{"id":2175288,"url":"http://patchwork.ozlabs.org/api/1.0/patches/2175288/?format=json","project":{"id":2,"url":"http://patchwork.ozlabs.org/api/1.0/projects/2/?format=json","name":"Linux PPC development","link_name":"linuxppc-dev","list_id":"linuxppc-dev.lists.ozlabs.org","list_email":"linuxppc-dev@lists.ozlabs.org","web_url":"https://github.com/linuxppc/wiki/wiki","scm_url":"https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git","webscm_url":"https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git/"},"msgid":"<20251217172505.112398-4-ssrish@linux.ibm.com>","date":"2025-12-17T17:25:02","name":"[v2,3/6] pseries/plpks: expose PowerVM wrapping features via the sysfs","commit_ref":null,"pull_url":null,"state":"superseded","archived":false,"hash":"b45c64dbbdc0c4d32e9526d322a86af232e87229","submitter":{"id":90762,"url":"http://patchwork.ozlabs.org/api/1.0/people/90762/?format=json","name":"Srish Srinivasan","email":"ssrish@linux.ibm.com"},"delegate":null,"mbox":"http://patchwork.ozlabs.org/project/linuxppc-dev/patch/20251217172505.112398-4-ssrish@linux.ibm.com/mbox/","series":[{"id":485734,"url":"http://patchwork.ozlabs.org/api/1.0/series/485734/?format=json","date":"2025-12-17T17:24:59","name":"Extend \"trusted\" keys to support a new trust source named the PowerVM Key Wrapping Module (PKWM)","version":2,"mbox":"http://patchwork.ozlabs.org/series/485734/mbox/"}],"check":"pending","checks":"http://patchwork.ozlabs.org/api/patches/2175288/checks/","tags":{},"headers":{"Return-Path":"\n ","X-Original-To":["incoming@patchwork.ozlabs.org","linuxppc-dev@lists.ozlabs.org"],"Delivered-To":"patchwork-incoming@legolas.ozlabs.org","Authentication-Results":["legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=ibm.com header.i=@ibm.com header.a=rsa-sha256\n header.s=pp1 header.b=ZXp7KMFs;\n\tdkim-atps=neutral","legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.ozlabs.org\n (client-ip=112.213.38.117; helo=lists.ozlabs.org;\n envelope-from=linuxppc-dev+bounces-14847-incoming=patchwork.ozlabs.org@lists.ozlabs.org;\n receiver=patchwork.ozlabs.org)","lists.ozlabs.org;\n arc=none smtp.remote-ip=148.163.156.1","lists.ozlabs.org;\n dmarc=pass (p=none dis=none) header.from=linux.ibm.com","lists.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=ibm.com header.i=@ibm.com header.a=rsa-sha256\n header.s=pp1 header.b=ZXp7KMFs;\n\tdkim-atps=neutral","lists.