lkml.org 
[lkml]   [2018]   [Apr]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Subject[PATCH v4 00/15] s390: vfio-ap: guest dedicated crypto adapters
    Date
    On s390, we have cryptographic coprocessor cards, which are modeled on
    Linux as devices on the AP bus. Each card can be partitioned into domains
    which can be thought of as a set of hardware registers for processing
    crypto commands. Crypto commands are sent to a specific domain within a
    card is via a queue which is identified as a (card,domain) tuple. We model
    this something like the following (assuming we have access to cards 3 and
    4 and domains 1 and 2):

    AP -> card3 -> queue (3,1)
    -> queue (3,2)
    -> card4 -> queue (4,1)
    -> queue (4,2)

    If we want to virtualize this, we can use a feature provided by the
    hardware. We basically attach a satellite control block to our main
    hardware virtualization control block and the hardware takes care of
    most of the rest.

    For this control block, we don't specify explicit tuples, but a list of
    cards and a list of domains. The guest will get access to the cross
    product.

    Because of this, we need to take care that the lists provided to
    different guests don't overlap; i.e., we need to enforce sane
    configurations. Otherwise, one guest may get access to things like
    secret keys for another guest.

    The idea of this patch set is to introduce a new device, the matrix
    device. This matrix device hangs off a different root and acts as the
    parent node for mdev devices.

    If you now want to give the tuples (4,1) and (4,2), you need to do the
    following:

    - Unbind the (4,1) and (4,2) tuples from their ap bus driver.
    - Bind the (4,1) and (4,2) tuples to the vfio_ap driver.
    - Create the mediated device.
    - Assign card 4 and domains 1 and 2 to the mediated device

    QEMU will now simply consume the mediated device and things should work.

    For a complete description of the architecture and concepts underlying the
    design, see the Documentation/s390/vfio-ap.txt file included with this
    patch set.

    Change log v3 -> v4
    ===================
    * Resolved issue with enabling ZCRYPT when KVM is enabled by using
    #ifdef ZCRYPT in relevant functions
    * Added patch with a new function for resetting the crypto attributes
    for all vcpus to resolve the issue raised with running vcpus getting out
    of sync.
    * Removed KVM_S390_VM_CRYPTO_INTERPRET_AP: Setting interpretive exec mode
    from vfio_ap driver when mdev device is opened.


    Tony Krowiak (15):
    s390: zcrypt: externalize AP instructions available function
    KVM: s390: reset crypto attributes for all vcpus
    KVM: s390: refactor crypto initialization
    KVM: s390: CPU model support for AP virtualization
    KVM: s390: enable/disable AP interpretive execution
    s390: vfio-ap: base implementation of VFIO AP device driver
    s390: vfio-ap: register matrix device with VFIO mdev framework
    KVM: s390: interfaces to (de)configure guest's AP matrix
    s390: vfio-ap: sysfs interfaces to configure adapters
    s390: vfio-ap: sysfs interfaces to configure domains
    s390: vfio-ap: sysfs interfaces to configure control domains
    s390: vfio-ap: sysfs interface to view matrix mdev matrix
    KVM: s390: configure the guest's AP devices
    s390: vfio-ap: implement VFIO_DEVICE_GET_INFO ioctl
    s390: doc: detailed specifications for AP virtualization

    Documentation/s390/vfio-ap.txt | 567 +++++++++++++++++++++
    MAINTAINERS | 12 +
    arch/s390/Kconfig | 11 +
    arch/s390/include/asm/ap.h | 7 +
    arch/s390/include/asm/kvm-ap.h | 136 +++++
    arch/s390/include/asm/kvm_host.h | 3 +
    arch/s390/include/uapi/asm/kvm.h | 1 +
    arch/s390/kvm/Makefile | 2 +-
    arch/s390/kvm/kvm-ap.c | 339 +++++++++++++
    arch/s390/kvm/kvm-s390.c | 93 ++---
    arch/s390/kvm/kvm-s390.h | 14 +
    arch/s390/tools/gen_facilities.c | 2 +
    drivers/s390/crypto/Makefile | 4 +
    drivers/s390/crypto/ap_bus.c | 6 +
    drivers/s390/crypto/vfio_ap_drv.c | 143 ++++++
    drivers/s390/crypto/vfio_ap_ops.c | 873 +++++++++++++++++++++++++++++++++
    drivers/s390/crypto/vfio_ap_private.h | 46 ++
    include/uapi/linux/vfio.h | 2 +
    18 files changed, 2200 insertions(+), 61 deletions(-)
    create mode 100644 Documentation/s390/vfio-ap.txt
    create mode 100644 arch/s390/include/asm/kvm-ap.h
    create mode 100644 arch/s390/kvm/kvm-ap.c
    create mode 100644 drivers/s390/crypto/vfio_ap_drv.c
    create mode 100644 drivers/s390/crypto/vfio_ap_ops.c
    create mode 100644 drivers/s390/crypto/vfio_ap_private.h

    \
     
     \ /
      Last update: 2018-04-15 23:27    [W:5.408 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site