* [GIT PULL 1/4] s390/uvdevice: Report additional-data length for attestation
2024-01-02 13:34 [GIT PULL 0/4] KVM: s390: Changes for 6.8 Janosch Frank
@ 2024-01-02 13:34 ` Janosch Frank
2024-01-02 13:34 ` [GIT PULL 2/4] KVM: s390: vsie: Fix STFLE interpretive execution identification Janosch Frank
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Janosch Frank @ 2024-01-02 13:34 UTC (permalink / raw)
To: pbonzini
Cc: kvm, frankja, david, borntraeger, cohuck, linux-s390, imbrenda,
seiden, nsg
From: Steffen Eiden <seiden@linux.ibm.com>
Additional data length in the attestation request is an in/out variable.
Software provides the capacity of the buffer. Upon successful request,
firmware reports the actual bytes written to the additional data in that
field. This information is lost, as the length field was not copied back
to userspace before. Attestation might fail, if user space did not
specify the exact amount of needed bytes required, as this length is
part of the attestation measurement.
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
Link: https://lore.kernel.org/r/20231106124922.3032370-1-seiden@linux.ibm.com
Message-Id: <20231106124922.3032370-1-seiden@linux.ibm.com>
Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
---
drivers/s390/char/uvdevice.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/s390/char/uvdevice.c b/drivers/s390/char/uvdevice.c
index 144cd2e03590..42c9f77f8da0 100644
--- a/drivers/s390/char/uvdevice.c
+++ b/drivers/s390/char/uvdevice.c
@@ -109,6 +109,7 @@ static int uvio_copy_attest_result_to_user(struct uv_cb_attest *uvcb_attest,
struct uvio_attest *uvio_attest)
{
struct uvio_attest __user *user_uvio_attest = (void __user *)uv_ioctl->argument_addr;
+ u32 __user *user_buf_add_len = (u32 __user *)&user_uvio_attest->add_data_len;
void __user *user_buf_add = (void __user *)uvio_attest->add_data_addr;
void __user *user_buf_meas = (void __user *)uvio_attest->meas_addr;
void __user *user_buf_uid = &user_uvio_attest->config_uid;
@@ -117,6 +118,8 @@ static int uvio_copy_attest_result_to_user(struct uv_cb_attest *uvcb_attest,
return -EFAULT;
if (add_data && copy_to_user(user_buf_add, add_data, uvio_attest->add_data_len))
return -EFAULT;
+ if (put_user(uvio_attest->add_data_len, user_buf_add_len))
+ return -EFAULT;
if (copy_to_user(user_buf_uid, uvcb_attest->config_uid, sizeof(uvcb_attest->config_uid)))
return -EFAULT;
return 0;
--
2.43.0
^ permalink raw reply related [flat|nested] 6+ messages in thread* [GIT PULL 2/4] KVM: s390: vsie: Fix STFLE interpretive execution identification
2024-01-02 13:34 [GIT PULL 0/4] KVM: s390: Changes for 6.8 Janosch Frank
2024-01-02 13:34 ` [GIT PULL 1/4] s390/uvdevice: Report additional-data length for attestation Janosch Frank
@ 2024-01-02 13:34 ` Janosch Frank
2024-01-02 13:34 ` [GIT PULL 3/4] KVM: s390: vsie: Fix length of facility list shadowed Janosch Frank
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Janosch Frank @ 2024-01-02 13:34 UTC (permalink / raw)
To: pbonzini
Cc: kvm, frankja, david, borntraeger, cohuck, linux-s390, imbrenda,
seiden, nsg
From: Nina Schoetterl-Glausch <nsg@linux.ibm.com>
STFLE can be interpretively executed.
This occurs when the facility list designation is unequal to zero.
Perform the check before applying the address mask instead of after.