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=linux.ibm.com\n (client-ip=148.163.156.1; helo=mx0a-001b2d01.pphosted.com;\n envelope-from=ssrish@linux.ibm.com; receiver=lists.ozlabs.org)"],"Received":["from lists.ozlabs.org (lists.ozlabs.org [112.213.38.117])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4dWggN2tVRz1y0P\n\tfor ; Thu, 18 Dec 2025 04:25:52 +1100 (AEDT)","from boromir.ozlabs.org (localhost [127.0.0.1])\n\tby lists.ozlabs.org (Postfix) with ESMTP id 4dWgg51PDWz30Wh;\n\tThu, 18 Dec 2025 04:25:37 +1100 (AEDT)","from mx0a-001b2d01.pphosted.com (mx0a-001b2d01.pphosted.com\n [148.163.156.1])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby lists.ozlabs.org (Postfix) with ESMTPS id 4dWgg44Fklz30VM\n\tfor ; Thu, 18 Dec 2025 04:25:36 +1100 (AEDT)","from pps.filterd (m0353729.ppops.net [127.0.0.1])\n\tby mx0a-001b2d01.pphosted.com (8.18.1.2/8.18.1.2) with ESMTP id\n 5BHHK29c025635;\n\tWed, 17 Dec 2025 17:25:25 GMT","from pps.reinject (localhost [127.0.0.1])\n\tby mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4b0ytvea8y-1\n\t(version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT);\n\tWed, 17 Dec 2025 17:25:25 +0000 (GMT)","from m0353729.ppops.net (m0353729.ppops.net [127.0.0.1])\n\tby pps.reinject (8.18.1.12/8.18.0.8) with ESMTP id 5BHHKZSI006748;\n\tWed, 17 Dec 2025 17:25:24 GMT","from ppma13.dal12v.mail.ibm.com\n (dd.9e.1632.ip4.static.sl-reverse.com [50.22.158.221])\n\tby mx0a-001b2d01.pphosted.com (PPS) with ESMTPS id 4b0ytvea8r-1\n\t(version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT);\n\tWed, 17 Dec 2025 17:25:24 +0000 (GMT)","from pps.filterd (ppma13.dal12v.mail.ibm.com [127.0.0.1])\n\tby ppma13.dal12v.mail.ibm.com (8.18.1.2/8.18.1.2) with ESMTP id\n 5BHExUCF014337;\n\tWed, 17 Dec 2025 17:25:23 GMT","from smtprelay06.fra02v.mail.ibm.com ([9.218.2.230])\n\tby ppma13.dal12v.mail.ibm.com (PPS) with ESMTPS id 4b1mpk3aea-1\n\t(version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT);\n\tWed, 17 Dec 2025 17:25:23 +0000","from smtpav01.fra02v.mail.ibm.com (smtpav01.fra02v.mail.ibm.com\n [10.20.54.100])\n\tby smtprelay06.fra02v.mail.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id\n 5BHHPKTT27132252\n\t(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK);\n\tWed, 17 Dec 2025 17:25:20 GMT","from smtpav01.fra02v.mail.ibm.com (unknown [127.0.0.1])\n\tby IMSVA (Postfix) with ESMTP id 062E920043;\n\tWed, 17 Dec 2025 17:25:20 +0000 (GMT)","from smtpav01.fra02v.mail.ibm.com (unknown [127.0.0.1])\n\tby IMSVA (Postfix) with ESMTP id 0C5AC20040;\n\tWed, 17 Dec 2025 17:25:17 +0000 (GMT)","from li-fc74f8cc-3279-11b2-a85c-ef5828687581.ibm.com.com (unknown\n [9.124.211.226])\n\tby smtpav01.fra02v.mail.ibm.com (Postfix) with ESMTP;\n\tWed, 17 Dec 2025 17:25:16 +0000 (GMT)"],"ARC-Seal":"i=1; a=rsa-sha256; d=lists.ozlabs.org; s=201707; t=1765992337;\n\tcv=none;\n