* Re: [GIT PULL] Landlock fix for v6.19-rc6
From: Linus Torvalds @ 2026-01-15 23:09 UTC (permalink / raw)
To: Mickaël Salaün
Cc: Günther Noack, Matthieu Buffet, Tingmao Wang, linux-kernel,
linux-security-module
In-Reply-To: <20260115214740.803611-1-mic@digikod.net>
On Thu, 15 Jan 2026 at 13:47, Mickaël Salaün <mic@digikod.net> wrote:
>
> This PR fixes TCP handling, tests, documentation, non-audit elided code,
> and minor cosmetic changes.
This seems significantly bigger than what you sent for the whole merge
window for the Landlock code.
The merge window pull was - ignoring tests - 4 files changed, 59
insertions(+), 17 deletions(-).
I want more explanations for why I'm suddenly getting more alleged
fixes than I got any development and why this shouldn't wait until the
next merge window.
Because honestly, this just all seems out of place.
Linus
^ permalink raw reply
* Re: [PATCH v2 1/5] lsm: Add hook unix_path_connect
From: Günther Noack @ 2026-01-15 22:32 UTC (permalink / raw)
To: Demi Marie Obenour
Cc: Paul Moore, Christian Brauner, Justin Suess,
Mickaël Salaün, James Morris, Serge E . Hallyn,
linux-security-module, Tingmao Wang, Samasth Norway Ananda,
Matthieu Buffet, Mikhail Ivanov, konstantin.meskhidze,
Alyssa Ross, Jann Horn, Tahera Fahimi, Simon Horman, netdev,
Alexander Viro
In-Reply-To: <4c3956c2-4133-46bb-9ee5-4abf9bf7fff8@gmail.com>
On Thu, Jan 15, 2026 at 04:24:48PM -0500, Demi Marie Obenour wrote:
> On 1/15/26 05:10, Günther Noack wrote:
> > I would prefer if the correctness of our LSM did not depend on
> > keeping track of the error scenarios in af_unix.c. This seems
> > brittle.
>
> Indeed so.
Thanks for the support!
> > Overall, I am not convinced that using pre-existing hooks is the right
> > way and I would prefer the approach where we have a more dedicated LSM
> > hook for the path lookup.
> >
> > Does that seem reasonable? Let me know what you think.
> >
> > –Günther
>
> Having a dedicated LSM hook for all path lookups is definitely my
> preferred approach. Could this allow limiting directory traversal
> as well?
No, this does not limit all path lookups, in the sense of what was
discussed in the thread at [1]. (I assume this is what you meant?)
The LSM hook proposed here is only about the lookup of named UNIX
domain sockets, as it happens when clients pass a struct sockaddr_un
to connect(2) or sendmsg(2).
–Günther
[1] https://lore.kernel.org/all/81f908e3-8a98-46e7-b20c-fe647784ceb4@gmail.com/
^ permalink raw reply
* [GIT PULL] Landlock fix for v6.19-rc6
From: Mickaël Salaün @ 2026-01-15 21:47 UTC (permalink / raw)
To: Linus Torvalds
Cc: Mickaël Salaün, Günther Noack, Matthieu Buffet,
Tingmao Wang, linux-kernel, linux-security-module
Hi,
This PR fixes TCP handling, tests, documentation, non-audit elided code,
and minor cosmetic changes.
Please pull these changes for v6.19-rc6 . These commits merge cleanly
with your master branch. The kernel changes have been tested in the
latest linux-next releases for some weeks.
Test coverage for security/landlock is 91.9% of 1933 lines according to
LLVM 21, and it was 92.1% of 1927 lines before this PR.
Regards,
Mickaël
--
The following changes since commit 8f0b4cce4481fb22653697cced8d0d04027cb1e8:
Linux 6.19-rc1 (2025-12-14 16:05:07 +1200)
are available in the Git repository at:
https://git.kernel.org/pub/scm/linux/kernel/git/mic/linux.git tags/landlock-6.19-rc6
for you to fetch changes up to 6abbb8703aeeb645a681ab6ad155e0b450413787:
landlock: Clarify documentation for the IOCTL access right (2026-01-12 17:07:21 +0100)
----------------------------------------------------------------
Landlock fix for v6.19-rc6
----------------------------------------------------------------
Günther Noack (2):
selftests/landlock: Properly close a file descriptor
landlock: Clarify documentation for the IOCTL access right
Matthieu Buffet (5):
landlock: Fix TCP handling of short AF_UNSPEC addresses
selftests/landlock: Fix TCP bind(AF_UNSPEC) test case
selftests/landlock: Add missing connect(minimal AF_UNSPEC) test
selftests/landlock: Remove invalid unix socket bind()
selftests/landlock: NULL-terminate unix pathname addresses
Mickaël Salaün (6):
landlock: Fix formatting
landlock: Remove useless include
landlock: Improve erratum documentation
landlock: Clean up hook_ptrace_access_check()
landlock: Fix spelling
landlock: Optimize stack usage when !CONFIG_AUDIT
Tingmao Wang (5):
landlock: Fix wrong type usage
selftests/landlock: Fix typo in fs_test
selftests/landlock: Fix missing semicolon
selftests/landlock: Use scoped_base_variants.h for ptrace_test
landlock: Improve the comment for domain_is_scoped
include/uapi/linux/landlock.h | 37 +++--
security/landlock/audit.c | 2 +-
security/landlock/domain.h | 2 +-
security/landlock/errata/abi-6.h | 2 +-
security/landlock/fs.c | 14 +-
security/landlock/net.c | 118 +++++++++-------
security/landlock/ruleset.c | 1 -
security/landlock/task.c | 12 +-
tools/testing/selftests/landlock/common.h | 1 +
tools/testing/selftests/landlock/fs_test.c | 34 ++---
tools/testing/selftests/landlock/net_test.c | 30 +++-
tools/testing/selftests/landlock/ptrace_test.c | 154 +--------------------
.../selftests/landlock/scoped_abstract_unix_test.c | 23 ++-
.../selftests/landlock/scoped_base_variants.h | 9 +-
14 files changed, 170 insertions(+), 269 deletions(-)
^ permalink raw reply
* Re: [PATCH v2 1/5] lsm: Add hook unix_path_connect
From: Paul Moore @ 2026-01-15 21:46 UTC (permalink / raw)
To: Günther Noack
Cc: Christian Brauner, Justin Suess, Mickaël Salaün,
James Morris, Serge E . Hallyn, linux-security-module,
Tingmao Wang, Samasth Norway Ananda, Matthieu Buffet,
Mikhail Ivanov, konstantin.meskhidze, Demi Marie Obenour,
Alyssa Ross, Jann Horn, Tahera Fahimi, Simon Horman, netdev,
Alexander Viro
In-Reply-To: <20260115.b5977d57d52d@gnoack.org>
On Thu, Jan 15, 2026 at 5:10 AM Günther Noack <gnoack3000@gmail.com> wrote:
> On Tue, Jan 13, 2026 at 06:27:15PM -0500, Paul Moore wrote:
> > On Tue, Jan 13, 2026 at 4:34 AM Christian Brauner <brauner@kernel.org> wrote:
> > > On Sat, Jan 10, 2026 at 03:32:57PM +0100, Günther Noack wrote:
> > > > From: Justin Suess <utilityemal77@gmail.com>
> > > >
> > > > Adds an LSM hook unix_path_connect.
> > > >
> > > > This hook is called to check the path of a named unix socket before a
> > > > connection is initiated.
> > > >
> > > > Cc: Günther Noack <gnoack3000@gmail.com>
> > > > Signed-off-by: Justin Suess <utilityemal77@gmail.com>
> > > > ---
> > > > include/linux/lsm_hook_defs.h | 4 ++++
> > > > include/linux/security.h | 11 +++++++++++
> > > > net/unix/af_unix.c | 9 +++++++++
> > > > security/security.c | 20 ++++++++++++++++++++
> > > > 4 files changed, 44 insertions(+)
...
> On the other side, I see the following drawbacks:
>
> * The more serious surgery in af_unix, which Paul also discussed:
Not to take away from what Günther already mentioned, but my concern
about extending the path beyond the unix_find_bsd() function for the
sake of the LSM is that history has shown that the easiest (this is
very much a relative statement) approach towards acceptance of a new
LSM hook is to keep the addition/patch as small as possible while
still being useful. Making the addition of a new LSM hook dependent
on significant changes outside of the security/ directory often
results in failure.
> Overall, I am not convinced that using pre-existing hooks is the right
> way and I would prefer the approach where we have a more dedicated LSM
> hook for the path lookup.
>
> Does that seem reasonable? Let me know what you think.
I believe it's definitely the "path" (sorry) of least resistance.
--
paul-moore.com
^ permalink raw reply
* Re: [PATCH v2 1/5] lsm: Add hook unix_path_connect
From: Demi Marie Obenour @ 2026-01-15 21:24 UTC (permalink / raw)
To: Günther Noack, Paul Moore, Christian Brauner, Justin Suess
Cc: Mickaël Salaün, James Morris, Serge E . Hallyn,
linux-security-module, Tingmao Wang, Samasth Norway Ananda,
Matthieu Buffet, Mikhail Ivanov, konstantin.meskhidze,
Alyssa Ross, Jann Horn, Tahera Fahimi, Simon Horman, netdev,
Alexander Viro
In-Reply-To: <20260115.b5977d57d52d@gnoack.org>
[-- Attachment #1.1.1: Type: text/plain, Size: 2400 bytes --]
On 1/15/26 05:10, Günther Noack wrote:
> On Tue, Jan 13, 2026 at 06:27:15PM -0500, Paul Moore wrote:
>> On Tue, Jan 13, 2026 at 4:34 AM Christian Brauner <brauner@kernel.org> wrote:
>>> On Sat, Jan 10, 2026 at 03:32:57PM +0100, Günther Noack wrote:
>>>> From: Justin Suess <utilityemal77@gmail.com>
>>>>
>>>> Adds an LSM hook unix_path_connect.
>>>>
>>>> This hook is called to check the path of a named unix socket before a
>>>> connection is initiated.
>>>>
>>>> Cc: Günther Noack <gnoack3000@gmail.com>
>>>> Signed-off-by: Justin Suess <utilityemal77@gmail.com>
>>>> ---
>>>> include/linux/lsm_hook_defs.h | 4 ++++
>>>> include/linux/security.h | 11 +++++++++++
>>>> net/unix/af_unix.c | 9 +++++++++
>>>> security/security.c | 20 ++++++++++++++++++++
>>>> 4 files changed, 44 insertions(+)
>>
>> ...
...
> * Some properties of the resolved socket are still observable to
> userspace:
>
> When we only pass the path to a later LSM hook, there are a variety
> of additional error case checks in af_unix.c which are based on the
> "other" socket which we looked up through the path. Examples:
>
> * was other shutdown(2)? (ECONNREFUSED on connect or EPIPE on dgram_sendmsg)
> * does other support SO_PASSRIGHTS (fd passing)? (EPERM on dgram_sendmsg)
> * would sendmsg pass sk_filter() (on dgram_sendmsg)
>
> For a LSM policy that is supposed to restrict the resolution of a
> UNIX socket by path, I would not expect such properties of the
> resolved socket to be observable?
>
> (And we also can't fix this up in the LSM by returning a matching
> error code, because at least unix_dgram_sendmsg() returns multiple
> different error codes in these error cases.)
>
> I would prefer if the correctness of our LSM did not depend on
> keeping track of the error scenarios in af_unix.c. This seems
> brittle.
Indeed so.
> Overall, I am not convinced that using pre-existing hooks is the right
> way and I would prefer the approach where we have a more dedicated LSM
> hook for the path lookup.
>
> Does that seem reasonable? Let me know what you think.
>
> –Günther
Having a dedicated LSM hook for all path lookups is definitely my
preferred approach. Could this allow limiting directory traversal
as well?
--
Sincerely,
Demi Marie Obenour (she/her/hers)
[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 7253 bytes --]
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply
* Re: [PATCH v4 5/6] keys/trusted_keys: establish PKWM as a trusted source
From: Nayna Jain @ 2026-01-15 20:46 UTC (permalink / raw)
To: Srish Srinivasan, linux-integrity, keyrings, linuxppc-dev
Cc: maddy, mpe, npiggin, christophe.leroy, James.Bottomley, jarkko,
zohar, rnsastry, linux-kernel, linux-security-module
In-Reply-To: <20260115100504.488665-6-ssrish@linux.ibm.com>
On 1/15/26 5:05 AM, Srish Srinivasan wrote:
> The wrapping key does not exist by default and is generated by the
> hypervisor as a part of PKWM initialization. This key is then persisted by
> the hypervisor and is used to wrap trusted keys. These are variable length
> symmetric keys, which in the case of PowerVM Key Wrapping Module (PKWM) are
> generated using the kernel RNG. PKWM can be used as a trust source through
> the following example keyctl commands:
>
> keyctl add trusted my_trusted_key "new 32" @u
>
> Use the wrap_flags command option to set the secure boot requirement for
> the wrapping request through the following keyctl commands
>
> case1: no secure boot requirement. (default)
> keyctl usage: keyctl add trusted my_trusted_key "new 32" @u
> OR
> keyctl add trusted my_trusted_key "new 32 wrap_flags=0x00" @u
>
> case2: secure boot required to in either audit or enforce mode. set bit 0
> keyctl usage: keyctl add trusted my_trusted_key "new 32 wrap_flags=0x01" @u
>
> case3: secure boot required to be in enforce mode. set bit 1
> keyctl usage: keyctl add trusted my_trusted_key "new 32 wrap_flags=0x02" @u
>
> NOTE:
> -> Setting the secure boot requirement is NOT a must.
> -> Only either of the secure boot requirement options should be set. Not
> both.
> -> All the other bits are required to be not set.
> -> Set the kernel parameter trusted.source=pkwm to choose PKWM as the
> backend for trusted keys implementation.
> -> CONFIG_PSERIES_PLPKS must be enabled to build PKWM.
>
> Add PKWM, which is a combination of IBM PowerVM and Power LPAR Platform
> KeyStore, as a new trust source for trusted keys.
Looks good to me.
Reviewed-by: Nayna Jain <nayna@linux.ibm.com>
>
> Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
> ---
> This version introduces a private pointer for backend specific fields and
> related changes specific to the PKWM backend, but defers migrating the TPM
> fields to this new framework. That will be done independently of this
> patch series.
> MAINTAINERS | 9 +
> include/keys/trusted-type.h | 7 +-
> include/keys/trusted_pkwm.h | 33 ++++
> security/keys/trusted-keys/Kconfig | 8 +
> security/keys/trusted-keys/Makefile | 2 +
> security/keys/trusted-keys/trusted_core.c | 6 +-
> security/keys/trusted-keys/trusted_pkwm.c | 190 ++++++++++++++++++++++
> 7 files changed, 253 insertions(+), 2 deletions(-)
> create mode 100644 include/keys/trusted_pkwm.h
> create mode 100644 security/keys/trusted-keys/trusted_pkwm.c
>
> diff --git a/MAINTAINERS b/MAINTAINERS
> index cf755238c429..c98f1811f836 100644
> --- a/MAINTAINERS
> +++ b/MAINTAINERS
> @@ -14008,6 +14008,15 @@ S: Supported
> F: include/keys/trusted_dcp.h
> F: security/keys/trusted-keys/trusted_dcp.c
>
> +KEYS-TRUSTED-PLPKS
> +M: Srish Srinivasan <ssrish@linux.ibm.com>
> +M: Nayna Jain <nayna@linux.ibm.com>
> +L: linux-integrity@vger.kernel.org
> +L: keyrings@vger.kernel.org
> +S: Supported
> +F: include/keys/trusted_pkwm.h
> +F: security/keys/trusted-keys/trusted_pkwm.c
> +
> KEYS-TRUSTED-TEE
> M: Sumit Garg <sumit.garg@kernel.org>
> L: linux-integrity@vger.kernel.org
> diff --git a/include/keys/trusted-type.h b/include/keys/trusted-type.h
> index 4eb64548a74f..03527162613f 100644
> --- a/include/keys/trusted-type.h
> +++ b/include/keys/trusted-type.h
> @@ -19,7 +19,11 @@
>
> #define MIN_KEY_SIZE 32
> #define MAX_KEY_SIZE 128
> -#define MAX_BLOB_SIZE 512
> +#if IS_ENABLED(CONFIG_TRUSTED_KEYS_PKWM)
> +#define MAX_BLOB_SIZE 1152
> +#else
> +#define MAX_BLOB_SIZE 512
> +#endif
> #define MAX_PCRINFO_SIZE 64
> #define MAX_DIGEST_SIZE 64
>
> @@ -46,6 +50,7 @@ struct trusted_key_options {
> uint32_t policydigest_len;
> unsigned char policydigest[MAX_DIGEST_SIZE];
> uint32_t policyhandle;
> + void *private;
> };
>
> struct trusted_key_ops {
> diff --git a/include/keys/trusted_pkwm.h b/include/keys/trusted_pkwm.h
> new file mode 100644
> index 000000000000..4035b9776394
> --- /dev/null
> +++ b/include/keys/trusted_pkwm.h
> @@ -0,0 +1,33 @@
> +/* SPDX-License-Identifier: GPL-2.0 */
> +#ifndef __PKWM_TRUSTED_KEY_H
> +#define __PKWM_TRUSTED_KEY_H
> +
> +#include <keys/trusted-type.h>
> +#include <linux/bitops.h>
> +#include <linux/printk.h>
> +
> +extern struct trusted_key_ops pkwm_trusted_key_ops;
> +
> +struct trusted_pkwm_options {
> + u16 wrap_flags;
> +};
> +
> +static inline void dump_options(struct trusted_key_options *o)
> +{
> + const struct trusted_pkwm_options *pkwm;
> + bool sb_audit_or_enforce_bit;
> + bool sb_enforce_bit;
> +
> + pkwm = o->private;
> + sb_audit_or_enforce_bit = pkwm->wrap_flags & BIT(0);
> + sb_enforce_bit = pkwm->wrap_flags & BIT(1);
> +
> + if (sb_audit_or_enforce_bit)
> + pr_debug("secure boot mode required: audit or enforce");
> + else if (sb_enforce_bit)
> + pr_debug("secure boot mode required: enforce");
> + else
> + pr_debug("secure boot mode required: disabled");
> +}
> +
> +#endif
> diff --git a/security/keys/trusted-keys/Kconfig b/security/keys/trusted-keys/Kconfig
> index 204a68c1429d..9e00482d886a 100644
> --- a/security/keys/trusted-keys/Kconfig
> +++ b/security/keys/trusted-keys/Kconfig
> @@ -46,6 +46,14 @@ config TRUSTED_KEYS_DCP
> help
> Enable use of NXP's DCP (Data Co-Processor) as trusted key backend.
>
> +config TRUSTED_KEYS_PKWM
> + bool "PKWM-based trusted keys"
> + depends on PSERIES_PLPKS >= TRUSTED_KEYS
> + default y
> + select HAVE_TRUSTED_KEYS
> + help
> + Enable use of IBM PowerVM Key Wrapping Module (PKWM) as a trusted key backend.
> +
> if !HAVE_TRUSTED_KEYS
> comment "No trust source selected!"
> endif
> diff --git a/security/keys/trusted-keys/Makefile b/security/keys/trusted-keys/Makefile
> index f0f3b27f688b..5fc053a21dad 100644
> --- a/security/keys/trusted-keys/Makefile
> +++ b/security/keys/trusted-keys/Makefile
> @@ -16,3 +16,5 @@ trusted-$(CONFIG_TRUSTED_KEYS_TEE) += trusted_tee.o
> trusted-$(CONFIG_TRUSTED_KEYS_CAAM) += trusted_caam.o
>
> trusted-$(CONFIG_TRUSTED_KEYS_DCP) += trusted_dcp.o
> +
> +trusted-$(CONFIG_TRUSTED_KEYS_PKWM) += trusted_pkwm.o
> diff --git a/security/keys/trusted-keys/trusted_core.c b/security/keys/trusted-keys/trusted_core.c
> index b1680ee53f86..2d328de170e8 100644
> --- a/security/keys/trusted-keys/trusted_core.c
> +++ b/security/keys/trusted-keys/trusted_core.c
> @@ -12,6 +12,7 @@
> #include <keys/trusted_caam.h>
> #include <keys/trusted_dcp.h>
> #include <keys/trusted_tpm.h>
> +#include <keys/trusted_pkwm.h>
> #include <linux/capability.h>
> #include <linux/err.h>
> #include <linux/init.h>
> @@ -31,7 +32,7 @@ MODULE_PARM_DESC(rng, "Select trusted key RNG");
>
> static char *trusted_key_source;
> module_param_named(source, trusted_key_source, charp, 0);
> -MODULE_PARM_DESC(source, "Select trusted keys source (tpm, tee, caam or dcp)");
> +MODULE_PARM_DESC(source, "Select trusted keys source (tpm, tee, caam, dcp or pkwm)");
>
> static const struct trusted_key_source trusted_key_sources[] = {
> #if defined(CONFIG_TRUSTED_KEYS_TPM)
> @@ -46,6 +47,9 @@ static const struct trusted_key_source trusted_key_sources[] = {
> #if defined(CONFIG_TRUSTED_KEYS_DCP)
> { "dcp", &dcp_trusted_key_ops },
> #endif
> +#if defined(CONFIG_TRUSTED_KEYS_PKWM)
> + { "pkwm", &pkwm_trusted_key_ops },
> +#endif
> };
>
> DEFINE_STATIC_CALL_NULL(trusted_key_seal, *trusted_key_sources[0].ops->seal);
> diff --git a/security/keys/trusted-keys/trusted_pkwm.c b/security/keys/trusted-keys/trusted_pkwm.c
> new file mode 100644
> index 000000000000..4f391b77a907
> --- /dev/null
> +++ b/security/keys/trusted-keys/trusted_pkwm.c
> @@ -0,0 +1,190 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +/*
> + * Copyright (C) 2025 IBM Corporation, Srish Srinivasan <ssrish@linux.ibm.com>
> + */
> +
> +#include <keys/trusted_pkwm.h>
> +#include <keys/trusted-type.h>
> +#include <linux/build_bug.h>
> +#include <linux/key-type.h>
> +#include <linux/parser.h>
> +#include <asm/plpks.h>
> +
> +enum {
> + Opt_err,
> + Opt_wrap_flags,
> +};
> +
> +static const match_table_t key_tokens = {
> + {Opt_wrap_flags, "wrap_flags=%s"},
> + {Opt_err, NULL}
> +};
> +
> +static int getoptions(char *datablob, struct trusted_key_options *opt)
> +{
> + substring_t args[MAX_OPT_ARGS];
> + char *p = datablob;
> + int token;
> + int res;
> + u16 wrap_flags;
> + unsigned long token_mask = 0;
> + struct trusted_pkwm_options *pkwm;
> +
> + if (!datablob)
> + return 0;
> +
> + pkwm = opt->private;
> +
> + while ((p = strsep(&datablob, " \t"))) {
> + if (*p == '\0' || *p == ' ' || *p == '\t')
> + continue;
> +
> + token = match_token(p, key_tokens, args);
> + if (test_and_set_bit(token, &token_mask))
> + return -EINVAL;
> +
> + switch (token) {
> + case Opt_wrap_flags:
> + res = kstrtou16(args[0].from, 16, &wrap_flags);
> + if (res < 0 || wrap_flags > 2)
> + return -EINVAL;
> + pkwm->wrap_flags = wrap_flags;
> + break;
> + default:
> + return -EINVAL;
> + }
> + }
> + return 0;
> +}
> +
> +static struct trusted_key_options *trusted_options_alloc(void)
> +{
> + struct trusted_key_options *options;
> + struct trusted_pkwm_options *pkwm;
> +
> + options = kzalloc(sizeof(*options), GFP_KERNEL);
> +
> + if (options) {
> + pkwm = kzalloc(sizeof(*pkwm), GFP_KERNEL);
> +
> + if (!pkwm) {
> + kfree_sensitive(options);
> + options = NULL;
> + } else {
> + options->private = pkwm;
> + }
> + }
> +
> + return options;
> +}
> +
> +static int trusted_pkwm_seal(struct trusted_key_payload *p, char *datablob)
> +{
> + struct trusted_key_options *options = NULL;
> + struct trusted_pkwm_options *pkwm = NULL;
> + u8 *input_buf, *output_buf;
> + u32 output_len, input_len;
> + int rc;
> +
> + options = trusted_options_alloc();
> +
> + if (!options)
> + return -ENOMEM;
> +
> + rc = getoptions(datablob, options);
> + if (rc < 0)
> + goto out;
> + dump_options(options);
> +
> + input_len = p->key_len;
> + input_buf = kmalloc(ALIGN(input_len, 4096), GFP_KERNEL);
> + if (!input_buf) {
> + pr_err("Input buffer allocation failed. Returning -ENOMEM.");
> + rc = -ENOMEM;
> + goto out;
> + }
> +
> + memcpy(input_buf, p->key, p->key_len);
> +
> + pkwm = options->private;
> +
> + rc = plpks_wrap_object(&input_buf, input_len, pkwm->wrap_flags,
> + &output_buf, &output_len);
> + if (!rc) {
> + memcpy(p->blob, output_buf, output_len);
> + p->blob_len = output_len;
> + dump_payload(p);
> + } else {
> + pr_err("Wrapping of payload key failed: %d\n", rc);
> + }
> +
> + kfree(input_buf);
> + kfree(output_buf);
> +
> +out:
> + kfree_sensitive(options->private);
> + kfree_sensitive(options);
> + return rc;
> +}
> +
> +static int trusted_pkwm_unseal(struct trusted_key_payload *p, char *datablob)
> +{
> + u8 *input_buf, *output_buf;
> + u32 input_len, output_len;
> + int rc;
> +
> + input_len = p->blob_len;
> + input_buf = kmalloc(ALIGN(input_len, 4096), GFP_KERNEL);
> + if (!input_buf) {
> + pr_err("Input buffer allocation failed. Returning -ENOMEM.");
> + return -ENOMEM;
> + }
> +
> + memcpy(input_buf, p->blob, p->blob_len);
> +
> + rc = plpks_unwrap_object(&input_buf, input_len, &output_buf,
> + &output_len);
> + if (!rc) {
> + memcpy(p->key, output_buf, output_len);
> + p->key_len = output_len;
> + dump_payload(p);
> + } else {
> + pr_err("Unwrapping of payload failed: %d\n", rc);
> + }
> +
> + kfree(input_buf);
> + kfree(output_buf);
> +
> + return rc;
> +}
> +
> +static int trusted_pkwm_init(void)
> +{
> + int ret;
> +
> + if (!plpks_wrapping_is_supported()) {
> + pr_err("H_PKS_WRAP_OBJECT interface not supported\n");
> + return -ENODEV;
> + }
> +
> + ret = plpks_gen_wrapping_key();
> + if (ret) {
> + pr_err("Failed to generate default wrapping key\n");
> + return -EINVAL;
> + }
> +
> + return register_key_type(&key_type_trusted);
> +}
> +
> +static void trusted_pkwm_exit(void)
> +{
> + unregister_key_type(&key_type_trusted);
> +}
> +
> +struct trusted_key_ops pkwm_trusted_key_ops = {
> + .migratable = 0, /* non-migratable */
> + .init = trusted_pkwm_init,
> + .seal = trusted_pkwm_seal,
> + .unseal = trusted_pkwm_unseal,
> + .exit = trusted_pkwm_exit,
> +};
^ permalink raw reply
* Re: [PATCH v4 4/6] pseries/plpks: add HCALLs for PowerVM Key Wrapping Module
From: Nayna Jain @ 2026-01-15 20:45 UTC (permalink / raw)
To: Srish Srinivasan, linux-integrity, keyrings, linuxppc-dev
Cc: maddy, mpe, npiggin, christophe.leroy, James.Bottomley, jarkko,
zohar, rnsastry, linux-kernel, linux-security-module
In-Reply-To: <20260115100504.488665-5-ssrish@linux.ibm.com>
On 1/15/26 5:05 AM, Srish Srinivasan wrote:
> The hypervisor generated wrapping key is an AES-GCM-256 symmetric key which
> is stored in a non-volatile, secure, and encrypted storage called the Power
> LPAR Platform KeyStore. It has policy based protections that prevent it
> from being read out or exposed to the user.
>
> Implement H_PKS_GEN_KEY, H_PKS_WRAP_OBJECT, and H_PKS_UNWRAP_OBJECT HCALLs
> to enable using the PowerVM Key Wrapping Module (PKWM) as a new trust
> source for trusted keys. Disallow H_PKS_READ_OBJECT, H_PKS_SIGNED_UPDATE,
> and H_PKS_WRITE_OBJECT for objects with the 'wrapping key' policy set.
> Capture the availability status for the H_PKS_WRAP_OBJECT interface.
Reviewed-by: Nayna Jain <nayna@linux.ibm.com>
>
> Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
> ---
> Documentation/arch/powerpc/papr_hcalls.rst | 43 +++
> arch/powerpc/include/asm/plpks.h | 10 +
> arch/powerpc/platforms/pseries/plpks.c | 342 ++++++++++++++++++++-
> 3 files changed, 393 insertions(+), 2 deletions(-)
>
> diff --git a/Documentation/arch/powerpc/papr_hcalls.rst b/Documentation/arch/powerpc/papr_hcalls.rst
> index 805e1cb9bab9..14e39f095a1c 100644
> --- a/Documentation/arch/powerpc/papr_hcalls.rst
> +++ b/Documentation/arch/powerpc/papr_hcalls.rst
> @@ -300,6 +300,49 @@ H_HTM supports setup, configuration, control and dumping of Hardware Trace
> Macro (HTM) function and its data. HTM buffer stores tracing data for functions
> like core instruction, core LLAT and nest.
>
> +**H_PKS_GEN_KEY**
> +
> +| Input: authorization, objectlabel, objectlabellen, policy, out, outlen
> +| Out: *Hypervisor Generated Key, or None when the wrapping key policy is set*
> +| Return Value: *H_SUCCESS, H_Function, H_State, H_R_State, H_Parameter, H_P2,
> + H_P3, H_P4, H_P5, H_P6, H_Authority, H_Nomem, H_Busy, H_Resource,
> + H_Aborted*
> +
> +H_PKS_GEN_KEY is used to have the hypervisor generate a new random key.
> +This key is stored as an object in the Power LPAR Platform KeyStore with
> +the provided object label. With the wrapping key policy set the key is only
> +visible to the hypervisor, while the key's label would still be visible to
> +the user. Generation of wrapping keys is supported only for a key size of
> +32 bytes.
> +
> +**H_PKS_WRAP_OBJECT**
> +
> +| Input: authorization, wrapkeylabel, wrapkeylabellen, objectwrapflags, in,
> +| inlen, out, outlen, continue-token
> +| Out: *continue-token, byte size of wrapped object, wrapped object*
> +| Return Value: *H_SUCCESS, H_Function, H_State, H_R_State, H_Parameter, H_P2,
> + H_P3, H_P4, H_P5, H_P6, H_P7, H_P8, H_P9, H_Authority, H_Invalid_Key,
> + H_NOT_FOUND, H_Busy, H_LongBusy, H_Aborted*
> +
> +H_PKS_WRAP_OBJECT is used to wrap an object using a wrapping key stored in the
> +Power LPAR Platform KeyStore and return the wrapped object to the caller. The
> +caller provides a label to a wrapping key with the 'wrapping key' policy set,
> +which must have been previously created with H_PKS_GEN_KEY. The provided object
> +is then encrypted with the wrapping key and additional metadata and the result
> +is returned to the caller.
