[PATCH v2 10/10] pseries/plpks/wrapkey: expose PKWM wrapping key management to userspace via sysfs
R Nageswara Sastry
rnsastry at linux.ibm.com
Fri Sep 4 06:19:27 UTC 2026
On 31.08.2026 4:47 PM, Srish Srinivasan wrote:
> The PKWM trusted source currently uses a single default wrapping key
> created during initialization. However, PKWM also supports user-created
> wrapping keys for better isolation between trusted keys.
>
> Expose wrapping key lifecycle operations through sysfs to allow users to
> create and manage their own wrapping keys.
>
> Create a sysfs interface at /sys/firmware/plpks/wrapkey with the following
> attributes:
>
> create - Create a new wrapping key with a user-provided label
> delete - Delete a revoked wrapping key by label
> revoke - Revoke a wrapping key by label
> unrevoke - Unrevoke a previously revoked wrapping key by label
> list_active - List labels of all active (non-revoked) wrapping keys
> list_revoked - List labels of all revoked wrapping keys
>
> User-provided labels are validated to contain only alphanumeric characters.
>
> Wrapping key lifecycle constraints:
> - A wrapping key must be revoked before it can be deleted
> - Revoked wrapping keys cannot be used for wrap operations until unrevoked
> - The default wrapping key cannot be revoked or deleted; it always appears
> in list_active
>
> The wrapping keys themselves are confidential objects stored in PLPKS. Only
> the user-provided labels are exposed to userspace for identification and
> management purposes.
>
> These user-created wrapping keys can be used in seal/unseal operations via
> the wrapping_key=<label> option.
>
> Signed-off-by: Srish Srinivasan <ssrish at linux.ibm.com>
Tested-by: R Nageswara Sastry <rnsastry at linux.ibm.com>
Tested on ppc64le PowerVM LPARs:
On firmware without revoke/unrevoke support:
- /sys/firmware/plpks/wrapkey is correctly absent; the kernel logs that
the H_PKS_{UN}REVOKE_OBJECT interface is not supported.
On firmware with revoke/unrevoke support, Secure Boot disabled:
- /sys/firmware/plpks/wrapkey is present with all six attributes:
create, delete, revoke, unrevoke, list_active, list_revoked.
- Full wrapping key lifecycle via sysfs (create, revoke, unrevoke,
delete)
works correctly.
- Sealing a trusted key with a user-created wrapping key and unsealing it
works. Unsealing fails as expected when the wrapping key is
revoked, and
succeeds again after unrevoking.
- Only root (CAP_SYS_ADMIN) can write to the sysfs attributes.
Non-alphanumeric labels are rejected. The default wrapping key is
protected from revoke and delete.
- Listing wrapping key labels (list_active, list_revoked) is consistent
across many keys, including the H_CONTINUE pagination path.
- PLPKS was filled to capacity with wrapping keys and confirmed to reject
further creation correctly; cleanup via sysfs restored the original
state.
- Concurrent Dynamic GSB secvar reads and wrapping key lifecycle
operations
complete without issue.
On firmware with revoke/unrevoke support, Secure Boot enabled:
- All sysfs interface functionality listed above passes.
> ---
> .../ABI/testing/sysfs-firmware-plpks | 106 +++++
> arch/powerpc/include/asm/plpks.h | 9 +
> arch/powerpc/platforms/pseries/Kconfig | 15 +
> arch/powerpc/platforms/pseries/Makefile | 1 +
> arch/powerpc/platforms/pseries/plpks-sysfs.c | 11 +
> .../platforms/pseries/plpks-wrapkey-sysfs.c | 407 ++++++++++++++++++
> arch/powerpc/platforms/pseries/plpks.c | 1 -
> 7 files changed, 549 insertions(+), 1 deletion(-)
> create mode 100644 arch/powerpc/platforms/pseries/plpks-wrapkey-sysfs.c
>
> diff --git a/Documentation/ABI/testing/sysfs-firmware-plpks b/Documentation/ABI/testing/sysfs-firmware-plpks
> index cba061e4eee2..ebcdef17a8a8 100644
> --- a/Documentation/ABI/testing/sysfs-firmware-plpks
> +++ b/Documentation/ABI/testing/sysfs-firmware-plpks
> @@ -56,3 +56,109 @@ Description: Bitmask of the wrapping features indicating the wrapping
> algorithms that are supported for the H_PKS_WRAP_OBJECT requests
> , represented as a 8 byte hexadecimal ASCII string. Consult the
> hypervisor documentation for what these flags mean.
