plpks_wrap_object(9)

🌸 NAME 🌸

hii bestie 💖 welcome to the plpks_wrap_object(9) page from the Kernel API Manual. plpks_wrap_object is literally here to wrap an object using the default wrapping key stored in the PLPKS. no cap, that's the whole name vibe ✨

---

✨ SYNOPSIS ✨

the signature is giving very serious kernel business, so here it is exactly:

int plpks_wrap_object (u8 **input_buf , u32 input_len , u16 wrap_flags ,
       u8 **output_buf , u32 *output_len );

---

🎀 ARGUMENTS 🎀

• input_buf — buffer containing the data to be wrapped 🫶
• input_len — length of the input buffer
• wrap_flags — object wrapping flags
• output_buf — buffer to store the wrapped data
• output_len — length of the output buffer

---

💅 DESCRIPTION 💅

okay so the H_PKS_WRAP_OBJECT HCALL is the main character here: it wraps an object using a wrapping key stored in the PLPKS and returns the wrapped object to the caller. periodt 💅

The caller provides a label to the wrapping key with the 'wrapping key' policy set that must have been previously created with the H_PKS_GEN_KEY HCALL. The provided object is then encrypted with the wrapping key and additional metadata, and the result is returned to the user. The metadata includes the wrapping algorithm and the wrapping key name, so those parameters are not required during unwrap. iykyk ✨

Possible reasons for the returned errno values — bestie, this list is long but every bit matters 👑:

• -ENXIO — if PLPKS is not supported
• -EIO
  • if PLPKS access is blocked due to the LPAR's state
  • if PLPKS modification is blocked due to the LPAR's state
  • if an error occurred while processing the request
• -EINVAL
  • if invalid authorization parameter
  • if invalid wrapping key label parameter
  • if invalid wrapping key label length parameter
  • if invalid or unsupported object wrapping flags
  • if invalid input buffer parameter
  • if invalid input buffer length parameter
  • if invalid output buffer parameter
  • if invalid output buffer length parameter
  • if invalid continue token parameter
  • if the wrapping key is not compatible with the wrapping algorithm
• -EPERM — if access is denied
• -ENOENT — if the requested wrapping key was not found
• -EBUSY — if unable to handle the request or long running operation initiated, retry later.

---

🔥 RETURN 🔥

On success 0 is returned, a negative errno if not. that's it, that's the return vibe 😌

---

👑 SEE ALSO 👑

Kernel file ./arch/powerpc/platforms/pseries/plpks.c

and the whole plpks squad, in original order because we respect the lore 🦋:

• plpks_get_version(9)
• plpks_get_objoverhead(9)
• plpks_get_maxpwsize(9)
• plpks_get_maxobjectsize(9)
• plpks_get_maxobjectlabelsize(9)
• plpks_get_totalsize(9)
• plpks_get_usedspace(9)
• plpks_get_supportedpolicies(9)
• plpks_get_maxlargeobjectsize(9)
• plpks_get_signedupdatealgorithms(9)
• plpks_get_wrappingfeatures(9)
• plpks_get_passwordlen(9)
• plpks_is_available(9)
• plpks_signed_update_var(9)
• plpks_write_var(9)
• plpks_remove_var(9)
• plpks_wrapping_is_supported(9)
• plpks_gen_wrapping_key(9)
• plpks_unwrap_object(9)
• plpks_read_os_var(9)
• plpks_read_fw_var(9)
• plpks_read_bootloader_var(9)
• plpks_populate_fdt(9)
• plpks_early_init_devtree(9)

---

Final footer vibe check 🎀: source/version ./arch/powerpc/platforms/pseries, date October 2026, manual title plpks_wrap_object(9). bye bestie, go wrap something cute 🦋💖