Fixes: 66b630d5b7f2 ("KVM: s390: vsie: support STFLE interpretation")
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Acked-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
Link: https://lore.kernel.org/r/20231219140854.1042599-2-nsg@linux.ibm.com
Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
Message-ID: <20231219140854.1042599-2-nsg@linux.ibm.com>
---
arch/s390/kvm/vsie.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c
index 02dcbe82a8e5..3cf95bc0401d 100644
--- a/arch/s390/kvm/vsie.c
+++ b/arch/s390/kvm/vsie.c
@@ -988,10 +988,15 @@ static void retry_vsie_icpt(struct vsie_page *vsie_page)
static int handle_stfle(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
{
struct kvm_s390_sie_block *scb_s = &vsie_page->scb_s;
- __u32 fac = READ_ONCE(vsie_page->scb_o->fac) & 0x7ffffff8U;
+ __u32 fac = READ_ONCE(vsie_page->scb_o->fac);
if (fac && test_kvm_facility(vcpu->kvm, 7)) {
retry_vsie_icpt(vsie_page);
+ /*
+ * The facility list origin (FLO) is in bits 1 - 28 of the FLD
+ * so we need to mask here before reading.
+ */
+ fac = fac & 0x7ffffff8U;
if (read_guest_real(vcpu, fac, &vsie_page->fac,
sizeof(vsie_page->fac)))
return set_validity_icpt(scb_s, 0x1090U);
--
2.43.0
^ permalink raw reply related [flat|nested] 6+ messages in thread* [GIT PULL 3/4] KVM: s390: vsie: Fix length of facility list shadowed
2024-01-02 13:34 [GIT PULL 0/4] KVM: s390: Changes for 6.8 Janosch Frank
2024-01-02 13:34 ` [GIT PULL 1/4] s390/uvdevice: Report additional-data length for attestation Janosch Frank
2024-01-02 13:34 ` [GIT PULL 2/4] KVM: s390: vsie: Fix STFLE interpretive execution identification Janosch Frank
@ 2024-01-02 13:34 ` Janosch Frank
2024-01-02 13:34 ` [GIT PULL 4/4] KVM: s390: cpu model: Use proper define for facility mask size Janosch Frank
2024-01-02 18:19 ` [GIT PULL 0/4] KVM: s390: Changes for 6.8 Paolo Bonzini
4 siblings, 0 replies; 6+ messages in thread
From: Janosch Frank @ 2024-01-02 13:34 UTC (permalink / raw)
To: pbonzini
Cc: kvm, frankja, david, borntraeger, cohuck, linux-s390, imbrenda,
seiden, nsg
From: Nina Schoetterl-Glausch <nsg@linux.ibm.com>
The length of the facility list accessed when interpretively executing
STFLE is the same as the hosts facility list (in case of format-0)
The memory following the facility list doesn't need to be accessible.
The current VSIE implementation accesses a fixed length that exceeds the
guest/host facility list length and can therefore wrongly inject a
validity intercept.
Instead, find out the host facility list length by running STFLE and
copy only as much as necessary when shadowing.
Acked-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Acked-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com>
Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
Link: https://lore.kernel.org/r/20231219140854.1042599-3-nsg@linux.ibm.com
Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
Message-ID: <20231219140854.1042599-3-nsg@linux.ibm.com>
---
arch/s390/include/asm/facility.h | 6 ++++++
arch/s390/kernel/Makefile | 2 +-
arch/s390/kernel/facility.c | 21 +++++++++++++++++++++
arch/s390/kvm/vsie.c | 12 +++++++++++-
4 files changed, 39 insertions(+), 2 deletions(-)
create mode 100644 arch/s390/kernel/facility.c
diff --git a/arch/s390/include/asm/facility.h b/arch/s390/include/asm/facility.h
index 94b6919026df..796007125dff 100644
--- a/arch/s390/include/asm/facility.h
+++ b/arch/s390/include/asm/facility.h
@@ -111,4 +111,10 @@ static inline void stfle(u64 *stfle_fac_list, int size)
preempt_enable();
}
+/**
+ * stfle_size - Actual size of the facility list as specified by stfle
+ * (number of double words)
+ */
+unsigned int stfle_size(void);
+
#endif /* __ASM_FACILITY_H */
diff --git a/arch/s390/kernel/Makefile b/arch/s390/kernel/Makefile
index 353def93973b..7a562b4199c8 100644
--- a/arch/s390/kernel/Makefile
+++ b/arch/s390/kernel/Makefile
@@ -41,7 +41,7 @@ obj-y += sysinfo.o lgr.o os_info.o ctlreg.o
obj-y += runtime_instr.o cache.o fpu.o dumpstack.o guarded_storage.o sthyi.o
obj-y += entry.o reipl.o kdebugfs.o alternative.o
obj-y += nospec-branch.o ipl_vmparm.o machine_kexec_reloc.o unwind_bc.o
-obj-y += smp.o text_amode31.o stacktrace.o abs_lowcore.o
+obj-y += smp.o text_amode31.o stacktrace.o abs_lowcore.o facility.o
extra-y += vmlinux.lds
diff --git a/arch/s390/kernel/facility.c b/arch/s390/kernel/facility.c
new file mode 100644
index 000000000000..f02127219a27
--- /dev/null
+++ b/arch/s390/kernel/facility.c
@@ -0,0 +1,21 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Copyright IBM Corp. 2023
+ */
+
+#include <asm/facility.h>
+
+unsigned int stfle_size(void)
+{
+ static unsigned int size;
+ unsigned int r;
+ u64 dummy;
+
+ r = READ_ONCE(size);
+ if (!r) {
+ r = __stfle_asm(&dummy, 1) + 1;
+ WRITE_ONCE(size, r);
+ }
+ return r;
+}
+EXPORT_SYMBOL(stfle_size);
diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c
index 3cf95bc0401d..aa8f4ab11e33 100644
--- a/arch/s390/kvm/vsie.c
+++ b/arch/s390/kvm/vsie.c
@@ -19,6 +19,7 @@
#include <asm/nmi.h>
#include <asm/dis.h>
#include <asm/fpu/api.h>
+#include <asm/facility.h>
#include "kvm-s390.h"
#include "gaccess.h"
@@ -990,6 +991,10 @@ static int handle_stfle(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
struct kvm_s390_sie_block *scb_s = &vsie_page->scb_s;
__u32 fac = READ_ONCE(vsie_page->scb_o->fac);
+ /*
+ * Alternate-STFLE-Interpretive-Execution facilities are not supported
+ * -> format-0 flcb
+ */
if (fac && test_kvm_facility(vcpu->kvm, 7)) {
retry_vsie_icpt(vsie_page);
/*
@@ -997,8 +1002,13 @@ static int handle_stfle(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
* so we need to mask here before reading.
*/
fac = fac & 0x7ffffff8U;
+ /*
+ * format-0 -> size of nested guest's facility list == guest's size
+ * guest's size == host's size, since STFLE is interpretatively executed
+ * using a format-0 for the guest, too.
+ */
if (read_guest_real(vcpu, fac, &vsie_page->fac,
- sizeof(vsie_page->fac)))
+ stfle_size() * sizeof(u64)))
return set_validity_icpt(scb_s, 0x1090U);
scb_s->fac = (__u32)(__u64) &vsie_page->fac;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 6+ messages in thread* [GIT PULL 4/4] KVM: s390: cpu model: Use proper define for facility mask size
2024-01-02 13:34 [GIT PULL 0/4] KVM: s390: Changes for 6.8 Janosch Frank
` (2 preceding siblings ...)
