From: Vishal Annapurve <[email protected]>
This change adds handling of HVA ranges to copy contents
to private memory while doing sev launch update data.
mem_attr array is updated during LAUNCH_UPDATE_DATA to ensure
that encrypted memory is marked as private.
Signed-off-by: Vishal Annapurve <[email protected]>
[mdr: use gfn_to_hva_memslot_prot() for shared GFN handler to deal with
read-only slots for ROMs]
Signed-off-by: Michael Roth <[email protected]>
---
arch/x86/kvm/svm/sev.c | 99 ++++++++++++++++++++++++++++++++++++----
include/linux/kvm_host.h | 1 +
virt/kvm/kvm_main.c | 27 ++++++++---
3 files changed, 111 insertions(+), 16 deletions(-)
diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
index 69dbf17f0d6a..a7e4e3005786 100644
--- a/arch/x86/kvm/svm/sev.c
+++ b/arch/x86/kvm/svm/sev.c
@@ -493,23 +493,26 @@ static unsigned long get_num_contig_pages(unsigned long idx,
return pages;
}
-static int sev_launch_update_data(struct kvm *kvm, struct kvm_sev_cmd *argp)
+static int sev_launch_update_shared_gfn_handler(struct kvm *kvm,
+ struct kvm_gfn_range *range,
+ struct kvm_sev_cmd *argp)
{
unsigned long vaddr, vaddr_end, next_vaddr, npages, pages, size, i;
struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info;
- struct kvm_sev_launch_update_data params;
struct sev_data_launch_update_data data;
struct page **inpages;
int ret;
- if (!sev_guest(kvm))
- return -ENOTTY;
-
- if (copy_from_user(¶ms, (void __user *)(uintptr_t)argp->data, sizeof(params)))
- return -EFAULT;
+ vaddr = gfn_to_hva_memslot_prot(range->slot, range->start, NULL);
+ pr_debug("%s: shared GFN: %llx, slot.id: %d, slot.base_gfn: %llx, slot.userspace_addr: %lx, slot.flags: %x, vaddr: %lx\n",
+ __func__, range->start, range->slot->id, range->slot->base_gfn,
+ range->slot->userspace_addr, range->slot->flags, vaddr);
+ if (kvm_is_error_hva(vaddr)) {
+ pr_err("vaddr is erroneous 0x%lx\n", vaddr);
+ return -EINVAL;
+ }
- vaddr = params.uaddr;
- size = params.len;
+ size = (range->end - range->start) << PAGE_SHIFT;
vaddr_end = vaddr + size;
/* Lock the user memory. */
@@ -561,6 +564,84 @@ static int sev_launch_update_data(struct kvm *kvm, struct kvm_sev_cmd *argp)
return ret;
}
+static int sev_launch_update_priv_gfn_handler(struct kvm *kvm,
+ struct kvm_gfn_range *range,
+ struct kvm_sev_cmd *argp)
+{
+ struct sev_data_launch_update_data data;
+ struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info;
+ gfn_t gfn;
+ kvm_pfn_t pfn;
+ struct kvm_memory_slot *memslot = range->slot;
+ int ret = 0;
+
+ data.reserved = 0;
+ data.handle = sev->handle;
+
+ for (gfn = range->start; gfn < range->end; gfn++) {
+ int order;
+ void *kvaddr;
+
+ ret = kvm_restricted_mem_get_pfn(memslot, gfn, &pfn, &order);
+ if (ret)
+ return ret;
+
+ kvaddr = pfn_to_kaddr(pfn);
+ if (!virt_addr_valid(kvaddr)) {
+ pr_err("Invalid kvaddr 0x%llx\n", (uint64_t)kvaddr);
+ ret = -EINVAL;
+ goto e_ret;
+ }
+
+ ret = kvm_read_guest_page(kvm, gfn, kvaddr, 0, PAGE_SIZE);
+ if (ret) {
+ pr_err("guest read failed 0x%x\n", ret);
+ goto e_ret;
+ }
+
+ if (!this_cpu_has(X86_FEATURE_SME_COHERENT))
+ clflush_cache_range(kvaddr, PAGE_SIZE);
+
+ data.len = PAGE_SIZE;
+ data.address = __sme_set(pfn << PAGE_SHIFT);
+ ret = sev_issue_cmd(kvm, SEV_CMD_LAUNCH_UPDATE_DATA, &data, &argp->error);
+ if (ret)
+ goto e_ret;
+ kvm_release_pfn_clean(pfn);
+ }
+ kvm_vm_set_region_attr(kvm, range->start, range->end,
+ true /* priv_attr */);
+
+e_ret:
+ return ret;
+}
+
+static int sev_launch_update_gfn_handler(struct kvm *kvm, struct kvm_gfn_range *range,
+ void *data)
+{
+ struct kvm_sev_cmd *argp = (struct kvm_sev_cmd *)data;
+
+ if (kvm_slot_can_be_private(range->slot))
+ return sev_launch_update_priv_gfn_handler(kvm, range, argp);
+
+ return sev_launch_update_shared_gfn_handler(kvm, range, argp);
+}
+
+static int sev_launch_update_data(struct kvm *kvm,
+ struct kvm_sev_cmd *argp)
+{
