yeahuh / rpms / qemu-kvm

Forked from rpms/qemu-kvm 2 years ago
Clone
ddf19c
From e6474080e3816e82e87c545a3d22db77c55ab053 Mon Sep 17 00:00:00 2001
ddf19c
From: Thomas Huth <thuth@redhat.com>
ddf19c
Date: Fri, 29 May 2020 05:54:04 -0400
ddf19c
Subject: [PATCH 22/42] s390x: protvirt: Support unpack facility
ddf19c
ddf19c
RH-Author: Thomas Huth <thuth@redhat.com>
ddf19c
Message-id: <20200529055420.16855-23-thuth@redhat.com>
ddf19c
Patchwork-id: 97045
ddf19c
O-Subject: [RHEL-8.3.0 qemu-kvm PATCH v2 22/38] s390x: protvirt: Support unpack facility
ddf19c
Bugzilla: 1828317
ddf19c
RH-Acked-by: Claudio Imbrenda <cimbrend@redhat.com>
ddf19c
RH-Acked-by: Cornelia Huck <cohuck@redhat.com>
ddf19c
RH-Acked-by: David Hildenbrand <david@redhat.com>
ddf19c
ddf19c
From: Janosch Frank <frankja@linux.ibm.com>
ddf19c
ddf19c
The unpack facility provides the means to setup a protected guest. A
ddf19c
protected guest cannot be introspected by the hypervisor or any
ddf19c
user/administrator of the machine it is running on.
ddf19c
ddf19c
Protected guests are encrypted at rest and need a special boot
ddf19c
mechanism via diag308 subcode 8 and 10.
ddf19c
ddf19c
Code 8 sets the PV specific IPLB which is retained separately from
ddf19c
those set via code 5.
ddf19c
ddf19c
Code 10 is used to unpack the VM into protected memory, verify its
ddf19c
integrity and start it.
ddf19c
ddf19c
Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
ddf19c
Co-developed-by: Christian Borntraeger <borntraeger@de.ibm.com> [Changes
ddf19c
to machine]
ddf19c
Reviewed-by: David Hildenbrand <david@redhat.com>
ddf19c
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
ddf19c
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
ddf19c
Message-Id: <20200323083606.24520-1-frankja@linux.ibm.com>
ddf19c
[CH: fixed up KVM_PV_VM_ -> KVM_PV_]
ddf19c
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
ddf19c
(cherry picked from commit c3347ed0d2ee42a7dcf7bfe7f9c3884a9596727a)
ddf19c
Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
ddf19c
---
ddf19c
 MAINTAINERS                         |   2 +
ddf19c
 hw/s390x/Makefile.objs              |   1 +
ddf19c
 hw/s390x/ipl.c                      |  59 +++++++++++++-
ddf19c
 hw/s390x/ipl.h                      |  91 ++++++++++++++++++++-
ddf19c
 hw/s390x/pv.c                       |  98 +++++++++++++++++++++++
ddf19c
 hw/s390x/s390-virtio-ccw.c          | 119 +++++++++++++++++++++++++++-
ddf19c
 include/hw/s390x/pv.h               |  55 +++++++++++++
ddf19c
 include/hw/s390x/s390-virtio-ccw.h  |   1 +
ddf19c
 target/s390x/cpu.c                  |   1 +
ddf19c
 target/s390x/cpu_features_def.inc.h |   1 +
ddf19c
 target/s390x/diag.c                 |  39 ++++++++-
ddf19c
 target/s390x/kvm-stub.c             |   5 ++
ddf19c
 target/s390x/kvm.c                  |   5 ++
ddf19c
 target/s390x/kvm_s390x.h            |   1 +
ddf19c
 14 files changed, 468 insertions(+), 10 deletions(-)
ddf19c
 create mode 100644 hw/s390x/pv.c
ddf19c
 create mode 100644 include/hw/s390x/pv.h
ddf19c
ddf19c
diff --git a/MAINTAINERS b/MAINTAINERS
ddf19c
index 49d5d44edc..2742c95575 100644
ddf19c
--- a/MAINTAINERS
ddf19c
+++ b/MAINTAINERS
ddf19c
@@ -385,6 +385,8 @@ F: target/s390x/machine.c
ddf19c
 F: target/s390x/sigp.c
ddf19c
 F: target/s390x/cpu_features*.[ch]
ddf19c
 F: target/s390x/cpu_models.[ch]
ddf19c
+F: hw/s390x/pv.c
ddf19c
+F: include/hw/s390x/pv.h
ddf19c
 F: hw/intc/s390_flic.c
ddf19c
 F: hw/intc/s390_flic_kvm.c
ddf19c
 F: include/hw/s390x/s390_flic.h
ddf19c
diff --git a/hw/s390x/Makefile.objs b/hw/s390x/Makefile.objs
ddf19c
index e02ed80b68..a46a1c7894 100644
ddf19c
--- a/hw/s390x/Makefile.objs
ddf19c
+++ b/hw/s390x/Makefile.objs
ddf19c
@@ -31,6 +31,7 @@ obj-y += tod-qemu.o
ddf19c
 obj-$(CONFIG_KVM) += tod-kvm.o
ddf19c
 obj-$(CONFIG_KVM) += s390-skeys-kvm.o
ddf19c
 obj-$(CONFIG_KVM) += s390-stattrib-kvm.o
ddf19c
+obj-$(CONFIG_KVM) += pv.o
ddf19c
 obj-y += s390-ccw.o
ddf19c
 obj-y += ap-device.o
ddf19c
 obj-y += ap-bridge.o
ddf19c
diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
ddf19c
index fa0409dc23..586d95b5b6 100644
ddf19c
--- a/hw/s390x/ipl.c
ddf19c
+++ b/hw/s390x/ipl.c
ddf19c
@@ -1,10 +1,11 @@
ddf19c
 /*
ddf19c
  * bootloader support
ddf19c
  *
ddf19c
- * Copyright IBM, Corp. 2012
ddf19c
+ * Copyright IBM, Corp. 2012, 2020
ddf19c
  *
ddf19c
  * Authors:
ddf19c
  *  Christian Borntraeger <borntraeger@de.ibm.com>
ddf19c
+ *  Janosch Frank <frankja@linux.ibm.com>
ddf19c
  *
ddf19c
  * This work is licensed under the terms of the GNU GPL, version 2 or (at your
ddf19c
  * option) any later version.  See the COPYING file in the top-level directory.
ddf19c
@@ -27,6 +28,7 @@
ddf19c
 #include "hw/s390x/vfio-ccw.h"
ddf19c
 #include "hw/s390x/css.h"
ddf19c
 #include "hw/s390x/ebcdic.h"
ddf19c
+#include "hw/s390x/pv.h"
ddf19c
 #include "ipl.h"
ddf19c
 #include "qemu/error-report.h"
ddf19c
 #include "qemu/config-file.h"
ddf19c
@@ -557,12 +559,31 @@ void s390_ipl_update_diag308(IplParameterBlock *iplb)
ddf19c
 {
ddf19c
     S390IPLState *ipl = get_ipl_device();
ddf19c
 
