diff mbox series

[RFC,v7,10/64] KVM: SEV: Populate private memory fd during LAUNCH_UPDATE_DATA

Message ID 20221214194056.161492-11-michael.roth@amd.com (mailing list archive)
State Not Applicable
Delegated to: Herbert Xu
Headers show
Series Add AMD Secure Nested Paging (SEV-SNP) Hypervisor Support | expand

Commit Message

Michael Roth Dec. 14, 2022, 7:40 p.m. UTC 
From: Vishal Annapurve <vannapurve@google.com>

This change adds handling of HVA ranges to copy contents
to private memory while doing sev launch update data.

mem_attr array is updated during LAUNCH_UPDATE_DATA to ensure
that encrypted memory is marked as private.

Signed-off-by: Vishal Annapurve <vannapurve@google.com>
[mdr: use gfn_to_hva_memslot_prot() for shared GFN handler to deal with
      read-only slots for ROMs]
Signed-off-by: Michael Roth <michael.roth@amd.com>
---
 arch/x86/kvm/svm/sev.c   | 99 ++++++++++++++++++++++++++++++++++++----
 include/linux/kvm_host.h |  1 +
 virt/kvm/kvm_main.c      | 27 ++++++++---
 3 files changed, 111 insertions(+), 16 deletions(-)

Comments

Borislav Petkov Jan. 13, 2023, 7:11 p.m. UTC | #1 
On Wed, Dec 14, 2022 at 01:40:02PM -0600, Michael Roth wrote:
> From: Vishal Annapurve <vannapurve@google.com>
> 
> This change adds handling of HVA ranges to copy contents

s/This change adds handling of/Handle/

> +static int sev_launch_update_priv_gfn_handler(struct kvm *kvm,
> +					      struct kvm_gfn_range *range,
> +					      struct kvm_sev_cmd *argp)
> +{
> +	struct sev_data_launch_update_data data;
> +	struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info;
> +	gfn_t gfn;
> +	kvm_pfn_t pfn;
> +	struct kvm_memory_slot *memslot = range->slot;
> +	int ret = 0;
> +
> +	data.reserved = 0;
> +	data.handle = sev->handle;
> +
> +	for (gfn = range->start; gfn < range->end; gfn++) {
> +		int order;
> +		void *kvaddr;
> +
> +		ret = kvm_restricted_mem_get_pfn(memslot, gfn, &pfn, &order);
> +		if (ret)
> +			return ret;
> +
> +		kvaddr = pfn_to_kaddr(pfn);
> +		if (!virt_addr_valid(kvaddr)) {
> +			pr_err("Invalid kvaddr 0x%llx\n", (uint64_t)kvaddr);

Is that some debugging help leftover or what is that printk issued for?

> +			ret = -EINVAL;
> +			goto e_ret;
> +		}
> +
> +		ret = kvm_read_guest_page(kvm, gfn, kvaddr, 0, PAGE_SIZE);
> +		if (ret) {
> +			pr_err("guest read failed 0x%x\n", ret);
> +			goto e_ret;
> +		}
> +
> +		if (!this_cpu_has(X86_FEATURE_SME_COHERENT))

check_for_deprecated_apis: WARNING: arch/x86/kvm/svm/sev.c:602: Do not use this_cpu_has() - use cpu_feature_enabled() instead.

> +			clflush_cache_range(kvaddr, PAGE_SIZE);
> +
> +		data.len = PAGE_SIZE;
> +		data.address = __sme_set(pfn << PAGE_SHIFT);
> +		ret = sev_issue_cmd(kvm, SEV_CMD_LAUNCH_UPDATE_DATA, &data, &argp->error);
> +		if (ret)
> +			goto e_ret;
> +		kvm_release_pfn_clean(pfn);
> +	}
> +	kvm_vm_set_region_attr(kvm, range->start, range->end,
> +		true /* priv_attr */);

No need to break that line.

> +
> +e_ret:
> +	return ret;
> +}
> +
> +static int sev_launch_update_gfn_handler(struct kvm *kvm, struct kvm_gfn_range *range,
> +					 void *data)
> +{
> +	struct kvm_sev_cmd *argp = (struct kvm_sev_cmd *)data;
> +
> +	if (kvm_slot_can_be_private(range->slot))
> +		return sev_launch_update_priv_gfn_handler(kvm, range, argp);
> +
> +	return sev_launch_update_shared_gfn_handler(kvm, range, argp);
> +}
> +
> +static int sev_launch_update_data(struct kvm *kvm,
> +		struct kvm_sev_cmd *argp)
> +{
> +	struct kvm_sev_launch_update_data params;
> +
> +	if (!sev_guest(kvm))
> +		return -ENOTTY;
> +
> +	if (copy_from_user(&params, (void __user *)(uintptr_t)argp->data, sizeof(params)))
> +		return -EFAULT;

Not gonna check those user-supplied values for sanity?

Or is this check

        if (WARN_ON_ONCE(hva_end <= hva_start))
                return -EINVAL;

in kvm_vm_do_hva_range_op() enough?