+ struct kvm_sev_launch_update_data params;
+
+ if (!sev_guest(kvm))
+ return -ENOTTY;
+
+ if (copy_from_user(¶ms, (void __user *)(uintptr_t)argp->data, sizeof(params)))
+ return -EFAULT;
+
+ return kvm_vm_do_hva_range_op(kvm, params.uaddr, params.uaddr + params.len,
+ sev_launch_update_gfn_handler, argp);
+}
+
static int sev_es_sync_vmsa(struct vcpu_svm *svm)
{
struct sev_es_save_area *save = svm->sev_es.vmsa;
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 21a539ab17f6..33fa0b1435d3 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -973,6 +973,7 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
void kvm_exit(void);
void kvm_get_kvm(struct kvm *kvm);
+int kvm_vm_set_region_attr(struct kvm *kvm, gfn_t start, gfn_t end, u64 attributes);
bool kvm_get_kvm_safe(struct kvm *kvm);
void kvm_put_kvm(struct kvm *kvm);
bool file_is_kvm(struct file *file);
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 4ff7adaf6c56..1343070657d1 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -747,6 +747,7 @@ int kvm_vm_do_hva_range_op(struct kvm *kvm, unsigned long hva_start,
return ret;
}
+EXPORT_SYMBOL_GPL(kvm_vm_do_hva_range_op);
static __always_inline int kvm_handle_hva_range(struct mmu_notifier *mn,
unsigned long start,
@@ -2595,12 +2596,28 @@ static void kvm_unmap_mem_range(struct kvm *kvm, gfn_t start, gfn_t end,
kvm_flush_remote_tlbs(kvm);
}
+int kvm_vm_set_region_attr(struct kvm *kvm, gfn_t start, gfn_t end,
+ u64 attributes)
+{
+ gfn_t index;
+ void *entry;
+
+ entry = attributes ? xa_mk_value(attributes) : NULL;
+
+ for (index = start; index < end; index++)
+ if (xa_err(xa_store(&kvm->mem_attr_array, index, entry,
+ GFP_KERNEL_ACCOUNT)))
+ break;
+
+ return index;
+}
+EXPORT_SYMBOL_GPL(kvm_vm_set_region_attr);
+
static int kvm_vm_ioctl_set_mem_attributes(struct kvm *kvm,
struct kvm_memory_attributes *attrs)
{
gfn_t start, end;
unsigned long i;
- void *entry;
int idx;
u64 supported_attrs = kvm_supported_mem_attributes(kvm);
@@ -2617,8 +2634,6 @@ static int kvm_vm_ioctl_set_mem_attributes(struct kvm *kvm,
start = attrs->address >> PAGE_SHIFT;
end = (attrs->address + attrs->size - 1 + PAGE_SIZE) >> PAGE_SHIFT;
- entry = attrs->attributes ? xa_mk_value(attrs->attributes) : NULL;
-
if (kvm_arch_has_private_mem(kvm)) {
KVM_MMU_LOCK(kvm);
kvm_mmu_invalidate_begin(kvm);
@@ -2627,10 +2642,7 @@ static int kvm_vm_ioctl_set_mem_attributes(struct kvm *kvm,
}
mutex_lock(&kvm->lock);
- for (i = start; i < end; i++)
- if (xa_err(xa_store(&kvm->mem_attr_array, i, entry,
- GFP_KERNEL_ACCOUNT)))
- break;
+ i = kvm_vm_set_region_attr(kvm, start, end, attrs->attributes);
mutex_unlock(&kvm->lock);
if (kvm_arch_has_private_mem(kvm)) {
@@ -2793,6 +2805,7 @@ unsigned long gfn_to_hva_memslot_prot(struct kvm_memory_slot *slot,
return hva;
}
+EXPORT_SYMBOL_GPL(gfn_to_hva_memslot_prot);
unsigned long gfn_to_hva_prot(struct kvm *kvm, gfn_t gfn, bool *writable)
{
--
2.25.1
On Wed, Dec 14, 2022 at 01:40:02PM -0600, Michael Roth wrote:
> From: Vishal Annapurve <[email protected]>
>
> This change adds handling of HVA ranges to copy contents
s/This change adds handling of/Handle/
> +static int sev_launch_update_priv_gfn_handler(struct kvm *kvm,
> + struct kvm_gfn_range *range,
> + struct kvm_sev_cmd *argp)
> +{
> + struct sev_data_launch_update_data data;
> + struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info;
> + gfn_t gfn;
> + kvm_pfn_t pfn;
> + struct kvm_memory_slot *memslot = range->slot;
> + int ret = 0;
> +
> + data.reserved = 0;
> + data.handle = sev->handle;
> +
> + for (gfn = range->start; gfn < range->end; gfn++) {
> + int order;
> + void *kvaddr;
> +
> + ret = kvm_restricted_mem_get_pfn(memslot, gfn, &pfn, &order);
> + if (ret)
> + return ret;
> +
> + kvaddr = pfn_to_kaddr(pfn);
> + if (!virt_addr_valid(kvaddr)) {
> + pr_err("Invalid kvaddr 0x%llx\n", (uint64_t)kvaddr);
Is that some debugging help leftover or what is that printk issued for?