ddf19c
-    ipl->iplb = *iplb;
ddf19c
-    ipl->iplb_valid = true;
ddf19c
+    /*
ddf19c
+     * The IPLB set and retrieved by subcodes 8/9 is completely
ddf19c
+     * separate from the one managed via subcodes 5/6.
ddf19c
+     */
ddf19c
+    if (iplb->pbt == S390_IPL_TYPE_PV) {
ddf19c
+        ipl->iplb_pv = *iplb;
ddf19c
+        ipl->iplb_valid_pv = true;
ddf19c
+    } else {
ddf19c
+        ipl->iplb = *iplb;
ddf19c
+        ipl->iplb_valid = true;
ddf19c
+    }
ddf19c
     ipl->netboot = is_virtio_net_device(iplb);
ddf19c
     update_machine_ipl_properties(iplb);
ddf19c
 }
ddf19c
 
ddf19c
+IplParameterBlock *s390_ipl_get_iplb_pv(void)
ddf19c
+{
ddf19c
+    S390IPLState *ipl = get_ipl_device();
ddf19c
+
ddf19c
+    if (!ipl->iplb_valid_pv) {
ddf19c
+        return NULL;
ddf19c
+    }
ddf19c
+    return &ipl->iplb_pv;
ddf19c
+}
ddf19c
+
ddf19c
 IplParameterBlock *s390_ipl_get_iplb(void)
ddf19c
 {
ddf19c
     S390IPLState *ipl = get_ipl_device();
ddf19c
@@ -651,6 +672,38 @@ static void s390_ipl_prepare_qipl(S390CPU *cpu)
ddf19c
     cpu_physical_memory_unmap(addr, len, 1, len);
ddf19c
 }
ddf19c
 
ddf19c
+int s390_ipl_prepare_pv_header(void)
ddf19c
+{
ddf19c
+    IplParameterBlock *ipib = s390_ipl_get_iplb_pv();
ddf19c
+    IPLBlockPV *ipib_pv = &ipib->pv;
ddf19c
+    void *hdr = g_malloc(ipib_pv->pv_header_len);
ddf19c
+    int rc;
ddf19c
+
ddf19c
+    cpu_physical_memory_read(ipib_pv->pv_header_addr, hdr,
ddf19c
+                             ipib_pv->pv_header_len);
ddf19c
+    rc = s390_pv_set_sec_parms((uintptr_t)hdr,
ddf19c
+                               ipib_pv->pv_header_len);
ddf19c
+    g_free(hdr);
ddf19c
+    return rc;
ddf19c
+}
ddf19c
+
ddf19c
+int s390_ipl_pv_unpack(void)
ddf19c
+{
ddf19c
+    IplParameterBlock *ipib = s390_ipl_get_iplb_pv();
ddf19c
+    IPLBlockPV *ipib_pv = &ipib->pv;
ddf19c
+    int i, rc = 0;
ddf19c
+
ddf19c
+    for (i = 0; i < ipib_pv->num_comp; i++) {
ddf19c
+        rc = s390_pv_unpack(ipib_pv->components[i].addr,
ddf19c
+                            TARGET_PAGE_ALIGN(ipib_pv->components[i].size),
ddf19c
+                            ipib_pv->components[i].tweak_pref);
ddf19c
+        if (rc) {
ddf19c
+            break;
ddf19c
+        }
ddf19c
+    }
ddf19c
+    return rc;
ddf19c
+}
ddf19c
+
ddf19c
 void s390_ipl_prepare_cpu(S390CPU *cpu)
ddf19c
 {
ddf19c
     S390IPLState *ipl = get_ipl_device();
ddf19c
diff --git a/hw/s390x/ipl.h b/hw/s390x/ipl.h
ddf19c
index a5665e6bfd..89b3044d7a 100644
ddf19c
--- a/hw/s390x/ipl.h
ddf19c
+++ b/hw/s390x/ipl.h
ddf19c
@@ -1,8 +1,9 @@
ddf19c
 /*
ddf19c
  * s390 IPL device
ddf19c
  *
ddf19c
- * Copyright 2015 IBM Corp.
ddf19c
+ * Copyright 2015, 2020 IBM Corp.
ddf19c
  * Author(s): Zhang Fan <bjfanzh@cn.ibm.com>
ddf19c
+ * Janosch Frank <frankja@linux.ibm.com>
ddf19c
  *
ddf19c
  * This work is licensed under the terms of the GNU GPL, version 2 or (at
ddf19c
  * your option) any later version. See the COPYING file in the top-level
ddf19c
@@ -15,6 +16,24 @@
ddf19c
 #include "cpu.h"
ddf19c
 #include "hw/qdev-core.h"
ddf19c
 
