From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752988AbeDOVWi (ORCPT ); Sun, 15 Apr 2018 17:22:38 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:57274 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752913AbeDOVWg (ORCPT ); Sun, 15 Apr 2018 17:22:36 -0400 From: Tony Krowiak To: linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: freude@de.ibm.com, schwidefsky@de.ibm.com, heiko.carstens@de.ibm.com, borntraeger@de.ibm.com, cohuck@redhat.com, kwankhede@nvidia.com, bjsdjshi@linux.vnet.ibm.com, pbonzini@redhat.com, alex.williamson@redhat.com, pmorel@linux.vnet.ibm.com, alifm@linux.vnet.ibm.com, mjrosato@linux.vnet.ibm.com, jjherne@linux.vnet.ibm.com, thuth@redhat.com, pasic@linux.vnet.ibm.com, berrange@redhat.com, fiuczy@linux.vnet.ibm.com, buendgen@de.ibm.com, akrowiak@linux.vnet.ibm.com Subject: [PATCH v4 00/15] s390: vfio-ap: guest dedicated crypto adapters Date: Sun, 15 Apr 2018 17:22:10 -0400 X-Mailer: git-send-email 1.7.1 X-TM-AS-GCONF: 00 x-cbid: 18041521-0052-0000-0000-000002DB5A1B X-IBM-SpamModules-Scores: X-IBM-SpamModules-Versions: BY=3.00008862; HX=3.00000241; KW=3.00000007; PH=3.00000004; SC=3.00000257; SDB=6.01018429; UDB=6.00519481; IPR=6.00797666; MB=3.00020592; MTD=3.00000008; XFM=3.00000015; UTC=2018-04-15 21:22:32 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 18041521-0053-0000-0000-00005C578053 Message-Id: <1523827345-11600-1-git-send-email-akrowiak@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:,, definitions=2018-04-15_10:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=0 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1709140000 definitions=main-1804150214 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On s390, we have cryptographic coprocessor cards, which are modeled on Linux as devices on the AP bus. Each card can be partitioned into domains which can be thought of as a set of hardware registers for processing crypto commands. Crypto commands are sent to a specific domain within a card is via a queue which is identified as a (card,domain) tuple. We model this something like the following (assuming we have access to cards 3 and 4 and domains 1 and 2): AP -> card3 -> queue (3,1) -> queue (3,2) -> card4 -> queue (4,1) -> queue (4,2) If we want to virtualize this, we can use a feature provided by the hardware. We basically attach a satellite control block to our main hardware virtualization control block and the hardware takes care of most of the rest. For this control block, we don't specify explicit tuples, but a list of cards and a list of domains. The guest will get access to the cross product. Because of this, we need to take care that the lists provided to different guests don't overlap; i.e., we need to enforce sane configurations. Otherwise, one guest may get access to things like secret keys for another guest. The idea of this patch set is to introduce a new device, the matrix device. This matrix device hangs off a different root and acts as the parent node for mdev devices. If you now want to give the tuples (4,1) and (4,2), you need to do the following: - Unbind the (4,1) and (4,2) tuples from their ap bus driver. - Bind the (4,1) and (4,2) tuples to the vfio_ap driver. - Create the mediated device. - Assign card 4 and domains 1 and 2 to the mediated device QEMU will now simply consume the mediated device and things should work. For a complete description of the architecture and concepts underlying the design, see the Documentation/s390/vfio-ap.txt file included with this patch set. Change log v3 -> v4 =================== * Resolved issue with enabling ZCRYPT when KVM is enabled by using #ifdef ZCRYPT in relevant functions * Added patch with a new function for resetting the crypto attributes for all vcpus to resolve the issue raised with running vcpus getting out of sync. * Removed KVM_S390_VM_CRYPTO_INTERPRET_AP: Setting interpretive exec mode from vfio_ap driver when mdev device is opened. Tony Krowiak (15): s390: zcrypt: externalize AP instructions available function KVM: s390: reset crypto attributes for all vcpus KVM: s390: refactor crypto initialization KVM: s390: CPU model support for AP virtualization KVM: s390: enable/disable AP interpretive execution s390: vfio-ap: base implementation of VFIO AP device driver s390: vfio-ap: register matrix device with VFIO mdev framework KVM: s390: interfaces to (de)configure guest's AP matrix s390: vfio-ap: sysfs interfaces to configure adapters s390: vfio-ap: sysfs interfaces to configure domains s390: vfio-ap: sysfs interfaces to configure control domains s390: vfio-ap: sysfs interface to view matrix mdev matrix KVM: s390: configure the guest's AP devices s390: vfio-ap: implement VFIO_DEVICE_GET_INFO ioctl s390: doc: detailed specifications for AP virtualization Documentation/s390/vfio-ap.txt | 567 +++++++++++++++++++++ MAINTAINERS | 12 + arch/s390/Kconfig | 11 + arch/s390/include/asm/ap.h | 7 + arch/s390/include/asm/kvm-ap.h | 136 +++++ arch/s390/include/asm/kvm_host.h | 3 + arch/s390/include/uapi/asm/kvm.h | 1 + arch/s390/kvm/Makefile | 2 +- arch/s390/kvm/kvm-ap.c | 339 +++++++++++++ arch/s390/kvm/kvm-s390.c | 93 ++--- arch/s390/kvm/kvm-s390.h | 14 + arch/s390/tools/gen_facilities.c | 2 + drivers/s390/crypto/Makefile | 4 + drivers/s390/crypto/ap_bus.c | 6 + drivers/s390/crypto/vfio_ap_drv.c | 143 ++++++ drivers/s390/crypto/vfio_ap_ops.c | 873 +++++++++++++++++++++++++++++++++ drivers/s390/crypto/vfio_ap_private.h | 46 ++ include/uapi/linux/vfio.h | 2 + 18 files changed, 2200 insertions(+), 61 deletions(-) create mode 100644 Documentation/s390/vfio-ap.txt create mode 100644 arch/s390/include/asm/kvm-ap.h create mode 100644 arch/s390/kvm/kvm-ap.c create mode 100644 drivers/s390/crypto/vfio_ap_drv.c create mode 100644 drivers/s390/crypto/vfio_ap_ops.c create mode 100644 drivers/s390/crypto/vfio_ap_private.h