> +
> +What: /sys/firmware/plpks/wrapkey
> +Date: August 2026
> +Contact: Srish Srinivasan <ssrish at linux.ibm.com>
> +Description: This directory provides the interface for creating and managing
> + user-created PKWM wrapping keys.
> +
> + The directory is present only when CONFIG_PLPKS_WRAPKEY_SYSFS is
> + enabled and the system supports the H_PKS_{UN}REVOKE_OBJECT
> + interfaces.
> +
> + Only alphanumeric characters are accepted in wrapping key
> + labels. The wrapping keys themselves are confidential PLPKS
> + objects and are not exposed to userspace. Only their labels are
> + exposed for identification and management.
> +
> + Each write is processed as an independent operation and accepts
> + exactly one wrapping key label. The resulting state can be
> + verified through list_active or list_revoked, as appropriate.
> +
> + The default wrapping key cannot be revoked or deleted.
> +
> +What: /sys/firmware/plpks/wrapkey/create
> +Date: August 2026
> +Contact: Srish Srinivasan <ssrish at linux.ibm.com>
> +Description: (WO) Create a wrapping key with the specified label.
> +
> + On success, the label appears in list_active.
> +
> + For example, to create a wrapping key labelled "wk1":
> +
> + echo -n wk1 > /sys/firmware/plpks/wrapkey/create
> +
> + or:
> +
> + printf '%s' 'wk1' > /sys/firmware/plpks/wrapkey/create
> +
> +What: /sys/firmware/plpks/wrapkey/delete
> +Date: August 2026
> +Contact: Srish Srinivasan <ssrish at linux.ibm.com>
> +Description: (WO) Delete a revoked wrapping key identified by the specified
> + label. A wrapping key must be revoked before it can be deleted.
> +
> + On success, the label no longer appears in list_revoked.
> +
> + For example, to delete a revoked wrapping key labelled "wk1":
> +
> + echo -n wk1 > /sys/firmware/plpks/wrapkey/delete
> +
> + or:
> +
> + printf '%s' 'wk1' > /sys/firmware/plpks/wrapkey/delete
> +
> +What: /sys/firmware/plpks/wrapkey/revoke
> +Date: August 2026
> +Contact: Srish Srinivasan <ssrish at linux.ibm.com>
> +Description: (WO) Revoke a wrapping key identified by the specified label. A
> + revoked wrapping key cannot be used for seal or unseal
> + operations until it is unrevoked.
> +
> + On success, the label appears in list_revoked and no longer
> + appears in list_active.
> +
> + For example, to revoke a wrapping key labelled "wk1":
> +
> + echo -n wk1 > /sys/firmware/plpks/wrapkey/revoke
> +
> + or:
> +
> + printf '%s' 'wk1' > /sys/firmware/plpks/wrapkey/revoke
> +
> +What: /sys/firmware/plpks/wrapkey/unrevoke
> +Date: August 2026
> +Contact: Srish Srinivasan <ssrish at linux.ibm.com>
> +Description: (WO) Unrevoke a revoked wrapping key identified by the specified
> + label.
> +
> + On success, the label appears in list_active and no longer
> + appears in list_revoked.