> +
> +
> +**H_PKS_UNWRAP_OBJECT**
> +
> +| Input: authorization, objectwrapflags, in, inlen, out, outlen, continue-token
> +| Out: *continue-token, byte size of unwrapped object, unwrapped object*
> +| Return Value: *H_SUCCESS, H_Function, H_State, H_R_State, H_Parameter, H_P2,
> + H_P3, H_P4, H_P5, H_P6, H_P7, H_Authority, H_Unsupported, H_Bad_Data,
> + H_NOT_FOUND, H_Invalid_Key, H_Busy, H_LongBusy, H_Aborted*
> +
> +H_PKS_UNWRAP_OBJECT is used to unwrap an object that was previously warapped with
> +H_PKS_WRAP_OBJECT.
> +
> References
> ==========
> .. [1] "Power Architecture Platform Reference"
> diff --git a/arch/powerpc/include/asm/plpks.h b/arch/powerpc/include/asm/plpks.h
> index 8f034588fdf7..e87f90e40d4e 100644
> --- a/arch/powerpc/include/asm/plpks.h
> +++ b/arch/powerpc/include/asm/plpks.h
> @@ -113,6 +113,16 @@ void plpks_early_init_devtree(void);
> int plpks_populate_fdt(void *fdt);
>
> int plpks_config_create_softlink(struct kobject *from);
> +
> +bool plpks_wrapping_is_supported(void);
> +
> +int plpks_gen_wrapping_key(void);
> +
> +int plpks_wrap_object(u8 **input_buf, u32 input_len, u16 wrap_flags,
> + u8 **output_buf, u32 *output_len);
> +
> +int plpks_unwrap_object(u8 **input_buf, u32 input_len,
> + u8 **output_buf, u32 *output_len);
> #else // CONFIG_PSERIES_PLPKS
> static inline bool plpks_is_available(void) { return false; }
> static inline u16 plpks_get_passwordlen(void) { BUILD_BUG(); }
> diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c
> index 4a08f51537c8..b97b7750f6a8 100644
> --- a/arch/powerpc/platforms/pseries/plpks.c
> +++ b/arch/powerpc/platforms/pseries/plpks.c
> @@ -9,6 +9,32 @@
>
> #define pr_fmt(fmt) "plpks: " fmt
>
> +#define PLPKS_WRAPKEY_COMPONENT "PLPKSWR"
> +#define PLPKS_WRAPKEY_NAME "default-wrapping-key"
> +
> +/*
> + * To 4K align the {input, output} buffers to the {UN}WRAP H_CALLs
> + */
> +#define PLPKS_WRAPPING_BUF_ALIGN 4096
> +
> +/*
> + * To ensure the output buffer's length is at least 1024 bytes greater
> + * than the input buffer's length during the WRAP H_CALL
> + */
> +#define PLPKS_WRAPPING_BUF_DIFF 1024
> +
> +#define PLPKS_WRAP_INTERFACE_BIT 3
> +#define PLPKS_WRAPPING_KEY_LENGTH 32
> +
> +#define WRAPFLAG_BE_BIT_SET(be_bit) \
> + BIT_ULL(63 - (be_bit))
> +
> +#define WRAPFLAG_BE_GENMASK(be_bit_hi, be_bit_lo) \
> + GENMASK_ULL(63 - (be_bit_hi), 63 - (be_bit_lo))
> +
> +#define WRAPFLAG_BE_FIELD_PREP(be_bit_hi, be_bit_lo, val) \
> + FIELD_PREP(WRAPFLAG_BE_GENMASK(be_bit_hi, be_bit_lo), (val))
> +
> #include <linux/delay.h>
> #include <linux/errno.h>
> #include <linux/io.h>
> @@ -39,6 +65,7 @@ static u32 supportedpolicies;
> static u32 maxlargeobjectsize;
> static u64 signedupdatealgorithms;
> static u64 wrappingfeatures;
> +static bool wrapsupport;
>
> struct plpks_auth {
> u8 version;
> @@ -283,6 +310,7 @@ static int _plpks_get_config(void)
> maxlargeobjectsize = be32_to_cpu(config->maxlargeobjectsize);
> signedupdatealgorithms = be64_to_cpu(config->signedupdatealgorithms);
> wrappingfeatures = be64_to_cpu(config->wrappingfeatures);
> + wrapsupport = config->flags & PPC_BIT8(PLPKS_WRAP_INTERFACE_BIT);
>
> // Validate that the numbers we get back match the requirements of the spec
> if (maxpwsize < 32) {
> @@ -614,6 +642,9 @@ int plpks_signed_update_var(struct plpks_var *var, u64 flags)
> if (!(var->policy & PLPKS_SIGNEDUPDATE))
> return -EINVAL;
>
> + if (var->policy & PLPKS_WRAPPINGKEY)
> + return -EINVAL;
> +
> // Signed updates need the component to be NULL.
> if (var->component)
> return -EINVAL;
> @@ -696,6 +727,9 @@ int plpks_write_var(struct plpks_var var)
> if (var.policy & PLPKS_SIGNEDUPDATE)
> return -EINVAL;
>
> + if (var.policy & PLPKS_WRAPPINGKEY)
> + return -EINVAL;
> +
> auth = construct_auth(PLPKS_OS_OWNER);
> if (IS_ERR(auth))
> return PTR_ERR(auth);
> @@ -790,6 +824,9 @@ static int plpks_read_var(u8 consumer, struct plpks_var *var)
> if (var->namelen > PLPKS_MAX_NAME_SIZE)
> return -EINVAL;
>
> + if (var->policy & PLPKS_WRAPPINGKEY)
> + return -EINVAL;
> +
> auth = construct_auth(consumer);
> if (IS_ERR(auth))
> return PTR_ERR(auth);
> @@ -845,8 +882,309 @@ static int plpks_read_var(u8 consumer, struct plpks_var *var)
> }
>
> /**
> - * plpks_read_os_var() - Fetch the data for the specified variable that is
> - * owned by the OS consumer.
> + * plpks_wrapping_is_supported() - Get the H_PKS_WRAP_OBJECT interface
> + * availability status for the LPAR.
> + *
> + * Successful execution of the H_PKS_GET_CONFIG HCALL during initialization
> + * sets bit 3 of the flags variable in the PLPKS config structure if the
> + * H_PKS_WRAP_OBJECT interface is supported.
> + *
> + * Returns: true if the H_PKS_WRAP_OBJECT interface is supported, false if not.
> + */
> +bool plpks_wrapping_is_supported(void)
> +{
> + return wrapsupport;
> +}
> +
> +/**
> + * plpks_gen_wrapping_key() - Generate a new random key with the 'wrapping key'
> + * policy set.
> + *
> + * The H_PKS_GEN_KEY HCALL makes the hypervisor generate a new random key and
> + * store the key in a PLPKS object with the provided object label. With the
> + * 'wrapping key' policy set, only the label to the newly generated random key
> + * would be visible to the user.
> + *
> + * Possible reasons for the returned errno values:
> + *
> + * -ENXIO if PLPKS is not supported
> + * -EIO if PLPKS access is blocked due to the LPAR's state
> + * if PLPKS modification is blocked due to the LPAR's state
> + * if an error occurred while processing the request
> + * -EINVAL if invalid authorization parameter
> + * if invalid object label parameter
> + * if invalid object label len parameter
> + * if invalid or unsupported policy declaration
> + * if invalid output buffer parameter
> + * if invalid output buffer length parameter
> + * -EPERM if access is denied
> + * -ENOMEM if there is inadequate memory to perform this operation
> + * -EBUSY if unable to handle the request
> + * -EEXIST if the object label already exists
> + *
> + * Returns: On success 0 is returned, a negative errno if not.
> + */
> +int plpks_gen_wrapping_key(void)
> +{
> + unsigned long retbuf[PLPAR_HCALL_BUFSIZE] = { 0 };
> + struct plpks_auth *auth;
> + struct label *label;
> + int rc = 0, pseries_status = 0;
> + struct plpks_var var = {
> + .name = PLPKS_WRAPKEY_NAME,
> + .namelen = strlen(var.name),
> + .policy = PLPKS_WRAPPINGKEY,
> + .os = PLPKS_VAR_LINUX,
> + .component = PLPKS_WRAPKEY_COMPONENT
> + };
> +
> + auth = construct_auth(PLPKS_OS_OWNER);
> + if (IS_ERR(auth))
> + return PTR_ERR(auth);
> +
> + label = construct_label(var.component, var.os, var.name, var.namelen);
> + if (IS_ERR(label)) {
> + rc = PTR_ERR(label);
> + goto out;
> + }
> +
> + rc = plpar_hcall(H_PKS_GEN_KEY, retbuf,
> + virt_to_phys(auth), virt_to_phys(label),
> + label->size, var.policy,
> + NULL, PLPKS_WRAPPING_KEY_LENGTH);
> +
> + if (!rc)
> + rc = plpks_confirm_object_flushed(label, auth);
> +
> + pseries_status = rc;
> + rc = pseries_status_to_err(rc);
> +
> + if (rc && rc != -EEXIST) {
> + pr_err("H_PKS_GEN_KEY failed. pseries_status=%d, rc=%d",
> + pseries_status, rc);
> + } else {
> + rc = 0;
> + }
> +
> + kfree(label);
> +out:
> + kfree(auth);
> + return rc;
> +}
> +EXPORT_SYMBOL_GPL(plpks_gen_wrapping_key);
> +
> +/**
> + * plpks_wrap_object() - Wrap an object using the default wrapping key stored in
> + * the PLPKS.
> + * @input_buf: buffer containing the data to be wrapped
> + * @input_len: length of the input buffer
> + * @wrap_flags: object wrapping flags
> + * @output_buf: buffer to store the wrapped data
> + * @output_len: length of the output buffer
> + *
> + * The H_PKS_WRAP_OBJECT HCALL wraps an object using a wrapping key stored in
> + * the PLPKS and returns the wrapped object to the caller. The caller provides a
> + * label to the wrapping key with the 'wrapping key' policy set that must have
> + * been previously created with the H_PKS_GEN_KEY HCALL. The provided object is
> + * then encrypted with the wrapping key and additional metadata and the result
> + * is returned to the user. The metadata includes the wrapping algorithm and the
> + * wrapping key name so those parameters are not required during unwrap.
> + *
> + * Possible reasons for the returned errno values:
> + *
> + * -ENXIO if PLPKS is not supported
> + * -EIO if PLPKS access is blocked due to the LPAR's state
> + * if PLPKS modification is blocked due to the LPAR's state
> + * if an error occurred while processing the request
> + * -EINVAL if invalid authorization parameter
> + * if invalid wrapping key label parameter
> + * if invalid wrapping key label length parameter
> + * if invalid or unsupported object wrapping flags
> + * if invalid input buffer parameter
> + * if invalid input buffer length parameter
> + * if invalid output buffer parameter
> + * if invalid output buffer length parameter
> + * if invalid continue token parameter
> + * if the wrapping key is not compatible with the wrapping
> + * algorithm
> + * -EPERM if access is denied
> + * -ENOENT if the requested wrapping key was not found
> + * -EBUSY if unable to handle the request or long running operation
> + * initiated, retry later.
> + *
> + * Returns: On success 0 is returned, a negative errno if not.
> + */
> +int plpks_wrap_object(u8 **input_buf, u32 input_len, u16 wrap_flags,
> + u8 **output_buf, u32 *output_len)
> +{
> + unsigned long retbuf[PLPAR_HCALL9_BUFSIZE] = { 0 };
> + struct plpks_auth *auth;
> + struct label *label;
> + u64 continuetoken = 0;
> + u64 objwrapflags = 0;
> + int rc = 0, pseries_status = 0;
> + bool sb_audit_or_enforce_bit = wrap_flags & BIT(0);
> + bool sb_enforce_bit = wrap_flags & BIT(1);
> + struct plpks_var var = {
> + .name = PLPKS_WRAPKEY_NAME,
> + .namelen = strlen(var.name),
> + .os = PLPKS_VAR_LINUX,
> + .component = PLPKS_WRAPKEY_COMPONENT
> + };
> +
> + auth = construct_auth(PLPKS_OS_OWNER);
> + if (IS_ERR(auth))
> + return PTR_ERR(auth);
> +
> + label = construct_label(var.component, var.os, var.name, var.namelen);
> + if (IS_ERR(label)) {
> + rc = PTR_ERR(label);
> + goto out;
> + }
> +
> + /* Set the consumer password requirement bit. A must have. */
> + objwrapflags |= WRAPFLAG_BE_BIT_SET(3);
> +
> + /* Set the wrapping algorithm bit. Just one algorithm option for now */
> + objwrapflags |= WRAPFLAG_BE_FIELD_PREP(60, 63, 0x1);
> +
> + if (sb_audit_or_enforce_bit & sb_enforce_bit) {
> + pr_err("Cannot set both audit/enforce and enforce bits.");
> + rc = -EINVAL;
> + goto out_free_label;
> + } else if (sb_audit_or_enforce_bit) {
> + objwrapflags |= WRAPFLAG_BE_BIT_SET(1);
> + } else if (sb_enforce_bit) {
> + objwrapflags |= WRAPFLAG_BE_BIT_SET(2);
> + }
> +
> + *output_len = input_len + PLPKS_WRAPPING_BUF_DIFF;
> +
> + *output_buf = kzalloc(ALIGN(*output_len, PLPKS_WRAPPING_BUF_ALIGN),
> + GFP_KERNEL);
> + if (!(*output_buf)) {
> + pr_err("Output buffer allocation failed. Returning -ENOMEM.");
> + rc = -ENOMEM;
> + goto out_free_label;
> + }
> +
> + do {
> + rc = plpar_hcall9(H_PKS_WRAP_OBJECT, retbuf,
> + virt_to_phys(auth), virt_to_phys(label),
> + label->size, objwrapflags,
> + virt_to_phys(*input_buf), input_len,
> + virt_to_phys(*output_buf), *output_len,
> + continuetoken);
> +
> + continuetoken = retbuf[0];
> + pseries_status = rc;
> + rc = pseries_status_to_err(rc);
> + } while (rc == -EBUSY);
> +
> + if (rc) {
> + pr_err("H_PKS_WRAP_OBJECT failed. pseries_status=%d, rc=%d",
> + pseries_status, rc);
> + kfree(*output_buf);
> + *output_buf = NULL;
> + } else {
> + *output_len = retbuf[1];
> + }
> +
> +out_free_label:
> + kfree(label);
> +out:
> + kfree(auth);
> + return rc;
> +}
> +EXPORT_SYMBOL_GPL(plpks_wrap_object);
> +
> +/**
> + * plpks_unwrap_object() - Unwrap an object using the default wrapping key
> + * stored in the PLPKS.
> + * @input_buf: buffer containing the data to be unwrapped
> + * @input_len: length of the input buffer
> + * @output_buf: buffer to store the unwrapped data
> + * @output_len: length of the output buffer
> + *
> + * The H_PKS_UNWRAP_OBJECT HCALL unwraps an object that was previously wrapped
> + * using the H_PKS_WRAP_OBJECT HCALL.
> + *
> + * Possible reasons for the returned errno values:
> + *
> + * -ENXIO if PLPKS is not supported
> + * -EIO if PLPKS access is blocked due to the LPAR's state
> + * if PLPKS modification is blocked due to the LPAR's state
> + * if an error occurred while processing the request
> + * -EINVAL if invalid authorization parameter
> + * if invalid or unsupported object unwrapping flags
> + * if invalid input buffer parameter
> + * if invalid input buffer length parameter
> + * if invalid output buffer parameter
> + * if invalid output buffer length parameter
> + * if invalid continue token parameter
> + * if the wrapping key is not compatible with the wrapping
> + * algorithm
> + * if the wrapped object's format is not supported
> + * if the wrapped object is invalid
> + * -EPERM if access is denied
> + * -ENOENT if the wrapping key for the provided object was not found
> + * -EBUSY if unable to handle the request or long running operation
> + * initiated, retry later.
> + *
> + * Returns: On success 0 is returned, a negative errno if not.
> + */
> +int plpks_unwrap_object(u8 **input_buf, u32 input_len, u8 **output_buf,
> + u32 *output_len)
> +{
> + unsigned long retbuf[PLPAR_HCALL9_BUFSIZE] = { 0 };
> + struct plpks_auth *auth;
> + u64 continuetoken = 0;
> + u64 objwrapflags = 0;
> + int rc = 0, pseries_status = 0;
> +
> + auth = construct_auth(PLPKS_OS_OWNER);
> + if (IS_ERR(auth))
> + return PTR_ERR(auth);
> +
> + *output_len = input_len - PLPKS_WRAPPING_BUF_DIFF;
> + *output_buf = kzalloc(ALIGN(*output_len, PLPKS_WRAPPING_BUF_ALIGN),
> + GFP_KERNEL);
> + if (!(*output_buf)) {
> + pr_err("Output buffer allocation failed. Returning -ENOMEM.");
> + rc = -ENOMEM;
> + goto out;
> + }
> +
> + do {
> + rc = plpar_hcall9(H_PKS_UNWRAP_OBJECT, retbuf,
> + virt_to_phys(auth), objwrapflags,
> + virt_to_phys(*input_buf), input_len,
> + virt_to_phys(*output_buf), *output_len,
> + continuetoken);
> +
> + continuetoken = retbuf[0];
> + pseries_status = rc;
> + rc = pseries_status_to_err(rc);
> + } while (rc == -EBUSY);
> +
> + if (rc) {
> + pr_err("H_PKS_UNWRAP_OBJECT failed. pseries_status=%d, rc=%d",
> + pseries_status, rc);
> + kfree(*output_buf);
> + *output_buf = NULL;
> + } else {
> + *output_len = retbuf[1];
> + }
> +
> +out:
> + kfree(auth);
> + return rc;
> +}
> +EXPORT_SYMBOL_GPL(plpks_unwrap_object);
> +
> +/**
> + * plpks_read_os_var() - Fetch the data for the specified variable that is owned
> + * by the OS consumer.
> * @var: variable to be read from the PLPKS
> *
> * The consumer or the owner of the object is the os kernel. The
^ permalink raw reply
* Re: [PATCH v4 3/6] pseries/plpks: expose PowerVM wrapping features via the sysfs
From: Nayna Jain @ 2026-01-15 20:45 UTC (permalink / raw)
To: Srish Srinivasan, linux-integrity, keyrings, linuxppc-dev
Cc: maddy, mpe, npiggin, christophe.leroy, James.Bottomley, jarkko,
zohar, rnsastry, linux-kernel, linux-security-module
In-Reply-To: <20260115100504.488665-4-ssrish@linux.ibm.com>
On 1/15/26 5:05 AM, Srish Srinivasan wrote:
> Starting with Power11, PowerVM supports a new feature called "Key Wrapping"
> that protects user secrets by wrapping them using a hypervisor generated
> wrapping key. The status of this feature can be read by the
> H_PKS_GET_CONFIG HCALL.
>
> Expose the Power LPAR Platform KeyStore (PLPKS) wrapping features config
> via the sysfs file /sys/firmware/plpks/config/wrapping_features.
Thanks for the patch.
Reviewed-by: Nayna Jain <nayna@linux.ibm.com>
>
> Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
> ---
> .../ABI/testing/sysfs-firmware-plpks | 8 ++++++++
> arch/powerpc/include/asm/hvcall.h | 4 +++-
> arch/powerpc/include/asm/plpks.h | 3 +++
> arch/powerpc/platforms/pseries/plpks-sysfs.c | 2 ++
> arch/powerpc/platforms/pseries/plpks.c | 20 +++++++++++++++++++
> 5 files changed, 36 insertions(+), 1 deletion(-)
>
> diff --git a/Documentation/ABI/testing/sysfs-firmware-plpks b/Documentation/ABI/testing/sysfs-firmware-plpks
> index af0353f34115..cba061e4eee2 100644
> --- a/Documentation/ABI/testing/sysfs-firmware-plpks
> +++ b/Documentation/ABI/testing/sysfs-firmware-plpks
> @@ -48,3 +48,11 @@ Description: Bitmask of flags indicating which algorithms the hypervisor
> supports for signed update of objects, represented as a 16 byte
> hexadecimal ASCII string. Consult the hypervisor documentation
> for what these flags mean.
> +
> +What: /sys/firmware/plpks/config/wrapping_features
> +Date: November 2025
> +Contact: Srish Srinivasan <ssrish@linux.ibm.com>
> +Description: Bitmask of the wrapping features indicating the wrapping
> + algorithms that are supported for the H_PKS_WRAP_OBJECT requests
> + , represented as a 8 byte hexadecimal ASCII string. Consult the
> + hypervisor documentation for what these flags mean.
> diff --git a/arch/powerpc/include/asm/hvcall.h b/arch/powerpc/include/asm/hvcall.h
> index 9aef16149d92..dff90a7d7f70 100644
> --- a/arch/powerpc/include/asm/hvcall.h
> +++ b/arch/powerpc/include/asm/hvcall.h
> @@ -360,7 +360,9 @@
> #define H_GUEST_RUN_VCPU 0x480
> #define H_GUEST_COPY_MEMORY 0x484
> #define H_GUEST_DELETE 0x488
> -#define MAX_HCALL_OPCODE H_GUEST_DELETE
> +#define H_PKS_WRAP_OBJECT 0x490
> +#define H_PKS_UNWRAP_OBJECT 0x494
> +#define MAX_HCALL_OPCODE H_PKS_UNWRAP_OBJECT
>
> /* Scope args for H_SCM_UNBIND_ALL */
> #define H_UNBIND_SCOPE_ALL (0x1)
> diff --git a/arch/powerpc/include/asm/plpks.h b/arch/powerpc/include/asm/plpks.h
> index 8829a13bfda0..8f034588fdf7 100644
> --- a/arch/powerpc/include/asm/plpks.h
> +++ b/arch/powerpc/include/asm/plpks.h
> @@ -23,6 +23,7 @@
> #define PLPKS_IMMUTABLE PPC_BIT32(5) // Once written, object cannot be removed
> #define PLPKS_TRANSIENT PPC_BIT32(6) // Object does not persist through reboot
> #define PLPKS_SIGNEDUPDATE PPC_BIT32(7) // Object can only be modified by signed updates
> +#define PLPKS_WRAPPINGKEY PPC_BIT32(8) // Object contains a wrapping key
> #define PLPKS_HVPROVISIONED PPC_BIT32(28) // Hypervisor has provisioned this object
>
> // Signature algorithm flags from signed_update_algorithms
> @@ -103,6 +104,8 @@ u32 plpks_get_maxlargeobjectsize(void);
>
> u64 plpks_get_signedupdatealgorithms(void);
>
> +u64 plpks_get_wrappingfeatures(void);
> +
> u16 plpks_get_passwordlen(void);
>
> void plpks_early_init_devtree(void);
> diff --git a/arch/powerpc/platforms/pseries/plpks-sysfs.c b/arch/powerpc/platforms/pseries/plpks-sysfs.c
> index 01d526185783..c2ebcbb41ae3 100644
> --- a/arch/powerpc/platforms/pseries/plpks-sysfs.c
> +++ b/arch/powerpc/platforms/pseries/plpks-sysfs.c
> @@ -30,6 +30,7 @@ PLPKS_CONFIG_ATTR(used_space, "%u\n", plpks_get_usedspace);
> PLPKS_CONFIG_ATTR(supported_policies, "%08x\n", plpks_get_supportedpolicies);
> PLPKS_CONFIG_ATTR(signed_update_algorithms, "%016llx\n",
> plpks_get_signedupdatealgorithms);
> +PLPKS_CONFIG_ATTR(wrapping_features, "%016llx\n", plpks_get_wrappingfeatures);
>
> static const struct attribute *config_attrs[] = {
> &attr_version.attr,
> @@ -38,6 +39,7 @@ static const struct attribute *config_attrs[] = {
> &attr_used_space.attr,
> &attr_supported_policies.attr,
> &attr_signed_update_algorithms.attr,
> + &attr_wrapping_features.attr,
> NULL,
> };
>
> diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c
> index 03722fabf9c3..4a08f51537c8 100644
> --- a/arch/powerpc/platforms/pseries/plpks.c
> +++ b/arch/powerpc/platforms/pseries/plpks.c
> @@ -38,6 +38,7 @@ static u32 usedspace;
> static u32 supportedpolicies;
> static u32 maxlargeobjectsize;
> static u64 signedupdatealgorithms;
> +static u64 wrappingfeatures;
>
> struct plpks_auth {
> u8 version;
> @@ -248,6 +249,7 @@ static int _plpks_get_config(void)
> __be32 supportedpolicies;
> __be32 maxlargeobjectsize;
> __be64 signedupdatealgorithms;
> + __be64 wrappingfeatures;
> u8 rsvd1[476];
> } __packed * config;
> size_t size;
> @@ -280,6 +282,7 @@ static int _plpks_get_config(void)
> supportedpolicies = be32_to_cpu(config->supportedpolicies);
> maxlargeobjectsize = be32_to_cpu(config->maxlargeobjectsize);
> signedupdatealgorithms = be64_to_cpu(config->signedupdatealgorithms);
> + wrappingfeatures = be64_to_cpu(config->wrappingfeatures);
>
> // Validate that the numbers we get back match the requirements of the spec
> if (maxpwsize < 32) {
> @@ -472,6 +475,23 @@ u64 plpks_get_signedupdatealgorithms(void)
> return signedupdatealgorithms;
> }
>
> +/**
> + * plpks_get_wrappingfeatures() - Returns a bitmask of the wrapping features
> + * supported by the hypervisor.
> + *
> + * Successful execution of the H_PKS_GET_CONFIG HCALL during initialization
> + * reads a bitmask of the wrapping features supported by the hypervisor into the
> + * file local static wrappingfeatures variable. This is valid only when the
> + * PLPKS config structure version >= 3.
> + *
> + * Return:
> + * bitmask of the wrapping features supported by the hypervisor
> + */
> +u64 plpks_get_wrappingfeatures(void)
> +{
> + return wrappingfeatures;
> +}
> +
> /**
> * plpks_get_passwordlen() - Get the length of the PLPKS password in bytes.
> *
^ permalink raw reply
* Re: [PATCH v4 2/6] powerpc/pseries: move the PLPKS config inside its own sysfs directory
From: Nayna Jain @ 2026-01-15 20:44 UTC (permalink / raw)
To: Srish Srinivasan, linux-integrity, keyrings, linuxppc-dev
Cc: maddy, mpe, npiggin, christophe.leroy, James.Bottomley, jarkko,
zohar, rnsastry, linux-kernel, linux-security-module
In-Reply-To: <20260115100504.488665-3-ssrish@linux.ibm.com>
On 1/15/26 5:05 AM, Srish Srinivasan wrote:
> The /sys/firmware/secvar/config directory represents Power LPAR Platform
> KeyStore (PLPKS) configuration properties such as max_object_size, signed_
> update_algorithms, supported_policies, total_size, used_space, and version.
> These attributes describe the PLPKS, and not the secure boot variables
> (secvars).
>
> Create /sys/firmware/plpks directory and move the PLPKS config inside this
> directory. For backwards compatibility, create a soft link from the secvar
> sysfs directory to this config and emit a warning stating that the older
> sysfs path has been deprecated. Separate out the plpks specific
> documentation from secvar.
Again, Thanks for the patch.
Reviewed-by: Nayna Jain <nayna@linux.ibm.com>
>
> Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
> Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
> ---
> .../ABI/testing/sysfs-firmware-plpks | 50 ++++++++++
> Documentation/ABI/testing/sysfs-secvar | 65 -------------
> arch/powerpc/include/asm/plpks.h | 5 +
> arch/powerpc/include/asm/secvar.h | 1 -
> arch/powerpc/kernel/secvar-sysfs.c | 21 ++---
> arch/powerpc/platforms/pseries/Makefile | 2 +-
> arch/powerpc/platforms/pseries/plpks-secvar.c | 29 ------
> arch/powerpc/platforms/pseries/plpks-sysfs.c | 94 +++++++++++++++++++
> 8 files changed, 156 insertions(+), 111 deletions(-)
> create mode 100644 Documentation/ABI/testing/sysfs-firmware-plpks
> create mode 100644 arch/powerpc/platforms/pseries/plpks-sysfs.c
>
> diff --git a/Documentation/ABI/testing/sysfs-firmware-plpks b/Documentation/ABI/testing/sysfs-firmware-plpks
> new file mode 100644
> index 000000000000..af0353f34115
> --- /dev/null
> +++ b/Documentation/ABI/testing/sysfs-firmware-plpks
> @@ -0,0 +1,50 @@
> +What: /sys/firmware/plpks/config
> +Date: February 2023
> +Contact: Nayna Jain <nayna@linux.ibm.com>
> +Description: This optional directory contains read-only config attributes as
> + defined by the PLPKS implementation. All data is in ASCII
> + format.
> +
> +What: /sys/firmware/plpks/config/version
> +Date: February 2023
> +Contact: Nayna Jain <nayna@linux.ibm.com>
> +Description: Config version as reported by the hypervisor in ASCII decimal
> + format.
> +
> +What: /sys/firmware/plpks/config/max_object_size
> +Date: February 2023
> +Contact: Nayna Jain <nayna@linux.ibm.com>
> +Description: Maximum allowed size of objects in the keystore in bytes,
> + represented in ASCII decimal format.
> +
> + This is not necessarily the same as the max size that can be
> + written to an update file as writes can contain more than
> + object data, you should use the size of the update file for
> + that purpose.
> +
> +What: /sys/firmware/plpks/config/total_size
> +Date: February 2023
> +Contact: Nayna Jain <nayna@linux.ibm.com>
> +Description: Total size of the PLPKS in bytes, represented in ASCII decimal
> + format.
> +
> +What: /sys/firmware/plpks/config/used_space
> +Date: February 2023
> +Contact: Nayna Jain <nayna@linux.ibm.com>
> +Description: Current space consumed by the key store, in bytes, represented
> + in ASCII decimal format.
> +
> +What: /sys/firmware/plpks/config/supported_policies
> +Date: February 2023
> +Contact: Nayna Jain <nayna@linux.ibm.com>
> +Description: Bitmask of supported policy flags by the hypervisor, represented
> + as an 8 byte hexadecimal ASCII string. Consult the hypervisor
> + documentation for what these flags are.
> +
> +What: /sys/firmware/plpks/config/signed_update_algorithms
> +Date: February 2023
> +Contact: Nayna Jain <nayna@linux.ibm.com>
> +Description: Bitmask of flags indicating which algorithms the hypervisor
> + supports for signed update of objects, represented as a 16 byte
> + hexadecimal ASCII string. Consult the hypervisor documentation
> + for what these flags mean.
> diff --git a/Documentation/ABI/testing/sysfs-secvar b/Documentation/ABI/testing/sysfs-secvar
> index 1016967a730f..c52a5fd15709 100644
> --- a/Documentation/ABI/testing/sysfs-secvar
> +++ b/Documentation/ABI/testing/sysfs-secvar
> @@ -63,68 +63,3 @@ Contact: Nayna Jain <nayna@linux.ibm.com>
> Description: A write-only file that is used to submit the new value for the
> variable. The size of the file represents the maximum size of
> the variable data that can be written.
> -
> -What: /sys/firmware/secvar/config
> -Date: February 2023
> -Contact: Nayna Jain <nayna@linux.ibm.com>
> -Description: This optional directory contains read-only config attributes as
> - defined by the secure variable implementation. All data is in
> - ASCII format. The directory is only created if the backing
> - implementation provides variables to populate it, which at
> - present is only PLPKS on the pseries platform.
