IBM Secure Execution guests may want to inject secrets into the Ultravisor(UV).
Also they should be able to know which secrets the UV possesses and prevent the
further addition of more secrets.
Therefore, add three new Ultravisor-Calls and expose them via the uvdevice: Add
Secret, List Secrets, and Lock Secrets. The uvdevice still acts as the
messenger only and does not inspect or modify the requests. Only some sanity
checks are made to prevent the kernel from corruption.
Also add a new IOCTL to get information about the supported UV-calls of the
uvdevice. As userspace wants to know which secrets, types, etc. are supported
expose the corresponding UV Query info data to userspace via sysfs.
The series contains:
* A patch to export uv_info unconditionally
* A new info IOCTL, giving information about the capabilities of the uvdevice and UV
* 3 patches adding new Ultravisor-Calls and expose them to userspace
* A patch replacing scnprintf with sysfs_emit in arch/s390/kernel/uv.c
* A patch with an Ultravisor Query Info update for the new secret related information
Changes for v5:
* fix Kconfig for uvdevice
* add PATCH to always export `uv_info`
* fix oopsie
see diff below
Changes for v4:
* more nits from Janosch
Changes for v3:
* misc nits from Janosch
Changes for v2:
* use __set_bit instead of the atomic set_bit (Heiko)
* add a patch for replacing scnprintf with sysfs_emit in arch/s390/kernel/uv.c (Heiko)
* use scnprintf instead of sysfs_emit for the new sysfs entries in the last patch (Heiko)
* use hex values in struct definitions (Claudio)
Steffen
DIFF v4->v5
diff --git a/arch/s390/boot/uv.c b/arch/s390/boot/uv.c
index cdffc395f1cd..1e66d2cbb096 100644
--- a/arch/s390/boot/uv.c
+++ b/arch/s390/boot/uv.c
@@ -50,7 +50,7 @@ void uv_query_info(void)
uv_info.supp_add_secret_req_ver = uvcb.supp_add_secret_req_ver;
uv_info.supp_add_secret_pcf = uvcb.supp_add_secret_pcf;
uv_info.supp_secret_types = uvcb.supp_secret_types;
- uv_info.max_secrets = uvcb.max_secrets
+ uv_info.max_secrets = uvcb.max_secrets;
}
#ifdef CONFIG_PROTECTED_VIRTUALIZATION_GUEST
diff --git a/arch/s390/kernel/uv.c b/arch/s390/kernel/uv.c
index 0687fc0360fe..6a0153289ace 100644
--- a/arch/s390/kernel/uv.c
+++ b/arch/s390/kernel/uv.c
@@ -23,12 +23,20 @@
int __bootdata_preserved(prot_virt_guest);
#endif
+/*
+ * uv_info contains both host and guest information but it's currently only
+ * expected to be used within modules if it's the KVM module or for
+ * any PV guest module.
+ *
+ * The kernel itself will write these values once in uv_query_info()
+ * and then make some of them readable via a sysfs interface.
+ */
struct uv_info __bootdata_preserved(uv_info);
+EXPORT_SYMBOL(uv_info);
#if IS_ENABLED(CONFIG_KVM)
int __bootdata_preserved(prot_virt_host);
EXPORT_SYMBOL(prot_virt_host);
-EXPORT_SYMBOL(uv_info);
static int __init uv_init(phys_addr_t stor_base, unsigned long stor_len)
{
diff --git a/drivers/s390/char/Kconfig b/drivers/s390/char/Kconfig
index 80c4e5101c97..8a03af5ee5b3 100644
--- a/drivers/s390/char/Kconfig
+++ b/drivers/s390/char/Kconfig
@@ -96,7 +96,7 @@ config SCLP_OFB
config S390_UV_UAPI
def_tristate m
prompt "Ultravisor userspace API"
- depends on S390
+ depends on S390 && (KVM || PROTECTED_VIRTUALIZATION_GUEST)
help
Selecting exposes parts of the UV interface to userspace
by providing a misc character device at /dev/uv.
diff --git a/drivers/s390/char/uvdevice.c b/drivers/s390/char/uvdevice.c
index 79f694e04ac4..144cd2e03590 100644
--- a/drivers/s390/char/uvdevice.c
+++ b/drivers/s390/char/uvdevice.c
@@ -78,7 +78,7 @@ static int uvio_uvdev_info(struct uvio_ioctl_cb *uv_ioctl)
return -EFAULT;
uv_ioctl->uv_rc = UVC_RC_EXECUTED;
- return 0;
+ return 0;
}
static int uvio_build_uvcb_attest(struct uv_cb_attest *uvcb_attest, u8 *arcb,
END DIFFv4->v5
Steffen Eiden (7):
s390/uv: Always export uv_info
s390/uvdevice: Add info IOCTL
s390/uvdevice: Add 'Add Secret' UVC
s390/uvdevice: Add 'List Secrets' UVC
s390/uvdevice: Add 'Lock Secret Store' UVC
s390/uv: replace scnprintf with sysfs_emit
s390/uv: Update query for secret-UVCs
arch/s390/boot/uv.c | 4 +
arch/s390/include/asm/uv.h | 32 +++-
arch/s390/include/uapi/asm/uvdevice.h | 53 +++++-
arch/s390/kernel/uv.c | 108 ++++++++----
drivers/s390/char/Kconfig | 2 +-
drivers/s390/char/uvdevice.c | 231 +++++++++++++++++++++++++-
6 files changed, 386 insertions(+), 44 deletions(-)
--
2.40.1