b=nrG6R8/m3YouXN5LECj8HwDqBVopRxLygKyGjujM0lE7owZlbPBUbw0xsPB3E5qvV7w15dwvmsN1Tig9xiM2HMNR9k2rIdQkd4kDKKLCltYQ7HtQhqiOl22Zvkp115KE+yIHOB7bH3Hr8GY2bvOj5t7ISYMWylFC1QjgW2Ir8rocfn3LSSrIUZ4KqNwZPN3RQmi47hXjiTKekMLMklF/pp7z8uir01NScLoKEyk9Kvh5xt2JjsHegzAHIJm4WhhdGcD43EFFZHTocmKD1ZxJ8RxjzGgVvob2IxTR63Te5ZJ8NJbdN1ZvVWQyzj+jNaB6EYDtdI6Yr7iqKPgPlnbdAg==","ARC-Message-Signature":"i=1; a=rsa-sha256; d=lists.ozlabs.org; s=201707;\n\tt=1765992337; c=relaxed/relaxed;\n\tbh=E9q9MwLx+QxB8gPZoWTVfIF6m08d+i7ReyBrKfC6Vc8=;\n\th=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References:\n\t MIME-Version;\n b=iZmloUEEPpN0z6jEwxKGwBJNAbyWStULUuZ//55EvZW7BdFlGJhz6MWUAiaRnGHvjY9WdJcPk9byKF/yRyxi/5hgjXCEPv1NFP91o6DfGh/8teTrhBLIvTFbwaCewC0cvXE6bxjCkMNTJNpPcffkqX+NR+p0btZGnQtVILH81JMF1BX1d8LO3EBP+z1T9vbvnSvWZahIfhlwLGp9WkfQcA9X6DGVNXT7PIbCt4wI5r4lar9L09bQlReFMTbWZqVXJGfaY6XEhfkfHbfE/PXBmwaBphWStoPEOiAXpRVFvIMmskfsXeCUg59tyrFsdycnjDeXiuXIr5LjWbSXVOTMJQ==","ARC-Authentication-Results":"i=1; lists.ozlabs.org;\n dmarc=pass (p=none dis=none) header.from=linux.ibm.com;\n dkim=pass (2048-bit key;\n unprotected) header.d=ibm.com header.i=@ibm.com header.a=rsa-sha256\n header.s=pp1 header.b=ZXp7KMFs; dkim-atps=neutral;\n spf=pass (client-ip=148.163.156.1; helo=mx0a-001b2d01.pphosted.com;\n envelope-from=ssrish@linux.ibm.com;\n receiver=lists.ozlabs.org) smtp.mailfrom=linux.ibm.com","DKIM-Signature":"v=1; a=rsa-sha256; c=relaxed/relaxed; d=ibm.com; h=cc\n\t:content-transfer-encoding:date:from:in-reply-to:message-id\n\t:mime-version:references:subject:to; s=pp1; bh=E9q9MwLx+QxB8gPZo\n\tWTVfIF6m08d+i7ReyBrKfC6Vc8=; b=ZXp7KMFsTfbr3Ezsi6iQDHDk1kTrHe/JL\n\ttX1+DmMHe/Y++nAdqmwWIDhDk4NnaLcS08Sz/+2JM27FK4marQioOjFK3lLv1Myk\n\tNUBZhRSbYHZHO05ggvxQL3wtOXrTmUfxTxlTwveFXcW4dtyTK/j89ufIoccirXxN\n\tZd+W+QQVPJGM30pPomQg1eh+VzZHh99QWNmg8BB86TVPTaWkZUbF3ssPMbWjEw+j\n\t0mECjxbDgFFXX1J2t6gZA39o/rSm5aec1bO7J37DMfRQyjFVMA2COWXX50YxZ0LB\n\t1RCecZ4ojc1HNcYKakK8Nz4N5+/XfMm50FfdaiXlvskS6jQhG4LeQ==","From":"Srish Srinivasan ","To":"linux-integrity@vger.kernel.org, keyrings@vger.kernel.org,\n linuxppc-dev@lists.ozlabs.org","Cc":"maddy@linux.ibm.com, mpe@ellerman.id.au, npiggin@gmail.com,\n christophe.leroy@csgroup.eu, James.Bottomley@HansenPartnership.com,\n jarkko@kernel.org, zohar@linux.ibm.com, nayna@linux.ibm.com,\n rnsastry@linux.ibm.com, linux-kernel@vger.kernel.org,\n linux-security-module@vger.kernel.org, ssrish@linux.ibm.com","Subject":"[PATCH v2 3/6] pseries/plpks: expose PowerVM wrapping features via\n the sysfs","Date":"Wed, 17 Dec 2025 22:55:02 +0530","Message-ID":"<20251217172505.112398-4-ssrish@linux.ibm.com>","X-Mailer":"git-send-email 