(struct plpks_var *var, char *keyname)
+{
+ if (!plpks_sed_initialized) {
+ plpks_sed_initialized = true;
+ plpks_sed_available = plpks_is_available();
+ if (!plpks_sed_available)
+ pr_err("SED: plpks not available\n");
+ }
+
+ var->name = keyname;
+ var->namelen = strlen(keyname);
+ if (strcmp(PLPKS_SED_KEY, keyname) == 0) {
+ var->name = PLPKS_SED_MANGLED_LABEL;
+ var->namelen = strlen(keyname);
+ }
+ var->policy = PLPKS_WORLDREADABLE;
+ var->os = PLPKS_VAR_COMMON;
+ var->data = NULL;
+ var->datalen = 0;
+ var->component = PLPKS_SED_COMPONENT;
+}
+
+/*
+ * Read the SED Opal key from PLPKS given the label
+ */
+int sed_read_key(char *keyname, char *key, u_int *keylen)
+{
+ struct plpks_var var;
+ struct plpks_sed_object_data data;
+ int ret;
+ u_int len;
+
+ plpks_init_var(&var, keyname);
+
+ if (!plpks_sed_available)
+ return -EOPNOTSUPP;
+
+ var.data = (u8 *)&data;
+ var.datalen = sizeof(data);
+
+ ret = plpks_read_os_var(&var);
+ if (ret != 0)
+ return ret;
+
+ len = min_t(u16, be32_to_cpu(data.key_len), var.datalen);
+ memcpy(key, data.key, len);
+ key[len] = '\0';
+ *keylen = len;
+
+ return 0;
+}
+
+/*
+ * Write the SED Opal key to PLPKS given the label
+ */
+int sed_write_key(char *keyname, char *key, u_int keylen)
+{
+ struct plpks_var var;
+ struct plpks_sed_object_data data;
+ struct plpks_var_name vname;
+
+ plpks_init_var(&var, keyname);
+
+ if (!plpks_sed_available)
+ return -EOPNOTSUPP;
+
+ var.datalen = sizeof(struct plpks_sed_object_data);
+ var.data = (u8 *)&data;
+
+ /* initialize SED object */
+ data.version = PLPKS_SED_OBJECT_DATA_V0;
+ data.authority = cpu_to_be64(PLPKS_SED_AUTHORITY);
+ data.range = cpu_to_be64(PLPKS_SED_RANGE);
+ memset(&data.pad1, '\0', sizeof(data.pad1));
+ data.key_len = cpu_to_be32(keylen);
+ memcpy(data.key, (char *)key, keylen);
+
+ /*
+ * Key update requires remove first. The return value
+ * is ignored since it's okay if the key doesn't exist.
+ */
+ vname.namelen = var.namelen;
+ vname.name = var.name;
+ plpks_remove_var(var.component, var.os, vname);
+
+ return plpks_write_var(var);
+}
diff --git a/block/Kconfig b/block/Kconfig
index f1364d1c0d93..55ae2286a4de 100644
--- a/block/Kconfig
+++ b/block/Kconfig
@@ -186,6 +186,7 @@ config BLK_SED_OPAL
bool "Logic for interfacing with Opal enabled SEDs"
depends on KEYS
select PSERIES_PLPKS if PPC_PSERIES
+ select PSERIES_PLPKS_SED if PPC_PSERIES
help
Builds Logic for interfacing with Opal enabled controllers.
Enabling this option enables users to setup/unlock/lock
--
gjoyce@linux.vnet.ibm.com
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH v8 0/3] generic and PowerPC SED Opal keystore
2023-10-04 20:19 [PATCH v8 0/3] generic and PowerPC SED Opal keystore gjoyce
` (2 preceding siblings ...)
2023-10-04 20:19 ` [PATCH v8 3/3] powerpc/pseries: PLPKS SED Opal keystore support gjoyce
@ 2023-10-17 15:09 ` Greg Joyce
2023-10-17 15:24 ` Jens Axboe
2023-10-17 15:24 ` Jens Axboe
4 siblings, 1 reply; 7+ messages in thread
From: Greg Joyce @ 2023-10-17 15:09 UTC (permalink / raw)
To: linux-block, axboe
Cc: linuxppc-dev, jonathan.derrick, brking, msuchanek, mpe, nayna,
akpm, ndesaulniers, nathan, jarkko, okozina
Hi Jens,
I've addressed all the comments/issues on v7 of the patchset and
haven't received any feedback on v8. Is there anything else that you'd
like to see before this can be included?
Thanks,
Greg
On Wed, 2023-10-04 at 15:19 -0500, gjoyce@linux.vnet.ibm.com wrote:
> From: Greg Joyce <gjoyce@linux.vnet.ibm.com>
>
> This patchset has gone through numerous rounds of review and
> all comments/suggetions have been addressed. The reviews have
> covered all relevant areas including reviews by block and keyring
> developers as well as the SED Opal maintainer.