> -
> -What: /sys/firmware/secvar/config/version
> -Date: February 2023
> -Contact: Nayna Jain <nayna@linux.ibm.com>
> -Description: Config version as reported by the hypervisor in ASCII decimal
> - format.
> -
> - Currently only provided by PLPKS on the pseries platform.
> -
> -What: /sys/firmware/secvar/config/max_object_size
> -Date: February 2023
> -Contact: Nayna Jain <nayna@linux.ibm.com>
> -Description: Maximum allowed size of objects in the keystore in bytes,
> - represented in ASCII decimal format.
> -
> - This is not necessarily the same as the max size that can be
> - written to an update file as writes can contain more than
> - object data, you should use the size of the update file for
> - that purpose.
> -
> - Currently only provided by PLPKS on the pseries platform.
> -
> -What: /sys/firmware/secvar/config/total_size
> -Date: February 2023
> -Contact: Nayna Jain <nayna@linux.ibm.com>
> -Description: Total size of the PLPKS in bytes, represented in ASCII decimal
> - format.
> -
> - Currently only provided by PLPKS on the pseries platform.
> -
> -What: /sys/firmware/secvar/config/used_space
> -Date: February 2023
> -Contact: Nayna Jain <nayna@linux.ibm.com>
> -Description: Current space consumed by the key store, in bytes, represented
> - in ASCII decimal format.
> -
> - Currently only provided by PLPKS on the pseries platform.
> -
> -What: /sys/firmware/secvar/config/supported_policies
> -Date: February 2023
> -Contact: Nayna Jain <nayna@linux.ibm.com>
> -Description: Bitmask of supported policy flags by the hypervisor,
> - represented as an 8 byte hexadecimal ASCII string. Consult the
> - hypervisor documentation for what these flags are.
> -
> - Currently only provided by PLPKS on the pseries platform.
> -
> -What: /sys/firmware/secvar/config/signed_update_algorithms
> -Date: February 2023
> -Contact: Nayna Jain <nayna@linux.ibm.com>
> -Description: Bitmask of flags indicating which algorithms the hypervisor
> - supports for signed update of objects, represented as a 16 byte
> - hexadecimal ASCII string. Consult the hypervisor documentation
> - for what these flags mean.
> -
> - Currently only provided by PLPKS on the pseries platform.
> diff --git a/arch/powerpc/include/asm/plpks.h b/arch/powerpc/include/asm/plpks.h
> index f303922bf622..8829a13bfda0 100644
> --- a/arch/powerpc/include/asm/plpks.h
> +++ b/arch/powerpc/include/asm/plpks.h
> @@ -13,6 +13,7 @@
>
> #include <linux/types.h>
> #include <linux/list.h>
> +#include <linux/kobject.h>
>
> // Object policy flags from supported_policies
> #define PLPKS_OSSECBOOTAUDIT PPC_BIT32(1) // OS secure boot must be audit/enforce
> @@ -107,11 +108,15 @@ u16 plpks_get_passwordlen(void);
> void plpks_early_init_devtree(void);
>
> int plpks_populate_fdt(void *fdt);
> +
> +int plpks_config_create_softlink(struct kobject *from);
> #else // CONFIG_PSERIES_PLPKS
> static inline bool plpks_is_available(void) { return false; }
> static inline u16 plpks_get_passwordlen(void) { BUILD_BUG(); }
> static inline void plpks_early_init_devtree(void) { }
> static inline int plpks_populate_fdt(void *fdt) { BUILD_BUG(); }
> +static inline int plpks_config_create_softlink(struct kobject *from)
> + { return 0; }
> #endif // CONFIG_PSERIES_PLPKS
>
> #endif // _ASM_POWERPC_PLPKS_H
> diff --git a/arch/powerpc/include/asm/secvar.h b/arch/powerpc/include/asm/secvar.h
> index 4828e0ab7e3c..fd5006307f2a 100644
> --- a/arch/powerpc/include/asm/secvar.h
> +++ b/arch/powerpc/include/asm/secvar.h
> @@ -20,7 +20,6 @@ struct secvar_operations {
> int (*set)(const char *key, u64 key_len, u8 *data, u64 data_size);
> ssize_t (*format)(char *buf, size_t bufsize);
> int (*max_size)(u64 *max_size);
> - const struct attribute **config_attrs;
>
> // NULL-terminated array of fixed variable names
> // Only used if get_next() isn't provided
> diff --git a/arch/powerpc/kernel/secvar-sysfs.c b/arch/powerpc/kernel/secvar-sysfs.c
> index ec900bce0257..4111b21962eb 100644
> --- a/arch/powerpc/kernel/secvar-sysfs.c
> +++ b/arch/powerpc/kernel/secvar-sysfs.c
> @@ -12,6 +12,7 @@
> #include <linux/string.h>
> #include <linux/of.h>
> #include <asm/secvar.h>
> +#include <asm/plpks.h>
>
> #define NAME_MAX_SIZE 1024
>
> @@ -145,19 +146,6 @@ static __init int update_kobj_size(void)
> return 0;
> }
>
> -static __init int secvar_sysfs_config(struct kobject *kobj)
> -{
> - struct attribute_group config_group = {
> - .name = "config",
> - .attrs = (struct attribute **)secvar_ops->config_attrs,
> - };
> -
> - if (secvar_ops->config_attrs)
> - return sysfs_create_group(kobj, &config_group);
> -
> - return 0;
> -}
> -
> static __init int add_var(const char *name)
> {
> struct kobject *kobj;
> @@ -260,12 +248,15 @@ static __init int secvar_sysfs_init(void)
> goto err;
> }
>
> - rc = secvar_sysfs_config(secvar_kobj);
> + rc = plpks_config_create_softlink(secvar_kobj);
> if (rc) {
> - pr_err("Failed to create config directory\n");
> + pr_err("Failed to create softlink to PLPKS config directory");
> goto err;
> }
>
> + pr_info("/sys/firmware/secvar/config is now deprecated.\n");
> + pr_info("Will be removed in future versions.\n");
> +
> if (secvar_ops->get_next)
> rc = secvar_sysfs_load();
> else
> diff --git a/arch/powerpc/platforms/pseries/Makefile b/arch/powerpc/platforms/pseries/Makefile
> index 931ebaa474c8..3ced289a675b 100644
> --- a/arch/powerpc/platforms/pseries/Makefile
> +++ b/arch/powerpc/platforms/pseries/Makefile
> @@ -30,7 +30,7 @@ obj-$(CONFIG_PAPR_SCM) += papr_scm.o
> obj-$(CONFIG_PPC_SPLPAR) += vphn.o
> obj-$(CONFIG_PPC_SVM) += svm.o
> obj-$(CONFIG_FA_DUMP) += rtas-fadump.o
> -obj-$(CONFIG_PSERIES_PLPKS) += plpks.o
> +obj-$(CONFIG_PSERIES_PLPKS) += plpks.o plpks-sysfs.o
> obj-$(CONFIG_PPC_SECURE_BOOT) += plpks-secvar.o
> obj-$(CONFIG_PSERIES_PLPKS_SED) += plpks_sed_ops.o
> obj-$(CONFIG_SUSPEND) += suspend.o
> diff --git a/arch/powerpc/platforms/pseries/plpks-secvar.c b/arch/powerpc/platforms/pseries/plpks-secvar.c
> index f9e9cc40c9d0..a50ff6943d80 100644
> --- a/arch/powerpc/platforms/pseries/plpks-secvar.c
> +++ b/arch/powerpc/platforms/pseries/plpks-secvar.c
> @@ -20,33 +20,6 @@
> #include <asm/secvar.h>
> #include <asm/plpks.h>
>
> -// Config attributes for sysfs
> -#define PLPKS_CONFIG_ATTR(name, fmt, func) \
> - static ssize_t name##_show(struct kobject *kobj, \
> - struct kobj_attribute *attr, \
> - char *buf) \
> - { \
> - return sysfs_emit(buf, fmt, func()); \
> - } \
> - static struct kobj_attribute attr_##name = __ATTR_RO(name)
> -
> -PLPKS_CONFIG_ATTR(version, "%u\n", plpks_get_version);
> -PLPKS_CONFIG_ATTR(max_object_size, "%u\n", plpks_get_maxobjectsize);
> -PLPKS_CONFIG_ATTR(total_size, "%u\n", plpks_get_totalsize);
> -PLPKS_CONFIG_ATTR(used_space, "%u\n", plpks_get_usedspace);
> -PLPKS_CONFIG_ATTR(supported_policies, "%08x\n", plpks_get_supportedpolicies);
> -PLPKS_CONFIG_ATTR(signed_update_algorithms, "%016llx\n", plpks_get_signedupdatealgorithms);
> -
> -static const struct attribute *config_attrs[] = {
> - &attr_version.attr,
> - &attr_max_object_size.attr,
> - &attr_total_size.attr,
> - &attr_used_space.attr,
> - &attr_supported_policies.attr,
> - &attr_signed_update_algorithms.attr,
> - NULL,
> -};
> -
> static u32 get_policy(const char *name)
> {
> if ((strcmp(name, "db") == 0) ||
> @@ -225,7 +198,6 @@ static const struct secvar_operations plpks_secvar_ops_static = {
> .set = plpks_set_variable,
> .format = plpks_secvar_format,
> .max_size = plpks_max_size,
> - .config_attrs = config_attrs,
> .var_names = plpks_var_names_static,
> };
>
> @@ -234,7 +206,6 @@ static const struct secvar_operations plpks_secvar_ops_dynamic = {
> .set = plpks_set_variable,
> .format = plpks_secvar_format,
> .max_size = plpks_max_size,
> - .config_attrs = config_attrs,
> .var_names = plpks_var_names_dynamic,
> };
>
> diff --git a/arch/powerpc/platforms/pseries/plpks-sysfs.c b/arch/powerpc/platforms/pseries/plpks-sysfs.c
> new file mode 100644
> index 000000000000..01d526185783
> --- /dev/null
> +++ b/arch/powerpc/platforms/pseries/plpks-sysfs.c
> @@ -0,0 +1,94 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +/*
> + * Copyright (C) 2025 IBM Corporation, Srish Srinivasan <ssrish@linux.ibm.com>
> + *
> + * This code exposes PLPKS config to user via sysfs
> + */
> +
> +#define pr_fmt(fmt) "plpks-sysfs: "fmt
> +
> +#include <linux/init.h>
> +#include <linux/printk.h>
> +#include <linux/types.h>
> +#include <asm/machdep.h>
> +#include <asm/plpks.h>
> +
> +/* config attributes for sysfs */
> +#define PLPKS_CONFIG_ATTR(name, fmt, func) \
> + static ssize_t name##_show(struct kobject *kobj, \
> + struct kobj_attribute *attr, \
> + char *buf) \
> + { \
> + return sysfs_emit(buf, fmt, func()); \
> + } \
> + static struct kobj_attribute attr_##name = __ATTR_RO(name)
> +
> +PLPKS_CONFIG_ATTR(version, "%u\n", plpks_get_version);
> +PLPKS_CONFIG_ATTR(max_object_size, "%u\n", plpks_get_maxobjectsize);
> +PLPKS_CONFIG_ATTR(total_size, "%u\n", plpks_get_totalsize);
> +PLPKS_CONFIG_ATTR(used_space, "%u\n", plpks_get_usedspace);
> +PLPKS_CONFIG_ATTR(supported_policies, "%08x\n", plpks_get_supportedpolicies);
> +PLPKS_CONFIG_ATTR(signed_update_algorithms, "%016llx\n",
> + plpks_get_signedupdatealgorithms);
> +
> +static const struct attribute *config_attrs[] = {
> + &attr_version.attr,
> + &attr_max_object_size.attr,
> + &attr_total_size.attr,
> + &attr_used_space.attr,
> + &attr_supported_policies.attr,
> + &attr_signed_update_algorithms.attr,
> + NULL,
> +};
> +
> +static struct kobject *plpks_kobj, *plpks_config_kobj;
> +
> +int plpks_config_create_softlink(struct kobject *from)
> +{
> + if (!plpks_config_kobj)
> + return -EINVAL;
> + return sysfs_create_link(from, plpks_config_kobj, "config");
> +}
> +
> +static __init int plpks_sysfs_config(struct kobject *kobj)
> +{
> + struct attribute_group config_group = {
> + .name = NULL,
> + .attrs = (struct attribute **)config_attrs,
> + };
> +
> + return sysfs_create_group(kobj, &config_group);
> +}
> +
> +static __init int plpks_sysfs_init(void)
> +{
> + int rc;
> +
> + if (!plpks_is_available())
> + return -ENODEV;
> +
> + plpks_kobj = kobject_create_and_add("plpks", firmware_kobj);
> + if (!plpks_kobj) {
> + pr_err("Failed to create plpks kobj\n");
> + return -ENOMEM;
> + }
> +
> + plpks_config_kobj = kobject_create_and_add("config", plpks_kobj);
> + if (!plpks_config_kobj) {
> + pr_err("Failed to create plpks config kobj\n");
> + kobject_put(plpks_kobj);
> + return -ENOMEM;
> + }
> +
> + rc = plpks_sysfs_config(plpks_config_kobj);
> + if (rc) {
> + pr_err("Failed to create attribute group for plpks config\n");
> + kobject_put(plpks_config_kobj);
> + kobject_put(plpks_kobj);
> + return rc;
> + }
> +
> + return 0;
> +}
> +
> +machine_subsys_initcall(pseries, plpks_sysfs_init);
^ permalink raw reply
* Re: [PATCH v4 1/6] pseries/plpks: fix kernel-doc comment inconsistencies
From: Nayna Jain @ 2026-01-15 20:43 UTC (permalink / raw)
To: Srish Srinivasan, linux-integrity, keyrings, linuxppc-dev
Cc: maddy, mpe, npiggin, christophe.leroy, James.Bottomley, jarkko,
zohar, rnsastry, linux-kernel, linux-security-module
In-Reply-To: <20260115100504.488665-2-ssrish@linux.ibm.com>
On 1/15/26 5:04 AM, Srish Srinivasan wrote:
> Fix issues with comments for all the applicable functions to be
> consistent with kernel-doc format. Move them before the function
> definition as opposed to the function prototype.
Thanks for the patch.
Reviewed-by: Nayna Jain <nayna@linux.ibm.com>
>
> Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
> ---
> arch/powerpc/include/asm/plpks.h | 77 ------
> arch/powerpc/platforms/pseries/plpks.c | 328 ++++++++++++++++++++++++-
> 2 files changed, 318 insertions(+), 87 deletions(-)
>
> diff --git a/arch/powerpc/include/asm/plpks.h b/arch/powerpc/include/asm/plpks.h
> index 7a84069759b0..f303922bf622 100644
> --- a/arch/powerpc/include/asm/plpks.h
> +++ b/arch/powerpc/include/asm/plpks.h
> @@ -67,122 +67,45 @@ struct plpks_var_name_list {
> struct plpks_var_name varlist[];
> };
>
> -/**
> - * Updates the authenticated variable. It expects NULL as the component.
> - */
> int plpks_signed_update_var(struct plpks_var *var, u64 flags);
>
> -/**
> - * Writes the specified var and its data to PKS.
> - * Any caller of PKS driver should present a valid component type for
> - * their variable.
> - */
> int plpks_write_var(struct plpks_var var);
>
> -/**
> - * Removes the specified var and its data from PKS.
> - */
> int plpks_remove_var(char *component, u8 varos,
> struct plpks_var_name vname);
>
> -/**
> - * Returns the data for the specified os variable.
> - *
> - * Caller must allocate a buffer in var->data with length in var->datalen.
> - * If no buffer is provided, var->datalen will be populated with the object's
> - * size.
> - */
> int plpks_read_os_var(struct plpks_var *var);
>
> -/**
> - * Returns the data for the specified firmware variable.
> - *
> - * Caller must allocate a buffer in var->data with length in var->datalen.
> - * If no buffer is provided, var->datalen will be populated with the object's
> - * size.
> - */
> int plpks_read_fw_var(struct plpks_var *var);
>
> -/**
> - * Returns the data for the specified bootloader variable.
> - *
> - * Caller must allocate a buffer in var->data with length in var->datalen.
> - * If no buffer is provided, var->datalen will be populated with the object's
> - * size.
> - */
> int plpks_read_bootloader_var(struct plpks_var *var);
>
> -/**
> - * Returns if PKS is available on this LPAR.
> - */
> bool plpks_is_available(void);
>
> -/**
> - * Returns version of the Platform KeyStore.
> - */
> u8 plpks_get_version(void);
>
> -/**
> - * Returns hypervisor storage overhead per object, not including the size of
> - * the object or label. Only valid for config version >= 2
> - */
> u16 plpks_get_objoverhead(void);
>
> -/**
> - * Returns maximum password size. Must be >= 32 bytes
> - */
> u16 plpks_get_maxpwsize(void);
>
> -/**
> - * Returns maximum object size supported by Platform KeyStore.
> - */
> u16 plpks_get_maxobjectsize(void);
>
> -/**
> - * Returns maximum object label size supported by Platform KeyStore.
> - */
> u16 plpks_get_maxobjectlabelsize(void);
>
> -/**
> - * Returns total size of the configured Platform KeyStore.
> - */
> u32 plpks_get_totalsize(void);
>
> -/**
> - * Returns used space from the total size of the Platform KeyStore.
> - */
> u32 plpks_get_usedspace(void);
>
> -/**
> - * Returns bitmask of policies supported by the hypervisor.
> - */
> u32 plpks_get_supportedpolicies(void);
>
> -/**
> - * Returns maximum byte size of a single object supported by the hypervisor.
> - * Only valid for config version >= 3
> - */
> u32 plpks_get_maxlargeobjectsize(void);
>
> -/**
> - * Returns bitmask of signature algorithms supported for signed updates.
> - * Only valid for config version >= 3
> - */
> u64 plpks_get_signedupdatealgorithms(void);
>
> -/**
> - * Returns the length of the PLPKS password in bytes.
> - */
> u16 plpks_get_passwordlen(void);
>
> -/**
> - * Called in early init to retrieve and clear the PLPKS password from the DT.
> - */
> void plpks_early_init_devtree(void);
>
> -/**
> - * Populates the FDT with the PLPKS password to prepare for kexec.
> - */
> int plpks_populate_fdt(void *fdt);
> #else // CONFIG_PSERIES_PLPKS
> static inline bool plpks_is_available(void) { return false; }
> diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c
> index b1667ed05f98..03722fabf9c3 100644
> --- a/arch/powerpc/platforms/pseries/plpks.c
> +++ b/arch/powerpc/platforms/pseries/plpks.c
> @@ -312,40 +312,107 @@ static int _plpks_get_config(void)
> return rc;
> }
>
> +/**
> + * plpks_get_version() - Get the version of the PLPKS config structure.
> + *
> + * Successful execution of the H_PKS_GET_CONFIG HCALL during initialization
> + * reads the PLPKS config structure version and saves it in a file local static
> + * version variable.
> + *
> + * Returns: On success the saved PLPKS config structure version is returned, 0
> + * if not.
> + */
> u8 plpks_get_version(void)
> {
> return version;
> }
>
> +/**
> + * plpks_get_objoverhead() - Get the hypervisor storage overhead per object.
> + *
> + * Successful execution of the H_PKS_GET_CONFIG HCALL during initialization
> + * reads the per object hypervisor storage overhead in bytes into the local
> + * static objoverhead variable, excluding the size of the object or the label.
> + * This value can be treated as valid only when the PLPKS config structure
> + * version >= 2.
> + *
> + * Returns: If PLPKS config structure version >= 2 then the storage overhead is
> + * returned, 0 otherwise.
> + */
> u16 plpks_get_objoverhead(void)
> {
> return objoverhead;
> }
>
> +/**
> + * plpks_get_maxpwsize() - Get the maximum password size.
> + *
> + * Successful execution of the H_PKS_GET_CONFIG HCALL during initialization
> + * reads the maximum password size and checks if it is 32 bytes at the least
> + * before storing it in the local static maxpwsize variable.
> + *
> + * Returns: On success the maximum password size is returned, 0 if not.
> + */
> u16 plpks_get_maxpwsize(void)
> {
> return maxpwsize;
> }
>
> +/**
> + * plpks_get_maxobjectsize() - Get the maximum object size supported by the
> + * PLPKS.
> + *
> + * Successful execution of the H_PKS_GET_CONFIG HCALL during initialization
> + * reads the maximum object size into the file local static maxobjsize variable.
> + *
> + * Returns: On success the maximum object size is returned, 0 if not.
> + */
> u16 plpks_get_maxobjectsize(void)
> {
> return maxobjsize;
> }
>
> +/**
> + * plpks_get_maxobjectlabelsize() - Get the maximum object label size supported
> + * by the PLPKS.
> + *
> + * Successful execution of the H_PKS_GET_CONFIG HCALL during initialization
> + * reads the maximum object label size into the local static maxobjlabelsize
> + * variable.
> + *
> + * Returns: On success the maximum object label size is returned, 0 if not.
> + */
> u16 plpks_get_maxobjectlabelsize(void)
> {
> return maxobjlabelsize;
> }
>
> +/**
> + * plpks_get_totalsize() - Get the total size of the PLPKS that is configured.
> + *
> + * Successful execution of the H_PKS_GET_CONFIG HCALL during initialization
> + * reads the total size of the PLPKS that is configured for the LPAR into the
> + * file local static totalsize variable.
> + *
> + * Returns: On success the total size of the PLPKS configured is returned, 0 if
> + * not.
> + */
> u32 plpks_get_totalsize(void)
> {
> return totalsize;
> }
>
> +/**
> + * plpks_get_usedspace() - Get the used space from the total size of the PLPKS.
> + *
> + * Invoke the H_PKS_GET_CONFIG HCALL to refresh the latest value for the used
> + * space as this keeps changing with the creation and removal of objects in the
> + * PLPKS.
> + *
> + * Returns: On success the used space is returned, 0 if not.
> + */
> u32 plpks_get_usedspace(void)
> {
> - // Unlike other config values, usedspace regularly changes as objects
> - // are updated, so we need to refresh.
> int rc = _plpks_get_config();
> if (rc) {
> pr_err("Couldn't get config, rc: %d\n", rc);
> @@ -354,26 +421,84 @@ u32 plpks_get_usedspace(void)
> return usedspace;
> }
>
> +/**
> + * plpks_get_supportedpolicies() - Get a bitmask of the policies supported by
> + * the hypervisor.
> + *
> + * Successful execution of the H_PKS_GET_CONFIG HCALL during initialization
> + * reads a bitmask of the policies supported by the hypervisor into the file
> + * local static supportedpolicies variable.
> + *
> + * Returns: On success the bitmask of the policies supported by the hypervisor
> + * are returned, 0 if not.
> + */
> u32 plpks_get_supportedpolicies(void)
> {
> return supportedpolicies;
> }
>
> +/**
> + * plpks_get_maxlargeobjectsize() - Get the maximum object size supported for
> + * PLPKS config structure version >= 3
> + *
> + * Successful execution of the H_PKS_GET_CONFIG HCALL during initialization
> + * reads the maximum object size into the local static maxlargeobjectsize
> + * variable for PLPKS config structure version >= 3. This was introduced
> + * starting with PLPKS config structure version 3 to allow for objects of
> + * size >= 64K.
> + *
> + * Returns: If PLPKS config structure version >= 3 then the new maximum object
> + * size is returned, 0 if not.
> + */
> u32 plpks_get_maxlargeobjectsize(void)
> {
> return maxlargeobjectsize;
> }
>
> +/**
> + * plpks_get_signedupdatealgorithms() - Get a bitmask of the signature
> + * algorithms supported for signed updates.
> + *
> + * Successful execution of the H_PKS_GET_CONFIG HCALL during initialization
> + * reads a bitmask of the signature algorithms supported for signed updates into
> + * the file local static signedupdatealgorithms variable. This is valid only
> + * when the PLPKS config structure version >= 3.
> + *
> + * Returns: On success the bitmask of the signature algorithms supported for
> + * signed updates is returned, 0 if not.
> + */
> u64 plpks_get_signedupdatealgorithms(void)
> {
> return signedupdatealgorithms;
> }
>
> +/**
> + * plpks_get_passwordlen() - Get the length of the PLPKS password in bytes.
> + *
> + * The H_PKS_GEN_PASSWORD HCALL makes the hypervisor generate a random password
> + * for the specified consumer, apply that password to the PLPKS and return it to
> + * the caller. In this process, the password length for the OS consumer is
> + * stored in the local static ospasswordlength variable.
> + *
> + * Returns: On success the password length for the OS consumer in bytes is
> + * returned, 0 if not.
> + */
> u16 plpks_get_passwordlen(void)
> {
> return ospasswordlength;
> }
>
> +/**
> + * plpks_is_available() - Get the PLPKS availability status for the LPAR.
> + *
> + * The availability of PLPKS is inferred based upon the successful execution of
> + * the H_PKS_GET_CONFIG HCALL provided the firmware supports this feature. The
> + * H_PKS_GET_CONFIG HCALL reads the configuration and status information related
> + * to the PLPKS. The configuration structure provides a version number to inform
> + * the caller of the supported features.
> + *
> + * Returns: true is returned if PLPKS is available, false if not.
> + */
> bool plpks_is_available(void)
> {
> int rc;
> @@ -425,6 +550,35 @@ static int plpks_confirm_object_flushed(struct label *label,
> return pseries_status_to_err(rc);
> }
>
> +/**
> + * plpks_signed_update_var() - Update the specified authenticated variable.
> + * @var: authenticated variable to be updated
> + * @flags: signed update request operation flags
> + *
> + * The H_PKS_SIGNED_UPDATE HCALL performs a signed update to an object in the
> + * PLPKS. The object must have the signed update policy flag set.
> + *
> + * Possible reasons for the returned errno values:
> + *
> + * -ENXIO if PLPKS is not supported
> + * -EIO if PLPKS access is blocked due to the LPAR's state
> + * if PLPKS modification is blocked due to the LPAR's state
> + * if an error occurred while processing the request
> + * -EINVAL if invalid authorization parameter
> + * if invalid object label parameter
> + * if invalid object label len parameter
> + * if invalid or unsupported policy declaration
> + * if invalid signed update flags
> + * if invalid input data parameter
> + * if invalid input data len parameter
> + * if invalid continue token parameter
> + * -EPERM if access is denied
> + * -ENOMEM if there is inadequate memory to perform the operation
> + * -EBUSY if unable to handle the request or long running operation
> + * initiated, retry later
> + *
> + * Returns: On success 0 is returned, a negative errno if not.
> + */
> int plpks_signed_update_var(struct plpks_var *var, u64 flags)
> {
> unsigned long retbuf[PLPAR_HCALL9_BUFSIZE] = {0};
> @@ -481,6 +635,33 @@ int plpks_signed_update_var(struct plpks_var *var, u64 flags)
> return rc;
> }
>
> +/**
> + * plpks_write_var() - Write the specified variable and its data to PLPKS.
> + * @var: variable to be written into the PLPKS
> + *
> + * The H_PKS_WRITE_OBJECT HCALL writes an object into the PLPKS. The caller must
> + * provide a valid component type for the variable, and the signed update policy
> + * flag must not be set.
> + *
> + * Possible reasons for the returned errno values:
> + *
> + * -ENXIO if PLPKS is not supported
> + * -EIO if PLPKS access is blocked due to the LPAR's state
> + * if PLPKS modification is blocked due to the LPAR's state
> + * if an error occurred while processing the request
> + * -EINVAL if invalid authorization parameter
> + * if invalid object label parameter
> + * if invalid object label len parameter
> + * if invalid or unsupported policy declaration
> + * if invalid input data parameter
> + * if invalid input data len parameter
> + * -EPERM if access is denied
> + * -ENOMEM if unable to store the requested object in the space available
> + * -EBUSY if unable to handle the request
> + * -EEXIST if the object label already exists
> + *
> + * Returns: On success 0 is returned, a negative errno if not.
> + */
> int plpks_write_var(struct plpks_var var)
> {
> unsigned long retbuf[PLPAR_HCALL_BUFSIZE] = { 0 };
> @@ -520,6 +701,30 @@ int plpks_write_var(struct plpks_var var)
> return rc;
> }
>
> +/**
> + * plpks_remove_var() - Remove the specified variable and its data from PLPKS.
> + * @component: metadata prefix in the object label metadata structure
> + * @varos: metadata OS flags in the object label metadata structure
> + * @vname: object label for the object that needs to be removed
> + *
> + * The H_PKS_REMOVE_OBJECT HCALL removes an object from the PLPKS. The removal
> + * is independent of the policy bits that are set.
> + *
> + * Possible reasons for the returned errno values:
> + *
> + * -ENXIO if PLPKS is not supported
> + * -EIO if PLPKS access is blocked due to the LPAR's state
> + * if PLPKS modification is blocked due to the LPAR's state
> + * if an error occurred while processing the request
> + * -EINVAL if invalid authorization parameter
> + * if invalid object label parameter
> + * if invalid object label len parameter
> + * -EPERM if access is denied
> + * -ENOENT if the requested object was not found
> + * -EBUSY if unable to handle the request
> + *
> + * Returns: On success 0 is returned, a negative errno if not.
> + */
> int plpks_remove_var(char *component, u8 varos, struct plpks_var_name vname)
> {
> unsigned long retbuf[PLPAR_HCALL_BUFSIZE] = { 0 };
> @@ -619,21 +824,119 @@ static int plpks_read_var(u8 consumer, struct plpks_var *var)
> return rc;
> }
>
> +/**
> + * plpks_read_os_var() - Fetch the data for the specified variable that is
> + * owned by the OS consumer.
> + * @var: variable to be read from the PLPKS
> + *
> + * The consumer or the owner of the object is the os kernel. The
> + * H_PKS_READ_OBJECT HCALL reads an object from the PLPKS. The caller must
> + * allocate the buffer var->data and specify the length for this buffer in
> + * var->datalen. If no buffer is provided, var->datalen will be populated with
> + * the requested object's size.
> + *
> + * Possible reasons for the returned errno values:
> + *
> + * -ENXIO if PLPKS is not supported
> + * -EIO if PLPKS access is blocked due to the LPAR's state
> + * if an error occurred while processing the request
> + * -EINVAL if invalid authorization parameter
> + * if invalid object label parameter
> + * if invalid object label len parameter
> + * if invalid output data parameter
> + * if invalid output data len parameter
> + * -EPERM if access is denied
> + * -ENOENT if the requested object was not found
> + * -EFBIG if the requested object couldn't be
> + * stored in the buffer provided
> + * -EBUSY if unable to handle the request
> + *
> + * Returns: On success 0 is returned, a negative errno if not.
> + */
> int plpks_read_os_var(struct plpks_var *var)
> {
> return plpks_read_var(PLPKS_OS_OWNER, var);
> }
>
> +/**
> + * plpks_read_fw_var() - Fetch the data for the specified variable that is
> + * owned by the firmware consumer.
> + * @var: variable to be read from the PLPKS
> + *
> + * The consumer or the owner of the object is the firmware. The
> + * H_PKS_READ_OBJECT HCALL reads an object from the PLPKS. The caller must
> + * allocate the buffer var->data and specify the length for this buffer in
> + * var->datalen. If no buffer is provided, var->datalen will be populated with
> + * the requested object's size.