> +
> + For example, to unrevoke a revoked wrapping key labelled "wk1":
> +
> + echo -n wk1 > /sys/firmware/plpks/wrapkey/unrevoke
> +
> + or:
> +
> + printf '%s' 'wk1' > /sys/firmware/plpks/wrapkey/unrevoke
> +
> +What: /sys/firmware/plpks/wrapkey/list_active
> +Date: August 2026
> +Contact: Srish Srinivasan <ssrish at linux.ibm.com>
> +Description: (RO) List the labels of active, non-revoked wrapping keys. The
> + default wrapping key is always included in this list.
> +
> + For example:
> +
> + cat /sys/firmware/plpks/wrapkey/list_active
> +
> +What: /sys/firmware/plpks/wrapkey/list_revoked
> +Date: August 2026
> +Contact: Srish Srinivasan <ssrish at linux.ibm.com>
> +Description: (RO) List the labels of revoked wrapping keys.
> +
> + For example:
> +
> + cat /sys/firmware/plpks/wrapkey/list_revoked
> diff --git a/arch/powerpc/include/asm/plpks.h b/arch/powerpc/include/asm/plpks.h
> index badb07afe749..420945aeeb0e 100644
> --- a/arch/powerpc/include/asm/plpks.h
> +++ b/arch/powerpc/include/asm/plpks.h
> @@ -56,6 +56,8 @@
> // Component for a PKWM wrapping key
> #define PLPKS_WRAPKEY_COMPONENT "PLPKSWR"
>
> +#define PLPKS_OBJLABEL_LEN_FIELD_SIZE 2
> +
> struct plpks_var {
> char *component;
> u8 *name;
> @@ -144,6 +146,9 @@ int plpks_get_object_labels(u8 **output_buf, u64 *output_len,
>
> bool plpks_revoke_is_supported(void);
>
> +int plpks_init_child_kobj(struct kobject *kobj, const struct kobj_type *ktype,
> + const char *name);
> +
> #else // CONFIG_PSERIES_PLPKS
> static inline bool plpks_is_available(void) { return false; }
> static inline u16 plpks_get_passwordlen(void) { BUILD_BUG(); }
> @@ -151,6 +156,10 @@ static inline void plpks_early_init_devtree(void) { }
> static inline int plpks_populate_fdt(void *fdt) { BUILD_BUG(); }
> static inline int plpks_config_create_softlink(struct kobject *from)
> { return 0; }
> +static inline int plpks_init_child_kobj(struct kobject *kobj,
> + const struct kobj_type *ktype,
> + const char *name)
> + { return 0; }
> #endif // CONFIG_PSERIES_PLPKS
>
> #endif // _ASM_POWERPC_PLPKS_H
> diff --git a/arch/powerpc/platforms/pseries/Kconfig b/arch/powerpc/platforms/pseries/Kconfig
> index 74910ce3a541..d0dcfbae6fc9 100644
> --- a/arch/powerpc/platforms/pseries/Kconfig
> +++ b/arch/powerpc/platforms/pseries/Kconfig
> @@ -216,3 +216,18 @@ config PPC_SVM
> those guests.
>
> If unsure, say "N".
> +
> +config PLPKS_WRAPKEY_SYSFS
> + bool "Enable sysfs interface for managing PKWM wrapping keys"
> + default n
> + depends on PSERIES_PLPKS
> + depends on SYSFS
> + depends on TRUSTED_KEYS_PKWM
> + help
> + The PKWM trusted source supports user-created wrapping keys that are
> + managed by the OS. These wrapping keys can be created, revoked,
> + unrevoked, and deleted through sysfs. Their labels can also be viewed
> + through sysfs.
> +
> + Say Y if PLPKS and PKWM are enabled and you want to isolate trusted
> + keys using user-created wrapping keys.
