On Mon, Jul 06 2026, Harald Freudenberger <[email protected]> wrote:
> Add base support for cpacf protected key handling.
>
> The qemu version provided here is only a fake intended to make
> protected key available for developing and testing purpose:
> * The protected key is 'derived' from the clear key by xoring
> the fixed pattern 0xAAAA... onto the key value.
> * The AES Wrapping Key Verification Pattern is a fixed
> value of 32 bytes 0xFACEFACE...
>
> Add preprocessor defines for the xor pattern and wkvp used to
> construct ('encrypt') a protected key from a clear key value with
> this implementation. Also add some static functions to 'encrypt'
> from clear key to protected key and 'decrypt' back to cpacf_aes.c.
>
> The preprocessor defines shall be used later in testcases to
> construct and decode protected keys.
Hmm... so does that mean that we only provide the protected key handling
in the !KVM case for people who want to run via tcg for some development
purposes? Does the user actually get some kind of notice in that case,
if for example they run with !KVM due to some configuration hiccup? IOW,
do users get some clue that they are running with a fake placeholder
implementation, other than the setup being slow?
>
> Signed-off-by: Harald Freudenberger <[email protected]>
> ---
> target/s390x/tcg/cpacf.h | 25 +++++++++++++++++++++++
> target/s390x/tcg/cpacf_aes.c | 39 ++++++++++++++++++++++++++++++++++++
> 2 files changed, 64 insertions(+)
