Commit c3347ed0 authored by Janosch Frank's avatar Janosch Frank Committed by Cornelia Huck
Browse files

s390x: protvirt: Support unpack facility 



The unpack facility provides the means to setup a protected guest. A
protected guest cannot be introspected by the hypervisor or any
user/administrator of the machine it is running on.

Protected guests are encrypted at rest and need a special boot
mechanism via diag308 subcode 8 and 10.

Code 8 sets the PV specific IPLB which is retained separately from
those set via code 5.

Code 10 is used to unpack the VM into protected memory, verify its
integrity and start it.

Signed-off-by: default avatarJanosch Frank <frankja@linux.ibm.com>
Co-developed-by: Christian Borntraeger <borntraeger@de.ibm.com> [Changes
to machine]
Reviewed-by: default avatarDavid Hildenbrand <david@redhat.com>
Reviewed-by: default avatarClaudio Imbrenda <imbrenda@linux.ibm.com>
Reviewed-by: default avatarCornelia Huck <cohuck@redhat.com>
Message-Id: <20200323083606.24520-1-frankja@linux.ibm.com>
[CH: fixed up KVM_PV_VM_ -> KVM_PV_]
Signed-off-by: default avatarCornelia Huck <cohuck@redhat.com>
parent 9b39d294

MAINTAINERS

+2 −0
Original line number Diff line number Diff line
@@ -396,6 +396,8 @@ F: target/s390x/machine.c 
F: target/s390x/sigp.c

F: target/s390x/cpu_features*.[ch]

F: target/s390x/cpu_models.[ch]

F: hw/s390x/pv.c

F: include/hw/s390x/pv.h

F: hw/intc/s390_flic.c

F: hw/intc/s390_flic_kvm.c

F: include/hw/s390x/s390_flic.h

hw/s390x/Makefile.objs

+1 −0
Original line number Diff line number Diff line
@@ -31,6 +31,7 @@ obj-y += tod-qemu.o 
obj-$(CONFIG_KVM) += tod-kvm.o

obj-$(CONFIG_KVM) += s390-skeys-kvm.o

obj-$(CONFIG_KVM) += s390-stattrib-kvm.o

obj-$(CONFIG_KVM) += pv.o

obj-y += s390-ccw.o

obj-y += ap-device.o

obj-y += ap-bridge.o

hw/s390x/ipl.c

+56 −3
Original line number Diff line number Diff line 
/*

 * bootloader support

 *

 * Copyright IBM, Corp. 2012

 * Copyright IBM, Corp. 2012, 2020

 *

 * Authors:

 *  Christian Borntraeger <borntraeger@de.ibm.com>

 *  Janosch Frank <frankja@linux.ibm.com>

 *

 * This work is licensed under the terms of the GNU GPL, version 2 or (at your

 * option) any later version.  See the COPYING file in the top-level directory.
@@ -27,6 +28,7 @@ 
#include "hw/s390x/vfio-ccw.h"

#include "hw/s390x/css.h"

#include "hw/s390x/ebcdic.h"

#include "hw/s390x/pv.h"

#include "ipl.h"

#include "qemu/error-report.h"

#include "qemu/config-file.h"
@@ -566,12 +568,31 @@ void s390_ipl_update_diag308(IplParameterBlock *iplb) 
{

    S390IPLState *ipl = get_ipl_device();



    /*

     * The IPLB set and retrieved by subcodes 8/9 is completely

     * separate from the one managed via subcodes 5/6.