> diff --git a/arch/powerpc/platforms/pseries/Makefile b/arch/powerpc/platforms/pseries/Makefile
> index 3ced289a675b..c604be40f546 100644
> --- a/arch/powerpc/platforms/pseries/Makefile
> +++ b/arch/powerpc/platforms/pseries/Makefile
> @@ -33,6 +33,7 @@ obj-$(CONFIG_FA_DUMP) += rtas-fadump.o
> obj-$(CONFIG_PSERIES_PLPKS) += plpks.o plpks-sysfs.o
> obj-$(CONFIG_PPC_SECURE_BOOT) += plpks-secvar.o
> obj-$(CONFIG_PSERIES_PLPKS_SED) += plpks_sed_ops.o
> +obj-$(CONFIG_PLPKS_WRAPKEY_SYSFS) += plpks-wrapkey-sysfs.o
> obj-$(CONFIG_SUSPEND) += suspend.o
> obj-$(CONFIG_PPC_VAS) += vas.o vas-sysfs.o
>
> diff --git a/arch/powerpc/platforms/pseries/plpks-sysfs.c b/arch/powerpc/platforms/pseries/plpks-sysfs.c
> index f2436229f323..0ca13bb6405f 100644
> --- a/arch/powerpc/platforms/pseries/plpks-sysfs.c
> +++ b/arch/powerpc/platforms/pseries/plpks-sysfs.c
> @@ -55,6 +55,17 @@ static umode_t plpks_config_attr_is_visible(struct kobject *kobj,
> return attr->mode;
> }
>
> +int plpks_init_child_kobj(struct kobject *kobj, const struct kobj_type *ktype,
> + const char *name)
> +{
> + kobject_init(kobj, ktype);
> +
> + if (!plpks_kobj)
> + return -ENODEV;
> +
> + return kobject_add(kobj, plpks_kobj, "%s", name);
> +}
> +
> int plpks_config_create_softlink(struct kobject *from)
> {
> if (!plpks_config_kobj)
> diff --git a/arch/powerpc/platforms/pseries/plpks-wrapkey-sysfs.c b/arch/powerpc/platforms/pseries/plpks-wrapkey-sysfs.c
> new file mode 100644
> index 000000000000..7493d3f58546
> --- /dev/null
> +++ b/arch/powerpc/platforms/pseries/plpks-wrapkey-sysfs.c
> @@ -0,0 +1,407 @@
> +// SPDX-License-Identifier: GPL-2.0+
> +/*
> + * Copyright (C) 2025 IBM Corporation <ssrish at linux.ibm.com>
> + *
> + * This code exposes wrapping key management options to the user via the
> + * sysfs
> + */
> +
> +#define pr_fmt(fmt) "wrapkey-sysfs: " fmt
> +#define PLPKS_WRAPKEY_REVOKED 1
> +#define PLPKS_WRAPKEY_UNREVOKED 0
> +
> +#include <linux/slab.h>
> +#include <linux/compat.h>
> +#include <linux/string.h>
> +#include <linux/of.h>
> +#include <linux/ctype.h>
> +#include <linux/unaligned.h>
> +#include <asm/plpks.h>
> +
> +static struct kobject *wrapkey_kobj;
> +
> +static bool is_wrapkey_label_alnum(const char *key_label, size_t len)
> +{
> + size_t i;
> +
> + for (i = 0; i < len; i++) {
> + if (!isalnum((unsigned char)key_label[i])) {
> + pr_err("key label <%*pE> is not alphanumeric\n",
> + (int)len, key_label);
> + return false;
> + }
> + }
> +
> + return true;
> +}
> +
> +static ssize_t list_key_labels(char *buf, u8 *obj_labels_buf,
> + u64 obj_labels_count, int revoked)
> +{
> + struct plpks_var var = {0};
> + u8 *obj_labels_buf_ptr, *comp_prefix;
> + u8 *key_label_ptr;
> + u16 obj_label_len;
> + int len = 0;
> + int is_revoked;
> + u64 i;
> +
> + var.os = PLPKS_VAR_LINUX;
