* [kvm-unit-tests PATCH v3 1/2] s390x: factor out common args for genprotimg
2022-09-09 12:14 [kvm-unit-tests PATCH v3 0/2] s390x: dump support for PV tests Nico Boehr
@ 2022-09-09 12:14 ` Nico Boehr
2022-09-09 12:14 ` [kvm-unit-tests PATCH v3 2/2] s390x: create persistent comm-key Nico Boehr
2022-09-14 13:44 ` [kvm-unit-tests PATCH v3 0/2] s390x: dump support for PV tests Janosch Frank
2 siblings, 0 replies; 5+ messages in thread
From: Nico Boehr @ 2022-09-09 12:14 UTC (permalink / raw)
To: kvm; +Cc: frankja, imbrenda, thuth
Upcoming changes will add more arguments to genprotimg. To avoid
duplicating this logic, move the arguments to genprotimg to a variable.
Signed-off-by: Nico Boehr <nrb@linux.ibm.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
---
s390x/Makefile | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/s390x/Makefile b/s390x/Makefile
index efd5e0c13102..d17055ebe6a8 100644
--- a/s390x/Makefile
+++ b/s390x/Makefile
@@ -165,11 +165,13 @@ $(SNIPPET_DIR)/c/%.hdr: $(SNIPPET_DIR)/c/%.gbin $(HOST_KEY_DOCUMENT)
%.bin: %.elf
$(OBJCOPY) -O binary $< $@
+genprotimg_args = --host-key-document $(HOST_KEY_DOCUMENT) --no-verify
+
%selftest.pv.bin: %selftest.bin $(HOST_KEY_DOCUMENT) $(patsubst %.pv.bin,%.parmfile,$@)
- $(GENPROTIMG) --host-key-document $(HOST_KEY_DOCUMENT) --parmfile $(patsubst %.pv.bin,%.parmfile,$@) --no-verify --image $< -o $@
+ $(GENPROTIMG) $(genprotimg_args) --parmfile $(patsubst %.pv.bin,%.parmfile,$@) --image $< -o $@
%.pv.bin: %.bin $(HOST_KEY_DOCUMENT)
- $(GENPROTIMG) --host-key-document $(HOST_KEY_DOCUMENT) --no-verify --image $< -o $@
+ $(GENPROTIMG) $(genprotimg_args) --image $< -o $@
$(snippet_asmlib): $$(patsubst %.o,%.S,$$@) $(asm-offsets)
$(CC) $(CFLAGS) -c -nostdlib -o $@ $<
--
2.36.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [kvm-unit-tests PATCH v3 2/2] s390x: create persistent comm-key
2022-09-09 12:14 [kvm-unit-tests PATCH v3 0/2] s390x: dump support for PV tests Nico Boehr
2022-09-09 12:14 ` [kvm-unit-tests PATCH v3 1/2] s390x: factor out common args for genprotimg Nico Boehr
@ 2022-09-09 12:14 ` Nico Boehr
2022-09-13 12:36 ` Janosch Frank
2022-09-14 13:44 ` [kvm-unit-tests PATCH v3 0/2] s390x: dump support for PV tests Janosch Frank
2 siblings, 1 reply; 5+ messages in thread
From: Nico Boehr @ 2022-09-09 12:14 UTC (permalink / raw)
To: kvm; +Cc: frankja, imbrenda, thuth
To decrypt the dump of a PV guest, the comm-key (CCK) is required. Until
now, no comm-key was provided to genprotimg, therefore decrypting the
dump of a kvm-unit-test under PV was not possible.
This patch makes sure that we create a random CCK if there's no
$(TEST_DIR)/comm.key file.
Also allow dumping of PV tests by passing the appropriate PCF to
genprotimg (bit 34). --x-pcf is used to be compatible with older
genprotimg versions, which don't support --enable-dump. 0xe0 is the
default PCF value and only bit 34 is added.
