[21.10 FEAT] KVM: Change Secure Execution Header defaults for plaintext control flags (PCF) (s390-tools)

[bugproxy]

The plaintext control flags (PCF) in the Secure Execution header have safe default settings. Specifically the protected key support (PCKMO) is disabled by default. This is however in contrast to the defaults used by regular KVM guests, which are allowed to use protected keys. This may lead (and has lead) to confusion. To improve usability the default SE header PCF settings should be set to allow all PCKMO types. While doing that, an explicit option to enable/disable PCKMO should be added, so that clients have no need to use the 'experimental/expert' flags.

Value: Lowers the hurdles to deploy secure execution guests by maintaining commonality with the non-secure behavior.

Feature will be part of s390-tools >= 2.17

[Frank Heimes (fheimes)]

I cannot find this in v2.17 https://github.com/ibm-s390-linux/s390-tools/releases/tag/v2.17.0
So I guess it did not made it into 2.17 ?

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2021-08-12 07:30 EDT-------
@Canonical (Frank):
Yes, this feature is part of the s390-tools 2.17 release. Here are the commit IDs:

8db32a8c genprotimg: add `--(enable|disable)-pckmo` flag
4cf73238 genprotimg: allow PCKMO functions by default
27120f28 genprotimg: rename PV_CFLAG_NO_DECRYPTION to PV_PCF_NO_DECRYPTION

[Frank Heimes (fheimes)]

Thx Boris for sharing.
In this case we can close this ticket as Fix Released based on the closure of the tickets LP#1929024 and LP#1934988.

[bugproxy (bugproxy)]

------- Comment From <email address hidden> 2021-08-15 21:06 EDT-------
feature is part of the s390-tools 2.17 release which goes into impish / 21.10, hence closing this bug.
Status: ->CLOSED