lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 23 Sep 2021 18:18:29 +0100 From: "Dr. David Alan Gilbert" <dgilbert@...hat.com> To: Brijesh Singh <brijesh.singh@....com> Cc: x86@...nel.org, linux-kernel@...r.kernel.org, kvm@...r.kernel.org, linux-coco@...ts.linux.dev, linux-mm@...ck.org, linux-crypto@...r.kernel.org, Thomas Gleixner <tglx@...utronix.de>, Ingo Molnar <mingo@...hat.com>, Joerg Roedel <jroedel@...e.de>, Tom Lendacky <thomas.lendacky@....com>, "H. Peter Anvin" <hpa@...or.com>, Ard Biesheuvel <ardb@...nel.org>, Paolo Bonzini <pbonzini@...hat.com>, Sean Christopherson <seanjc@...gle.com>, Vitaly Kuznetsov <vkuznets@...hat.com>, Wanpeng Li <wanpengli@...cent.com>, Jim Mattson <jmattson@...gle.com>, Andy Lutomirski <luto@...nel.org>, Dave Hansen <dave.hansen@...ux.intel.com>, Sergio Lopez <slp@...hat.com>, Peter Gonda <pgonda@...gle.com>, Peter Zijlstra <peterz@...radead.org>, Srinivas Pandruvada <srinivas.pandruvada@...ux.intel.com>, David Rientjes <rientjes@...gle.com>, Dov Murik <dovmurik@...ux.ibm.com>, Tobin Feldman-Fitzthum <tobin@....com>, Borislav Petkov <bp@...en8.de>, Michael Roth <michael.roth@....com>, Vlastimil Babka <vbabka@...e.cz>, "Kirill A . Shutemov" <kirill@...temov.name>, Andi Kleen <ak@...ux.intel.com>, tony.luck@...el.com, marcorr@...gle.com, sathyanarayanan.kuppuswamy@...ux.intel.com Subject: Re: [PATCH Part2 v5 26/45] KVM: SVM: Mark the private vma unmerable for SEV-SNP guests * Brijesh Singh (brijesh.singh@....com) wrote: > When SEV-SNP is enabled, the guest private pages are added in the RMP > table; while adding the pages, the rmp_make_private() unmaps the pages > from the direct map. If KSM attempts to access those unmapped pages then > it will trigger #PF (page-not-present). > > Encrypted guest pages cannot be shared between the process, so an > userspace should not mark the region mergeable but to be safe, mark the > process vma unmerable before adding the pages in the RMP table. ^^^^^^^^^ (and in the subject) -> unmergeable > > Signed-off-by: Brijesh Singh <brijesh.singh@....com> > --- > arch/x86/kvm/svm/sev.c | 32 ++++++++++++++++++++++++++++++++ > 1 file changed, 32 insertions(+) > > diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c > index 4b126598b7aa..dcef0ae5f8e4 100644 > --- a/arch/x86/kvm/svm/sev.c > +++ b/arch/x86/kvm/svm/sev.c > @@ -18,11 +18,13 @@ > #include <linux/processor.h> > #include <linux/trace_events.h> > #include <linux/sev.h> > +#include <linux/ksm.h> > #include <asm/fpu/internal.h> > > #include <asm/pkru.h> > #include <asm/trapnr.h> > #include <asm/sev.h> > +#include <asm/mman.h> > > #include "x86.h" > #include "svm.h" > @@ -1683,6 +1685,30 @@ static bool is_hva_registered(struct kvm *kvm, hva_t hva, size_t len) > return false; > } > > +static int snp_mark_unmergable(struct kvm *kvm, u64 start, u64 size) ^^^^^^^^^^ > +{ > + struct vm_area_struct *vma; > + u64 end = start + size; Do you need to worry about wrap there? (User supplied start/size?) Dave > + int ret; > + > + do { > + vma = find_vma_intersection(kvm->mm, start, end); > + if (!vma) { > + ret = -EINVAL; > + break; > + } > + > + ret = ksm_madvise(vma, vma->vm_start, vma->vm_end, > + MADV_UNMERGEABLE, &vma->vm_flags); > + if (ret) > + break; > + > + start = vma->vm_end; > + } while (end > vma->vm_end); > + > + return ret; > +} > + > static int snp_launch_update(struct kvm *kvm, struct kvm_sev_cmd *argp) > { > struct kvm_sev_info *sev = &to_kvm_svm(kvm)->sev_info; > @@ -1707,6 +1733,12 @@ static int snp_launch_update(struct kvm *kvm, struct kvm_sev_cmd *argp) > if (!is_hva_registered(kvm, params.uaddr, params.len)) > return -EINVAL; > > + mmap_write_lock(kvm->mm); > + ret = snp_mark_unmergable(kvm, params.uaddr, params.len); > + mmap_write_unlock(kvm->mm); > + if (ret) > + return -EFAULT; > + > /* > * The userspace memory is already locked so technically we don't > * need to lock it again. Later part of the function needs to know > -- > 2.17.1 > > -- Dr. David Alan Gilbert / dgilbert@...hat.com / Manchester, UK
Powered by blists - more mailing lists