Skip to content

Commit 25ce7a5

Browse files
maddy-kerneldevmaddy-kerneldev
committed
Automatic merge of 'next' into merge (2026-02-01 11:28)
2 parents 960c1fd + 1d72a02 commit 25ce7a5

File tree

25 files changed

+1523
-264
lines changed

25 files changed

+1523
-264
lines changed

‎Documentation/ABI/testing/sysfs-firmware-plpks‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
What: /sys/firmware/plpks/config
2+
Date: February 2023
3+
Contact: Nayna Jain <nayna@linux.ibm.com>
4+
Description: This optional directory contains read-only config attributes as
5+
defined by the PLPKS implementation. All data is in ASCII
6+
format.
7+
8+
What: /sys/firmware/plpks/config/version
9+
Date: February 2023
10+
Contact: Nayna Jain <nayna@linux.ibm.com>
11+
Description: Config version as reported by the hypervisor in ASCII decimal
12+
format.
13+
14+
What: /sys/firmware/plpks/config/max_object_size
15+
Date: February 2023
16+
Contact: Nayna Jain <nayna@linux.ibm.com>
17+
Description: Maximum allowed size of objects in the keystore in bytes,
18+
represented in ASCII decimal format.
19+
20+
This is not necessarily the same as the max size that can be
21+
written to an update file as writes can contain more than
22+
object data, you should use the size of the update file for
23+
that purpose.
24+
25+
What: /sys/firmware/plpks/config/total_size
26+
Date: February 2023
27+
Contact: Nayna Jain <nayna@linux.ibm.com>
28+
Description: Total size of the PLPKS in bytes, represented in ASCII decimal
29+
format.
30+
31+
What: /sys/firmware/plpks/config/used_space
32+
Date: February 2023
33+
Contact: Nayna Jain <nayna@linux.ibm.com>
34+
Description: Current space consumed by the key store, in bytes, represented
35+
in ASCII decimal format.
36+
37+
What: /sys/firmware/plpks/config/supported_policies
38+
Date: February 2023
39+
Contact: Nayna Jain <nayna@linux.ibm.com>
40+
Description: Bitmask of supported policy flags by the hypervisor, represented
41+
as an 8 byte hexadecimal ASCII string. Consult the hypervisor
42+
documentation for what these flags are.
43+
44+
What: /sys/firmware/plpks/config/signed_update_algorithms
45+
Date: February 2023
46+
Contact: Nayna Jain <nayna@linux.ibm.com>
47+
Description: Bitmask of flags indicating which algorithms the hypervisor
48+
supports for signed update of objects, represented as a 16 byte
49+
hexadecimal ASCII string. Consult the hypervisor documentation
50+
for what these flags mean.
51+
52+
What: /sys/firmware/plpks/config/wrapping_features
53+
Date: November 2025
54+
Contact: Srish Srinivasan <ssrish@linux.ibm.com>
55+
Description: Bitmask of the wrapping features indicating the wrapping
56+
algorithms that are supported for the H_PKS_WRAP_OBJECT requests
57+
, represented as a 8 byte hexadecimal ASCII string. Consult the
58+
hypervisor documentation for what these flags mean.

