kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zkey: Add function to select a CCA adapter by mkvp

Browse Source 
Add a utility function to select an APQN that is set up with
a specific master key for use with the CCA host library. The
selection is based on the master key verification pattern, which
is typically obtained from an existing secure AES key.

The function iterates over a set of APQNs to find one that is setup
with the desired master key in the CURRENT or OLD master key register,
and optionally has a new master key loaded. It then selects the found
APQN for use with the CCA host library.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Ingo Franzki
2019-06-19 11:23:00 +02:00
committed by Jan Höppner
parent 016a0a56fc
commit 1091b0bf65
2 changed files with 107 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

100
zkey/cca.c
View File

@@ -507,3 +507,103 @@ int select_cca_adapter(struct cca_lib *cca, int card, int domain, bool verbose)
pr_verbose(verbose, "Selected adapter %u (CRP%02d)", adapter, adapter);
return 0;
}
struct find_mkvp_info {
u64 mkvp;
unsigned int flags;
bool found;
int card;
int domain;
bool verbose;
};
static int find_mkvp(int card, int domain, void *handler_data)
{
struct find_mkvp_info *info = (struct find_mkvp_info *)handler_data;
struct mk_info mk_info;
bool found = false;
int rc;
rc = sysfs_get_mkvps(card, domain, &mk_info, info->verbose);
if (rc == -ENODEV)
return 0;
if (rc != 0)
return rc;
if (info->flags & FLAG_SEL_CCA_MATCH_CUR_MKVP)
if (mk_info.cur_mk.mk_state == MK_STATE_VALID &&
mk_info.cur_mk.mkvp == info->mkvp)
found = true;
if (info->flags & FLAG_SEL_CCA_MATCH_OLD_MKVP)
if (mk_info.old_mk.mk_state == MK_STATE_VALID &&
mk_info.old_mk.mkvp == info->mkvp)
found = true;
if (info->flags & FLAG_SEL_CCA_NEW_MUST_BE_SET)
if (mk_info.new_mk.mk_state != MK_STATE_FULL)
found = false;
if (found) {
info->card = card;
info->domain = domain;
info->found = true;
pr_verbose(info->verbose, "%02x.%04x has the desired mkvp%s",
card, domain,
info->flags & FLAG_SEL_CCA_NEW_MUST_BE_SET ?
" and NEW MK set" : "");
return 1;
}
return 0;
}
/**
* Selects an APQN to be used for the CCA host library that has the specified
* master key verification pattern
*
* @param[in] cca the CCA library structure
* @param[in] mkvp the master key verification pattern to search for
* @param[in] apqns a comma separated list of APQNs. If NULL is specified,
* or an empty string, then all online CCA APQNs are
* checked.
* @param[in] flags Flags that control the MKVM matching and NEW register
* checking. Multiple flags can be combined.
* @param[in] verbose if true, verbose messages are printed
*
* @returns 0 on success, a negative errno in case of an error. -ENOTSUP is
* returned when the serialnr sysfs attribute is not available,
* because the zcrypt kernel module is on an older level. -ENODEV is
* returned if no APQN is available with the desired mkvp.
*/
int select_cca_adapter_by_mkvp(struct cca_lib *cca, u64 mkvp, const char *apqns,
unsigned int flags, bool verbose)
{
struct find_mkvp_info info;
int rc;
util_assert(cca != NULL, "Internal error: cca is NULL");
pr_verbose(verbose, "Select mkvp %016llx in APQNs %s for the CCA host "
"library", mkvp, apqns == 0 ? "ANY" : apqns);
info.mkvp = mkvp;
info.flags = flags;
info.found = false;
info.card = 0;
info.domain = 0;
info.verbose = verbose;
rc = handle_apqns(apqns, find_mkvp, &info, verbose);
if (rc < 0)
return rc;
if (!info.found)
return -ENODEV;
rc = select_cca_adapter(cca, info.card, info.domain, verbose);
return rc;
}

7
zkey/cca.h
View File

@@ -83,4 +83,11 @@ int key_token_change(struct cca_lib *cca,
int select_cca_adapter(struct cca_lib *cca, int card, int domain, bool verbose);
#define FLAG_SEL_CCA_MATCH_CUR_MKVP 0x01
#define FLAG_SEL_CCA_MATCH_OLD_MKVP 0x02
#define FLAG_SEL_CCA_NEW_MUST_BE_SET 0x80
int select_cca_adapter_by_mkvp(struct cca_lib *cca, u64 mkvp, const char *apqns,
unsigned int flags, bool verbose);
#endif