linux-kernel - Re: [PATCH v4 03/15] KVM: s390: refactor crypto initialization

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180417121044.5c8f2182.cohuck@redhat.com>
Date:   Tue, 17 Apr 2018 12:10:44 +0200
From:   Cornelia Huck <cohuck@...hat.com>
To:     "Harald Freudenberger" <FREUDE@...ibm.com>
Cc:     Pierre Morel <pmorel@...ux.vnet.ibm.com>,
        Tony Krowiak <akrowiak@...ux.vnet.ibm.com>,
        alex.williamson@...hat.com, alifm@...ux.vnet.ibm.com,
        berrange@...hat.com, bjsdjshi@...ux.vnet.ibm.com,
        borntrae@...ux.ibm.com, fiuczy@...ux.vnet.ibm.com,
        heicars2@...ux.vnet.ibm.com, jjherne@...ux.vnet.ibm.com,
        kvm@...r.kernel.org, kwankhede@...dia.com,
        linux-kernel@...r.kernel.org, linux-s390@...r.kernel.org,
        mjrosato@...ux.vnet.ibm.com, mschwid2@...ux.vnet.ibm.com,
        pasic@...ux.vnet.ibm.com, pbonzini@...hat.com,
        "Reinhard Buendgen" <BUENDGEN@...ibm.com>, thuth@...hat.com
Subject: Re: [PATCH v4 03/15] KVM: s390: refactor crypto initialization

On Tue, 17 Apr 2018 09:49:58 +0200
"Harald Freudenberger" <FREUDE@...ibm.com> wrote:

> Didn't we say that when APXA is not available there is no Crypto support
> for KVM ?

[Going by the code, as I don't have access to the architecture]

Current status seems to be:
- setup crycb if facility 76 is available (that's MSAX3, I guess?)
- use format 2 if APXA is available, else use format 1

>From Tony's patch description, the goal seems to be:
- setup crycb even if MSAX3 is not available

So my understanding is that we use APXA only to decide on the format of
the crycb, but provide it in any case?

(Not providing a crycb if APXA is not available would be loss of
functionality, I guess? Deciding not to provide vfio-ap if APXA is not
available is a different game, of course.)