ddf19c
+struct IPLBlockPVComp {
ddf19c
+    uint64_t tweak_pref;
ddf19c
+    uint64_t addr;
ddf19c
+    uint64_t size;
ddf19c
+} QEMU_PACKED;
ddf19c
+typedef struct IPLBlockPVComp IPLBlockPVComp;
ddf19c
+
ddf19c
+struct IPLBlockPV {
ddf19c
+    uint8_t  reserved18[87];    /* 0x18 */
ddf19c
+    uint8_t  version;           /* 0x6f */
ddf19c
+    uint32_t reserved70;        /* 0x70 */
ddf19c
+    uint32_t num_comp;          /* 0x74 */
ddf19c
+    uint64_t pv_header_addr;    /* 0x78 */
ddf19c
+    uint64_t pv_header_len;     /* 0x80 */
ddf19c
+    struct IPLBlockPVComp components[];
ddf19c
+} QEMU_PACKED;
ddf19c
+typedef struct IPLBlockPV IPLBlockPV;
ddf19c
+
ddf19c
 struct IplBlockCcw {
ddf19c
     uint8_t  reserved0[85];
ddf19c
     uint8_t  ssid;
ddf19c
@@ -71,6 +90,7 @@ union IplParameterBlock {
ddf19c
         union {
ddf19c
             IplBlockCcw ccw;
ddf19c
             IplBlockFcp fcp;
ddf19c
+            IPLBlockPV pv;
ddf19c
             IplBlockQemuScsi scsi;
ddf19c
         };
ddf19c
     } QEMU_PACKED;
ddf19c
@@ -85,8 +105,11 @@ typedef union IplParameterBlock IplParameterBlock;
ddf19c
 
ddf19c
 int s390_ipl_set_loadparm(uint8_t *loadparm);
ddf19c
 void s390_ipl_update_diag308(IplParameterBlock *iplb);
ddf19c
+int s390_ipl_prepare_pv_header(void);
ddf19c
+int s390_ipl_pv_unpack(void);
ddf19c
 void s390_ipl_prepare_cpu(S390CPU *cpu);
ddf19c
 IplParameterBlock *s390_ipl_get_iplb(void);
ddf19c
+IplParameterBlock *s390_ipl_get_iplb_pv(void);
ddf19c
 
ddf19c
 enum s390_reset {
ddf19c
     /* default is a reset not triggered by a CPU e.g. issued by QMP */
ddf19c
@@ -94,6 +117,7 @@ enum s390_reset {
ddf19c
     S390_RESET_REIPL,
ddf19c
     S390_RESET_MODIFIED_CLEAR,
ddf19c
     S390_RESET_LOAD_NORMAL,
ddf19c
+    S390_RESET_PV,
ddf19c
 };
ddf19c
 void s390_ipl_reset_request(CPUState *cs, enum s390_reset reset_type);
ddf19c
 void s390_ipl_get_reset_request(CPUState **cs, enum s390_reset *reset_type);
ddf19c
@@ -133,6 +157,7 @@ struct S390IPLState {
ddf19c
     /*< private >*/
ddf19c
     DeviceState parent_obj;
ddf19c
     IplParameterBlock iplb;
ddf19c
+    IplParameterBlock iplb_pv;
ddf19c
     QemuIplParameters qipl;
ddf19c
     uint64_t start_addr;
ddf19c
     uint64_t compat_start_addr;
ddf19c
@@ -140,6 +165,7 @@ struct S390IPLState {
ddf19c
     uint64_t compat_bios_start_addr;
ddf19c
     bool enforce_bios;
ddf19c
     bool iplb_valid;
ddf19c
+    bool iplb_valid_pv;
ddf19c
     bool netboot;
ddf19c
     /* reset related properties don't have to be migrated or reset */
ddf19c
     enum s390_reset reset_type;
ddf19c
@@ -162,6 +188,8 @@ QEMU_BUILD_BUG_MSG(offsetof(S390IPLState, iplb) & 3, "alignment of iplb wrong");
ddf19c
 #define DIAG_308_RC_OK              0x0001
ddf19c
 #define DIAG_308_RC_NO_CONF         0x0102
ddf19c
 #define DIAG_308_RC_INVALID         0x0402
ddf19c
+#define DIAG_308_RC_NO_PV_CONF      0x0902
ddf19c
+#define DIAG_308_RC_INVAL_FOR_PV    0x0a02
ddf19c
 
ddf19c
 #define DIAG308_RESET_MOD_CLR       0
ddf19c
 #define DIAG308_RESET_LOAD_NORM     1
ddf19c
@@ -169,12 +197,17 @@ QEMU_BUILD_BUG_MSG(offsetof(S390IPLState, iplb) & 3, "alignment of iplb wrong");
ddf19c
 #define DIAG308_LOAD_NORMAL_DUMP    4
ddf19c
 #define DIAG308_SET                 5
ddf19c
 #define DIAG308_STORE               6
ddf19c
+#define DIAG308_PV_SET              8
ddf19c
+#define DIAG308_PV_STORE            9
ddf19c
+#define DIAG308_PV_START            10
ddf19c
 
ddf19c
 #define S390_IPL_TYPE_FCP 0x00
ddf19c
 #define S390_IPL_TYPE_CCW 0x02
ddf19c
+#define S390_IPL_TYPE_PV 0x05
ddf19c
 #define S390_IPL_TYPE_QEMU_SCSI 0xff
ddf19c
 
ddf19c
 #define S390_IPLB_HEADER_LEN 8
ddf19c
+#define S390_IPLB_MIN_PV_LEN 148
ddf19c
 #define S390_IPLB_MIN_CCW_LEN 200
ddf19c
 #define S390_IPLB_MIN_FCP_LEN 384
ddf19c
 #define S390_IPLB_MIN_QEMU_SCSI_LEN 200
ddf19c
@@ -184,6 +217,62 @@ static inline bool iplb_valid_len(IplParameterBlock *iplb)
ddf19c
     return be32_to_cpu(iplb->len) <= sizeof(IplParameterBlock);
ddf19c
 }
ddf19c
 