‎Documentation/ABI/testing/sysfs-secvar‎

Lines changed: 0 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -63,68 +63,3 @@ Contact: Nayna Jain <nayna@linux.ibm.com>
6363
Description: A write-only file that is used to submit the new value for the
6464
variable. The size of the file represents the maximum size of
6565
the variable data that can be written.
66-
67-
What: /sys/firmware/secvar/config
68-
Date: February 2023
69-
Contact: Nayna Jain <nayna@linux.ibm.com>
70-
Description: This optional directory contains read-only config attributes as
71-
defined by the secure variable implementation. All data is in
72-
ASCII format. The directory is only created if the backing
73-
implementation provides variables to populate it, which at
74-
present is only PLPKS on the pseries platform.
75-
76-
What: /sys/firmware/secvar/config/version
77-
Date: February 2023
78-
Contact: Nayna Jain <nayna@linux.ibm.com>
79-
Description: Config version as reported by the hypervisor in ASCII decimal
80-
format.
81-
82-
Currently only provided by PLPKS on the pseries platform.
83-
84-
What: /sys/firmware/secvar/config/max_object_size
85-
Date: February 2023
86-
Contact: Nayna Jain <nayna@linux.ibm.com>
87-
Description: Maximum allowed size of objects in the keystore in bytes,
88-
represented in ASCII decimal format.
89-
90-
This is not necessarily the same as the max size that can be
91-
written to an update file as writes can contain more than
92-
object data, you should use the size of the update file for
93-
that purpose.
94-
95-
Currently only provided by PLPKS on the pseries platform.
96-
97-
What: /sys/firmware/secvar/config/total_size
98-
Date: February 2023
99-
Contact: Nayna Jain <nayna@linux.ibm.com>
100-
Description: Total size of the PLPKS in bytes, represented in ASCII decimal
101-
format.
102-
103-
Currently only provided by PLPKS on the pseries platform.
104-
105-
What: /sys/firmware/secvar/config/used_space
106-
Date: February 2023
107-
Contact: Nayna Jain <nayna@linux.ibm.com>
108-
Description: Current space consumed by the key store, in bytes, represented
109-
in ASCII decimal format.
110-
111-
Currently only provided by PLPKS on the pseries platform.
112-
113-
What: /sys/firmware/secvar/config/supported_policies
114-
Date: February 2023
115-
Contact: Nayna Jain <nayna@linux.ibm.com>
116-
Description: Bitmask of supported policy flags by the hypervisor,
117-
represented as an 8 byte hexadecimal ASCII string. Consult the
118-
hypervisor documentation for what these flags are.
119-
120-
Currently only provided by PLPKS on the pseries platform.
121-
122-
What: /sys/firmware/secvar/config/signed_update_algorithms
123-
Date: February 2023
124-
Contact: Nayna Jain <nayna@linux.ibm.com>
125-
Description: Bitmask of flags indicating which algorithms the hypervisor
126-
supports for signed update of objects, represented as a 16 byte
127-
hexadecimal ASCII string. Consult the hypervisor documentation
128-
for what these flags mean.
129-
130-
Currently only provided by PLPKS on the pseries platform.

‎Documentation/admin-guide/kernel-parameters.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7755,6 +7755,7 @@ Kernel parameters
77557755
- "tee"
77567756
- "caam"
77577757
- "dcp"
7758+
- "pkwm"
77587759
If not specified then it defaults to iterating through
77597760
the trust source list starting with TPM and assigns the
77607761
first trust source as a backend which is initialized

‎Documentation/arch/powerpc/papr_hcalls.rst‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -300,6 +300,49 @@ H_HTM supports setup, configuration, control and dumping of Hardware Trace
300300
Macro (HTM) function and its data. HTM buffer stores tracing data for functions
301301
like core instruction, core LLAT and nest.
302302