> + ret = -EINVAL;
> + goto e_ret;
> + }
> +
> + ret = kvm_read_guest_page(kvm, gfn, kvaddr, 0, PAGE_SIZE);
> + if (ret) {
> + pr_err("guest read failed 0x%x\n", ret);
> + goto e_ret;
> + }
> +
> + if (!this_cpu_has(X86_FEATURE_SME_COHERENT))
check_for_deprecated_apis: WARNING: arch/x86/kvm/svm/sev.c:602: Do not use this_cpu_has() - use cpu_feature_enabled() instead.
> + clflush_cache_range(kvaddr, PAGE_SIZE);
> +
> + data.len = PAGE_SIZE;
> + data.address = __sme_set(pfn << PAGE_SHIFT);
> + ret = sev_issue_cmd(kvm, SEV_CMD_LAUNCH_UPDATE_DATA, &data, &argp->error);
> + if (ret)
> + goto e_ret;
> + kvm_release_pfn_clean(pfn);
> + }
> + kvm_vm_set_region_attr(kvm, range->start, range->end,
> + true /* priv_attr */);
No need to break that line.
> +
> +e_ret:
> + return ret;
> +}
> +
> +static int sev_launch_update_gfn_handler(struct kvm *kvm, struct kvm_gfn_range *range,
> + void *data)
> +{
> + struct kvm_sev_cmd *argp = (struct kvm_sev_cmd *)data;
> +
> + if (kvm_slot_can_be_private(range->slot))
> + return sev_launch_update_priv_gfn_handler(kvm, range, argp);
> +
> + return sev_launch_update_shared_gfn_handler(kvm, range, argp);
> +}
> +
> +static int sev_launch_update_data(struct kvm *kvm,
> + struct kvm_sev_cmd *argp)
> +{
> + struct kvm_sev_launch_update_data params;
> +
> + if (!sev_guest(kvm))
> + return -ENOTTY;
> +
> + if (copy_from_user(¶ms, (void __user *)(uintptr_t)argp->data, sizeof(params)))
> + return -EFAULT;
Not gonna check those user-supplied values for sanity?
Or is this check
if (WARN_ON_ONCE(hva_end <= hva_start))
return -EINVAL;
in kvm_vm_do_hva_range_op() enough?
Thx.
--
Regards/Gruss,
Boris.
https://people.kernel.org/tglx/notes-about-netiquette
On Wed, Dec 14, 2022 at 01:40:02PM -0600, Michael Roth wrote:
> From: Vishal Annapurve <[email protected]>
>
> This change adds handling of HVA ranges to copy contents
> to private memory while doing sev launch update data.
>
> mem_attr array is updated during LAUNCH_UPDATE_DATA to ensure
> that encrypted memory is marked as private.
