1. Patchew
  2. linux
  3. [PATCH v4 0/6] Extend "trusted" keys to support a new trust source named the PowerVM Key Wrapping Module (PKWM)
  4. View patch

[PATCH v4 3/6] pseries/plpks: expose PowerVM wrapping features via the sysfs

Srish Srinivasan posted 6 patches 3 weeks, 3 days ago
There is a newer version of this series
[PATCH v4 3/6] pseries/plpks: expose PowerVM wrapping features via the sysfs
Posted by Srish Srinivasan 3 weeks, 3 days ago 
Starting with Power11, PowerVM supports a new feature called "Key Wrapping"
that protects user secrets by wrapping them using a hypervisor generated
wrapping key. The status of this feature can be read by the
H_PKS_GET_CONFIG HCALL.

Expose the Power LPAR Platform KeyStore (PLPKS) wrapping features config
via the sysfs file /sys/firmware/plpks/config/wrapping_features.

Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
---
 .../ABI/testing/sysfs-firmware-plpks          |  8 ++++++++
 arch/powerpc/include/asm/hvcall.h             |  4 +++-
 arch/powerpc/include/asm/plpks.h              |  3 +++
 arch/powerpc/platforms/pseries/plpks-sysfs.c  |  2 ++
 arch/powerpc/platforms/pseries/plpks.c        | 20 +++++++++++++++++++
 5 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/Documentation/ABI/testing/sysfs-firmware-plpks b/Documentation/ABI/testing/sysfs-firmware-plpks
index af0353f34115..cba061e4eee2 100644
--- a/Documentation/ABI/testing/sysfs-firmware-plpks
+++ b/Documentation/ABI/testing/sysfs-firmware-plpks
@@ -48,3 +48,11 @@ Description:	Bitmask of flags indicating which algorithms the hypervisor
 		supports for signed update of objects, represented as a 16 byte
 		hexadecimal ASCII string. Consult the hypervisor documentation
 		for what these flags mean.
+
+What:		/sys/firmware/plpks/config/wrapping_features
+Date:		November 2025
+Contact:	Srish Srinivasan <ssrish@linux.ibm.com>
+Description:	Bitmask of the wrapping features indicating the wrapping
+		algorithms that are supported for the H_PKS_WRAP_OBJECT requests
+		, represented as a 8 byte hexadecimal ASCII string. Consult the
+		hypervisor documentation for what these flags mean.
diff --git a/arch/powerpc/include/asm/hvcall.h b/arch/powerpc/include/asm/hvcall.h
index 9aef16149d92..dff90a7d7f70 100644
--- a/arch/powerpc/include/asm/hvcall.h
+++ b/arch/powerpc/include/asm/hvcall.h
@@ -360,7 +360,9 @@
 #define H_GUEST_RUN_VCPU	0x480
 #define H_GUEST_COPY_MEMORY	0x484
 #define H_GUEST_DELETE		0x488
-#define MAX_HCALL_OPCODE	H_GUEST_DELETE
+#define H_PKS_WRAP_OBJECT	0x490
+#define H_PKS_UNWRAP_OBJECT	0x494
+#define MAX_HCALL_OPCODE	H_PKS_UNWRAP_OBJECT
 
 /* Scope args for H_SCM_UNBIND_ALL */
 #define H_UNBIND_SCOPE_ALL (0x1)
diff --git a/arch/powerpc/include/asm/plpks.h b/arch/powerpc/include/asm/plpks.h
index 8829a13bfda0..8f034588fdf7 100644
--- a/arch/powerpc/include/asm/plpks.h
+++ b/arch/powerpc/include/asm/plpks.h
@@ -23,6 +23,7 @@
 #define PLPKS_IMMUTABLE		PPC_BIT32(5) // Once written, object cannot be removed
 #define PLPKS_TRANSIENT		PPC_BIT32(6) // Object does not persist through reboot
 #define PLPKS_SIGNEDUPDATE	PPC_BIT32(7) // Object can only be modified by signed updates
+#define PLPKS_WRAPPINGKEY	PPC_BIT32(8) // Object contains a wrapping key
 #define PLPKS_HVPROVISIONED	PPC_BIT32(28) // Hypervisor has provisioned this object
 