ddf19c
+static inline bool ipl_valid_pv_components(IplParameterBlock *iplb)
ddf19c
+{
ddf19c
+    IPLBlockPV *ipib_pv = &iplb->pv;
ddf19c
+    int i;
ddf19c
+
ddf19c
+    if (ipib_pv->num_comp == 0) {
ddf19c
+        return false;
ddf19c
+    }
ddf19c
+
ddf19c
+    for (i = 0; i < ipib_pv->num_comp; i++) {
ddf19c
+        /* Addr must be 4k aligned */
ddf19c
+        if (ipib_pv->components[i].addr & ~TARGET_PAGE_MASK) {
ddf19c
+            return false;
ddf19c
+        }
ddf19c
+
ddf19c
+        /* Tweak prefix is monotonically increasing with each component */
ddf19c
+        if (i < ipib_pv->num_comp - 1 &&
ddf19c
+            ipib_pv->components[i].tweak_pref >=
ddf19c
+            ipib_pv->components[i + 1].tweak_pref) {
ddf19c
+            return false;
ddf19c
+        }
ddf19c
+    }
ddf19c
+    return true;
ddf19c
+}
ddf19c
+
ddf19c
+static inline bool ipl_valid_pv_header(IplParameterBlock *iplb)
ddf19c
+{
ddf19c
+        IPLBlockPV *ipib_pv = &iplb->pv;
ddf19c
+
ddf19c
+        if (ipib_pv->pv_header_len > 2 * TARGET_PAGE_SIZE) {
ddf19c
+            return false;
ddf19c
+        }
ddf19c
+
ddf19c
+        if (!address_space_access_valid(&address_space_memory,
ddf19c
+                                        ipib_pv->pv_header_addr,
ddf19c
+                                        ipib_pv->pv_header_len,
ddf19c
+                                        false,
ddf19c
+                                        MEMTXATTRS_UNSPECIFIED)) {
ddf19c
+            return false;
ddf19c
+        }
ddf19c
+
ddf19c
+        return true;
ddf19c
+}
ddf19c
+
ddf19c
+static inline bool iplb_valid_pv(IplParameterBlock *iplb)
ddf19c
+{
ddf19c
+    if (iplb->pbt != S390_IPL_TYPE_PV ||
ddf19c
+        be32_to_cpu(iplb->len) < S390_IPLB_MIN_PV_LEN) {
ddf19c
+        return false;
ddf19c
+    }
ddf19c
+    if (!ipl_valid_pv_header(iplb)) {
ddf19c
+        return false;
ddf19c
+    }
ddf19c
+    return ipl_valid_pv_components(iplb);
ddf19c
+}
ddf19c
+
ddf19c
 static inline bool iplb_valid(IplParameterBlock *iplb)
ddf19c
 {
ddf19c
     switch (iplb->pbt) {
ddf19c
diff --git a/hw/s390x/pv.c b/hw/s390x/pv.c
ddf19c
new file mode 100644
ddf19c
index 0000000000..a40a844806
ddf19c
--- /dev/null
ddf19c
+++ b/hw/s390x/pv.c
ddf19c
@@ -0,0 +1,98 @@
ddf19c
+/*
ddf19c
+ * Protected Virtualization functions
ddf19c
+ *
ddf19c
+ * Copyright IBM Corp. 2020
ddf19c
+ * Author(s):
ddf19c
+ *  Janosch Frank <frankja@linux.ibm.com>
ddf19c
+ *
ddf19c
+ * This work is licensed under the terms of the GNU GPL, version 2 or (at
ddf19c
+ * your option) any later version. See the COPYING file in the top-level
ddf19c
+ * directory.
ddf19c
+ */
ddf19c
+#include "qemu/osdep.h"
ddf19c
+
ddf19c
+#include <linux/kvm.h>
ddf19c
+
ddf19c
+#include "qemu/error-report.h"
ddf19c
+#include "sysemu/kvm.h"
ddf19c
+#include "hw/s390x/pv.h"
ddf19c
+
ddf19c
+static int __s390_pv_cmd(uint32_t cmd, const char *cmdname, void *data)
ddf19c
+{
ddf19c
+    struct kvm_pv_cmd pv_cmd = {
ddf19c
+        .cmd = cmd,
ddf19c
+        .data = (uint64_t)data,
ddf19c
+    };
ddf19c
+    int rc = kvm_vm_ioctl(kvm_state, KVM_S390_PV_COMMAND, &pv_cmd);
ddf19c
+
ddf19c
+    if (rc) {
ddf19c
+        error_report("KVM PV command %d (%s) failed: header rc %x rrc %x "
ddf19c
+                     "IOCTL rc: %d", cmd, cmdname, pv_cmd.rc, pv_cmd.rrc,
ddf19c
+                     rc);
ddf19c
+    }
ddf19c
+    return rc;
ddf19c
+}
ddf19c
+
ddf19c
+/*
ddf19c
+ * This macro lets us pass the command as a string to the function so
ddf19c
+ * we can print it on an error.
ddf19c
+ */
ddf19c
+#define s390_pv_cmd(cmd, data) __s390_pv_cmd(cmd, #cmd, data);
ddf19c
+#define s390_pv_cmd_exit(cmd, data)    \
ddf19c
+{                                      \
ddf19c
+    int rc;                            \
ddf19c
+                                       \
ddf19c
+    rc = __s390_pv_cmd(cmd, #cmd, data);\
ddf19c
+    if (rc) {                          \
ddf19c
+        exit(1);                       \
ddf19c
+    }                                  \
ddf19c
+}
ddf19c
+
ddf19c
+int s390_pv_vm_enable(void)
ddf19c
+{
ddf19c
+    return s390_pv_cmd(KVM_PV_ENABLE, NULL);
ddf19c
+}
ddf19c
+
ddf19c
+void s390_pv_vm_disable(void)
ddf19c
+{
ddf19c
+     s390_pv_cmd_exit(KVM_PV_DISABLE, NULL);
ddf19c
+}
ddf19c
+
ddf19c
+int s390_pv_set_sec_parms(uint64_t origin, uint64_t length)
ddf19c
+{
ddf19c
+    struct kvm_s390_pv_sec_parm args = {
ddf19c
+        .origin = origin,
ddf19c
+        .length = length,
ddf19c
+    };
ddf19c
+
ddf19c
+    return s390_pv_cmd(KVM_PV_SET_SEC_PARMS, &args);
ddf19c
+}
ddf19c
+
ddf19c
+/*
ddf19c
+ * Called for each component in the SE type IPL parameter block 0.
ddf19c
+ */
ddf19c
+int s390_pv_unpack(uint64_t addr, uint64_t size, uint64_t tweak)
ddf19c
+{
ddf19c
+    struct kvm_s390_pv_unp args = {
ddf19c
+        .addr = addr,
ddf19c
+        .size = size,
ddf19c
+        .tweak = tweak,
ddf19c
+    };
ddf19c
+
ddf19c
+    return s390_pv_cmd(KVM_PV_UNPACK, &args);
ddf19c
+}
ddf19c
+
ddf19c
+void s390_pv_perf_clear_reset(void)
ddf19c
+{
ddf19c
+    s390_pv_cmd_exit(KVM_PV_PREP_RESET, NULL);
ddf19c
+}
ddf19c
+
ddf19c
+int s390_pv_verify(void)
ddf19c
+{
ddf19c
+    return s390_pv_cmd(KVM_PV_VERIFY, NULL);
ddf19c
+}
ddf19c
+
ddf19c
+void s390_pv_unshare(void)
ddf19c
+{
ddf19c
+    s390_pv_cmd_exit(KVM_PV_UNSHARE_ALL, NULL);
ddf19c
+}
ddf19c
diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
ddf19c
index 4ea01c53c0..82da1d9ab5 100644
ddf19c
--- a/hw/s390x/s390-virtio-ccw.c
ddf19c
+++ b/hw/s390x/s390-virtio-ccw.c
ddf19c
@@ -1,9 +1,10 @@
ddf19c
 /*
ddf19c
  * virtio ccw machine
ddf19c
  *
ddf19c
- * Copyright 2012 IBM Corp.
ddf19c
+ * Copyright 2012, 2020 IBM Corp.
ddf19c
  * Copyright (c) 2009 Alexander Graf <agraf@suse.de>
ddf19c
  * Author(s): Cornelia Huck <cornelia.huck@de.ibm.com>
ddf19c
+ *            Janosch Frank <frankja@linux.ibm.com>
ddf19c
  *
ddf19c
  * This work is licensed under the terms of the GNU GPL, version 2 or (at
ddf19c
  * your option) any later version. See the COPYING file in the top-level
ddf19c
@@ -41,6 +42,8 @@
ddf19c
 #include "hw/qdev-properties.h"
ddf19c
 #include "hw/s390x/tod.h"
ddf19c
 #include "sysemu/sysemu.h"
ddf19c
+#include "hw/s390x/pv.h"
ddf19c
+#include <linux/kvm.h>
ddf19c
 