> + var.component = PLPKS_WRAPKEY_COMPONENT;
> + obj_labels_buf_ptr = obj_labels_buf;
> +
> + for (i = 0; i < obj_labels_count; ++i) {
> + obj_label_len = get_unaligned_be16(obj_labels_buf_ptr);
> + comp_prefix = obj_labels_buf_ptr +
> + PLPKS_OBJLABEL_LEN_FIELD_SIZE;
> +
> + var.namelen = obj_label_len - PLPKS_MAX_LABEL_ATTR_SIZE;
> + var.name = kzalloc(var.namelen + 1, GFP_KERNEL);
> +
> + if (!var.name)
> + return -ENOMEM;
> +
> + key_label_ptr = comp_prefix + PLPKS_MAX_LABEL_ATTR_SIZE;
> + memcpy(var.name, key_label_ptr, var.namelen);
> +
> + is_revoked = plpks_is_wrapping_key_revoked(&var);
> + if (is_revoked == revoked)
> + len += sysfs_emit_at(buf, len, "<%s>\n",
> + (char *)var.name);
> + else if (is_revoked < 0)
> + pr_warn("Failed to get revocation status for <%s>\n",
> + (char *)var.name);
> +
> + kfree(var.name);
> + obj_labels_buf_ptr = key_label_ptr + var.namelen;
> + }
> +
> + return len;
> +}
> +
> +static ssize_t list_active_show(struct kobject *kobj,
> + struct kobj_attribute *attr, char *buf)
> +{
> + u8 *obj_labels_buf;
> + u64 obj_labels_count = 0;
> + int rc;
> +
> + rc = plpks_get_object_labels(&obj_labels_buf, &obj_labels_count,
> + PLPKS_WRAPKEY_COMPONENT);
> + if (rc) {
> + pr_err("Retrieving object labels failed. rc=%d\n", rc);
> + goto out;
> + }
> +
> + rc = list_key_labels(buf, obj_labels_buf, obj_labels_count,
> + PLPKS_WRAPKEY_UNREVOKED);
> +
> +out:
> + kfree(obj_labels_buf);
> + return rc;
> +}
> +
> +static ssize_t list_revoked_show(struct kobject *kobj,
> + struct kobj_attribute *attr, char *buf)
> +{
> + u8 *obj_labels_buf;
> + u64 obj_labels_count = 0;
> + int rc;
> +
> + rc = plpks_get_object_labels(&obj_labels_buf, &obj_labels_count,
> + PLPKS_WRAPKEY_COMPONENT);
> + if (rc) {
> + pr_err("Retrieving object labels failed. rc=%d\n", rc);
> + goto out;
> + }
> +
> + rc = list_key_labels(buf, obj_labels_buf, obj_labels_count,
> + PLPKS_WRAPKEY_REVOKED);
> +
> +out:
> + kfree(obj_labels_buf);
> + return rc;
> +}
> +
> +static ssize_t create_store(struct kobject *kobj, struct kobj_attribute *attr,
> + const char *buf, size_t count)
> +{
> + struct plpks_var var = {0};
> + int rc;
> +
> + if (!capable(CAP_SYS_ADMIN)) {
> + rc = -EPERM;
> + goto out;
> + }
> +
> + if (!count) {
> + rc = -EINVAL;
> + goto out;
> + }
> +
> + if (count > PLPKS_MAX_NAME_SIZE) {
> + rc = -ENAMETOOLONG;
> + goto out;
> + }
> +
> + if (!strcmp(buf, PLPKS_DEFAULT_WRAPKEY_LABEL)) {
> + pr_warn("<%s> creation is restricted to pkwm init\n",
> + PLPKS_DEFAULT_WRAPKEY_LABEL);
> + rc = -EPERM;
> + goto out;
> + }
> +
> + if (!is_wrapkey_label_alnum(buf, count)) {
> + rc = -EINVAL;
> + goto out;
> + }
> +
> + var.name = kstrndup(buf, count, GFP_KERNEL);
> + if (!var.name) {
> + rc = -ENOMEM;
> + goto out;
> + }
> +
> + var.namelen = count;