303+
**H_PKS_GEN_KEY**
304+
305+
| Input: authorization, objectlabel, objectlabellen, policy, out, outlen
306+
| Out: *Hypervisor Generated Key, or None when the wrapping key policy is set*
307+
| Return Value: *H_SUCCESS, H_Function, H_State, H_R_State, H_Parameter, H_P2,
308+
H_P3, H_P4, H_P5, H_P6, H_Authority, H_Nomem, H_Busy, H_Resource,
309+
H_Aborted*
310+
311+
H_PKS_GEN_KEY is used to have the hypervisor generate a new random key.
312+
This key is stored as an object in the Power LPAR Platform KeyStore with
313+
the provided object label. With the wrapping key policy set the key is only
314+
visible to the hypervisor, while the key's label would still be visible to
315+
the user. Generation of wrapping keys is supported only for a key size of
316+
32 bytes.
317+
318+
**H_PKS_WRAP_OBJECT**
319+
320+
| Input: authorization, wrapkeylabel, wrapkeylabellen, objectwrapflags, in,
321+
| inlen, out, outlen, continue-token
322+
| Out: *continue-token, byte size of wrapped object, wrapped object*
323+
| Return Value: *H_SUCCESS, H_Function, H_State, H_R_State, H_Parameter, H_P2,
324+
H_P3, H_P4, H_P5, H_P6, H_P7, H_P8, H_P9, H_Authority, H_Invalid_Key,
325+
H_NOT_FOUND, H_Busy, H_LongBusy, H_Aborted*
326+
327+
H_PKS_WRAP_OBJECT is used to wrap an object using a wrapping key stored in the
328+
Power LPAR Platform KeyStore and return the wrapped object to the caller. The
329+
caller provides a label to a wrapping key with the 'wrapping key' policy set,
330+
which must have been previously created with H_PKS_GEN_KEY. The provided object
331+
is then encrypted with the wrapping key and additional metadata and the result
332+
is returned to the caller.
333+
334+
335+
**H_PKS_UNWRAP_OBJECT**
336+
337+
| Input: authorization, objectwrapflags, in, inlen, out, outlen, continue-token
338+
| Out: *continue-token, byte size of unwrapped object, unwrapped object*
339+
| Return Value: *H_SUCCESS, H_Function, H_State, H_R_State, H_Parameter, H_P2,
340+
H_P3, H_P4, H_P5, H_P6, H_P7, H_Authority, H_Unsupported, H_Bad_Data,
341+
H_NOT_FOUND, H_Invalid_Key, H_Busy, H_LongBusy, H_Aborted*
342+
343+
H_PKS_UNWRAP_OBJECT is used to unwrap an object that was previously warapped with
344+
H_PKS_WRAP_OBJECT.
345+
303346
References
304347
==========
305348
.. [1] "Power Architecture Platform Reference"

‎Documentation/security/keys/trusted-encrypted.rst‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,14 @@ safe.
8181
and the UNIQUE key. Default is to use the UNIQUE key, but selecting
8282
the OTP key can be done via a module parameter (dcp_use_otp_key).
8383

84+
(5) PKWM (PowerVM Key Wrapping Module: IBM PowerVM + Platform KeyStore)
85+
86+
Rooted to a unique, per-LPAR key, which is derived from a system-wide,
87+
randomly generated LPAR root key. Both the per-LPAR keys and the LPAR
88+
root key are stored in hypervisor-owned secure memory at runtime,
89+
and the LPAR root key is additionally persisted in secure locations
90+
such as the processor SEEPROMs and encrypted NVRAM.
91+
8492
* Execution isolation
8593

8694
(1) TPM
@@ -102,6 +110,14 @@ safe.
102110
environment. Only basic blob key encryption is executed there.
103111
The actual key sealing/unsealing is done on main processor/kernel space.
104112

113+
(5) PKWM (PowerVM Key Wrapping Module: IBM PowerVM + Platform KeyStore)
114+
115+
Fixed set of cryptographic operations done on on-chip hardware
116+
cryptographic acceleration unit NX. Keys for wrapping and unwrapping
117+
are managed by PowerVM Platform KeyStore, which stores keys in an
118+
isolated in-memory copy in secure hypervisor memory, as well as in a
119+
persistent copy in hypervisor-encrypted NVRAM.
120+
105121
* Optional binding to platform integrity state
106122

107123
(1) TPM
@@ -129,6 +145,11 @@ safe.
129145
Relies on Secure/Trusted boot process (called HAB by vendor) for
130146
platform integrity.
131147

148+
(5) PKWM (PowerVM Key Wrapping Module: IBM PowerVM + Platform KeyStore)
149+
150+
Relies on secure and trusted boot process of IBM Power systems for
151+
platform integrity.
152+
132153
* Interfaces and APIs
133154

134155
(1) TPM
@@ -149,6 +170,11 @@ safe.
149170
Vendor-specific API that is implemented as part of the DCP crypto driver in
150171
``drivers/crypto/mxs-dcp.c``.
151172