 // Signature algorithm flags from signed_update_algorithms
@@ -103,6 +104,8 @@ u32 plpks_get_maxlargeobjectsize(void);
 
 u64 plpks_get_signedupdatealgorithms(void);
 
+u64 plpks_get_wrappingfeatures(void);
+
 u16 plpks_get_passwordlen(void);
 
 void plpks_early_init_devtree(void);
diff --git a/arch/powerpc/platforms/pseries/plpks-sysfs.c b/arch/powerpc/platforms/pseries/plpks-sysfs.c
index 01d526185783..c2ebcbb41ae3 100644
--- a/arch/powerpc/platforms/pseries/plpks-sysfs.c
+++ b/arch/powerpc/platforms/pseries/plpks-sysfs.c
@@ -30,6 +30,7 @@ PLPKS_CONFIG_ATTR(used_space, "%u\n", plpks_get_usedspace);
 PLPKS_CONFIG_ATTR(supported_policies, "%08x\n", plpks_get_supportedpolicies);
 PLPKS_CONFIG_ATTR(signed_update_algorithms, "%016llx\n",
 		  plpks_get_signedupdatealgorithms);
+PLPKS_CONFIG_ATTR(wrapping_features, "%016llx\n", plpks_get_wrappingfeatures);
 
 static const struct attribute *config_attrs[] = {
 	&attr_version.attr,
@@ -38,6 +39,7 @@ static const struct attribute *config_attrs[] = {
 	&attr_used_space.attr,
 	&attr_supported_policies.attr,
 	&attr_signed_update_algorithms.attr,
+	&attr_wrapping_features.attr,
 	NULL,
 };
 
diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c
index 03722fabf9c3..4a08f51537c8 100644
--- a/arch/powerpc/platforms/pseries/plpks.c
+++ b/arch/powerpc/platforms/pseries/plpks.c
@@ -38,6 +38,7 @@ static u32 usedspace;
 static u32 supportedpolicies;
 static u32 maxlargeobjectsize;
 static u64 signedupdatealgorithms;
+static u64 wrappingfeatures;
 
 struct plpks_auth {
 	u8 version;
@@ -248,6 +249,7 @@ static int _plpks_get_config(void)
 		__be32 supportedpolicies;
 		__be32 maxlargeobjectsize;
 		__be64 signedupdatealgorithms;
+		__be64 wrappingfeatures;
 		u8 rsvd1[476];
 	} __packed * config;
 	size_t size;
@@ -280,6 +282,7 @@ static int _plpks_get_config(void)
 	supportedpolicies = be32_to_cpu(config->supportedpolicies);
 	maxlargeobjectsize = be32_to_cpu(config->maxlargeobjectsize);
 	signedupdatealgorithms = be64_to_cpu(config->signedupdatealgorithms);
+	wrappingfeatures = be64_to_cpu(config->wrappingfeatures);
 
 	// Validate that the numbers we get back match the requirements of the spec
 	if (maxpwsize < 32) {
@@ -472,6 +475,23 @@ u64 plpks_get_signedupdatealgorithms(void)
 	return signedupdatealgorithms;
 }
 
+/**
+ * plpks_get_wrappingfeatures() - Returns a bitmask of the wrapping features
+ * supported by the hypervisor.
+ *
+ * Successful execution of the H_PKS_GET_CONFIG HCALL during initialization
+ * reads a bitmask of the wrapping features supported by the hypervisor into the
+ * file local static wrappingfeatures variable. This is valid only when the
+ * PLPKS config structure version >= 3.
+ *
+ * Return:
+ *	bitmask of the wrapping features supported by the hypervisor
+ */
+u64 plpks_get_wrappingfeatures(void)
+{
+	return wrappingfeatures;
+}
+
 /**
  * plpks_get_passwordlen() - Get the length of the PLPKS password in bytes.
  *
-- 
2.47.3
Re: [PATCH v4 3/6] pseries/plpks: expose PowerVM wrapping features via the sysfs
Posted by Nayna Jain 3 weeks, 2 days ago 
On 1/15/26 5:05 AM, Srish Srinivasan wrote:
> Starting with Power11, PowerVM supports a new feature called "Key Wrapping"
> that protects user secrets by wrapping them using a hypervisor generated
> wrapping key. The status of this feature can be read by the
> H_PKS_GET_CONFIG HCALL.
>
> Expose the Power LPAR Platform KeyStore (PLPKS) wrapping features config
> via the sysfs file /sys/firmware/plpks/config/wrapping_features.
Thanks for the patch.