Thx.
Jarkko Sakkinen Jan. 17, 2023, 11:42 p.m. UTC | #2 
On Wed, Dec 14, 2022 at 01:40:02PM -0600, Michael Roth wrote:
> From: Vishal Annapurve <vannapurve@google.com>
> 
> This change adds handling of HVA ranges to copy contents
> to private memory while doing sev launch update data.
> 
> mem_attr array is updated during LAUNCH_UPDATE_DATA to ensure
> that encrypted memory is marked as private.
> 
> Signed-off-by: Vishal Annapurve <vannapurve@google.com>
> [mdr: use gfn_to_hva_memslot_prot() for shared GFN handler to deal with
>       read-only slots for ROMs]
> Signed-off-by: Michael Roth <michael.roth@amd.com>
> ---
>  arch/x86/kvm/svm/sev.c   | 99 ++++++++++++++++++++++++++++++++++++----
>  include/linux/kvm_host.h |  1 +
>  virt/kvm/kvm_main.c      | 27 ++++++++---
>  3 files changed, 111 insertions(+), 16 deletions(-)
> 
> diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> index 69dbf17f0d6a..a7e4e3005786 100644
> --- a/arch/x86/kvm/svm/sev.c
> +++ b/arch/x86/kvm/svm/sev.c
> @@ -493,23 +493,26 @@ static unsigned long get_num_contig_pages(unsigned long idx,
>  	return pages;
>  }
>  
> -static int sev_launch_update_data(struct kvm *kvm, struct kvm_sev_cmd *argp)
> +static int sev_launch_update_shared_gfn_handler(struct kvm *kvm,
> +						struct kvm_gfn_range *range,
> +						struct kvm_sev_cmd *argp)
>  {
>  	unsigned long vaddr, vaddr_end, next_vaddr, npages, pages, size, i;
>  	struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info;
> -	struct kvm_sev_launch_update_data params;
>  	struct sev_data_launch_update_data data;
>  	struct page **inpages;
>  	int ret;
>  
> -	if (!sev_guest(kvm))
> -		return -ENOTTY;
> -
> -	if (copy_from_user(&params, (void __user *)(uintptr_t)argp->data, sizeof(params)))
> -		return -EFAULT;
> +	vaddr = gfn_to_hva_memslot_prot(range->slot, range->start, NULL);
> +	pr_debug("%s: shared GFN: %llx, slot.id: %d, slot.base_gfn: %llx, slot.userspace_addr: %lx, slot.flags: %x, vaddr: %lx\n",
> +		 __func__, range->start, range->slot->id, range->slot->base_gfn,
> +		 range->slot->userspace_addr, range->slot->flags, vaddr);
> +	if (kvm_is_error_hva(vaddr)) {
> +		pr_err("vaddr is erroneous 0x%lx\n", vaddr);
> +		return -EINVAL;
> +	}
>  
> -	vaddr = params.uaddr;
> -	size = params.len;
> +	size = (range->end - range->start) << PAGE_SHIFT;
>  	vaddr_end = vaddr + size;
>  
>  	/* Lock the user memory. */
> @@ -561,6 +564,84 @@ static int sev_launch_update_data(struct kvm *kvm, struct kvm_sev_cmd *argp)
>  	return ret;
>  }
>  
> +static int sev_launch_update_priv_gfn_handler(struct kvm *kvm,
> +					      struct kvm_gfn_range *range,
> +					      struct kvm_sev_cmd *argp)
> +{
> +	struct sev_data_launch_update_data data;
> +	struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info;
> +	gfn_t gfn;
> +	kvm_pfn_t pfn;
> +	struct kvm_memory_slot *memslot = range->slot;
> +	int ret = 0;
> +
> +	data.reserved = 0;
> +	data.handle = sev->handle;
> +
> +	for (gfn = range->start; gfn < range->end; gfn++) {
> +		int order;
> +		void *kvaddr;
> +
> +		ret = kvm_restricted_mem_get_pfn(memslot, gfn, &pfn, &order);
> +		if (ret)
> +			return ret;
> +
> +		kvaddr = pfn_to_kaddr(pfn);
> +		if (!virt_addr_valid(kvaddr)) {
> +			pr_err("Invalid kvaddr 0x%llx\n", (uint64_t)kvaddr);
> +			ret = -EINVAL;
> +			goto e_ret;
> +		}
> +
> +		ret = kvm_read_guest_page(kvm, gfn, kvaddr, 0, PAGE_SIZE);
> +		if (ret) {
> +			pr_err("guest read failed 0x%x\n", ret);
> +			goto e_ret;
> +		}
> +
> +		if (!this_cpu_has(X86_FEATURE_SME_COHERENT))
> +			clflush_cache_range(kvaddr, PAGE_SIZE);
> +
> +		data.len = PAGE_SIZE;
> +		data.address = __sme_set(pfn << PAGE_SHIFT);
> +		ret = sev_issue_cmd(kvm, SEV_CMD_LAUNCH_UPDATE_DATA, &data, &argp->error);
> +		if (ret)
> +			goto e_ret;
> +		kvm_release_pfn_clean(pfn);
> +	}
