plpks_unwrap_object(9)

💅 plpks_unwrap_object — bestie's guide to unwrapping PLPKS objects ✨

okay so real talk, this one is a kernel API function (it's plpks_unwrap_object(9), say it with your chest) and it does exactly one iconic thing: it unwraps an object using the default wrapping key stored in the PLPKS. that's the whole personality. 🎀

---

✨ SYNOPSIS ✨

int plpks_unwrap_object (u8 **input_buf , u32 input_len , u8
**output_buf , u32 *output_len );

like yes bestie the double pointers are giving main character energy, they are supposed to be like that 💅

---

🌸 ARGUMENTS 🌸

• input_buf — the buffer holding the data you wanna unwrap. your little wrapped present 🎁
• input_len — how long that input buffer is. fr fr, tell it the size.
• output_buf — where the unwrapped data goes. the reveal ✨
• output_len — the length of the output buffer. gotta know how much room you have, no cap.

---

🦋 DESCRIPTION 🦋

so the H_PKS_UNWRAP_OBJECT HCALL is the actual star of the show here — it unwraps an object that was previously wrapped using the H_PKS_WRAP_OBJECT HCALL. it's the reverse slay. 🔥

and here's the possible reasons you'd get a returned errno value — lowkey the receipts of what went wrong:

• -ENXIO — if PLPKS is not supported 🙈
• -EIO — if PLPKS access is blocked due to the LPAR's state; if PLPKS modification is blocked due to the LPAR's state; if an error occurred while processing the request 💀
• -EINVAL — if invalid authorization parameter; if invalid or unsupported object unwrapping flags; if invalid input buffer parameter; if invalid input buffer length parameter; if invalid output buffer parameter; if invalid output buffer length parameter; if invalid continue token parameter; if the wrapping key is not compatible with the wrapping algorithm; if the wrapped object's format is not supported; if the wrapped object is invalid 😭 that's a LOT of ways to be invalid tbh
• -EPERM — if access is denied 🚫
• -ENOENT — if the wrapping key for the provided object was not found 🕵️‍♀️
• -EBUSY — if unable to handle the request or long running operation initiated, retry later. like it's not a no, it's a "not right now" ⏳

---

👑 RETURN 👑

On success, 0 is returned. a negative errno if not. that's it, that's the vibe check. ⭐

---

🌈 SEE ALSO 🌈

Kernel file ./arch/powerpc/platforms/pseries/plpks.c — go read the source bestie, it's right there 📖

and the whole friend group:

• plpks_get_version(9)
• plpks_get_objoverhead(9)
• plpks_get_maxpwsize(9)
• plpks_get_maxobjectsize(9)
• plpks_get_maxobjectlabelsize(9)
• plpks_get_totalsize(9)
• plpks_get_usedspace(9)
• plpks_get_supportedpolicies(9)
• plpks_get_maxlargeobjectsize(9)
• plpks_get_signedupdatealgorithms(9)
• plpks_get_wrappingfeatures(9)
• plpks_get_passwordlen(9)
• plpks_is_available(9)
• plpks_signed_update_var(9)
• plpks_write_var(9)
• plpks_remove_var(9)
• plpks_wrapping_is_supported(9)
• plpks_gen_wrapping_key(9)
• plpks_wrap_object(9)
• plpks_read_os_var(9)
• plpks_read_fw_var(9)
• plpks_read_bootloader_var(9)
• plpks_populate_fdt(9)
• plpks_early_init_devtree(9)

---

okay that's the whole page, tysm for reading 🫶 this came from ./arch/powerpc/platforms/pseries, dated October 2026, and it's the plpks_unwrap_object(9) manual page — periodt. 💜🧚‍♀️