linux-kernel - Re: [PATCH v1 2/6] s390/uv: Retrieve UV secrets support

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <5179c537-8b0d-4839-8a5a-7bf4a4f50632@linux.ibm.com>
Date: Wed, 2 Oct 2024 09:51:27 +0200
From: Janosch Frank <frankja@...ux.ibm.com>
To: Christoph Schlameuss <schlameuss@...ux.ibm.com>,
        Steffen Eiden <seiden@...ux.ibm.com>, linux-kernel@...r.kernel.org,
        linux-s390@...r.kernel.org
Cc: Ingo Franzki <ifranzki@...ux.ibm.com>,
        Harald Freudenberger <freude@...ux.ibm.com>,
        Claudio Imbrenda <imbrenda@...ux.ibm.com>
Subject: Re: [PATCH v1 2/6] s390/uv: Retrieve UV secrets support

On 10/1/24 6:06 PM, Christoph Schlameuss wrote:
> On Mon Sep 30, 2024 at 3:19 PM CEST, Steffen Eiden wrote:
>> Provide a kernel API to retrieve secrets from the UV secret store.
>> Add two new functions:
>> * `uv_get_secret_metadata` - get metadata for a given secret identifier
>> * `uv_retrieve_secret` - get the secret value for the secret index
>>
>> With those two functions one can extract the secret for a given secret
>> id, if the secret is retrievable.
>>
>> Signed-off-by: Steffen Eiden <seiden@...ux.ibm.com>
>> ---
>>   arch/s390/include/asm/uv.h | 131 ++++++++++++++++++++++++++++++++++++-
>>   arch/s390/kernel/uv.c      | 124 +++++++++++++++++++++++++++++++++++
>>   2 files changed, 254 insertions(+), 1 deletion(-)
> 
> [...]
> 
>>   /* Bits in installed uv calls */
>>   enum uv_cmds_inst {
>> @@ -95,6 +96,7 @@ enum uv_cmds_inst {
>>   	BIT_UVC_CMD_ADD_SECRET = 29,
>>   	BIT_UVC_CMD_LIST_SECRETS = 30,
>>   	BIT_UVC_CMD_LOCK_SECRETS = 31,
> 
> Is 32 skipped intentionally? Should there be a comment here that it is reserved?

Yes, we usually only add the things that are needed for a patch series.
32 is used for some other UVC which will be added in another series.

Also those bits are defined by architecture, not by KVM.