ddf19c
 S390CPU *s390_cpu_addr2state(uint16_t cpu_addr)
ddf19c
 {
ddf19c
@@ -318,10 +321,78 @@ static inline void s390_do_cpu_ipl(CPUState *cs, run_on_cpu_data arg)
ddf19c
     s390_cpu_set_state(S390_CPU_STATE_OPERATING, cpu);
ddf19c
 }
ddf19c
 
ddf19c
+static void s390_machine_unprotect(S390CcwMachineState *ms)
ddf19c
+{
ddf19c
+    s390_pv_vm_disable();
ddf19c
+    ms->pv = false;
ddf19c
+}
ddf19c
+
ddf19c
+static int s390_machine_protect(S390CcwMachineState *ms)
ddf19c
+{
ddf19c
+    int rc;
ddf19c
+
ddf19c
+    /* Create SE VM */
ddf19c
+    rc = s390_pv_vm_enable();
ddf19c
+    if (rc) {
ddf19c
+        return rc;
ddf19c
+    }
ddf19c
+
ddf19c
+    ms->pv = true;
ddf19c
+
ddf19c
+    /* Set SE header and unpack */
ddf19c
+    rc = s390_ipl_prepare_pv_header();
ddf19c
+    if (rc) {
ddf19c
+        goto out_err;
ddf19c
+    }
ddf19c
+
ddf19c
+    /* Decrypt image */
ddf19c
+    rc = s390_ipl_pv_unpack();
ddf19c
+    if (rc) {
ddf19c
+        goto out_err;
ddf19c
+    }
ddf19c
+
ddf19c
+    /* Verify integrity */
ddf19c
+    rc = s390_pv_verify();
ddf19c
+    if (rc) {
ddf19c
+        goto out_err;
ddf19c
+    }
ddf19c
+    return rc;
ddf19c
+
ddf19c
+out_err:
ddf19c
+    s390_machine_unprotect(ms);
ddf19c
+    return rc;
ddf19c
+}
ddf19c
+
ddf19c
+static void s390_machine_inject_pv_error(CPUState *cs)
ddf19c
+{
ddf19c
+    int r1 = (cs->kvm_run->s390_sieic.ipa & 0x00f0) >> 4;
ddf19c
+    CPUS390XState *env = &S390_CPU(cs)->env;
ddf19c
+
ddf19c
+    /* Report that we are unable to enter protected mode */
ddf19c
+    env->regs[r1 + 1] = DIAG_308_RC_INVAL_FOR_PV;
ddf19c
+}
ddf19c
+
ddf19c
+static void s390_pv_prepare_reset(S390CcwMachineState *ms)
ddf19c
+{
ddf19c
+    CPUState *cs;
ddf19c
+
ddf19c
+    if (!s390_is_pv()) {
ddf19c
+        return;
ddf19c
+    }
ddf19c
+    /* Unsharing requires all cpus to be stopped */
ddf19c
+    CPU_FOREACH(cs) {
ddf19c
+        s390_cpu_set_state(S390_CPU_STATE_STOPPED, S390_CPU(cs));
ddf19c
+    }
ddf19c
+    s390_pv_unshare();
ddf19c
+    s390_pv_perf_clear_reset();
ddf19c
+}
ddf19c
+
ddf19c
 static void s390_machine_reset(MachineState *machine)
ddf19c
 {
ddf19c
+    S390CcwMachineState *ms = S390_CCW_MACHINE(machine);
ddf19c
     enum s390_reset reset_type;
ddf19c
     CPUState *cs, *t;
ddf19c
+    S390CPU *cpu;
ddf19c
 
ddf19c
     /* get the reset parameters, reset them once done */
ddf19c
     s390_ipl_get_reset_request(&cs, &reset_type);
ddf19c
@@ -329,9 +400,15 @@ static void s390_machine_reset(MachineState *machine)
ddf19c
     /* all CPUs are paused and synchronized at this point */
ddf19c
     s390_cmma_reset();
ddf19c
 
