PowerVM provides an isolated Platform Keystore(PKS) storage allocation for each partition with individually managed access controls to store sensitive information securely. Linux Kernel can access this storage by interfacing with hypervisor using a new set of hypervisor calls.
PowerVM guest secure boot intend to use Platform Keystore for the purpose of storing public keys. Secure boot requires public keys to be able to verify the grub and boot kernel. To allow authenticated manipulation of keys, it supports variables to store key authorities - PK/KEK and code signing keys - db. It also supports denied list to disallow booting even if signed with valid key. This is done via denied list database - dbx or sbat. These variables would be stored in PKS, and are managed and controlled by firmware. The purpose of this patchset is to add support for users to read/write/add/delete variables required for secure boot on PowerVM. Nayna Jain (2): pseries: define driver for Platform Keystore pseries: define sysfs interface to expose PKS variables Documentation/ABI/testing/sysfs-pksvar | 77 +++ arch/powerpc/include/asm/hvcall.h | 13 +- arch/powerpc/include/asm/pks.h | 84 +++ arch/powerpc/platforms/pseries/Kconfig | 17 + arch/powerpc/platforms/pseries/Makefile | 2 + arch/powerpc/platforms/pseries/pks.c | 494 ++++++++++++++++++ arch/powerpc/platforms/pseries/pksvar-sysfs.c | 356 +++++++++++++ 7 files changed, 1042 insertions(+), 1 deletion(-) create mode 100644 Documentation/ABI/testing/sysfs-pksvar create mode 100644 arch/powerpc/include/asm/pks.h create mode 100644 arch/powerpc/platforms/pseries/pks.c create mode 100644 arch/powerpc/platforms/pseries/pksvar-sysfs.c -- 2.27.0