> +	kvm_vm_set_region_attr(kvm, range->start, range->end,
> +		true /* priv_attr */);
> +
> +e_ret:
> +	return ret;
> +}
> +
> +static int sev_launch_update_gfn_handler(struct kvm *kvm, struct kvm_gfn_range *range,
> +					 void *data)
> +{
> +	struct kvm_sev_cmd *argp = (struct kvm_sev_cmd *)data;
> +
> +	if (kvm_slot_can_be_private(range->slot))
> +		return sev_launch_update_priv_gfn_handler(kvm, range, argp);
> +
> +	return sev_launch_update_shared_gfn_handler(kvm, range, argp);
> +}
> +
> +static int sev_launch_update_data(struct kvm *kvm,
> +		struct kvm_sev_cmd *argp)
> +{
> +	struct kvm_sev_launch_update_data params;
> +
> +	if (!sev_guest(kvm))
> +		return -ENOTTY;
> +
> +	if (copy_from_user(&params, (void __user *)(uintptr_t)argp->data, sizeof(params)))
> +		return -EFAULT;
> +
> +	return kvm_vm_do_hva_range_op(kvm, params.uaddr, params.uaddr + params.len,
> +		sev_launch_update_gfn_handler, argp);
> +}
> +
>  static int sev_es_sync_vmsa(struct vcpu_svm *svm)
>  {
>  	struct sev_es_save_area *save = svm->sev_es.vmsa;
> diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
> index 21a539ab17f6..33fa0b1435d3 100644
> --- a/include/linux/kvm_host.h
> +++ b/include/linux/kvm_host.h
> @@ -973,6 +973,7 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
>  void kvm_exit(void);
>  
>  void kvm_get_kvm(struct kvm *kvm);
> +int kvm_vm_set_region_attr(struct kvm *kvm, gfn_t start, gfn_t end, u64 attributes);
>  bool kvm_get_kvm_safe(struct kvm *kvm);
>  void kvm_put_kvm(struct kvm *kvm);
>  bool file_is_kvm(struct file *file);
> diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> index 4ff7adaf6c56..1343070657d1 100644
> --- a/virt/kvm/kvm_main.c
> +++ b/virt/kvm/kvm_main.c
> @@ -747,6 +747,7 @@ int kvm_vm_do_hva_range_op(struct kvm *kvm, unsigned long hva_start,
>  
>  	return ret;
>  }
> +EXPORT_SYMBOL_GPL(kvm_vm_do_hva_range_op);
>  
>  static __always_inline int kvm_handle_hva_range(struct mmu_notifier *mn,
>  						unsigned long start,
> @@ -2595,12 +2596,28 @@ static void kvm_unmap_mem_range(struct kvm *kvm, gfn_t start, gfn_t end,
>  		kvm_flush_remote_tlbs(kvm);
>  }
>  
> +int kvm_vm_set_region_attr(struct kvm *kvm, gfn_t start, gfn_t end,
> +			   u64 attributes)
> +{
> +	gfn_t index;
> +	void *entry;
> +
> +	entry = attributes ? xa_mk_value(attributes) : NULL;
> +
> +	for (index = start; index < end; index++)
> +		if (xa_err(xa_store(&kvm->mem_attr_array, index, entry,
> +				    GFP_KERNEL_ACCOUNT)))
> +			break;
> +
> +	return index;
> +}
> +EXPORT_SYMBOL_GPL(kvm_vm_set_region_attr);
> +
>  static int kvm_vm_ioctl_set_mem_attributes(struct kvm *kvm,
>  					   struct kvm_memory_attributes *attrs)
>  {
>  	gfn_t start, end;
>  	unsigned long i;
> -	void *entry;
>  	int idx;
>  	u64 supported_attrs = kvm_supported_mem_attributes(kvm);
>  
> @@ -2617,8 +2634,6 @@ static int kvm_vm_ioctl_set_mem_attributes(struct kvm *kvm,
>  	start = attrs->address >> PAGE_SHIFT;
>  	end = (attrs->address + attrs->size - 1 + PAGE_SIZE) >> PAGE_SHIFT;
>  
> -	entry = attrs->attributes ? xa_mk_value(attrs->attributes) : NULL;
> -
>  	if (kvm_arch_has_private_mem(kvm)) {
>  		KVM_MMU_LOCK(kvm);
>  		kvm_mmu_invalidate_begin(kvm);
> @@ -2627,10 +2642,7 @@ static int kvm_vm_ioctl_set_mem_attributes(struct kvm *kvm,
>  	}
>  
>  	mutex_lock(&kvm->lock);
> -	for (i = start; i < end; i++)
> -		if (xa_err(xa_store(&kvm->mem_attr_array, i, entry,
> -				    GFP_KERNEL_ACCOUNT)))
> -			break;
> +	i = kvm_vm_set_region_attr(kvm, start, end, attrs->attributes);
>  	mutex_unlock(&kvm->lock);
>  
>  	if (kvm_arch_has_private_mem(kvm)) {
> @@ -2793,6 +2805,7 @@ unsigned long gfn_to_hva_memslot_prot(struct kvm_memory_slot *slot,
>  
>  	return hva;
>  }
> +EXPORT_SYMBOL_GPL(gfn_to_hva_memslot_prot);
>  
>  unsigned long gfn_to_hva_prot(struct kvm *kvm, gfn_t gfn, bool *writable)
>  {
> -- 
> 2.25.1
> 

