linux-kernel - Re: [PATCH v2 2/2] s390/uv: Provide host-key hashes in sysfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <e4808d4e-dc9a-44ec-a749-d30571ed6637@linux.ibm.com>
Date: Tue, 8 Oct 2024 14:12:04 +0200
From: Janosch Frank <frankja@...ux.ibm.com>
To: Steffen Eiden <seiden@...ux.ibm.com>, linux-kernel@...r.kernel.org,
        linux-s390@...r.kernel.org
Cc: Ingo Franzki <ifranzki@...ux.ibm.com>,
        Harald Freudenberger <freude@...ux.ibm.com>,
        Christoph Schlameuss <schlameuss@...ux.ibm.com>,
        Claudio Imbrenda <imbrenda@...ux.ibm.com>
Subject: Re: [PATCH v2 2/2] s390/uv: Provide host-key hashes in sysfs

On 10/2/24 6:04 PM, Steffen Eiden wrote:
> Utilize the new Query Ultravisor Keys UVC to give user space the
> information which host-keys are installed on the system.
> 
> Create a new sysfs directory 'firmware/uv/keys' that contains the hash
> of the host-key and the backup host-key of that system. Additionally,
> the file 'all' contains the response from the UVC possibly containing
> more key-hashes than currently known.
> 
> Signed-off-by: Steffen Eiden <seiden@...ux.ibm.com>

Reviewed-by: Janosch Frank <frankja@...ux.ibm.com>

Two nits below.

> ---
>   arch/s390/include/asm/uv.h | 16 +++++++++
>   arch/s390/kernel/uv.c      | 71 ++++++++++++++++++++++++++++++++++++++
>   2 files changed, 87 insertions(+)
> 

[...]

> +struct uv_key_hash {
> +	u64 dword[4];
> +} __packed __aligned(8);
> +
> +#define UVC_QUERY_KEYS_IDX_HK		0
> +#define UVC_QUERY_KEYS_IDX_BACK_HK		1
> +
> +/* Query Ultravisor Keys */
> +struct uv_cb_query_keys {
> +	struct uv_cb_header header;	/* 0x0000 */
> +	u64 reserved08[3];		/* 0x0008 */
> +	struct uv_key_hash keys[15];	/* 0x0020 */

s/keys/key_hash/ or something similar?

> +} __packed __aligned(8);
>

We could add a static size assert here.