> + *
> + * Possible reasons for the returned errno values:
> + *
> + * -ENXIO if PLPKS is not supported
> + * -EIO if PLPKS access is blocked due to the LPAR's state
> + * if an error occurred while processing the request
> + * -EINVAL if invalid authorization parameter
> + * if invalid object label parameter
> + * if invalid object label len parameter
> + * if invalid output data parameter
> + * if invalid output data len parameter
> + * -EPERM if access is denied
> + * -ENOENT if the requested object was not found
> + * -EFBIG if the requested object couldn't be
> + * stored in the buffer provided
> + * -EBUSY if unable to handle the request
> + *
> + * Returns: On success 0 is returned, a negative errno if not.
> + */
> int plpks_read_fw_var(struct plpks_var *var)
> {
> return plpks_read_var(PLPKS_FW_OWNER, var);
> }
>
> +/**
> + * plpks_read_bootloader_var() - Fetch the data for the specified variable
> + * owned by the bootloader consumer.
> + * @var: variable to be read from the PLPKS
> + *
> + * The consumer or the owner of the object is the bootloader. The
> + * H_PKS_READ_OBJECT HCALL reads an object from the PLPKS. The caller must
> + * allocate the buffer var->data and specify the length for this buffer in
> + * var->datalen. If no buffer is provided, var->datalen will be populated with
> + * the requested object's size.
> + *
> + * Possible reasons for the returned errno values:
> + *
> + * -ENXIO if PLPKS is not supported
> + * -EIO if PLPKS access is blocked due to the LPAR's state
> + * if an error occurred while processing the request
> + * -EINVAL if invalid authorization parameter
> + * if invalid object label parameter
> + * if invalid object label len parameter
> + * if invalid output data parameter
> + * if invalid output data len parameter
> + * -EPERM if access is denied
> + * -ENOENT if the requested object was not found
> + * -EFBIG if the requested object couldn't be
> + * stored in the buffer provided
> + * -EBUSY if unable to handle the request
> + *
> + * Returns: On success 0 is returned, a negative errno if not.
> + */
> int plpks_read_bootloader_var(struct plpks_var *var)
> {
> return plpks_read_var(PLPKS_BOOTLOADER_OWNER, var);
> }
>
> +/**
> + * plpks_populate_fdt(): Populates the FDT with the PLPKS password to prepare
> + * for kexec.
> + * @fdt: pointer to the device tree blob
> + *
> + * Upon confirming the existence of the chosen node, invoke fdt_setprop to
> + * populate the device tree with the PLPKS password in order to prepare for
> + * kexec.
> + *
> + * Returns: On success 0 is returned, a negative value if not.
> + */
> int plpks_populate_fdt(void *fdt)
> {
> int chosen_offset = fdt_path_offset(fdt, "/chosen");
> @@ -647,14 +950,19 @@ int plpks_populate_fdt(void *fdt)
> return fdt_setprop(fdt, chosen_offset, "ibm,plpks-pw", ospassword, ospasswordlength);
> }
>
> -// Once a password is registered with the hypervisor it cannot be cleared without
> -// rebooting the LPAR, so to keep using the PLPKS across kexec boots we need to
> -// recover the previous password from the FDT.
> -//
> -// There are a few challenges here. We don't want the password to be visible to
> -// users, so we need to clear it from the FDT. This has to be done in early boot.
> -// Clearing it from the FDT would make the FDT's checksum invalid, so we have to
> -// manually cause the checksum to be recalculated.
> +/**
> + * plpks_early_init_devtree() - Retrieves and clears the PLPKS password from the
> + * DT in early init.
> + *
> + * Once a password is registered with the hypervisor it cannot be cleared
> + * without rebooting the LPAR, so to keep using the PLPKS across kexec boots we
> + * need to recover the previous password from the FDT.
> + *
> + * There are a few challenges here. We don't want the password to be visible to
> + * users, so we need to clear it from the FDT. This has to be done in early
> + * boot. Clearing it from the FDT would make the FDT's checksum invalid, so we
> + * have to manually cause the checksum to be recalculated.
> + */
> void __init plpks_early_init_devtree(void)
> {
> void *fdt = initial_boot_params;
^ permalink raw reply
* Re: [PATCH] ima: Detect changes to files via kstat changes rather than i_version
From: Jeff Layton @ 2026-01-15 19:45 UTC (permalink / raw)
To: Frederick Lawler, Roberto Sassu
Cc: Mimi Zohar, Roberto Sassu, Dmitry Kasatkin, Eric Snowberg,
Paul Moore, James Morris, Serge E. Hallyn, Darrick J. Wong,
Christian Brauner, Josef Bacik, linux-kernel, linux-integrity,
linux-security-module, kernel-team
In-Reply-To: <aWktm4vdzxF0b596@CMGLRV3>
On Thu, 2026-01-15 at 12:10 -0600, Frederick Lawler wrote:
> On Thu, Jan 15, 2026 at 12:46:37PM +0100, Roberto Sassu wrote:
> > On Mon, 2026-01-12 at 16:32 -0600, Frederick Lawler wrote:
> > > Commit 1cf7e834a6fb ("xfs: switch to multigrain timestamps")
> > > introduced a means to track change detection for an inode
> > > via ctime updates, opposed to setting kstat.change_cookie when
> > > calling into xfs_vn_getattr().
> > >
> > > This introduced a regression because IMA caches kstat.change_cookie
> > > to compare against an inode's i_version directly in
> > > integrity_inode_attrs_changed(), and thus could be out of date
> > > depending on how file systems increment i_version.
> > >
> > > To address this, require integrity_inode_attrs_changed() to query
> > > vfs_getattr_nosec() to compare the cached version against
> > > kstat.change_cookie directly. This ensures that when updates occur,
> > > we're accessing the same changed inode version on changes, and fallback
> > > to compare against an artificial version generated from kstat.ctime
> > > via integrity_ctime_guard() when there's no detected change
> > > to the kstat.change_cookie.
> > >
> > > This ensures that in the absence of i_version support for file systems,
> > > and in the absence of a kstat.change_cookie update, we ultimately have a
> > > unique-enough version to compare against.
> > >
> > > The exact implementation for integrity_ctime_guard() is to ensure that
> > > if tv_sec or tv_nsec are zero, there's some value to store back into
> > > struct integrity_inode_attributes.version. This also avoids the need to
> > > add additional storage and comparisons.
> > >
> > > Lastly, because EVM still relies on querying and caching a backing inode's
> > > i_version, the integrity_inode_attrs_changed() falls back to the
> > > original inode.i_version != cached comparison. This maintains the
> > > invariant that a re-evaluation in unknown change detection circumstances
> > > is required.
> > >
> > > Link: https://lore.kernel.org/all/aTspr4_h9IU4EyrR@CMGLRV3
> > > Suggested-by: Jeff Layton <jlayton@kernel.org>
> > > Signed-off-by: Frederick Lawler <fred@cloudflare.com>
> > > ---
> > > We uncovered a case in kernels >= 6.13 where XFS is no longer updating
> > > struct kstat.change_cookie on i_op getattr() access calls. Instead, XFS is
> > > using multigrain ctime (as well as other file systems) for
> > > change detection in commit 1cf7e834a6fb ("xfs: switch to
> > > multigrain timestamps").
> > >
> > > Because file systems may implement i_version as they see fit, IMA
> > > caching may be behind as well as file systems that don't support/export
> > > i_version. Thus we're proposing to compare against the kstat.change_cookie
> > > directly to the cached version, and fall back to a ctime guard when
> > > that's not updated.
> > >
> > > EVM is largely left alone since there's no trivial way to query a file
> > > directly in the LSM call paths to obtain kstat.change_cookie &
> > > kstat.ctime to cache. Thus retains accessing i_version directly.
> > >
> > > Regression tests will be added to the Linux Test Project instead of
> > > selftest to help catch future file system changes that may impact
> > > future evaluation of IMA.
> > >
> > > I'd like this to be backported to at least 6.18 if possible.
> > >
> > > Below is a simplified test that demonstrates the issue:
> > >
> > > _fragment.config_
> > > CONFIG_XFS_FS=y
> > > CONFIG_OVERLAY_FS=y
> > > CONFIG_IMA=y
> > > CONFIG_IMA_WRITE_POLICY=y
> > > CONFIG_IMA_READ_POLICY=y
> > >
> > > _./test.sh_
> > >
> > > IMA_POLICY="/sys/kernel/security/ima/policy"
> > > TEST_BIN="/bin/date"
> > > MNT_BASE="/tmp/ima_test_root"
> > >
> > > mkdir -p "$MNT_BASE"
> > > mount -t tmpfs tmpfs "$MNT_BASE"
> > > mkdir -p "$MNT_BASE"/{xfs_disk,upper,work,ovl}
> > >
> > > dd if=/dev/zero of="$MNT_BASE/xfs.img" bs=1M count=300
> > > mkfs.xfs -q "$MNT_BASE/xfs.img"
> > > mount "$MNT_BASE/xfs.img" "$MNT_BASE/xfs_disk"
> > > cp "$TEST_BIN" "$MNT_BASE/xfs_disk/test_prog"
> > >
> > > mount -t overlay overlay -o \
> > > "lowerdir=$MNT_BASE/xfs_disk,upperdir=$MNT_BASE/upper,workdir=$MNT_BASE/work" \
> > > "$MNT_BASE/ovl"
> > >
> > > echo "audit func=BPRM_CHECK uid=$(id -u nobody)" > "$IMA_POLICY"
> > >
> > > target_prog="$MNT_BASE/ovl/test_prog"
> > > setpriv --reuid nobody "$target_prog"
> > > setpriv --reuid nobody "$target_prog"
> > > setpriv --reuid nobody "$target_prog"
> > >
> > > audit_count=$(dmesg | grep -c "file=\"$target_prog\"")
> > >
> > > if [[ "$audit_count" -eq 1 ]]; then
> > > echo "PASS: Found exactly 1 audit event."
> > > else
> > > echo "FAIL: Expected 1 audit event, but found $audit_count."
> > > exit 1
> > > fi
> > > ---
> > > Changes since RFC:
> > > - Remove calls to I_IS_VERSION()
> > > - Function documentation/comments
> > > - Abide IMA/EVM change detection fallback invariants
> > > - Combined ctime guard into version for attributes struct
> > > - Link to RFC: https://lore.kernel.org/r/20251229-xfs-ima-fixup-v1-1-6a717c939f7c@cloudflare.com
> > > ---
> > > include/linux/integrity.h | 42 +++++++++++++++++++++++++++++++++++----
> > > security/integrity/evm/evm_main.c | 5 ++---
> > > security/integrity/ima/ima_api.c | 11 +++++++---
> > > security/integrity/ima/ima_main.c | 15 +++++---------
> > > 4 files changed, 53 insertions(+), 20 deletions(-)
> > >
> > > diff --git a/include/linux/integrity.h b/include/linux/integrity.h
> > > index f5842372359be5341b6870a43b92e695e8fc78af..5eca8aa2769f9238c68bb40885ecc46910524f11 100644
> > > --- a/include/linux/integrity.h
> > > +++ b/include/linux/integrity.h
> > > @@ -9,6 +9,7 @@
> > >
> > > #include <linux/fs.h>
> > > #include <linux/iversion.h>
> > > +#include <linux/kernel.h>
> > >
> > > enum integrity_status {
> > > INTEGRITY_PASS = 0,
> > > @@ -36,6 +37,14 @@ struct integrity_inode_attributes {
> > > dev_t dev;
> > > };
> > >
> > > +/*
> > > + * Wrapper to generate an artificial version for a file.
> > > + */
> > > +static inline u64 integrity_ctime_guard(struct kstat stat)
> > > +{
> > > + return stat.ctime.tv_sec ^ stat.ctime.tv_nsec;
> >
> > Unfortunately, we cannot take the risk of a collision. Better use all
> > or a packed version.
>
> Sounds good.
>
> >
> > > +}
> > > +
> > > /*
> > > * On stacked filesystems the i_version alone is not enough to detect file data
> > > * or metadata change. Additional metadata is required.
> > > @@ -51,14 +60,39 @@ integrity_inode_attrs_store(struct integrity_inode_attributes *attrs,
> > >
> > > /*
> > > * On stacked filesystems detect whether the inode or its content has changed.
> > > + *
> > > + * Must be called in process context.
> > > */
> > > static inline bool
> > > integrity_inode_attrs_changed(const struct integrity_inode_attributes *attrs,
> > > - const struct inode *inode)
> > > + struct file *file, struct inode *inode)
> > > {
> > > - return (inode->i_sb->s_dev != attrs->dev ||
> > > - inode->i_ino != attrs->ino ||
> > > - !inode_eq_iversion(inode, attrs->version));
> > > + struct kstat stat;
> > > +
> > > + might_sleep();
> > > +
> > > + if (inode->i_sb->s_dev != attrs->dev || inode->i_ino != attrs->ino)
> > > + return true;
> > > +
> > > + /*
> > > + * EVM currently relies on backing inode i_version. While IS_I_VERSION
> > > + * is not a good indicator of i_version support, this still retains
> > > + * the logic such that a re-evaluation should still occur for EVM, and
> > > + * only for IMA if vfs_getattr_nosec() fails.
> > > + */
> > > + if (!file || vfs_getattr_nosec(&file->f_path, &stat,
> > > + STATX_CHANGE_COOKIE | STATX_CTIME,
> > > + AT_STATX_SYNC_AS_STAT))
> > > + return !IS_I_VERSION(inode) ||
> > > + !inode_eq_iversion(inode, attrs->version);
> > > +
> > > + if (stat.result_mask & STATX_CHANGE_COOKIE)
> > > + return stat.change_cookie != attrs->version;
> > > +
> > > + if (stat.result_mask & STATX_CTIME)
> > > + return integrity_ctime_guard(stat) != attrs->version;
> >
> > Yes, switching to the new field I guess it works, but I'm wondering if
> > we could have more uniformity across the filesystems, otherwise one has
> > to use one source for filesystem X, another source for filesystem Y.
>
> Agreed. But I'm under the impression from casual searching, that most
> file systems are likely to support ctime, than setting the change cookie
> with an i_version or even having/updating i_version consistently.
>
> Is there someone we could CC in here to get another opinion?
>
Most filesystems properly support ctime. The problem is that only some
of them (so far) have multigrain ctime support, so on many filesystems
the ctime has quite coarse granularity (~1 jiffy or so).
Multigrain timestamps fix that. They guarantee that if you do
stat()+write()+stat() that the two stats will get different c/mtime
values. This is why we've disabled reporting the i_version via -
>getattr() in XFS. The ctime now provides better semantics for the
change attribute on XFS.
Most filesystems that support i_version now support multigrain
timestamps, so I sort of expect that in the future, we may end up
removing the i_version from some of these filesystems and just
manufacture it from the ctime.
We do need to convert more in-kernel filesystems to use multigrain
timestamps first though.
> >
> > Thanks
> >
> > Roberto
> >
> > > +
> > > + return true;
> > > }
> > >
> > >
> > > diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
> > > index 73d500a375cb37a54f295b0e1e93fd6e5d9ecddc..6a4e0e246005246d5700b1db590c1759242b9cb6 100644
> > > --- a/security/integrity/evm/evm_main.c
> > > +++ b/security/integrity/evm/evm_main.c
> > > @@ -752,9 +752,8 @@ bool evm_metadata_changed(struct inode *inode, struct inode *metadata_inode)
> > > bool ret = false;
> > >
> > > if (iint) {
> > > - ret = (!IS_I_VERSION(metadata_inode) ||
> > > - integrity_inode_attrs_changed(&iint->metadata_inode,
> > > - metadata_inode));
> > > + ret = integrity_inode_attrs_changed(&iint->metadata_inode,
> > > + NULL, metadata_inode);
> > > if (ret)
> > > iint->evm_status = INTEGRITY_UNKNOWN;
> > > }
> > > diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
> > > index c35ea613c9f8d404ba4886e3b736c3bab29d1668..8096986f3689781d3cdf6595f330033782f9cc45 100644
> > > --- a/security/integrity/ima/ima_api.c
> > > +++ b/security/integrity/ima/ima_api.c
> > > @@ -272,10 +272,15 @@ int ima_collect_measurement(struct ima_iint_cache *iint, struct file *file,
> > > * to an initial measurement/appraisal/audit, but was modified to
> > > * assume the file changed.
> > > */
> > > - result = vfs_getattr_nosec(&file->f_path, &stat, STATX_CHANGE_COOKIE,
> > > + result = vfs_getattr_nosec(&file->f_path, &stat,
> > > + STATX_CHANGE_COOKIE | STATX_CTIME,
> > > AT_STATX_SYNC_AS_STAT);
> > > - if (!result && (stat.result_mask & STATX_CHANGE_COOKIE))
> > > - i_version = stat.change_cookie;
> > > + if (!result) {
> > > + if (stat.result_mask & STATX_CHANGE_COOKIE)
> > > + i_version = stat.change_cookie;
> > > + else if (stat.result_mask & STATX_CTIME)
> > > + i_version = integrity_ctime_guard(stat);
> > > + }
> > > hash.hdr.algo = algo;
> > > hash.hdr.length = hash_digest_size[algo];
> > >
> > > diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
> > > index 5770cf691912aa912fc65280c59f5baac35dd725..3a4c32e254f925bba85cb91b63744ac142b3b049 100644
> > > --- a/security/integrity/ima/ima_main.c
> > > +++ b/security/integrity/ima/ima_main.c
> > > @@ -22,6 +22,7 @@
> > > #include <linux/mount.h>
> > > #include <linux/mman.h>
> > > #include <linux/slab.h>
> > > +#include <linux/stat.h>
> > > #include <linux/xattr.h>
> > > #include <linux/ima.h>
> > > #include <linux/fs.h>
> > > @@ -191,18 +192,13 @@ static void ima_check_last_writer(struct ima_iint_cache *iint,
> > >
> > > mutex_lock(&iint->mutex);
> > > if (atomic_read(&inode->i_writecount) == 1) {
> > > - struct kstat stat;
> > > -
> > > clear_bit(IMA_EMITTED_OPENWRITERS, &iint->atomic_flags);
> > >
> > > update = test_and_clear_bit(IMA_UPDATE_XATTR,
> > > &iint->atomic_flags);
> > > if ((iint->flags & IMA_NEW_FILE) ||
> > > - vfs_getattr_nosec(&file->f_path, &stat,
> > > - STATX_CHANGE_COOKIE,
> > > - AT_STATX_SYNC_AS_STAT) ||
> > > - !(stat.result_mask & STATX_CHANGE_COOKIE) ||
> > > - stat.change_cookie != iint->real_inode.version) {
> > > + integrity_inode_attrs_changed(&iint->real_inode, file,
> > > + inode)) {
> > > iint->flags &= ~(IMA_DONE_MASK | IMA_NEW_FILE);
> > > iint->measured_pcrs = 0;
> > > if (update)
> > > @@ -328,9 +324,8 @@ static int process_measurement(struct file *file, const struct cred *cred,
> > > real_inode = d_real_inode(file_dentry(file));
> > > if (real_inode != inode &&
> > > (action & IMA_DO_MASK) && (iint->flags & IMA_DONE_MASK)) {
> > > - if (!IS_I_VERSION(real_inode) ||
> > > - integrity_inode_attrs_changed(&iint->real_inode,
> > > - real_inode)) {
> > > + if (integrity_inode_attrs_changed(&iint->real_inode,
> > > + file, real_inode)) {
> > > iint->flags &= ~IMA_DONE_MASK;
> > > iint->measured_pcrs = 0;
> > > }
> > >
> > > ---
> > > base-commit: 8f0b4cce4481fb22653697cced8d0d04027cb1e8
> > > change-id: 20251212-xfs-ima-fixup-931780a62c2c
> > >
> > > Best regards,
> >
--
Jeff Layton <jlayton@kernel.org>
^ permalink raw reply
* Re: Improved guidance for LSM submissions.
From: Casey Schaufler @ 2026-01-15 18:24 UTC (permalink / raw)
To: Dr. Greg; +Cc: Paul Moore, linux-security-module, Casey Schaufler
In-Reply-To: <20260115155555.GA18668@wind.enjellic.com>
On 1/15/2026 7:55 AM, Dr. Greg wrote:
> On Fri, Jan 09, 2026 at 11:58:39AM -0800, Casey Schaufler wrote:
>
>> On 1/9/2026 10:51 AM, Paul Moore wrote:
>>> On Thu, Jan 8, 2026 at 11:08???AM Dr. Greg <greg@enjellic.com> wrote:
>>>> What is not clear in these guidelines is how a virgin LSM should be
>>>> structured for initial submission. Moving forward, we believe the
>>>> community would benefit from having clear guidance on this issue.
>>>>
>>>> It would be helpful if the guidance covers a submission of 10-15 KLOC
>>>> of code and 5-8 compilation units, which seems to cover the average
>>>> range of sizes for LSM's that have significant coverage of the event
>>>> handlers/hooks.
>> Good day Greg, I hope you are well.
> Hi Casey, thank you, I hope your week has been going well.
>
>> If you would review the comments I made in 2023 regarding how to
>> make your submission reviewable you might find that you don't need
>> a "formal" statement of policy. Remember that you are not submitting
>> your code to a chartered organization, but to a collection of system
>> developers who are enthusiastic about security. Many are overworked,
>> some are hobbyists, but all treat their time as valuable. If you can't
>> heed the advice you've already been given, there's no incentive for
>> anyone to spend their limited resources to provide it in another
>> format.
> As Paul noted in the following:
>
> https://lore.kernel.org/linux-security-module/20230608191304.253977-2-paul@paul-moore.com/
>
> Microsoft employs him to maintain the Linux security sub-system, and
> related infrastructure, secondary to Microsoft's concern over the long
> term health of the Linux community.
>
> Given that, it is disappointing that Microsoft isn't providing
> sufficient resources to enable him to provide guidance to the
> community they desire to support,
In January of 2019 (oh so long ago) I gave a talk at Linux Conference Australia
about the amazing popularity of Linux kernel security. At the end of the talk,
someone asked how long I expected it to last. Without hesitation, I replied
"18 months". Operating system security has never been on a major vendor's
priority list for more than about 2 years. Even the "C2 in '92" era was of
seriously limited duration. *We don't whinge about the limits of Microsoft's
support. We revel in it's continuation.*
https://www.youtube.com/watch?v=GFGJ3e3oj2c
> regardless of that, we now have
> 'official' guidance as to the requirements for submitting a virgin
> body of LSM code:
>
> https://docs.kernel.org/process/submitting-patches.html
>
> Paul notes the 'separate your changes' section as his only specific
> recommendation for the submission of new code, that section recommends
> that each patch represent a logical change.
>
> A careful read of the document suggests that our submission did not
> violate what is the 'official' guidance for virgin code submissions.
I'm sorry that you have come to that conclusion. You're wrong.
> Absent the utility of specific guidance, Paul recommends reviewing the
> mailing list for community norms and expectations, so we did.
>
> The following URL provides a full reference to Microsoft's submission
> of their IPE LSM:
>
> https://lwn.net/Articles/969749/
>
> Their strategy mirrored ours with respect to submitting each major
> functional unit as a single patch, a strategy that was sufficient for
> the review of Microsoft's submission, 16 separate times.
>
> You take exception with a single include file containing structures
> referenced by every compilation unit, indicating that a structure
> should be introduced with the code that uses it.
Indeed. You have identified a problem with your submission. You are
encouraged to fix your submission.
> For the good of the community, it would be helpful to have
> clarification as to how you do that without including all of the
> compilation units in a single patch, which would clearly be rejected
> as an inappropriate submission.
Sure it would. Sometimes you have to work it out for yourself.
I have work that's been in flight for 15 years now, not because it's
a bad idea, but because staging it in an acceptable way isn't easy
or obvious.
> Best wishes for a productive New Year.
And the same to you.
>
> As always,
> Dr. Greg
>
> The Quixote Project - Flailing at the Travails of Cybersecurity
> https://github.com/Quixote-Project
>
^ permalink raw reply
* Re: [PATCH 1/3] integrity: Make arch_ima_get_secureboot integrity-wide
From: Mimi Zohar @ 2026-01-15 18:14 UTC (permalink / raw)
To: Coiby Xu, linux-integrity
Cc: Heiko Carstens, Roberto Sassu, Catalin Marinas, Will Deacon,
Madhavan Srinivasan, Michael Ellerman, Nicholas Piggin,
Christophe Leroy (CS GROUP), Vasily Gorbik, Alexander Gordeev,
Christian Borntraeger, Sven Schnelle, Thomas Gleixner,
Ingo Molnar, Borislav Petkov, Dave Hansen,
maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT), H. Peter Anvin,
Ard Biesheuvel, Roberto Sassu, Dmitry Kasatkin, Eric Snowberg,
Paul Moore, James Morris, Serge E. Hallyn, Jarkko Sakkinen,
moderated list:ARM64 PORT (AARCH64 ARCHITECTURE), open list,
open list:LINUX FOR POWERPC (32-BIT AND 64-BIT),
open list:S390 ARCHITECTURE,
open list:EXTENSIBLE FIRMWARE INTERFACE (EFI),
open list:SECURITY SUBSYSTEM, open list:KEYS/KEYRINGS_INTEGRITY
In-Reply-To: <20260115004328.194142-2-coxu@redhat.com>
On Thu, 2026-01-15 at 08:43 +0800, Coiby Xu wrote:
> EVM and other LSMs need the ability to query the secure boot status of
> the system, without directly calling the IMA arch_ima_get_secureboot
> function. Refactor the secure boot status check into a general,
> integrity-wide function named arch_integrity_get_secureboot.
>
> Define a new Kconfig option CONFIG_INTEGRITY_SECURE_BOOT, which is
> automatically configured by the supported architectures. The existing
> IMA_SECURE_AND_OR_TRUSTED_BOOT Kconfig loads the architecture specific
> IMA policy based on the refactored secure boot status code.
>
> Reported-and-suggested-by: Mimi Zohar <zohar@linux.ibm.com>
> Suggested-by: Roberto Sassu <roberto.sassu@huaweicloud.com>
> Signed-off-by: Coiby Xu <coxu@redhat.com>
Thanks, Coiby!
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
^ permalink raw reply
* Re: [PATCH 2/3] evm: Don't enable fix mode when secure boot is enabled
From: Mimi Zohar @ 2026-01-15 18:15 UTC (permalink / raw)
To: Coiby Xu, linux-integrity
Cc: Heiko Carstens, Roberto Sassu, Roberto Sassu, Dmitry Kasatkin,
Eric Snowberg, Paul Moore, James Morris, Serge E. Hallyn,
open list:SECURITY SUBSYSTEM, open list
In-Reply-To: <20260115004328.194142-3-coxu@redhat.com>
On Thu, 2026-01-15 at 08:43 +0800, Coiby Xu wrote:
> Similar to IMA fix mode, forbid EVM fix mode when secure boot is
> enabled.
>
> Reported-and-suggested-by: Mimi Zohar <zohar@linux.ibm.com>
> Suggested-by: Roberto Sassu <roberto.sassu@huaweicloud.com>
> Signed-off-by: Coiby Xu <coxu@redhat.com>
Thanks, Coiby!
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
^ permalink raw reply
* Re: [PATCH] ima: Detect changes to files via kstat changes rather than i_version
From: Frederick Lawler @ 2026-01-15 18:10 UTC (permalink / raw)
To: Roberto Sassu
Cc: Mimi Zohar, Roberto Sassu, Dmitry Kasatkin, Eric Snowberg,
Paul Moore, James Morris, Serge E. Hallyn, Darrick J. Wong,
Christian Brauner, Josef Bacik, Jeff Layton, linux-kernel,
linux-integrity, linux-security-module, kernel-team
In-Reply-To: <c825efc60cace922b45d0824f11cdaf44be9c0d3.camel@huaweicloud.com>
On Thu, Jan 15, 2026 at 12:46:37PM +0100, Roberto Sassu wrote:
> On Mon, 2026-01-12 at 16:32 -0600, Frederick Lawler wrote:
> > Commit 1cf7e834a6fb ("xfs: switch to multigrain timestamps")
> > introduced a means to track change detection for an inode
> > via ctime updates, opposed to setting kstat.change_cookie when
> > calling into xfs_vn_getattr().
> >
> > This introduced a regression because IMA caches kstat.change_cookie
> > to compare against an inode's i_version directly in
> > integrity_inode_attrs_changed(), and thus could be out of date
> > depending on how file systems increment i_version.
> >
> > To address this, require integrity_inode_attrs_changed() to query
> > vfs_getattr_nosec() to compare the cached version against
> > kstat.change_cookie directly. This ensures that when updates occur,
> > we're accessing the same changed inode version on changes, and fallback
> > to compare against an artificial version generated from kstat.ctime
> > via integrity_ctime_guard() when there's no detected change
> > to the kstat.change_cookie.
> >
> > This ensures that in the absence of i_version support for file systems,
> > and in the absence of a kstat.change_cookie update, we ultimately have a
> > unique-enough version to compare against.
> >
> > The exact implementation for integrity_ctime_guard() is to ensure that
> > if tv_sec or tv_nsec are zero, there's some value to store back into
> > struct integrity_inode_attributes.version. This also avoids the need to
> > add additional storage and comparisons.
> >
> > Lastly, because EVM still relies on querying and caching a backing inode's
> > i_version, the integrity_inode_attrs_changed() falls back to the
> > original inode.i_version != cached comparison. This maintains the
> > invariant that a re-evaluation in unknown change detection circumstances
> > is required.
> >
> > Link: https://lore.kernel.org/all/aTspr4_h9IU4EyrR@CMGLRV3
> > Suggested-by: Jeff Layton <jlayton@kernel.org>
> > Signed-off-by: Frederick Lawler <fred@cloudflare.com>
> > ---
> > We uncovered a case in kernels >= 6.13 where XFS is no longer updating
> > struct kstat.change_cookie on i_op getattr() access calls. Instead, XFS is
> > using multigrain ctime (as well as other file systems) for
> > change detection in commit 1cf7e834a6fb ("xfs: switch to
> > multigrain timestamps").
> >
> > Because file systems may implement i_version as they see fit, IMA
> > caching may be behind as well as file systems that don't support/export
> > i_version. Thus we're proposing to compare against the kstat.change_cookie
> > directly to the cached version, and fall back to a ctime guard when
> > that's not updated.
> >
> > EVM is largely left alone since there's no trivial way to query a file
> > directly in the LSM call paths to obtain kstat.change_cookie &
> > kstat.ctime to cache. Thus retains accessing i_version directly.
> >
> > Regression tests will be added to the Linux Test Project instead of
> > selftest to help catch future file system changes that may impact
> > future evaluation of IMA.
> >
> > I'd like this to be backported to at least 6.18 if possible.
> >
> > Below is a simplified test that demonstrates the issue:
> >
> > _fragment.config_
> > CONFIG_XFS_FS=y
> > CONFIG_OVERLAY_FS=y
> > CONFIG_IMA=y
> > CONFIG_IMA_WRITE_POLICY=y
> > CONFIG_IMA_READ_POLICY=y
> >
> > _./test.sh_
> >
> > IMA_POLICY="/sys/kernel/security/ima/policy"
> > TEST_BIN="/bin/date"
> > MNT_BASE="/tmp/ima_test_root"
> >
> > mkdir -p "$MNT_BASE"
> > mount -t tmpfs tmpfs "$MNT_BASE"
> > mkdir -p "$MNT_BASE"/{xfs_disk,upper,work,ovl}
> >
> > dd if=/dev/zero of="$MNT_BASE/xfs.img" bs=1M count=300
> > mkfs.xfs -q "$MNT_BASE/xfs.img"
> > mount "$MNT_BASE/xfs.img" "$MNT_BASE/xfs_disk"
> > cp "$TEST_BIN" "$MNT_BASE/xfs_disk/test_prog"
> >
> > mount -t overlay overlay -o \
> > "lowerdir=$MNT_BASE/xfs_disk,upperdir=$MNT_BASE/upper,workdir=$MNT_BASE/work" \
> > "$MNT_BASE/ovl"
> >
> > echo "audit func=BPRM_CHECK uid=$(id -u nobody)" > "$IMA_POLICY"
> >
> > target_prog="$MNT_BASE/ovl/test_prog"
> > setpriv --reuid nobody "$target_prog"
> > setpriv --reuid nobody "$target_prog"
> > setpriv --reuid nobody "$target_prog"
> >
> > audit_count=$(dmesg | grep -c "file=\"$target_prog\"")
> >
> > if [[ "$audit_count" -eq 1 ]]; then
> > echo "PASS: Found exactly 1 audit event."