>
> Signed-off-by: Vishal Annapurve <[email protected]>
> [mdr: use gfn_to_hva_memslot_prot() for shared GFN handler to deal with
> read-only slots for ROMs]
> Signed-off-by: Michael Roth <[email protected]>
> ---
> arch/x86/kvm/svm/sev.c | 99 ++++++++++++++++++++++++++++++++++++----
> include/linux/kvm_host.h | 1 +
> virt/kvm/kvm_main.c | 27 ++++++++---
> 3 files changed, 111 insertions(+), 16 deletions(-)
>
> diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> index 69dbf17f0d6a..a7e4e3005786 100644
> --- a/arch/x86/kvm/svm/sev.c
> +++ b/arch/x86/kvm/svm/sev.c
> @@ -493,23 +493,26 @@ static unsigned long get_num_contig_pages(unsigned long idx,
> return pages;
> }
>
> -static int sev_launch_update_data(struct kvm *kvm, struct kvm_sev_cmd *argp)
> +static int sev_launch_update_shared_gfn_handler(struct kvm *kvm,
> + struct kvm_gfn_range *range,
> + struct kvm_sev_cmd *argp)
> {
> unsigned long vaddr, vaddr_end, next_vaddr, npages, pages, size, i;
> struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info;
> - struct kvm_sev_launch_update_data params;
> struct sev_data_launch_update_data data;
> struct page **inpages;
> int ret;
>
> - if (!sev_guest(kvm))
> - return -ENOTTY;
> -
> - if (copy_from_user(¶ms, (void __user *)(uintptr_t)argp->data, sizeof(params)))
> - return -EFAULT;
> + vaddr = gfn_to_hva_memslot_prot(range->slot, range->start, NULL);
> + pr_debug("%s: shared GFN: %llx, slot.id: %d, slot.base_gfn: %llx, slot.userspace_addr: %lx, slot.flags: %x, vaddr: %lx\n",
> + __func__, range->start, range->slot->id, range->slot->base_gfn,
> + range->slot->userspace_addr, range->slot->flags, vaddr);
> + if (kvm_is_error_hva(vaddr)) {
> + pr_err("vaddr is erroneous 0x%lx\n", vaddr);
> + return -EINVAL;
> + }
>
> - vaddr = params.uaddr;
> - size = params.len;
> + size = (range->end - range->start) << PAGE_SHIFT;
> vaddr_end = vaddr + size;
>
> /* Lock the user memory. */
> @@ -561,6 +564,84 @@ static int sev_launch_update_data(struct kvm *kvm, struct kvm_sev_cmd *argp)
> return ret;
> }
>
> +static int sev_launch_update_priv_gfn_handler(struct kvm *kvm,
> + struct kvm_gfn_range *range,
> + struct kvm_sev_cmd *argp)
> +{
> + struct sev_data_launch_update_data data;
> + struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info;
> + gfn_t gfn;
> + kvm_pfn_t pfn;
> + struct kvm_memory_slot *memslot = range->slot;
> + int ret = 0;
> +
> + data.reserved = 0;
> + data.handle = sev->handle;
> +
> + for (gfn = range->start; gfn < range->end; gfn++) {
> + int order;
> + void *kvaddr;
> +
> + ret = kvm_restricted_mem_get_pfn(memslot, gfn, &pfn, &order);
> + if (ret)
> + return ret;
> +
> + kvaddr = pfn_to_kaddr(pfn);
> + if (!virt_addr_valid(kvaddr)) {
> + pr_err("Invalid kvaddr 0x%llx\n", (uint64_t)kvaddr);
> + ret = -EINVAL;
> + goto e_ret;
> + }
> +
> + ret = kvm_read_guest_page(kvm, gfn, kvaddr, 0, PAGE_SIZE);
> + if (ret) {
> + pr_err("guest read failed 0x%x\n", ret);
> + goto e_ret;
> + }
> +
> + if (!this_cpu_has(X86_FEATURE_SME_COHERENT))
> + clflush_cache_range(kvaddr, PAGE_SIZE);
> +
> + data.len = PAGE_SIZE;
> + data.address = __sme_set(pfn << PAGE_SHIFT);
> + ret = sev_issue_cmd(kvm, SEV_CMD_LAUNCH_UPDATE_DATA, &data, &argp->error);
> + if (ret)
> + goto e_ret;
> + kvm_release_pfn_clean(pfn);
> + }
> + kvm_vm_set_region_attr(kvm, range->start, range->end,
> + true /* priv_attr */);
> +
> +e_ret:
> + return ret;
> +}
> +
> +static int sev_launch_update_gfn_handler(struct kvm *kvm, struct kvm_gfn_range *range,
> + void *data)
> +{
> + struct kvm_sev_cmd *argp = (struct kvm_sev_cmd *)data;
> +
> + if (kvm_slot_can_be_private(range->slot))
> + return sev_launch_update_priv_gfn_handler(kvm, range, argp);
> +
> + return sev_launch_update_shared_gfn_handler(kvm, range, argp);
> +}
> +
> +static int sev_launch_update_data(struct kvm *kvm,
> + struct kvm_sev_cmd *argp)
> +{
> + struct kvm_sev_launch_update_data params;
> +
> + if (!sev_guest(kvm))
> + return -ENOTTY;
> +
> + if (copy_from_user(¶ms, (void __user *)(uintptr_t)argp->data, sizeof(params)))
> + return -EFAULT;
> +
> + return kvm_vm_do_hva_range_op(kvm, params.uaddr, params.uaddr + params.len,
> + sev_launch_update_gfn_handler, argp);
> +}
> +
