| Message ID | 20191024114059.102802-22-frankja@linux.ibm.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | KVM: s390: Add support for protected VMs | expand |
On Thu, 24 Oct 2019 07:40:43 -0400 Janosch Frank <frankja@linux.ibm.com> wrote: > We have two new SIE exit codes 104 for a secure instruction > interception, on which the SIE needs hypervisor action to complete the > instruction. > > And 108 which is merely a notification and provides data for tracking > and management, like for the lowcore we set notification bits for the > lowcore pages. What about the following: "With protected virtualization, we have two new SIE exit codes: - 104 indicates a secure instruction interception; the hypervisor needs to complete emulation of the instruction. - 108 is merely a notification providing data for tracking and management in the hypervisor; for example, we set notification bits for the lowcore pages." ? > > Signed-off-by: Janosch Frank <frankja@linux.ibm.com> > --- > arch/s390/include/asm/kvm_host.h | 2 ++ > arch/s390/kvm/intercept.c | 23 +++++++++++++++++++++++ > 2 files changed, 25 insertions(+) > > diff --git a/arch/s390/include/asm/kvm_host.h b/arch/s390/include/asm/kvm_host.h > index 2a8a1e21e1c3..a42dfe98128b 100644 > --- a/arch/s390/include/asm/kvm_host.h > +++ b/arch/s390/include/asm/kvm_host.h > @@ -212,6 +212,8 @@ struct kvm_s390_sie_block { > #define ICPT_KSS 0x5c > #define ICPT_PV_MCHKR 0x60 > #define ICPT_PV_INT_EN 0x64 > +#define ICPT_PV_INSTR 0x68 > +#define ICPT_PV_NOT 0x6c Maybe ICPT_PV_NOTIF? > __u8 icptcode; /* 0x0050 */ > __u8 icptstatus; /* 0x0051 */ > __u16 ihcpu; /* 0x0052 */ > diff --git a/arch/s390/kvm/intercept.c b/arch/s390/kvm/intercept.c > index b013a9c88d43..a1df8a43c88b 100644 > --- a/arch/s390/kvm/intercept.c > +++ b/arch/s390/kvm/intercept.c > @@ -451,6 +451,23 @@ static int handle_operexc(struct kvm_vcpu *vcpu) > return kvm_s390_inject_program_int(vcpu, PGM_OPERATION); > } > > +static int handle_pv_spx(struct kvm_vcpu *vcpu) > +{ > + u32 pref = *(u32 *)vcpu->arch.sie_block->sidad; > + > + kvm_s390_set_prefix(vcpu, pref); > + trace_kvm_s390_handle_prefix(vcpu, 1, pref); > + return 0; > +} > + > +static int handle_pv_not(struct kvm_vcpu *vcpu) > +{ > + if (vcpu->arch.sie_block->ipa == 0xb210) > + return handle_pv_spx(vcpu); > + > + return handle_instruction(vcpu); Hm... if I understood it correctly, we are getting this one because the SIE informs us about things that it handled itself (but which we should be aware of). What can handle_instruction() do in this case? > +} > + > int kvm_handle_sie_intercept(struct kvm_vcpu *vcpu) > { > int rc, per_rc = 0; > @@ -505,6 +522,12 @@ int kvm_handle_sie_intercept(struct kvm_vcpu *vcpu) > */ > rc = 0; > break; > + case ICPT_PV_INSTR: > + rc = handle_instruction(vcpu); > + break; > + case ICPT_PV_NOT: > + rc = handle_pv_not(vcpu); > + break; > default: > return -EOPNOTSUPP; > }
On 11/14/19 4:38 PM, Cornelia Huck wrote: > On Thu, 24 Oct 2019 07:40:43 -0400 > Janosch Frank <frankja@linux.ibm.com> wrote: > >> We have two new SIE exit codes 104 for a secure instruction >> interception, on which the SIE needs hypervisor action to complete the >> instruction. >> >> And 108 which is merely a notification and provides data for tracking >> and management, like for the lowcore we set notification bits for the >> lowcore pages. > > What about the following: > > "With protected virtualization, we have two new SIE exit codes: > > - 104 indicates a secure instruction interception; the hypervisor needs > to complete emulation of the instruction. > - 108 is merely a notification providing data for tracking and > management in the hypervisor; for example, we set notification bits > for the lowcore pages." > > ? > >> >> Signed-off-by: Janosch Frank <frankja@linux.ibm.com> >> --- >> arch/s390/include/asm/kvm_host.h | 2 ++ >> arch/s390/kvm/intercept.c | 23 +++++++++++++++++++++++ >> 2 files changed, 25 insertions(+) >> >> diff --git a/arch/s390/include/asm/kvm_host.h b/arch/s390/include/asm/kvm_host.h >> index 2a8a1e21e1c3..a42dfe98128b 100644 >> --- a/arch/s390/include/asm/kvm_host.h >> +++ b/arch/s390/include/asm/kvm_host.h >> @@ -212,6 +212,8 @@ struct kvm_s390_sie_block { >> #define ICPT_KSS 0x5c >> #define ICPT_PV_MCHKR 0x60 >> #define ICPT_PV_INT_EN 0x64 >> +#define ICPT_PV_INSTR 0x68 >> +#define ICPT_PV_NOT 0x6c > > Maybe ICPT_PV_NOTIF? NOTF? > >> __u8 icptcode; /* 0x0050 */ >> __u8 icptstatus; /* 0x0051 */ >> __u16 ihcpu; /* 0x0052 */ >> diff --git a/arch/s390/kvm/intercept.c b/arch/s390/kvm/intercept.c >> index b013a9c88d43..a1df8a43c88b 100644 >> --- a/arch/s390/kvm/intercept.c >> +++ b/arch/s390/kvm/intercept.c >> @@ -451,6 +451,23 @@ static int handle_operexc(struct kvm_vcpu *vcpu) >> return kvm_s390_inject_program_int(vcpu, PGM_OPERATION); >> } >> >> +static int handle_pv_spx(struct kvm_vcpu *vcpu) >> +{ >> + u32 pref = *(u32 *)vcpu->arch.sie_block->sidad; >> + >> + kvm_s390_set_prefix(vcpu, pref); >> + trace_kvm_s390_handle_prefix(vcpu, 1, pref); >> + return 0; >> +} >> + >> +static int handle_pv_not(struct kvm_vcpu *vcpu) >> +{ >> + if (vcpu->arch.sie_block->ipa == 0xb210) >> + return handle_pv_spx(vcpu); >> + >> + return handle_instruction(vcpu); > > Hm... if I understood it correctly, we are getting this one because the > SIE informs us about things that it handled itself (but which we > should be aware of). What can handle_instruction() do in this case? There used to be an instruction which I could just pipe through normal instruction handling. But I can't really remember what it was, too many firmware changes in that area since then. I'll mark it as a TODO for thinking about it with some coffee. > >> +} >> + >> int kvm_handle_sie_intercept(struct kvm_vcpu *vcpu) >> { >> int rc, per_rc = 0; >> @@ -505,6 +522,12 @@ int kvm_handle_sie_intercept(struct kvm_vcpu *vcpu) >> */ >> rc = 0; >> break; >> + case ICPT_PV_INSTR: >> + rc = handle_instruction(vcpu); >> + break; >> + case ICPT_PV_NOT: >> + rc = handle_pv_not(vcpu); >> + break; >> default: >> return -EOPNOTSUPP; >> } >
On Thu, 14 Nov 2019 17:00:41 +0100 Janosch Frank <frankja@linux.ibm.com> wrote: > On 11/14/19 4:38 PM, Cornelia Huck wrote: > > On Thu, 24 Oct 2019 07:40:43 -0400 > > Janosch Frank <frankja@linux.ibm.com> wrote: > > > >> We have two new SIE exit codes 104 for a secure instruction > >> interception, on which the SIE needs hypervisor action to complete the > >> instruction. > >> > >> And 108 which is merely a notification and provides data for tracking > >> and management, like for the lowcore we set notification bits for the > >> lowcore pages. > > > > What about the following: > > > > "With protected virtualization, we have two new SIE exit codes: > > > > - 104 indicates a secure instruction interception; the hypervisor needs > > to complete emulation of the instruction. > > - 108 is merely a notification providing data for tracking and > > management in the hypervisor; for example, we set notification bits > > for the lowcore pages." > > > > ? > > > >> > >> Signed-off-by: Janosch Frank <frankja@linux.ibm.com> > >> --- > >> arch/s390/include/asm/kvm_host.h | 2 ++ > >> arch/s390/kvm/intercept.c | 23 +++++++++++++++++++++++ > >> 2 files changed, 25 insertions(+) > >> > >> diff --git a/arch/s390/include/asm/kvm_host.h b/arch/s390/include/asm/kvm_host.h > >> index 2a8a1e21e1c3..a42dfe98128b 100644 > >> --- a/arch/s390/include/asm/kvm_host.h > >> +++ b/arch/s390/include/asm/kvm_host.h > >> @@ -212,6 +212,8 @@ struct kvm_s390_sie_block { > >> #define ICPT_KSS 0x5c > >> #define ICPT_PV_MCHKR 0x60 > >> #define ICPT_PV_INT_EN 0x64 > >> +#define ICPT_PV_INSTR 0x68 > >> +#define ICPT_PV_NOT 0x6c > > > > Maybe ICPT_PV_NOTIF? > > NOTF? Sounds good. > > > > >> __u8 icptcode; /* 0x0050 */ > >> __u8 icptstatus; /* 0x0051 */ > >> __u16 ihcpu; /* 0x0052 */ > >> diff --git a/arch/s390/kvm/intercept.c b/arch/s390/kvm/intercept.c > >> index b013a9c88d43..a1df8a43c88b 100644 > >> --- a/arch/s390/kvm/intercept.c > >> +++ b/arch/s390/kvm/intercept.c > >> @@ -451,6 +451,23 @@ static int handle_operexc(struct kvm_vcpu *vcpu) > >> return kvm_s390_inject_program_int(vcpu, PGM_OPERATION); > >> } > >> > >> +static int handle_pv_spx(struct kvm_vcpu *vcpu) > >> +{ > >> + u32 pref = *(u32 *)vcpu->arch.sie_block->sidad; > >> + > >> + kvm_s390_set_prefix(vcpu, pref); > >> + trace_kvm_s390_handle_prefix(vcpu, 1, pref); > >> + return 0; > >> +} > >> + > >> +static int handle_pv_not(struct kvm_vcpu *vcpu) > >> +{ > >> + if (vcpu->arch.sie_block->ipa == 0xb210) > >> + return handle_pv_spx(vcpu); > >> + > >> + return handle_instruction(vcpu); > > > > Hm... if I understood it correctly, we are getting this one because the > > SIE informs us about things that it handled itself (but which we > > should be aware of). What can handle_instruction() do in this case? > > There used to be an instruction which I could just pipe through normal > instruction handling. But I can't really remember what it was, too many > firmware changes in that area since then. > > I'll mark it as a TODO for thinking about it with some coffee. ok :) > > > > >> +} > >> + > >> int kvm_handle_sie_intercept(struct kvm_vcpu *vcpu) > >> { > >> int rc, per_rc = 0; > >> @@ -505,6 +522,12 @@ int kvm_handle_sie_intercept(struct kvm_vcpu *vcpu) > >> */ > >> rc = 0; > >> break; > >> + case ICPT_PV_INSTR: > >> + rc = handle_instruction(vcpu); > >> + break; > >> + case ICPT_PV_NOT: > >> + rc = handle_pv_not(vcpu); > >> + break; > >> default: > >> return -EOPNOTSUPP; > >> } > > > >
diff --git a/arch/s390/include/asm/kvm_host.h b/arch/s390/include/asm/kvm_host.h index 2a8a1e21e1c3..a42dfe98128b 100644 --- a/arch/s390/include/asm/kvm_host.h +++ b/arch/s390/include/asm/kvm_host.h @@ -212,6 +212,8 @@ struct kvm_s390_sie_block { #define ICPT_KSS 0x5c #define ICPT_PV_MCHKR 0x60 #define ICPT_PV_INT_EN 0x64 +#define ICPT_PV_INSTR 0x68 +#define ICPT_PV_NOT 0x6c __u8 icptcode; /* 0x0050 */ __u8 icptstatus; /* 0x0051 */ __u16 ihcpu; /* 0x0052 */ diff --git a/arch/s390/kvm/intercept.c b/arch/s390/kvm/intercept.c index b013a9c88d43..a1df8a43c88b 100644 --- a/arch/s390/kvm/intercept.c +++ b/arch/s390/kvm/intercept.c @@ -451,6 +451,23 @@ static int handle_operexc(struct kvm_vcpu *vcpu) return kvm_s390_inject_program_int(vcpu, PGM_OPERATION); } +static int handle_pv_spx(struct kvm_vcpu *vcpu) +{ + u32 pref = *(u32 *)vcpu->arch.sie_block->sidad; + + kvm_s390_set_prefix(vcpu, pref); + trace_kvm_s390_handle_prefix(vcpu, 1, pref); + return 0; +} + +static int handle_pv_not(struct kvm_vcpu *vcpu) +{ + if (vcpu->arch.sie_block->ipa == 0xb210) + return handle_pv_spx(vcpu); + + return handle_instruction(vcpu); +} + int kvm_handle_sie_intercept(struct kvm_vcpu *vcpu) { int rc, per_rc = 0; @@ -505,6 +522,12 @@ int kvm_handle_sie_intercept(struct kvm_vcpu *vcpu) */ rc = 0; break; + case ICPT_PV_INSTR: + rc = handle_instruction(vcpu); + break; + case ICPT_PV_NOT: + rc = handle_pv_not(vcpu); + break; default: return -EOPNOTSUPP; }
We have two new SIE exit codes 104 for a secure instruction interception, on which the SIE needs hypervisor action to complete the instruction. And 108 which is merely a notification and provides data for tracking and management, like for the lowcore we set notification bits for the lowcore pages. Signed-off-by: Janosch Frank <frankja@linux.ibm.com> --- arch/s390/include/asm/kvm_host.h | 2 ++ arch/s390/kvm/intercept.c | 23 +++++++++++++++++++++++ 2 files changed, 25 insertions(+)