Re: [PATCH v2 1/4] powerpc/powernv: Add OPAL API interface to access secure variable

2019-08-21 Thread Oliver O'Halloran
On Thu, Aug 22, 2019 at 3:02 PM Oliver O'Halloran wrote: > > On Wed, 2019-08-21 at 11:08 -0400, Nayna Jain wrote: > > diff --git a/arch/powerpc/platforms/powernv/opal.c > > b/arch/powerpc/platforms/powernv/opal.c > > index aba443be7daa..ffe6f1cf0830 100644 > > ---

Re: [PATCH v2 2/4] powerpc: expose secure variables to userspace via sysfs

2019-08-21 Thread Oliver O'Halloran
On Wed, 2019-08-21 at 11:08 -0400, Nayna Jain wrote: > PowerNV secure variables, which store the keys used for OS kernel > verification, are managed by the firmware. These secure variables need to > be accessed by the userspace for addition/deletion of the certificates. > > This patch adds the

Re: [PATCH v2 1/4] powerpc/powernv: Add OPAL API interface to access secure variable

2019-08-21 Thread Oliver O'Halloran
On Wed, 2019-08-21 at 11:08 -0400, Nayna Jain wrote: > The X.509 certificates trusted by the platform and required to secure boot > the OS kernel are wrapped in secure variables, which are controlled by > OPAL. > > This patch adds firmware/kernel interface to read and write OPAL secure >

Re: [PATCH v2 4/4] powerpc: load firmware trusted keys into kernel keyring

2019-08-21 Thread Greg Kroah-Hartman
On Wed, Aug 21, 2019 at 11:08:23AM -0400, Nayna Jain wrote: > The keys used to verify the Host OS kernel are managed by OPAL as secure > variables. This patch loads the verification keys into the .platform > keyring and revocation keys into .blacklist keyring. This enables > verification and

Re: [PATCH v2 3/4] x86/efi: move common keyring handler functions to new file

2019-08-21 Thread Greg Kroah-Hartman
On Wed, Aug 21, 2019 at 11:08:22AM -0400, Nayna Jain wrote: > This patch moves the common code to keyring_handler.c That says _what_ you are doing, but not _why_ you are doing it. We have no idea :(

Re: [PATCH v2 2/4] powerpc: expose secure variables to userspace via sysfs

2019-08-21 Thread Greg Kroah-Hartman
On Wed, Aug 21, 2019 at 11:08:21AM -0400, Nayna Jain wrote: > --- /dev/null > +++ b/Documentation/ABI/testing/sysfs-secvar > @@ -0,0 +1,27 @@ > +What:/sys/firmware/secvar > +Date:August 2019 > +Contact: Nayna Jain > +Description: > + This directory

[PATCH v2 4/4] powerpc: load firmware trusted keys into kernel keyring

2019-08-21 Thread Nayna Jain
The keys used to verify the Host OS kernel are managed by OPAL as secure variables. This patch loads the verification keys into the .platform keyring and revocation keys into .blacklist keyring. This enables verification and loading of the kernels signed by the boot time keys which are trusted by

[PATCH v2 1/4] powerpc/powernv: Add OPAL API interface to access secure variable

2019-08-21 Thread Nayna Jain
The X.509 certificates trusted by the platform and required to secure boot the OS kernel are wrapped in secure variables, which are controlled by OPAL. This patch adds firmware/kernel interface to read and write OPAL secure variables based on the unique key. This support can be enabled using

[PATCH v2 3/4] x86/efi: move common keyring handler functions to new file

2019-08-21 Thread Nayna Jain
This patch moves the common code to keyring_handler.c Signed-off-by: Nayna Jain --- security/integrity/Makefile | 3 +- .../platform_certs/keyring_handler.c | 80 +++ .../platform_certs/keyring_handler.h | 35

[PATCH v2 0/4] powerpc: expose secure variables to the kernel and userspace

2019-08-21 Thread Nayna Jain
In order to verify the OS kernel on PowerNV systems, secure boot requires X.509 certificates trusted by the platform. These are stored in secure variables controlled by OPAL, called OPAL secure variables. In order to enable users to manage the keys, the secure variables need to be exposed to