> static int sev_es_sync_vmsa(struct vcpu_svm *svm)
> {
> struct sev_es_save_area *save = svm->sev_es.vmsa;
> diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
> index 21a539ab17f6..33fa0b1435d3 100644
> --- a/include/linux/kvm_host.h
> +++ b/include/linux/kvm_host.h
> @@ -973,6 +973,7 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
> void kvm_exit(void);
>
> void kvm_get_kvm(struct kvm *kvm);
> +int kvm_vm_set_region_attr(struct kvm *kvm, gfn_t start, gfn_t end, u64 attributes);
> bool kvm_get_kvm_safe(struct kvm *kvm);
> void kvm_put_kvm(struct kvm *kvm);
> bool file_is_kvm(struct file *file);
> diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> index 4ff7adaf6c56..1343070657d1 100644
> --- a/virt/kvm/kvm_main.c
> +++ b/virt/kvm/kvm_main.c
> @@ -747,6 +747,7 @@ int kvm_vm_do_hva_range_op(struct kvm *kvm, unsigned long hva_start,
>
> return ret;
> }
> +EXPORT_SYMBOL_GPL(kvm_vm_do_hva_range_op);
>
> static __always_inline int kvm_handle_hva_range(struct mmu_notifier *mn,
> unsigned long start,
> @@ -2595,12 +2596,28 @@ static void kvm_unmap_mem_range(struct kvm *kvm, gfn_t start, gfn_t end,
> kvm_flush_remote_tlbs(kvm);
> }
>
> +int kvm_vm_set_region_attr(struct kvm *kvm, gfn_t start, gfn_t end,
> + u64 attributes)
> +{
> + gfn_t index;
> + void *entry;
> +
> + entry = attributes ? xa_mk_value(attributes) : NULL;
> +
> + for (index = start; index < end; index++)
> + if (xa_err(xa_store(&kvm->mem_attr_array, index, entry,
> + GFP_KERNEL_ACCOUNT)))
> + break;
> +
> + return index;
> +}
> +EXPORT_SYMBOL_GPL(kvm_vm_set_region_attr);
> +
> static int kvm_vm_ioctl_set_mem_attributes(struct kvm *kvm,
> struct kvm_memory_attributes *attrs)
> {
> gfn_t start, end;
> unsigned long i;
> - void *entry;
> int idx;
> u64 supported_attrs = kvm_supported_mem_attributes(kvm);
>
> @@ -2617,8 +2634,6 @@ static int kvm_vm_ioctl_set_mem_attributes(struct kvm *kvm,
> start = attrs->address >> PAGE_SHIFT;
> end = (attrs->address + attrs->size - 1 + PAGE_SIZE) >> PAGE_SHIFT;
>
> - entry = attrs->attributes ? xa_mk_value(attrs->attributes) : NULL;
> -
> if (kvm_arch_has_private_mem(kvm)) {
> KVM_MMU_LOCK(kvm);
> kvm_mmu_invalidate_begin(kvm);
> @@ -2627,10 +2642,7 @@ static int kvm_vm_ioctl_set_mem_attributes(struct kvm *kvm,
> }
>
> mutex_lock(&kvm->lock);
> - for (i = start; i < end; i++)
> - if (xa_err(xa_store(&kvm->mem_attr_array, i, entry,
> - GFP_KERNEL_ACCOUNT)))
> - break;
> + i = kvm_vm_set_region_attr(kvm, start, end, attrs->attributes);
> mutex_unlock(&kvm->lock);
>
> if (kvm_arch_has_private_mem(kvm)) {
> @@ -2793,6 +2805,7 @@ unsigned long gfn_to_hva_memslot_prot(struct kvm_memory_slot *slot,
>
> return hva;
> }
> +EXPORT_SYMBOL_GPL(gfn_to_hva_memslot_prot);
>
> unsigned long gfn_to_hva_prot(struct kvm *kvm, gfn_t gfn, bool *writable)
> {
> --
> 2.25.1
>
Hmm.. but user space is still allowed to call KVM_SET_MEMORY_ATTRIBUTES
with KVM_MEMORY_ATTRIBUTE_PRIVATE set? How do these behaviours complement
each other?
SEV specific changes and kvm_vm_set_region_attr() definition should really
be separate patches.
BR, Jarkko
On Fri, Jan 13, 2023 at 08:11:14PM +0100, Borislav Petkov wrote:
> On Wed, Dec 14, 2022 at 01:40:02PM -0600, Michael Roth wrote:
> > From: Vishal Annapurve <[email protected]>
> >
> > This change adds handling of HVA ranges to copy contents
>
> s/This change adds handling of/Handle/
>
> > +static int sev_launch_update_priv_gfn_handler(struct kvm *kvm,
> > + struct kvm_gfn_range *range,
> > + struct kvm_sev_cmd *argp)
> > +{
> > + struct sev_data_launch_update_data data;
> > + struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info;
> > + gfn_t gfn;
> > + kvm_pfn_t pfn;
> > + struct kvm_memory_slot *memslot = range->slot;
> > + int ret = 0;
> > +
> > + data.reserved = 0;
> > + data.handle = sev->handle;
> > +
> > + for (gfn = range->start; gfn < range->end; gfn++) {
> > + int order;
> > + void *kvaddr;
> > +
> > + ret = kvm_restricted_mem_get_pfn(memslot, gfn, &pfn, &order);
> > + if (ret)
> > + return ret;
> > +
> > + kvaddr = pfn_to_kaddr(pfn);
> > + if (!virt_addr_valid(kvaddr)) {
> > + pr_err("Invalid kvaddr 0x%llx\n", (uint64_t)kvaddr);
>
> Is that some debugging help leftover or what is that printk issued for?
