| Message ID | 20230131063928.388035-26-ajd@linux.ibm.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | pSeries dynamic secure boot secvar interface + platform keyring loading | expand |
On 1/31/23 01:39, Andrew Donnellan wrote: > From: Russell Currey <ruscur@russell.cc> > > Add support for loading keys from the PLPKS on pseries machines, with the > "ibm,plpks-sb-v1" format. > > The object format is expected to be the same, so there shouldn't be any > functional differences between objects retrieved on powernv or pseries. > > Unlike on powernv, on pseries the format string isn't contained in the > device tree. Use secvar_ops->format() to fetch the format string in a > generic manner, rather than searching the device tree ourselves. > > (The current code searches the device tree for a node compatible with > "ibm,edk2-compat-v1". This patch switches to calling secvar_ops->format(), > which in the case of OPAL/powernv means opal_secvar_format(), which > searches the device tree for a node compatible with "ibm,secvar-backend" > and checks its "format" property. These are equivalent, as skiboot creates > a node with both "ibm,edk2-compat-v1" and "ibm,secvar-backend" as > compatible strings.) > > Signed-off-by: Russell Currey <ruscur@russell.cc> > Signed-off-by: Andrew Donnellan <ajd@linux.ibm.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
diff --git a/security/integrity/platform_certs/load_powerpc.c b/security/integrity/platform_certs/load_powerpc.c index dee51606d5f4..b9de70b90826 100644 --- a/security/integrity/platform_certs/load_powerpc.c +++ b/security/integrity/platform_certs/load_powerpc.c @@ -10,7 +10,6 @@ #include <linux/cred.h> #include <linux/err.h> #include <linux/slab.h> -#include <linux/of.h> #include <asm/secure_boot.h> #include <asm/secvar.h> #include "keyring_handler.h" @@ -59,16 +58,22 @@ static int __init load_powerpc_certs(void) void *db = NULL, *dbx = NULL; u64 dbsize = 0, dbxsize = 0; int rc = 0; - struct device_node *node; + ssize_t len; + char buf[32]; if (!secvar_ops) return -ENODEV; - /* The following only applies for the edk2-compat backend. */ - node = of_find_compatible_node(NULL, NULL, "ibm,edk2-compat-v1"); - if (!node) + len = secvar_ops->format(buf, sizeof(buf)); + if (len <= 0) return -ENODEV; + // Check for known secure boot implementations from OPAL or PLPKS + if (strcmp("ibm,edk2-compat-v1", buf) && strcmp("ibm,plpks-sb-v1", buf)) { + pr_err("Unsupported secvar implementation \"%s\", not loading certs\n", buf); + return -ENODEV; + } + /* * Get db, and dbx. They might not exist, so it isn't an error if we * can't get them. @@ -103,8 +108,6 @@ static int __init load_powerpc_certs(void) kfree(dbx); } - of_node_put(node); - return rc; } late_initcall(load_powerpc_certs);