On 3/5/20 2:51 PM, David Hildenbrand wrote: > On 04.03.20 12:42, Janosch Frank wrote: >> When a guest has saved a ipib of type 5 and calls diagnose308 with > > s/a/an/ > >> subcode 10, we have to setup the protected processing environment via >> Ultravisor calls. The calls are done by KVM and are exposed via an >> API. >> >> The following steps are necessary: >> 1. Enable protected mode for the VM (register it and its cpus with the Ultravisor) >> 2. Forward the secure header to the Ultravisor (has all information on >> how to decrypt the image and VM information) >> 3. Protect image pages from the host and decrypt them >> 4. Verify the image integrity >> >> Only after step 4 a protected VM is allowed to run. >> >> Signed-off-by: Janosch Frank >> Signed-off-by: Christian Borntraeger [Changes >> to machine] >> --- >> hw/s390x/Makefile.objs | 1 + >> hw/s390x/ipl.c | 33 +++++++++ >> hw/s390x/ipl.h | 2 + >> hw/s390x/pv.c | 106 ++++++++++++++++++++++++++++ >> hw/s390x/pv.h | 34 +++++++++ >> hw/s390x/s390-virtio-ccw.c | 91 ++++++++++++++++++++++++ >> include/hw/s390x/s390-virtio-ccw.h | 1 + >> target/s390x/cpu.c | 4 ++ >> target/s390x/cpu.h | 1 + >> target/s390x/cpu_features_def.inc.h | 1 + >> 10 files changed, 274 insertions(+) >> create mode 100644 hw/s390x/pv.c >> create mode 100644 hw/s390x/pv.h > > [...] > >> >> #define KERN_IMAGE_START 0x010000UL >> #define LINUX_MAGIC_ADDR 0x010008UL >> @@ -676,6 +677,38 @@ static void s390_ipl_prepare_qipl(S390CPU *cpu) >> cpu_physical_memory_unmap(addr, len, 1, len); >> } >> >> +int s390_ipl_prepare_pv_header(void) >> +{ >> + S390IPLState *ipl = get_ipl_device(); >> + IPLBlockPV *ipib_pv = &ipl->iplb_pv.pv; >> + void *hdr = g_malloc(ipib_pv->pv_header_len); >> + int rc; >> + >> + cpu_physical_memory_read(ipib_pv->pv_header_addr, hdr, >> + ipib_pv->pv_header_len); >> + rc = s390_pv_set_sec_parms((uint64_t)hdr, >> + ipib_pv->pv_header_len); >> + g_free(hdr); >> + return rc; >> +} >> + >> +int s390_ipl_pv_unpack(void) >> +{ >> + int i, rc = 0; >> + S390IPLState *ipl = get_ipl_device(); >> + IPLBlockPV *ipib_pv = &ipl->iplb_pv.pv; >> + >> + for (i = 0; i < ipib_pv->num_comp; i++) { >> + rc = s390_pv_unpack(ipib_pv->components[i].addr, >> + TARGET_PAGE_ALIGN(ipib_pv->components[i].size), >> + ipib_pv->components[i].tweak_pref); >> + if (rc) { >> + break; >> + } > > You can check for " && !rc" in the loop condition Not sure if that would make it more readable... > >> + } >> + return rc; >> +} >> + >> void s390_ipl_prepare_cpu(S390CPU *cpu) >> { >> S390IPLState *ipl = get_ipl_device(); >> diff --git a/hw/s390x/ipl.h b/hw/s390x/ipl.h >> index 04be63cee1..ad8090a02c 100644 >> --- a/hw/s390x/ipl.h >> +++ b/hw/s390x/ipl.h >> @@ -105,6 +105,8 @@ typedef union IplParameterBlock IplParameterBlock; >> int s390_ipl_set_loadparm(uint8_t *loadparm); >> int s390_ipl_pv_check_components(IplParameterBlock *iplb); >> void s390_ipl_update_diag308(IplParameterBlock *iplb); >> +int s390_ipl_prepare_pv_header(void); >> +int s390_ipl_pv_unpack(void); >> void s390_ipl_prepare_cpu(S390CPU *cpu); >> IplParameterBlock *s390_ipl_get_iplb(void); >> IplParameterBlock *s390_ipl_get_iplb_secure(void); >> diff --git a/hw/s390x/pv.c b/hw/s390x/pv.c >> new file mode 100644 >> index 0000000000..50b68b6c34 >> --- /dev/null >> +++ b/hw/s390x/pv.c >> @@ -0,0 +1,106 @@ >> +/* >> + * Secure execution functions >> + * >> + * Copyright IBM Corp. 2020 >> + * Author(s): >> + * Janosch Frank >> + * >> + * This work is licensed under the terms of the GNU GPL, version 2 or (at >> + * your option) any later version. See the COPYING file in the top-level >> + * directory. >> + */ >> +#include "qemu/osdep.h" >> +#include >> + >> +#include >> + >> +#include "qemu/error-report.h" >> +#include "sysemu/kvm.h" >> +#include "pv.h" >> + >> +const char *cmd_names[] = { >> + "VM_ENABLE", >> + "VM_DISABLE", >> + "VM_SET_SEC_PARAMS", >> + "VM_UNPACK", >> + "VM_VERIFY", >> + "VM_PREP_RESET", >> + "VM_UNSHARE_ALL", >> + NULL > > Is the NULL really needed? This will be somewhat error prone when we add > new PV commands. Not sure if guarding this by an access function (chack > against ARRAY_SIZE() makes