The PKWM trusted source currently uses a single default wrapping key per LPAR. This key is created during trusted source initialization, and all trusted keys backed by PKWM are sealed and unsealed using it.
Recent versions of PKWM allow users to create and manage their own wrapping keys through a set of lifecycle operations. This patch series brings these PKWM capabilities into the kernel, allowing users to create, manage, and select wrapping keys for sealing and unsealing their trusted keys, rather than requiring all trusted keys to use the default wrapping key. This series extends PKWM to support user-created wrapping keys. It adds the required hcalls, allows users to select a wrapping key by label when creating PKWM-backed trusted keys, and introduces a sysfs interface for managing wrapping keys from userspace. This patchset also includes three fixes: one aligning the PLPKS wrapping length types with the underlying hcall interfaces, another preserving the original error returned when default wrapping key generation fails, and a third clearing sensitive PKWM seal and unseal buffers before freeing them. This series depends on the following PLPKS refactoring and hardening series and must be applied on top of it: https://lore.kernel.org/all/[email protected]/ Changelog: v2 -> v3: - Moved most of the refactoring and hardening patches into a separate series: https://lore.kernel.org/all/[email protected]/ - Added a fix to clear sensitive PKWM seal and unseal buffers before freeing them - Retained Nageswara's Tested-by tag - Refined error handling and documented default wrapping key restrictions v1 -> v2: - Addressed parameter validation issues reported by Nageswara - Tweaked PLPKS_WRAPKEY_SYSFS Kconfig help text - Added two preparatory bug-fix patches - Cc'd [email protected] where applicable Srish Srinivasan (6): pseries/plpks: fix length types for wrapping operations keys/trusted_keys: propagate wrapping key generation errors keys/trusted_keys: clear sensitive PKWM buffers pseries/plpks: add HCALLs for PKWM wrapping key life cycle management keys/trusted_keys: enable PKWM wrapping key selection by label pseries/plpks/wrapkey: expose PKWM wrapping key management to userspace via sysfs .../ABI/testing/sysfs-firmware-plpks | 116 ++++ Documentation/arch/powerpc/papr_hcalls.rst | 33 ++ .../security/keys/trusted-encrypted.rst | 4 +- arch/powerpc/include/asm/hvcall.h | 5 +- arch/powerpc/include/asm/plpks.h | 40 +- arch/powerpc/platforms/pseries/Kconfig | 15 + arch/powerpc/platforms/pseries/Makefile | 1 + arch/powerpc/platforms/pseries/plpks-sysfs.c | 11 + .../platforms/pseries/plpks-wrapkey-sysfs.c | 399 ++++++++++++++ arch/powerpc/platforms/pseries/plpks.c | 502 ++++++++++++++++-- include/keys/trusted_pkwm.h | 3 + security/keys/trusted-keys/trusted_pkwm.c | 48 +- 12 files changed, 1126 insertions(+), 51 deletions(-) create mode 100644 arch/powerpc/platforms/pseries/plpks-wrapkey-sysfs.c -- 2.52.0