>
> TCG SED Opal is a specification from The Trusted Computing Group
> that allows self encrypting storage devices (SED) to be locked at
> power on and require an authentication key to unlock the drive.
>
> PowerPC/pseries versions of key functions provide read/write access
> to SED Opal keys in the PLPKS keystore.
>
> The SED block driver has been modified to read the SED Opal
> keystore to populate a key in the SED Opal keyring. Changes to the
> SED Opal key will be written to the SED Opal keystore.
>
>
> Changelog
> v8: - rebased to 6.6-rc4
> - fixed issues using clang (thanks Nathan Chancellor and Nick
> Desaulniers)
> - fixed crash if PLPKS is not present for pseries (thanks
> Michael
> Ellerman)
>
> v7: - rebased to for-6.5/block
>
> v6: - squashed two commits (suggested by Andrew Donnellan)
>
> v5: - updated to reflect changes in PLPKS API
>
> v4:
> - scope reduced to cover just SED Opal keys
> - base SED Opal keystore is now in SED block driver
> - removed use of enum to indicate type
> - refactored common code into common function that read and
> write use
> - removed cast to void
> - added use of SED Opal keystore functions to SED block
> driver
>
> v3:
> - No code changes, but per reviewer requests, adding
> additional
> mailing lists(keyring, EFI) for wider review.
>
> v2:
> - Include feedback from Gregory Joyce, Eric Richter and
> Murilo Opsfelder Araujo.
> - Include suggestions from Michael Ellerman.
> - Moved a dependency from generic SED code to this patchset.
> This patchset now builds of its own.
>
>
>
>
> Greg Joyce (3):
> block:sed-opal: SED Opal keystore
> block: sed-opal: keystore access for SED Opal keys
> powerpc/pseries: PLPKS SED Opal keystore support
>
> arch/powerpc/platforms/pseries/Kconfig | 6 +
> arch/powerpc/platforms/pseries/Makefile | 1 +
> .../powerpc/platforms/pseries/plpks_sed_ops.c | 131
> ++++++++++++++++++
> block/Kconfig | 1 +
> block/sed-opal.c | 18 ++-
> include/linux/sed-opal-key.h | 26 ++++
> 6 files changed, 181 insertions(+), 2 deletions(-)
> create mode 100644 arch/powerpc/platforms/pseries/plpks_sed_ops.c
> create mode 100644 include/linux/sed-opal-key.h
>
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH v8 0/3] generic and PowerPC SED Opal keystore
2023-10-17 15:09 ` [PATCH v8 0/3] generic and PowerPC SED Opal keystore Greg Joyce
@ 2023-10-17 15:24 ` Jens Axboe
0 siblings, 0 replies; 7+ messages in thread
From: Jens Axboe @ 2023-10-17 15:24 UTC (permalink / raw)
To: gjoyce, linux-block
Cc: linuxppc-dev, jonathan.derrick, brking, msuchanek, mpe, nayna,
akpm, ndesaulniers, nathan, jarkko, okozina
On 10/17/23 9:09 AM, Greg Joyce wrote:
>
> Hi Jens,
>
> I've addressed all the comments/issues on v7 of the patchset and
> haven't received any feedback on v8. Is there anything else that you'd
> like to see before this can be included?
Let's give it another shot!
--
Jens Axboe
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v8 0/3] generic and PowerPC SED Opal keystore
2023-10-04 20:19 [PATCH v8 0/3] generic and PowerPC SED Opal keystore gjoyce
` (3 preceding siblings ...)
2023-10-17 15:09 ` [PATCH v8 0/3] generic and PowerPC SED Opal keystore Greg Joyce
@ 2023-10-17 15:24 ` Jens Axboe
4 siblings, 0 replies; 7+ messages in thread
From: Jens Axboe @ 2023-10-17 15:24 UTC (permalink / raw)
To: linux-block, gjoyce
Cc: linuxppc-dev, jonathan.derrick, brking, msuchanek, mpe, nayna,
akpm, ndesaulniers, nathan, jarkko, okozina
On Wed, 04 Oct 2023 15:19:54 -0500, gjoyce@linux.vnet.ibm.com wrote:
> This patchset has gone through numerous rounds of review and
> all comments/suggetions have been addressed. The reviews have
> covered all relevant areas including reviews by block and keyring
> developers as well as the SED Opal maintainer.
>
> TCG SED Opal is a specification from The Trusted Computing Group
> that allows self encrypting storage devices (SED) to be locked at
> power on and require an authentication key to unlock the drive.
>
> [...]
Applied, thanks!
[1/3] block:sed-opal: SED Opal keystore
commit: 96ff37ceb203426b1bcebbae42399686110b0130
[2/3] block: sed-opal: keystore access for SED Opal keys
commit: 5dd339722f5f612f349b068e8da6d6710fd0e460
[3/3] powerpc/pseries: PLPKS SED Opal keystore support
commit: ec8cf230ceccfcc2bd29990c2902be168a92dee4
Best regards,
--
Jens Axboe
^ permalink raw reply [flat|nested] 7+ messages in thread