Received-SPF: pass (google.com: domain of linux-kernel+bounces-155578-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
Received-SPF: Pass (protection.outlook.com: domain of amd.com designates
 165.204.84.17 as permitted sender) receiver=protection.outlook.com;
 client-ip=165.204.84.17; helo=SATLEXMB04.amd.com; pr=C
Content-Type: text/plain; charset="utf-8"
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
In-Reply-To: <20240421180122.1650812-1-michael.roth@amd.com>
References: <20240421180122.1650812-1-michael.roth@amd.com>
Subject: Re: [PATCH v14 00/22] Add AMD Secure Nested Paging (SEV-SNP) Hypervisor Support
From: Michael Roth <michael.roth@amd.com>
CC: <linux-coco@lists.linux.dev>, <linux-mm@kvack.org>,
	<linux-crypto@vger.kernel.org>, <x86@kernel.org>,
	<linux-kernel@vger.kernel.org>, <tglx@linutronix.de>, <mingo@redhat.com>,
	<jroedel@suse.de>, <thomas.lendacky@amd.com>, <hpa@zytor.com>,
	<ardb@kernel.org>, <pbonzini@redhat.com>, <seanjc@google.com>,
	<vkuznets@redhat.com>, <jmattson@google.com>, <luto@kernel.org>,
	<dave.hansen@linux.intel.com>, <slp@redhat.com>, <pgonda@google.com>,
	<peterz@infradead.org>, <srinivas.pandruvada@linux.intel.com>,
	<rientjes@google.com>, <dovmurik@linux.ibm.com>, <tobin@ibm.com>,
	<bp@alien8.de>, <vbabka@suse.cz>, <kirill@shutemov.name>,
	<ak@linux.intel.com>, <tony.luck@intel.com>,
	<sathyanarayanan.kuppuswamy@linux.intel.com>, <alpergun@google.com>,
	<jarkko@kernel.org>, <ashish.kalra@amd.com>, <nikunj.dadhania@amd.com>,
	<pankaj.gupta@amd.com>, <liam.merwick@oracle.com>
To: <kvm@vger.kernel.org>
Date: Tue, 23 Apr 2024 11:31:53 -0500
Message-ID: <171388991368.1780702.14461882076074410508@amd.com>
User-Agent: alot/0.9
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 23 Apr 2024 16:32:09.1474
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 02f30532-0467-4c79-fdf2-08dc63b2ebe6
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=3dd8961f-e488-4e60-8e11-a82d994e183d;Ip=[165.204.84.17];Helo=[SATLEXMB04.amd.com]
X-MS-Exchange-CrossTenant-AuthSource:
	CO1PEPF000042A7.namprd03.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH3PR12MB7594

Quoting Michael Roth (2024-04-21 13:01:00)
> This patchset is also available at:
>=20
>   https://github.com/amdese/linux/commits/snp-host-v14
>=20
> and is based on commit 20cc50a0410f (just before the v13 SNP patches) fro=
m:
>=20
>   https://git.kernel.org/pub/scm/virt/kvm/kvm.git/log/?h=3Dkvm-coco-queue
>=20
>=20
> Patch Layout
> ------------
>=20
> 01-04: These patches add some basic infrastructure and introduces a new
>        KVM_X86_SNP_VM vm_type to handle differences verses the existing
>        KVM_X86_SEV_VM and KVM_X86_SEV_ES_VM types.
>=20
> 05-07: These implement the KVM API to handle the creation of a
>        cryptographic launch context, encrypt/measure the initial image
>        into guest memory, and finalize it before launching it.
>=20
> 08-13: These implement handling for various guest-generated events such
>        as page state changes, onlining of additional vCPUs, etc.
>=20
> 14-17: These implement the gmem hooks needed to prepare gmem-allocated
>        pages before mapping them into guest private memory ranges as
>        well as cleaning them up prior to returning them to the host for
>        use as normal memory. Because this supplants certain activities
>        like issued WBINVDs during KVM MMU invalidations, there's also
>        a patch to avoid duplicating that work to avoid unecessary
>        overhead.
>=20
> 18:    With all the core support in place, the patch adds a kvm_amd module
>        parameter to enable SNP support.
>=20
> 19-22: These patches all deal with the servicing of guest requests to han=
dle
>        things like attestation, as well as some related host-management
>        interfaces.

I just sent an additional set of fixups, patches 23-29. These add some
additional input validation on GHCB requests, mainly ensuring that
SNP-specific requests from non-SNP guests result in an error as soon as
they are received rather than reaching an error state indirectly further
into the call stack.

It's a small diff (included below), but a bit of a pain to squash in
patch by patch due to close proximity with each other, so I've pushed an
updated branch here that already has them squashed in:

  https://github.com/amdese/linux/commits/snp-host-v14b

If preferred I can also resubmit as v15, just let me know.

Full diff is below.

Thanks!