ddf19c
+    cpu = S390_CPU(cs);
ddf19c
+
ddf19c
     switch (reset_type) {
ddf19c
     case S390_RESET_EXTERNAL:
ddf19c
     case S390_RESET_REIPL:
ddf19c
+        if (s390_is_pv()) {
ddf19c
+            s390_machine_unprotect(ms);
ddf19c
+        }
ddf19c
+
ddf19c
         qemu_devices_reset();
ddf19c
         s390_crypto_reset();
ddf19c
 
ddf19c
@@ -339,22 +416,56 @@ static void s390_machine_reset(MachineState *machine)
ddf19c
         run_on_cpu(cs, s390_do_cpu_ipl, RUN_ON_CPU_NULL);
ddf19c
         break;
ddf19c
     case S390_RESET_MODIFIED_CLEAR:
ddf19c
+        /*
ddf19c
+         * Susbsystem reset needs to be done before we unshare memory
ddf19c
+         * and lose access to VIRTIO structures in guest memory.
ddf19c
+         */
ddf19c
+        subsystem_reset();
ddf19c
+        s390_crypto_reset();
ddf19c
+        s390_pv_prepare_reset(ms);
ddf19c
         CPU_FOREACH(t) {
ddf19c
             run_on_cpu(t, s390_do_cpu_full_reset, RUN_ON_CPU_NULL);
ddf19c
         }
ddf19c
-        subsystem_reset();
ddf19c
-        s390_crypto_reset();
ddf19c
         run_on_cpu(cs, s390_do_cpu_load_normal, RUN_ON_CPU_NULL);
ddf19c
         break;
ddf19c
     case S390_RESET_LOAD_NORMAL:
ddf19c
+        /*
ddf19c
+         * Susbsystem reset needs to be done before we unshare memory
ddf19c
+         * and lose access to VIRTIO structures in guest memory.
ddf19c
+         */
ddf19c
+        subsystem_reset();
ddf19c
+        s390_pv_prepare_reset(ms);
ddf19c
         CPU_FOREACH(t) {
ddf19c
             if (t == cs) {
ddf19c
                 continue;
ddf19c
             }
ddf19c
             run_on_cpu(t, s390_do_cpu_reset, RUN_ON_CPU_NULL);
ddf19c
         }
ddf19c
-        subsystem_reset();
ddf19c
         run_on_cpu(cs, s390_do_cpu_initial_reset, RUN_ON_CPU_NULL);
ddf19c
+        run_on_cpu(cs, s390_do_cpu_load_normal, RUN_ON_CPU_NULL);
ddf19c
+        break;
ddf19c
+    case S390_RESET_PV: /* Subcode 10 */
ddf19c
+        subsystem_reset();
ddf19c
+        s390_crypto_reset();
ddf19c
+
ddf19c
+        CPU_FOREACH(t) {
ddf19c
+            if (t == cs) {
ddf19c
+                continue;
ddf19c
+            }
ddf19c
+            run_on_cpu(t, s390_do_cpu_full_reset, RUN_ON_CPU_NULL);
ddf19c
+        }
ddf19c
+        run_on_cpu(cs, s390_do_cpu_reset, RUN_ON_CPU_NULL);
ddf19c
+
ddf19c
+        if (s390_machine_protect(ms)) {
ddf19c
+            s390_machine_inject_pv_error(cs);
ddf19c
+            /*
ddf19c
+             * Continue after the diag308 so the guest knows something
ddf19c
+             * went wrong.
ddf19c
+             */
ddf19c
+            s390_cpu_set_state(S390_CPU_STATE_OPERATING, cpu);
ddf19c
+            return;
ddf19c
+        }
ddf19c
+
ddf19c
         run_on_cpu(cs, s390_do_cpu_load_normal, RUN_ON_CPU_NULL);
ddf19c
         break;
ddf19c
     default:
ddf19c
diff --git a/include/hw/s390x/pv.h b/include/hw/s390x/pv.h
ddf19c
new file mode 100644
ddf19c
index 0000000000..c6cb360f2f
ddf19c
--- /dev/null
ddf19c
+++ b/include/hw/s390x/pv.h
ddf19c
@@ -0,0 +1,55 @@
ddf19c
+/*
ddf19c
+ * Protected Virtualization header
ddf19c
+ *
ddf19c
+ * Copyright IBM Corp. 2020
ddf19c
+ * Author(s):
ddf19c
+ *  Janosch Frank <frankja@linux.ibm.com>
ddf19c
+ *
ddf19c
+ * This work is licensed under the terms of the GNU GPL, version 2 or (at
ddf19c
+ * your option) any later version. See the COPYING file in the top-level
ddf19c
+ * directory.
ddf19c
+ */
ddf19c
+#ifndef HW_S390_PV_H
ddf19c
+#define HW_S390_PV_H
ddf19c
+
ddf19c
+#ifdef CONFIG_KVM
ddf19c
+#include "hw/s390x/s390-virtio-ccw.h"
ddf19c
+
ddf19c
+static inline bool s390_is_pv(void)
ddf19c
+{
ddf19c
+    static S390CcwMachineState *ccw;
ddf19c
+    Object *obj;
ddf19c
+
ddf19c
+    if (ccw) {
ddf19c
+        return ccw->pv;
ddf19c
+    }
ddf19c
+
ddf19c
+    /* we have to bail out for the "none" machine */
ddf19c
+    obj = object_dynamic_cast(qdev_get_machine(),
ddf19c
+                              TYPE_S390_CCW_MACHINE);
ddf19c
+    if (!obj) {
ddf19c
+        return false;
ddf19c
+    }
ddf19c
+    ccw = S390_CCW_MACHINE(obj);
ddf19c
+    return ccw->pv;
ddf19c
+}
ddf19c
+
ddf19c
+int s390_pv_vm_enable(void);
ddf19c
+void s390_pv_vm_disable(void);
ddf19c
+int s390_pv_set_sec_parms(uint64_t origin, uint64_t length);
ddf19c
+int s390_pv_unpack(uint64_t addr, uint64_t size, uint64_t tweak);
ddf19c
+void s390_pv_perf_clear_reset(void);
ddf19c
+int s390_pv_verify(void);
ddf19c
+void s390_pv_unshare(void);
ddf19c
+#else /* CONFIG_KVM */
ddf19c
+static inline bool s390_is_pv(void) { return false; }
ddf19c
+static inline int s390_pv_vm_enable(void) { return 0; }
ddf19c
+static inline void s390_pv_vm_disable(void) {}
ddf19c
+static inline int s390_pv_set_sec_parms(uint64_t origin, uint64_t length) { return 0; }
ddf19c
+static inline int s390_pv_unpack(uint64_t addr, uint64_t size, uint64_t tweak) { return 0; }
ddf19c
+static inline void s390_pv_perf_clear_reset(void) {}
ddf19c
+static inline int s390_pv_verify(void) { return 0; }
ddf19c
+static inline void s390_pv_unshare(void) {}
ddf19c
+#endif /* CONFIG_KVM */
ddf19c
+
ddf19c
+#endif /* HW_S390_PV_H */
ddf19c
diff --git a/include/hw/s390x/s390-virtio-ccw.h b/include/hw/s390x/s390-virtio-ccw.h
ddf19c
index 8aa27199c9..cd1dccc6e3 100644
ddf19c
--- a/include/hw/s390x/s390-virtio-ccw.h
ddf19c
+++ b/include/hw/s390x/s390-virtio-ccw.h
ddf19c
@@ -28,6 +28,7 @@ typedef struct S390CcwMachineState {
ddf19c
     /*< public >*/
ddf19c
     bool aes_key_wrap;
ddf19c
     bool dea_key_wrap;
ddf19c
+    bool pv;
ddf19c
     uint8_t loadparm[8];
ddf19c
 } S390CcwMachineState;
ddf19c
 