Hmm.. but user space is still allowed to call KVM_SET_MEMORY_ATTRIBUTES
with KVM_MEMORY_ATTRIBUTE_PRIVATE set? How do these behaviours complement
each other?

SEV specific changes and kvm_vm_set_region_attr() definition should really
be separate patches.

BR, Jarkko
Michael Roth Feb. 20, 2023, 5:49 p.m. UTC | #3 
On Fri, Jan 13, 2023 at 08:11:14PM +0100, Borislav Petkov wrote:
> On Wed, Dec 14, 2022 at 01:40:02PM -0600, Michael Roth wrote:
> > From: Vishal Annapurve <vannapurve@google.com>
> > 
> > This change adds handling of HVA ranges to copy contents
> 
> s/This change adds handling of/Handle/
> 
> > +static int sev_launch_update_priv_gfn_handler(struct kvm *kvm,
> > +					      struct kvm_gfn_range *range,
> > +					      struct kvm_sev_cmd *argp)
> > +{
> > +	struct sev_data_launch_update_data data;
> > +	struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info;
> > +	gfn_t gfn;
> > +	kvm_pfn_t pfn;
> > +	struct kvm_memory_slot *memslot = range->slot;
> > +	int ret = 0;
> > +
> > +	data.reserved = 0;
> > +	data.handle = sev->handle;
> > +
> > +	for (gfn = range->start; gfn < range->end; gfn++) {
> > +		int order;
> > +		void *kvaddr;
> > +
> > +		ret = kvm_restricted_mem_get_pfn(memslot, gfn, &pfn, &order);
> > +		if (ret)
> > +			return ret;
> > +
> > +		kvaddr = pfn_to_kaddr(pfn);
> > +		if (!virt_addr_valid(kvaddr)) {
> > +			pr_err("Invalid kvaddr 0x%llx\n", (uint64_t)kvaddr);
> 
> Is that some debugging help leftover or what is that printk issued for?

A mix of error-reporting and debugging I think. I think the error message
isn't needed since the error value will get plumbed straight to
userspace and anything beyond that is kernel debugging, so I added some
context and switched this to pr_debug().

> > +			ret = -EINVAL;
> > +			goto e_ret;
> > +		}
> > +
> > +		ret = kvm_read_guest_page(kvm, gfn, kvaddr, 0, PAGE_SIZE);
> > +		if (ret) {
> > +			pr_err("guest read failed 0x%x\n", ret);
> > +			goto e_ret;
> > +		}
> > +
> > +		if (!this_cpu_has(X86_FEATURE_SME_COHERENT))
> 
> check_for_deprecated_apis: WARNING: arch/x86/kvm/svm/sev.c:602: Do not use this_cpu_has() - use cpu_feature_enabled() instead.
> 
> > +			clflush_cache_range(kvaddr, PAGE_SIZE);
> > +
> > +		data.len = PAGE_SIZE;
> > +		data.address = __sme_set(pfn << PAGE_SHIFT);
> > +		ret = sev_issue_cmd(kvm, SEV_CMD_LAUNCH_UPDATE_DATA, &data, &argp->error);
> > +		if (ret)
> > +			goto e_ret;
> > +		kvm_release_pfn_clean(pfn);
> > +	}
> > +	kvm_vm_set_region_attr(kvm, range->start, range->end,
> > +		true /* priv_attr */);
> 
> No need to break that line.
> 
> > +
> > +e_ret:
> > +	return ret;
> > +}
> > +
> > +static int sev_launch_update_gfn_handler(struct kvm *kvm, struct kvm_gfn_range *range,
> > +					 void *data)
> > +{
> > +	struct kvm_sev_cmd *argp = (struct kvm_sev_cmd *)data;
> > +
> > +	if (kvm_slot_can_be_private(range->slot))
> > +		return sev_launch_update_priv_gfn_handler(kvm, range, argp);
> > +
> > +	return sev_launch_update_shared_gfn_handler(kvm, range, argp);
> > +}
> > +
> > +static int sev_launch_update_data(struct kvm *kvm,
> > +		struct kvm_sev_cmd *argp)
> > +{
> > +	struct kvm_sev_launch_update_data params;
> > +
> > +	if (!sev_guest(kvm))
> > +		return -ENOTTY;
> > +
> > +	if (copy_from_user(&params, (void __user *)(uintptr_t)argp->data, sizeof(params)))
> > +		return -EFAULT;
> 
> Not gonna check those user-supplied values for sanity?
> 
> Or is this check
> 
>         if (WARN_ON_ONCE(hva_end <= hva_start))
>                 return -EINVAL;
> 
> in kvm_vm_do_hva_range_op() enough?

Only partially, but kvm_vm_do_hva_range_op() should sanitize the address
range and only call sev_launch_update_gfn_handler() on valid GFNs within
the range, so if userspace provides a bogus HVA range that doesn't
actually correspond to a valid memslot it'll simply be treated as a
no-op.