> > else
> > echo "FAIL: Expected 1 audit event, but found $audit_count."
> > exit 1
> > fi
> > ---
> > Changes since RFC:
> > - Remove calls to I_IS_VERSION()
> > - Function documentation/comments
> > - Abide IMA/EVM change detection fallback invariants
> > - Combined ctime guard into version for attributes struct
> > - Link to RFC: https://lore.kernel.org/r/20251229-xfs-ima-fixup-v1-1-6a717c939f7c@cloudflare.com
> > ---
> > include/linux/integrity.h | 42 +++++++++++++++++++++++++++++++++++----
> > security/integrity/evm/evm_main.c | 5 ++---
> > security/integrity/ima/ima_api.c | 11 +++++++---
> > security/integrity/ima/ima_main.c | 15 +++++---------
> > 4 files changed, 53 insertions(+), 20 deletions(-)
> >
> > diff --git a/include/linux/integrity.h b/include/linux/integrity.h
> > index f5842372359be5341b6870a43b92e695e8fc78af..5eca8aa2769f9238c68bb40885ecc46910524f11 100644
> > --- a/include/linux/integrity.h
> > +++ b/include/linux/integrity.h
> > @@ -9,6 +9,7 @@
> >
> > #include <linux/fs.h>
> > #include <linux/iversion.h>
> > +#include <linux/kernel.h>
> >
> > enum integrity_status {
> > INTEGRITY_PASS = 0,
> > @@ -36,6 +37,14 @@ struct integrity_inode_attributes {
> > dev_t dev;
> > };
> >
> > +/*
> > + * Wrapper to generate an artificial version for a file.
> > + */
> > +static inline u64 integrity_ctime_guard(struct kstat stat)
> > +{
> > + return stat.ctime.tv_sec ^ stat.ctime.tv_nsec;
>
> Unfortunately, we cannot take the risk of a collision. Better use all
> or a packed version.
Sounds good.
>
> > +}
> > +
> > /*
> > * On stacked filesystems the i_version alone is not enough to detect file data
> > * or metadata change. Additional metadata is required.
> > @@ -51,14 +60,39 @@ integrity_inode_attrs_store(struct integrity_inode_attributes *attrs,
> >
> > /*
> > * On stacked filesystems detect whether the inode or its content has changed.
> > + *
> > + * Must be called in process context.
> > */
> > static inline bool
> > integrity_inode_attrs_changed(const struct integrity_inode_attributes *attrs,
> > - const struct inode *inode)
> > + struct file *file, struct inode *inode)
> > {
> > - return (inode->i_sb->s_dev != attrs->dev ||
> > - inode->i_ino != attrs->ino ||
> > - !inode_eq_iversion(inode, attrs->version));
> > + struct kstat stat;
> > +
> > + might_sleep();
> > +
> > + if (inode->i_sb->s_dev != attrs->dev || inode->i_ino != attrs->ino)
> > + return true;
> > +
> > + /*
> > + * EVM currently relies on backing inode i_version. While IS_I_VERSION
> > + * is not a good indicator of i_version support, this still retains
> > + * the logic such that a re-evaluation should still occur for EVM, and
> > + * only for IMA if vfs_getattr_nosec() fails.
> > + */
> > + if (!file || vfs_getattr_nosec(&file->f_path, &stat,
> > + STATX_CHANGE_COOKIE | STATX_CTIME,
> > + AT_STATX_SYNC_AS_STAT))
> > + return !IS_I_VERSION(inode) ||
> > + !inode_eq_iversion(inode, attrs->version);
> > +
> > + if (stat.result_mask & STATX_CHANGE_COOKIE)
> > + return stat.change_cookie != attrs->version;
> > +
> > + if (stat.result_mask & STATX_CTIME)
> > + return integrity_ctime_guard(stat) != attrs->version;
>
> Yes, switching to the new field I guess it works, but I'm wondering if
> we could have more uniformity across the filesystems, otherwise one has
> to use one source for filesystem X, another source for filesystem Y.
Agreed. But I'm under the impression from casual searching, that most
file systems are likely to support ctime, than setting the change cookie
with an i_version or even having/updating i_version consistently.
Is there someone we could CC in here to get another opinion?
>
> Thanks
>
> Roberto
>
> > +
> > + return true;
> > }
> >
> >
> > diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
> > index 73d500a375cb37a54f295b0e1e93fd6e5d9ecddc..6a4e0e246005246d5700b1db590c1759242b9cb6 100644
> > --- a/security/integrity/evm/evm_main.c
> > +++ b/security/integrity/evm/evm_main.c
> > @@ -752,9 +752,8 @@ bool evm_metadata_changed(struct inode *inode, struct inode *metadata_inode)
> > bool ret = false;
> >
> > if (iint) {
> > - ret = (!IS_I_VERSION(metadata_inode) ||
> > - integrity_inode_attrs_changed(&iint->metadata_inode,
> > - metadata_inode));
> > + ret = integrity_inode_attrs_changed(&iint->metadata_inode,
> > + NULL, metadata_inode);
> > if (ret)
> > iint->evm_status = INTEGRITY_UNKNOWN;
> > }
> > diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
> > index c35ea613c9f8d404ba4886e3b736c3bab29d1668..8096986f3689781d3cdf6595f330033782f9cc45 100644
> > --- a/security/integrity/ima/ima_api.c
> > +++ b/security/integrity/ima/ima_api.c
> > @@ -272,10 +272,15 @@ int ima_collect_measurement(struct ima_iint_cache *iint, struct file *file,
> > * to an initial measurement/appraisal/audit, but was modified to
> > * assume the file changed.
> > */
> > - result = vfs_getattr_nosec(&file->f_path, &stat, STATX_CHANGE_COOKIE,
> > + result = vfs_getattr_nosec(&file->f_path, &stat,
> > + STATX_CHANGE_COOKIE | STATX_CTIME,
> > AT_STATX_SYNC_AS_STAT);
> > - if (!result && (stat.result_mask & STATX_CHANGE_COOKIE))
> > - i_version = stat.change_cookie;
> > + if (!result) {
> > + if (stat.result_mask & STATX_CHANGE_COOKIE)
> > + i_version = stat.change_cookie;
> > + else if (stat.result_mask & STATX_CTIME)
> > + i_version = integrity_ctime_guard(stat);
> > + }
> > hash.hdr.algo = algo;
> > hash.hdr.length = hash_digest_size[algo];
> >
> > diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
> > index 5770cf691912aa912fc65280c59f5baac35dd725..3a4c32e254f925bba85cb91b63744ac142b3b049 100644
> > --- a/security/integrity/ima/ima_main.c
> > +++ b/security/integrity/ima/ima_main.c
> > @@ -22,6 +22,7 @@
> > #include <linux/mount.h>
> > #include <linux/mman.h>
> > #include <linux/slab.h>
> > +#include <linux/stat.h>
> > #include <linux/xattr.h>
> > #include <linux/ima.h>
> > #include <linux/fs.h>
> > @@ -191,18 +192,13 @@ static void ima_check_last_writer(struct ima_iint_cache *iint,
> >
> > mutex_lock(&iint->mutex);
> > if (atomic_read(&inode->i_writecount) == 1) {
> > - struct kstat stat;
> > -
> > clear_bit(IMA_EMITTED_OPENWRITERS, &iint->atomic_flags);
> >
> > update = test_and_clear_bit(IMA_UPDATE_XATTR,
> > &iint->atomic_flags);
> > if ((iint->flags & IMA_NEW_FILE) ||
> > - vfs_getattr_nosec(&file->f_path, &stat,
> > - STATX_CHANGE_COOKIE,
> > - AT_STATX_SYNC_AS_STAT) ||
> > - !(stat.result_mask & STATX_CHANGE_COOKIE) ||
> > - stat.change_cookie != iint->real_inode.version) {
> > + integrity_inode_attrs_changed(&iint->real_inode, file,
> > + inode)) {
> > iint->flags &= ~(IMA_DONE_MASK | IMA_NEW_FILE);
> > iint->measured_pcrs = 0;
> > if (update)
> > @@ -328,9 +324,8 @@ static int process_measurement(struct file *file, const struct cred *cred,
> > real_inode = d_real_inode(file_dentry(file));
> > if (real_inode != inode &&
> > (action & IMA_DO_MASK) && (iint->flags & IMA_DONE_MASK)) {
> > - if (!IS_I_VERSION(real_inode) ||
> > - integrity_inode_attrs_changed(&iint->real_inode,
> > - real_inode)) {
> > + if (integrity_inode_attrs_changed(&iint->real_inode,
> > + file, real_inode)) {
> > iint->flags &= ~IMA_DONE_MASK;
> > iint->measured_pcrs = 0;
> > }
> >
> > ---
> > base-commit: 8f0b4cce4481fb22653697cced8d0d04027cb1e8
> > change-id: 20251212-xfs-ima-fixup-931780a62c2c
> >
> > Best regards,
>
^ permalink raw reply
* Re: Improved guidance for LSM submissions.
From: Paul Moore @ 2026-01-15 17:49 UTC (permalink / raw)
To: Dr. Greg; +Cc: Casey Schaufler, linux-security-module
In-Reply-To: <20260115155555.GA18668@wind.enjellic.com>
On Thu, Jan 15, 2026 at 10:56 AM Dr. Greg <greg@enjellic.com> wrote:
> On Fri, Jan 09, 2026 at 11:58:39AM -0800, Casey Schaufler wrote:
> > On 1/9/2026 10:51 AM, Paul Moore wrote:
> > > On Thu, Jan 8, 2026 at 11:08???AM Dr. Greg <greg@enjellic.com> wrote:
> > >> What is not clear in these guidelines is how a virgin LSM should be
> > >> structured for initial submission. Moving forward, we believe the
> > >> community would benefit from having clear guidance on this issue.
> > >>
> > >> It would be helpful if the guidance covers a submission of 10-15 KLOC
> > >> of code and 5-8 compilation units, which seems to cover the average
> > >> range of sizes for LSM's that have significant coverage of the event
> > >> handlers/hooks.
...
> > If you would review the comments I made in 2023 regarding how to
> > make your submission reviewable you might find that you don't need
> > a "formal" statement of policy. Remember that you are not submitting
> > your code to a chartered organization, but to a collection of system
> > developers who are enthusiastic about security. Many are overworked,
> > some are hobbyists, but all treat their time as valuable. If you can't
> > heed the advice you've already been given, there's no incentive for
> > anyone to spend their limited resources to provide it in another
> > format.
>
> As Paul noted in the following:
>
> https://lore.kernel.org/linux-security-module/20230608191304.253977-2-paul@paul-moore.com/
>
> Microsoft employs him to maintain the Linux security sub-system, and
> related infrastructure, secondary to Microsoft's concern over the long
> term health of the Linux community ...
You've brought this up before, which I thought was a bit odd, but I
largely skipped over it because I thought it might simply be you
working your way through learning how the upstream kernel community
works. We've all been there at one time or another, and we all learn
differently, so no harm in that. However, you've chosen to bring this
up again, which strikes me as more than just an oddity, but in hopes
that your email is due to an honest lack of understanding, let me try
to provide some background.
I don't have concrete numbers to provide you, but the majority of the
substantial Linux kernel subsystems are maintained by individuals that
are employed, at least in part, to support the upstream Linux kernel.
Personally, I've been responsible for the upkeep of at least one
upstream kernel subsystem for over (checks notes ...) 18 years,
spanning a number of companies with varying levels of employer
support. Considering the number of people that rely on the subsystems
I maintain, and the trust placed in me by the community, I take my
upstream responsibilities very seriously; I've pushed back against
employers when I've felt their wants would have been detrimental
upstream, and I've left employers when my job duties have become
incompatible with my upstream responsibilities.
I obviously don't want to speak for the other kernel maintainers, but
I believe you will hear similar stories from many others, if not all.
I will say that in my experience the different individual LSM
maintainers have demonstrated the same level of stewardship and
concern for upstream that I've tried to model over the course of my
career. In my opinion we have a good community here, and our failings
are much more likely due to human time limits than any malice or
intentional constraints.
> Given that, it is disappointing that Microsoft isn't providing
> sufficient resources to enable him to provide guidance to the
> community they desire to support ...
Continuing what I said above, there is no reason to disparage my
current employer, I can assure you my limits are entirely due to how
much time I can spend in front of a computer dealing with difficult
problems, both technical and social, before I burn out for the day.
Of course you are free to make whatever comments you like, but if you
want me to take you seriously, you should give some more thoughtful
consideration before speaking incorrectly about matters you know
little to nothing about (e.g. my relationship with my employer, my
work/life balance, etc.).
Deciding how to prioritize work is a difficult thing, and subject to
revision over the course of a month, week, or even day. Like many of
us, there are a number of considerations that go into prioritization,
far too many to describe them all here, but one of the criteria is
simply an understanding of how many people will benefit from the work.
While an exhaustive document describing how to submit new LSMs would
surely have value, we've seen a number of LSMs submitted, and merged,
over the years that have been able to do so with the guidance we have
now, if not less. With that in mind, at this point in time I'm
choosing to focus my efforts on other, more impactful tasks.
> ... regardless of that, we now have
> 'official' guidance as to the requirements for submitting a virgin
> body of LSM code:
>
> https://docs.kernel.org/process/submitting-patches.html
I would encourage a more careful reading of my comments before
repeating. I "suggested" the document above, I did not say it was
"official guidance":
"I would suggest looking at the existing Linux kernel documentation
on submitting patches, a link is provided below."
(copied from my first reply in this thread)
As Casey pointed out, you've received quite a bit of feedback on your
prior LSM submissions, I would suggest using those comments as a
learning tool to help guide any future submissions. Just as with
other aspects of life, there are no guarantees here, try to learn from
your experiences and move forward.
Another bit of advice that I think might be helpful in your particular
case: focus on being a constructive member of the LSM community, not a
distraction. While disruption has been seen as a trendy idea among
the "move fast and break things" crowd, when it comes to core platform
security "break things" can result in significant losses, up to and
including people's lives.
--
paul-moore.com
^ permalink raw reply
* Re: Improved guidance for LSM submissions.
From: Dr. Greg @ 2026-01-15 15:55 UTC (permalink / raw)
To: Casey Schaufler; +Cc: Paul Moore, linux-security-module
In-Reply-To: <2ea2e67e-8fcd-43d8-8cda-7df8d678d2b0@schaufler-ca.com>
On Fri, Jan 09, 2026 at 11:58:39AM -0800, Casey Schaufler wrote:
> On 1/9/2026 10:51 AM, Paul Moore wrote:
> > On Thu, Jan 8, 2026 at 11:08???AM Dr. Greg <greg@enjellic.com> wrote:
> >> What is not clear in these guidelines is how a virgin LSM should be
> >> structured for initial submission. Moving forward, we believe the
> >> community would benefit from having clear guidance on this issue.
> >>
> >> It would be helpful if the guidance covers a submission of 10-15 KLOC
> >> of code and 5-8 compilation units, which seems to cover the average
> >> range of sizes for LSM's that have significant coverage of the event
> >> handlers/hooks.
> Good day Greg, I hope you are well.
Hi Casey, thank you, I hope your week has been going well.
> If you would review the comments I made in 2023 regarding how to
> make your submission reviewable you might find that you don't need
> a "formal" statement of policy. Remember that you are not submitting
> your code to a chartered organization, but to a collection of system
> developers who are enthusiastic about security. Many are overworked,
> some are hobbyists, but all treat their time as valuable. If you can't
> heed the advice you've already been given, there's no incentive for
> anyone to spend their limited resources to provide it in another
> format.
As Paul noted in the following:
https://lore.kernel.org/linux-security-module/20230608191304.253977-2-paul@paul-moore.com/
Microsoft employs him to maintain the Linux security sub-system, and
related infrastructure, secondary to Microsoft's concern over the long
term health of the Linux community.
Given that, it is disappointing that Microsoft isn't providing
sufficient resources to enable him to provide guidance to the
community they desire to support, regardless of that, we now have
'official' guidance as to the requirements for submitting a virgin
body of LSM code:
https://docs.kernel.org/process/submitting-patches.html
Paul notes the 'separate your changes' section as his only specific
recommendation for the submission of new code, that section recommends
that each patch represent a logical change.
A careful read of the document suggests that our submission did not
violate what is the 'official' guidance for virgin code submissions.
Absent the utility of specific guidance, Paul recommends reviewing the
mailing list for community norms and expectations, so we did.
The following URL provides a full reference to Microsoft's submission
of their IPE LSM:
https://lwn.net/Articles/969749/
Their strategy mirrored ours with respect to submitting each major
functional unit as a single patch, a strategy that was sufficient for
the review of Microsoft's submission, 16 separate times.
You take exception with a single include file containing structures
referenced by every compilation unit, indicating that a structure
should be introduced with the code that uses it.
For the good of the community, it would be helpful to have
clarification as to how you do that without including all of the
compilation units in a single patch, which would clearly be rejected
as an inappropriate submission.
Best wishes for a productive New Year.
As always,
Dr. Greg
The Quixote Project - Flailing at the Travails of Cybersecurity
https://github.com/Quixote-Project
^ permalink raw reply
* Re: [PATCH] ima: Detect changes to files via kstat changes rather than i_version
From: Roberto Sassu @ 2026-01-15 11:46 UTC (permalink / raw)
To: Frederick Lawler, Mimi Zohar, Roberto Sassu, Dmitry Kasatkin,
Eric Snowberg, Paul Moore, James Morris, Serge E. Hallyn,
Darrick J. Wong, Christian Brauner, Josef Bacik, Jeff Layton
Cc: linux-kernel, linux-integrity, linux-security-module, kernel-team
In-Reply-To: <20260112-xfs-ima-fixup-v1-1-8d13b6001312@cloudflare.com>
On Mon, 2026-01-12 at 16:32 -0600, Frederick Lawler wrote:
> Commit 1cf7e834a6fb ("xfs: switch to multigrain timestamps")
> introduced a means to track change detection for an inode
> via ctime updates, opposed to setting kstat.change_cookie when
> calling into xfs_vn_getattr().
>
> This introduced a regression because IMA caches kstat.change_cookie
> to compare against an inode's i_version directly in
> integrity_inode_attrs_changed(), and thus could be out of date
> depending on how file systems increment i_version.
>
> To address this, require integrity_inode_attrs_changed() to query
> vfs_getattr_nosec() to compare the cached version against
> kstat.change_cookie directly. This ensures that when updates occur,
> we're accessing the same changed inode version on changes, and fallback
> to compare against an artificial version generated from kstat.ctime
> via integrity_ctime_guard() when there's no detected change
> to the kstat.change_cookie.
>
> This ensures that in the absence of i_version support for file systems,
> and in the absence of a kstat.change_cookie update, we ultimately have a
> unique-enough version to compare against.
>
> The exact implementation for integrity_ctime_guard() is to ensure that
> if tv_sec or tv_nsec are zero, there's some value to store back into
> struct integrity_inode_attributes.version. This also avoids the need to
> add additional storage and comparisons.
>
> Lastly, because EVM still relies on querying and caching a backing inode's
> i_version, the integrity_inode_attrs_changed() falls back to the
> original inode.i_version != cached comparison. This maintains the
> invariant that a re-evaluation in unknown change detection circumstances
> is required.
>
> Link: https://lore.kernel.org/all/aTspr4_h9IU4EyrR@CMGLRV3
> Suggested-by: Jeff Layton <jlayton@kernel.org>
> Signed-off-by: Frederick Lawler <fred@cloudflare.com>
> ---
> We uncovered a case in kernels >= 6.13 where XFS is no longer updating
> struct kstat.change_cookie on i_op getattr() access calls. Instead, XFS is
> using multigrain ctime (as well as other file systems) for
> change detection in commit 1cf7e834a6fb ("xfs: switch to
> multigrain timestamps").
>
> Because file systems may implement i_version as they see fit, IMA
> caching may be behind as well as file systems that don't support/export
> i_version. Thus we're proposing to compare against the kstat.change_cookie
> directly to the cached version, and fall back to a ctime guard when
> that's not updated.
>
> EVM is largely left alone since there's no trivial way to query a file
> directly in the LSM call paths to obtain kstat.change_cookie &
> kstat.ctime to cache. Thus retains accessing i_version directly.
>
> Regression tests will be added to the Linux Test Project instead of
> selftest to help catch future file system changes that may impact
> future evaluation of IMA.
>
> I'd like this to be backported to at least 6.18 if possible.
>
> Below is a simplified test that demonstrates the issue:
>
> _fragment.config_
> CONFIG_XFS_FS=y
> CONFIG_OVERLAY_FS=y
> CONFIG_IMA=y
> CONFIG_IMA_WRITE_POLICY=y
> CONFIG_IMA_READ_POLICY=y
>
> _./test.sh_
>
> IMA_POLICY="/sys/kernel/security/ima/policy"
> TEST_BIN="/bin/date"
> MNT_BASE="/tmp/ima_test_root"
>
> mkdir -p "$MNT_BASE"
> mount -t tmpfs tmpfs "$MNT_BASE"
> mkdir -p "$MNT_BASE"/{xfs_disk,upper,work,ovl}
>
> dd if=/dev/zero of="$MNT_BASE/xfs.img" bs=1M count=300
> mkfs.xfs -q "$MNT_BASE/xfs.img"
> mount "$MNT_BASE/xfs.img" "$MNT_BASE/xfs_disk"
> cp "$TEST_BIN" "$MNT_BASE/xfs_disk/test_prog"
>
> mount -t overlay overlay -o \
> "lowerdir=$MNT_BASE/xfs_disk,upperdir=$MNT_BASE/upper,workdir=$MNT_BASE/work" \
> "$MNT_BASE/ovl"
>
> echo "audit func=BPRM_CHECK uid=$(id -u nobody)" > "$IMA_POLICY"
>
> target_prog="$MNT_BASE/ovl/test_prog"
> setpriv --reuid nobody "$target_prog"
> setpriv --reuid nobody "$target_prog"
> setpriv --reuid nobody "$target_prog"
>
> audit_count=$(dmesg | grep -c "file=\"$target_prog\"")
>
> if [[ "$audit_count" -eq 1 ]]; then
> echo "PASS: Found exactly 1 audit event."
> else
> echo "FAIL: Expected 1 audit event, but found $audit_count."
> exit 1
> fi
> ---
> Changes since RFC:
> - Remove calls to I_IS_VERSION()
> - Function documentation/comments
> - Abide IMA/EVM change detection fallback invariants
> - Combined ctime guard into version for attributes struct
> - Link to RFC: https://lore.kernel.org/r/20251229-xfs-ima-fixup-v1-1-6a717c939f7c@cloudflare.com
> ---
> include/linux/integrity.h | 42 +++++++++++++++++++++++++++++++++++----
> security/integrity/evm/evm_main.c | 5 ++---
> security/integrity/ima/ima_api.c | 11 +++++++---
> security/integrity/ima/ima_main.c | 15 +++++---------
> 4 files changed, 53 insertions(+), 20 deletions(-)
>
> diff --git a/include/linux/integrity.h b/include/linux/integrity.h
> index f5842372359be5341b6870a43b92e695e8fc78af..5eca8aa2769f9238c68bb40885ecc46910524f11 100644
> --- a/include/linux/integrity.h
> +++ b/include/linux/integrity.h
> @@ -9,6 +9,7 @@
>
> #include <linux/fs.h>
> #include <linux/iversion.h>
> +#include <linux/kernel.h>
>
> enum integrity_status {
> INTEGRITY_PASS = 0,
> @@ -36,6 +37,14 @@ struct integrity_inode_attributes {
> dev_t dev;
> };
>
> +/*
> + * Wrapper to generate an artificial version for a file.
> + */
> +static inline u64 integrity_ctime_guard(struct kstat stat)
> +{
> + return stat.ctime.tv_sec ^ stat.ctime.tv_nsec;
Unfortunately, we cannot take the risk of a collision. Better use all
or a packed version.
> +}
> +
> /*
> * On stacked filesystems the i_version alone is not enough to detect file data
> * or metadata change. Additional metadata is required.
> @@ -51,14 +60,39 @@ integrity_inode_attrs_store(struct integrity_inode_attributes *attrs,
>
> /*
> * On stacked filesystems detect whether the inode or its content has changed.
> + *
> + * Must be called in process context.
> */
> static inline bool
> integrity_inode_attrs_changed(const struct integrity_inode_attributes *attrs,
> - const struct inode *inode)
> + struct file *file, struct inode *inode)
> {
> - return (inode->i_sb->s_dev != attrs->dev ||
> - inode->i_ino != attrs->ino ||
> - !inode_eq_iversion(inode, attrs->version));
> + struct kstat stat;
> +
> + might_sleep();
> +
> + if (inode->i_sb->s_dev != attrs->dev || inode->i_ino != attrs->ino)
> + return true;
> +
> + /*
> + * EVM currently relies on backing inode i_version. While IS_I_VERSION
> + * is not a good indicator of i_version support, this still retains
> + * the logic such that a re-evaluation should still occur for EVM, and
> + * only for IMA if vfs_getattr_nosec() fails.
> + */
> + if (!file || vfs_getattr_nosec(&file->f_path, &stat,
> + STATX_CHANGE_COOKIE | STATX_CTIME,
> + AT_STATX_SYNC_AS_STAT))
> + return !IS_I_VERSION(inode) ||
> + !inode_eq_iversion(inode, attrs->version);
> +
> + if (stat.result_mask & STATX_CHANGE_COOKIE)
> + return stat.change_cookie != attrs->version;
> +
> + if (stat.result_mask & STATX_CTIME)
> + return integrity_ctime_guard(stat) != attrs->version;
Yes, switching to the new field I guess it works, but I'm wondering if
we could have more uniformity across the filesystems, otherwise one has
to use one source for filesystem X, another source for filesystem Y.
Thanks
Roberto
> +
> + return true;
> }
>
>
> diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
> index 73d500a375cb37a54f295b0e1e93fd6e5d9ecddc..6a4e0e246005246d5700b1db590c1759242b9cb6 100644
> --- a/security/integrity/evm/evm_main.c
> +++ b/security/integrity/evm/evm_main.c
> @@ -752,9 +752,8 @@ bool evm_metadata_changed(struct inode *inode, struct inode *metadata_inode)
> bool ret = false;
>
> if (iint) {
> - ret = (!IS_I_VERSION(metadata_inode) ||
> - integrity_inode_attrs_changed(&iint->metadata_inode,
> - metadata_inode));
> + ret = integrity_inode_attrs_changed(&iint->metadata_inode,
> + NULL, metadata_inode);
> if (ret)
> iint->evm_status = INTEGRITY_UNKNOWN;
> }
> diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
> index c35ea613c9f8d404ba4886e3b736c3bab29d1668..8096986f3689781d3cdf6595f330033782f9cc45 100644
> --- a/security/integrity/ima/ima_api.c
> +++ b/security/integrity/ima/ima_api.c
> @@ -272,10 +272,15 @@ int ima_collect_measurement(struct ima_iint_cache *iint, struct file *file,
> * to an initial measurement/appraisal/audit, but was modified to
> * assume the file changed.
> */
> - result = vfs_getattr_nosec(&file->f_path, &stat, STATX_CHANGE_COOKIE,
> + result = vfs_getattr_nosec(&file->f_path, &stat,
> + STATX_CHANGE_COOKIE | STATX_CTIME,
> AT_STATX_SYNC_AS_STAT);
> - if (!result && (stat.result_mask & STATX_CHANGE_COOKIE))
> - i_version = stat.change_cookie;
> + if (!result) {
> + if (stat.result_mask & STATX_CHANGE_COOKIE)
> + i_version = stat.change_cookie;
> + else if (stat.result_mask & STATX_CTIME)
> + i_version = integrity_ctime_guard(stat);
> + }
> hash.hdr.algo = algo;
> hash.hdr.length = hash_digest_size[algo];
>
> diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
> index 5770cf691912aa912fc65280c59f5baac35dd725..3a4c32e254f925bba85cb91b63744ac142b3b049 100644
> --- a/security/integrity/ima/ima_main.c
> +++ b/security/integrity/ima/ima_main.c
> @@ -22,6 +22,7 @@
> #include <linux/mount.h>
> #include <linux/mman.h>
> #include <linux/slab.h>
> +#include <linux/stat.h>
> #include <linux/xattr.h>
> #include <linux/ima.h>
> #include <linux/fs.h>
> @@ -191,18 +192,13 @@ static void ima_check_last_writer(struct ima_iint_cache *iint,
>
> mutex_lock(&iint->mutex);
> if (atomic_read(&inode->i_writecount) == 1) {
> - struct kstat stat;
> -
> clear_bit(IMA_EMITTED_OPENWRITERS, &iint->atomic_flags);
>
> update = test_and_clear_bit(IMA_UPDATE_XATTR,
> &iint->atomic_flags);
> if ((iint->flags & IMA_NEW_FILE) ||
> - vfs_getattr_nosec(&file->f_path, &stat,
> - STATX_CHANGE_COOKIE,
> - AT_STATX_SYNC_AS_STAT) ||
> - !(stat.result_mask & STATX_CHANGE_COOKIE) ||
> - stat.change_cookie != iint->real_inode.version) {
> + integrity_inode_attrs_changed(&iint->real_inode, file,
> + inode)) {
> iint->flags &= ~(IMA_DONE_MASK | IMA_NEW_FILE);
> iint->measured_pcrs = 0;
> if (update)
> @@ -328,9 +324,8 @@ static int process_measurement(struct file *file, const struct cred *cred,
> real_inode = d_real_inode(file_dentry(file));
> if (real_inode != inode &&
> (action & IMA_DO_MASK) && (iint->flags & IMA_DONE_MASK)) {
> - if (!IS_I_VERSION(real_inode) ||
> - integrity_inode_attrs_changed(&iint->real_inode,
> - real_inode)) {
> + if (integrity_inode_attrs_changed(&iint->real_inode,
> + file, real_inode)) {
> iint->flags &= ~IMA_DONE_MASK;
> iint->measured_pcrs = 0;
> }
>
> ---
> base-commit: 8f0b4cce4481fb22653697cced8d0d04027cb1e8
> change-id: 20251212-xfs-ima-fixup-931780a62c2c
>
> Best regards,
^ permalink raw reply
* Re: [PATCH v2 1/5] lsm: Add hook unix_path_connect
From: Günther Noack @ 2026-01-15 10:10 UTC (permalink / raw)
To: Paul Moore, Christian Brauner, Justin Suess
Cc: Mickaël Salaün, James Morris, Serge E . Hallyn,
linux-security-module, Tingmao Wang, Samasth Norway Ananda,
Matthieu Buffet, Mikhail Ivanov, konstantin.meskhidze,
Demi Marie Obenour, Alyssa Ross, Jann Horn, Tahera Fahimi,
Simon Horman, netdev, Alexander Viro
In-Reply-To: <CAHC9VhQOQ096WEZPLo4-57cYkM8c38qzE-F8L3f_cSSB4WadGg@mail.gmail.com>
On Tue, Jan 13, 2026 at 06:27:15PM -0500, Paul Moore wrote:
> On Tue, Jan 13, 2026 at 4:34 AM Christian Brauner <brauner@kernel.org> wrote:
> > On Sat, Jan 10, 2026 at 03:32:57PM +0100, Günther Noack wrote:
> > > From: Justin Suess <utilityemal77@gmail.com>
> > >
> > > Adds an LSM hook unix_path_connect.
