linux-kernel - Re: [PATCH Part2 v6 25/49] KVM: SVM: Disallow registering memory range from HugeTLB for SNP guest

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5c806192-f62c-5ea3-820d-8d629e0b0eba@suse.cz>
Date:   Thu, 4 Aug 2022 15:37:17 +0200
From:   Vlastimil Babka <vbabka@...e.cz>
To:     Ashish Kalra <Ashish.Kalra@....com>, x86@...nel.org,
        linux-kernel@...r.kernel.org, kvm@...r.kernel.org,
        linux-coco@...ts.linux.dev, linux-mm@...ck.org,
        linux-crypto@...r.kernel.org
Cc:     tglx@...utronix.de, mingo@...hat.com, jroedel@...e.de,
        thomas.lendacky@....com, hpa@...or.com, ardb@...nel.org,
        pbonzini@...hat.com, seanjc@...gle.com, vkuznets@...hat.com,
        jmattson@...gle.com, luto@...nel.org, dave.hansen@...ux.intel.com,
        slp@...hat.com, pgonda@...gle.com, peterz@...radead.org,
        srinivas.pandruvada@...ux.intel.com, rientjes@...gle.com,
        dovmurik@...ux.ibm.com, tobin@....com, bp@...en8.de,
        michael.roth@....com, kirill@...temov.name, ak@...ux.intel.com,
        tony.luck@...el.com, marcorr@...gle.com,
        sathyanarayanan.kuppuswamy@...ux.intel.com, alpergun@...gle.com,
        dgilbert@...hat.com, jarkko@...nel.org
Subject: Re: [PATCH Part2 v6 25/49] KVM: SVM: Disallow registering memory
 range from HugeTLB for SNP guest

On 6/21/22 01:07, Ashish Kalra wrote:
> From: Brijesh Singh <brijesh.singh@....com>
> 
> While creating the VM, userspace call the KVM_MEMORY_ENCRYPT_REG_REGION
> ioctl to register the memory regions for the guest. This registered
> memory region is typically used as a guest RAM. Later, the guest may
> issue the page state change (PSC) request that will require splitting
> the large page into smaller page. If the memory is allocated from the
> HugeTLB then hypervisor will not be able to split it.
> 
> Do not allow registering the memory range backed by the HugeTLB until
> the hypervisor support is added to handle the case.
> 
> Signed-off-by: Brijesh Singh <brijesh.singh@....com>
> ---
>  arch/x86/kvm/svm/sev.c | 37 +++++++++++++++++++++++++++++++++++++
>  1 file changed, 37 insertions(+)
> 
> diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> index 9e6fc7a94ed7..41b83aa6b5f4 100644
> --- a/arch/x86/kvm/svm/sev.c
> +++ b/arch/x86/kvm/svm/sev.c
> @@ -17,6 +17,7 @@
>  #include <linux/misc_cgroup.h>
>  #include <linux/processor.h>
>  #include <linux/trace_events.h>
> +#include <linux/hugetlb.h>
>  
>  #include <asm/pkru.h>
>  #include <asm/trapnr.h>
> @@ -2007,6 +2008,35 @@ int sev_mem_enc_ioctl(struct kvm *kvm, void __user *argp)
>  	return r;
>  }
>  
> +static bool is_range_hugetlb(struct kvm *kvm, struct kvm_enc_region *range)
> +{
> +	struct vm_area_struct *vma;
> +	u64 start, end;
> +	bool ret = true;
> +
> +	start = range->addr;
> +	end = start + range->size;
> +
> +	mmap_read_lock(kvm->mm);
> +
> +	do {
> +		vma = find_vma_intersection(kvm->mm, start, end);
> +		if (!vma)
> +			goto unlock;
> +
> +		if (is_vm_hugetlb_page(vma))
> +			goto unlock;
> +
> +		start = vma->vm_end;
> +	} while (end > vma->vm_end);

Note it's more efficient to only find the first vma and then iterate using
vma->vm_next. But the details will change when maple tree is merged, and
likely this patch won't exist after rebasing to UPM anyway...

> +	ret = false;
> +
> +unlock:
> +	mmap_read_unlock(kvm->mm);
> +	return ret;
> +}
> +
>  int sev_mem_enc_register_region(struct kvm *kvm,
>  				struct kvm_enc_region *range)
>  {
> @@ -2024,6 +2054,13 @@ int sev_mem_enc_register_region(struct kvm *kvm,
>  	if (range->addr > ULONG_MAX || range->size > ULONG_MAX)
>  		return -EINVAL;
>  
> +	/*
> +	 * SEV-SNP does not support the backing pages from the HugeTLB. Verify
> +	 * that the registered memory range is not from the HugeTLB.
> +	 */
> +	if (sev_snp_guest(kvm) && is_range_hugetlb(kvm, range))
> +		return -EINVAL;
> +
>  	region = kzalloc(sizeof(*region), GFP_KERNEL_ACCOUNT);
>  	if (!region)
>  		return -ENOMEM;