From: Tony Krowiak <akrowiak@linux.vnet.ibm.com>
To: linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org,
kvm@vger.kernel.org
Cc: freude@de.ibm.com, schwidefsky@de.ibm.com,
heiko.carstens@de.ibm.com, borntraeger@de.ibm.com,
cohuck@redhat.com, kwankhede@nvidia.com,
bjsdjshi@linux.vnet.ibm.com, pbonzini@redhat.com,
alex.williamson@redhat.com, pmorel@linux.vnet.ibm.com,
alifm@linux.vnet.ibm.com, mjrosato@linux.vnet.ibm.com,
jjherne@linux.vnet.ibm.com, thuth@redhat.com,
pasic@linux.vnet.ibm.com, berrange@redhat.com,
fiuczy@linux.vnet.ibm.com, buendgen@de.ibm.com,
akrowiak@linux.vnet.ibm.com
Subject: [PATCH v3 00/14] s390: vfio-ap: guest dedicated crypto adapters
Date: Wed, 14 Mar 2018 14:25:40 -0400 [thread overview]
Message-ID: <1521051954-25715-1-git-send-email-akrowiak@linux.vnet.ibm.com> (raw)
On s390, we have cryptographic coprocessor cards, which are modeled on
Linux as devices on the AP bus. Each card can be partitioned into domains
which can be thought of as a set of hardware registers for processing
crypto commands. Crypto commands are sent to a specific domain within a
card is via a queue which is identified as a (card,domain) tuple. We model
this something like the following (assuming we have access to cards 3 and
4 and domains 1 and 2):
AP -> card3 -> queue (3,1)
-> queue (3,2)
-> card4 -> queue (4,1)
-> queue (4,2)
If we want to virtualize this, we can use a feature provided by the
hardware. We basically attach a satellite control block to our main
hardware virtualization control block and the hardware takes care of
most of the rest.
For this control block, we don't specify explicit tuples, but a list of
cards and a list of domains. The guest will get access to the cross
product.
Because of this, we need to take care that the lists provided to
different guests don't overlap; i.e., we need to enforce sane
configurations. Otherwise, one guest may get access to things like
secret keys for another guest.
The idea of this patch set is to introduce a new device, the matrix
device. This matrix device hangs off a different root and acts as the
parent node for mdev devices.
If you now want to give the tuples (4,1) and (4,2), you need to do the
following:
- Unbind the (4,1) and (4,2) tuples from their ap bus driver.
- Bind the (4,1) and (4,2) tuples to the vfio_ap driver.
- Create the mediated device.
- Assign card 4 and domains 1 and 2 to the mediated device
QEMU will now simply consume the mediated device and things should work.
For a complete description of the architecture and concepts underlying the
design, see the Documentation/s390/vfio-ap.txt file included with this
patch set.
v2 => v3 Change log:
===================
* Set APIE in VCPU setup function
* Renamed patch 13/15:
KVM: s390: Configure the guest's CRYCB
KVM: s390: Configure the guest's AP devices
* Fixed problem with building arch/s390/kvm/kvm-ap.c when CONFIG_ZCRYPT
not selected
* Removed patch introducing VSIE support for AP pending further
investigation
* Initialized AP maximum mask sizes - i.e., APM, AQM and ADM - from info
returned from PQAP(QCI) function
* Introduced a new device attribute to the KVM_S390_VM_CRYPTO attribute
group for setting a flag via the KVM_SET_DEVICE_ATTR ioctl to indicate
whether ECA_APIE should be set or not. The flag is used in the
kvm_s390_vcpu_crypto_setup() function to set ECA_APIE in the SIE block.
* Misc. formatting etc.
