* [kvm-unit-tests PATCH v1 0/2] s390x: dump support for PV tests @ 2022-07-21 13:26 Nico Boehr 2022-07-21 13:26 ` [kvm-unit-tests PATCH v1 1/2] s390x: factor out common args for genprotimg Nico Boehr 2022-07-21 13:26 ` [kvm-unit-tests PATCH v1 2/2] s390x: create persistent comm-key Nico Boehr 0 siblings, 2 replies; 7+ messages in thread From: Nico Boehr @ 2022-07-21 13:26 UTC (permalink / raw) To: kvm; +Cc: frankja, imbrenda, thuth With the upcoming possibility to dump PV guests under s390x, we should be able to dump kvm-unit-tests for debugging, too. Add the necessary flags to genprotimg to allow dumping. Nico Boehr (2): s390x: factor out common args for genprotimg s390x: create persistent comm-key s390x/Makefile | 24 +++++++++++++++++++----- 1 file changed, 19 insertions(+), 5 deletions(-) -- 2.36.1 ^ permalink raw reply [flat|nested] 7+ messages in thread
* [kvm-unit-tests PATCH v1 1/2] s390x: factor out common args for genprotimg 2022-07-21 13:26 [kvm-unit-tests PATCH v1 0/2] s390x: dump support for PV tests Nico Boehr @ 2022-07-21 13:26 ` Nico Boehr 2022-07-21 16:30 ` Claudio Imbrenda 2022-07-21 13:26 ` [kvm-unit-tests PATCH v1 2/2] s390x: create persistent comm-key Nico Boehr 1 sibling, 1 reply; 7+ messages in thread From: Nico Boehr @ 2022-07-21 13:26 UTC (permalink / raw) To: kvm; +Cc: frankja, imbrenda, thuth Upcoming changes will add more arguments to genprotimg. To avoid duplicating this logic, move the arguments to genprotimg to a variable. Signed-off-by: Nico Boehr <nrb@linux.ibm.com> --- s390x/Makefile | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/s390x/Makefile b/s390x/Makefile index efd5e0c13102..34de233d09b8 100644 --- a/s390x/Makefile +++ b/s390x/Makefile @@ -165,11 +165,12 @@ $(SNIPPET_DIR)/c/%.hdr: $(SNIPPET_DIR)/c/%.gbin $(HOST_KEY_DOCUMENT) %.bin: %.elf $(OBJCOPY) -O binary $< $@ +genprotimg_args = --host-key-document $(HOST_KEY_DOCUMENT) --no-verify %selftest.pv.bin: %selftest.bin $(HOST_KEY_DOCUMENT) $(patsubst %.pv.bin,%.parmfile,$@) - $(GENPROTIMG) --host-key-document $(HOST_KEY_DOCUMENT) --parmfile $(patsubst %.pv.bin,%.parmfile,$@) --no-verify --image $< -o $@ + $(GENPROTIMG) $(genprotimg_args) --parmfile $(patsubst %.pv.bin,%.parmfile,$@) --image $< -o $@ %.pv.bin: %.bin $(HOST_KEY_DOCUMENT) - $(GENPROTIMG) --host-key-document $(HOST_KEY_DOCUMENT) --no-verify --image $< -o $@ + $(GENPROTIMG) $(genprotimg_args) --image $< -o $@ $(snippet_asmlib): $$(patsubst %.o,%.S,$$@) $(asm-offsets) $(CC) $(CFLAGS) -c -nostdlib -o $@ $< -- 2.36.1 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [kvm-unit-tests PATCH v1 1/2] s390x: factor out common args for genprotimg 2022-07-21 13:26 ` [kvm-unit-tests PATCH v1 1/2] s390x: factor out common args for genprotimg Nico Boehr @ 2022-07-21 16:30 ` Claudio Imbrenda 0 siblings, 0 replies; 7+ messages in thread From: Claudio Imbrenda @ 2022-07-21 16:30 UTC (permalink / raw) To: Nico Boehr; +Cc: kvm, frankja, thuth On Thu, 21 Jul 2022 15:26:46 +0200 Nico Boehr <nrb@linux.ibm.com> wrote: > Upcoming changes will add more arguments to genprotimg. To avoid > duplicating this logic, move the arguments to genprotimg to a variable. > > Signed-off-by: Nico Boehr <nrb@linux.ibm.com> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> > --- > s390x/Makefile | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/s390x/Makefile b/s390x/Makefile > index efd5e0c13102..34de233d09b8 100644 > --- a/s390x/Makefile > +++ b/s390x/Makefile > @@ -165,11 +165,12 @@ $(SNIPPET_DIR)/c/%.hdr: $(SNIPPET_DIR)/c/%.gbin $(HOST_KEY_DOCUMENT) > %.bin: %.elf > $(OBJCOPY) -O binary $< $@ > > +genprotimg_args = --host-key-document $(HOST_KEY_DOCUMENT) --no-verify > %selftest.pv.bin: %selftest.bin $(HOST_KEY_DOCUMENT) $(patsubst %.pv.bin,%.parmfile,$@) > - $(GENPROTIMG) --host-key-document $(HOST_KEY_DOCUMENT) --parmfile $(patsubst %.pv.bin,%.parmfile,$@) --no-verify --image $< -o $@ > + $(GENPROTIMG) $(genprotimg_args) --parmfile $(patsubst %.pv.bin,%.parmfile,$@) --image $< -o $@ > > %.pv.bin: %.bin $(HOST_KEY_DOCUMENT) > - $(GENPROTIMG) --host-key-document $(HOST_KEY_DOCUMENT) --no-verify --image $< -o $@ > + $(GENPROTIMG) $(genprotimg_args) --image $< -o $@ > > $(snippet_asmlib): $$(patsubst %.o,%.S,$$@) $(asm-offsets) > $(CC) $(CFLAGS) -c -nostdlib -o $@ $< ^ permalink raw reply [flat|nested] 7+ messages in thread
* [kvm-unit-tests PATCH v1 2/2] s390x: create persistent comm-key 2022-07-21 13:26 [kvm-unit-tests PATCH v1 0/2] s390x: dump support for PV tests Nico Boehr 2022-07-21 13:26 ` [kvm-unit-tests PATCH v1 1/2] s390x: factor out common args for genprotimg Nico Boehr @ 2022-07-21 13:26 ` Nico Boehr 2022-07-21 16:32 ` Claudio Imbrenda 2022-08-24 8:15 ` Janosch Frank 1 sibling, 2 replies; 7+ messages in thread From: Nico Boehr @ 2022-07-21 13:26 UTC (permalink / raw) To: kvm; +Cc: frankja, imbrenda, thuth To decrypt the dump of a PV guest, the comm-key (CCK) is required. Until now, no comm-key was provided to genprotimg, therefore decrypting the dump of a kvm-unit-test under PV was not possible. This patch makes sure that we create a random CCK if there's no $(TEST_DIR)/comm.key file. Also allow dumping of PV tests by passing the appropriate PCF to genprotimg (bit 34). --x-pcf is used to be compatible with older genprotimg versions, which don't support --enable-dump. 0xe0 is the default PCF value and only bit 34 is added. Unfortunately, recent versions of genprotimg removed the --x-comm-key argument which was used by older versions to specify the CCK. To support these versions, we need to parse the genprotimg help output and decide which argument to use. Signed-off-by: Nico Boehr <nrb@linux.ibm.com> --- s390x/Makefile | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/s390x/Makefile b/s390x/Makefile index 34de233d09b8..5e3cb5a47bc2 100644 --- a/s390x/Makefile +++ b/s390x/Makefile @@ -162,14 +162,27 @@ $(SNIPPET_DIR)/c/%.hdr: $(SNIPPET_DIR)/c/%.gbin $(HOST_KEY_DOCUMENT) $(RM) $(@:.elf=.aux.o) @chmod a-x $@ +comm-key = $(TEST_DIR)/comm.key +$(comm-key): + dd if=/dev/urandom of=$@ bs=32 count=1 status=none + %.bin: %.elf $(OBJCOPY) -O binary $< $@ -genprotimg_args = --host-key-document $(HOST_KEY_DOCUMENT) --no-verify -%selftest.pv.bin: %selftest.bin $(HOST_KEY_DOCUMENT) $(patsubst %.pv.bin,%.parmfile,$@) +GENPROTIMG_HAS_COMM_KEY = $(shell $(GENPROTIMG) --help | grep -q -- --comm-key && echo yes) +ifeq ($(GENPROTIMG_HAS_COMM_KEY),yes) + GENPROTIMG_COMM_KEY = --comm-key $(comm-key) +else + GENPROTIMG_COMM_KEY = --x-comm-key $(comm-key) +endif +# use x-pcf to be compatible with old genprotimg versions +# allow dumping + PCKMO +genprotimg_pcf = 0x200000e0 +genprotimg_args = --host-key-document $(HOST_KEY_DOCUMENT) --no-verify $(GENPROTIMG_COMM_KEY) --x-pcf $(genprotimg_pcf) +%selftest.pv.bin: %selftest.bin $(HOST_KEY_DOCUMENT) $(patsubst %.pv.bin,%.parmfile,$@) $(comm-key) $(GENPROTIMG) $(genprotimg_args) --parmfile $(patsubst %.pv.bin,%.parmfile,$@) --image $< -o $@ -%.pv.bin: %.bin $(HOST_KEY_DOCUMENT) +%.pv.bin: %.bin $(HOST_KEY_DOCUMENT) $(comm-key) $(GENPROTIMG) $(genprotimg_args) --image $< -o $@ $(snippet_asmlib): $$(patsubst %.o,%.S,$$@) $(asm-offsets) @@ -177,7 +190,7 @@ $(snippet_asmlib): $$(patsubst %.o,%.S,$$@) $(asm-offsets) arch_clean: asm_offsets_clean - $(RM) $(TEST_DIR)/*.{o,elf,bin} $(SNIPPET_DIR)/*/*.{o,elf,*bin,*obj,hdr} $(SNIPPET_DIR)/asm/.*.d $(TEST_DIR)/.*.d lib/s390x/.*.d + $(RM) $(TEST_DIR)/*.{o,elf,bin} $(SNIPPET_DIR)/*/*.{o,elf,*bin,*obj,hdr} $(SNIPPET_DIR)/asm/.*.d $(TEST_DIR)/.*.d lib/s390x/.*.d $(comm-key) generated-files = $(asm-offsets) $(tests:.elf=.o) $(asmlib) $(cflatobjs): $(generated-files) -- 2.36.1 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [kvm-unit-tests PATCH v1 2/2] s390x: create persistent comm-key 2022-07-21 13:26 ` [kvm-unit-tests PATCH v1 2/2] s390x: create persistent comm-key Nico Boehr @ 2022-07-21 16:32 ` Claudio Imbrenda 2022-07-22 7:31 ` Nico Boehr 2022-08-24 8:15 ` Janosch Frank 1 sibling, 1 reply; 7+ messages in thread From: Claudio Imbrenda @ 2022-07-21 16:32 UTC (permalink / raw) To: Nico Boehr; +Cc: kvm, frankja, thuth On Thu, 21 Jul 2022 15:26:47 +0200 Nico Boehr <nrb@linux.ibm.com> wrote: > To decrypt the dump of a PV guest, the comm-key (CCK) is required. Until > now, no comm-key was provided to genprotimg, therefore decrypting the > dump of a kvm-unit-test under PV was not possible. > > This patch makes sure that we create a random CCK if there's no > $(TEST_DIR)/comm.key file. > > Also allow dumping of PV tests by passing the appropriate PCF to > genprotimg (bit 34). --x-pcf is used to be compatible with older > genprotimg versions, which don't support --enable-dump. 0xe0 is the > default PCF value and only bit 34 is added. > > Unfortunately, recent versions of genprotimg removed the --x-comm-key > argument which was used by older versions to specify the CCK. To support > these versions, we need to parse the genprotimg help output and decide > which argument to use. I wonder if we can simply support only the newest version? would make the code cleaner, and updating genprotimg is not too complicated [...] ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [kvm-unit-tests PATCH v1 2/2] s390x: create persistent comm-key 2022-07-21 16:32 ` Claudio Imbrenda @ 2022-07-22 7:31 ` Nico Boehr 0 siblings, 0 replies; 7+ messages in thread From: Nico Boehr @ 2022-07-22 7:31 UTC (permalink / raw) To: Claudio Imbrenda; +Cc: kvm, frankja, thuth Quoting Claudio Imbrenda (2022-07-21 18:32:45) > On Thu, 21 Jul 2022 15:26:47 +0200 > Nico Boehr <nrb@linux.ibm.com> wrote: > > > To decrypt the dump of a PV guest, the comm-key (CCK) is required. Until > > now, no comm-key was provided to genprotimg, therefore decrypting the > > dump of a kvm-unit-test under PV was not possible. > > > > This patch makes sure that we create a random CCK if there's no > > $(TEST_DIR)/comm.key file. > > > > Also allow dumping of PV tests by passing the appropriate PCF to > > genprotimg (bit 34). --x-pcf is used to be compatible with older > > genprotimg versions, which don't support --enable-dump. 0xe0 is the > > default PCF value and only bit 34 is added. > > > > Unfortunately, recent versions of genprotimg removed the --x-comm-key > > argument which was used by older versions to specify the CCK. To support > > these versions, we need to parse the genprotimg help output and decide > > which argument to use. > > I wonder if we can simply support only the newest version? > would make the code cleaner, and updating genprotimg is not too > complicated I would be annoyed by having to compile s390-tools every time I want to run PV tests on older distros. If we want to avoid the --help parsing stuff, we could add a configure option to disable PV dump support. Not sure if it's a good idea. ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [kvm-unit-tests PATCH v1 2/2] s390x: create persistent comm-key 2022-07-21 13:26 ` [kvm-unit-tests PATCH v1 2/2] s390x: create persistent comm-key Nico Boehr 2022-07-21 16:32 ` Claudio Imbrenda @ 2022-08-24 8:15 ` Janosch Frank 1 sibling, 0 replies; 7+ messages in thread From: Janosch Frank @ 2022-08-24 8:15 UTC (permalink / raw) To: Nico Boehr, kvm; +Cc: imbrenda, thuth On 7/21/22 15:26, Nico Boehr wrote: > To decrypt the dump of a PV guest, the comm-key (CCK) is required. Until > now, no comm-key was provided to genprotimg, therefore decrypting the > dump of a kvm-unit-test under PV was not possible. > > This patch makes sure that we create a random CCK if there's no > $(TEST_DIR)/comm.key file. > > Also allow dumping of PV tests by passing the appropriate PCF to > genprotimg (bit 34). --x-pcf is used to be compatible with older > genprotimg versions, which don't support --enable-dump. 0xe0 is the > default PCF value and only bit 34 is added. > > Unfortunately, recent versions of genprotimg removed the --x-comm-key > argument which was used by older versions to specify the CCK. To support > these versions, we need to parse the genprotimg help output