On 04.03.20 12:42, Janosch Frank wrote:
> When a guest has saved a ipib of type 5 and calls diagnose308 with
> subcode 10, we have to setup the protected processing environment via
> Ultravisor calls. The calls are done by KVM and are exposed via an
> API.
>
> The following steps are necessary:
> 1. Enable protected mode for the VM (register it and its cpus with the
> Ultravisor)
> 2. Forward the secure header to the Ultravisor (has all information on
> how to decrypt the image and VM information)
> 3. Protect image pages from the host and decrypt them
> 4. Verify the image integrity
>
> Only after step 4 a protected VM is allowed to run.
>
> Signed-off-by: Janosch Frank <fran...@linux.ibm.com>
> Signed-off-by: Christian Borntraeger <borntrae...@de.ibm.com> [Changes
> to machine]
> ---
> hw/s390x/Makefile.objs | 1 +
> hw/s390x/ipl.c | 33 +++++++++
> hw/s390x/ipl.h | 2 +
> hw/s390x/pv.c | 106 ++++++++++++++++++++++++++++
> hw/s390x/pv.h | 34 +++++++++
> hw/s390x/s390-virtio-ccw.c | 91 ++++++++++++++++++++++++
> include/hw/s390x/s390-virtio-ccw.h | 1 +
> target/s390x/cpu.c | 4 ++
> target/s390x/cpu.h | 1 +
> target/s390x/cpu_features_def.inc.h | 1 +
> 10 files changed, 274 insertions(+)
> create mode 100644 hw/s390x/pv.c
> create mode 100644 hw/s390x/pv.h
>
> diff --git a/hw/s390x/Makefile.objs b/hw/s390x/Makefile.objs
> index e02ed80b68..a46a1c7894 100644
> --- a/hw/s390x/Makefile.objs
> +++ b/hw/s390x/Makefile.objs
> @@ -31,6 +31,7 @@ obj-y += tod-qemu.o
> obj-$(CONFIG_KVM) += tod-kvm.o
> obj-$(CONFIG_KVM) += s390-skeys-kvm.o
> obj-$(CONFIG_KVM) += s390-stattrib-kvm.o
> +obj-$(CONFIG_KVM) += pv.o
> obj-y += s390-ccw.o
> obj-y += ap-device.o
> obj-y += ap-bridge.o
> diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
> index 80c6ab233a..3b241ea549 100644
> --- a/hw/s390x/ipl.c
> +++ b/hw/s390x/ipl.c
> @@ -33,6 +33,7 @@
> #include "qemu/cutils.h"
> #include "qemu/option.h"
> #include "exec/exec-all.h"
> +#include "pv.h"
>
> #define KERN_IMAGE_START 0x010000UL
> #define LINUX_MAGIC_ADDR 0x010008UL
> @@ -676,6 +677,38 @@ static void s390_ipl_prepare_qipl(S390CPU *cpu)
> cpu_physical_memory_unmap(addr, len, 1, len);
> }
>
> +int s390_ipl_prepare_pv_header(void)
> +{
> + S390IPLState *ipl = get_ipl_device();
> + IPLBlockPV *ipib_pv = &ipl->iplb_pv.pv;
> + void *hdr = g_malloc(ipib_pv->pv_header_len);
> + int rc;
> +
> + cpu_physical_memory_read(ipib_pv->pv_header_addr, hdr,
> + ipib_pv->pv_header_len);
> + rc = s390_pv_set_sec_parms((uint64_t)hdr,
> + ipib_pv->pv_header_len);
> + g_free(hdr);
> + return rc;
> +}
> +
> +int s390_ipl_pv_unpack(void)
> +{
> + int i, rc = 0;
> + S390IPLState *ipl = get_ipl_device();
> + IPLBlockPV *ipib_pv = &ipl->iplb_pv.pv;
> +
> + for (i = 0; i < ipib_pv->num_comp; i++) {
> + rc = s390_pv_unpack(ipib_pv->components[i].addr,
> + TARGET_PAGE_ALIGN(ipib_pv->components[i].size),
> + ipib_pv->components[i].tweak_pref);
> + if (rc) {
> + break;
> + }
> + }
> + return rc;
> +}
> +
> void s390_ipl_prepare_cpu(S390CPU *cpu)
> {
> S390IPLState *ipl = get_ipl_device();
> diff --git a/hw/s390x/ipl.h b/hw/s390x/ipl.h
> index 04be63cee1..ad8090a02c 100644
> --- a/hw/s390x/ipl.h
> +++ b/hw/s390x/ipl.h
> @@ -105,6 +105,8 @@ typedef union IplParameterBlock IplParameterBlock;
> int s390_ipl_set_loadparm(uint8_t *loadparm);
> int s390_ipl_pv_check_components(IplParameterBlock *iplb);
> void s390_ipl_update_diag308(IplParameterBlock *iplb);
> +int s390_ipl_prepare_pv_header(void);
> +int s390_ipl_pv_unpack(void);
> void s390_ipl_prepare_cpu(S390CPU *cpu);
> IplParameterBlock *s390_ipl_get_iplb(void);
> IplParameterBlock *s390_ipl_get_iplb_secure(void);
> diff --git a/hw/s390x/pv.c b/hw/s390x/pv.c
> new file mode 100644
> index 0000000000..50b68b6c34
> --- /dev/null
> +++ b/hw/s390x/pv.c
> @@ -0,0 +1,106 @@
> +/*
> + * Secure execution functions
> + *
> + * Copyright IBM Corp. 2020
> + * Author(s):
> + * Janosch Frank <fran...@linux.ibm.com>
> + *
> + * This work is licensed under the terms of the GNU GPL, version 2 or (at
> + * your option) any later version. See the COPYING file in the top-level
> + * directory.
> + */
> +#include "qemu/osdep.h"
> +#include <sys/ioctl.h>
Do you really need that include? You're using kvm_vm_ioctl().
--
Thanks,
David / dhildenb