> + var.policy = PLPKS_WRAPPINGKEY;
> + var.os = PLPKS_VAR_LINUX;
> + var.component = PLPKS_WRAPKEY_COMPONENT;
> +
> + rc = plpks_gen_wrapping_key(&var);
> + if (rc) {
> + pr_err("creation of wrapping key <%s> failed. rc = %d\n",
> + (char *)var.name, rc);
> + goto out;
> + }
> +
> + rc = count;
> +out:
> + kfree(var.name);
> + return rc;
> +}
> +
> +static ssize_t revoke_store(struct kobject *kobj, struct kobj_attribute *attr,
> + const char *buf, size_t count)
> +{
> + struct plpks_var var = {0};
> + int rc;
> +
> + if (!capable(CAP_SYS_ADMIN)) {
> + rc = -EPERM;
> + goto out;
> + }
> +
> + if (!count) {
> + rc = -EINVAL;
> + goto out;
> + }
> +
> + if (count > PLPKS_MAX_NAME_SIZE) {
> + rc = -ENAMETOOLONG;
> + goto out;
> + }
> +
> + if (!strcmp(buf, PLPKS_DEFAULT_WRAPKEY_LABEL)) {
> + pr_warn("<%s> must not be revoked\n",
> + PLPKS_DEFAULT_WRAPKEY_LABEL);
> + rc = -EPERM;
> + goto out;
> + }
> +
> + if (!is_wrapkey_label_alnum(buf, count)) {
> + rc = -EINVAL;
> + goto out;
> + }
> +
> + var.name = kstrndup(buf, count, GFP_KERNEL);
> + if (!var.name) {
> + rc = -ENOMEM;
> + goto out;
> + }
> +
> + var.namelen = count;
> + var.os = PLPKS_VAR_LINUX;
> + var.component = PLPKS_WRAPKEY_COMPONENT;
> +
> + rc = plpks_revoke_wrapping_key(&var);
> +
> + if (rc) {
> + pr_err("revocation of wrapping key <%s> failed. rc = %d\n",
> + (char *)var.name, rc);
> + goto out;
> + }
> +
> + rc = count;
> +out:
> + kfree(var.name);
> + return rc;
> +}
> +
> +static ssize_t unrevoke_store(struct kobject *kobj, struct kobj_attribute *attr,
> + const char *buf, size_t count)
> +{
> + struct plpks_var var = {0};
> + int rc;
> +
> + if (!capable(CAP_SYS_ADMIN)) {
> + rc = -EPERM;
> + goto out;
> + }
> +
> + if (!count) {
> + rc = -EINVAL;
> + goto out;
> + }
> +
> + if (count > PLPKS_MAX_NAME_SIZE) {
> + rc = -ENAMETOOLONG;
> + goto out;
> + }
> +
> + if (!strcmp(buf, PLPKS_DEFAULT_WRAPKEY_LABEL)) {
> + pr_warn("unrevoke on <%s> is invalid\n",
> + PLPKS_DEFAULT_WRAPKEY_LABEL);
> + rc = -EINVAL;
> + goto out;
> + }
> +
> + if (!is_wrapkey_label_alnum(buf, count)) {
> + rc = -EINVAL;
> + goto out;
> + }
> +
> + var.name = kstrndup(buf, count, GFP_KERNEL);
> + if (!var.name) {
> + rc = -ENOMEM;
> + goto out;
> + }
> +
> + var.namelen = count;
> + var.os = PLPKS_VAR_LINUX;
> + var.component = PLPKS_WRAPKEY_COMPONENT;
> +
> + rc = plpks_unrevoke_wrapping_key(&var);
> +
> + if (rc) {
> + pr_err("un-revocation of wrapping key <%s> failed. rc = %d\n",
> + (char *)var.name, rc);
> + goto out;
> + }
> +
> + rc = count;
> +out:
> + kfree(var.name);
> + return rc;
> +}
> +
> +static ssize_t delete_store(struct kobject *kobj, struct kobj_attribute *attr,
> + const char *buf, size_t count)
> +{
> + struct plpks_var var = {0};
> + int rc;
> +
> + if (!capable(CAP_SYS_ADMIN)) {
> + rc = -EPERM;