A mix of error-reporting and debugging I think. I think the error message
isn't needed since the error value will get plumbed straight to
userspace and anything beyond that is kernel debugging, so I added some
context and switched this to pr_debug().
> > + ret = -EINVAL;
> > + goto e_ret;
> > + }
> > +
> > + ret = kvm_read_guest_page(kvm, gfn, kvaddr, 0, PAGE_SIZE);
> > + if (ret) {
> > + pr_err("guest read failed 0x%x\n", ret);
> > + goto e_ret;
> > + }
> > +
> > + if (!this_cpu_has(X86_FEATURE_SME_COHERENT))
>
> check_for_deprecated_apis: WARNING: arch/x86/kvm/svm/sev.c:602: Do not use this_cpu_has() - use cpu_feature_enabled() instead.
>
> > + clflush_cache_range(kvaddr, PAGE_SIZE);
> > +
> > + data.len = PAGE_SIZE;
> > + data.address = __sme_set(pfn << PAGE_SHIFT);
> > + ret = sev_issue_cmd(kvm, SEV_CMD_LAUNCH_UPDATE_DATA, &data, &argp->error);
> > + if (ret)
> > + goto e_ret;
> > + kvm_release_pfn_clean(pfn);
> > + }
> > + kvm_vm_set_region_attr(kvm, range->start, range->end,
> > + true /* priv_attr */);
>
> No need to break that line.
>
> > +
> > +e_ret:
> > + return ret;
> > +}
> > +
> > +static int sev_launch_update_gfn_handler(struct kvm *kvm, struct kvm_gfn_range *range,
> > + void *data)
> > +{
> > + struct kvm_sev_cmd *argp = (struct kvm_sev_cmd *)data;
> > +
> > + if (kvm_slot_can_be_private(range->slot))
> > + return sev_launch_update_priv_gfn_handler(kvm, range, argp);
> > +
> > + return sev_launch_update_shared_gfn_handler(kvm, range, argp);
> > +}
> > +
> > +static int sev_launch_update_data(struct kvm *kvm,
> > + struct kvm_sev_cmd *argp)
> > +{
> > + struct kvm_sev_launch_update_data params;
> > +
> > + if (!sev_guest(kvm))
> > + return -ENOTTY;
> > +
> > + if (copy_from_user(¶ms, (void __user *)(uintptr_t)argp->data, sizeof(params)))
> > + return -EFAULT;
>
> Not gonna check those user-supplied values for sanity?
>
> Or is this check
>
> if (WARN_ON_ONCE(hva_end <= hva_start))
> return -EINVAL;
>
> in kvm_vm_do_hva_range_op() enough?
Only partially, but kvm_vm_do_hva_range_op() should sanitize the address
range and only call sev_launch_update_gfn_handler() on valid GFNs within
the range, so if userspace provides a bogus HVA range that doesn't
actually correspond to a valid memslot it'll simply be treated as a
no-op.
-Mike
>
> Thx.
>
> --
> Regards/Gruss,
> Boris.
>
> https://people.kernel.org/tglx/notes-about-netiquette
On Wed, Jan 18, 2023 at 01:42:45AM +0200, Jarkko Sakkinen wrote:
> On Wed, Dec 14, 2022 at 01:40:02PM -0600, Michael Roth wrote:
> > From: Vishal Annapurve <[email protected]>
> >
> > This change adds handling of HVA ranges to copy contents
> > to private memory while doing sev launch update data.
> >
> > mem_attr array is updated during LAUNCH_UPDATE_DATA to ensure
> > that encrypted memory is marked as private.
