[PATCH v4 4/6] pseries/plpks: add HCALLs for PowerVM Key Wrapping Module

[Christophe Leroy (CS GROUP)]

Le 15/01/2026 à 21:45, Nayna Jain a écrit :
> 
> On 1/15/26 5:05 AM, Srish Srinivasan wrote:
>> The hypervisor generated wrapping key is an AES-GCM-256 symmetric key 
>> which
>> is stored in a non-volatile, secure, and encrypted storage called the 
>> Power
>> LPAR Platform KeyStore. It has policy based protections that prevent it
>> from being read out or exposed to the user.
>>
>> Implement H_PKS_GEN_KEY, H_PKS_WRAP_OBJECT, and H_PKS_UNWRAP_OBJECT 
>> HCALLs
>> to enable using the PowerVM Key Wrapping Module (PKWM) as a new trust
>> source for trusted keys. Disallow H_PKS_READ_OBJECT, H_PKS_SIGNED_UPDATE,
>> and H_PKS_WRITE_OBJECT for objects with the 'wrapping key' policy set.
>> Capture the availability status for the H_PKS_WRAP_OBJECT interface.
> 
> Reviewed-by: Nayna Jain <nayna at linux.ibm.com>
>>
>> Signed-off-by: Srish Srinivasan <ssrish at linux.ibm.com>
>> ---
>>   Documentation/arch/powerpc/papr_hcalls.rst |  43 +++
>>   arch/powerpc/include/asm/plpks.h           |  10 +
>>   arch/powerpc/platforms/pseries/plpks.c     | 342 ++++++++++++++++++++-
>>   3 files changed, 393 insertions(+), 2 deletions(-)

[...]

>> diff --git a/arch/powerpc/platforms/pseries/plpks.c b/arch/powerpc/ 
>> platforms/pseries/plpks.c
>> index 4a08f51537c8..b97b7750f6a8 100644
>> --- a/arch/powerpc/platforms/pseries/plpks.c
>> +++ b/arch/powerpc/platforms/pseries/plpks.c
>> @@ -9,6 +9,32 @@
>>   #define pr_fmt(fmt) "plpks: " fmt
>> +#define PLPKS_WRAPKEY_COMPONENT    "PLPKSWR"
>> +#define PLPKS_WRAPKEY_NAME    "default-wrapping-key"
>> +
>> +/*
>> + * To 4K align the {input, output} buffers to the {UN}WRAP H_CALLs
>> + */
>> +#define PLPKS_WRAPPING_BUF_ALIGN    4096
>> +
>> +/*
>> + * To ensure the output buffer's length is at least 1024 bytes greater
>> + * than the input buffer's length during the WRAP H_CALL
>> + */
>> +#define PLPKS_WRAPPING_BUF_DIFF    1024
>> +
>> +#define PLPKS_WRAP_INTERFACE_BIT    3
>> +#define PLPKS_WRAPPING_KEY_LENGTH    32
>> +
>> +#define WRAPFLAG_BE_BIT_SET(be_bit) \
>> +    BIT_ULL(63 - (be_bit))
>> +
>> +#define WRAPFLAG_BE_GENMASK(be_bit_hi, be_bit_lo) \
>> +    GENMASK_ULL(63 - (be_bit_hi), 63 - (be_bit_lo))
>> +
>> +#define WRAPFLAG_BE_FIELD_PREP(be_bit_hi, be_bit_lo, val) \
>> +    FIELD_PREP(WRAPFLAG_BE_GENMASK(be_bit_hi, be_bit_lo), (val))

I get following build failure:

   CC      arch/powerpc/platforms/pseries/plpks.o
arch/powerpc/platforms/pseries/plpks.c: In function 'plpks_wrap_object':
arch/powerpc/platforms/pseries/plpks.c:36:9: error: implicit declaration 
of function 'FIELD_PREP' [-Werror=implicit-function-declaration]
    36 |         FIELD_PREP(WRAPFLAG_BE_GENMASK(be_bit_hi, be_bit_lo), 
(val))
       |         ^~~~~~~~~~
arch/powerpc/platforms/pseries/plpks.c:1049:25: note: in expansion of 
macro 'WRAPFLAG_BE_FIELD_PREP'
  1049 |         objwrapflags |= WRAPFLAG_BE_FIELD_PREP(60, 63, 0x1);
       |                         ^~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors


>> +
>>   #include <linux/delay.h>
>>   #include <linux/errno.h>
>>   #include <linux/io.h>