Tony Krowiak (14):
KVM: s390: refactor crypto initialization
s390: zcrypt: externalize AP instructions available function
KVM: s390: CPU model support for AP virtualization
KVM: s390: device attribute to set AP interpretive execution
s390: vfio-ap: base implementation of VFIO AP device driver
s390: vfio-ap: register matrix device with VFIO mdev framework
KVM: s390: interfaces to configure/deconfigure guest's AP matrix
s390: vfio-ap: sysfs interfaces to configure adapters
s390: vfio-ap: sysfs interfaces to configure domains
s390: vfio-ap: sysfs interfaces to configure control domains
s390: vfio-ap: sysfs interface to view matrix mdev matrix
KVM: s390: configure the guest's AP devices
s390: vfio-ap: implement VFIO_DEVICE_GET_INFO ioctl
s390: doc: detailed specifications for AP virtualization
Documentation/s390/vfio-ap.txt | 560 +++++++++++++++++++++
MAINTAINERS | 14 +
arch/s390/Kconfig | 11 +
arch/s390/include/asm/ap.h | 7 +
arch/s390/include/asm/kvm-ap.h | 57 +++
arch/s390/include/asm/kvm_host.h | 3 +
arch/s390/include/uapi/asm/kvm.h | 2 +
arch/s390/kvm/Kconfig | 1 +
arch/s390/kvm/Makefile | 2 +-
arch/s390/kvm/kvm-ap.c | 330 +++++++++++++
arch/s390/kvm/kvm-s390.c | 84 ++--
arch/s390/tools/gen_facilities.c | 2 +
drivers/s390/crypto/Makefile | 4 +
drivers/s390/crypto/ap_bus.c | 6 +
drivers/s390/crypto/vfio_ap_drv.c | 144 ++++++
drivers/s390/crypto/vfio_ap_ops.c | 872 +++++++++++++++++++++++++++++++++
drivers/s390/crypto/vfio_ap_private.h | 47 ++
include/uapi/linux/vfio.h | 2 +
18 files changed, 2093 insertions(+), 55 deletions(-)
create mode 100644 Documentation/s390/vfio-ap.txt
create mode 100644 arch/s390/include/asm/kvm-ap.h
create mode 100644 arch/s390/kvm/kvm-ap.c
create mode 100644 drivers/s390/crypto/vfio_ap_drv.c
create mode 100644 drivers/s390/crypto/vfio_ap_ops.c
create mode 100644 drivers/s390/crypto/vfio_ap_private.h
next reply other threads:[~2018-03-14 18:26 UTC|newest]
Thread overview: 62+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-03-14 18:25 Tony Krowiak [this message]
2018-03-14 18:25 ` [PATCH v3 01/14] KVM: s390: refactor crypto initialization Tony Krowiak
2018-03-15 12:26 ` Pierre Morel
2018-03-15 14:48 ` Tony Krowiak
2018-03-15 14:55 ` Pierre Morel
2018-03-26 8:44 ` Cornelia Huck
2018-03-29 18:57 ` Tony Krowiak
2018-04-03 11:26 ` Cornelia Huck
2018-04-05 10:42 ` Christian Borntraeger
2018-04-05 10:45 ` Christian Borntraeger
2018-04-05 13:16 ` Tony Krowiak
2018-03-14 18:25 ` [PATCH v3 02/14] s390: zcrypt: externalize AP instructions available function Tony Krowiak
2018-03-14 18:25 ` [PATCH v3 03/14] KVM: s390: CPU model support for AP virtualization Tony Krowiak
2018-03-27 10:59 ` Cornelia Huck
2018-03-27 11:22 ` Pierre Morel
2018-03-27 11:30 ` Cornelia Huck
2018-03-14 18:25 ` [PATCH v3 04/14] KVM: s390: device attribute to set AP interpretive execution Tony Krowiak
2018-03-14 21:57 ` Halil Pasic
2018-03-15 13:00 ` Pierre Morel
2018-03-15 15:26 ` Tony Krowiak
2018-03-15 15:45 ` Pierre Morel