2.52.0","In-Reply-To":"<20251217172505.112398-1-ssrish@linux.ibm.com>","References":"<20251217172505.112398-1-ssrish@linux.ibm.com>","X-Mailing-List":"linuxppc-dev@lists.ozlabs.org","List-Id":"","List-Help":"","List-Owner":"","List-Post":"","List-Archive":",\n ","List-Subscribe":",\n ,\n ","List-Unsubscribe":"","Precedence":"list","MIME-Version":"1.0","Content-Transfer-Encoding":"8bit","X-TM-AS-GCONF":"00","X-Proofpoint-Spam-Details-Enc":"AW1haW4tMjUxMjEzMDAyMyBTYWx0ZWRfX9tnRxkQteBI6\n Q5tqtyTkeO04SpvFWQjdHgLMFjwR8zMd129SpF1s6GFuTIS70B4NFLtUtiSx0KWrPH1JY97wHrf\n /E50ztVB8WLZhibwQGAofI8g3kRMbRNMaPU0Wgt+n+yiNYwm7+D1gdaDJzA+iYb5Pu3YwzKjKfE\n Ru1bW7BYOSVH5X0KXIt8Wc40yWMu8AYMVajPc+6tx3V6Cb46RUacUPHqD3O3B/vXJYBNL5GFBKx\n /0WEvv4L0U0N5tKUazS0Q1ntVXYFcReSjkchdEnXN6l/AImtYTynyNXEkteYFoU0cw3I3xqG0xd\n kLfR/KbkHL9+xnoDHy1MacNwas+r/K79i42xGr8pQ5roTMvy91R6L3OgM33HobxSATHumw9mLXW\n z+5N9ycAFxH1fo3WUksM7MEZqlbUIw==","X-Proofpoint-ORIG-GUID":"1kZIqMv__lyuypxDN-Xg_m7C5Xtx6ifC","X-Authority-Analysis":"v=2.4 cv=QtRTHFyd c=1 sm=1 tr=0 ts=6942e785 cx=c_pps\n a=AfN7/Ok6k8XGzOShvHwTGQ==:117 a=AfN7/Ok6k8XGzOShvHwTGQ==:17\n a=wP3pNCr1ah4A:10 a=VkNPw1HP01LnGYTKEx00:22 a=VnNF1IyMAAAA:8\n a=z7cUUKlKUSfJ7xv5IYMA:9","X-Proofpoint-GUID":"rx6XoglfU01VC7Xnu_RuNwHhcVe9AvI0","X-Proofpoint-Virus-Version":"vendor=baseguard\n engine=ICAP:2.0.293,Aquarius:18.0.1121,Hydra:6.1.9,FMLib:17.12.100.49\n definitions=2025-12-17_03,2025-12-16_05,2025-10-01_01","X-Proofpoint-Spam-Details":"rule=outbound_notspam policy=outbound score=0\n phishscore=0 adultscore=0 malwarescore=0 lowpriorityscore=0 spamscore=0\n priorityscore=1501 bulkscore=0 suspectscore=0 impostorscore=0 clxscore=1015\n classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0\n reason=mlx scancount=1 engine=8.19.0-2510240000 definitions=main-2512130023","X-Spam-Status":"No, score=-0.7 required=3.0 tests=DKIM_SIGNED,DKIM_VALID,\n\tRCVD_IN_DNSWL_LOW,RCVD_IN_MSPIKE_H4,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,\n\tSPF_PASS autolearn=disabled version=4.0.1 OzLabs 8","X-Spam-Checker-Version":"SpamAssassin 4.0.1 (2024-03-25) on lists.ozlabs.org"},"content":"Starting with Power11, PowerVM supports a new feature called \"Key Wrapping\"\nthat protects user secrets by wrapping them using a hypervisor generated\nwrapping key. The status of this feature can be read by the\nH_PKS_GET_CONFIG HCALL.\n\nExpose the Power LPAR Platform KeyStore (PLPKS) wrapping features config\nvia the sysfs file /sys/firmware/plpks/config/wrapping_features.