Reviewed-by: Nayna Jain <nayna@linux.ibm.com>
>
> Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
> ---
>   .../ABI/testing/sysfs-firmware-plpks          |  8 ++++++++
>   arch/powerpc/include/asm/hvcall.h             |  4 +++-
>   arch/powerpc/include/asm/plpks.h              |  3 +++
>   arch/powerpc/platforms/pseries/plpks-sysfs.c  |  2 ++
>   arch/powerpc/platforms/pseries/plpks.c        | 20 +++++++++++++++++++
>   5 files changed, 36 insertions(+), 1 deletion(-)
>
> diff --git a/Documentation/ABI/testing/sysfs-firmware-plpks b/Documentation/ABI/testing/sysfs-firmware-plpks
> index af0353f34115..cba061e4eee2 100644
> --- a/Documentation/ABI/testing/sysfs-firmware-plpks
> +++ b/Documentation/ABI/testing/sysfs-firmware-plpks
> @@ -48,3 +48,11 @@ Description:	Bitmask of flags indicating which algorithms the hypervisor
>   		supports for signed update of objects, represented as a 16 byte
>   		hexadecimal ASCII string. Consult the hypervisor documentation
>   		for what these flags mean.
> +
> +What:		/sys/firmware/plpks/config/wrapping_features
> +Date:		November 2025
> +Contact:	Srish Srinivasan <ssrish@linux.ibm.com>
> +Description:	Bitmask of the wrapping features indicating the wrapping
> +		algorithms that are supported for the H_PKS_WRAP_OBJECT requests
> +		, represented as a 8 byte hexadecimal ASCII string. Consult the
> +		hypervisor documentation for what these flags mean.
> diff --git a/arch/powerpc/include/asm/hvcall.h b/arch/powerpc/include/asm/hvcall.h
> index 9aef16149d92..dff90a7d7f70 100644
> --- a/arch/powerpc/include/asm/hvcall.h
> +++ b/arch/powerpc/include/asm/hvcall.h
> @@ -360,7 +360,9 @@
>   #define H_GUEST_RUN_VCPU	0x480
>   #define H_GUEST_COPY_MEMORY	0x484
>   #define H_GUEST_DELETE		0x488
> -#define MAX_HCALL_OPCODE	H_GUEST_DELETE
> +#define H_PKS_WRAP_OBJECT	0x490
> +#define H_PKS_UNWRAP_OBJECT	0x494
> +#define MAX_HCALL_OPCODE	H_PKS_UNWRAP_OBJECT
>   
>   /* Scope args for H_SCM_UNBIND_ALL */
>   #define H_UNBIND_SCOPE_ALL (0x1)
> diff --git a/arch/powerpc/include/asm/plpks.h b/arch/powerpc/include/asm/plpks.h
> index 8829a13bfda0..8f034588fdf7 100644
> --- a/arch/powerpc/include/asm/plpks.h
> +++ b/arch/powerpc/include/asm/plpks.h
> @@ -23,6 +23,7 @@
>   #define PLPKS_IMMUTABLE		PPC_BIT32(5) // Once written, object cannot be removed
>   #define PLPKS_TRANSIENT		PPC_BIT32(6) // Object does not persist through reboot
>   #define PLPKS_SIGNEDUPDATE	PPC_BIT32(7) // Object can only be modified by signed updates
> +#define PLPKS_WRAPPINGKEY	PPC_BIT32(8) // Object contains a wrapping key
>   #define PLPKS_HVPROVISIONED	PPC_BIT32(28) // Hypervisor has provisioned this object
>   
>   // Signature algorithm flags from signed_update_algorithms
> @@ -103,6 +104,8 @@ u32 plpks_get_maxlargeobjectsize(void);
>   
>   u64 plpks_get_signedupdatealgorithms(void);
>   
> +u64 plpks_get_wrappingfeatures(void);
> +
>   u16 plpks_get_passwordlen(void);
>   