> + goto out;
> + }
> +
> + if (!count) {
> + rc = -EINVAL;
> + goto out;
> + }
> +
> + if (count > PLPKS_MAX_NAME_SIZE) {
> + rc = -ENAMETOOLONG;
> + goto out;
> + }
> +
> + if (!strcmp(buf, PLPKS_DEFAULT_WRAPKEY_LABEL)) {
> + pr_warn("<%s> must not be deleted\n",
> + PLPKS_DEFAULT_WRAPKEY_LABEL);
> + rc = -EPERM;
> + goto out;
> + }
> +
> + if (!is_wrapkey_label_alnum(buf, count)) {
> + rc = -EINVAL;
> + goto out;
> + }
> +
> + var.name = kstrndup(buf, count, GFP_KERNEL);
> + if (!var.name) {
> + rc = -ENOMEM;
> + goto out;
> + }
> +
> + var.namelen = count;
> + var.os = PLPKS_VAR_LINUX;
> + var.component = PLPKS_WRAPKEY_COMPONENT;
> +
> + rc = plpks_del_wrapping_key(&var);
> +
> + if (rc) {
> + pr_err("deletion of wrapping key <%s> failed. rc = %d\n",
> + (char *)var.name, rc);
> + goto out;
> + }
> +
> + rc = count;
> +out:
> + kfree(var.name);
> + return rc;
> +}
> +
> +static struct kobj_attribute view_active_attr = __ATTR_RO(list_active);
> +
> +static struct kobj_attribute view_revoked_attr = __ATTR_RO(list_revoked);
> +
> +static struct kobj_attribute create_attr = __ATTR_WO(create);
> +
> +static struct kobj_attribute revoke_attr = __ATTR_WO(revoke);
> +
> +static struct kobj_attribute unrevoke_attr = __ATTR_WO(unrevoke);
> +
> +static struct kobj_attribute delete_attr = __ATTR_WO(delete);
> +
> +static struct attribute *wrapkey_attrs[] = {
> + &view_active_attr.attr,
> + &view_revoked_attr.attr,
> + &create_attr.attr,
> + &revoke_attr.attr,
> + &unrevoke_attr.attr,
> + &delete_attr.attr,
> + NULL,
> +};
> +
> +static const struct attribute_group wrapkey_attr_group = {
> + .attrs = wrapkey_attrs,
> +};
> +__ATTRIBUTE_GROUPS(wrapkey_attr);
> +
> +static const struct kobj_type wrapkey_ktype = {
> + .sysfs_ops = &kobj_sysfs_ops,
> + .default_groups = wrapkey_attr_groups,
> +};
> +
> +static __init int wrapkey_sysfs_init(void)
> +{
> + int rc;
> +
> + if (!plpks_revoke_is_supported()) {
> + pr_err("H_PKS_{UN}REVOKE_OBJECT interface not supported\n");
> + return -ENODEV;
> + }
> +
> + wrapkey_kobj = kzalloc_obj(*wrapkey_kobj);
> + if (!wrapkey_kobj)
> + return -ENOMEM;
> +
> + rc = plpks_init_child_kobj(wrapkey_kobj, &wrapkey_ktype, "wrapkey");
> +
> + if (rc)
> + kobject_put(wrapkey_kobj);
> +
> + return rc;
> +}
> +
> +late_initcall(wrapkey_sysfs_init);
> diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c
> index 5cdaabe9de06..1666c1889e43 100644
> --- a/arch/powerpc/platforms/pseries/plpks.c
> +++ b/arch/powerpc/platforms/pseries/plpks.c
> @@ -25,7 +25,6 @@
> */
> #define PLPKS_OBJLABEL_BUF_MAX 2550
>
> -#define PLPKS_OBJLABEL_LEN_FIELD_SIZE 2
> #define PLPKS_OBJLABEL_PREFIX_LEN 8
>
> #define PLPKS_WRAP_INTERFACE_BIT 3
--
Thanks and Regards
R.Nageswara Sastry
More information about the Linux-security-module-archive
mailing list