powerpc: Add support for adding an ESM blob to the zImage wrapper

For secure VMs, the signing tool will create a ticket called the "ESM blob"
for the Enter Secure Mode ultravisor call with the signatures of the kernel
and initrd among other things.

This adds support to the wrapper script for adding that blob via the "-e"
option to the zImage.pseries.

It also adds code to the zImage wrapper itself to retrieve and if necessary
relocate the blob, and pass its address to Linux via the device-tree, to be
later consumed by prom_init.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
[ bauerman: Minor adjustments to some comments. ]
Signed-off-by: Thiago Jung Bauermann <bauerman@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20190820021326.6884-4-bauerman@linux.ibm.com

diff --git a/arch/powerpc/boot/main.c b/arch/powerpc/boot/main.c
index 102cc546444d23c58408b92e4f92abed9d4b2cde..a9d209135975daecd270fad855dde12a19768d1d 100644 (file)
--- a/arch/powerpc/boot/main.c
+++ b/arch/powerpc/boot/main.c
@@ -146,6 +146,46 @@ static struct addr_range prep_initrd(struct addr_range vmlinux, void *chosen,
        return (struct addr_range){(void *)initrd_addr, initrd_size};
 }
 
+#ifdef __powerpc64__
+static void prep_esm_blob(struct addr_range vmlinux, void *chosen)
+{
+       unsigned long esm_blob_addr, esm_blob_size;
+
+       /* Do we have an ESM (Enter Secure Mode) blob? */
+       if (_esm_blob_end <= _esm_blob_start)
+               return;
+
+       printf("Attached ESM blob at 0x%p-0x%p\n\r",
+              _esm_blob_start, _esm_blob_end);
+       esm_blob_addr = (unsigned long)_esm_blob_start;
+       esm_blob_size = _esm_blob_end - _esm_blob_start;
+
+       /*
+        * If the ESM blob is too low it will be clobbered when the
+        * kernel relocates to its final location.  In this case,
+        * allocate a safer place and move it.
+        */
+       if (esm_blob_addr < vmlinux.size) {
+               void *old_addr = (void *)esm_blob_addr;
+
+               printf("Allocating 0x%lx bytes for esm_blob ...\n\r",
+                      esm_blob_size);
+               esm_blob_addr = (unsigned long)malloc(esm_blob_size);
+               if (!esm_blob_addr)
+                       fatal("Can't allocate memory for ESM blob !\n\r");
+               printf("Relocating ESM blob 0x%lx <- 0x%p (0x%lx bytes)\n\r",
+                      esm_blob_addr, old_addr, esm_blob_size);
+               memmove((void *)esm_blob_addr, old_addr, esm_blob_size);
+       }
+
+       /* Tell the kernel ESM blob address via device tree. */
+       setprop_val(chosen, "linux,esm-blob-start", (u32)(esm_blob_addr));
+       setprop_val(chosen, "linux,esm-blob-end", (u32)(esm_blob_addr + esm_blob_size));
+}
+#else
+static inline void prep_esm_blob(struct addr_range vmlinux, void *chosen) { }
+#endif
+
 /* A buffer that may be edited by tools operating on a zImage binary so as to
  * edit the command line passed to vmlinux (by setting /chosen/bootargs).
  * The buffer is put in it's own section so that tools may locate it easier.
@@ -214,6 +254,7 @@ void start(void)
        vmlinux = prep_kernel();
        initrd = prep_initrd(vmlinux, chosen,
                             loader_info.initrd_addr, loader_info.initrd_size);
+       prep_esm_blob(vmlinux, chosen);
        prep_cmdline(chosen);
 
        printf("Finalizing device tree...");

diff --git a/arch/powerpc/boot/ops.h b/arch/powerpc/boot/ops.h
index cd043726ed88c56af280517b0597e39e686395cc..e0606766480f7530f4eaa082ddd7fed0342c78ca 100644 (file)
--- a/arch/powerpc/boot/ops.h
+++ b/arch/powerpc/boot/ops.h
@@ -251,6 +251,8 @@ extern char _initrd_start[];
 extern char _initrd_end[];
 extern char _dtb_start[];
 extern char _dtb_end[];
+extern char _esm_blob_start[];
+extern char _esm_blob_end[];
 