> > >
> > > This hook is called to check the path of a named unix socket before a
> > > connection is initiated.
> > >
> > > Cc: Günther Noack <gnoack3000@gmail.com>
> > > Signed-off-by: Justin Suess <utilityemal77@gmail.com>
> > > ---
> > > include/linux/lsm_hook_defs.h | 4 ++++
> > > include/linux/security.h | 11 +++++++++++
> > > net/unix/af_unix.c | 9 +++++++++
> > > security/security.c | 20 ++++++++++++++++++++
> > > 4 files changed, 44 insertions(+)
>
> ...
>
> > > diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
> > > index 55cdebfa0da0..3aabe2d489ae 100644
> > > --- a/net/unix/af_unix.c
> > > +++ b/net/unix/af_unix.c
> > > @@ -1226,6 +1226,15 @@ static struct sock *unix_find_bsd(struct sockaddr_un *sunaddr, int addr_len,
> > > if (!S_ISSOCK(inode->i_mode))
> > > goto path_put;
> > >
> > > + /*
> > > + * We call the hook because we know that the inode is a socket
> > > + * and we hold a valid reference to it via the path.
> > > + */
> > > + err = security_unix_path_connect(&path, type, flags);
> > > + if (err)
> > > + goto path_put;
> >
> > Couldn't we try reflowing the code here so the path is passed ...
>
> It would be good if you could be a bit more specific about your
> desires here. Are you talking about changing the
> unix_find_other()/unix_find_bsd() code path such that the path is
> available to unix_find_other() callers and not limited to the
> unix_find_bsd() scope?
>
> > ... to
> > security_unix_stream_connect() and security_unix_may_send() so that all
> > LSMs get the same data and we don't have to have different LSMs hooks
> > into different callpaths that effectively do the same thing.
> >
> > I mean the objects are even in two completely different states between
> > those hooks. Even what type of sockets get a call to the LSM is
> > different between those two hooks.
>
> I'm working on the assumption that you are talking about changing the
> UNIX socket code so that the path info is available to the existing
> _may_send() and _stream_connect() hooks. If that isn't the case, and
> you're thinking of something different, disregard my comments below.
>
> In both the unix_dgram_{connect(),sendmsg()}, aka
> security_unix_may_send(), cases and the unix_stream_connect(), aka
> security_unix_stream_connect(), case the call to unix_find_other() is
> done to lookup the other end of the communication channel, which does
> seem reasonably consistent to me. Yes, of course, once you start
> getting into the specifics of the UNIX socket handling the unix_dgram_
> and unix_stream_ cases are very different, including their
> corresponding existing LSM hooks, but that doesn't mean in the context
> of unix_find_bsd() that security_unix_path_connect() doesn't have
> value.
>
> The alternative would be some rather serious surgery in af_unix.c to
> persist the path struct from unix_find_bsd() until the later LSM hooks
> are executed. It's certainly not impossible, but I'm not sure it is
> necessary or desirable at this point in time. LSMs that wish to
> connect the information from _unix_path_connect() to either
> _unix_stream_connect() or _unix_may_send() can do so today without
> needing to substantially change af_unix.c.
Thanks for the review, Christan and Paul!
I am also unconvinced by the approach. It has also crossed my mind
before though, and my reasoning is as follows:
For reference, the function call hierarchy in af_unix.c is:
* unix_dgram_connect() (*)
* unix_find_other()
* unix_find_bsd()
* security_unix_may_send()
* unix_dgram_sendmsg() (*)
* unix_find_other()
* unix_find_bsd()
* security_unix_may_send()
* unix_stream_connect() (*)
* unix_find_other()
* unix_find_bsd()
* security_unix_stream_connect()
In my understanding, the hypothetical implementation would be:
* allocate a struct path on the stack of these proto_ops hook
functions (marked with (*) above)
* pass a pointer to that path down to unix_find_other(), only to be
filled out in the case that this is a pathname UNIX socket (not an
abstract UNIX socket)
* pass a const pointer to that path to the LSM hooks
and then the LSM hooks would have to check whether the struct path has
non-zero pointers and could do the check.
This has the upside that it does not introduce a new LSM hook, but
only adds a "path" parameter to two existing LSM hooks.
On the other side, I see the following drawbacks:
* The more serious surgery in af_unix, which Paul also discussed:
The function interface to unix_find_other() would need additional
parameters for the sole purpose of supporting these LSM hooks and
the refcounting of the struct path would have to be done in three
functions instead of just in one. That would complicate the
af_unix.c logic, even when CONFIG_SECURITY_PATH is not set.
* The cases in which we pass a non-zero path argument to the LSM hooks
would have surprising semantics IMHO, because it is not always set:
* If a UNIX dgram user uses connect(2) and then calls sendmsg(2)
without explicit recipient address, unix_dgram_sendmsg() would
*not* do the look up any more and we can not provide the path to
the security_unix_may_send() hook.
* For abstract UNIX sockets it is not set either, of course.
The path argument to the LSM hook would be present in the exact same
cases where we now call the new UNIX path lookup LSM hook, but it
would be invoked with a delay.
* Some properties of the resolved socket are still observable to
userspace:
When we only pass the path to a later LSM hook, there are a variety
of additional error case checks in af_unix.c which are based on the
"other" socket which we looked up through the path. Examples:
* was other shutdown(2)? (ECONNREFUSED on connect or EPIPE on dgram_sendmsg)
* does other support SO_PASSRIGHTS (fd passing)? (EPERM on dgram_sendmsg)
* would sendmsg pass sk_filter() (on dgram_sendmsg)
For a LSM policy that is supposed to restrict the resolution of a
UNIX socket by path, I would not expect such properties of the
resolved socket to be observable?
(And we also can't fix this up in the LSM by returning a matching
error code, because at least unix_dgram_sendmsg() returns multiple
different error codes in these error cases.)
I would prefer if the correctness of our LSM did not depend on
keeping track of the error scenarios in af_unix.c. This seems
brittle.
Overall, I am not convinced that using pre-existing hooks is the right
way and I would prefer the approach where we have a more dedicated LSM
hook for the path lookup.
Does that seem reasonable? Let me know what you think.
–Günther
^ permalink raw reply
* [PATCH v4 6/6] docs: trusted-encryped: add PKWM as a new trust source
From: Srish Srinivasan @ 2026-01-15 10:05 UTC (permalink / raw)
To: linux-integrity, keyrings, linuxppc-dev
Cc: maddy, mpe, npiggin, christophe.leroy, James.Bottomley, jarkko,
zohar, nayna, rnsastry, linux-kernel, linux-security-module,
ssrish
In-Reply-To: <20260115100504.488665-1-ssrish@linux.ibm.com>
From: Nayna Jain <nayna@linux.ibm.com>
Update Documentation/security/keys/trusted-encrypted.rst and Documentation/
admin-guide/kernel-parameters.txt with PowerVM Key Wrapping Module (PKWM)
as a new trust source
Signed-off-by: Nayna Jain <nayna@linux.ibm.com>
Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
---
.../admin-guide/kernel-parameters.txt | 1 +
.../security/keys/trusted-encrypted.rst | 50 +++++++++++++++++++
2 files changed, 51 insertions(+)
diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
index a8d0afde7f85..ccb9c2f502fb 100644
--- a/Documentation/admin-guide/kernel-parameters.txt
+++ b/Documentation/admin-guide/kernel-parameters.txt
@@ -7755,6 +7755,7 @@ Kernel parameters
- "tee"
- "caam"
- "dcp"
+ - "pkwm"
If not specified then it defaults to iterating through
the trust source list starting with TPM and assigns the
first trust source as a backend which is initialized
diff --git a/Documentation/security/keys/trusted-encrypted.rst b/Documentation/security/keys/trusted-encrypted.rst
index eae6a36b1c9a..ddff7c7c2582 100644
--- a/Documentation/security/keys/trusted-encrypted.rst
+++ b/Documentation/security/keys/trusted-encrypted.rst
@@ -81,6 +81,14 @@ safe.
and the UNIQUE key. Default is to use the UNIQUE key, but selecting
the OTP key can be done via a module parameter (dcp_use_otp_key).
+ (5) PKWM (PowerVM Key Wrapping Module: IBM PowerVM + Platform KeyStore)
+
+ Rooted to a unique, per-LPAR key, which is derived from a system-wide,
+ randomly generated LPAR root key. Both the per-LPAR keys and the LPAR
+ root key are stored in hypervisor-owned secure memory at runtime,
+ and the LPAR root key is additionally persisted in secure locations
+ such as the processor SEEPROMs and encrypted NVRAM.
+
* Execution isolation
(1) TPM
@@ -102,6 +110,14 @@ safe.
environment. Only basic blob key encryption is executed there.
The actual key sealing/unsealing is done on main processor/kernel space.
+ (5) PKWM (PowerVM Key Wrapping Module: IBM PowerVM + Platform KeyStore)
+
+ Fixed set of cryptographic operations done on on-chip hardware
+ cryptographic acceleration unit NX. Keys for wrapping and unwrapping
+ are managed by PowerVM Platform KeyStore, which stores keys in an
+ isolated in-memory copy in secure hypervisor memory, as well as in a
+ persistent copy in hypervisor-encrypted NVRAM.
+
* Optional binding to platform integrity state
(1) TPM
@@ -129,6 +145,11 @@ safe.
Relies on Secure/Trusted boot process (called HAB by vendor) for
platform integrity.
+ (5) PKWM (PowerVM Key Wrapping Module: IBM PowerVM + Platform KeyStore)
+
+ Relies on secure and trusted boot process of IBM Power systems for
+ platform integrity.
+
* Interfaces and APIs
(1) TPM
@@ -149,6 +170,11 @@ safe.
Vendor-specific API that is implemented as part of the DCP crypto driver in
``drivers/crypto/mxs-dcp.c``.
+ (5) PKWM (PowerVM Key Wrapping Module: IBM PowerVM + Platform KeyStore)
+
+ Platform Keystore has well documented interfaces in PAPR document.
+ Refer to ``Documentation/arch/powerpc/papr_hcalls.rst``
+
* Threat model
The strength and appropriateness of a particular trust source for a given
@@ -191,6 +217,10 @@ selected trust source:
a dedicated hardware RNG that is independent from DCP which can be enabled
to back the kernel RNG.
+ * PKWM (PowerVM Key Wrapping Module: IBM PowerVM + Platform KeyStore)
+
+ The normal kernel random number generator is used to generate keys.
+
Users may override this by specifying ``trusted.rng=kernel`` on the kernel
command-line to override the used RNG with the kernel's random number pool.
@@ -321,6 +351,26 @@ Usage::
specific to this DCP key-blob implementation. The key length for new keys is
always in bytes. Trusted Keys can be 32 - 128 bytes (256 - 1024 bits).
+Trusted Keys usage: PKWM
+------------------------
+
+Usage::
+
+ keyctl add trusted name "new keylen [options]" ring
+ keyctl add trusted name "load hex_blob" ring
+ keyctl print keyid
+
+ options:
+ wrap_flags= ascii hex value of security policy requirement
+ 0x00: no secure boot requirement (default)
+ 0x01: require secure boot to be in either audit or
+ enforced mode
+ 0x02: require secure boot to be in enforced mode
+
+"keyctl print" returns an ASCII hex copy of the sealed key, which is in format
+specific to PKWM key-blob implementation. The key length for new keys is
+always in bytes. Trusted Keys can be 32 - 128 bytes (256 - 1024 bits).
+
Encrypted Keys usage
--------------------
--
2.47.3
^ permalink raw reply related
* [PATCH v4 5/6] keys/trusted_keys: establish PKWM as a trusted source
From: Srish Srinivasan @ 2026-01-15 10:05 UTC (permalink / raw)
To: linux-integrity, keyrings, linuxppc-dev
Cc: maddy, mpe, npiggin, christophe.leroy, James.Bottomley, jarkko,
zohar, nayna, rnsastry, linux-kernel, linux-security-module,
ssrish
In-Reply-To: <20260115100504.488665-1-ssrish@linux.ibm.com>
The wrapping key does not exist by default and is generated by the
hypervisor as a part of PKWM initialization. This key is then persisted by
the hypervisor and is used to wrap trusted keys. These are variable length
symmetric keys, which in the case of PowerVM Key Wrapping Module (PKWM) are
generated using the kernel RNG. PKWM can be used as a trust source through
the following example keyctl commands:
keyctl add trusted my_trusted_key "new 32" @u
Use the wrap_flags command option to set the secure boot requirement for
the wrapping request through the following keyctl commands
case1: no secure boot requirement. (default)
keyctl usage: keyctl add trusted my_trusted_key "new 32" @u
OR
keyctl add trusted my_trusted_key "new 32 wrap_flags=0x00" @u
case2: secure boot required to in either audit or enforce mode. set bit 0
keyctl usage: keyctl add trusted my_trusted_key "new 32 wrap_flags=0x01" @u
case3: secure boot required to be in enforce mode. set bit 1
keyctl usage: keyctl add trusted my_trusted_key "new 32 wrap_flags=0x02" @u
NOTE:
-> Setting the secure boot requirement is NOT a must.
-> Only either of the secure boot requirement options should be set. Not
both.
-> All the other bits are required to be not set.
-> Set the kernel parameter trusted.source=pkwm to choose PKWM as the
backend for trusted keys implementation.
-> CONFIG_PSERIES_PLPKS must be enabled to build PKWM.
Add PKWM, which is a combination of IBM PowerVM and Power LPAR Platform
KeyStore, as a new trust source for trusted keys.
Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
---
This version introduces a private pointer for backend specific fields and
related changes specific to the PKWM backend, but defers migrating the TPM
fields to this new framework. That will be done independently of this
patch series.
MAINTAINERS | 9 +
include/keys/trusted-type.h | 7 +-
include/keys/trusted_pkwm.h | 33 ++++
security/keys/trusted-keys/Kconfig | 8 +
security/keys/trusted-keys/Makefile | 2 +
security/keys/trusted-keys/trusted_core.c | 6 +-
security/keys/trusted-keys/trusted_pkwm.c | 190 ++++++++++++++++++++++
7 files changed, 253 insertions(+), 2 deletions(-)
create mode 100644 include/keys/trusted_pkwm.h
create mode 100644 security/keys/trusted-keys/trusted_pkwm.c
diff --git a/MAINTAINERS b/MAINTAINERS
index cf755238c429..c98f1811f836 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -14008,6 +14008,15 @@ S: Supported
F: include/keys/trusted_dcp.h
F: security/keys/trusted-keys/trusted_dcp.c
+KEYS-TRUSTED-PLPKS
+M: Srish Srinivasan <ssrish@linux.ibm.com>
+M: Nayna Jain <nayna@linux.ibm.com>
+L: linux-integrity@vger.kernel.org
+L: keyrings@vger.kernel.org
+S: Supported
+F: include/keys/trusted_pkwm.h
+F: security/keys/trusted-keys/trusted_pkwm.c
+
KEYS-TRUSTED-TEE
M: Sumit Garg <sumit.garg@kernel.org>
L: linux-integrity@vger.kernel.org
diff --git a/include/keys/trusted-type.h b/include/keys/trusted-type.h
index 4eb64548a74f..03527162613f 100644
--- a/include/keys/trusted-type.h
+++ b/include/keys/trusted-type.h
@@ -19,7 +19,11 @@
#define MIN_KEY_SIZE 32
#define MAX_KEY_SIZE 128
-#define MAX_BLOB_SIZE 512
+#if IS_ENABLED(CONFIG_TRUSTED_KEYS_PKWM)
+#define MAX_BLOB_SIZE 1152
+#else
+#define MAX_BLOB_SIZE 512
+#endif
#define MAX_PCRINFO_SIZE 64
#define MAX_DIGEST_SIZE 64
@@ -46,6 +50,7 @@ struct trusted_key_options {
uint32_t policydigest_len;
unsigned char policydigest[MAX_DIGEST_SIZE];
uint32_t policyhandle;
+ void *private;
};
struct trusted_key_ops {
diff --git a/include/keys/trusted_pkwm.h b/include/keys/trusted_pkwm.h
new file mode 100644
index 000000000000..4035b9776394
--- /dev/null
+++ b/include/keys/trusted_pkwm.h
@@ -0,0 +1,33 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef __PKWM_TRUSTED_KEY_H
+#define __PKWM_TRUSTED_KEY_H
+
+#include <keys/trusted-type.h>
+#include <linux/bitops.h>
+#include <linux/printk.h>
+
+extern struct trusted_key_ops pkwm_trusted_key_ops;
+
+struct trusted_pkwm_options {
+ u16 wrap_flags;
+};
+
+static inline void dump_options(struct trusted_key_options *o)
+{
+ const struct trusted_pkwm_options *pkwm;
+ bool sb_audit_or_enforce_bit;
+ bool sb_enforce_bit;
+
+ pkwm = o->private;
+ sb_audit_or_enforce_bit = pkwm->wrap_flags & BIT(0);
+ sb_enforce_bit = pkwm->wrap_flags & BIT(1);
+
+ if (sb_audit_or_enforce_bit)
+ pr_debug("secure boot mode required: audit or enforce");
+ else if (sb_enforce_bit)
+ pr_debug("secure boot mode required: enforce");
+ else
+ pr_debug("secure boot mode required: disabled");
+}
+
+#endif
diff --git a/security/keys/trusted-keys/Kconfig b/security/keys/trusted-keys/Kconfig
index 204a68c1429d..9e00482d886a 100644
--- a/security/keys/trusted-keys/Kconfig
+++ b/security/keys/trusted-keys/Kconfig
@@ -46,6 +46,14 @@ config TRUSTED_KEYS_DCP
help
Enable use of NXP's DCP (Data Co-Processor) as trusted key backend.
+config TRUSTED_KEYS_PKWM
+ bool "PKWM-based trusted keys"
+ depends on PSERIES_PLPKS >= TRUSTED_KEYS
+ default y
+ select HAVE_TRUSTED_KEYS
+ help
+ Enable use of IBM PowerVM Key Wrapping Module (PKWM) as a trusted key backend.
+
if !HAVE_TRUSTED_KEYS
comment "No trust source selected!"
endif
diff --git a/security/keys/trusted-keys/Makefile b/security/keys/trusted-keys/Makefile
index f0f3b27f688b..5fc053a21dad 100644
--- a/security/keys/trusted-keys/Makefile
+++ b/security/keys/trusted-keys/Makefile
@@ -16,3 +16,5 @@ trusted-$(CONFIG_TRUSTED_KEYS_TEE) += trusted_tee.o
trusted-$(CONFIG_TRUSTED_KEYS_CAAM) += trusted_caam.o
trusted-$(CONFIG_TRUSTED_KEYS_DCP) += trusted_dcp.o
+
+trusted-$(CONFIG_TRUSTED_KEYS_PKWM) += trusted_pkwm.o
diff --git a/security/keys/trusted-keys/trusted_core.c b/security/keys/trusted-keys/trusted_core.c
index b1680ee53f86..2d328de170e8 100644
--- a/security/keys/trusted-keys/trusted_core.c
+++ b/security/keys/trusted-keys/trusted_core.c
@@ -12,6 +12,7 @@
#include <keys/trusted_caam.h>
#include <keys/trusted_dcp.h>
#include <keys/trusted_tpm.h>
+#include <keys/trusted_pkwm.h>
#include <linux/capability.h>
#include <linux/err.h>
#include <linux/init.h>
@@ -31,7 +32,7 @@ MODULE_PARM_DESC(rng, "Select trusted key RNG");
static char *trusted_key_source;
module_param_named(source, trusted_key_source, charp, 0);
-MODULE_PARM_DESC(source, "Select trusted keys source (tpm, tee, caam or dcp)");
+MODULE_PARM_DESC(source, "Select trusted keys source (tpm, tee, caam, dcp or pkwm)");
static const struct trusted_key_source trusted_key_sources[] = {
#if defined(CONFIG_TRUSTED_KEYS_TPM)
@@ -46,6 +47,9 @@ static const struct trusted_key_source trusted_key_sources[] = {
#if defined(CONFIG_TRUSTED_KEYS_DCP)
{ "dcp", &dcp_trusted_key_ops },
#endif
+#if defined(CONFIG_TRUSTED_KEYS_PKWM)
+ { "pkwm", &pkwm_trusted_key_ops },
+#endif
};
DEFINE_STATIC_CALL_NULL(trusted_key_seal, *trusted_key_sources[0].ops->seal);
diff --git a/security/keys/trusted-keys/trusted_pkwm.c b/security/keys/trusted-keys/trusted_pkwm.c
new file mode 100644
index 000000000000..4f391b77a907
--- /dev/null
+++ b/security/keys/trusted-keys/trusted_pkwm.c
@@ -0,0 +1,190 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2025 IBM Corporation, Srish Srinivasan <ssrish@linux.ibm.com>
+ */
+
+#include <keys/trusted_pkwm.h>
+#include <keys/trusted-type.h>
+#include <linux/build_bug.h>
+#include <linux/key-type.h>
+#include <linux/parser.h>
+#include <asm/plpks.h>
+
+enum {
+ Opt_err,
+ Opt_wrap_flags,
+};
+
+static const match_table_t key_tokens = {
+ {Opt_wrap_flags, "wrap_flags=%s"},
+ {Opt_err, NULL}
+};
+
+static int getoptions(char *datablob, struct trusted_key_options *opt)
+{
+ substring_t args[MAX_OPT_ARGS];
+ char *p = datablob;
+ int token;
+ int res;
+ u16 wrap_flags;
+ unsigned long token_mask = 0;
+ struct trusted_pkwm_options *pkwm;
+
+ if (!datablob)
+ return 0;
+
+ pkwm = opt->private;
+
+ while ((p = strsep(&datablob, " \t"))) {
+ if (*p == '\0' || *p == ' ' || *p == '\t')
+ continue;
+
+ token = match_token(p, key_tokens, args);
+ if (test_and_set_bit(token, &token_mask))
+ return -EINVAL;
+
+ switch (token) {
+ case Opt_wrap_flags:
+ res = kstrtou16(args[0].from, 16, &wrap_flags);
+ if (res < 0 || wrap_flags > 2)
+ return -EINVAL;
+ pkwm->wrap_flags = wrap_flags;
+ break;
+ default:
+ return -EINVAL;
+ }
+ }
+ return 0;
+}
+
+static struct trusted_key_options *trusted_options_alloc(void)
+{
+ struct trusted_key_options *options;
+ struct trusted_pkwm_options *pkwm;
+
+ options = kzalloc(sizeof(*options), GFP_KERNEL);
+
+ if (options) {
+ pkwm = kzalloc(sizeof(*pkwm), GFP_KERNEL);
+
+ if (!pkwm) {
+ kfree_sensitive(options);
+ options = NULL;
+ } else {
+ options->private = pkwm;
+ }
+ }
+
+ return options;
+}
+
+static int trusted_pkwm_seal(struct trusted_key_payload *p, char *datablob)
+{
+ struct trusted_key_options *options = NULL;
+ struct trusted_pkwm_options *pkwm = NULL;
+ u8 *input_buf, *output_buf;
+ u32 output_len, input_len;
+ int rc;
+
+ options = trusted_options_alloc();
+
+ if (!options)
+ return -ENOMEM;
+
+ rc = getoptions(datablob, options);
+ if (rc < 0)
+ goto out;
+ dump_options(options);
+
+ input_len = p->key_len;
+ input_buf = kmalloc(ALIGN(input_len, 4096), GFP_KERNEL);
+ if (!input_buf) {
+ pr_err("Input buffer allocation failed. Returning -ENOMEM.");
+ rc = -ENOMEM;
+ goto out;
+ }
+
+ memcpy(input_buf, p->key, p->key_len);
+
+ pkwm = options->private;
+
+ rc = plpks_wrap_object(&input_buf, input_len, pkwm->wrap_flags,
+ &output_buf, &output_len);
+ if (!rc) {
+ memcpy(p->blob, output_buf, output_len);
+ p->blob_len = output_len;
+ dump_payload(p);
+ } else {
+ pr_err("Wrapping of payload key failed: %d\n", rc);
+ }
+
+ kfree(input_buf);
+ kfree(output_buf);
+
+out:
+ kfree_sensitive(options->private);
+ kfree_sensitive(options);
+ return rc;
+}
+
+static int trusted_pkwm_unseal(struct trusted_key_payload *p, char *datablob)
+{
+ u8 *input_buf, *output_buf;
+ u32 input_len, output_len;
+ int rc;
+
+ input_len = p->blob_len;
+ input_buf = kmalloc(ALIGN(input_len, 4096), GFP_KERNEL);
+ if (!input_buf) {
+ pr_err("Input buffer allocation failed. Returning -ENOMEM.");
+ return -ENOMEM;
+ }
+
+ memcpy(input_buf, p->blob, p->blob_len);
+
+ rc = plpks_unwrap_object(&input_buf, input_len, &output_buf,
+ &output_len);
+ if (!rc) {
+ memcpy(p->key, output_buf, output_len);
+ p->key_len = output_len;
+ dump_payload(p);
+ } else {
+ pr_err("Unwrapping of payload failed: %d\n", rc);
+ }
+
+ kfree(input_buf);
+ kfree(output_buf);
+
+ return rc;
+}
+
+static int trusted_pkwm_init(void)
+{
+ int ret;
+
+ if (!plpks_wrapping_is_supported()) {
+ pr_err("H_PKS_WRAP_OBJECT interface not supported\n");
+ return -ENODEV;
+ }
+
+ ret = plpks_gen_wrapping_key();
+ if (ret) {
+ pr_err("Failed to generate default wrapping key\n");
+ return -EINVAL;
+ }
+
+ return register_key_type(&key_type_trusted);
+}
+
+static void trusted_pkwm_exit(void)
+{
+ unregister_key_type(&key_type_trusted);
+}
+
+struct trusted_key_ops pkwm_trusted_key_ops = {
+ .migratable = 0, /* non-migratable */
+ .init = trusted_pkwm_init,
+ .seal = trusted_pkwm_seal,
+ .unseal = trusted_pkwm_unseal,
+ .exit = trusted_pkwm_exit,
+};
--
2.47.3
^ permalink raw reply related
* [PATCH v4 4/6] pseries/plpks: add HCALLs for PowerVM Key Wrapping Module
From: Srish Srinivasan @ 2026-01-15 10:05 UTC (permalink / raw)
To: linux-integrity, keyrings, linuxppc-dev
Cc: maddy, mpe, npiggin, christophe.leroy, James.Bottomley, jarkko,
zohar, nayna, rnsastry, linux-kernel, linux-security-module,
ssrish
In-Reply-To: <20260115100504.488665-1-ssrish@linux.ibm.com>
The hypervisor generated wrapping key is an AES-GCM-256 symmetric key which
is stored in a non-volatile, secure, and encrypted storage called the Power
LPAR Platform KeyStore. It has policy based protections that prevent it
from being read out or exposed to the user.
Implement H_PKS_GEN_KEY, H_PKS_WRAP_OBJECT, and H_PKS_UNWRAP_OBJECT HCALLs
to enable using the PowerVM Key Wrapping Module (PKWM) as a new trust
source for trusted keys. Disallow H_PKS_READ_OBJECT, H_PKS_SIGNED_UPDATE,
and H_PKS_WRITE_OBJECT for objects with the 'wrapping key' policy set.
Capture the availability status for the H_PKS_WRAP_OBJECT interface.
Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
---
Documentation/arch/powerpc/papr_hcalls.rst | 43 +++
arch/powerpc/include/asm/plpks.h | 10 +
arch/powerpc/platforms/pseries/plpks.c | 342 ++++++++++++++++++++-
3 files changed, 393 insertions(+), 2 deletions(-)
diff --git a/Documentation/arch/powerpc/papr_hcalls.rst b/Documentation/arch/powerpc/papr_hcalls.rst
index 805e1cb9bab9..14e39f095a1c 100644
--- a/Documentation/arch/powerpc/papr_hcalls.rst
+++ b/Documentation/arch/powerpc/papr_hcalls.rst
@@ -300,6 +300,49 @@ H_HTM supports setup, configuration, control and dumping of Hardware Trace
Macro (HTM) function and its data. HTM buffer stores tracing data for functions
like core instruction, core LLAT and nest.
+**H_PKS_GEN_KEY**
+
+| Input: authorization, objectlabel, objectlabellen, policy, out, outlen
+| Out: *Hypervisor Generated Key, or None when the wrapping key policy is set*
+| Return Value: *H_SUCCESS, H_Function, H_State, H_R_State, H_Parameter, H_P2,
+ H_P3, H_P4, H_P5, H_P6, H_Authority, H_Nomem, H_Busy, H_Resource,
+ H_Aborted*
+
+H_PKS_GEN_KEY is used to have the hypervisor generate a new random key.
+This key is stored as an object in the Power LPAR Platform KeyStore with
+the provided object label. With the wrapping key policy set the key is only
+visible to the hypervisor, while the key's label would still be visible to
+the user. Generation of wrapping keys is supported only for a key size of
+32 bytes.
+
+**H_PKS_WRAP_OBJECT**
+
+| Input: authorization, wrapkeylabel, wrapkeylabellen, objectwrapflags, in,
+| inlen, out, outlen, continue-token
+| Out: *continue-token, byte size of wrapped object, wrapped object*
+| Return Value: *H_SUCCESS, H_Function, H_State, H_R_State, H_Parameter, H_P2,
+ H_P3, H_P4, H_P5, H_P6, H_P7, H_P8, H_P9, H_Authority, H_Invalid_Key,
+ H_NOT_FOUND, H_Busy, H_LongBusy, H_Aborted*
+
+H_PKS_WRAP_OBJECT is used to wrap an object using a wrapping key stored in the
+Power LPAR Platform KeyStore and return the wrapped object to the caller. The
+caller provides a label to a wrapping key with the 'wrapping key' policy set,
+which must have been previously created with H_PKS_GEN_KEY. The provided object
+is then encrypted with the wrapping key and additional metadata and the result
+is returned to the caller.
+
+
+**H_PKS_UNWRAP_OBJECT**
+
+| Input: authorization, objectwrapflags, in, inlen, out, outlen, continue-token
+| Out: *continue-token, byte size of unwrapped object, unwrapped object*
+| Return Value: *H_SUCCESS, H_Function, H_State, H_R_State, H_Parameter, H_P2,
+ H_P3, H_P4, H_P5, H_P6, H_P7, H_Authority, H_Unsupported, H_Bad_Data,
+ H_NOT_FOUND, H_Invalid_Key, H_Busy, H_LongBusy, H_Aborted*
+
+H_PKS_UNWRAP_OBJECT is used to unwrap an object that was previously warapped with
+H_PKS_WRAP_OBJECT.