2018-03-15 17:21 ` Tony Krowiak
2018-03-15 17:56 ` Pierre Morel
2018-03-15 23:39 ` Tony Krowiak
2018-03-16 7:51 ` Pierre Morel
2018-03-16 16:09 ` Tony Krowiak
2018-03-20 17:58 ` Tony Krowiak
2018-03-20 22:48 ` Halil Pasic
2018-04-02 18:55 ` Tony Krowiak
2018-03-15 15:23 ` Tony Krowiak
2018-03-15 16:00 ` Pierre Morel
2018-03-15 23:37 ` Tony Krowiak
2018-03-15 16:25 ` Halil Pasic
2018-03-14 18:25 ` [PATCH v3 05/14] s390: vfio-ap: base implementation of VFIO AP device driver Tony Krowiak
2018-03-15 13:25 ` Pierre Morel
2018-03-15 17:25 ` Tony Krowiak
2018-03-27 11:17 ` Cornelia Huck
2018-03-27 14:45 ` Pierre Morel
2018-04-03 9:56 ` Cornelia Huck
2018-04-03 10:57 ` Cornelia Huck
2018-04-03 13:02 ` Tony Krowiak
2018-03-14 18:25 ` [PATCH v3 06/14] s390: vfio-ap: register matrix device with VFIO mdev framework Tony Krowiak
2018-03-14 18:25 ` [PATCH v3 07/14] KVM: s390: interfaces to configure/deconfigure guest's AP matrix Tony Krowiak
2018-04-03 11:07 ` Cornelia Huck
2018-04-03 13:17 ` Tony Krowiak
2018-04-03 13:38 ` Cornelia Huck
2018-03-14 18:25 ` [PATCH v3 08/14] s390: vfio-ap: sysfs interfaces to configure adapters Tony Krowiak
2018-04-03 11:10 ` Cornelia Huck
2018-04-03 13:33 ` Tony Krowiak
2018-03-14 18:25 ` [PATCH v3 09/14] s390: vfio-ap: sysfs interfaces to configure domains Tony Krowiak
2018-04-03 11:17 ` Cornelia Huck
[not found] ` <1860430c-df59-6d58-77f9-b36c51595b4b@linux.vnet.ibm.com>
2018-04-03 15:19 ` Cornelia Huck
2018-04-03 15:42 ` Tony Krowiak
2018-03-14 18:25 ` [PATCH v3 10/14] s390: vfio-ap: sysfs interfaces to configure control domains Tony Krowiak
2018-03-14 18:25 ` [PATCH v3 11/14] s390: vfio-ap: sysfs interface to view matrix mdev matrix Tony Krowiak
2018-03-15 9:42 ` Pierre Morel
2018-03-15 14:52 ` Tony Krowiak
2018-03-15 15:35 ` Pierre Morel
2018-03-27 11:19 ` Cornelia Huck
2018-03-14 18:25 ` [PATCH v3 12/14] KVM: s390: configure the guest's AP devices Tony Krowiak
2018-03-14 18:25 ` [PATCH v3 13/14] s390: vfio-ap: implement VFIO_DEVICE_GET_INFO ioctl Tony Krowiak
2018-03-14 18:25 ` [PATCH v3 14/14] s390: doc: detailed specifications for AP virtualization Tony Krowiak
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1521051954-25715-1-git-send-email-akrowiak@linux.vnet.ibm.com \
--to=akrowiak@linux.vnet.ibm.com \
--cc=alex.williamson@redhat.com \
--cc=alifm@linux.vnet.ibm.com \
--cc=berrange@redhat.com \
--cc=bjsdjshi@linux.vnet.ibm.com \
--cc=borntraeger@de.ibm.com \
--cc=buendgen@de.ibm.com \
--cc=cohuck@redhat.com \
--cc=fiuczy@linux.vnet.ibm.com \
--cc=freude@de.ibm.com \
--cc=heiko.carstens@de.ibm.com \
--cc=jjherne@linux.vnet.ibm.com \
--cc=kvm@vger.kernel.org \
--cc=kwankhede@nvidia.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-s390@vger.kernel.org \
--cc=mjrosato@linux.vnet.ibm.com \
--cc=pasic@linux.vnet.ibm.com \
--cc=pbonzini@redhat.com \
--cc=pmorel@linux.vnet.ibm.com \
--cc=schwidefsky@de.ibm.com \
--cc=thuth@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).