Unfortunately, recent versions of genprotimg removed the --x-comm-key
argument which was used by older versions to specify the CCK. To support
these versions, we need to parse the genprotimg help output and decide
which argument to use.
Signed-off-by: Nico Boehr <nrb@linux.ibm.com>
---
s390x/Makefile | 26 ++++++++++++++++++++++----
1 file changed, 22 insertions(+), 4 deletions(-)
diff --git a/s390x/Makefile b/s390x/Makefile
index d17055ebe6a8..d1a7bf6004a1 100644
--- a/s390x/Makefile
+++ b/s390x/Makefile
@@ -162,15 +162,33 @@ $(SNIPPET_DIR)/c/%.hdr: $(SNIPPET_DIR)/c/%.gbin $(HOST_KEY_DOCUMENT)
$(RM) $(@:.elf=.aux.o)
@chmod a-x $@
+# Secure Execution Customer Communication Key file
+# 32 bytes of key material, uses existing one if available
+comm-key = $(TEST_DIR)/comm.key
+$(comm-key):
+ dd if=/dev/urandom of=$@ bs=32 count=1 status=none
+
%.bin: %.elf
$(OBJCOPY) -O binary $< $@
-genprotimg_args = --host-key-document $(HOST_KEY_DOCUMENT) --no-verify
+# The genprotimg arguments for the cck changed over time so we need to
+# figure out which argument to use in order to set the cck
+GENPROTIMG_HAS_COMM_KEY = $(shell $(GENPROTIMG) --help | grep -q -- --comm-key && echo yes)
+ifeq ($(GENPROTIMG_HAS_COMM_KEY),yes)
+ GENPROTIMG_COMM_KEY = --comm-key $(comm-key)
+else
+ GENPROTIMG_COMM_KEY = --x-comm-key $(comm-key)
+endif
+
+# use x-pcf to be compatible with old genprotimg versions
+# allow dumping + PCKMO
+genprotimg_pcf = 0x200000e0
+genprotimg_args = --host-key-document $(HOST_KEY_DOCUMENT) --no-verify $(GENPROTIMG_COMM_KEY) --x-pcf $(genprotimg_pcf)
-%selftest.pv.bin: %selftest.bin $(HOST_KEY_DOCUMENT) $(patsubst %.pv.bin,%.parmfile,$@)
+%selftest.pv.bin: %selftest.bin $(HOST_KEY_DOCUMENT) $(patsubst %.pv.bin,%.parmfile,$@) $(comm-key)
$(GENPROTIMG) $(genprotimg_args) --parmfile $(patsubst %.pv.bin,%.parmfile,$@) --image $< -o $@
-%.pv.bin: %.bin $(HOST_KEY_DOCUMENT)
+%.pv.bin: %.bin $(HOST_KEY_DOCUMENT) $(comm-key)
$(GENPROTIMG) $(genprotimg_args) --image $< -o $@
$(snippet_asmlib): $$(patsubst %.o,%.S,$$@) $(asm-offsets)
@@ -178,7 +196,7 @@ $(snippet_asmlib): $$(patsubst %.o,%.S,$$@) $(asm-offsets)
arch_clean: asm_offsets_clean
- $(RM) $(TEST_DIR)/*.{o,elf,bin} $(SNIPPET_DIR)/*/*.{o,elf,*bin,*obj,hdr} $(SNIPPET_DIR)/asm/.*.d $(TEST_DIR)/.*.d lib/s390x/.*.d
+ $(RM) $(TEST_DIR)/*.{o,elf,bin} $(SNIPPET_DIR)/*/*.{o,elf,*bin,*obj,hdr} $(SNIPPET_DIR)/asm/.*.d $(TEST_DIR)/.*.d lib/s390x/.*.d $(comm-key)
generated-files = $(asm-offsets)
$(tests:.elf=.o) $(asmlib) $(cflatobjs): $(generated-files)
--
2.36.1
^ permalink raw reply related [flat|nested] 5+ messages in thread