and decide > which argument to use. > > Signed-off-by: Nico Boehr <nrb@linux.ibm.com> > --- > s390x/Makefile | 21 +++++++++++++++++---- > 1 file changed, 17 insertions(+), 4 deletions(-) > > diff --git a/s390x/Makefile b/s390x/Makefile > index 34de233d09b8..5e3cb5a47bc2 100644 > --- a/s390x/Makefile > +++ b/s390x/Makefile > @@ -162,14 +162,27 @@ $(SNIPPET_DIR)/c/%.hdr: $(SNIPPET_DIR)/c/%.gbin $(HOST_KEY_DOCUMENT) > $(RM) $(@:.elf=.aux.o) > @chmod a-x $@ > Add comment along the lines of: Secure Execution Customer Communication Key file 32 bytes of key material, uses existing one if available > +comm-key = $(TEST_DIR)/comm.key > +$(comm-key): > + dd if=/dev/urandom of=$@ bs=32 count=1 status=none > + > %.bin: %.elf > $(OBJCOPY) -O binary $< $@ > > -genprotimg_args = --host-key-document $(HOST_KEY_DOCUMENT) --no-verify > -%selftest.pv.bin: %selftest.bin $(HOST_KEY_DOCUMENT) $(patsubst %.pv.bin,%.parmfile,$@) > +GENPROTIMG_HAS_COMM_KEY = $(shell $(GENPROTIMG) --help | grep -q -- --comm-key && echo yes) > +ifeq ($(GENPROTIMG_HAS_COMM_KEY),yes) > + GENPROTIMG_COMM_KEY = --comm-key $(comm-key) > +else > + GENPROTIMG_COMM_KEY = --x-comm-key $(comm-key) > +endif > +# use x-pcf to be compatible with old genprotimg versions > +# allow dumping + PCKMO > +genprotimg_pcf = 0x200000e0 > +genprotimg_args = --host-key-document $(HOST_KEY_DOCUMENT) --no-verify $(GENPROTIMG_COMM_KEY) --x-pcf $(genprotimg_pcf) \n We might need to fix that in patch #1. > +%selftest.pv.bin: %selftest.bin $(HOST_KEY_DOCUMENT) $(patsubst %.pv.bin,%.parmfile,$@) $(comm-key) > $(GENPROTIMG) $(genprotimg_args) --parmfile $(patsubst %.pv.bin,%.parmfile,$@) --image $< -o $@ > > -%.pv.bin: %.bin $(HOST_KEY_DOCUMENT) > +%.pv.bin: %.bin $(HOST_KEY_DOCUMENT) $(comm-key) > $(GENPROTIMG) $(genprotimg_args) --image $< -o $@ > > $(snippet_asmlib): $$(patsubst %.o,%.S,$$@) $(asm-offsets) > @@ -177,7 +190,7 @@ $(snippet_asmlib): $$(patsubst %.o,%.S,$$@) $(asm-offsets) > > > arch_clean: asm_offsets_clean > - $(RM) $(TEST_DIR)/*.{o,elf,bin} $(SNIPPET_DIR)/*/*.{o,elf,*bin,*obj,hdr} $(SNIPPET_DIR)/asm/.*.d $(TEST_DIR)/.*.d lib/s390x/.*.d > + $(RM) $(TEST_DIR)/*.{o,elf,bin} $(SNIPPET_DIR)/*/*.{o,elf,*bin,*obj,hdr} $(SNIPPET_DIR)/asm/.*.d $(TEST_DIR)/.*.d lib/s390x/.*.d $(comm-key) > > generated-files = $(asm-offsets) > $(tests:.elf=.o) $(asmlib) $(cflatobjs): $(generated-files) ^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2022-08-24 8:16 UTC | newest] Thread overview: 7+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2022-07-21 13:26 [kvm-unit-tests PATCH v1 0/2] s390x: dump support for PV tests Nico Boehr 2022-07-21 13:26 ` [kvm-unit-tests PATCH v1 1/2] s390x: factor out common args for genprotimg Nico Boehr 2022-07-21 16:30 ` Claudio Imbrenda 2022-07-21 13:26 ` [kvm-unit-tests PATCH v1 2/2] s390x: create persistent comm-key Nico Boehr 2022-07-21 16:32 ` Claudio Imbrenda 2022-07-22 7:31 ` Nico Boehr 2022-08-24 8:15 ` Janosch Frank
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox