linux-kernel - Re: [PATCH v3 01/14] KVM: s390: refactor crypto initialization

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Thu, 15 Mar 2018 13:26:40 +0100
From:   Pierre Morel <pmorel@...ux.vnet.ibm.com>
To:     Tony Krowiak <akrowiak@...ux.vnet.ibm.com>,
        linux-s390@...r.kernel.org, linux-kernel@...r.kernel.org,
        kvm@...r.kernel.org
Cc:     freude@...ibm.com, schwidefsky@...ibm.com,
        heiko.carstens@...ibm.com, borntraeger@...ibm.com,
        cohuck@...hat.com, kwankhede@...dia.com,
        bjsdjshi@...ux.vnet.ibm.com, pbonzini@...hat.com,
        alex.williamson@...hat.com, alifm@...ux.vnet.ibm.com,
        mjrosato@...ux.vnet.ibm.com, jjherne@...ux.vnet.ibm.com,
        thuth@...hat.com, pasic@...ux.vnet.ibm.com, berrange@...hat.com,
        fiuczy@...ux.vnet.ibm.com, buendgen@...ibm.com
Subject: Re: [PATCH v3 01/14] KVM: s390: refactor crypto initialization

On 14/03/2018 19:25, Tony Krowiak wrote:
> This patch refactors the code that initializes the crypto
> configuration for a guest. The crypto configuration is contained in
> a crypto control block (CRYCB) which is a satellite control block to
> our main hardware virtualization control block. The CRYCB is
> attached to the main virtualization control block via a CRYCB
> designation (CRYCBD) designation field containing the address of
> the CRYCB as well as its format.
>
> Prior to the introduction of AP device virtualization, there was
> no need to provide access to or specify the format of the CRYCB for
> a guest unless the MSA extension 3 (MSAX3) facility was installed
> on the host system. With the introduction of AP device virtualization,
> the CRYCB and its format must be made accessible to the guest
> regardless of the presence of the MSAX3 facility.
>
> The crypto initialization code is restructured as follows:
>
> * A new compilation unit is introduced to contain all interfaces
>    and data structures related to configuring a guest's CRYCB for
>    both the refactoring of crypto initialization as well as all
>    subsequent patches introducing AP virtualization support.
>
> * Currently, the asm code for querying the AP configuration is
>    duplicated in the AP bus as well as in KVM. Since the KVM
>    code was introduced, the AP bus has externalized the interface
>    for querying the AP configuration. The KVM interface will be
>    replaced with a call to the AP bus interface. Of course, this
>    will be moved to the new compilation unit mentioned above.
>
> * An interface to format the CRYCBD field will be provided via
>    the new compilation unit and called from the KVM vm
>    initialization.
>
> Signed-off-by: Tony Krowiak <akrowiak@...ux.vnet.ibm.com>
> ---
>   MAINTAINERS                      |   10 ++++++
>   arch/s390/include/asm/kvm-ap.h   |   16 ++++++++++
>   arch/s390/include/asm/kvm_host.h |    1 +
>   arch/s390/kvm/Kconfig            |    1 +
>   arch/s390/kvm/Makefile           |    2 +-
>   arch/s390/kvm/kvm-ap.c           |   48 +++++++++++++++++++++++++++++
>   arch/s390/kvm/kvm-s390.c         |   61 ++++---------------------------------
>   7 files changed, 84 insertions(+), 55 deletions(-)
>   create mode 100644 arch/s390/include/asm/kvm-ap.h
>   create mode 100644 arch/s390/kvm/kvm-ap.c
>
> diff --git a/MAINTAINERS b/MAINTAINERS
> index 0ec5881..72742d5 100644
> --- a/MAINTAINERS
> +++ b/MAINTAINERS
> @@ -11875,6 +11875,16 @@ W:	http://www.ibm.com/developerworks/linux/linux390/
>   S:	Supported
>   F:	drivers/s390/crypto/
>
> +S390 VFIO AP DRIVER
> +M:	Tony Krowiak <akrowiak@...ux.vnet.ibm.com>
> +M:	Christian Borntraeger <borntraeger@...ibm.com>
> +M:	Martin Schwidefsky <schwidefsky@...ibm.com>
> +L:	linux-s390@...r.kernel.org
> +W:	http://www.ibm.com/developerworks/linux/linux390/
> +S:	Supported
> +F:	arch/s390/include/asm/kvm/kvm-ap.h
> +F:	arch/s390/kvm/kvm-ap.c
> +
>   S390 ZFCP DRIVER
>   M:	Steffen Maier <maier@...ux.vnet.ibm.com>
>   M:	Benjamin Block <bblock@...ux.vnet.ibm.com>
> diff --git a/arch/s390/include/asm/kvm-ap.h b/arch/s390/include/asm/kvm-ap.h
> new file mode 100644
> index 0000000..362846c
> --- /dev/null
> +++ b/arch/s390/include/asm/kvm-ap.h
> @@ -0,0 +1,16 @@
> +/*
> + * Adjunct Processor (AP) configuration management for KVM guests
> + *
> + * Copyright IBM Corp. 2017
> + *
> + * Author(s): Tony Krowiak <akrowia@...ux.vnet.ibm.com>
> + */
> +
> +#ifndef _ASM_KVM_AP
> +#define _ASM_KVM_AP
> +#include <linux/types.h>
> +#include <linux/kvm_host.h>
> +
> +void kvm_ap_build_crycbd(struct kvm *kvm);
> +
> +#endif /* _ASM_KVM_AP */
> diff --git a/arch/s390/include/asm/kvm_host.h b/arch/s390/include/asm/kvm_host.h
> index 34c9b5b..65a944e 100644
> --- a/arch/s390/include/asm/kvm_host.h
> +++ b/arch/s390/include/asm/kvm_host.h
> @@ -257,6 +257,7 @@ struct kvm_s390_sie_block {
>   	__u8	reservedf0[12];		/* 0x00f0 */
>   #define CRYCB_FORMAT1 0x00000001
>   #define CRYCB_FORMAT2 0x00000003
> +#define CRYCB_FORMAT_MASK 0x00000003
>   	__u32	crycbd;			/* 0x00fc */
>   	__u64	gcr[16];		/* 0x0100 */
>   	__u64	gbea;			/* 0x0180 */
> diff --git a/arch/s390/kvm/Kconfig b/arch/s390/kvm/Kconfig
> index a3dbd45..4ca9077 100644
> --- a/arch/s390/kvm/Kconfig
> +++ b/arch/s390/kvm/Kconfig
> @@ -33,6 +33,7 @@ config KVM
>   	select HAVE_KVM_INVALID_WAKEUPS
>   	select SRCU
>   	select KVM_VFIO
> +	select ZCRYPT

I do not think it is a good solution to *always* enable ZCRYPT
when we have KVM.

Pierre


-- 
Pierre Morel
Linux/KVM/QEMU in Böblingen - Germany