pseries/plpks: expose PowerVM wrapping features via the sysfs

Starting with Power11, PowerVM supports a new feature called "Key Wrapping"
that protects user secrets by wrapping them using a hypervisor generated
wrapping key. The status of this feature can be read by the
H_PKS_GET_CONFIG HCALL.

Expose the Power LPAR Platform KeyStore (PLPKS) wrapping features config
via the sysfs file /sys/firmware/plpks/config/wrapping_features.

Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
Tested-by: Nayna Jain <nayna@linux.ibm.com>
Reviewed-by: Nayna Jain <nayna@linux.ibm.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20260127145228.48320-4-ssrish@linux.ibm.com

diff --git a/Documentation/ABI/testing/sysfs-firmware-plpks b/Documentation/ABI/testing/sysfs-firmware-plpks
index af0353f341151e98377902dd920db61511168122..cba061e4eee2a24e9171c94a128ac8fe0d3c4702 100644 (file)
--- a/Documentation/ABI/testing/sysfs-firmware-plpks
+++ b/Documentation/ABI/testing/sysfs-firmware-plpks
@@ -48,3 +48,11 @@ Description: Bitmask of flags indicating which algorithms the hypervisor
                supports for signed update of objects, represented as a 16 byte
                hexadecimal ASCII string. Consult the hypervisor documentation
                for what these flags mean.
+
+What:          /sys/firmware/plpks/config/wrapping_features
+Date:          November 2025
+Contact:       Srish Srinivasan <ssrish@linux.ibm.com>
+Description:   Bitmask of the wrapping features indicating the wrapping
+               algorithms that are supported for the H_PKS_WRAP_OBJECT requests
+               , represented as a 8 byte hexadecimal ASCII string. Consult the
+               hypervisor documentation for what these flags mean.

diff --git a/arch/powerpc/include/asm/hvcall.h b/arch/powerpc/include/asm/hvcall.h
index 9aef16149d9274c02e9e342484dc71b816ee6478..dff90a7d7f70b85b55408b01a3513c09e9aedf6a 100644 (file)
--- a/arch/powerpc/include/asm/hvcall.h
+++ b/arch/powerpc/include/asm/hvcall.h
@@ -360,7 +360,9 @@
 #define H_GUEST_RUN_VCPU       0x480
 #define H_GUEST_COPY_MEMORY    0x484
 #define H_GUEST_DELETE         0x488
-#define MAX_HCALL_OPCODE       H_GUEST_DELETE
+#define H_PKS_WRAP_OBJECT      0x490
+#define H_PKS_UNWRAP_OBJECT    0x494
+#define MAX_HCALL_OPCODE       H_PKS_UNWRAP_OBJECT
 
 /* Scope args for H_SCM_UNBIND_ALL */
 #define H_UNBIND_SCOPE_ALL (0x1)

diff --git a/arch/powerpc/include/asm/plpks.h b/arch/powerpc/include/asm/plpks.h
index 8829a13bfda0975fc0cb8ed30749948ab9376e17..8f034588fdf77a47061b34df5f83a190cd0b21e5 100644 (file)
--- a/arch/powerpc/include/asm/plpks.h
+++ b/arch/powerpc/include/asm/plpks.h
@@ -23,6 +23,7 @@
 #define PLPKS_IMMUTABLE                PPC_BIT32(5) // Once written, object cannot be removed
 #define PLPKS_TRANSIENT                PPC_BIT32(6) // Object does not persist through reboot
 #define PLPKS_SIGNEDUPDATE     PPC_BIT32(7) // Object can only be modified by signed updates
+#define PLPKS_WRAPPINGKEY      PPC_BIT32(8) // Object contains a wrapping key
 #define PLPKS_HVPROVISIONED    PPC_BIT32(28) // Hypervisor has provisioned this object
 