-Mike

> 
> Thx.
> 
> -- 
> Regards/Gruss,
>     Boris.
> 
> https://people.kernel.org/tglx/notes-about-netiquette
Michael Roth Feb. 20, 2023, 5:54 p.m. UTC | #4 
On Wed, Jan 18, 2023 at 01:42:45AM +0200, Jarkko Sakkinen wrote:
> On Wed, Dec 14, 2022 at 01:40:02PM -0600, Michael Roth wrote:
> > From: Vishal Annapurve <vannapurve@google.com>
> > 
> > This change adds handling of HVA ranges to copy contents
> > to private memory while doing sev launch update data.
> > 
> > mem_attr array is updated during LAUNCH_UPDATE_DATA to ensure
> > that encrypted memory is marked as private.
> > 
> > Signed-off-by: Vishal Annapurve <vannapurve@google.com>
> > [mdr: use gfn_to_hva_memslot_prot() for shared GFN handler to deal with
> >       read-only slots for ROMs]
> > Signed-off-by: Michael Roth <michael.roth@amd.com>
> > ---
> >  arch/x86/kvm/svm/sev.c   | 99 ++++++++++++++++++++++++++++++++++++----
> >  include/linux/kvm_host.h |  1 +
> >  virt/kvm/kvm_main.c      | 27 ++++++++---
> >  3 files changed, 111 insertions(+), 16 deletions(-)
> > 
> > diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> > index 69dbf17f0d6a..a7e4e3005786 100644
> > --- a/arch/x86/kvm/svm/sev.c
> > +++ b/arch/x86/kvm/svm/sev.c
> > @@ -493,23 +493,26 @@ static unsigned long get_num_contig_pages(unsigned long idx,
> >  	return pages;
> >  }
> >  
> > -static int sev_launch_update_data(struct kvm *kvm, struct kvm_sev_cmd *argp)
> > +static int sev_launch_update_shared_gfn_handler(struct kvm *kvm,
> > +						struct kvm_gfn_range *range,
> > +						struct kvm_sev_cmd *argp)
> >  {
> >  	unsigned long vaddr, vaddr_end, next_vaddr, npages, pages, size, i;
> >  	struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info;
> > -	struct kvm_sev_launch_update_data params;
> >  	struct sev_data_launch_update_data data;
> >  	struct page **inpages;
> >  	int ret;
> >  
> > -	if (!sev_guest(kvm))
> > -		return -ENOTTY;
> > -
> > -	if (copy_from_user(&params, (void __user *)(uintptr_t)argp->data, sizeof(params)))
> > -		return -EFAULT;
> > +	vaddr = gfn_to_hva_memslot_prot(range->slot, range->start, NULL);
> > +	pr_debug("%s: shared GFN: %llx, slot.id: %d, slot.base_gfn: %llx, slot.userspace_addr: %lx, slot.flags: %x, vaddr: %lx\n",
> > +		 __func__, range->start, range->slot->id, range->slot->base_gfn,
> > +		 range->slot->userspace_addr, range->slot->flags, vaddr);
> > +	if (kvm_is_error_hva(vaddr)) {
> > +		pr_err("vaddr is erroneous 0x%lx\n", vaddr);
> > +		return -EINVAL;
> > +	}
> >  
> > -	vaddr = params.uaddr;
> > -	size = params.len;
> > +	size = (range->end - range->start) << PAGE_SHIFT;
> >  	vaddr_end = vaddr + size;
> >  
> >  	/* Lock the user memory. */
> > @@ -561,6 +564,84 @@ static int sev_launch_update_data(struct kvm *kvm, struct kvm_sev_cmd *argp)
> >  	return ret;
> >  }
> >  
> > +static int sev_launch_update_priv_gfn_handler(struct kvm *kvm,
> > +					      struct kvm_gfn_range *range,
> > +					      struct kvm_sev_cmd *argp)
> > +{
> > +	struct sev_data_launch_update_data data;
> > +	struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info;
> > +	gfn_t gfn;
> > +	kvm_pfn_t pfn;
> > +	struct kvm_memory_slot *memslot = range->slot;
> > +	int ret = 0;
> > +
> > +	data.reserved = 0;
> > +	data.handle = sev->handle;
> > +
> > +	for (gfn = range->start; gfn < range->end; gfn++) {
> > +		int order;
> > +		void *kvaddr;
> > +
> > +		ret = kvm_restricted_mem_get_pfn(memslot, gfn, &pfn, &order);
> > +		if (ret)
> > +			return ret;
> > +
> > +		kvaddr = pfn_to_kaddr(pfn);
> > +		if (!virt_addr_valid(kvaddr)) {
> > +			pr_err("Invalid kvaddr 0x%llx\n", (uint64_t)kvaddr);
> > +			ret = -EINVAL;
> > +			goto e_ret;
> > +		}
> > +
> > +		ret = kvm_read_guest_page(kvm, gfn, kvaddr, 0, PAGE_SIZE);
> > +		if (ret) {
> > +			pr_err("guest read failed 0x%x\n", ret);
> > +			goto e_ret;
> > +		}
> > +
> > +		if (!this_cpu_has(X86_FEATURE_SME_COHERENT))
> > +			clflush_cache_range(kvaddr, PAGE_SIZE);
> > +
> > +		data.len = PAGE_SIZE;
> > +		data.address = __sme_set(pfn << PAGE_SHIFT);
> > +		ret = sev_issue_cmd(kvm, SEV_CMD_LAUNCH_UPDATE_DATA, &data, &argp->error);
> > +		if (ret)
> > +			goto e_ret;
> > +		kvm_release_pfn_clean(pfn);
> > +	}
> > +	kvm_vm_set_region_attr(kvm, range->start, range->end,