     */

    if (iplb->pbt == S390_IPL_TYPE_PV) {

        ipl->iplb_pv = *iplb;

        ipl->iplb_valid_pv = true;

    } else {

        ipl->iplb = *iplb;

        ipl->iplb_valid = true;

    }

    ipl->netboot = is_virtio_net_device(iplb);

    update_machine_ipl_properties(iplb);

}



IplParameterBlock *s390_ipl_get_iplb_pv(void)

{

    S390IPLState *ipl = get_ipl_device();



    if (!ipl->iplb_valid_pv) {

        return NULL;

    }

    return &ipl->iplb_pv;

}



IplParameterBlock *s390_ipl_get_iplb(void)

{

    S390IPLState *ipl = get_ipl_device();
@@ -660,6 +681,38 @@ static void s390_ipl_prepare_qipl(S390CPU *cpu) 
    cpu_physical_memory_unmap(addr, len, 1, len);

}



int s390_ipl_prepare_pv_header(void)

{

    IplParameterBlock *ipib = s390_ipl_get_iplb_pv();

    IPLBlockPV *ipib_pv = &ipib->pv;

    void *hdr = g_malloc(ipib_pv->pv_header_len);

    int rc;



    cpu_physical_memory_read(ipib_pv->pv_header_addr, hdr,

                             ipib_pv->pv_header_len);

    rc = s390_pv_set_sec_parms((uintptr_t)hdr,

                               ipib_pv->pv_header_len);

    g_free(hdr);

    return rc;

}



int s390_ipl_pv_unpack(void)

{

    IplParameterBlock *ipib = s390_ipl_get_iplb_pv();

    IPLBlockPV *ipib_pv = &ipib->pv;

    int i, rc = 0;



    for (i = 0; i < ipib_pv->num_comp; i++) {

        rc = s390_pv_unpack(ipib_pv->components[i].addr,

                            TARGET_PAGE_ALIGN(ipib_pv->components[i].size),

                            ipib_pv->components[i].tweak_pref);

        if (rc) {

            break;

        }

    }

    return rc;

}



void s390_ipl_prepare_cpu(S390CPU *cpu)

{

    S390IPLState *ipl = get_ipl_device();

hw/s390x/ipl.h

+90 −1
Original line number Diff line number Diff line 
/*

 * s390 IPL device

 *

 * Copyright 2015 IBM Corp.

 * Copyright 2015, 2020 IBM Corp.

 * Author(s): Zhang Fan <bjfanzh@cn.ibm.com>

 * Janosch Frank <frankja@linux.ibm.com>

 *

 * This work is licensed under the terms of the GNU GPL, version 2 or (at

 * your option) any later version. See the COPYING file in the top-level
@@ -15,6 +16,24 @@ 
#include "cpu.h"

#include "hw/qdev-core.h"



struct IPLBlockPVComp {

    uint64_t tweak_pref;

    uint64_t addr;

    uint64_t size;

} QEMU_PACKED;

typedef struct IPLBlockPVComp IPLBlockPVComp;



struct IPLBlockPV {

    uint8_t  reserved18[87];    /* 0x18 */

    uint8_t  version;           /* 0x6f */

    uint32_t reserved70;        /* 0x70 */

    uint32_t num_comp;          /* 0x74 */

    uint64_t pv_header_addr;    /* 0x78 */

    uint64_t pv_header_len;     /* 0x80 */

    struct IPLBlockPVComp components[];

} QEMU_PACKED;

typedef struct IPLBlockPV IPLBlockPV;



struct IplBlockCcw {

    uint8_t  reserved0[85];

    uint8_t  ssid;
@@ -71,6 +90,7 @@ union IplParameterBlock { 
        union {

            IplBlockCcw ccw;

            IplBlockFcp fcp;

            IPLBlockPV pv;

            IplBlockQemuScsi scsi;

        };

    } QEMU_PACKED;
@@ -85,8 +105,11 @@ typedef union IplParameterBlock IplParameterBlock; 


int s390_ipl_set_loadparm(uint8_t *loadparm);

void s390_ipl_update_diag308(IplParameterBlock *iplb);

int s390_ipl_prepare_pv_header(void);

int s390_ipl_pv_unpack(void);

void s390_ipl_prepare_cpu(S390CPU *cpu);