>   void plpks_early_init_devtree(void);
> diff --git a/arch/powerpc/platforms/pseries/plpks-sysfs.c b/arch/powerpc/platforms/pseries/plpks-sysfs.c
> index 01d526185783..c2ebcbb41ae3 100644
> --- a/arch/powerpc/platforms/pseries/plpks-sysfs.c
> +++ b/arch/powerpc/platforms/pseries/plpks-sysfs.c
> @@ -30,6 +30,7 @@ PLPKS_CONFIG_ATTR(used_space, "%u\n", plpks_get_usedspace);
>   PLPKS_CONFIG_ATTR(supported_policies, "%08x\n", plpks_get_supportedpolicies);
>   PLPKS_CONFIG_ATTR(signed_update_algorithms, "%016llx\n",
>   		  plpks_get_signedupdatealgorithms);
> +PLPKS_CONFIG_ATTR(wrapping_features, "%016llx\n", plpks_get_wrappingfeatures);
>   
>   static const struct attribute *config_attrs[] = {
>   	&attr_version.attr,
> @@ -38,6 +39,7 @@ static const struct attribute *config_attrs[] = {
>   	&attr_used_space.attr,
>   	&attr_supported_policies.attr,
>   	&attr_signed_update_algorithms.attr,
> +	&attr_wrapping_features.attr,
>   	NULL,
>   };
>   
> diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c
> index 03722fabf9c3..4a08f51537c8 100644
> --- a/arch/powerpc/platforms/pseries/plpks.c
> +++ b/arch/powerpc/platforms/pseries/plpks.c
> @@ -38,6 +38,7 @@ static u32 usedspace;
>   static u32 supportedpolicies;
>   static u32 maxlargeobjectsize;
>   static u64 signedupdatealgorithms;
> +static u64 wrappingfeatures;
>   
>   struct plpks_auth {
>   	u8 version;
> @@ -248,6 +249,7 @@ static int _plpks_get_config(void)
>   		__be32 supportedpolicies;
>   		__be32 maxlargeobjectsize;
>   		__be64 signedupdatealgorithms;
> +		__be64 wrappingfeatures;
>   		u8 rsvd1[476];
>   	} __packed * config;
>   	size_t size;
> @@ -280,6 +282,7 @@ static int _plpks_get_config(void)
>   	supportedpolicies = be32_to_cpu(config->supportedpolicies);
>   	maxlargeobjectsize = be32_to_cpu(config->maxlargeobjectsize);
>   	signedupdatealgorithms = be64_to_cpu(config->signedupdatealgorithms);
> +	wrappingfeatures = be64_to_cpu(config->wrappingfeatures);
>   
>   	// Validate that the numbers we get back match the requirements of the spec
>   	if (maxpwsize < 32) {
> @@ -472,6 +475,23 @@ u64 plpks_get_signedupdatealgorithms(void)
>   	return signedupdatealgorithms;
>   }
>   
> +/**
> + * plpks_get_wrappingfeatures() - Returns a bitmask of the wrapping features
> + * supported by the hypervisor.
> + *
> + * Successful execution of the H_PKS_GET_CONFIG HCALL during initialization
> + * reads a bitmask of the wrapping features supported by the hypervisor into the
> + * file local static wrappingfeatures variable. This is valid only when the
> + * PLPKS config structure version >= 3.
> + *
> + * Return:
> + *	bitmask of the wrapping features supported by the hypervisor
> + */
> +u64 plpks_get_wrappingfeatures(void)
> +{
> +	return wrappingfeatures;
> +}
> +
>   /**
>    * plpks_get_passwordlen() - Get the length of the PLPKS password in bytes.
>    *

Patchew 2.1-devel-b67e4c2

© 2016 - 2026 Red Hat, Inc.