Commit 1c482452 authored by Paolo Bonzini's avatar Paolo Bonzini
Browse files

Merge tag 'kvm-s390-next-5.7-1' of... 

Merge tag 'kvm-s390-next-5.7-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD

KVM: s390: Features and Enhancements for 5.7 part1

1. Allow to disable gisa
2. protected virtual machines
  Protected VMs (PVM) are KVM VMs, where KVM can't access the VM's
  state like guest memory and guest registers anymore. Instead the
  PVMs are mostly managed by a new entity called Ultravisor (UV),
  which provides an API, so KVM and the PV can request management
  actions.

  PVMs are encrypted at rest and protected from hypervisor access
  while running.  They switch from a normal operation into protected
  mode, so we can still use the standard boot process to load a
  encrypted blob and then move it into protected mode.

  Rebooting is only possible by passing through the unprotected/normal
  mode and switching to protected again.

  One mm related patch will go via Andrews mm tree ( mm/gup/writeback:
  add callbacks for inaccessible pages)
parents 6d05a965 cc674ef2

Documentation/admin-guide/kernel-parameters.txt

+5 −0
Original line number Diff line number Diff line
@@ -3795,6 +3795,11 @@ 
			before loading.

			See Documentation/admin-guide/blockdev/ramdisk.rst.



	prot_virt=	[S390] enable hosting protected virtual machines

			isolated from the hypervisor (if hardware supports

			that).

			Format: <bool>



	psi=		[KNL] Enable or disable pressure stall information

			tracking.

			Format: <bool>

Documentation/devicetree/bindings/input/ilitek,ili2xxx.txt

+2 −1
Original line number Diff line number Diff line 
Ilitek ILI210x/ILI2117/ILI251x touchscreen controller

Ilitek ILI210x/ILI2117/ILI2120/ILI251x touchscreen controller



Required properties:

- compatible:

    ilitek,ili210x for ILI210x

    ilitek,ili2117 for ILI2117

    ilitek,ili2120 for ILI2120

    ilitek,ili251x for ILI251x



- reg: The I2C address of the device

Documentation/driver-api/ipmb.rst

+4 −0
Original line number Diff line number Diff line
@@ -71,9 +71,13 @@ b) Example for device tree:: 
            ipmb@10 {

                    compatible = "ipmb-dev";

                    reg = <0x10>;

                    i2c-protocol;

            };

     };



If xmit of data to be done using raw i2c block vs smbus

then "i2c-protocol" needs to be defined as above.



2) Manually from Linux::



     modprobe ipmb-dev-int

Documentation/virt/kvm/api.rst

+63 −2
Original line number Diff line number Diff line
@@ -2110,7 +2110,8 @@ Errors: 


  ======   ============================================================

  ENOENT   no such register

  EINVAL   invalid register ID, or no such register

  EINVAL   invalid register ID, or no such register or used with VMs in

           protected virtualization mode on s390

  EPERM    (arm64) register access not allowed before vcpu finalization

  ======   ============================================================
@@ -2545,7 +2546,8 @@ Errors include: 


  ======== ============================================================

  ENOENT   no such register

  EINVAL   invalid register ID, or no such register

  EINVAL   invalid register ID, or no such register or used with VMs in

           protected virtualization mode on s390

  EPERM    (arm64) register access not allowed before vcpu finalization

  ======== ============================================================
@@ -4635,6 +4637,54 @@ the clear cpu reset definition in the POP. However, the cpu is not put 
into ESA mode. This reset is a superset of the initial reset.





4.125 KVM_S390_PV_COMMAND

-------------------------



:Capability: KVM_CAP_S390_PROTECTED

:Architectures: s390

:Type: vm ioctl

:Parameters: struct kvm_pv_cmd

:Returns: 0 on success, < 0 on error



::



  struct kvm_pv_cmd {

	__u32 cmd;	/* Command to be executed */

	__u16 rc;	/* Ultravisor return code */

	__u16 rrc;	/* Ultravisor return reason code */

	__u64 data;	/* Data or address */

	__u32 flags;    /* flags for future extensions. Must be 0 for now */

	__u32 reserved[3];

  };



cmd values:



KVM_PV_ENABLE

  Allocate memory and register the VM with the Ultravisor, thereby

  donating memory to the Ultravisor that will become inaccessible to

  KVM. All existing CPUs are converted to protected ones. After this

  command has succeeded, any CPU added via hotplug will become

  protected during its creation as well.



KVM_PV_DISABLE



  Deregister the VM from the Ultravisor and reclaim the memory that

  had been donated to the Ultravisor, making it usable by the kernel

  again.  All registered VCPUs are converted back to non-protected

  ones.



KVM_PV_VM_SET_SEC_PARMS

  Pass the image header from VM memory to the Ultravisor in

  preparation of image unpacking and verification.



KVM_PV_VM_UNPACK

  Unpack (protect and decrypt) a page of the encrypted boot image.



KVM_PV_VM_VERIFY

  Verify the integrity of the unpacked image. Only if this succeeds,

  KVM is allowed to start protected VCPUs.





5. The kvm_run structure

========================
@@ -6025,3 +6075,14 @@ Architectures: s390 


This capability indicates that the KVM_S390_NORMAL_RESET and

KVM_S390_CLEAR_RESET ioctls are available.



8.23 KVM_CAP_S390_PROTECTED



Architecture: s390





This capability indicates that the Ultravisor has been initialized and

KVM can therefore start protected VMs.

This capability governs the KVM_S390_PV_COMMAND ioctl and the

KVM_MP_STATE_LOAD MP_STATE. KVM_SET_MP_STATE can fail for protected

guests when the state change is invalid.

Documentation/virt/kvm/devices/s390_flic.rst

+2 −9
Original line number Diff line number Diff line
@@ -108,16 +108,9 @@ Groups: 
      mask or unmask the adapter, as specified in mask



    KVM_S390_IO_ADAPTER_MAP

      perform a gmap translation for the guest address provided in addr,

      pin a userspace page for the translated address and add it to the

      list of mappings



      .. note:: A new mapping will be created unconditionally; therefore,

	        the calling code should avoid making duplicate mappings.



      This is now a no-op. The mapping is purely done by the irq route.

    KVM_S390_IO_ADAPTER_UNMAP

      release a userspace page for the translated address specified in addr

      from the list of mappings

      This is now a no-op. The mapping is purely done by the irq route.



  KVM_DEV_FLIC_AISM

    modify the adapter-interruption-suppression mode for a given isc if the

CRA Git | Maintained and supported by SUSTech CRA and CCSE