1 // SPDX-License-Identifier: GPL-2.0-only
3 * POWER LPAR Platform KeyStore(PLPKS)
4 * Copyright (C) 2022 IBM Corporation
5 * Author: Nayna Jain <nayna@linux.ibm.com>
7 * Provides access to variables stored in Power LPAR Platform KeyStore(PLPKS).
10 #define pr_fmt(fmt) "plpks: " fmt
12 #include <linux/delay.h>
13 #include <linux/errno.h>
15 #include <linux/printk.h>
16 #include <linux/slab.h>
17 #include <linux/string.h>
18 #include <linux/types.h>
19 #include <linux/of_fdt.h>
20 #include <linux/libfdt.h>
21 #include <linux/memblock.h>
22 #include <asm/hvcall.h>
23 #include <asm/machdep.h>
24 #include <asm/plpks.h>
25 #include <asm/firmware.h>
27 static u8 *ospassword;
28 static u16 ospasswordlength;
30 // Retrieved with H_PKS_GET_CONFIG
32 static u16 objoverhead;
34 static u16 maxobjsize;
35 static s16 maxobjlabelsize;
38 static u32 supportedpolicies;
39 static u32 maxlargeobjectsize;
40 static u64 signedupdatealgorithms;
47 __be16 passwordlength;
49 } __packed __aligned(16);
60 struct label_attr attr;
61 u8 name[PLPKS_MAX_NAME_SIZE];
65 static int pseries_status_to_err(int rc)
88 case H_LONG_BUSY_ORDER_1_MSEC:
89 case H_LONG_BUSY_ORDER_10_MSEC:
90 case H_LONG_BUSY_ORDER_100_MSEC:
91 case H_LONG_BUSY_ORDER_1_SEC:
92 case H_LONG_BUSY_ORDER_10_SEC:
93 case H_LONG_BUSY_ORDER_100_SEC:
124 pr_debug("Converted hypervisor code %d to Linux %d\n", rc, err);
129 static int plpks_gen_password(void)
131 unsigned long retbuf[PLPAR_HCALL_BUFSIZE] = { 0 };
132 u8 *password, consumer = PLPKS_OS_OWNER;
135 // If we booted from kexec, we could be reusing an existing password already
137 pr_debug("Password of length %u already in use\n", ospasswordlength);
141 // The password must not cross a page boundary, so we align to the next power of 2
142 password = kzalloc(roundup_pow_of_two(maxpwsize), GFP_KERNEL);
146 rc = plpar_hcall(H_PKS_GEN_PASSWORD, retbuf, consumer, 0,
147 virt_to_phys(password), maxpwsize);
150 ospasswordlength = maxpwsize;
151 ospassword = kzalloc(maxpwsize, GFP_KERNEL);
153 kfree_sensitive(password);
156 memcpy(ospassword, password, ospasswordlength);
158 if (rc == H_IN_USE) {
159 pr_warn("Password already set - authenticated operations will fail\n");
166 kfree_sensitive(password);
168 return pseries_status_to_err(rc);
171 static struct plpks_auth *construct_auth(u8 consumer)
173 struct plpks_auth *auth;
175 if (consumer > PLPKS_OS_OWNER)
176 return ERR_PTR(-EINVAL);
178 // The auth structure must not cross a page boundary and must be
179 // 16 byte aligned. We align to the next largest power of 2
180 auth = kzalloc(roundup_pow_of_two(struct_size(auth, password, maxpwsize)), GFP_KERNEL);
182 return ERR_PTR(-ENOMEM);
185 auth->consumer = consumer;
187 if (consumer == PLPKS_FW_OWNER || consumer == PLPKS_BOOTLOADER_OWNER)
190 memcpy(auth->password, ospassword, ospasswordlength);
192 auth->passwordlength = cpu_to_be16(ospasswordlength);
198 * Label is combination of label attributes + name.
199 * Label attributes are used internally by kernel and not exposed to the user.