> > +		true /* priv_attr */);
> > +
> > +e_ret:
> > +	return ret;
> > +}
> > +
> > +static int sev_launch_update_gfn_handler(struct kvm *kvm, struct kvm_gfn_range *range,
> > +					 void *data)
> > +{
> > +	struct kvm_sev_cmd *argp = (struct kvm_sev_cmd *)data;
> > +
> > +	if (kvm_slot_can_be_private(range->slot))
> > +		return sev_launch_update_priv_gfn_handler(kvm, range, argp);
> > +
> > +	return sev_launch_update_shared_gfn_handler(kvm, range, argp);
> > +}
> > +
> > +static int sev_launch_update_data(struct kvm *kvm,
> > +		struct kvm_sev_cmd *argp)
> > +{
> > +	struct kvm_sev_launch_update_data params;
> > +
> > +	if (!sev_guest(kvm))
> > +		return -ENOTTY;
> > +
> > +	if (copy_from_user(&params, (void __user *)(uintptr_t)argp->data, sizeof(params)))
> > +		return -EFAULT;
> > +
> > +	return kvm_vm_do_hva_range_op(kvm, params.uaddr, params.uaddr + params.len,
> > +		sev_launch_update_gfn_handler, argp);
> > +}
> > +
> >  static int sev_es_sync_vmsa(struct vcpu_svm *svm)
> >  {
> >  	struct sev_es_save_area *save = svm->sev_es.vmsa;
> > diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
> > index 21a539ab17f6..33fa0b1435d3 100644
> > --- a/include/linux/kvm_host.h
> > +++ b/include/linux/kvm_host.h
> > @@ -973,6 +973,7 @@ int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
> >  void kvm_exit(void);
> >  
> >  void kvm_get_kvm(struct kvm *kvm);
> > +int kvm_vm_set_region_attr(struct kvm *kvm, gfn_t start, gfn_t end, u64 attributes);
> >  bool kvm_get_kvm_safe(struct kvm *kvm);
> >  void kvm_put_kvm(struct kvm *kvm);
> >  bool file_is_kvm(struct file *file);
> > diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> > index 4ff7adaf6c56..1343070657d1 100644
> > --- a/virt/kvm/kvm_main.c
> > +++ b/virt/kvm/kvm_main.c
> > @@ -747,6 +747,7 @@ int kvm_vm_do_hva_range_op(struct kvm *kvm, unsigned long hva_start,
> >  
> >  	return ret;
> >  }
> > +EXPORT_SYMBOL_GPL(kvm_vm_do_hva_range_op);
> >  
> >  static __always_inline int kvm_handle_hva_range(struct mmu_notifier *mn,
> >  						unsigned long start,
> > @@ -2595,12 +2596,28 @@ static void kvm_unmap_mem_range(struct kvm *kvm, gfn_t start, gfn_t end,
> >  		kvm_flush_remote_tlbs(kvm);
> >  }
> >  
> > +int kvm_vm_set_region_attr(struct kvm *kvm, gfn_t start, gfn_t end,
> > +			   u64 attributes)
> > +{
> > +	gfn_t index;
> > +	void *entry;
> > +
> > +	entry = attributes ? xa_mk_value(attributes) : NULL;
> > +
> > +	for (index = start; index < end; index++)
> > +		if (xa_err(xa_store(&kvm->mem_attr_array, index, entry,
> > +				    GFP_KERNEL_ACCOUNT)))
> > +			break;
> > +
> > +	return index;
> > +}
> > +EXPORT_SYMBOL_GPL(kvm_vm_set_region_attr);
> > +
> >  static int kvm_vm_ioctl_set_mem_attributes(struct kvm *kvm,
> >  					   struct kvm_memory_attributes *attrs)
> >  {
> >  	gfn_t start, end;
> >  	unsigned long i;
> > -	void *entry;
> >  	int idx;
> >  	u64 supported_attrs = kvm_supported_mem_attributes(kvm);
> >  
> > @@ -2617,8 +2634,6 @@ static int kvm_vm_ioctl_set_mem_attributes(struct kvm *kvm,
> >  	start = attrs->address >> PAGE_SHIFT;
> >  	end = (attrs->address + attrs->size - 1 + PAGE_SIZE) >> PAGE_SHIFT;
> >  
> > -	entry = attrs->attributes ? xa_mk_value(attrs->attributes) : NULL;
> > -
> >  	if (kvm_arch_has_private_mem(kvm)) {
> >  		KVM_MMU_LOCK(kvm);
> >  		kvm_mmu_invalidate_begin(kvm);
> > @@ -2627,10 +2642,7 @@ static int kvm_vm_ioctl_set_mem_attributes(struct kvm *kvm,
> >  	}
> >  
> >  	mutex_lock(&kvm->lock);
> > -	for (i = start; i < end; i++)
> > -		if (xa_err(xa_store(&kvm->mem_attr_array, i, entry,
> > -				    GFP_KERNEL_ACCOUNT)))
> > -			break;
> > +	i = kvm_vm_set_region_attr(kvm, start, end, attrs->attributes);
> >  	mutex_unlock(&kvm->lock);
> >  
> >  	if (kvm_arch_has_private_mem(kvm)) {
> > @@ -2793,6 +2805,7 @@ unsigned long gfn_to_hva_memslot_prot(struct kvm_memory_slot *slot,
> >  
> >  	return hva;
> >  }
> > +EXPORT_SYMBOL_GPL(gfn_to_hva_memslot_prot);
> >  
> >  unsigned long gfn_to_hva_prot(struct kvm *kvm, gfn_t gfn, bool *writable)
> >  {
> > -- 
> > 2.25.1
> > 
> 
> Hmm.. but user space is still allowed to call KVM_SET_MEMORY_ATTRIBUTES
> with KVM_MEMORY_ATTRIBUTE_PRIVATE set? How do these behaviours complement
> each other?