sense). > >> diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c >> index a89cf4c129..dd39890f89 100644 >> --- a/hw/s390x/s390-virtio-ccw.c >> +++ b/hw/s390x/s390-virtio-ccw.c >> @@ -41,6 +41,8 @@ >> #include "hw/qdev-properties.h" >> #include "hw/s390x/tod.h" >> #include "sysemu/sysemu.h" >> +#include "hw/s390x/pv.h" >> +#include >> >> S390CPU *s390_cpu_addr2state(uint16_t cpu_addr) >> { >> @@ -238,9 +240,11 @@ static void s390_create_sclpconsole(const char *type, Chardev *chardev) >> static void ccw_init(MachineState *machine) >> { >> int ret; >> + S390CcwMachineState *ms = S390_CCW_MACHINE(machine); >> VirtualCssBus *css_bus; >> DeviceState *dev; >> >> + ms->pv = false; > > Should not be necessary, default is false. ok > >> s390_sclp_init(); >> /* init memory + setup max page size. Required for the CPU model */ >> s390_memory_init(machine->ram); >> @@ -316,10 +320,75 @@ static inline void s390_do_cpu_ipl(CPUState *cs, run_on_cpu_data arg) >> s390_cpu_set_state(S390_CPU_STATE_OPERATING, cpu); >> } >> >> +static void s390_machine_unprotect(S390CcwMachineState *ms) >> +{ >> + CPUState *t; >> + >> + if (!ms->pv) >> + return; > > How can this ever happen? g_assert(ms->pv) ? Currently not, that's only used in the follow up patches with the ballon and migration blocker > > Also, i don't see this function getting called from anywhere else except > when s390_machine_protect() fails. That looks wrong. This has to be > called when going out of PV mode. Yes, but that's in the diag308 1-4 patch. > > >> + s390_pv_vm_disable(); >> + CPU_FOREACH(t) { >> + S390_CPU(t)->env.pv = false; >> + } >> + ms->pv = false; >> +} >> + >> +static int s390_machine_protect(S390CcwMachineState *ms) >> +{ >> + CPUState *t; >> + int rc; >> + > > g_assert(!ms->pv) ? Ok > >> + /* Create SE VM */ >> + rc = s390_pv_vm_enable(); >> + if (rc) { >> + return rc; >> + } >> + >> + CPU_FOREACH(t) { >> + S390_CPU(t)->env.pv = true; >> + } >> + ms->pv = true; >> + >> + /* Set SE header and unpack */ >> + rc = s390_ipl_prepare_pv_header(); >> + if (rc) { >> + goto out_err; >> + } >> + >> + /* Decrypt image */ >> + rc = s390_ipl_pv_unpack(); >> + if (rc) { >> + goto out_err; >> + } >> + >> + /* Verify integrity */ >> + rc = s390_pv_verify(); >> + if (rc) { >> + goto out_err; >> + } >> + return rc; >> + >> +out_err: >> + s390_machine_unprotect(ms); >> + return rc; >> +} >> + >> +#define DIAG_308_RC_INVAL_FOR_PV 0x0a02 >> +static void s390_machine_inject_pv_error(CPUState *cs) >> +{ >> + int r1 = (cs->kvm_run->s390_sieic.ipa & 0x00f0) >> 4; >> + CPUS390XState *env = &S390_CPU(cs)->env; >> + >> + /* Report that we are unable to enter protected mode */ >> + env->regs[r1 + 1] = DIAG_308_RC_INVAL_FOR_PV; >> +} >> + > > [...] >> switch (reset_type) { >> case S390_RESET_EXTERNAL: >> case S390_RESET_REIPL: >> @@ -353,6 +424,26 @@ static void s390_machine_reset(MachineState *machine) >> } >> subsystem_reset(); >> run_on_cpu(cs, s390_do_cpu_initial_reset, RUN_ON_CPU_NULL); >> + run_on_cpu(cs, s390_do_cpu_load_normal, RUN_ON_CPU_NULL); > > This does look unrelated and wrong? Indeed, that looks dodgy > >> + break; >> + case S390_RESET_PV: /* Subcode 10 */ >> + subsystem_reset(); >> + s390_crypto_reset(); >> + >> + CPU_FOREACH(t) { >> + if (t == cs) { >> + continue; >> + } >> + run_on_cpu(t, s390_do_cpu_full_reset, RUN_ON_CPU_NULL); >> + } >> + run_on_cpu(cs, s390_do_cpu_reset, RUN_ON_CPU_NULL); >> + >> + if (s390_machine_protect(ms)) { >> + s390_machine_inject_pv_error(cs); > > Ah, so it's not an actual exception. BUT: All other guest cpus were > reset, can the guest deal with that? Well, all other CPUs should be stopped for diag308, no? Also it's done by the bootloader and not a OS which just stops its cpus and goes into protected mode. > > (run_on_cpu(cs, s390_do_cpu_reset, RUN_ON_CPU_NULL) should go after the > s390_machine_protect() I assume - the change you had in the other patch) That's not a good idea, I want to reset before we automatically call the UV routines on a reset. > >> + s390_cpu_set_state(S390_CPU_STATE_OPERATING, cpu); >> + return; >> + } >> + >> run_on_cpu(cs, s390_do_cpu_load_normal, RUN_ON_CPU_NULL); >> break; >> default: > >