diff options
| author | Harald Freudenberger <freude@linux.ibm.com> | 2024-10-25 12:34:32 +0200 |
|---|---|---|
| committer | Heiko Carstens <hca@linux.ibm.com> | 2024-10-29 11:17:18 +0100 |
| commit | 73dfc79c6b046af252a5d1b7b34a2f1454d6f7f3 (patch) | |
| tree | 6cc6be49d14fd8f37606e67ec10ca8c055bc5331 /arch/s390/include/uapi | |
| parent | eb37a9aea64d1b3b2944679dc6b85b3bb84053cd (diff) | |
s390/pkey: Add new pkey handler module pkey-uv
This new pkey handler module supports the conversion of
Ultravisor retrievable secrets to protected keys.
The new module pkey-uv.ko is able to retrieve and verify
protected keys backed up by the Ultravisor layer which is
only available within protected execution environment.
The module is only automatically loaded if there is the
UV CPU feature flagged as available. Additionally on module
init there is a check for protected execution environment
and for UV supporting retrievable secrets. Also if the kernel
is not running as a protected execution guest, the module
unloads itself with errno ENODEV.
The pkey UV module currently supports these Ultravisor
secrets and is able to retrieve a protected key for these
UV secret types:
- UV_SECRET_AES_128
- UV_SECRET_AES_192
- UV_SECRET_AES_256
- UV_SECRET_AES_XTS_128
- UV_SECRET_AES_XTS_256
- UV_SECRET_HMAC_SHA_256
- UV_SECRET_HMAC_SHA_512
- UV_SECRET_ECDSA_P256
- UV_SECRET_ECDSA_P384
- UV_SECRET_ECDSA_P521
- UV_SECRET_ECDSA_ED25519
- UV_SECRET_ECDSA_ED448
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Diffstat (limited to 'arch/s390/include/uapi')
| -rw-r--r-- | arch/s390/include/uapi/asm/pkey.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/arch/s390/include/uapi/asm/pkey.h b/arch/s390/include/uapi/asm/pkey.h index 0e266ef714ff..ca42e941675d 100644 --- a/arch/s390/include/uapi/asm/pkey.h +++ b/arch/s390/include/uapi/asm/pkey.h @@ -55,6 +55,7 @@ enum pkey_key_type { PKEY_TYPE_EP11_AES = (__u32)6, PKEY_TYPE_EP11_ECC = (__u32)7, PKEY_TYPE_PROTKEY = (__u32)8, + PKEY_TYPE_UVSECRET = (__u32)9, }; /* the newer ioctls use a pkey_key_size enum for key size information */ |