Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Thu, 10 Feb 2022 17:33:49 +0100
From:   Claudio Imbrenda <imbrenda@linux.ibm.com>
To:     Janis Schoetterl-Glausch <scgl@linux.ibm.com>
Cc:     Christian Borntraeger <borntraeger@linux.ibm.com>,
        Heiko Carstens <hca@linux.ibm.com>,
        Janosch Frank <frankja@linux.ibm.com>,
        Alexander Gordeev <agordeev@linux.ibm.com>,
        David Hildenbrand <david@redhat.com>,
        Jonathan Corbet <corbet@lwn.net>, kvm@vger.kernel.org,
        linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org,
        linux-s390@vger.kernel.org, Paolo Bonzini <pbonzini@redhat.com>,
        Sven Schnelle <svens@linux.ibm.com>,
        Vasily Gorbik <gor@linux.ibm.com>
Subject: Re: [PATCH v3 05/10] KVM: s390: Add optional storage key checking
 to MEMOP IOCTL
Message-ID: <20220210173349.6f498780@p-imbrenda>
In-Reply-To: <0310d3c8-7dd3-a840-9c54-f4de35a6b465@linux.ibm.com>
References: <20220209170422.1910690-1-scgl@linux.ibm.com>
        <20220209170422.1910690-6-scgl@linux.ibm.com>
        <0310d3c8-7dd3-a840-9c54-f4de35a6b465@linux.ibm.com>
Organization: IBM
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Precedence: bulk

On Thu, 10 Feb 2022 12:59:03 +0100
Janis Schoetterl-Glausch <scgl@linux.ibm.com> wrote:

> On 2/9/22 18:04, Janis Schoetterl-Glausch wrote:
> > User space needs a mechanism to perform key checked accesses when
> > emulating instructions.
> > 
> > The key can be passed as an additional argument.
> > Having an additional argument is flexible, as user space can
> > pass the guest PSW's key, in order to make an access the same way the
> > CPU would, or pass another key if necessary.
> > 
> > Signed-off-by: Janis Schoetterl-Glausch <scgl@linux.ibm.com>
> > Acked-by: Janosch Frank <frankja@linux.ibm.com>
> > Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
> > ---
> >  arch/s390/kvm/kvm-s390.c | 30 ++++++++++++++++++++----------
> >  include/uapi/linux/kvm.h |  6 +++++-
> >  2 files changed, 25 insertions(+), 11 deletions(-)
> > 
> > diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
> > index cf347e1a4f17..85763ec7bc60 100644
> > --- a/arch/s390/kvm/kvm-s390.c
> > +++ b/arch/s390/kvm/kvm-s390.c
> > @@ -32,6 +32,7 @@
> >  #include <linux/sched/signal.h>
> >  #include <linux/string.h>
> >  #include <linux/pgtable.h>
> > +#include <linux/bitfield.h>
> >  
> >  #include <asm/asm-offsets.h>
> >  #include <asm/lowcore.h>
> > @@ -2359,6 +2360,11 @@ static int kvm_s390_handle_pv(struct kvm *kvm, struct kvm_pv_cmd *cmd)
> >  	return r;
> >  }
> >  
> > +static bool access_key_invalid(u8 access_key)
> > +{
> > +	return access_key > 0xf;
> > +}
> > +
> >  long kvm_arch_vm_ioctl(struct file *filp,
> >  		       unsigned int ioctl, unsigned long arg)
> >  {
> > @@ -4690,17 +4696,19 @@ static long kvm_s390_guest_mem_op(struct kvm_vcpu *vcpu,
> >  	void *tmpbuf = NULL;
> >  	int r = 0;
> >  	const u64 supported_flags = KVM_S390_MEMOP_F_INJECT_EXCEPTION
> > -				    | KVM_S390_MEMOP_F_CHECK_ONLY;
> > +				    | KVM_S390_MEMOP_F_CHECK_ONLY
> > +				    | KVM_S390_MEMOP_F_SKEY_PROTECTION;
> >  
> >  	if (mop->flags & ~supported_flags || mop->ar >= NUM_ACRS || !mop->size)
> >  		return -EINVAL;
> > -
> >  	if (mop->size > MEM_OP_MAX_SIZE)
> >  		return -E2BIG;
> > -
> >  	if (kvm_s390_pv_cpu_is_protected(vcpu))
> >  		return -EINVAL;
> > -
> > +	if (mop->flags & KVM_S390_MEMOP_F_SKEY_PROTECTION) {
> > +		if (access_key_invalid(mop->key))
> > +			return -EINVAL;  
> 
> I got this wrong unfortunately, we need to explicitly default to key 0, i.e.
> +       } else {
> +               mop->key = 0;
> Same for the vm memop.
> Didn't have a test case for this, yet.

you can keep my r-b once you fix this (and the spurious include)

> > +	}>  	if (!(mop->flags & KVM_S390_MEMOP_F_CHECK_ONLY)) {
> >  		tmpbuf = vmalloc(mop->size);
> >  		if (!tmpbuf)
> > @@ -4710,11 +4718,12 @@ static long kvm_s390_guest_mem_op(struct kvm_vcpu *vcpu,
> >  	switch (mop->op) {
> >  	case KVM_S390_MEMOP_LOGICAL_READ:
> >  		if (mop->flags & KVM_S390_MEMOP_F_CHECK_ONLY) {
> > -			r = check_gva_range(vcpu, mop->gaddr, mop->ar,
> > -					    mop->size, GACC_FETCH, 0);
> > +			r = check_gva_range(vcpu, mop->gaddr, mop->ar, mop->size,
> > +					    GACC_FETCH, mop->key);
> >  			break;
> >  		}
> > -		r = read_guest(vcpu, mop->gaddr, mop->ar, tmpbuf, mop->size);
> > +		r = read_guest_with_key(vcpu, mop->gaddr, mop->ar, tmpbuf,
> > +					mop->size, mop->key);
> >  		if (r == 0) {
> >  			if (copy_to_user(uaddr, tmpbuf, mop->size))
> >  				r = -EFAULT;
> > @@ -4722,15 +4731,16 @@ static long kvm_s390_guest_mem_op(struct kvm_vcpu *vcpu,
> >  		break;
> >  	case KVM_S390_MEMOP_LOGICAL_WRITE:
> >  		if (mop->flags & KVM_S390_MEMOP_F_CHECK_ONLY) {
> > -			r = check_gva_range(vcpu, mop->gaddr, mop->ar,
> > -					    mop->size, GACC_STORE, 0);
> > +			r = check_gva_range(vcpu, mop->gaddr, mop->ar, mop->size,
> > +					    GACC_STORE, mop->key);
> >  			break;
> >  		}
> >  		if (copy_from_user(tmpbuf, uaddr, mop->size)) {
> >  			r = -EFAULT;
> >  			break;
> >  		}
> > -		r = write_guest(vcpu, mop->gaddr, mop->ar, tmpbuf, mop->size);
> > +		r = write_guest_with_key(vcpu, mop->gaddr, mop->ar, tmpbuf,
> > +					 mop->size, mop->key);
> >  		break;
> >  	}
> >    
> 
> [...]