[PATCH v2 2/4] powerpc: expose secure variables to userspace via sysfs

2019-08-21 Thread Nayna Jain
PowerNV secure variables, which store the keys used for OS kernel verification, are managed by the firmware. These secure variables need to be accessed by the userspace for addition/deletion of the certificates. This patch adds the sysfs interface to expose secure variables for PowerNV

Re: [PATCH] efi/arm: fix allocation failure when reserving the kernel base

2019-08-21 Thread Ard Biesheuvel
On Wed, 21 Aug 2019 at 11:29, Mike Rapoport wrote: > > On Wed, Aug 21, 2019 at 10:29:37AM +0300, Ard Biesheuvel wrote: > > On Wed, 21 Aug 2019 at 10:11, Mike Rapoport wrote: > > > ... > > > I think the only missing part here is to ensure that non-reserved memory > > > in > > > bank 0 starts

Re: [PATCH] efi/arm: fix allocation failure when reserving the kernel base

2019-08-21 Thread Mike Rapoport
On Wed, Aug 21, 2019 at 10:29:37AM +0300, Ard Biesheuvel wrote: > On Wed, 21 Aug 2019 at 10:11, Mike Rapoport wrote: > > > > On Wed, Aug 21, 2019 at 09:35:16AM +0300, Ard Biesheuvel wrote: > > > On Wed, 21 Aug 2019 at 09:11, Chester Lin wrote: > > > > > > > > On Tue, Aug 20, 2019 at 03:28:25PM

Re: [PATCH] efi/arm: fix allocation failure when reserving the kernel base

2019-08-21 Thread Ard Biesheuvel
On Wed, 21 Aug 2019 at 10:11, Mike Rapoport wrote: > > On Wed, Aug 21, 2019 at 09:35:16AM +0300, Ard Biesheuvel wrote: > > On Wed, 21 Aug 2019 at 09:11, Chester Lin wrote: > > > > > > On Tue, Aug 20, 2019 at 03:28:25PM +0300, Ard Biesheuvel wrote: > > > > On Tue, 20 Aug 2019 at 14:56, Russell

Re: [PATCH] efi/arm: fix allocation failure when reserving the kernel base

2019-08-21 Thread Chester Lin
On Wed, Aug 21, 2019 at 10:11:01AM +0300, Mike Rapoport wrote: > On Wed, Aug 21, 2019 at 09:35:16AM +0300, Ard Biesheuvel wrote: > > On Wed, 21 Aug 2019 at 09:11, Chester Lin wrote: > > > > > > On Tue, Aug 20, 2019 at 03:28:25PM +0300, Ard Biesheuvel wrote: > > > > On Tue, 20 Aug 2019 at 14:56,

Re: [PATCH] efi/arm: fix allocation failure when reserving the kernel base

2019-08-21 Thread Mike Rapoport
On Wed, Aug 21, 2019 at 09:35:16AM +0300, Ard Biesheuvel wrote: > On Wed, 21 Aug 2019 at 09:11, Chester Lin wrote: > > > > On Tue, Aug 20, 2019 at 03:28:25PM +0300, Ard Biesheuvel wrote: > > > On Tue, 20 Aug 2019 at 14:56, Russell King - ARM Linux admin > > > wrote: > > > > > > > > On Fri, Aug

Re: [PATCH] efi/arm: fix allocation failure when reserving the kernel base

2019-08-21 Thread Ard Biesheuvel
On Wed, 21 Aug 2019 at 09:11, Chester Lin wrote: > > On Tue, Aug 20, 2019 at 03:28:25PM +0300, Ard Biesheuvel wrote: > > On Tue, 20 Aug 2019 at 14:56, Russell King - ARM Linux admin > > wrote: > > > > > > On Fri, Aug 02, 2019 at 05:38:54AM +, Chester Lin wrote: > > > > diff --git

Re: [PATCH] efi/arm: fix allocation failure when reserving the kernel base

2019-08-21 Thread Chester Lin
On Tue, Aug 20, 2019 at 03:28:25PM +0300, Ard Biesheuvel wrote: > On Tue, 20 Aug 2019 at 14:56, Russell King - ARM Linux admin > wrote: > > > > On Fri, Aug 02, 2019 at 05:38:54AM +, Chester Lin wrote: > > > diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c > > > index