 static inline __attribute__((const))
 int __ilog2_u32(u32 n)

diff --git a/arch/powerpc/boot/wrapper b/arch/powerpc/boot/wrapper
index 5148ac271f28f0dc9760ed1ea10c4713f74c8de8..ed6266367bc022c22d8df7bffba20dd4df4f19e6 100755 (executable)
--- a/arch/powerpc/boot/wrapper
+++ b/arch/powerpc/boot/wrapper
@@ -13,6 +13,7 @@
 # -i initrd    specify initrd file
 # -d devtree   specify device-tree blob
 # -s tree.dts  specify device-tree source file (needs dtc installed)
+# -e esm_blob   specify ESM blob for secure images
 # -c           cache $kernel.strip.gz (use if present & newer, else make)
 # -C prefix    specify command prefix for cross-building tools
 #              (strip, objcopy, ld)
@@ -37,6 +38,7 @@ platform=of
 initrd=
 dtb=
 dts=
+esm_blob=
 cacheit=
 binary=
 compression=.gz
@@ -60,9 +62,9 @@ tmpdir=.
 
 usage() {
     echo 'Usage: wrapper [-o output] [-p platform] [-i initrd]' >&2
-    echo '       [-d devtree] [-s tree.dts] [-c] [-C cross-prefix]' >&2
-    echo '       [-D datadir] [-W workingdir] [-Z (gz|xz|none)]' >&2
-    echo '       [--no-compression] [vmlinux]' >&2
+    echo '       [-d devtree] [-s tree.dts] [-e esm_blob]' >&2
+    echo '       [-c] [-C cross-prefix] [-D datadir] [-W workingdir]' >&2
+    echo '       [-Z (gz|xz|none)] [--no-compression] [vmlinux]' >&2
     exit 1
 }
 
@@ -105,6 +107,11 @@ while [ "$#" -gt 0 ]; do
        [ "$#" -gt 0 ] || usage
        dtb="$1"
        ;;
+    -e)
+       shift
+       [ "$#" -gt 0 ] || usage
+       esm_blob="$1"
+       ;;
     -s)
        shift
        [ "$#" -gt 0 ] || usage
@@ -218,9 +225,16 @@ objflags=-S
 tmp=$tmpdir/zImage.$$.o
 ksection=.kernel:vmlinux.strip
 isection=.kernel:initrd
+esection=.kernel:esm_blob
 link_address='0x400000'
 make_space=y
 
+
+if [ -n "$esm_blob" -a "$platform" != "pseries" ]; then
+    echo "ESM blob not support on non-pseries platforms" >&2
+    exit 1
+fi
+
 case "$platform" in
 of)
     platformo="$object/of.o $object/epapr.o"
@@ -477,6 +491,10 @@ if [ -n "$dtb" ]; then
     fi
 fi
 
+if [ -n "$esm_blob" ]; then
+    addsec $tmp "$esm_blob" $esection
+fi
+
 if [ "$platform" != "miboot" ]; then
     if [ -n "$link_address" ] ; then
         text_start="-Ttext $link_address"

diff --git a/arch/powerpc/boot/zImage.lds.S b/arch/powerpc/boot/zImage.lds.S
index 4ac1e36edfe7f0187a487c65382481bd6d5a4c2a..a21f3a76e06fce36dc5b69a065a30df62adf0dec 100644 (file)
--- a/arch/powerpc/boot/zImage.lds.S
+++ b/arch/powerpc/boot/zImage.lds.S
@@ -68,6 +68,14 @@ SECTIONS
     _initrd_end =  .;
   }
 
+  . = ALIGN(4096);
+  .kernel:esm_blob :
+  {
+    _esm_blob_start =  .;
+    *(.kernel:esm_blob)
+    _esm_blob_end =  .;
+  }
+
 #ifdef CONFIG_PPC64_BOOT_WRAPPER
   . = ALIGN(256);
   .got :