KVM: s390: vsie: Do the CRYCB validation first

BugLink: https://bugs.launchpad.net/bugs/1787405
We need to handle the validity checks for the crycb, no matter what the
settings for the keywrappings are. So lets move the keywrapping checks
after we have done the validy checks.

Signed-off-by: Pierre Morel <pmorel@linux.ibm.com>
Signed-off-by: Tony Krowiak <akrowiak@linux.ibm.com>
Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Message-Id: <20180925231641.4954-17-akrowiak@linux.vnet.ibm.com>
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
(cherry picked from commit d6f6959ac5877885fbba8b0efe09e6103fa1da80)
Signed-off-by: Joseph Salisbury <joseph.salisbury@canonical.com>
Acked-by: Brad Figg <brad.figg@canonical.com>
Acked-by: Kamal Mostafa <kamal@canonical.com>
Acked-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>

diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c
index b01a75b982d60737e914f7f1e7e68aefe3d6b2ef..f0cd6665bc7eb6dcc00d5c7e879bc9acc206c59f 100644 (file)
--- a/arch/s390/kvm/vsie.c
+++ b/arch/s390/kvm/vsie.c
@@ -155,17 +155,18 @@ static int shadow_crycb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
        /* format-1 is supported with message-security-assist extension 3 */
        if (!test_kvm_facility(vcpu->kvm, 76))
                return 0;
-       /* we may only allow it if enabled for guest 2 */
-       ecb3_flags = scb_o->ecb3 & vcpu->arch.sie_block->ecb3 &
-                    (ECB3_AES | ECB3_DEA);
-       if (!ecb3_flags)
-               return 0;
 
        if ((crycb_addr & PAGE_MASK) != ((crycb_addr + 128) & PAGE_MASK))
                return set_validity_icpt(scb_s, 0x003CU);
        else if (!crycb_addr)
                return set_validity_icpt(scb_s, 0x0039U);
 
+       /* we may only allow it if enabled for guest 2 */
+       ecb3_flags = scb_o->ecb3 & vcpu->arch.sie_block->ecb3 &
+                    (ECB3_AES | ECB3_DEA);
+       if (!ecb3_flags)
+               return 0;
+
        /* copy only the wrapping keys */
        if (read_guest_real(vcpu, crycb_addr + 72, &vsie_page->crycb, 56))
                return set_validity_icpt(scb_s, 0x0035U);