From cd93949d172e71917c397439c0d3aab00a79171d Mon Sep 17 00:00:00 2001 From: Ingo Franzki Date: Wed, 3 Sep 2025 10:11:38 +0200 Subject: [PATCH] zkey: Add phmac_s390 to initramfs and load it via modules-load.d MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add kernel module phmac_s390 to the initramfs hook and dracut config file to ensure that the PHMAC cipher is available during early boot, in case the root disk is integrity protected via PHMAC. Also load phmac_s390 via modules-load.d to ensure that the PHMAC ciphers are available. Signed-off-by: Ingo Franzki Reviewed-by: Finn Callies Signed-off-by: Jan Höppner --- etc/modules-load.d/s390-pkey.conf | 1 + zkey/dracut/99-pkey.conf | 2 +- zkey/initramfs/hooks/s390-tools-zkey | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/etc/modules-load.d/s390-pkey.conf b/etc/modules-load.d/s390-pkey.conf index b1544d57..4c5671ac 100644 --- a/etc/modules-load.d/s390-pkey.conf +++ b/etc/modules-load.d/s390-pkey.conf @@ -4,3 +4,4 @@ pkey_pckmo pkey_ep11 pkey_cca paes_s390 +phmac_s390 diff --git a/zkey/dracut/99-pkey.conf b/zkey/dracut/99-pkey.conf index 75c5e0ea..ed5009f0 100644 --- a/zkey/dracut/99-pkey.conf +++ b/zkey/dracut/99-pkey.conf @@ -4,6 +4,6 @@ # it under the terms of the MIT license. See LICENSE for details. # -add_drivers+=" uvdevice pkey pkey_cca pkey_ep11 pkey_pckmo pkey_uv paes_s390 zcrypt zcrypt_cex4 " +add_drivers+=" uvdevice pkey pkey_cca pkey_ep11 pkey_pckmo pkey_uv paes_s390 phmac_s390 zcrypt zcrypt_cex4 " install_items+=" chzcrypt lszcrypt zkey zkey-cryptsetup " install_optional_items+=" /usr/lib64/zkey/*.so /etc/zkey/* /etc/zkey/repository/* /etc/zkey/kmip/profiles/* " diff --git a/zkey/initramfs/hooks/s390-tools-zkey b/zkey/initramfs/hooks/s390-tools-zkey index 3473718e..9eabfb4e 100644 --- a/zkey/initramfs/hooks/s390-tools-zkey +++ b/zkey/initramfs/hooks/s390-tools-zkey @@ -29,7 +29,7 @@ esac . /usr/share/initramfs-tools/hook-functions # Add zcrypt modules -zdev_modules="uvdevice pkey pkey_cca pkey_ep11 pkey_pckmo pkey_uv paes_s390 zcrypt zcrypt_cex4" +zdev_modules="uvdevice pkey pkey_cca pkey_ep11 pkey_pckmo pkey_uv paes_s390 phmac_s390 zcrypt zcrypt_cex4" for x in $zdev_modules ; do manual_add_modules ${x}