KVM: s390: add msa11 to cpu model

Message-security-assist 11 introduces pckmo subfunctions to encrypt
hmac keys.

Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Link: https://lore.kernel.org/r/20241107152319.77816-3-brueckner@linux.ibm.com
Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
Message-ID: <20241107152319.77816-3-brueckner@linux.ibm.com>

diff --git a/arch/s390/include/asm/kvm_host.h b/arch/s390/include/asm/kvm_host.h
index 8e77afbed58ec21577a4a2417509c405dd02f374..851cfe5042f389574b00d07e6491fb5d86f3dc1d 100644 (file)
--- a/arch/s390/include/asm/kvm_host.h
+++ b/arch/s390/include/asm/kvm_host.h
@@ -356,6 +356,7 @@ struct kvm_s390_sie_block {
 #define ECD_MEF                0x08000000
 #define ECD_ETOKENF    0x02000000
 #define ECD_ECC                0x00200000
+#define ECD_HMAC       0x00004000
        __u32   ecd;                    /* 0x01c8 */
        __u8    reserved1cc[18];        /* 0x01cc */
        __u64   pp;                     /* 0x01de */

diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index 74f385b5efbdcc31e27b535d1ff36236b8b64941..20b1317ef95d628ffa42ac787a276a85bb513f21 100644 (file)
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -3796,6 +3796,13 @@ static bool kvm_has_pckmo_ecc(struct kvm *kvm)
 
 }
 
+static bool kvm_has_pckmo_hmac(struct kvm *kvm)
+{
+       /* At least one HMAC subfunction must be present */
+       return kvm_has_pckmo_subfunc(kvm, 118) ||
+              kvm_has_pckmo_subfunc(kvm, 122);
+}
+
 static void kvm_s390_vcpu_crypto_setup(struct kvm_vcpu *vcpu)
 {
        /*
@@ -3808,7 +3815,7 @@ static void kvm_s390_vcpu_crypto_setup(struct kvm_vcpu *vcpu)
        vcpu->arch.sie_block->crycbd = vcpu->kvm->arch.crypto.crycbd;
        vcpu->arch.sie_block->ecb3 &= ~(ECB3_AES | ECB3_DEA);
        vcpu->arch.sie_block->eca &= ~ECA_APIE;
-       vcpu->arch.sie_block->ecd &= ~ECD_ECC;
+       vcpu->arch.sie_block->ecd &= ~(ECD_ECC | ECD_HMAC);
 
        if (vcpu->kvm->arch.crypto.apie)
                vcpu->arch.sie_block->eca |= ECA_APIE;
@@ -3816,9 +3823,11 @@ static void kvm_s390_vcpu_crypto_setup(struct kvm_vcpu *vcpu)
        /* Set up protected key support */
        if (vcpu->kvm->arch.crypto.aes_kw) {
                vcpu->arch.sie_block->ecb3 |= ECB3_AES;
-               /* ecc is also wrapped with AES key */
+               /* ecc/hmac is also wrapped with AES key */
                if (kvm_has_pckmo_ecc(vcpu->kvm))
                        vcpu->arch.sie_block->ecd |= ECD_ECC;
+               if (kvm_has_pckmo_hmac(vcpu->kvm))
+                       vcpu->arch.sie_block->ecd |= ECD_HMAC;
        }
 
        if (vcpu->kvm->arch.crypto.dea_kw)

diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c
index 89cafea4c41f26c0af31eb00246c892e6c6b2e6f..9ce0902f309b365fea193184a00d2f2ee833e28d 100644 (file)
--- a/arch/s390/kvm/vsie.c
+++ b/arch/s390/kvm/vsie.c
@@ -335,7 +335,8 @@ static int shadow_crycb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
        /* we may only allow it if enabled for guest 2 */
        ecb3_flags = scb_o->ecb3 & vcpu->arch.sie_block->ecb3 &
                     (ECB3_AES | ECB3_DEA);
-       ecd_flags = scb_o->ecd & vcpu->arch.sie_block->ecd & ECD_ECC;
+       ecd_flags = scb_o->ecd & vcpu->arch.sie_block->ecd &
+                    (ECD_ECC | ECD_HMAC);
        if (!ecb3_flags && !ecd_flags)
                goto end;