\n\nSigned-off-by: Srish Srinivasan \n---\n .../ABI/testing/sysfs-firmware-plpks | 8 ++++++++\n arch/powerpc/include/asm/hvcall.h | 4 +++-\n arch/powerpc/include/asm/plpks.h | 3 +++\n arch/powerpc/platforms/pseries/plpks-sysfs.c | 2 ++\n arch/powerpc/platforms/pseries/plpks.c | 20 +++++++++++++++++++\n 5 files changed, 36 insertions(+), 1 deletion(-)","diff":"diff --git a/Documentation/ABI/testing/sysfs-firmware-plpks b/Documentation/ABI/testing/sysfs-firmware-plpks\nindex af0353f34115..cba061e4eee2 100644\n--- a/Documentation/ABI/testing/sysfs-firmware-plpks\n+++ b/Documentation/ABI/testing/sysfs-firmware-plpks\n@@ -48,3 +48,11 @@ Description:\tBitmask of flags indicating which algorithms the hypervisor\n \t\tsupports for signed update of objects, represented as a 16 byte\n \t\thexadecimal ASCII string. Consult the hypervisor documentation\n \t\tfor what these flags mean.\n+\n+What:\t\t/sys/firmware/plpks/config/wrapping_features\n+Date:\t\tNovember 2025\n+Contact:\tSrish Srinivasan \n+Description:\tBitmask of the wrapping features indicating the wrapping\n+\t\talgorithms that are supported for the H_PKS_WRAP_OBJECT requests\n+\t\t, represented as a 8 byte hexadecimal ASCII string. Consult the\n+\t\thypervisor documentation for what these flags mean.\ndiff --git a/arch/powerpc/include/asm/hvcall.h b/arch/powerpc/include/asm/hvcall.h\nindex 9aef16149d92..dff90a7d7f70 100644\n--- a/arch/powerpc/include/asm/hvcall.h\n+++ b/arch/powerpc/include/asm/hvcall.h\n@@ -360,7 +360,9 @@\n #define H_GUEST_RUN_VCPU\t0x480\n #define H_GUEST_COPY_MEMORY\t0x484\n #define H_GUEST_DELETE\t\t0x488\n-#define MAX_HCALL_OPCODE\tH_GUEST_DELETE\n+#define H_PKS_WRAP_OBJECT\t0x490\n+#define H_PKS_UNWRAP_OBJECT\t0x494\n+#define MAX_HCALL_OPCODE\tH_PKS_UNWRAP_OBJECT\n \n /* Scope args for H_SCM_UNBIND_ALL */\n #define H_UNBIND_SCOPE_ALL (0x1)\ndiff --git a/arch/powerpc/include/asm/plpks.h b/arch/powerpc/include/asm/plpks.h\nindex 8829a13bfda0..8f034588fdf7 100644\n--- a/arch/powerpc/include/asm/plpks.h\n+++ b/arch/powerpc/include/asm/plpks.h\n@@ -23,6 +23,7 @@\n #define PLPKS_IMMUTABLE\t\tPPC_BIT32(5) // Once written, object cannot be removed\n #define PLPKS_TRANSIENT\t\tPPC_BIT32(6) // Object does not persist through reboot\n #define PLPKS_SIGNEDUPDATE\tPPC_BIT32(7) // Object can only be modified by signed updates\n+#define PLPKS_WRAPPINGKEY\tPPC_BIT32(8) // Object contains a wrapping key\n #define PLPKS_HVPROVISIONED\tPPC_BIT32(28) // Hypervisor has provisioned this object\n \n // Signature algorithm flags from signed_update_algorithms\n@@ -103,6 +104,8 @@ u32 plpks_get_maxlargeobjectsize(void);\n \n u64 plpks_get_signedupdatealgorithms(void);\n \n+u64 plpks_get_wrappingfeatures(void);\n+\n u16 plpks_get_passwordlen(void);\n \n void plpks_early_init_devtree(void);\ndiff --git a/arch/powerpc/platforms/pseries/plpks-sysfs.c b/arch/powerpc/platforms/pseries/plpks-sysfs.c\nindex 01d526185783..c2ebcbb41ae3 