+
References
==========
.. [1] "Power Architecture Platform Reference"
diff --git a/arch/powerpc/include/asm/plpks.h b/arch/powerpc/include/asm/plpks.h
index 8f034588fdf7..e87f90e40d4e 100644
--- a/arch/powerpc/include/asm/plpks.h
+++ b/arch/powerpc/include/asm/plpks.h
@@ -113,6 +113,16 @@ void plpks_early_init_devtree(void);
int plpks_populate_fdt(void *fdt);
int plpks_config_create_softlink(struct kobject *from);
+
+bool plpks_wrapping_is_supported(void);
+
+int plpks_gen_wrapping_key(void);
+
+int plpks_wrap_object(u8 **input_buf, u32 input_len, u16 wrap_flags,
+ u8 **output_buf, u32 *output_len);
+
+int plpks_unwrap_object(u8 **input_buf, u32 input_len,
+ u8 **output_buf, u32 *output_len);
#else // CONFIG_PSERIES_PLPKS
static inline bool plpks_is_available(void) { return false; }
static inline u16 plpks_get_passwordlen(void) { BUILD_BUG(); }
diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c
index 4a08f51537c8..b97b7750f6a8 100644
--- a/arch/powerpc/platforms/pseries/plpks.c
+++ b/arch/powerpc/platforms/pseries/plpks.c
@@ -9,6 +9,32 @@
#define pr_fmt(fmt) "plpks: " fmt
+#define PLPKS_WRAPKEY_COMPONENT "PLPKSWR"
+#define PLPKS_WRAPKEY_NAME "default-wrapping-key"
+
+/*
+ * To 4K align the {input, output} buffers to the {UN}WRAP H_CALLs
+ */
+#define PLPKS_WRAPPING_BUF_ALIGN 4096
+
+/*
+ * To ensure the output buffer's length is at least 1024 bytes greater
+ * than the input buffer's length during the WRAP H_CALL
+ */
+#define PLPKS_WRAPPING_BUF_DIFF 1024
+
+#define PLPKS_WRAP_INTERFACE_BIT 3
+#define PLPKS_WRAPPING_KEY_LENGTH 32
+
+#define WRAPFLAG_BE_BIT_SET(be_bit) \
+ BIT_ULL(63 - (be_bit))
+
+#define WRAPFLAG_BE_GENMASK(be_bit_hi, be_bit_lo) \
+ GENMASK_ULL(63 - (be_bit_hi), 63 - (be_bit_lo))
+
+#define WRAPFLAG_BE_FIELD_PREP(be_bit_hi, be_bit_lo, val) \
+ FIELD_PREP(WRAPFLAG_BE_GENMASK(be_bit_hi, be_bit_lo), (val))
+
#include <linux/delay.h>
#include <linux/errno.h>
#include <linux/io.h>
@@ -39,6 +65,7 @@ static u32 supportedpolicies;
static u32 maxlargeobjectsize;
static u64 signedupdatealgorithms;
static u64 wrappingfeatures;
+static bool wrapsupport;
struct plpks_auth {
u8 version;
@@ -283,6 +310,7 @@ static int _plpks_get_config(void)
maxlargeobjectsize = be32_to_cpu(config->maxlargeobjectsize);
signedupdatealgorithms = be64_to_cpu(config->signedupdatealgorithms);
wrappingfeatures = be64_to_cpu(config->wrappingfeatures);
+ wrapsupport = config->flags & PPC_BIT8(PLPKS_WRAP_INTERFACE_BIT);
// Validate that the numbers we get back match the requirements of the spec
if (maxpwsize < 32) {
@@ -614,6 +642,9 @@ int plpks_signed_update_var(struct plpks_var *var, u64 flags)
if (!(var->policy & PLPKS_SIGNEDUPDATE))
return -EINVAL;
+ if (var->policy & PLPKS_WRAPPINGKEY)
+ return -EINVAL;
+
// Signed updates need the component to be NULL.
if (var->component)
return -EINVAL;
@@ -696,6 +727,9 @@ int plpks_write_var(struct plpks_var var)
if (var.policy & PLPKS_SIGNEDUPDATE)
return -EINVAL;
+ if (var.policy & PLPKS_WRAPPINGKEY)
+ return -EINVAL;
+
auth = construct_auth(PLPKS_OS_OWNER);
if (IS_ERR(auth))
return PTR_ERR(auth);
@@ -790,6 +824,9 @@ static int plpks_read_var(u8 consumer, struct plpks_var *var)
if (var->namelen > PLPKS_MAX_NAME_SIZE)
return -EINVAL;
+ if (var->policy & PLPKS_WRAPPINGKEY)
+ return -EINVAL;
+
auth = construct_auth(consumer);
if (IS_ERR(auth))
return PTR_ERR(auth);
@@ -845,8 +882,309 @@ static int plpks_read_var(u8 consumer, struct plpks_var *var)
}
/**
- * plpks_read_os_var() - Fetch the data for the specified variable that is
- * owned by the OS consumer.
+ * plpks_wrapping_is_supported() - Get the H_PKS_WRAP_OBJECT interface
+ * availability status for the LPAR.
+ *
+ * Successful execution of the H_PKS_GET_CONFIG HCALL during initialization
+ * sets bit 3 of the flags variable in the PLPKS config structure if the
+ * H_PKS_WRAP_OBJECT interface is supported.
+ *
+ * Returns: true if the H_PKS_WRAP_OBJECT interface is supported, false if not.
+ */
+bool plpks_wrapping_is_supported(void)
+{
+ return wrapsupport;
+}
+
+/**
+ * plpks_gen_wrapping_key() - Generate a new random key with the 'wrapping key'
+ * policy set.
+ *
+ * The H_PKS_GEN_KEY HCALL makes the hypervisor generate a new random key and
+ * store the key in a PLPKS object with the provided object label. With the
+ * 'wrapping key' policy set, only the label to the newly generated random key
+ * would be visible to the user.
+ *
+ * Possible reasons for the returned errno values:
+ *
+ * -ENXIO if PLPKS is not supported
+ * -EIO if PLPKS access is blocked due to the LPAR's state
+ * if PLPKS modification is blocked due to the LPAR's state
+ * if an error occurred while processing the request
+ * -EINVAL if invalid authorization parameter
+ * if invalid object label parameter
+ * if invalid object label len parameter
+ * if invalid or unsupported policy declaration
+ * if invalid output buffer parameter
+ * if invalid output buffer length parameter
+ * -EPERM if access is denied
+ * -ENOMEM if there is inadequate memory to perform this operation
+ * -EBUSY if unable to handle the request
+ * -EEXIST if the object label already exists
+ *
+ * Returns: On success 0 is returned, a negative errno if not.
+ */
+int plpks_gen_wrapping_key(void)
+{
+ unsigned long retbuf[PLPAR_HCALL_BUFSIZE] = { 0 };
+ struct plpks_auth *auth;
+ struct label *label;
+ int rc = 0, pseries_status = 0;
+ struct plpks_var var = {
+ .name = PLPKS_WRAPKEY_NAME,
+ .namelen = strlen(var.name),
+ .policy = PLPKS_WRAPPINGKEY,
+ .os = PLPKS_VAR_LINUX,
+ .component = PLPKS_WRAPKEY_COMPONENT
+ };
+
+ auth = construct_auth(PLPKS_OS_OWNER);
+ if (IS_ERR(auth))
+ return PTR_ERR(auth);
+
+ label = construct_label(var.component, var.os, var.name, var.namelen);
+ if (IS_ERR(label)) {
+ rc = PTR_ERR(label);
+ goto out;
+ }
+
+ rc = plpar_hcall(H_PKS_GEN_KEY, retbuf,
+ virt_to_phys(auth), virt_to_phys(label),
+ label->size, var.policy,
+ NULL, PLPKS_WRAPPING_KEY_LENGTH);
+
+ if (!rc)
+ rc = plpks_confirm_object_flushed(label, auth);
+
+ pseries_status = rc;
+ rc = pseries_status_to_err(rc);
+
+ if (rc && rc != -EEXIST) {
+ pr_err("H_PKS_GEN_KEY failed. pseries_status=%d, rc=%d",
+ pseries_status, rc);
+ } else {
+ rc = 0;
+ }
+
+ kfree(label);
+out:
+ kfree(auth);
+ return rc;
+}
+EXPORT_SYMBOL_GPL(plpks_gen_wrapping_key);
+
+/**
+ * plpks_wrap_object() - Wrap an object using the default wrapping key stored in
+ * the PLPKS.
+ * @input_buf: buffer containing the data to be wrapped
+ * @input_len: length of the input buffer
+ * @wrap_flags: object wrapping flags
+ * @output_buf: buffer to store the wrapped data
+ * @output_len: length of the output buffer
+ *
+ * The H_PKS_WRAP_OBJECT HCALL wraps an object using a wrapping key stored in
+ * the PLPKS and returns the wrapped object to the caller. The caller provides a
+ * label to the wrapping key with the 'wrapping key' policy set that must have
+ * been previously created with the H_PKS_GEN_KEY HCALL. The provided object is
+ * then encrypted with the wrapping key and additional metadata and the result
+ * is returned to the user. The metadata includes the wrapping algorithm and the
+ * wrapping key name so those parameters are not required during unwrap.
+ *
+ * Possible reasons for the returned errno values:
+ *
+ * -ENXIO if PLPKS is not supported
+ * -EIO if PLPKS access is blocked due to the LPAR's state
+ * if PLPKS modification is blocked due to the LPAR's state
+ * if an error occurred while processing the request
+ * -EINVAL if invalid authorization parameter
+ * if invalid wrapping key label parameter
+ * if invalid wrapping key label length parameter
+ * if invalid or unsupported object wrapping flags
+ * if invalid input buffer parameter
+ * if invalid input buffer length parameter
+ * if invalid output buffer parameter
+ * if invalid output buffer length parameter
+ * if invalid continue token parameter
+ * if the wrapping key is not compatible with the wrapping
+ * algorithm
+ * -EPERM if access is denied
+ * -ENOENT if the requested wrapping key was not found
+ * -EBUSY if unable to handle the request or long running operation
+ * initiated, retry later.
+ *
+ * Returns: On success 0 is returned, a negative errno if not.
+ */
+int plpks_wrap_object(u8 **input_buf, u32 input_len, u16 wrap_flags,
+ u8 **output_buf, u32 *output_len)
+{
+ unsigned long retbuf[PLPAR_HCALL9_BUFSIZE] = { 0 };
+ struct plpks_auth *auth;
+ struct label *label;
+ u64 continuetoken = 0;
+ u64 objwrapflags = 0;
+ int rc = 0, pseries_status = 0;
+ bool sb_audit_or_enforce_bit = wrap_flags & BIT(0);
+ bool sb_enforce_bit = wrap_flags & BIT(1);
+ struct plpks_var var = {
+ .name = PLPKS_WRAPKEY_NAME,
+ .namelen = strlen(var.name),
+ .os = PLPKS_VAR_LINUX,
+ .component = PLPKS_WRAPKEY_COMPONENT
+ };
+
+ auth = construct_auth(PLPKS_OS_OWNER);
+ if (IS_ERR(auth))
+ return PTR_ERR(auth);
+
+ label = construct_label(var.component, var.os, var.name, var.namelen);
+ if (IS_ERR(label)) {
+ rc = PTR_ERR(label);
+ goto out;
+ }
+
+ /* Set the consumer password requirement bit. A must have. */
+ objwrapflags |= WRAPFLAG_BE_BIT_SET(3);
+
+ /* Set the wrapping algorithm bit. Just one algorithm option for now */
+ objwrapflags |= WRAPFLAG_BE_FIELD_PREP(60, 63, 0x1);
+
+ if (sb_audit_or_enforce_bit & sb_enforce_bit) {
+ pr_err("Cannot set both audit/enforce and enforce bits.");
+ rc = -EINVAL;
+ goto out_free_label;
+ } else if (sb_audit_or_enforce_bit) {
+ objwrapflags |= WRAPFLAG_BE_BIT_SET(1);
+ } else if (sb_enforce_bit) {
+ objwrapflags |= WRAPFLAG_BE_BIT_SET(2);
+ }
+
+ *output_len = input_len + PLPKS_WRAPPING_BUF_DIFF;
+
+ *output_buf = kzalloc(ALIGN(*output_len, PLPKS_WRAPPING_BUF_ALIGN),
+ GFP_KERNEL);
+ if (!(*output_buf)) {
+ pr_err("Output buffer allocation failed. Returning -ENOMEM.");
+ rc = -ENOMEM;
+ goto out_free_label;
+ }
+
+ do {
+ rc = plpar_hcall9(H_PKS_WRAP_OBJECT, retbuf,
+ virt_to_phys(auth), virt_to_phys(label),
+ label->size, objwrapflags,
+ virt_to_phys(*input_buf), input_len,
+ virt_to_phys(*output_buf), *output_len,
+ continuetoken);
+
+ continuetoken = retbuf[0];
+ pseries_status = rc;
+ rc = pseries_status_to_err(rc);
+ } while (rc == -EBUSY);
+
+ if (rc) {
+ pr_err("H_PKS_WRAP_OBJECT failed. pseries_status=%d, rc=%d",
+ pseries_status, rc);
+ kfree(*output_buf);
+ *output_buf = NULL;
+ } else {
+ *output_len = retbuf[1];
+ }
+
+out_free_label:
+ kfree(label);
+out:
+ kfree(auth);
+ return rc;
+}
+EXPORT_SYMBOL_GPL(plpks_wrap_object);
+
+/**
+ * plpks_unwrap_object() - Unwrap an object using the default wrapping key
+ * stored in the PLPKS.
+ * @input_buf: buffer containing the data to be unwrapped
+ * @input_len: length of the input buffer
+ * @output_buf: buffer to store the unwrapped data
+ * @output_len: length of the output buffer
+ *
+ * The H_PKS_UNWRAP_OBJECT HCALL unwraps an object that was previously wrapped
+ * using the H_PKS_WRAP_OBJECT HCALL.
+ *
+ * Possible reasons for the returned errno values:
+ *
+ * -ENXIO if PLPKS is not supported
+ * -EIO if PLPKS access is blocked due to the LPAR's state
+ * if PLPKS modification is blocked due to the LPAR's state
+ * if an error occurred while processing the request
+ * -EINVAL if invalid authorization parameter
+ * if invalid or unsupported object unwrapping flags
+ * if invalid input buffer parameter
+ * if invalid input buffer length parameter
+ * if invalid output buffer parameter
+ * if invalid output buffer length parameter
+ * if invalid continue token parameter
+ * if the wrapping key is not compatible with the wrapping
+ * algorithm
+ * if the wrapped object's format is not supported
+ * if the wrapped object is invalid
+ * -EPERM if access is denied
+ * -ENOENT if the wrapping key for the provided object was not found
+ * -EBUSY if unable to handle the request or long running operation
+ * initiated, retry later.
+ *
+ * Returns: On success 0 is returned, a negative errno if not.
+ */
+int plpks_unwrap_object(u8 **input_buf, u32 input_len, u8 **output_buf,
+ u32 *output_len)
+{
+ unsigned long retbuf[PLPAR_HCALL9_BUFSIZE] = { 0 };
+ struct plpks_auth *auth;
+ u64 continuetoken = 0;
+ u64 objwrapflags = 0;
+ int rc = 0, pseries_status = 0;
+
+ auth = construct_auth(PLPKS_OS_OWNER);
+ if (IS_ERR(auth))
+ return PTR_ERR(auth);
+
+ *output_len = input_len - PLPKS_WRAPPING_BUF_DIFF;
+ *output_buf = kzalloc(ALIGN(*output_len, PLPKS_WRAPPING_BUF_ALIGN),
+ GFP_KERNEL);
+ if (!(*output_buf)) {
+ pr_err("Output buffer allocation failed. Returning -ENOMEM.");
+ rc = -ENOMEM;
+ goto out;
+ }
+
+ do {
+ rc = plpar_hcall9(H_PKS_UNWRAP_OBJECT, retbuf,
+ virt_to_phys(auth), objwrapflags,
+ virt_to_phys(*input_buf), input_len,
+ virt_to_phys(*output_buf), *output_len,
+ continuetoken);
+
+ continuetoken = retbuf[0];
+ pseries_status = rc;
+ rc = pseries_status_to_err(rc);
+ } while (rc == -EBUSY);
+
+ if (rc) {
+ pr_err("H_PKS_UNWRAP_OBJECT failed. pseries_status=%d, rc=%d",
+ pseries_status, rc);
+ kfree(*output_buf);
+ *output_buf = NULL;
+ } else {
+ *output_len = retbuf[1];
+ }
+
+out:
+ kfree(auth);
+ return rc;
+}
+EXPORT_SYMBOL_GPL(plpks_unwrap_object);
+
+/**
+ * plpks_read_os_var() - Fetch the data for the specified variable that is owned
+ * by the OS consumer.
* @var: variable to be read from the PLPKS
*
* The consumer or the owner of the object is the os kernel. The
--
2.47.3
^ permalink raw reply related
* [PATCH v4 2/6] powerpc/pseries: move the PLPKS config inside its own sysfs directory
From: Srish Srinivasan @ 2026-01-15 10:05 UTC (permalink / raw)
To: linux-integrity, keyrings, linuxppc-dev
Cc: maddy, mpe, npiggin, christophe.leroy, James.Bottomley, jarkko,
zohar, nayna, rnsastry, linux-kernel, linux-security-module,
ssrish
In-Reply-To: <20260115100504.488665-1-ssrish@linux.ibm.com>
The /sys/firmware/secvar/config directory represents Power LPAR Platform
KeyStore (PLPKS) configuration properties such as max_object_size, signed_
update_algorithms, supported_policies, total_size, used_space, and version.
These attributes describe the PLPKS, and not the secure boot variables
(secvars).
Create /sys/firmware/plpks directory and move the PLPKS config inside this
directory. For backwards compatibility, create a soft link from the secvar
sysfs directory to this config and emit a warning stating that the older
sysfs path has been deprecated. Separate out the plpks specific
documentation from secvar.
Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
Reviewed-by: Mimi Zohar <zohar@linux.ibm.com>
---
.../ABI/testing/sysfs-firmware-plpks | 50 ++++++++++
Documentation/ABI/testing/sysfs-secvar | 65 -------------
arch/powerpc/include/asm/plpks.h | 5 +
arch/powerpc/include/asm/secvar.h | 1 -
arch/powerpc/kernel/secvar-sysfs.c | 21 ++---
arch/powerpc/platforms/pseries/Makefile | 2 +-
arch/powerpc/platforms/pseries/plpks-secvar.c | 29 ------
arch/powerpc/platforms/pseries/plpks-sysfs.c | 94 +++++++++++++++++++
8 files changed, 156 insertions(+), 111 deletions(-)
create mode 100644 Documentation/ABI/testing/sysfs-firmware-plpks
create mode 100644 arch/powerpc/platforms/pseries/plpks-sysfs.c
diff --git a/Documentation/ABI/testing/sysfs-firmware-plpks b/Documentation/ABI/testing/sysfs-firmware-plpks
new file mode 100644
index 000000000000..af0353f34115
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-firmware-plpks
@@ -0,0 +1,50 @@
+What: /sys/firmware/plpks/config
+Date: February 2023
+Contact: Nayna Jain <nayna@linux.ibm.com>
+Description: This optional directory contains read-only config attributes as
+ defined by the PLPKS implementation. All data is in ASCII
+ format.
+
+What: /sys/firmware/plpks/config/version
+Date: February 2023
+Contact: Nayna Jain <nayna@linux.ibm.com>
+Description: Config version as reported by the hypervisor in ASCII decimal
+ format.
+
+What: /sys/firmware/plpks/config/max_object_size
+Date: February 2023
+Contact: Nayna Jain <nayna@linux.ibm.com>
+Description: Maximum allowed size of objects in the keystore in bytes,
+ represented in ASCII decimal format.
+
+ This is not necessarily the same as the max size that can be
+ written to an update file as writes can contain more than
+ object data, you should use the size of the update file for
+ that purpose.
+
+What: /sys/firmware/plpks/config/total_size
+Date: February 2023
+Contact: Nayna Jain <nayna@linux.ibm.com>
+Description: Total size of the PLPKS in bytes, represented in ASCII decimal
+ format.
+
+What: /sys/firmware/plpks/config/used_space
+Date: February 2023
+Contact: Nayna Jain <nayna@linux.ibm.com>
+Description: Current space consumed by the key store, in bytes, represented
+ in ASCII decimal format.
+
+What: /sys/firmware/plpks/config/supported_policies
+Date: February 2023
+Contact: Nayna Jain <nayna@linux.ibm.com>
+Description: Bitmask of supported policy flags by the hypervisor, represented
+ as an 8 byte hexadecimal ASCII string. Consult the hypervisor
+ documentation for what these flags are.
+
+What: /sys/firmware/plpks/config/signed_update_algorithms
+Date: February 2023
+Contact: Nayna Jain <nayna@linux.ibm.com>
+Description: Bitmask of flags indicating which algorithms the hypervisor
+ supports for signed update of objects, represented as a 16 byte
+ hexadecimal ASCII string. Consult the hypervisor documentation
+ for what these flags mean.
diff --git a/Documentation/ABI/testing/sysfs-secvar b/Documentation/ABI/testing/sysfs-secvar
index 1016967a730f..c52a5fd15709 100644
--- a/Documentation/ABI/testing/sysfs-secvar
+++ b/Documentation/ABI/testing/sysfs-secvar
@@ -63,68 +63,3 @@ Contact: Nayna Jain <nayna@linux.ibm.com>
Description: A write-only file that is used to submit the new value for the
variable. The size of the file represents the maximum size of
the variable data that can be written.
-
-What: /sys/firmware/secvar/config
-Date: February 2023
-Contact: Nayna Jain <nayna@linux.ibm.com>
-Description: This optional directory contains read-only config attributes as
- defined by the secure variable implementation. All data is in
- ASCII format. The directory is only created if the backing
- implementation provides variables to populate it, which at
- present is only PLPKS on the pseries platform.
-
-What: /sys/firmware/secvar/config/version
-Date: February 2023
-Contact: Nayna Jain <nayna@linux.ibm.com>
-Description: Config version as reported by the hypervisor in ASCII decimal
- format.
-
- Currently only provided by PLPKS on the pseries platform.
-
-What: /sys/firmware/secvar/config/max_object_size
-Date: February 2023
-Contact: Nayna Jain <nayna@linux.ibm.com>
-Description: Maximum allowed size of objects in the keystore in bytes,
- represented in ASCII decimal format.
-
- This is not necessarily the same as the max size that can be
- written to an update file as writes can contain more than
- object data, you should use the size of the update file for
- that purpose.
-
- Currently only provided by PLPKS on the pseries platform.
-
-What: /sys/firmware/secvar/config/total_size
-Date: February 2023
-Contact: Nayna Jain <nayna@linux.ibm.com>
-Description: Total size of the PLPKS in bytes, represented in ASCII decimal
- format.
-
- Currently only provided by PLPKS on the pseries platform.
-
-What: /sys/firmware/secvar/config/used_space
-Date: February 2023
-Contact: Nayna Jain <nayna@linux.ibm.com>
-Description: Current space consumed by the key store, in bytes, represented
- in ASCII decimal format.
-
- Currently only provided by PLPKS on the pseries platform.
-
-What: /sys/firmware/secvar/config/supported_policies
-Date: February 2023
-Contact: Nayna Jain <nayna@linux.ibm.com>
-Description: Bitmask of supported policy flags by the hypervisor,
- represented as an 8 byte hexadecimal ASCII string. Consult the
- hypervisor documentation for what these flags are.
-
- Currently only provided by PLPKS on the pseries platform.
-
-What: /sys/firmware/secvar/config/signed_update_algorithms
-Date: February 2023
-Contact: Nayna Jain <nayna@linux.ibm.com>
-Description: Bitmask of flags indicating which algorithms the hypervisor
- supports for signed update of objects, represented as a 16 byte
- hexadecimal ASCII string. Consult the hypervisor documentation
- for what these flags mean.
-
- Currently only provided by PLPKS on the pseries platform.
diff --git a/arch/powerpc/include/asm/plpks.h b/arch/powerpc/include/asm/plpks.h
index f303922bf622..8829a13bfda0 100644
--- a/arch/powerpc/include/asm/plpks.h
+++ b/arch/powerpc/include/asm/plpks.h
@@ -13,6 +13,7 @@
#include <linux/types.h>
#include <linux/list.h>
+#include <linux/kobject.h>
// Object policy flags from supported_policies
#define PLPKS_OSSECBOOTAUDIT PPC_BIT32(1) // OS secure boot must be audit/enforce
@@ -107,11 +108,15 @@ u16 plpks_get_passwordlen(void);
void plpks_early_init_devtree(void);
int plpks_populate_fdt(void *fdt);
+
+int plpks_config_create_softlink(struct kobject *from);
#else // CONFIG_PSERIES_PLPKS
static inline bool plpks_is_available(void) { return false; }
static inline u16 plpks_get_passwordlen(void) { BUILD_BUG(); }
static inline void plpks_early_init_devtree(void) { }
static inline int plpks_populate_fdt(void *fdt) { BUILD_BUG(); }
+static inline int plpks_config_create_softlink(struct kobject *from)
+ { return 0; }
#endif // CONFIG_PSERIES_PLPKS
#endif // _ASM_POWERPC_PLPKS_H
diff --git a/arch/powerpc/include/asm/secvar.h b/arch/powerpc/include/asm/secvar.h
index 4828e0ab7e3c..fd5006307f2a 100644
--- a/arch/powerpc/include/asm/secvar.h
+++ b/arch/powerpc/include/asm/secvar.h
@@ -20,7 +20,6 @@ struct secvar_operations {
int (*set)(const char *key, u64 key_len, u8 *data, u64 data_size);
ssize_t (*format)(char *buf, size_t bufsize);
int (*max_size)(u64 *max_size);
- const struct attribute **config_attrs;
// NULL-terminated array of fixed variable names
// Only used if get_next() isn't provided
diff --git a/arch/powerpc/kernel/secvar-sysfs.c b/arch/powerpc/kernel/secvar-sysfs.c
index ec900bce0257..4111b21962eb 100644
--- a/arch/powerpc/kernel/secvar-sysfs.c
+++ b/arch/powerpc/kernel/secvar-sysfs.c
@@ -12,6 +12,7 @@
#include <linux/string.h>
#include <linux/of.h>
#include <asm/secvar.h>
+#include <asm/plpks.h>
#define NAME_MAX_SIZE 1024
@@ -145,19 +146,6 @@ static __init int update_kobj_size(void)
return 0;
}
-static __init int secvar_sysfs_config(struct kobject *kobj)
-{
- struct attribute_group config_group = {
- .name = "config",
- .attrs = (struct attribute **)secvar_ops->config_attrs,
- };
-
- if (secvar_ops->config_attrs)
- return sysfs_create_group(kobj, &config_group);
-
- return 0;
-}
-
static __init int add_var(const char *name)
{
struct kobject *kobj;
@@ -260,12 +248,15 @@ static __init int secvar_sysfs_init(void)
goto err;
}
- rc = secvar_sysfs_config(secvar_kobj);
+ rc = plpks_config_create_softlink(secvar_kobj);
if (rc) {
- pr_err("Failed to create config directory\n");
+ pr_err("Failed to create softlink to PLPKS config directory");
goto err;
}
+ pr_info("/sys/firmware/secvar/config is now deprecated.\n");
+ pr_info("Will be removed in future versions.\n");
+
if (secvar_ops->get_next)
rc = secvar_sysfs_load();
else
diff --git a/arch/powerpc/platforms/pseries/Makefile b/arch/powerpc/platforms/pseries/Makefile
index 931ebaa474c8..3ced289a675b 100644
--- a/arch/powerpc/platforms/pseries/Makefile
+++ b/arch/powerpc/platforms/pseries/Makefile
@@ -30,7 +30,7 @@ obj-$(CONFIG_PAPR_SCM) += papr_scm.o
obj-$(CONFIG_PPC_SPLPAR) += vphn.o
obj-$(CONFIG_PPC_SVM) += svm.o
obj-$(CONFIG_FA_DUMP) += rtas-fadump.o
-obj-$(CONFIG_PSERIES_PLPKS) += plpks.o
+obj-$(CONFIG_PSERIES_PLPKS) += plpks.o plpks-sysfs.o
obj-$(CONFIG_PPC_SECURE_BOOT) += plpks-secvar.o
obj-$(CONFIG_PSERIES_PLPKS_SED) += plpks_sed_ops.o
obj-$(CONFIG_SUSPEND) += suspend.o
diff --git a/arch/powerpc/platforms/pseries/plpks-secvar.c b/arch/powerpc/platforms/pseries/plpks-secvar.c
index f9e9cc40c9d0..a50ff6943d80 100644
--- a/arch/powerpc/platforms/pseries/plpks-secvar.c
+++ b/arch/powerpc/platforms/pseries/plpks-secvar.c
@@ -20,33 +20,6 @@
#include <asm/secvar.h>
#include <asm/plpks.h>
-// Config attributes for sysfs
-#define PLPKS_CONFIG_ATTR(name, fmt, func) \
- static ssize_t name##_show(struct kobject *kobj, \
- struct kobj_attribute *attr, \
- char *buf) \
- { \
- return sysfs_emit(buf, fmt, func()); \
- } \
- static struct kobj_attribute attr_##name = __ATTR_RO(name)
-
-PLPKS_CONFIG_ATTR(version, "%u\n", plpks_get_version);
-PLPKS_CONFIG_ATTR(max_object_size, "%u\n", plpks_get_maxobjectsize);
-PLPKS_CONFIG_ATTR(total_size, "%u\n", plpks_get_totalsize);
-PLPKS_CONFIG_ATTR(used_space, "%u\n", plpks_get_usedspace);
-PLPKS_CONFIG_ATTR(supported_policies, "%08x\n", plpks_get_supportedpolicies);
-PLPKS_CONFIG_ATTR(signed_update_algorithms, "%016llx\n", plpks_get_signedupdatealgorithms);
-
-static const struct attribute *config_attrs[] = {
- &attr_version.attr,
- &attr_max_object_size.attr,
- &attr_total_size.attr,
- &attr_used_space.attr,
- &attr_supported_policies.attr,
- &attr_signed_update_algorithms.attr,
- NULL,
-};
-
static u32 get_policy(const char *name)
{
if ((strcmp(name, "db") == 0) ||
@@ -225,7 +198,6 @@ static const struct secvar_operations plpks_secvar_ops_static = {
.set = plpks_set_variable,
.format = plpks_secvar_format,
.max_size = plpks_max_size,
- .config_attrs = config_attrs,
.var_names = plpks_var_names_static,
};
@@ -234,7 +206,6 @@ static const struct secvar_operations plpks_secvar_ops_dynamic = {
.set = plpks_set_variable,
.format = plpks_secvar_format,
.max_size = plpks_max_size,
- .config_attrs = config_attrs,
.var_names = plpks_var_names_dynamic,
};
diff --git a/arch/powerpc/platforms/pseries/plpks-sysfs.c b/arch/powerpc/platforms/pseries/plpks-sysfs.c
new file mode 100644
index 000000000000..01d526185783
--- /dev/null
+++ b/arch/powerpc/platforms/pseries/plpks-sysfs.c
@@ -0,0 +1,94 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2025 IBM Corporation, Srish Srinivasan <ssrish@linux.ibm.com>
+ *
+ * This code exposes PLPKS config to user via sysfs
+ */
+
+#define pr_fmt(fmt) "plpks-sysfs: "fmt
+
+#include <linux/init.h>
+#include <linux/printk.h>
+#include <linux/types.h>
+#include <asm/machdep.h>
+#include <asm/plpks.h>
+
+/* config attributes for sysfs */
+#define PLPKS_CONFIG_ATTR(name, fmt, func) \
+ static ssize_t name##_show(struct kobject *kobj, \
+ struct kobj_attribute *attr, \
+ char *buf) \
+ { \
+ return sysfs_emit(buf, fmt, func()); \
+ } \
+ static struct kobj_attribute attr_##name = __ATTR_RO(name)
+
+PLPKS_CONFIG_ATTR(version, "%u\n", plpks_get_version);
+PLPKS_CONFIG_ATTR(max_object_size, "%u\n", plpks_get_maxobjectsize);
+PLPKS_CONFIG_ATTR(total_size, "%u\n", plpks_get_totalsize);
+PLPKS_CONFIG_ATTR(used_space, "%u\n", plpks_get_usedspace);
+PLPKS_CONFIG_ATTR(supported_policies, "%08x\n", plpks_get_supportedpolicies);
+PLPKS_CONFIG_ATTR(signed_update_algorithms, "%016llx\n",
+ plpks_get_signedupdatealgorithms);
+
+static const struct attribute *config_attrs[] = {
+ &attr_version.attr,
+ &attr_max_object_size.attr,
+ &attr_total_size.attr,
+ &attr_used_space.attr,
+ &attr_supported_policies.attr,
+ &attr_signed_update_algorithms.attr,
+ NULL,
+};
+
+static struct kobject *plpks_kobj, *plpks_config_kobj;
+
+int plpks_config_create_softlink(struct kobject *from)
+{
+ if (!plpks_config_kobj)
+ return -EINVAL;
+ return sysfs_create_link(from, plpks_config_kobj, "config");
+}
+
+static __init int plpks_sysfs_config(struct kobject *kobj)
+{
+ struct attribute_group config_group = {
+ .name = NULL,
+ .attrs = (struct attribute **)config_attrs,
+ };
+
+ return sysfs_create_group(kobj, &config_group);
+}
+
+static __init int plpks_sysfs_init(void)
+{
+ int rc;
+
+ if (!plpks_is_available())
+ return -ENODEV;
+
+ plpks_kobj = kobject_create_and_add("plpks", firmware_kobj);
+ if (!plpks_kobj) {
+ pr_err("Failed to create plpks kobj\n");
+ return -ENOMEM;
+ }
+
+ plpks_config_kobj = kobject_create_and_add("config", plpks_kobj);
+ if (!plpks_config_kobj) {
+ pr_err("Failed to create plpks config kobj\n");
+ kobject_put(plpks_kobj);
+ return -ENOMEM;
+ }
+
+ rc = plpks_sysfs_config(plpks_config_kobj);
+ if (rc) {
+ pr_err("Failed to create attribute group for plpks config\n");
+ kobject_put(plpks_config_kobj);
+ kobject_put(plpks_kobj);
+ return rc;
+ }
+
+ return 0;
+}
+
+machine_subsys_initcall(pseries, plpks_sysfs_init);
--
2.47.3
^ permalink raw reply related
* [PATCH v4 3/6] pseries/plpks: expose PowerVM wrapping features via the sysfs
From: Srish Srinivasan @ 2026-01-15 10:05 UTC (permalink / raw)
To: linux-integrity, keyrings, linuxppc-dev
Cc: maddy, mpe, npiggin, christophe.leroy, James.Bottomley, jarkko,
zohar, nayna, rnsastry, linux-kernel, linux-security-module,
ssrish
In-Reply-To: <20260115100504.488665-1-ssrish@linux.ibm.com>
Starting with Power11, PowerVM supports a new feature called "Key Wrapping"
that protects user secrets by wrapping them using a hypervisor generated
wrapping key. The status of this feature can be read by the
H_PKS_GET_CONFIG HCALL.