In the current series it's allowed. It reduces some headaches since an
SNP guest can issue duplicate page-state changes without violating the
spec, and it would complicate things further if kernel/userspace
attempted to enforce something stricter.

> 
> SEV specific changes and kvm_vm_set_region_attr() definition should really
> be separate patches.

Done.

-Mike

> 
> BR, Jarkko
diff mbox series

Patch

diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
index 69dbf17f0d6a..a7e4e3005786 100644
--- a/arch/x86/kvm/svm/sev.c
+++ b/arch/x86/kvm/svm/sev.c
@@ -493,23 +493,26 @@  static unsigned long get_num_contig_pages(unsigned long idx,
 	return pages;
 }
 
-static int sev_launch_update_data(struct kvm *kvm, struct kvm_sev_cmd *argp)
+static int sev_launch_update_shared_gfn_handler(struct kvm *kvm,
+						struct kvm_gfn_range *range,
+						struct kvm_sev_cmd *argp)
 {
 	unsigned long vaddr, vaddr_end, next_vaddr, npages, pages, size, i;
 	struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info;
-	struct kvm_sev_launch_update_data params;
 	struct sev_data_launch_update_data data;
 	struct page **inpages;
 	int ret;
 
-	if (!sev_guest(kvm))
-		return -ENOTTY;
-
-	if (copy_from_user(&params, (void __user *)(uintptr_t)argp->data, sizeof(params)))
-		return -EFAULT;
+	vaddr = gfn_to_hva_memslot_prot(range->slot, range->start, NULL);
+	pr_debug("%s: shared GFN: %llx, slot.id: %d, slot.base_gfn: %llx, slot.userspace_addr: %lx, slot.flags: %x, vaddr: %lx\n",
+		 __func__, range->start, range->slot->id, range->slot->base_gfn,
+		 range->slot->userspace_addr, range->slot->flags, vaddr);
+	if (kvm_is_error_hva(vaddr)) {
+		pr_err("vaddr is erroneous 0x%lx\n", vaddr);
+		return -EINVAL;
+	}
 
-	vaddr = params.uaddr;
-	size = params.len;
+	size = (range->end - range->start) << PAGE_SHIFT;
 	vaddr_end = vaddr + size;
 
 	/* Lock the user memory. */
@@ -561,6 +564,84 @@  static int sev_launch_update_data(struct kvm *kvm, struct kvm_sev_cmd *argp)
 	return ret;
 }
 