 // Signature algorithm flags from signed_update_algorithms
@@ -103,6 +104,8 @@ u32 plpks_get_maxlargeobjectsize(void);
 
 u64 plpks_get_signedupdatealgorithms(void);
 
+u64 plpks_get_wrappingfeatures(void);
+
 u16 plpks_get_passwordlen(void);
 
 void plpks_early_init_devtree(void);

diff --git a/arch/powerpc/platforms/pseries/plpks-sysfs.c b/arch/powerpc/platforms/pseries/plpks-sysfs.c
index 01d526185783c36347abb779609f263867c6b069..c2ebcbb41ae390b716cfd40c2c61a4d6eeaa6574 100644 (file)
--- a/arch/powerpc/platforms/pseries/plpks-sysfs.c
+++ b/arch/powerpc/platforms/pseries/plpks-sysfs.c
@@ -30,6 +30,7 @@ PLPKS_CONFIG_ATTR(used_space, "%u\n", plpks_get_usedspace);
 PLPKS_CONFIG_ATTR(supported_policies, "%08x\n", plpks_get_supportedpolicies);
 PLPKS_CONFIG_ATTR(signed_update_algorithms, "%016llx\n",
                  plpks_get_signedupdatealgorithms);
+PLPKS_CONFIG_ATTR(wrapping_features, "%016llx\n", plpks_get_wrappingfeatures);
 
 static const struct attribute *config_attrs[] = {
        &attr_version.attr,
@@ -38,6 +39,7 @@ static const struct attribute *config_attrs[] = {
        &attr_used_space.attr,
        &attr_supported_policies.attr,
        &attr_signed_update_algorithms.attr,
+       &attr_wrapping_features.attr,
        NULL,
 };
 

diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c
index 03722fabf9c3bc08292ce5c4b17bd48a0d358d6f..4a08f51537c8f9688e6a5e2484ff9f8699eaa86d 100644 (file)
--- a/arch/powerpc/platforms/pseries/plpks.c
+++ b/arch/powerpc/platforms/pseries/plpks.c
@@ -38,6 +38,7 @@ static u32 usedspace;
 static u32 supportedpolicies;
 static u32 maxlargeobjectsize;
 static u64 signedupdatealgorithms;
+static u64 wrappingfeatures;
 
 struct plpks_auth {
        u8 version;
@@ -248,6 +249,7 @@ static int _plpks_get_config(void)
                __be32 supportedpolicies;
                __be32 maxlargeobjectsize;
                __be64 signedupdatealgorithms;
+               __be64 wrappingfeatures;
                u8 rsvd1[476];
        } __packed * config;
        size_t size;
@@ -280,6 +282,7 @@ static int _plpks_get_config(void)
        supportedpolicies = be32_to_cpu(config->supportedpolicies);
        maxlargeobjectsize = be32_to_cpu(config->maxlargeobjectsize);
        signedupdatealgorithms = be64_to_cpu(config->signedupdatealgorithms);
+       wrappingfeatures = be64_to_cpu(config->wrappingfeatures);
 
        // Validate that the numbers we get back match the requirements of the spec
        if (maxpwsize < 32) {
@@ -472,6 +475,23 @@ u64 plpks_get_signedupdatealgorithms(void)
        return signedupdatealgorithms;
 }
 
+/**
+ * plpks_get_wrappingfeatures() - Returns a bitmask of the wrapping features
+ * supported by the hypervisor.
+ *
+ * Successful execution of the H_PKS_GET_CONFIG HCALL during initialization
+ * reads a bitmask of the wrapping features supported by the hypervisor into the
+ * file local static wrappingfeatures variable. This is valid only when the
+ * PLPKS config structure version >= 3.
+ *
+ * Return:
+ *     bitmask of the wrapping features supported by the hypervisor
+ */
+u64 plpks_get_wrappingfeatures(void)
+{
+       return wrappingfeatures;
+}
+
 /**
  * plpks_get_passwordlen() - Get the length of the PLPKS password in bytes.
  *