IplParameterBlock *s390_ipl_get_iplb(void);

IplParameterBlock *s390_ipl_get_iplb_pv(void);



enum s390_reset {

    /* default is a reset not triggered by a CPU e.g. issued by QMP */
@@ -94,6 +117,7 @@ enum s390_reset { 
    S390_RESET_REIPL,

    S390_RESET_MODIFIED_CLEAR,

    S390_RESET_LOAD_NORMAL,

    S390_RESET_PV,

};

void s390_ipl_reset_request(CPUState *cs, enum s390_reset reset_type);

void s390_ipl_get_reset_request(CPUState **cs, enum s390_reset *reset_type);
@@ -133,6 +157,7 @@ struct S390IPLState { 
    /*< private >*/

    DeviceState parent_obj;

    IplParameterBlock iplb;

    IplParameterBlock iplb_pv;

    QemuIplParameters qipl;

    uint64_t start_addr;

    uint64_t compat_start_addr;
@@ -140,6 +165,7 @@ struct S390IPLState { 
    uint64_t compat_bios_start_addr;

    bool enforce_bios;

    bool iplb_valid;

    bool iplb_valid_pv;

    bool netboot;

    /* reset related properties don't have to be migrated or reset */

    enum s390_reset reset_type;
@@ -162,6 +188,8 @@ QEMU_BUILD_BUG_MSG(offsetof(S390IPLState, iplb) & 3, "alignment of iplb wrong"); 
#define DIAG_308_RC_OK              0x0001

#define DIAG_308_RC_NO_CONF         0x0102

#define DIAG_308_RC_INVALID         0x0402

#define DIAG_308_RC_NO_PV_CONF      0x0902

#define DIAG_308_RC_INVAL_FOR_PV    0x0a02



#define DIAG308_RESET_MOD_CLR       0

#define DIAG308_RESET_LOAD_NORM     1
@@ -169,12 +197,17 @@ QEMU_BUILD_BUG_MSG(offsetof(S390IPLState, iplb) & 3, "alignment of iplb wrong"); 
#define DIAG308_LOAD_NORMAL_DUMP    4

#define DIAG308_SET                 5

#define DIAG308_STORE               6

#define DIAG308_PV_SET              8

#define DIAG308_PV_STORE            9

#define DIAG308_PV_START            10



#define S390_IPL_TYPE_FCP 0x00

#define S390_IPL_TYPE_CCW 0x02

#define S390_IPL_TYPE_PV 0x05

#define S390_IPL_TYPE_QEMU_SCSI 0xff



#define S390_IPLB_HEADER_LEN 8

#define S390_IPLB_MIN_PV_LEN 148

#define S390_IPLB_MIN_CCW_LEN 200

#define S390_IPLB_MIN_FCP_LEN 384

#define S390_IPLB_MIN_QEMU_SCSI_LEN 200
@@ -184,6 +217,62 @@ static inline bool iplb_valid_len(IplParameterBlock *iplb) 
    return be32_to_cpu(iplb->len) <= sizeof(IplParameterBlock);

}



static inline bool ipl_valid_pv_components(IplParameterBlock *iplb)

{

    IPLBlockPV *ipib_pv = &iplb->pv;

    int i;



    if (ipib_pv->num_comp == 0) {

        return false;

    }



    for (i = 0; i < ipib_pv->num_comp; i++) {

        /* Addr must be 4k aligned */

        if (ipib_pv->components[i].addr & ~TARGET_PAGE_MASK) {

            return false;

        }



        /* Tweak prefix is monotonically increasing with each component */

        if (i < ipib_pv->num_comp - 1 &&

            ipib_pv->components[i].tweak_pref >=

            ipib_pv->components[i + 1].tweak_pref) {

            return false;

        }

    }

    return true;

}



static inline bool ipl_valid_pv_header(IplParameterBlock *iplb)