+static int sev_launch_update_priv_gfn_handler(struct kvm *kvm,
+					      struct kvm_gfn_range *range,
+					      struct kvm_sev_cmd *argp)
+{
+	struct sev_data_launch_update_data data;
+	struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info;
+	gfn_t gfn;
+	kvm_pfn_t pfn;
+	struct kvm_memory_slot *memslot = range->slot;
+	int ret = 0;
+
+	data.reserved = 0;
+	data.handle = sev->handle;
+
+	for (gfn = range->start; gfn < range->end; gfn++) {
+		int order;
+		void *kvaddr;
+
+		ret = kvm_restricted_mem_get_pfn(memslot, gfn, &pfn, &order);
+		if (ret)
+			return ret;
+
+		kvaddr = pfn_to_kaddr(pfn);
+		if (!virt_addr_valid(kvaddr)) {
+			pr_err("Invalid kvaddr 0x%llx\n", (uint64_t)kvaddr);
+			ret = -EINVAL;
+			goto e_ret;
+		}
+
+		ret = kvm_read_guest_page(kvm, gfn, kvaddr, 0, PAGE_SIZE);
+		if (ret) {
+			pr_err("guest read failed 0x%x\n", ret);
+			goto e_ret;
+		}
+
+		if (!this_cpu_has(X86_FEATURE_SME_COHERENT))
+			clflush_cache_range(kvaddr, PAGE_SIZE);
+
+		data.len = PAGE_SIZE;
+		data.address = __sme_set(pfn << PAGE_SHIFT);
+		ret = sev_issue_cmd(kvm, SEV_CMD_LAUNCH_UPDATE_DATA, &data, &argp->error);
+		if (ret)
+			goto e_ret;
+		kvm_release_pfn_clean(pfn);
+	}
+	kvm_vm_set_region_attr(kvm, range->start, range->end,
+		true /* priv_attr */);
+
+e_ret:
+	return ret;
+}
+
+static int sev_launch_update_gfn_handler(struct kvm *kvm, struct kvm_gfn_range *range,
+					 void *data)
+{
+	struct kvm_sev_cmd *argp = (struct kvm_sev_cmd *)data;
+
+	if (kvm_slot_can_be_private(range->slot))
+		return sev_launch_update_priv_gfn_handler(kvm, range, argp);
+
+	return sev_launch_update_shared_gfn_handler(kvm, range, argp);
+}
+
+static int sev_launch_update_data(struct kvm *kvm,
+		struct kvm_sev_cmd *argp)
+{
+	struct kvm_sev_launch_update_data params;
+
+	if (!sev_guest(kvm))
+		return -ENOTTY;
+
+	if (copy_from_user(&params, (void __user *)(uintptr_t)argp->data, sizeof(params)))
+		return -EFAULT;
+
+	return kvm_vm_do_hva_range_op(kvm, params.uaddr, params.uaddr + params.len,
+		sev_launch_update_gfn_handler, argp);
+}
+
 static int sev_es_sync_vmsa(struct vcpu_svm *svm)
 {
 	struct sev_es_save_area *save = svm->sev_es.vmsa;
diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
index 21a539ab17f6..33fa0b1435d3 100644
--- a/include/linux/kvm_host.h
+++ b/include/linux/kvm_host.h
@@ -973,6 +973,7 @@  int kvm_init(void *opaque, unsigned vcpu_size, unsigned vcpu_align,
 void kvm_exit(void);
 
 void kvm_get_kvm(struct kvm *kvm);
+int kvm_vm_set_region_attr(struct kvm *kvm, gfn_t start, gfn_t end, u64 attributes);
 bool kvm_get_kvm_safe(struct kvm *kvm);
 void kvm_put_kvm(struct kvm *kvm);
 bool file_is_kvm(struct file *file);
diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
index 4ff7adaf6c56..1343070657d1 100644
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@ -747,6 +747,7 @@  int kvm_vm_do_hva_range_op(struct kvm *kvm, unsigned long hva_start,
 
 	return ret;
 }
+EXPORT_SYMBOL_GPL(kvm_vm_do_hva_range_op);
 
 static __always_inline int kvm_handle_hva_range(struct mmu_notifier *mn,
 						unsigned long start,
@@ -2595,12 +2596,28 @@  static void kvm_unmap_mem_range(struct kvm *kvm, gfn_t start, gfn_t end,
 		kvm_flush_remote_tlbs(kvm);
 }
 
+int kvm_vm_set_region_attr(struct kvm *kvm, gfn_t start, gfn_t end,
+			   u64 attributes)
+{
+	gfn_t index;
+	void *entry;
+
+	entry = attributes ? xa_mk_value(attributes) : NULL;
+
+	for (index = start; index < end; index++)
+		if (xa_err(xa_store(&kvm->mem_attr_array, index, entry,
+				    GFP_KERNEL_ACCOUNT)))
+			break;
+
+	return index;
+}
+EXPORT_SYMBOL_GPL(kvm_vm_set_region_attr);
+
 static int kvm_vm_ioctl_set_mem_attributes(struct kvm *kvm,
 					   struct kvm_memory_attributes *attrs)
 {
 	gfn_t start, end;
 	unsigned long i;
-	void *entry;
 	int idx;
 	u64 supported_attrs = kvm_supported_mem_attributes(kvm);
 
@@ -2617,8 +2634,6 @@  static int kvm_vm_ioctl_set_mem_attributes(struct kvm *kvm,
 	start = attrs->address >> PAGE_SHIFT;
 	end = (attrs->address + attrs->size - 1 + PAGE_SIZE) >> PAGE_SHIFT;
 
-	entry = attrs->attributes ? xa_mk_value(attrs->attributes) : NULL;
-
 	if (kvm_arch_has_private_mem(kvm)) {
 		KVM_MMU_LOCK(kvm);
 		kvm_mmu_invalidate_begin(kvm);
@@ -2627,10 +2642,7 @@  static int kvm_vm_ioctl_set_mem_attributes(struct kvm *kvm,
 	}
 
 	mutex_lock(&kvm->lock);
-	for (i = start; i < end; i++)
-		if (xa_err(xa_store(&kvm->mem_attr_array, i, entry,
-				    GFP_KERNEL_ACCOUNT)))
-			break;
+	i = kvm_vm_set_region_attr(kvm, start, end, attrs->attributes);
 	mutex_unlock(&kvm->lock);
 
 	if (kvm_arch_has_private_mem(kvm)) {
@@ -2793,6 +2805,7 @@  unsigned long gfn_to_hva_memslot_prot(struct kvm_memory_slot *slot,
 
 	return hva;
 }
+EXPORT_SYMBOL_GPL(gfn_to_hva_memslot_prot);
 
 unsigned long gfn_to_hva_prot(struct kvm *kvm, gfn_t gfn, bool *writable)
 {