> >
> > Signed-off-by: Vishal Annapurve <[email protected]>
> > [mdr: use gfn_to_hva_memslot_prot() for shared GFN handler to deal with
> > read-only slots for ROMs]
> > Signed-off-by: Michael Roth <[email protected]>
> > ---
> > arch/x86/kvm/svm/sev.c | 99 ++++++++++++++++++++++++++++++++++++----
> > include/linux/kvm_host.h | 1 +
> > virt/kvm/kvm_main.c | 27 ++++++++---
> > 3 files changed, 111 insertions(+), 16 deletions(-)
> >
> > diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> > index 69dbf17f0d6a..a7e4e3005786 100644
> > --- a/arch/x86/kvm/svm/sev.c
> > +++ b/arch/x86/kvm/svm/sev.c
> > @@ -493,23 +493,26 @@ static unsigned long get_num_contig_pages(unsigned long idx,
> > return pages;
> > }
> >
> > -static int sev_launch_update_data(struct kvm *kvm, struct kvm_sev_cmd *argp)
> > +static int sev_launch_update_shared_gfn_handler(struct kvm *kvm,
> > + struct kvm_gfn_range *range,
> > + struct kvm_sev_cmd *argp)
> > {
> > unsigned long vaddr, vaddr_end, next_vaddr, npages, pages, size, i;
> > struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info;
> > - struct kvm_sev_launch_update_data params;
> > struct sev_data_launch_update_data data;
> > struct page **inpages;
> > int ret;
> >
> > - if (!sev_guest(kvm))
> > - return -ENOTTY;
> > -
> > - if (copy_from_user(¶ms, (void __user *)(uintptr_t)argp->data, sizeof(params)))
> > - return -EFAULT;
> > + vaddr = gfn_to_hva_memslot_prot(range->slot, range->start, NULL);
> > + pr_debug("%s: shared GFN: %llx, slot.id: %d, slot.base_gfn: %llx, slot.userspace_addr: %lx, slot.flags: %x, vaddr: %lx\n",
> > + __func__, range->start, range->slot->id, range->slot->base_gfn,
> > + range->slot->userspace_addr, range->slot->flags, vaddr);
> > + if (kvm_is_error_hva(vaddr)) {
> > + pr_err("vaddr is erroneous 0x%lx\n", vaddr);
> > + return -EINVAL;
> > + }
> >
> > - vaddr = params.uaddr;
> > - size = params.len;
> > + size = (range->end - range->start) << PAGE_SHIFT;
> > vaddr_end = vaddr + size;
> >
> > /* Lock the user memory. */
> > @@ -561,6 +564,84 @@ static int sev_launch_update_data(struct kvm *kvm, struct kvm_sev_cmd *argp)
> > return ret;
> > }
> >
> > +static int sev_launch_update_priv_gfn_handler(struct kvm *kvm,
> > + struct kvm_gfn_range *range,
> > + struct kvm_sev_cmd *argp)
> > +{
> > + struct sev_data_launch_update_data data;
> > + struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info;
> > + gfn_t gfn;
> > + kvm_pfn_t pfn;
> > + struct kvm_memory_slot *memslot = range->slot;
> > + int ret = 0;
> > +
> > + data.reserved = 0;
> > + data.handle = sev->handle;
> > +
> > + for (gfn = range->start; gfn < range->end; gfn++) {
> > + int order;
> > + void *kvaddr;
> > +
> > + ret = kvm_restricted_mem_get_pfn(memslot, gfn, &pfn, &order);
> > + if (ret)
> > + return ret;
> > +
> > + kvaddr = pfn_to_kaddr(pfn);
> > + if (!virt_addr_valid(kvaddr)) {
> > + pr_err("Invalid kvaddr 0x%llx\n", (uint64_t)kvaddr);
> > + ret = -EINVAL;
> > + goto e_ret;
> > + }
> > +
> > + ret = kvm_read_guest_page(kvm, gfn, kvaddr, 0, PAGE_SIZE);
> > + if (ret) {
> > + pr_err("guest read failed 0x%x\n", ret);
> > + goto e_ret;
> > + }
> > +
> > + if (!this_cpu_has(X86_FEATURE_SME_COHERENT))
> > + clflush_cache_range(kvaddr, PAGE_SIZE);
> > +
> > + data.len = PAGE_SIZE;
> > + data.address = __sme_set(pfn << PAGE_SHIFT);
> > + ret = sev_issue_cmd(kvm, SEV_CMD_LAUNCH_UPDATE_DATA, &data, &argp->error);
> > + if (ret)
> > + goto e_ret;
> > + kvm_release_pfn_clean(pfn);
> > + }
> > + kvm_vm_set_region_attr(kvm, range->start, range->end,
> > + true /* priv_attr */);
> > +
> > +e_ret:
> > + return ret;
> > +}
> > +
> > +static int sev_launch_update_gfn_handler(struct kvm *kvm, struct kvm_gfn_range *range,
> > + void *data)
> > +{
> > + struct kvm_sev_cmd *argp = (struct kvm_sev_cmd *)data;
> > +
> > + if (kvm_slot_can_be_private(range->slot))
> > + return sev_launch_update_priv_gfn_handler(kvm, range, argp);
> > +
> > + return sev_launch_update_shared_gfn_handler(kvm, range, argp);
> > +}
