The PKWM trusted source currently uses a single default wrapping key per LPAR. This key is created during trusted source initialization, and all trusted keys backed by PKWM are sealed and unsealed using it.
Recent versions of PKWM allow users to create and manage their own wrapping keys through a set of lifecycle operations. This patch series brings these PKWM capabilities into the kernel, allowing users to create, manage, and select wrapping keys for sealing and unsealing their trusted keys, rather than requiring all trusted keys to use the default wrapping key. This series adds support for user-created wrapping keys to PLPKS and PKWM. It begins with seven preparatory cleanup and bug-fix patches that improve error handling and type consistency, clarify macro naming, prevent unsupported capabilities from being exposed through sysfs, and update the documentation and MAINTAINERS entry. The final three patches add the required hcalls, enable wrapping key selection by label for PKWM-backed trusted keys, and provide a sysfs interface for managing wrapping keys from userspace. Changelog: v1 -> v2: - Addressed parameter validation issues reported by Nageswara - Tweaked PLPKS_WRAPKEY_SYSFS Kconfig help text - Added two preparatory bug-fix patches - Cc'd [email protected] where applicable Srish Srinivasan (10): pseries/plpks: update PKS documentation and maintainer entry pseries/plpks: fix error handling in plpks_read_var() pseries/plpks: improve type consistency and parameter validation keys/trusted_keys: propagate wrapping key generation errors pseries/plpks: rename the default wrapping key macro pseries/plpks: fix self-reference in plpks_var initializer pseries/plpks: hide wrapping_features when unsupported pseries/plpks: add HCALLs for PKWM wrapping key life cycle management keys/trusted_keys: enable PKWM wrapping key selection by label pseries/plpks/wrapkey: expose PKWM wrapping key management to userspace via sysfs .../ABI/testing/sysfs-firmware-plpks | 106 ++++ Documentation/arch/powerpc/papr_hcalls.rst | 49 +- .../security/keys/trusted-encrypted.rst | 4 +- MAINTAINERS | 2 +- arch/powerpc/include/asm/hvcall.h | 5 +- arch/powerpc/include/asm/plpks.h | 40 +- arch/powerpc/platforms/pseries/Kconfig | 15 + arch/powerpc/platforms/pseries/Makefile | 1 + arch/powerpc/platforms/pseries/plpks-sysfs.c | 31 +- .../platforms/pseries/plpks-wrapkey-sysfs.c | 407 ++++++++++++ arch/powerpc/platforms/pseries/plpks.c | 577 ++++++++++++++++-- include/keys/trusted_pkwm.h | 3 + security/keys/trusted-keys/trusted_pkwm.c | 40 +- 13 files changed, 1210 insertions(+), 70 deletions(-) create mode 100644 arch/powerpc/platforms/pseries/plpks-wrapkey-sysfs.c -- 2.52.0
