forked from pool/s390-tools
a7f8ed0265
Lots of features implemented for SLES15 SP1. OBS-URL: https://build.opensuse.org/request/show/648783 OBS-URL: https://build.opensuse.org/package/show/Base:System/s390-tools?expand=0&rev=57
125 lines
3.6 KiB
Diff
125 lines
3.6 KiB
Diff
Subject: lszcrypt: CEX6S exploitation
|
|
From: Harald Freudenberger <freude@linux.vnet.ibm.com>
|
|
|
|
Summary: s390-tools: Exploitation Support for CEX6S
|
|
Description: Exploitation Support for CEX6S
|
|
Upstream-ID: 31866fbfa4bd89606af2a313427ca06d230e20dc
|
|
Problem-ID: SEC1519
|
|
|
|
Upstream-Description:
|
|
|
|
lszcrypt: CEX6S exploitation
|
|
|
|
With z14 there comes a new crypto card 'CEX6S'.
|
|
|
|
This patch introduces the s390-tools changes needed
|
|
to list the new card and show the capabilities correctly.
|
|
|
|
Signed-off-by: Harald Freudenberger <freude@linux.vnet.ibm.com>
|
|
Signed-off-by: Michael Holzheu <holzheu@linux.vnet.ibm.com>
|
|
|
|
|
|
Signed-off-by: Harald Freudenberger <freude@linux.vnet.ibm.com>
|
|
---
|
|
zconf/zcrypt/lszcrypt.8 | 6 ++++++
|
|
zconf/zcrypt/lszcrypt.c | 37 ++++++++++++++++++++++++++++---------
|
|
2 files changed, 34 insertions(+), 9 deletions(-)
|
|
|
|
--- a/zconf/zcrypt/lszcrypt.8
|
|
+++ b/zconf/zcrypt/lszcrypt.8
|
|
@@ -85,6 +85,12 @@ EP11 Secure Key
|
|
.IP "o"
|
|
Long RNG
|
|
.RE
|
|
+
|
|
+.RS 8
|
|
+The CCA Secure Key capability may be limited by a hypervisor
|
|
+layer. The remarks 'full function set' or 'restricted function set' may
|
|
+reflect this. For details about these limitations please check the
|
|
+hypervisor documentation.
|
|
.TP 8
|
|
.B -d, --domains
|
|
Shows the usage and control domains of the cryptographic devices.
|
|
--- a/zconf/zcrypt/lszcrypt.c
|
|
+++ b/zconf/zcrypt/lszcrypt.c
|
|
@@ -42,11 +42,19 @@ struct lszcrypt_l *lszcrypt_l = &l;
|
|
/*
|
|
* Card types
|
|
*/
|
|
-#define MASK_APSC 0x80000000
|
|
-#define MASK_RSA4K 0x60000000
|
|
-#define MASK_COPRO 0x10000000
|
|
-#define MASK_ACCEL 0x08000000
|
|
-#define MASK_EP11 0x04000000
|
|
+#define MASK_APSC 0x80000000
|
|
+#define MASK_RSA4K 0x60000000
|
|
+#define MASK_COPRO 0x10000000
|
|
+#define MASK_ACCEL 0x08000000
|
|
+#define MASK_EP11 0x04000000
|
|
+
|
|
+/*
|
|
+ * Classification
|
|
+ */
|
|
+#define MASK_CLASS_FULL 0x00800000
|
|
+#define CLASS_FULL "full function set"
|
|
+#define MASK_CLASS_STATELESS 0x00400000
|
|
+#define CLASS_STATELESS "restricted function set"
|
|
|
|
/*
|
|
* Program configuration
|
|
@@ -226,7 +234,7 @@ static void show_capability(const char *
|
|
{
|
|
unsigned long func_val;
|
|
long hwtype, id;
|
|
- char *p, *ap, *dev, card[16];
|
|
+ char *p, *ap, *dev, card[16], cbuf[256];
|
|
|
|
/* check if ap driver is available */
|
|
ap = util_path_sysfs("bus/ap");
|
|
@@ -250,6 +258,11 @@ static void show_capability(const char *
|
|
printf("Detailed capability information for %s (hardware type %ld) is not available.\n", card, hwtype);
|
|
return;
|
|
}
|
|
+ cbuf[0] = '\0';
|
|
+ if (func_val & MASK_CLASS_FULL)
|
|
+ snprintf(cbuf, sizeof(cbuf), "%s", CLASS_FULL);
|
|
+ else if (func_val & MASK_CLASS_STATELESS)
|
|
+ snprintf(cbuf, sizeof(cbuf), "%s", CLASS_STATELESS);
|
|
printf("%s provides capability for:\n", card);
|
|
switch (hwtype) {
|
|
case 6:
|
|
@@ -262,11 +275,15 @@ static void show_capability(const char *
|
|
case 7:
|
|
case 9:
|
|
printf("%s\n", CAP_RSA4K);
|
|
- printf("%s\n", CAP_CCA);
|
|
+ if (cbuf[0])
|
|
+ printf("%s (%s)\n", CAP_CCA, cbuf);
|
|
+ else
|
|
+ printf("%s\n", CAP_CCA);
|
|
printf("%s", CAP_RNG);
|
|
break;
|
|
case 10:
|
|
case 11:
|
|
+ case 12:
|
|
if (func_val & MASK_ACCEL) {
|
|
if (func_val & MASK_RSA4K)
|
|
printf("%s", CAP_RSA4K);
|
|
@@ -274,12 +291,14 @@ static void show_capability(const char *
|
|
printf("%s", CAP_RSA2K);
|
|
} else if (func_val & MASK_COPRO) {
|
|
printf("%s\n", CAP_RSA4K);
|
|
- printf("%s\n", CAP_CCA);
|
|
+ if (cbuf[0])
|
|
+ printf("%s (%s)\n", CAP_CCA, cbuf);
|
|
+ else
|
|
+ printf("%s\n", CAP_CCA);
|
|
printf("%s", CAP_RNG);
|
|
} else if (func_val & MASK_EP11) {
|
|
printf("%s", CAP_EP11);
|
|
} else {
|
|
-
|
|
printf("Detailed capability information for %s (hardware type %ld) is not available.", card, hwtype);
|
|
}
|
|
break;
|