201 static struct label *construct_label(char *component, u8 varos, u8 *name,
207 if (!name || namelen > PLPKS_MAX_NAME_SIZE)
208 return ERR_PTR(-EINVAL);
210 // Support NULL component for signed updates
212 slen = strlen(component);
213 if (slen > sizeof(label->attr.prefix))
214 return ERR_PTR(-EINVAL);
217 // The label structure must not cross a page boundary, so we align to the next power of 2
218 label = kzalloc(roundup_pow_of_two(sizeof(*label)), GFP_KERNEL);
220 return ERR_PTR(-ENOMEM);
223 memcpy(&label->attr.prefix, component, slen);
225 label->attr.version = PLPKS_LABEL_VERSION;
226 label->attr.os = varos;
227 label->attr.length = PLPKS_MAX_LABEL_ATTR_SIZE;
228 memcpy(&label->name, name, namelen);
230 label->size = sizeof(struct label_attr) + namelen;
235 static int _plpks_get_config(void)
237 unsigned long retbuf[PLPAR_HCALL_BUFSIZE] = { 0 };
244 __be16 maxobjlabelsize;
248 __be32 supportedpolicies;
249 __be32 maxlargeobjectsize;
250 __be64 signedupdatealgorithms;
256 size = sizeof(*config);
258 // Config struct must not cross a page boundary. So long as the struct
259 // size is a power of 2, this should be fine as alignment is guaranteed
260 config = kzalloc(size, GFP_KERNEL);
266 rc = plpar_hcall(H_PKS_GET_CONFIG, retbuf, virt_to_phys(config), size);
268 if (rc != H_SUCCESS) {
269 rc = pseries_status_to_err(rc);
273 version = config->version;
274 objoverhead = be16_to_cpu(config->objoverhead);
275 maxpwsize = be16_to_cpu(config->maxpwsize);
276 maxobjsize = be16_to_cpu(config->maxobjsize);
277 maxobjlabelsize = be16_to_cpu(config->maxobjlabelsize);
278 totalsize = be32_to_cpu(config->totalsize);
279 usedspace = be32_to_cpu(config->usedspace);
280 supportedpolicies = be32_to_cpu(config->supportedpolicies);
281 maxlargeobjectsize = be32_to_cpu(config->maxlargeobjectsize);
282 signedupdatealgorithms = be64_to_cpu(config->signedupdatealgorithms);
284 // Validate that the numbers we get back match the requirements of the spec
285 if (maxpwsize < 32) {
286 pr_err("Invalid Max Password Size received from hypervisor (%d < 32)\n", maxpwsize);
291 if (maxobjlabelsize < 255) {
292 pr_err("Invalid Max Object Label Size received from hypervisor (%d < 255)\n",
298 if (totalsize < 4096) {
299 pr_err("Invalid Total Size received from hypervisor (%d < 4096)\n", totalsize);
304 if (version >= 3 && maxlargeobjectsize >= 65536 && maxobjsize != 0xFFFF) {
305 pr_err("Invalid Max Object Size (0x%x != 0xFFFF)\n", maxobjsize);
315 u8 plpks_get_version(void)
320 u16 plpks_get_objoverhead(void)
325 u16 plpks_get_maxpwsize(void)
330 u16 plpks_get_maxobjectsize(void)
335 u16 plpks_get_maxobjectlabelsize(void)
337 return maxobjlabelsize;
340 u32 plpks_get_totalsize(void)
345 u32 plpks_get_usedspace(void)
347 // Unlike other config values, usedspace regularly changes as objects
348 // are updated, so we need to refresh.
