kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

genprotimg: allow PCKMO functions by default

Browse Source 
Allow the PCKMO-encrypt-DEA/TDEA/AES/ECC-key functions to be used in a protected
virtualization guest by default.

Acked-by: Viktor Mihajlovski <mihajlov@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Marc Hartmayer
2021-06-24 16:05:15 +00:00
committed by Jan Höppner
parent 27120f2824
commit 4cf73238fc
4 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGELOG.md
View File

@@ -6,6 +6,7 @@ Release history for s390-tools (MIT version)
Changes of existing tools:
- genprotimg: Add OpenSSL 3.0 support
- genprotimg: Change plaintext control flags defaults so PCKMO functions are allowed
Bug Fixes:
- dbginfo: add KVM data collection for server and guest - fix lszdev

3
genprotimg/src/include/pv_hdr_def.h
View File

@@ -25,6 +25,9 @@
#define PV_VERSION_1 0x00000100U
/* Plaintext control flags */
#define PV_PCF_PCKM_ECC (1ULL << 5) /* PCKMO encrypt-ECC-key functions allowed */
#define PV_PCF_PCKMO_AES (1ULL << 6) /* PCKMO encrypt-AES-key functions allowed */
#define PV_PCF_PCKMO_DEA_TDEA (1ULL << 7) /* PCKMO encrypt-DEA/TDEA-key functions allowed */
#define PV_PCF_NO_DECRYPTION (1ULL << 28) /* prevent Ultravisor decryption during unpack operation */
/* maxima for the PV version 1 */

2
genprotimg/src/pv/pv_args.c
View File

@@ -357,7 +357,7 @@ gint pv_args_parse_options(PvArgs *args, gint *argc, gchar **argv[],
.description =
_("Specify the plaintext control flags\n" INDENT
"as a hexadecimal value.\n" INDENT
"Optional; default: '0x0'."),
"Optional; default: '0xe0'."),
.arg_description = _("VALUE") },
{ .long_name = "x-psw",
.short_name = 0,

1
genprotimg/src/pv/pv_image.c
View File

@@ -589,6 +589,7 @@ PvImage *pv_img_new(PvArgs *args, const gchar *stage3a_path, GError **err)
if (!ret->comps)
return NULL;
ret->pcf = PV_PCF_PCKMO_AES | PV_PCF_PCKMO_DEA_TDEA | PV_PCF_PCKM_ECC;
ret->cust_comm_cipher = EVP_aes_256_gcm();
ret->gcm_cipher = EVP_aes_256_gcm();
ret->initial_psw.addr = DEFAULT_INITIAL_PSW_ADDR;