[23.10 FEAT] [SEC2341] pkey: support generation of keys of type PKEY_TYPE_EP11_AES

------- Comment From <email address hidden> 2023-08-16 04:30 EDT-------
This fix will be these patches:

s390/paes: fix PKEY_TYPE_EP11_AES handling for secure keyblobs
2af203f3a42b s390/pkey: fix PKEY_TYPE_EP11_AES handling for sysfs attributes
9244d29d0016 s390/pkey: fix PKEY_TYPE_EP11_AES handling in PKEY_VERIFYKEY2 IOCTL
b9588e8c1f6d s390/pkey: fix PKEY_TYPE_EP11_AES handling in PKEY_KBLOB2PROTK[23]
4da75e5be658 s390/pkey: fix PKEY_TYPE_EP11_AES handling in PKEY_CLR2SECK2 IOCTL
6657ea25ab3e s390/pkey: fix PKEY_TYPE_EP11_AES handling in PKEY_GENSECK2 IOCTL
40ffcbd6c2d3 s390/pkey: fix/harmonize internal keyblob headers

which have been tested, reviewed and released into the IBM internal Linux kernel devel branch today. As soon as these commits are upstream visible, I'll append the commid ids to this bugzilla.

Okay, many thanks Harald.
(For the kernel bits there is still some time ...)
Just let us know when they for example landed in linux-next,
which would be sufficient for us to pick them.

Just noticed that the commits just arrived in linux-next - tagged with next-20230818.

A test build of the patched package (now gmp_6.3.0+dfsg-2ubuntu4) is being build at PPA:
https://launchpad.net/~fheimes/+archive/ubuntu/lp2029438

The testsuite was successful - especially on s390x:

============================================================================
Testsuite summary for GNU MP 6.3.0
============================================================================
# TOTAL: 8
# PASS: 8
# SKIP: 0
# XFAIL: 0
# FAIL: 0
# XPASS: 0
# ERROR: 0
============================================================================

No lintian errors.

Attaching debdiff.

Subscribing 'ubuntu-sponsors'.

Excuse me - the last two comments #4 and #5 were attached to the wrong bug - please ignore.

------- Comment From <email address hidden> 2023-08-21 02:49 EDT-------
Ok, the patches are upstream now on the s390 features branch and will go into the next kernel merge window:

cba33db3fc4d s390/paes: fix PKEY_TYPE_EP11_AES handling for secure keyblobs
b9352e4b9b9e s390/pkey: fix PKEY_TYPE_EP11_AES handling for sysfs attributes
745742dbca11 s390/pkey: fix PKEY_TYPE_EP11_AES handling in PKEY_VERIFYKEY2 IOCTL
d1fdfb0b2f33 s390/pkey: fix PKEY_TYPE_EP11_AES handling in PKEY_KBLOB2PROTK[23]
da2863f15945 s390/pkey: fix PKEY_TYPE_EP11_AES handling in PKEY_CLR2SECK2 IOCTL
fb249ce7f7bf s390/pkey: fix PKEY_TYPE_EP11_AES handling in PKEY_GENSECK2 IOCTL
37a08f010b7c s390/pkey: fix/harmonize internal keyblob headers

Kernel test build(s) available in this PPA:
https://launchpad.net/~fheimes/+archive/ubuntu/lp2028937

Pull request submitted to kernel team's mailing list:
https://lists.ubuntu.com/archives/kernel-team/2023-September/thread.html#142499

Changing status to 'In Progress'.

Assigning kernel team.

Updated to 'Fix Committed' since code is in mantic-proposed.

This bug was fixed in the package linux - 6.5.0-7.7

---------------
linux (6.5.0-7.7) mantic; urgency=medium

  * mantic/linux: 6.5.0-7.7 -proposed tracker (LP: #2037611)

  * kexec enable to load/kdump zstd compressed zimg (LP: #2037398)
    - [Packaging] Revert arm64 image format to Image.gz

  * Mantic minimized/minimal cloud images do not receive IP address during
    provisioning (LP: #2036968)
    - [Config] Enable virtio-net as built-in to avoid race

  * Miscellaneous Ubuntu changes
    - SAUCE: Add mdev_set_iommu_device() kABI
    - [Config] update gcc version in annotations

 -- Andrea Righi <email address hidden> Thu, 28 Sep 2023 10:19:24 +0200

This bug is awaiting verification that the linux-azure-6.5/6.5.0-1007.7~22.04.1 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux-azure-6.5' to 'verification-done-jammy-linux-azure-6.5'. If the problem still exists, change the tag 'verification-needed-jammy-linux-azure-6.5' to 'verification-failed-jammy-linux-azure-6.5'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

not needed, update tags to unblock

This bug is awaiting verification that the linux-aws-6.5/6.5.0-1008.8~22.04.1 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux-aws-6.5' to 'verification-done-jammy-linux-aws-6.5'. If the problem still exists, change the tag 'verification-needed-jammy-linux-aws-6.5' to 'verification-failed-jammy-linux-aws-6.5'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

does not affect aws, updating tags just to unblock