100644\n--- a/arch/powerpc/platforms/pseries/plpks-sysfs.c\n+++ b/arch/powerpc/platforms/pseries/plpks-sysfs.c\n@@ -30,6 +30,7 @@ PLPKS_CONFIG_ATTR(used_space, \"%u\\n\", plpks_get_usedspace);\n PLPKS_CONFIG_ATTR(supported_policies, \"%08x\\n\", plpks_get_supportedpolicies);\n PLPKS_CONFIG_ATTR(signed_update_algorithms, \"%016llx\\n\",\n \t\t plpks_get_signedupdatealgorithms);\n+PLPKS_CONFIG_ATTR(wrapping_features, \"%016llx\\n\", plpks_get_wrappingfeatures);\n \n static const struct attribute *config_attrs[] = {\n \t&attr_version.attr,\n@@ -38,6 +39,7 @@ static const struct attribute *config_attrs[] = {\n \t&attr_used_space.attr,\n \t&attr_supported_policies.attr,\n \t&attr_signed_update_algorithms.attr,\n+\t&attr_wrapping_features.attr,\n \tNULL,\n };\n \ndiff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/platforms/pseries/plpks.c\nindex 03722fabf9c3..4a08f51537c8 100644\n--- a/arch/powerpc/platforms/pseries/plpks.c\n+++ b/arch/powerpc/platforms/pseries/plpks.c\n@@ -38,6 +38,7 @@ static u32 usedspace;\n static u32 supportedpolicies;\n static u32 maxlargeobjectsize;\n static u64 signedupdatealgorithms;\n+static u64 wrappingfeatures;\n \n struct plpks_auth {\n \tu8 version;\n@@ -248,6 +249,7 @@ static int _plpks_get_config(void)\n \t\t__be32 supportedpolicies;\n \t\t__be32 maxlargeobjectsize;\n \t\t__be64 signedupdatealgorithms;\n+\t\t__be64 wrappingfeatures;\n \t\tu8 rsvd1[476];\n \t} __packed * config;\n \tsize_t size;\n@@ -280,6 +282,7 @@ static int _plpks_get_config(void)\n \tsupportedpolicies = be32_to_cpu(config->supportedpolicies);\n \tmaxlargeobjectsize = be32_to_cpu(config->maxlargeobjectsize);\n \tsignedupdatealgorithms = be64_to_cpu(config->signedupdatealgorithms);\n+\twrappingfeatures = be64_to_cpu(config->wrappingfeatures);\n \n \t// Validate that the numbers we get back match the requirements of the spec\n \tif (maxpwsize < 32) {\n@@ -472,6 +475,23 @@ u64 plpks_get_signedupdatealgorithms(void)\n \treturn signedupdatealgorithms;\n }\n \n+/**\n+ * plpks_get_wrappingfeatures() - Returns a bitmask of the wrapping features\n+ * supported by the hypervisor.\n+ *\n+ * Successful execution of the H_PKS_GET_CONFIG HCALL during initialization\n+ * reads a bitmask of the wrapping features supported by the hypervisor into the\n+ * file local static wrappingfeatures variable. This is valid only when the\n+ * PLPKS config structure version >= 3.\n+ *\n+ * Return:\n+ *\tbitmask of the wrapping features supported by the hypervisor\n+ */\n+u64 plpks_get_wrappingfeatures(void)\n+{\n+\treturn wrappingfeatures;\n+}\n+\n /**\n * plpks_get_passwordlen() - Get the length of the PLPKS password in bytes.\n *\n","prefixes":["v2","3/6"]}