From 4cf73238fc7cb68859ea263def0aab4b2ddb186d Mon Sep 17 00:00:00 2001 From: Marc Hartmayer Date: Thu, 24 Jun 2021 16:05:15 +0000 Subject: [PATCH] genprotimg: allow PCKMO functions by default MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Allow the PCKMO-encrypt-DEA/TDEA/AES/ECC-key functions to be used in a protected virtualization guest by default. Acked-by: Viktor Mihajlovski Signed-off-by: Marc Hartmayer Signed-off-by: Jan Höppner --- CHANGELOG.md | 1 + genprotimg/src/include/pv_hdr_def.h | 3 +++ genprotimg/src/pv/pv_args.c | 2 +- genprotimg/src/pv/pv_image.c | 1 + 4 files changed, 6 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index be4fd4e4..c21bc54f 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,7 @@ Release history for s390-tools (MIT version) Changes of existing tools: - genprotimg: Add OpenSSL 3.0 support + - genprotimg: Change plaintext control flags defaults so PCKMO functions are allowed Bug Fixes: - dbginfo: add KVM data collection for server and guest - fix lszdev diff --git a/genprotimg/src/include/pv_hdr_def.h b/genprotimg/src/include/pv_hdr_def.h index 2e0a15aa..79d4252f 100644 --- a/genprotimg/src/include/pv_hdr_def.h +++ b/genprotimg/src/include/pv_hdr_def.h @@ -25,6 +25,9 @@ #define PV_VERSION_1 0x00000100U /* Plaintext control flags */ +#define PV_PCF_PCKM_ECC (1ULL << 5) /* PCKMO encrypt-ECC-key functions allowed */ +#define PV_PCF_PCKMO_AES (1ULL << 6) /* PCKMO encrypt-AES-key functions allowed */ +#define PV_PCF_PCKMO_DEA_TDEA (1ULL << 7) /* PCKMO encrypt-DEA/TDEA-key functions allowed */ #define PV_PCF_NO_DECRYPTION (1ULL << 28) /* prevent Ultravisor decryption during unpack operation */ /* maxima for the PV version 1 */ diff --git a/genprotimg/src/pv/pv_args.c b/genprotimg/src/pv/pv_args.c index 3ba1f943..d48c526b 100644 --- a/genprotimg/src/pv/pv_args.c +++ b/genprotimg/src/pv/pv_args.c @@ -357,7 +357,7 @@ gint pv_args_parse_options(PvArgs *args, gint *argc, gchar **argv[], .description = _("Specify the plaintext control flags\n" INDENT "as a hexadecimal value.\n" INDENT - "Optional; default: '0x0'."), + "Optional; default: '0xe0'."), .arg_description = _("VALUE") }, { .long_name = "x-psw", .short_name = 0, diff --git a/genprotimg/src/pv/pv_image.c b/genprotimg/src/pv/pv_image.c index a0dd8fb4..c33f64eb 100644 --- a/genprotimg/src/pv/pv_image.c +++ b/genprotimg/src/pv/pv_image.c @@ -589,6 +589,7 @@ PvImage *pv_img_new(PvArgs *args, const gchar *stage3a_path, GError **err) if (!ret->comps) return NULL; + ret->pcf = PV_PCF_PCKMO_AES | PV_PCF_PCKMO_DEA_TDEA | PV_PCF_PCKM_ECC; ret->cust_comm_cipher = EVP_aes_256_gcm(); ret->gcm_cipher = EVP_aes_256_gcm(); ret->initial_psw.addr = DEFAULT_INITIAL_PSW_ADDR;