2024-01-02 13:34 ` [GIT PULL 3/4] KVM: s390: vsie: Fix length of facility list shadowed Janosch Frank
@ 2024-01-02 13:34 ` Janosch Frank
2024-01-02 18:19 ` [GIT PULL 0/4] KVM: s390: Changes for 6.8 Paolo Bonzini
4 siblings, 0 replies; 6+ messages in thread
From: Janosch Frank @ 2024-01-02 13:34 UTC (permalink / raw)
To: pbonzini
Cc: kvm, frankja, david, borntraeger, cohuck, linux-s390, imbrenda,
seiden, nsg
From: Nina Schoetterl-Glausch <nsg@linux.ibm.com>
Use the previously unused S390_ARCH_FAC_MASK_SIZE_U64 instead of
S390_ARCH_FAC_LIST_SIZE_U64 for defining the fac_mask array.
Note that both values are the same, there is no functional change.
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
Signed-off-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com>
Link: https://lore.kernel.org/r/20231219140854.1042599-4-nsg@linux.ibm.com
Signed-off-by: Janosch Frank <frankja@linux.ibm.com>
Message-ID: <20231219140854.1042599-4-nsg@linux.ibm.com>
---
arch/s390/include/asm/kvm_host.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/s390/include/asm/kvm_host.h b/arch/s390/include/asm/kvm_host.h
index 67a298b6cf6e..52664105a473 100644
--- a/arch/s390/include/asm/kvm_host.h
+++ b/arch/s390/include/asm/kvm_host.h
@@ -818,7 +818,7 @@ struct s390_io_adapter {
struct kvm_s390_cpu_model {
/* facility mask supported by kvm & hosting machine */
- __u64 fac_mask[S390_ARCH_FAC_LIST_SIZE_U64];
+ __u64 fac_mask[S390_ARCH_FAC_MASK_SIZE_U64];
struct kvm_s390_vm_cpu_subfunc subfuncs;
/* facility list requested by guest (in dma page) */
__u64 *fac_list;
--
2.43.0
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [GIT PULL 0/4] KVM: s390: Changes for 6.8
2024-01-02 13:34 [GIT PULL 0/4] KVM: s390: Changes for 6.8 Janosch Frank
` (3 preceding siblings ...)
2024-01-02 13:34 ` [GIT PULL 4/4] KVM: s390: cpu model: Use proper define for facility mask size Janosch Frank
@ 2024-01-02 18:19 ` Paolo Bonzini
4 siblings, 0 replies; 6+ messages in thread
From: Paolo Bonzini @ 2024-01-02 18:19 UTC (permalink / raw)
To: Janosch Frank
Cc: kvm, david, borntraeger, cohuck, linux-s390, imbrenda, seiden,
nsg
On Tue, Jan 2, 2024 at 2:37 PM Janosch Frank <frankja@linux.ibm.com> wrote:
>
> Dear Paolo,
>
> please pull the following changes for 6.8.
>
> The changes are fixes/cleanups that didn't require a fix pull and
> hence landed in next.
>
> -The uvdevice didn't return a firmware return value to
> userspace. This didn't matter since that value was unused but might
> be used in the future.
>
> -The stfle vsie code was not 100% spec compliant because it checked
> for readability of an area that was larger than the one accessed by
> firmware. Additionally there was an issue with a mask being applied
> to early.
>
> The following changes since commit 98b1cc82c4affc16f5598d4fa14b1858671b2263:
>
> Linux 6.7-rc2 (2023-11-19 15:02:14 -0800)
>
> are available in the Git repository at:
>
> https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux.git tags/kvm-s390-next-6.8-1
>
> for you to fetch changes up to 10f7b1dcdfe05efcd26e90e337daf1bfd8f4a6da:
>
> KVM: s390: cpu model: Use proper define for facility mask size (2023-12-23 10:41:09 +0100)
>
> ----------------------------------------------------------------
> - uvdevice fixed additional data return length (Steffen)
> - stfle (feature indication) vsie fixes and minor cleanup (Nina)
> ----------------------------------------------------------------
Pulled, thanks.
Paolo
^ permalink raw reply [flat|nested] 6+ messages in thread