> > +
> > +static int sev_launch_update_data(struct kvm *kvm,
> > + struct kvm_sev_cmd *argp)
> > +{
> > + struct kvm_sev_launch_update_data params;
> > +
> > + if (!sev_guest(kvm))
> > + return -ENOTTY;
> > +
> > + if (copy_from_user(¶ms, (void __user *)(uintptr_t)argp->data, sizeof(params)))
> > + return -EFAULT;
> > +
> > + return kvm_vm_do_hva_range_op(kvm, params.uaddr, params.uaddr + params.len,
> > + sev_launch_update_gfn_handler, argp);
> > +}
> > +
> > static int sev_es_sync_vmsa(struct vcpu_svm *svm)
> > {
> > struct sev_es_save_area *save = svm->sev_es.vmsa;
> > diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
> > index 21a539ab17f6..33fa0b1435d3 100644
> > --- a/include/linux/kvm_host.h
> > +++ b/include/linux/kvm_host.h
> > @@ -973,6 +973,7 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
> > void kvm_exit(void);
> >
> > void kvm_get_kvm(struct kvm *kvm);
> > +int kvm_vm_set_region_attr(struct kvm *kvm, gfn_t start, gfn_t end, u64 attributes);
> > bool kvm_get_kvm_safe(struct kvm *kvm);
> > void kvm_put_kvm(struct kvm *kvm);
> > bool file_is_kvm(struct file *file);
> > diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> > index 4ff7adaf6c56..1343070657d1 100644
> > --- a/virt/kvm/kvm_main.c
> > +++ b/virt/kvm/kvm_main.c
> > @@ -747,6 +747,7 @@ int kvm_vm_do_hva_range_op(struct kvm *kvm, unsigned long hva_start,
> >
> > return ret;
> > }
> > +EXPORT_SYMBOL_GPL(kvm_vm_do_hva_range_op);
> >
> > static __always_inline int kvm_handle_hva_range(struct mmu_notifier *mn,
> > unsigned long start,
> > @@ -2595,12 +2596,28 @@ static void kvm_unmap_mem_range(struct kvm *kvm, gfn_t start, gfn_t end,
> > kvm_flush_remote_tlbs(kvm);
> > }
> >
> > +int kvm_vm_set_region_attr(struct kvm *kvm, gfn_t start, gfn_t end,
> > + u64 attributes)
> > +{
> > + gfn_t index;
> > + void *entry;
> > +
> > + entry = attributes ? xa_mk_value(attributes) : NULL;
> > +
> > + for (index = start; index < end; index++)
> > + if (xa_err(xa_store(&kvm->mem_attr_array, index, entry,
> > + GFP_KERNEL_ACCOUNT)))
> > + break;
> > +
> > + return index;
> > +}
> > +EXPORT_SYMBOL_GPL(kvm_vm_set_region_attr);
> > +
> > static int kvm_vm_ioctl_set_mem_attributes(struct kvm *kvm,
> > struct kvm_memory_attributes *attrs)
> > {
> > gfn_t start, end;
> > unsigned long i;
> > - void *entry;
> > int idx;
> > u64 supported_attrs = kvm_supported_mem_attributes(kvm);
> >
> > @@ -2617,8 +2634,6 @@ static int kvm_vm_ioctl_set_mem_attributes(struct kvm *kvm,
> > start = attrs->address >> PAGE_SHIFT;
> > end = (attrs->address + attrs->size - 1 + PAGE_SIZE) >> PAGE_SHIFT;
> >
> > - entry = attrs->attributes ? xa_mk_value(attrs->attributes) : NULL;
> > -
> > if (kvm_arch_has_private_mem(kvm)) {
> > KVM_MMU_LOCK(kvm);
> > kvm_mmu_invalidate_begin(kvm);
> > @@ -2627,10 +2642,7 @@ static int kvm_vm_ioctl_set_mem_attributes(struct kvm *kvm,
> > }
> >
> > mutex_lock(&kvm->lock);
> > - for (i = start; i < end; i++)
> > - if (xa_err(xa_store(&kvm->mem_attr_array, i, entry,
> > - GFP_KERNEL_ACCOUNT)))
> > - break;
> > + i = kvm_vm_set_region_attr(kvm, start, end, attrs->attributes);
> > mutex_unlock(&kvm->lock);
> >
> > if (kvm_arch_has_private_mem(kvm)) {
> > @@ -2793,6 +2805,7 @@ unsigned long gfn_to_hva_memslot_prot(struct kvm_memory_slot *slot,
> >
> > return hva;
> > }
> > +EXPORT_SYMBOL_GPL(gfn_to_hva_memslot_prot);
> >
> > unsigned long gfn_to_hva_prot(struct kvm *kvm, gfn_t gfn, bool *writable)
> > {
> > --
> > 2.25.1
> >
>
> Hmm.. but user space is still allowed to call KVM_SET_MEMORY_ATTRIBUTES
> with KVM_MEMORY_ATTRIBUTE_PRIVATE set? How do these behaviours complement
> each other?
In the current series it's allowed. It reduces some headaches since an
SNP guest can issue duplicate page-state changes without violating the
spec, and it would complicate things further if kernel/userspace
attempted to enforce something stricter.
>
> SEV specific changes and kvm_vm_set_region_attr() definition should really
> be separate patches.
Done.
-Mike
>
> BR, Jarkko