173+
(5) PKWM (PowerVM Key Wrapping Module: IBM PowerVM + Platform KeyStore)
174+
175+
Platform Keystore has well documented interfaces in PAPR document.
176+
Refer to ``Documentation/arch/powerpc/papr_hcalls.rst``
177+
152178
* Threat model
153179

154180
The strength and appropriateness of a particular trust source for a given
@@ -191,6 +217,10 @@ selected trust source:
191217
a dedicated hardware RNG that is independent from DCP which can be enabled
192218
to back the kernel RNG.
193219

220+
* PKWM (PowerVM Key Wrapping Module: IBM PowerVM + Platform KeyStore)
221+
222+
The normal kernel random number generator is used to generate keys.
223+
194224
Users may override this by specifying ``trusted.rng=kernel`` on the kernel
195225
command-line to override the used RNG with the kernel's random number pool.
196226

@@ -321,6 +351,26 @@ Usage::
321351
specific to this DCP key-blob implementation. The key length for new keys is
322352
always in bytes. Trusted Keys can be 32 - 128 bytes (256 - 1024 bits).
323353

354+
Trusted Keys usage: PKWM
355+
------------------------
356+
357+
Usage::
358+
359+
keyctl add trusted name "new keylen [options]" ring
360+
keyctl add trusted name "load hex_blob" ring
361+
keyctl print keyid
362+
363+
options:
364+
wrap_flags= ascii hex value of security policy requirement
365+
0x00: no secure boot requirement (default)
366+
0x01: require secure boot to be in either audit or
367+
enforced mode
368+
0x02: require secure boot to be in enforced mode
369+
370+
"keyctl print" returns an ASCII hex copy of the sealed key, which is in format
371+
specific to PKWM key-blob implementation. The key length for new keys is
372+
always in bytes. Trusted Keys can be 32 - 128 bytes (256 - 1024 bits).
373+
324374
Encrypted Keys usage
325375
--------------------
326376

‎MAINTAINERS‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14003,6 +14003,15 @@ S: Supported
1400314003
F: include/keys/trusted_dcp.h
1400414004
F: security/keys/trusted-keys/trusted_dcp.c
1400514005

14006+
KEYS-TRUSTED-PLPKS
14007+
M: Srish Srinivasan <ssrish@linux.ibm.com>
14008+
M: Nayna Jain <nayna@linux.ibm.com>
14009+
L: linux-integrity@vger.kernel.org
14010+
L: keyrings@vger.kernel.org
14011+
S: Supported
14012+
F: include/keys/trusted_pkwm.h
14013+
F: security/keys/trusted-keys/trusted_pkwm.c
14014+
1400614015
KEYS-TRUSTED-TEE
1400714016
M: Sumit Garg <sumit.garg@kernel.org>
1400814017
L: linux-integrity@vger.kernel.org

‎arch/powerpc/include/asm/hvcall.h‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -360,7 +360,9 @@
360360
#define H_GUEST_RUN_VCPU 0x480
361361
#define H_GUEST_COPY_MEMORY 0x484
362362
#define H_GUEST_DELETE 0x488
363-
#define MAX_HCALL_OPCODE H_GUEST_DELETE
363+
#define H_PKS_WRAP_OBJECT 0x490
364+
#define H_PKS_UNWRAP_OBJECT 0x494
365+
#define MAX_HCALL_OPCODE H_PKS_UNWRAP_OBJECT
364366

365367
/* Scope args for H_SCM_UNBIND_ALL */
366368
#define H_UNBIND_SCOPE_ALL (0x1)

‎arch/powerpc/include/asm/kgdb.h‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,6 @@
2525

2626
#define BREAK_INSTR_SIZE 4
2727
#define BUFMAX ((NUMREGBYTES * 2) + 512)
28-
#define OUTBUFMAX ((NUMREGBYTES * 2) + 512)
2928

3029
#define BREAK_INSTR 0x7d821008 /* twge r2, r2 */
3130

0 commit comments

Comments
 (0)