ddf19c
diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
ddf19c
index c0dd502b84..8f38cd8e6f 100644
ddf19c
--- a/target/s390x/cpu.c
ddf19c
+++ b/target/s390x/cpu.c
ddf19c
@@ -37,6 +37,7 @@
ddf19c
 #include "sysemu/hw_accel.h"
ddf19c
 #include "hw/qdev-properties.h"
ddf19c
 #ifndef CONFIG_USER_ONLY
ddf19c
+#include "hw/s390x/pv.h"
ddf19c
 #include "hw/boards.h"
ddf19c
 #include "sysemu/arch_init.h"
ddf19c
 #include "sysemu/sysemu.h"
ddf19c
diff --git a/target/s390x/cpu_features_def.inc.h b/target/s390x/cpu_features_def.inc.h
ddf19c
index 31dff0d84e..60db28351d 100644
ddf19c
--- a/target/s390x/cpu_features_def.inc.h
ddf19c
+++ b/target/s390x/cpu_features_def.inc.h
ddf19c
@@ -107,6 +107,7 @@ DEF_FEAT(DEFLATE_BASE, "deflate-base", STFL, 151, "Deflate-conversion facility (
ddf19c
 DEF_FEAT(VECTOR_PACKED_DECIMAL_ENH, "vxpdeh", STFL, 152, "Vector-Packed-Decimal-Enhancement Facility")
ddf19c
 DEF_FEAT(MSA_EXT_9, "msa9-base", STFL, 155, "Message-security-assist-extension-9 facility (excluding subfunctions)")
ddf19c
 DEF_FEAT(ETOKEN, "etoken", STFL, 156, "Etoken facility")
ddf19c
+DEF_FEAT(UNPACK, "unpack", STFL, 161, "Unpack facility")
ddf19c
 
ddf19c
 /* Features exposed via SCLP SCCB Byte 80 - 98  (bit numbers relative to byte-80) */
ddf19c
 DEF_FEAT(SIE_GSLS, "gsls", SCLP_CONF_CHAR, 40, "SIE: Guest-storage-limit-suppression facility")
ddf19c
diff --git a/target/s390x/diag.c b/target/s390x/diag.c
ddf19c
index 8aba6341f9..b2cbefb8cf 100644
ddf19c
--- a/target/s390x/diag.c
ddf19c
+++ b/target/s390x/diag.c
ddf19c
@@ -20,6 +20,8 @@
ddf19c
 #include "sysemu/cpus.h"
ddf19c
 #include "hw/s390x/ipl.h"
ddf19c
 #include "hw/s390x/s390-virtio-ccw.h"
ddf19c
+#include "hw/s390x/pv.h"
ddf19c
+#include "kvm_s390x.h"
ddf19c
 
ddf19c
 int handle_diag_288(CPUS390XState *env, uint64_t r1, uint64_t r3)
ddf19c
 {
ddf19c
@@ -52,6 +54,10 @@ int handle_diag_288(CPUS390XState *env, uint64_t r1, uint64_t r3)
ddf19c
 static int diag308_parm_check(CPUS390XState *env, uint64_t r1, uint64_t addr,
ddf19c
                               uintptr_t ra, bool write)
ddf19c
 {
ddf19c
+    /* Handled by the Ultravisor */
ddf19c
+    if (s390_is_pv()) {
ddf19c
+        return 0;
ddf19c
+    }
ddf19c
     if ((r1 & 1) || (addr & ~TARGET_PAGE_MASK)) {
ddf19c
         s390_program_interrupt(env, PGM_SPECIFICATION, ra);
ddf19c
         return -1;
ddf19c
@@ -67,6 +73,7 @@ static int diag308_parm_check(CPUS390XState *env, uint64_t r1, uint64_t addr,
ddf19c
 
ddf19c
 void handle_diag_308(CPUS390XState *env, uint64_t r1, uint64_t r3, uintptr_t ra)
ddf19c
 {
ddf19c
+    bool valid;
ddf19c
     CPUState *cs = env_cpu(env);
ddf19c
     uint64_t addr =  env->regs[r1];
ddf19c
     uint64_t subcode = env->regs[r3];
ddf19c
@@ -82,6 +89,11 @@ void handle_diag_308(CPUS390XState *env, uint64_t r1, uint64_t r3, uintptr_t ra)
ddf19c
         return;
ddf19c
     }
ddf19c
 