349 int rc = _plpks_get_config();
351 pr_err("Couldn't get config, rc: %d\n", rc);
357 u32 plpks_get_supportedpolicies(void)
359 return supportedpolicies;
362 u32 plpks_get_maxlargeobjectsize(void)
364 return maxlargeobjectsize;
367 u64 plpks_get_signedupdatealgorithms(void)
369 return signedupdatealgorithms;
372 u16 plpks_get_passwordlen(void)
374 return ospasswordlength;
377 bool plpks_is_available(void)
381 if (!firmware_has_feature(FW_FEATURE_PLPKS))
384 rc = _plpks_get_config();
391 static int plpks_confirm_object_flushed(struct label *label,
392 struct plpks_auth *auth)
394 unsigned long retbuf[PLPAR_HCALL_BUFSIZE] = { 0 };
395 bool timed_out = true;
401 rc = plpar_hcall(H_PKS_CONFIRM_OBJECT_FLUSHED, retbuf,
402 virt_to_phys(auth), virt_to_phys(label),
408 if (rc == H_NOT_FOUND && status == 1)
413 if (!rc && status == 1) {
418 usleep_range(PLPKS_FLUSH_SLEEP,
419 PLPKS_FLUSH_SLEEP + PLPKS_FLUSH_SLEEP_RANGE);
420 timeout = timeout + PLPKS_FLUSH_SLEEP;
421 } while (timeout < PLPKS_MAX_TIMEOUT);
426 return pseries_status_to_err(rc);
429 int plpks_signed_update_var(struct plpks_var *var, u64 flags)
431 unsigned long retbuf[PLPAR_HCALL9_BUFSIZE] = {0};
434 struct plpks_auth *auth;
435 u64 continuetoken = 0;
438 if (!var->data || var->datalen <= 0 || var->namelen > PLPKS_MAX_NAME_SIZE)
441 if (!(var->policy & PLPKS_SIGNEDUPDATE))
444 // Signed updates need the component to be NULL.
448 auth = construct_auth(PLPKS_OS_OWNER);
450 return PTR_ERR(auth);
452 label = construct_label(var->component, var->os, var->name, var->namelen);
459 rc = plpar_hcall9(H_PKS_SIGNED_UPDATE, retbuf,
460 virt_to_phys(auth), virt_to_phys(label),
461 label->size, var->policy, flags,
462 virt_to_phys(var->data), var->datalen,
465 continuetoken = retbuf[0];
466 if (pseries_status_to_err(rc) == -EBUSY) {
467 int delay_ms = get_longbusy_msecs(rc);
471 rc = pseries_status_to_err(rc);
472 } while (rc == -EBUSY && timeout < PLPKS_MAX_TIMEOUT);
475 rc = plpks_confirm_object_flushed(label, auth);
484 int plpks_write_var(struct plpks_var var)
486 unsigned long retbuf[PLPAR_HCALL_BUFSIZE] = { 0 };
487 struct plpks_auth *auth;
491 if (!var.component || !var.data || var.datalen <= 0 ||
492 var.namelen > PLPKS_MAX_NAME_SIZE || var.datalen > PLPKS_MAX_DATA_SIZE)
495 if (var.policy & PLPKS_SIGNEDUPDATE)
498 auth = construct_auth(PLPKS_OS_OWNER);
500 return PTR_ERR(auth);
502 label = construct_label(var.component, var.os, var.name, var.namelen);
508 rc = plpar_hcall(H_PKS_WRITE_OBJECT, retbuf, virt_to_phys(auth),
509 virt_to_phys(label), label->size, var.policy,
510 virt_to_phys(var.data), var.datalen);
513 rc = plpks_confirm_object_flushed(label, auth);
515 rc = pseries_status_to_err(rc);
523 int plpks_remove_var(char *component, u8 varos, struct plpks_var_name vname)
525 unsigned long retbuf[PLPAR_HCALL_BUFSIZE] = { 0 };
526 struct plpks_auth *auth;
530 if (vname.namelen > PLPKS_MAX_NAME_SIZE)
533 auth = construct_auth(PLPKS_OS_OWNER);
535 return PTR_ERR(auth);
537 label = construct_label(component, varos, vname.name, vname.namelen);
543 rc = plpar_hcall(H_PKS_REMOVE_OBJECT, retbuf, virt_to_phys(auth),
544 virt_to_phys(label), label->size);
547 rc = plpks_confirm_object_flushed(label, auth);