-Mike


diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
index 1cec466e593b..1137a7f4136b 100644
--- a/arch/x86/kvm/svm/sev.c
+++ b/arch/x86/kvm/svm/sev.c
@@ -3280,6 +3280,8 @@ static int sev_es_validate_vmgexit(struct vcpu_svm *s=
vm)
 			goto vmgexit_err;
 		break;
 	case SVM_VMGEXIT_AP_CREATION:
+		if (!sev_snp_guest(vcpu->kvm))
+			goto vmgexit_err;
 		if (lower_32_bits(control->exit_info_1) !=3D SVM_VMGEXIT_AP_DESTROY)
 			if (!kvm_ghcb_rax_is_valid(svm))
 				goto vmgexit_err;
@@ -3289,10 +3291,19 @@ static int sev_es_validate_vmgexit(struct vcpu_svm =
*svm)
 	case SVM_VMGEXIT_AP_JUMP_TABLE:
 	case SVM_VMGEXIT_UNSUPPORTED_EVENT:
 	case SVM_VMGEXIT_HV_FEATURES:
-	case SVM_VMGEXIT_PSC:
 	case SVM_VMGEXIT_TERM_REQUEST:
+		break;
+	case SVM_VMGEXIT_PSC:
 	case SVM_VMGEXIT_GUEST_REQUEST:
+		if (!sev_snp_guest(vcpu->kvm))
+			goto vmgexit_err;
+		break;
 	case SVM_VMGEXIT_EXT_GUEST_REQUEST:
+		if (!sev_snp_guest(vcpu->kvm))
+			goto vmgexit_err;
+		if (!kvm_ghcb_rax_is_valid(svm) ||
+		    !kvm_ghcb_rbx_is_valid(svm))
+			goto vmgexit_err;
 		break;
 	default:
 		reason =3D GHCB_ERR_INVALID_EVENT;
@@ -3970,6 +3981,9 @@ static int sev_handle_vmgexit_msr_protocol(struct vcp=
u_svm *svm)
 				  GHCB_MSR_INFO_MASK, GHCB_MSR_INFO_POS);
 		break;
 	case GHCB_MSR_PREF_GPA_REQ:
+		if (!sev_snp_guest(vcpu->kvm))
+			goto out_terminate;
+
 		set_ghcb_msr_bits(svm, GHCB_MSR_PREF_GPA_NONE, GHCB_MSR_GPA_VALUE_MASK,
 				  GHCB_MSR_GPA_VALUE_POS);
 		set_ghcb_msr_bits(svm, GHCB_MSR_PREF_GPA_RESP, GHCB_MSR_INFO_MASK,
@@ -3978,6 +3992,9 @@ static int sev_handle_vmgexit_msr_protocol(struct vcp=
u_svm *svm)
 	case GHCB_MSR_REG_GPA_REQ: {
 		u64 gfn;
=20
+		if (!sev_snp_guest(vcpu->kvm))
+			goto out_terminate;
+
 		gfn =3D get_ghcb_msr_bits(svm, GHCB_MSR_GPA_VALUE_MASK,
 					GHCB_MSR_GPA_VALUE_POS);
=20
@@ -3990,6 +4007,9 @@ static int sev_handle_vmgexit_msr_protocol(struct vcp=
u_svm *svm)
 		break;
 	}
 	case GHCB_MSR_PSC_REQ:
+		if (!sev_snp_guest(vcpu->kvm))
+			goto out_terminate;
+
 		ret =3D snp_begin_psc_msr(vcpu, control->ghcb_gpa);
 		break;
 	case GHCB_MSR_TERM_REQ: {
@@ -4004,12 +4024,7 @@ static int sev_handle_vmgexit_msr_protocol(struct vc=
pu_svm *svm)
 		pr_info("SEV-ES guest requested termination: %#llx:%#llx\n",
 			reason_set, reason_code);
=20
-		vcpu->run->exit_reason =3D KVM_EXIT_SYSTEM_EVENT;
-		vcpu->run->system_event.type =3D KVM_SYSTEM_EVENT_SEV_TERM;
-		vcpu->run->system_event.ndata =3D 1;
-		vcpu->run->system_event.data[0] =3D control->ghcb_gpa;
-
-		return 0;
+		goto out_terminate;
 	}
 	default:
 		/* Error, keep GHCB MSR value as-is */
@@ -4020,6 +4035,14 @@ static int sev_handle_vmgexit_msr_protocol(struct vc=
pu_svm *svm)
 					    control->ghcb_gpa, ret);
=20
 	return ret;
+
+out_terminate:
+	vcpu->run->exit_reason =3D KVM_EXIT_SYSTEM_EVENT;
+	vcpu->run->system_event.type =3D KVM_SYSTEM_EVENT_SEV_TERM;
+	vcpu->run->system_event.ndata =3D 1;
+	vcpu->run->system_event.data[0] =3D control->ghcb_gpa;
+
+	return 0;
 }
=20
 int sev_handle_vmgexit(struct kvm_vcpu *vcpu)