ddf19c
+    if (subcode >= DIAG308_PV_SET && !s390_has_feat(S390_FEAT_UNPACK)) {
ddf19c
+        s390_program_interrupt(env, PGM_SPECIFICATION, ra);
ddf19c
+        return;
ddf19c
+    }
ddf19c
+
ddf19c
     switch (subcode) {
ddf19c
     case DIAG308_RESET_MOD_CLR:
ddf19c
         s390_ipl_reset_request(cs, S390_RESET_MODIFIED_CLEAR);
ddf19c
@@ -94,6 +106,7 @@ void handle_diag_308(CPUS390XState *env, uint64_t r1, uint64_t r3, uintptr_t ra)
ddf19c
         s390_ipl_reset_request(cs, S390_RESET_REIPL);
ddf19c
         break;
ddf19c
     case DIAG308_SET:
ddf19c
+    case DIAG308_PV_SET:
ddf19c
         if (diag308_parm_check(env, r1, addr, ra, false)) {
ddf19c
             return;
ddf19c
         }
ddf19c
@@ -106,7 +119,8 @@ void handle_diag_308(CPUS390XState *env, uint64_t r1, uint64_t r3, uintptr_t ra)
ddf19c
 
ddf19c
         cpu_physical_memory_read(addr, iplb, be32_to_cpu(iplb->len));
ddf19c
 
ddf19c
-        if (!iplb_valid(iplb)) {
ddf19c
+        valid = subcode == DIAG308_PV_SET ? iplb_valid_pv(iplb) : iplb_valid(iplb);
ddf19c
+        if (!valid) {
ddf19c
             env->regs[r1 + 1] = DIAG_308_RC_INVALID;
ddf19c
             goto out;
ddf19c
         }
ddf19c
@@ -117,10 +131,15 @@ out:
ddf19c
         g_free(iplb);
ddf19c
         return;
ddf19c
     case DIAG308_STORE:
ddf19c
+    case DIAG308_PV_STORE:
ddf19c
         if (diag308_parm_check(env, r1, addr, ra, true)) {
ddf19c
             return;
ddf19c
         }
ddf19c
-        iplb = s390_ipl_get_iplb();
ddf19c
+        if (subcode == DIAG308_PV_STORE) {
ddf19c
+            iplb = s390_ipl_get_iplb_pv();
ddf19c
+        } else {
ddf19c
+            iplb = s390_ipl_get_iplb();
ddf19c
+        }
ddf19c
         if (iplb) {
ddf19c
             cpu_physical_memory_write(addr, iplb, be32_to_cpu(iplb->len));
ddf19c
             env->regs[r1 + 1] = DIAG_308_RC_OK;
ddf19c
@@ -128,6 +147,22 @@ out:
ddf19c
             env->regs[r1 + 1] = DIAG_308_RC_NO_CONF;
ddf19c
         }
ddf19c
         return;
ddf19c
+    case DIAG308_PV_START:
ddf19c
+        iplb = s390_ipl_get_iplb_pv();
ddf19c
+        if (!iplb) {
ddf19c
+            env->regs[r1 + 1] = DIAG_308_RC_NO_PV_CONF;
ddf19c
+            return;
ddf19c
+        }
ddf19c
+
ddf19c
+        if (kvm_s390_get_hpage_1m()) {
ddf19c
+            error_report("Protected VMs can currently not be backed with "
ddf19c
+                         "huge pages");
ddf19c
+            env->regs[r1 + 1] = DIAG_308_RC_INVAL_FOR_PV;
ddf19c
+            return;
ddf19c
+        }
ddf19c
+
ddf19c
+        s390_ipl_reset_request(cs, S390_RESET_PV);
ddf19c
+        break;
ddf19c
     default:
ddf19c
         s390_program_interrupt(env, PGM_SPECIFICATION, ra);
ddf19c
         break;
ddf19c
diff --git a/target/s390x/kvm-stub.c b/target/s390x/kvm-stub.c
ddf19c
index c4cd497f85..aa185017a2 100644
ddf19c
--- a/target/s390x/kvm-stub.c
ddf19c
+++ b/target/s390x/kvm-stub.c
ddf19c
@@ -39,6 +39,11 @@ int kvm_s390_vcpu_interrupt_post_load(S390CPU *cpu)
ddf19c
     return 0;
ddf19c
 }
ddf19c
 
ddf19c
+int kvm_s390_get_hpage_1m(void)
ddf19c
+{
ddf19c
+    return 0;
ddf19c
+}
ddf19c
+
ddf19c
 int kvm_s390_get_ri(void)
ddf19c
 {
ddf19c
     return 0;
ddf19c
diff --git a/target/s390x/kvm.c b/target/s390x/kvm.c
ddf19c
index 75d82af6fc..9a0be13959 100644
ddf19c
--- a/target/s390x/kvm.c
ddf19c
+++ b/target/s390x/kvm.c
ddf19c
@@ -321,6 +321,11 @@ void kvm_s390_set_max_pagesize(uint64_t pagesize, Error **errp)
ddf19c
     cap_hpage_1m = 1;
ddf19c
 }
ddf19c
 
ddf19c
+int kvm_s390_get_hpage_1m(void)
ddf19c
+{
ddf19c
+    return cap_hpage_1m;
ddf19c
+}
ddf19c
+
ddf19c
 static void ccw_machine_class_foreach(ObjectClass *oc, void *opaque)
ddf19c
 {
ddf19c
     MachineClass *mc = MACHINE_CLASS(oc);
ddf19c
diff --git a/target/s390x/kvm_s390x.h b/target/s390x/kvm_s390x.h
ddf19c
index 0b21789796..dea813f450 100644
ddf19c
--- a/target/s390x/kvm_s390x.h
ddf19c
+++ b/target/s390x/kvm_s390x.h
ddf19c
@@ -23,6 +23,7 @@ void kvm_s390_program_interrupt(S390CPU *cpu, uint16_t code);
ddf19c
 int kvm_s390_set_cpu_state(S390CPU *cpu, uint8_t cpu_state);
ddf19c
 void kvm_s390_vcpu_interrupt_pre_save(S390CPU *cpu);
ddf19c
 int kvm_s390_vcpu_interrupt_post_load(S390CPU *cpu);
ddf19c
+int kvm_s390_get_hpage_1m(void);
ddf19c
 int kvm_s390_get_ri(void);
ddf19c
 int kvm_s390_get_gs(void);
ddf19c
 int kvm_s390_get_clock(uint8_t *tod_high, uint64_t *tod_clock);
ddf19c
-- 
ddf19c
2.27.0
ddf19c