{

        IPLBlockPV *ipib_pv = &iplb->pv;



        if (ipib_pv->pv_header_len > 2 * TARGET_PAGE_SIZE) {

            return false;

        }



        if (!address_space_access_valid(&address_space_memory,

                                        ipib_pv->pv_header_addr,

                                        ipib_pv->pv_header_len,

                                        false,

                                        MEMTXATTRS_UNSPECIFIED)) {

            return false;

        }



        return true;

}



static inline bool iplb_valid_pv(IplParameterBlock *iplb)

{

    if (iplb->pbt != S390_IPL_TYPE_PV ||

        be32_to_cpu(iplb->len) < S390_IPLB_MIN_PV_LEN) {

        return false;

    }

    if (!ipl_valid_pv_header(iplb)) {

        return false;

    }

    return ipl_valid_pv_components(iplb);

}



static inline bool iplb_valid(IplParameterBlock *iplb)

{

    switch (iplb->pbt) {

hw/s390x/pv.c

0 → 100644
+98 −0
Original line number Diff line number Diff line 
/*

 * Protected Virtualization functions

 *

 * Copyright IBM Corp. 2020

 * Author(s):

 *  Janosch Frank <frankja@linux.ibm.com>

 *

 * This work is licensed under the terms of the GNU GPL, version 2 or (at

 * your option) any later version. See the COPYING file in the top-level

 * directory.

 */

#include "qemu/osdep.h"



#include <linux/kvm.h>



#include "qemu/error-report.h"

#include "sysemu/kvm.h"

#include "hw/s390x/pv.h"



static int __s390_pv_cmd(uint32_t cmd, const char *cmdname, void *data)

{

    struct kvm_pv_cmd pv_cmd = {

        .cmd = cmd,

        .data = (uint64_t)data,

    };

    int rc = kvm_vm_ioctl(kvm_state, KVM_S390_PV_COMMAND, &pv_cmd);



    if (rc) {

        error_report("KVM PV command %d (%s) failed: header rc %x rrc %x "

                     "IOCTL rc: %d", cmd, cmdname, pv_cmd.rc, pv_cmd.rrc,

                     rc);

    }

    return rc;

}



/*

 * This macro lets us pass the command as a string to the function so

 * we can print it on an error.

 */

#define s390_pv_cmd(cmd, data) __s390_pv_cmd(cmd, #cmd, data);

#define s390_pv_cmd_exit(cmd, data)    \

{                                      \

    int rc;                            \

                                       \

    rc = __s390_pv_cmd(cmd, #cmd, data);\

    if (rc) {                          \

        exit(1);                       \

    }                                  \

}



int s390_pv_vm_enable(void)

{

    return s390_pv_cmd(KVM_PV_ENABLE, NULL);

}



void s390_pv_vm_disable(void)

{

     s390_pv_cmd_exit(KVM_PV_DISABLE, NULL);

}



int s390_pv_set_sec_parms(uint64_t origin, uint64_t length)

{

    struct kvm_s390_pv_sec_parm args = {

        .origin = origin,

        .length = length,

    };



    return s390_pv_cmd(KVM_PV_SET_SEC_PARMS, &args);

}



/*

 * Called for each component in the SE type IPL parameter block 0.

 */

int s390_pv_unpack(uint64_t addr, uint64_t size, uint64_t tweak)

{

    struct kvm_s390_pv_unp args = {

        .addr = addr,

        .size = size,

        .tweak = tweak,

    };



    return s390_pv_cmd(KVM_PV_UNPACK, &args);

}



void s390_pv_perf_clear_reset(void)

{

    s390_pv_cmd_exit(KVM_PV_PREP_RESET, NULL);

}



int s390_pv_verify(void)

{

    return s390_pv_cmd(KVM_PV_VERIFY, NULL);

}



void s390_pv_unshare(void)

{

    s390_pv_cmd_exit(KVM_PV_UNSHARE_ALL, NULL);

}