549 rc = pseries_status_to_err(rc);
557 static int plpks_read_var(u8 consumer, struct plpks_var *var)
559 unsigned long retbuf[PLPAR_HCALL_BUFSIZE] = { 0 };
560 struct plpks_auth *auth;
561 struct label *label = NULL;
565 if (var->namelen > PLPKS_MAX_NAME_SIZE)
568 auth = construct_auth(consumer);
570 return PTR_ERR(auth);
572 if (consumer == PLPKS_OS_OWNER) {
573 label = construct_label(var->component, var->os, var->name,
581 output = kzalloc(maxobjsize, GFP_KERNEL);
587 if (consumer == PLPKS_OS_OWNER)
588 rc = plpar_hcall(H_PKS_READ_OBJECT, retbuf, virt_to_phys(auth),
589 virt_to_phys(label), label->size, virt_to_phys(output),
592 rc = plpar_hcall(H_PKS_READ_OBJECT, retbuf, virt_to_phys(auth),
593 virt_to_phys(var->name), var->namelen, virt_to_phys(output),
597 if (rc != H_SUCCESS) {
598 rc = pseries_status_to_err(rc);
599 goto out_free_output;
602 if (!var->data || var->datalen > retbuf[0])
603 var->datalen = retbuf[0];
605 var->policy = retbuf[1];
608 memcpy(var->data, output, var->datalen);
622 int plpks_read_os_var(struct plpks_var *var)
624 return plpks_read_var(PLPKS_OS_OWNER, var);
627 int plpks_read_fw_var(struct plpks_var *var)
629 return plpks_read_var(PLPKS_FW_OWNER, var);
632 int plpks_read_bootloader_var(struct plpks_var *var)
634 return plpks_read_var(PLPKS_BOOTLOADER_OWNER, var);
637 int plpks_populate_fdt(void *fdt)
639 int chosen_offset = fdt_path_offset(fdt, "/chosen");
641 if (chosen_offset < 0) {
642 pr_err("Can't find chosen node: %s\n",
643 fdt_strerror(chosen_offset));
644 return chosen_offset;
647 return fdt_setprop(fdt, chosen_offset, "ibm,plpks-pw", ospassword, ospasswordlength);
650 // Once a password is registered with the hypervisor it cannot be cleared without
651 // rebooting the LPAR, so to keep using the PLPKS across kexec boots we need to
652 // recover the previous password from the FDT.
654 // There are a few challenges here. We don't want the password to be visible to
655 // users, so we need to clear it from the FDT. This has to be done in early boot.
656 // Clearing it from the FDT would make the FDT's checksum invalid, so we have to
657 // manually cause the checksum to be recalculated.
658 void __init plpks_early_init_devtree(void)
660 void *fdt = initial_boot_params;
661 int chosen_node = fdt_path_offset(fdt, "/chosen");
668 password = fdt_getprop(fdt, chosen_node, "ibm,plpks-pw", &len);
670 pr_debug("Couldn't find ibm,plpks-pw node.\n");
674 ospassword = memblock_alloc_raw(len, SMP_CACHE_BYTES);
676 pr_err("Error allocating memory for password.\n");
680 memcpy(ospassword, password, len);
681 ospasswordlength = (u16)len;
684 fdt_nop_property(fdt, chosen_node, "ibm,plpks-pw");
685 // Since we've cleared the password, we must update the FDT checksum
686 early_init_dt_verify(fdt);
689 static __init int pseries_plpks_init(void)
693 if (!firmware_has_feature(FW_FEATURE_PLPKS))
696 rc = _plpks_get_config();
699 pr_err("POWER LPAR Platform KeyStore is not supported or enabled\n");
703 rc = plpks_gen_password();
705 pr_err("Failed setting POWER LPAR Platform KeyStore Password\n");
707 pr_info("POWER LPAR Platform KeyStore initialized successfully\n");
711 machine_arch_initcall(pseries, pseries_plpks_init);