Expose the Power LPAR Platform KeyStore (PLPKS) wrapping features config
via the sysfs file /sys/firmware/plpks/config/wrapping_features.
Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
---
.../ABI/testing/sysfs-firmware-plpks | 8 ++++++++
arch/powerpc/include/asm/hvcall.h | 4 +++-
arch/powerpc/include/asm/plpks.h | 3 +++
arch/powerpc/platforms/pseries/plpks-sysfs.c | 2 ++
arch/powerpc/platforms/pseries/plpks.c | 20 +++++++++++++++++++
5 files changed, 36 insertions(+), 1 deletion(-)
diff --git a/Documentation/ABI/testing/sysfs-firmware-plpks b/Documentation/ABI/testing/sysfs-firmware-plpks
index af0353f34115..cba061e4eee2 100644
--- a/Documentation/ABI/testing/sysfs-firmware-plpks
+++ b/Documentation/ABI/testing/sysfs-firmware-plpks
@@ -48,3 +48,11 @@ Description: Bitmask of flags indicating which algorithms the hypervisor
supports for signed update of objects, represented as a 16 byte
hexadecimal ASCII string. Consult the hypervisor documentation
for what these flags mean.
+
+What: /sys/firmware/plpks/config/wrapping_features
+Date: November 2025
+Contact: Srish Srinivasan <ssrish@linux.ibm.com>
+Description: Bitmask of the wrapping features indicating the wrapping
+ algorithms that are supported for the H_PKS_WRAP_OBJECT requests
+ , represented as a 8 byte hexadecimal ASCII string. Consult the
+ hypervisor documentation for what these flags mean.
diff --git a/arch/powerpc/include/asm/hvcall.h b/arch/powerpc/include/asm/hvcall.h
index 9aef16149d92..dff90a7d7f70 100644
--- a/arch/powerpc/include/asm/hvcall.h
+++ b/arch/powerpc/include/asm/hvcall.h
@@ -360,7 +360,9 @@
#define H_GUEST_RUN_VCPU 0x480
#define H_GUEST_COPY_MEMORY 0x484
#define H_GUEST_DELETE 0x488
-#define MAX_HCALL_OPCODE H_GUEST_DELETE
+#define H_PKS_WRAP_OBJECT 0x490
+#define H_PKS_UNWRAP_OBJECT 0x494
+#define MAX_HCALL_OPCODE H_PKS_UNWRAP_OBJECT
/* Scope args for H_SCM_UNBIND_ALL */
#define H_UNBIND_SCOPE_ALL (0x1)
diff --git a/arch/powerpc/include/asm/plpks.h b/arch/powerpc/include/asm/plpks.h
index 8829a13bfda0..8f034588fdf7 100644
--- a/arch/powerpc/include/asm/plpks.h
+++ b/arch/powerpc/include/asm/plpks.h
@@ -23,6 +23,7 @@
#define PLPKS_IMMUTABLE PPC_BIT32(5) // Once written, object cannot be removed
#define PLPKS_TRANSIENT PPC_BIT32(6) // Object does not persist through reboot
#define PLPKS_SIGNEDUPDATE PPC_BIT32(7) // Object can only be modified by signed updates
+#define PLPKS_WRAPPINGKEY PPC_BIT32(8) // Object contains a wrapping key
#define PLPKS_HVPROVISIONED PPC_BIT32(28) // Hypervisor has provisioned this object
// Signature algorithm flags from signed_update_algorithms
@@ -103,6 +104,8 @@ u32 plpks_get_maxlargeobjectsize(void);
u64 plpks_get_signedupdatealgorithms(void);
+u64 plpks_get_wrappingfeatures(void);
+
u16 plpks_get_passwordlen(void);
void plpks_early_init_devtree(void);
diff --git a/arch/powerpc/platforms/pseries/plpks-sysfs.c b/arch/powerpc/platforms/pseries/plpks-sysfs.c
index 01d526185783..c2ebcbb41ae3 100644
--- a/arch/powerpc/platforms/pseries/plpks-sysfs.c
+++ b/arch/powerpc/platforms/pseries/plpks-sysfs.c
@@ -30,6 +30,7 @@ PLPKS_CONFIG_ATTR(used_space, "%u\n", plpks_get_usedspace);
PLPKS_CONFIG_ATTR(supported_policies, "%08x\n", plpks_get_supportedpolicies);
PLPKS_CONFIG_ATTR(signed_update_algorithms, "%016llx\n",
plpks_get_signedupdatealgorithms);
+PLPKS_CONFIG_ATTR(wrapping_features, "%016llx\n", plpks_get_wrappingfeatures);
static const struct attribute *config_attrs[] = {
&attr_version.attr,
@@ -38,6 +39,7 @@ static const struct attribute *config_attrs[] = {
&attr_used_space.attr,
&attr_supported_policies.attr,
&attr_signed_update_algorithms.attr,
+ &attr_wrapping_features.attr,
NULL,
};
diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c
index 03722fabf9c3..4a08f51537c8 100644
--- a/arch/powerpc/platforms/pseries/plpks.c
+++ b/arch/powerpc/platforms/pseries/plpks.c
@@ -38,6 +38,7 @@ static u32 usedspace;
static u32 supportedpolicies;
static u32 maxlargeobjectsize;
static u64 signedupdatealgorithms;
+static u64 wrappingfeatures;
struct plpks_auth {
u8 version;
@@ -248,6 +249,7 @@ static int _plpks_get_config(void)
__be32 supportedpolicies;
__be32 maxlargeobjectsize;
__be64 signedupdatealgorithms;
+ __be64 wrappingfeatures;
u8 rsvd1[476];
} __packed * config;
size_t size;
@@ -280,6 +282,7 @@ static int _plpks_get_config(void)
supportedpolicies = be32_to_cpu(config->supportedpolicies);
maxlargeobjectsize = be32_to_cpu(config->maxlargeobjectsize);
signedupdatealgorithms = be64_to_cpu(config->signedupdatealgorithms);
+ wrappingfeatures = be64_to_cpu(config->wrappingfeatures);
// Validate that the numbers we get back match the requirements of the spec
if (maxpwsize < 32) {
@@ -472,6 +475,23 @@ u64 plpks_get_signedupdatealgorithms(void)
return signedupdatealgorithms;
}
+/**
+ * plpks_get_wrappingfeatures() - Returns a bitmask of the wrapping features
+ * supported by the hypervisor.
+ *
+ * Successful execution of the H_PKS_GET_CONFIG HCALL during initialization
+ * reads a bitmask of the wrapping features supported by the hypervisor into the
+ * file local static wrappingfeatures variable. This is valid only when the
+ * PLPKS config structure version >= 3.
+ *
+ * Return:
+ * bitmask of the wrapping features supported by the hypervisor
+ */
+u64 plpks_get_wrappingfeatures(void)
+{
+ return wrappingfeatures;
+}
+
/**
* plpks_get_passwordlen() - Get the length of the PLPKS password in bytes.
*
--
2.47.3
^ permalink raw reply related
* [PATCH v4 1/6] pseries/plpks: fix kernel-doc comment inconsistencies
From: Srish Srinivasan @ 2026-01-15 10:04 UTC (permalink / raw)
To: linux-integrity, keyrings, linuxppc-dev
Cc: maddy, mpe, npiggin, christophe.leroy, James.Bottomley, jarkko,
zohar, nayna, rnsastry, linux-kernel, linux-security-module,
ssrish
In-Reply-To: <20260115100504.488665-1-ssrish@linux.ibm.com>
Fix issues with comments for all the applicable functions to be
consistent with kernel-doc format. Move them before the function
definition as opposed to the function prototype.
Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
---
arch/powerpc/include/asm/plpks.h | 77 ------
arch/powerpc/platforms/pseries/plpks.c | 328 ++++++++++++++++++++++++-
2 files changed, 318 insertions(+), 87 deletions(-)
diff --git a/arch/powerpc/include/asm/plpks.h b/arch/powerpc/include/asm/plpks.h
index 7a84069759b0..f303922bf622 100644
--- a/arch/powerpc/include/asm/plpks.h
+++ b/arch/powerpc/include/asm/plpks.h
@@ -67,122 +67,45 @@ struct plpks_var_name_list {
struct plpks_var_name varlist[];
};
-/**
- * Updates the authenticated variable. It expects NULL as the component.
- */
int plpks_signed_update_var(struct plpks_var *var, u64 flags);
-/**
- * Writes the specified var and its data to PKS.
- * Any caller of PKS driver should present a valid component type for
- * their variable.
- */
int plpks_write_var(struct plpks_var var);
-/**
- * Removes the specified var and its data from PKS.
- */
int plpks_remove_var(char *component, u8 varos,
struct plpks_var_name vname);
-/**
- * Returns the data for the specified os variable.
- *
- * Caller must allocate a buffer in var->data with length in var->datalen.
- * If no buffer is provided, var->datalen will be populated with the object's
- * size.
- */
int plpks_read_os_var(struct plpks_var *var);
-/**
- * Returns the data for the specified firmware variable.
- *
- * Caller must allocate a buffer in var->data with length in var->datalen.
- * If no buffer is provided, var->datalen will be populated with the object's
- * size.
- */
int plpks_read_fw_var(struct plpks_var *var);
-/**
- * Returns the data for the specified bootloader variable.
- *
- * Caller must allocate a buffer in var->data with length in var->datalen.
- * If no buffer is provided, var->datalen will be populated with the object's
- * size.
- */
int plpks_read_bootloader_var(struct plpks_var *var);
-/**
- * Returns if PKS is available on this LPAR.
- */
bool plpks_is_available(void);
-/**
- * Returns version of the Platform KeyStore.
- */
u8 plpks_get_version(void);
-/**
- * Returns hypervisor storage overhead per object, not including the size of
- * the object or label. Only valid for config version >= 2
- */
u16 plpks_get_objoverhead(void);
-/**
- * Returns maximum password size. Must be >= 32 bytes
- */
u16 plpks_get_maxpwsize(void);
-/**
- * Returns maximum object size supported by Platform KeyStore.
- */
u16 plpks_get_maxobjectsize(void);
-/**
- * Returns maximum object label size supported by Platform KeyStore.
- */
u16 plpks_get_maxobjectlabelsize(void);
-/**
- * Returns total size of the configured Platform KeyStore.
- */
u32 plpks_get_totalsize(void);
-/**
- * Returns used space from the total size of the Platform KeyStore.
- */
u32 plpks_get_usedspace(void);
-/**
- * Returns bitmask of policies supported by the hypervisor.
- */
u32 plpks_get_supportedpolicies(void);
-/**
- * Returns maximum byte size of a single object supported by the hypervisor.
- * Only valid for config version >= 3
- */
u32 plpks_get_maxlargeobjectsize(void);
-/**
- * Returns bitmask of signature algorithms supported for signed updates.
- * Only valid for config version >= 3
- */
u64 plpks_get_signedupdatealgorithms(void);
-/**
- * Returns the length of the PLPKS password in bytes.
- */
u16 plpks_get_passwordlen(void);
-/**
- * Called in early init to retrieve and clear the PLPKS password from the DT.
- */
void plpks_early_init_devtree(void);
-/**
- * Populates the FDT with the PLPKS password to prepare for kexec.
- */
int plpks_populate_fdt(void *fdt);
#else // CONFIG_PSERIES_PLPKS
static inline bool plpks_is_available(void) { return false; }
diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c
index b1667ed05f98..03722fabf9c3 100644
--- a/arch/powerpc/platforms/pseries/plpks.c
+++ b/arch/powerpc/platforms/pseries/plpks.c
@@ -312,40 +312,107 @@ static int _plpks_get_config(void)
return rc;
}
+/**
+ * plpks_get_version() - Get the version of the PLPKS config structure.
+ *
+ * Successful execution of the H_PKS_GET_CONFIG HCALL during initialization
+ * reads the PLPKS config structure version and saves it in a file local static
+ * version variable.
+ *
+ * Returns: On success the saved PLPKS config structure version is returned, 0
+ * if not.
+ */
u8 plpks_get_version(void)
{
return version;
}
+/**
+ * plpks_get_objoverhead() - Get the hypervisor storage overhead per object.
+ *
+ * Successful execution of the H_PKS_GET_CONFIG HCALL during initialization
+ * reads the per object hypervisor storage overhead in bytes into the local
+ * static objoverhead variable, excluding the size of the object or the label.
+ * This value can be treated as valid only when the PLPKS config structure
+ * version >= 2.
+ *
+ * Returns: If PLPKS config structure version >= 2 then the storage overhead is
+ * returned, 0 otherwise.
+ */
u16 plpks_get_objoverhead(void)
{
return objoverhead;
}
+/**
+ * plpks_get_maxpwsize() - Get the maximum password size.
+ *
+ * Successful execution of the H_PKS_GET_CONFIG HCALL during initialization
+ * reads the maximum password size and checks if it is 32 bytes at the least
+ * before storing it in the local static maxpwsize variable.
+ *
+ * Returns: On success the maximum password size is returned, 0 if not.
+ */
u16 plpks_get_maxpwsize(void)
{
return maxpwsize;
}
+/**
+ * plpks_get_maxobjectsize() - Get the maximum object size supported by the
+ * PLPKS.
+ *
+ * Successful execution of the H_PKS_GET_CONFIG HCALL during initialization
+ * reads the maximum object size into the file local static maxobjsize variable.
+ *
+ * Returns: On success the maximum object size is returned, 0 if not.
+ */
u16 plpks_get_maxobjectsize(void)
{
return maxobjsize;
}
+/**
+ * plpks_get_maxobjectlabelsize() - Get the maximum object label size supported
+ * by the PLPKS.
+ *
+ * Successful execution of the H_PKS_GET_CONFIG HCALL during initialization
+ * reads the maximum object label size into the local static maxobjlabelsize
+ * variable.
+ *
+ * Returns: On success the maximum object label size is returned, 0 if not.
+ */
u16 plpks_get_maxobjectlabelsize(void)
{
return maxobjlabelsize;
}
+/**
+ * plpks_get_totalsize() - Get the total size of the PLPKS that is configured.
+ *
+ * Successful execution of the H_PKS_GET_CONFIG HCALL during initialization
+ * reads the total size of the PLPKS that is configured for the LPAR into the
+ * file local static totalsize variable.
+ *
+ * Returns: On success the total size of the PLPKS configured is returned, 0 if
+ * not.
+ */
u32 plpks_get_totalsize(void)
{
return totalsize;
}
+/**
+ * plpks_get_usedspace() - Get the used space from the total size of the PLPKS.
+ *
+ * Invoke the H_PKS_GET_CONFIG HCALL to refresh the latest value for the used
+ * space as this keeps changing with the creation and removal of objects in the
+ * PLPKS.
+ *
+ * Returns: On success the used space is returned, 0 if not.
+ */
u32 plpks_get_usedspace(void)
{
- // Unlike other config values, usedspace regularly changes as objects
- // are updated, so we need to refresh.
int rc = _plpks_get_config();
if (rc) {
pr_err("Couldn't get config, rc: %d\n", rc);
@@ -354,26 +421,84 @@ u32 plpks_get_usedspace(void)
return usedspace;
}
+/**
+ * plpks_get_supportedpolicies() - Get a bitmask of the policies supported by
+ * the hypervisor.
+ *
+ * Successful execution of the H_PKS_GET_CONFIG HCALL during initialization
+ * reads a bitmask of the policies supported by the hypervisor into the file
+ * local static supportedpolicies variable.
+ *
+ * Returns: On success the bitmask of the policies supported by the hypervisor
+ * are returned, 0 if not.
+ */
u32 plpks_get_supportedpolicies(void)
{
return supportedpolicies;
}
+/**
+ * plpks_get_maxlargeobjectsize() - Get the maximum object size supported for
+ * PLPKS config structure version >= 3
+ *
+ * Successful execution of the H_PKS_GET_CONFIG HCALL during initialization
+ * reads the maximum object size into the local static maxlargeobjectsize
+ * variable for PLPKS config structure version >= 3. This was introduced
+ * starting with PLPKS config structure version 3 to allow for objects of
+ * size >= 64K.
+ *
+ * Returns: If PLPKS config structure version >= 3 then the new maximum object
+ * size is returned, 0 if not.
+ */
u32 plpks_get_maxlargeobjectsize(void)
{
return maxlargeobjectsize;
}
+/**
+ * plpks_get_signedupdatealgorithms() - Get a bitmask of the signature
+ * algorithms supported for signed updates.
+ *
+ * Successful execution of the H_PKS_GET_CONFIG HCALL during initialization
+ * reads a bitmask of the signature algorithms supported for signed updates into
+ * the file local static signedupdatealgorithms variable. This is valid only
+ * when the PLPKS config structure version >= 3.
+ *
+ * Returns: On success the bitmask of the signature algorithms supported for
+ * signed updates is returned, 0 if not.
+ */
u64 plpks_get_signedupdatealgorithms(void)
{
return signedupdatealgorithms;
}
+/**
+ * plpks_get_passwordlen() - Get the length of the PLPKS password in bytes.
+ *
+ * The H_PKS_GEN_PASSWORD HCALL makes the hypervisor generate a random password
+ * for the specified consumer, apply that password to the PLPKS and return it to
+ * the caller. In this process, the password length for the OS consumer is
+ * stored in the local static ospasswordlength variable.
+ *
+ * Returns: On success the password length for the OS consumer in bytes is
+ * returned, 0 if not.
+ */
u16 plpks_get_passwordlen(void)
{
return ospasswordlength;
}
+/**
+ * plpks_is_available() - Get the PLPKS availability status for the LPAR.
+ *
+ * The availability of PLPKS is inferred based upon the successful execution of
+ * the H_PKS_GET_CONFIG HCALL provided the firmware supports this feature. The
+ * H_PKS_GET_CONFIG HCALL reads the configuration and status information related
+ * to the PLPKS. The configuration structure provides a version number to inform
+ * the caller of the supported features.
+ *
+ * Returns: true is returned if PLPKS is available, false if not.
+ */
bool plpks_is_available(void)
{
int rc;
@@ -425,6 +550,35 @@ static int plpks_confirm_object_flushed(struct label *label,
return pseries_status_to_err(rc);
}
+/**
+ * plpks_signed_update_var() - Update the specified authenticated variable.
+ * @var: authenticated variable to be updated
+ * @flags: signed update request operation flags
+ *
+ * The H_PKS_SIGNED_UPDATE HCALL performs a signed update to an object in the
+ * PLPKS. The object must have the signed update policy flag set.
+ *
+ * Possible reasons for the returned errno values:
+ *
+ * -ENXIO if PLPKS is not supported
+ * -EIO if PLPKS access is blocked due to the LPAR's state
+ * if PLPKS modification is blocked due to the LPAR's state
+ * if an error occurred while processing the request
+ * -EINVAL if invalid authorization parameter
+ * if invalid object label parameter
+ * if invalid object label len parameter
+ * if invalid or unsupported policy declaration
+ * if invalid signed update flags
+ * if invalid input data parameter
+ * if invalid input data len parameter
+ * if invalid continue token parameter
+ * -EPERM if access is denied
+ * -ENOMEM if there is inadequate memory to perform the operation
+ * -EBUSY if unable to handle the request or long running operation
+ * initiated, retry later
+ *
+ * Returns: On success 0 is returned, a negative errno if not.
+ */
int plpks_signed_update_var(struct plpks_var *var, u64 flags)
{
unsigned long retbuf[PLPAR_HCALL9_BUFSIZE] = {0};
@@ -481,6 +635,33 @@ int plpks_signed_update_var(struct plpks_var *var, u64 flags)
return rc;
}
+/**
+ * plpks_write_var() - Write the specified variable and its data to PLPKS.
+ * @var: variable to be written into the PLPKS
+ *
+ * The H_PKS_WRITE_OBJECT HCALL writes an object into the PLPKS. The caller must
+ * provide a valid component type for the variable, and the signed update policy
+ * flag must not be set.
+ *
+ * Possible reasons for the returned errno values:
+ *
+ * -ENXIO if PLPKS is not supported
+ * -EIO if PLPKS access is blocked due to the LPAR's state
+ * if PLPKS modification is blocked due to the LPAR's state
+ * if an error occurred while processing the request
+ * -EINVAL if invalid authorization parameter
+ * if invalid object label parameter
+ * if invalid object label len parameter
+ * if invalid or unsupported policy declaration
+ * if invalid input data parameter
+ * if invalid input data len parameter
+ * -EPERM if access is denied
+ * -ENOMEM if unable to store the requested object in the space available
+ * -EBUSY if unable to handle the request
+ * -EEXIST if the object label already exists
+ *
+ * Returns: On success 0 is returned, a negative errno if not.
+ */
int plpks_write_var(struct plpks_var var)
{
unsigned long retbuf[PLPAR_HCALL_BUFSIZE] = { 0 };
@@ -520,6 +701,30 @@ int plpks_write_var(struct plpks_var var)
return rc;
}
+/**
+ * plpks_remove_var() - Remove the specified variable and its data from PLPKS.
+ * @component: metadata prefix in the object label metadata structure
+ * @varos: metadata OS flags in the object label metadata structure
+ * @vname: object label for the object that needs to be removed
+ *
+ * The H_PKS_REMOVE_OBJECT HCALL removes an object from the PLPKS. The removal
+ * is independent of the policy bits that are set.
+ *
+ * Possible reasons for the returned errno values:
+ *
+ * -ENXIO if PLPKS is not supported
+ * -EIO if PLPKS access is blocked due to the LPAR's state
+ * if PLPKS modification is blocked due to the LPAR's state
+ * if an error occurred while processing the request
+ * -EINVAL if invalid authorization parameter
+ * if invalid object label parameter
+ * if invalid object label len parameter
+ * -EPERM if access is denied
+ * -ENOENT if the requested object was not found
+ * -EBUSY if unable to handle the request
+ *
+ * Returns: On success 0 is returned, a negative errno if not.
+ */
int plpks_remove_var(char *component, u8 varos, struct plpks_var_name vname)
{
unsigned long retbuf[PLPAR_HCALL_BUFSIZE] = { 0 };
@@ -619,21 +824,119 @@ static int plpks_read_var(u8 consumer, struct plpks_var *var)
return rc;
}
+/**
+ * plpks_read_os_var() - Fetch the data for the specified variable that is
+ * owned by the OS consumer.
+ * @var: variable to be read from the PLPKS
+ *
+ * The consumer or the owner of the object is the os kernel. The
+ * H_PKS_READ_OBJECT HCALL reads an object from the PLPKS. The caller must
+ * allocate the buffer var->data and specify the length for this buffer in
+ * var->datalen. If no buffer is provided, var->datalen will be populated with
+ * the requested object's size.
+ *
+ * Possible reasons for the returned errno values:
+ *
+ * -ENXIO if PLPKS is not supported
+ * -EIO if PLPKS access is blocked due to the LPAR's state
+ * if an error occurred while processing the request
+ * -EINVAL if invalid authorization parameter
+ * if invalid object label parameter
+ * if invalid object label len parameter
+ * if invalid output data parameter
+ * if invalid output data len parameter
+ * -EPERM if access is denied
+ * -ENOENT if the requested object was not found
+ * -EFBIG if the requested object couldn't be
+ * stored in the buffer provided
+ * -EBUSY if unable to handle the request
+ *
+ * Returns: On success 0 is returned, a negative errno if not.
+ */
int plpks_read_os_var(struct plpks_var *var)
{
return plpks_read_var(PLPKS_OS_OWNER, var);
}
+/**
+ * plpks_read_fw_var() - Fetch the data for the specified variable that is
+ * owned by the firmware consumer.
+ * @var: variable to be read from the PLPKS
+ *
+ * The consumer or the owner of the object is the firmware. The
+ * H_PKS_READ_OBJECT HCALL reads an object from the PLPKS. The caller must
+ * allocate the buffer var->data and specify the length for this buffer in
+ * var->datalen. If no buffer is provided, var->datalen will be populated with
+ * the requested object's size.
+ *
+ * Possible reasons for the returned errno values:
+ *
+ * -ENXIO if PLPKS is not supported
+ * -EIO if PLPKS access is blocked due to the LPAR's state
+ * if an error occurred while processing the request
+ * -EINVAL if invalid authorization parameter
+ * if invalid object label parameter
+ * if invalid object label len parameter
+ * if invalid output data parameter
+ * if invalid output data len parameter
+ * -EPERM if access is denied
+ * -ENOENT if the requested object was not found
+ * -EFBIG if the requested object couldn't be
+ * stored in the buffer provided
+ * -EBUSY if unable to handle the request
+ *
+ * Returns: On success 0 is returned, a negative errno if not.
+ */
int plpks_read_fw_var(struct plpks_var *var)
{
return plpks_read_var(PLPKS_FW_OWNER, var);
}
+/**
+ * plpks_read_bootloader_var() - Fetch the data for the specified variable
+ * owned by the bootloader consumer.
+ * @var: variable to be read from the PLPKS
+ *
+ * The consumer or the owner of the object is the bootloader. The
+ * H_PKS_READ_OBJECT HCALL reads an object from the PLPKS. The caller must
+ * allocate the buffer var->data and specify the length for this buffer in
+ * var->datalen. If no buffer is provided, var->datalen will be populated with
+ * the requested object's size.
+ *
+ * Possible reasons for the returned errno values:
+ *
+ * -ENXIO if PLPKS is not supported
+ * -EIO if PLPKS access is blocked due to the LPAR's state
+ * if an error occurred while processing the request
+ * -EINVAL if invalid authorization parameter
+ * if invalid object label parameter
+ * if invalid object label len parameter
+ * if invalid output data parameter
+ * if invalid output data len parameter
+ * -EPERM if access is denied
+ * -ENOENT if the requested object was not found
+ * -EFBIG if the requested object couldn't be
+ * stored in the buffer provided
+ * -EBUSY if unable to handle the request
+ *
+ * Returns: On success 0 is returned, a negative errno if not.
+ */
int plpks_read_bootloader_var(struct plpks_var *var)
{
return plpks_read_var(PLPKS_BOOTLOADER_OWNER, var);
}
+/**
+ * plpks_populate_fdt(): Populates the FDT with the PLPKS password to prepare
+ * for kexec.
+ * @fdt: pointer to the device tree blob
+ *
+ * Upon confirming the existence of the chosen node, invoke fdt_setprop to
+ * populate the device tree with the PLPKS password in order to prepare for
+ * kexec.
+ *
+ * Returns: On success 0 is returned, a negative value if not.
+ */
int plpks_populate_fdt(void *fdt)
{
int chosen_offset = fdt_path_offset(fdt, "/chosen");
@@ -647,14 +950,19 @@ int plpks_populate_fdt(void *fdt)
return fdt_setprop(fdt, chosen_offset, "ibm,plpks-pw", ospassword, ospasswordlength);
}
-// Once a password is registered with the hypervisor it cannot be cleared without
-// rebooting the LPAR, so to keep using the PLPKS across kexec boots we need to
-// recover the previous password from the FDT.
-//
-// There are a few challenges here. We don't want the password to be visible to
-// users, so we need to clear it from the FDT. This has to be done in early boot.
-// Clearing it from the FDT would make the FDT's checksum invalid, so we have to
-// manually cause the checksum to be recalculated.
+/**
+ * plpks_early_init_devtree() - Retrieves and clears the PLPKS password from the
+ * DT in early init.
+ *
+ * Once a password is registered with the hypervisor it cannot be cleared
+ * without rebooting the LPAR, so to keep using the PLPKS across kexec boots we
+ * need to recover the previous password from the FDT.
+ *
+ * There are a few challenges here. We don't want the password to be visible to
+ * users, so we need to clear it from the FDT. This has to be done in early
+ * boot. Clearing it from the FDT would make the FDT's checksum invalid, so we
+ * have to manually cause the checksum to be recalculated.
+ */
void __init plpks_early_init_devtree(void)
{
void *fdt = initial_boot_params;
--
2.47.3
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox