| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 30 Aug 2022 22:42:56 +0000
From: Vishal Annapurve <vannapurve@...gle.com>
To: x86@...nel.org, kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
linux-kselftest@...r.kernel.org
Cc: pbonzini@...hat.com, vkuznets@...hat.com, wanpengli@...cent.com,
jmattson@...gle.com, joro@...tes.org, tglx@...utronix.de,
mingo@...hat.com, bp@...en8.de, dave.hansen@...ux.intel.com,
hpa@...or.com, shuah@...nel.org, yang.zhong@...el.com,
drjones@...hat.com, ricarkol@...gle.com, aaronlewis@...gle.com,
wei.w.wang@...el.com, kirill.shutemov@...ux.intel.com,
corbet@....net, hughd@...gle.com, jlayton@...nel.org,
bfields@...ldses.org, akpm@...ux-foundation.org,
chao.p.peng@...ux.intel.com, yu.c.zhang@...ux.intel.com,
jun.nakajima@...el.com, dave.hansen@...el.com,
michael.roth@....com, qperret@...gle.com, steven.price@....com,
ak@...ux.intel.com, david@...hat.com, luto@...nel.org,
vbabka@...e.cz, marcorr@...gle.com, erdemaktas@...gle.com,
pgonda@...gle.com, nikunj@....com, seanjc@...gle.com,
diviness@...gle.com, maz@...nel.org, dmatlack@...gle.com,
axelrasmussen@...gle.com, maciej.szmigiero@...cle.com,
mizhang@...gle.com, bgardon@...gle.com,
Vishal Annapurve <vannapurve@...gle.com>
Subject: [RFC V2 PATCH 5/8] selftests: kvm: Update usage of private mem lib
for SEV VMs
Add/update APIs to allow reusing private mem lib for SEV VMs.
Memory conversion for SEV VMs includes updating guest pagetables
based on virtual addresses to toggle C-bit.
Signed-off-by: Vishal Annapurve <vannapurve@...gle.com>
---
.../kvm/include/x86_64/private_mem.h | 9 +-
.../selftests/kvm/lib/x86_64/private_mem.c | 103 +++++++++++++-----
2 files changed, 83 insertions(+), 29 deletions(-)
diff --git a/tools/testing/selftests/kvm/include/x86_64/private_mem.h b/tools/testing/selftests/kvm/include/x86_64/private_mem.h
index 645bf3f61d1e..183b53b8c486 100644
--- a/tools/testing/selftests/kvm/include/x86_64/private_mem.h
+++ b/tools/testing/selftests/kvm/include/x86_64/private_mem.h
@@ -14,10 +14,10 @@ enum mem_conversion_type {
TO_SHARED
};
-void guest_update_mem_access(enum mem_conversion_type type, uint64_t gpa,
- uint64_t size);
-void guest_update_mem_map(enum mem_conversion_type type, uint64_t gpa,
- uint64_t size);
+void guest_update_mem_access(enum mem_conversion_type type, uint64_t gva,
+ uint64_t gpa, uint64_t size);
+void guest_update_mem_map(enum mem_conversion_type type, uint64_t gva,
+ uint64_t gpa, uint64_t size);
void guest_map_ucall_page_shared(void);
@@ -45,6 +45,7 @@ struct vm_setup_info {
struct test_setup_info test_info;
guest_code_fn guest_fn;
io_exit_handler ioexit_cb;
+ uint32_t policy; /* Used for Sev VMs */
};
void execute_vm_with_private_mem(struct vm_setup_info *info);
diff --git a/tools/testing/selftests/kvm/lib/x86_64/private_mem.c b/tools/testing/selftests/kvm/lib/x86_64/private_mem.c
index f6dcfa4d353f..28d93754e1f2 100644
--- a/tools/testing/selftests/kvm/lib/x86_64/private_mem.c
+++ b/tools/testing/selftests/kvm/lib/x86_64/private_mem.c
@@ -22,12 +22,45 @@
#include <kvm_util.h>
#include <private_mem.h>
#include <processor.h>
+#include <sev.h>
+
+#define GUEST_PGT_MIN_VADDR 0x10000
+
+/* Variables populated by userspace logic and consumed by guest code */
+static bool is_sev_vm;
+static struct guest_pgt_info *sev_gpgt_info;
+static uint8_t sev_enc_bit;
+
+static void sev_guest_set_clr_pte_bit(uint64_t vaddr_start, uint64_t mem_size,
+ bool set)
+{
+ uint64_t vaddr = vaddr_start;
+ uint32_t guest_page_size = sev_gpgt_info->page_size;
+ uint32_t num_pages;
+
+ GUEST_ASSERT(!(mem_size % guest_page_size) && !(vaddr_start %
+ guest_page_size));
+
+ num_pages = mem_size / guest_page_size;
+ for (uint32_t i = 0; i < num_pages; i++) {
+ uint64_t *pte = guest_code_get_pte(sev_gpgt_info, vaddr);
+
+ GUEST_ASSERT(pte);
+ if (set)
+ *pte |= (1ULL << sev_enc_bit);
+ else
+ *pte &= ~(1ULL << sev_enc_bit);
+ asm volatile("invlpg (%0)" :: "r"(vaddr) : "memory");
+ vaddr += guest_page_size;
+ }
+}
/*
* Execute KVM hypercall to change memory access type for a given gpa range.
*
* Input Args:
* type - memory conversion type TO_SHARED/TO_PRIVATE
+ * gva - starting gva address
* gpa - starting gpa address
* size - size of the range starting from gpa for which memory access needs
* to be changed
@@ -40,9 +73,12 @@
* for a given gpa range. This API is useful in exercising implicit conversion
* path.
*/
-void guest_update_mem_access(enum mem_conversion_type type, uint64_t gpa,
- uint64_t size)
+void guest_update_mem_access(enum mem_conversion_type type, uint64_t gva,
+ uint64_t gpa, uint64_t size)
{
+ if (is_sev_vm)
+ sev_guest_set_clr_pte_bit(gva, size, type == TO_PRIVATE ? true : false);
+
int ret = kvm_hypercall(KVM_HC_MAP_GPA_RANGE, gpa, size >> MIN_PAGE_SHIFT,
type == TO_PRIVATE ? KVM_MARK_GPA_RANGE_ENC_ACCESS :
KVM_CLR_GPA_RANGE_ENC_ACCESS, 0);
@@ -54,6 +90,7 @@ void guest_update_mem_access(enum mem_conversion_type type, uint64_t gpa,
*
* Input Args:
* type - memory conversion type TO_SHARED/TO_PRIVATE
+ * gva - starting gva address
* gpa - starting gpa address
* size - size of the range starting from gpa for which memory type needs
* to be changed
@@ -65,9 +102,12 @@ void guest_update_mem_access(enum mem_conversion_type type, uint64_t gpa,
* Function called by guest logic in selftests to update the memory type for a
* given gpa range. This API is useful in exercising explicit conversion path.
*/
-void guest_update_mem_map(enum mem_conversion_type type, uint64_t gpa,
- uint64_t size)
+void guest_update_mem_map(enum mem_conversion_type type, uint64_t gva,
+ uint64_t gpa, uint64_t size)
{
+ if (is_sev_vm)
+ sev_guest_set_clr_pte_bit(gva, size, type == TO_PRIVATE ? true : false);
+
int ret = kvm_hypercall(KVM_HC_MAP_GPA_RANGE, gpa, size >> MIN_PAGE_SHIFT,
type == TO_PRIVATE ? KVM_MAP_GPA_RANGE_ENCRYPTED :
KVM_MAP_GPA_RANGE_DECRYPTED, 0);
@@ -90,30 +130,15 @@ void guest_update_mem_map(enum mem_conversion_type type, uint64_t gpa,
void guest_map_ucall_page_shared(void)
{
vm_paddr_t ucall_paddr = get_ucall_pool_paddr();
+ GUEST_ASSERT(ucall_paddr);
- guest_update_mem_access(TO_SHARED, ucall_paddr, 1 << MIN_PAGE_SHIFT);
+ int ret = kvm_hypercall(KVM_HC_MAP_GPA_RANGE, ucall_paddr, 1,
+ KVM_MAP_GPA_RANGE_DECRYPTED, 0);
+ GUEST_ASSERT_1(!ret, ret);
}
-/*
- * Execute KVM ioctl to back/unback private memory for given gpa range.
- *
- * Input Args:
- * vm - kvm_vm handle
- * gpa - starting gpa address
- * size - size of the gpa range
- * op - mem_op indicating whether private memory needs to be allocated or
- * unbacked
- *
- * Output Args: None
- *
- * Return: None
- *
- * Function called by host userspace logic in selftests to back/unback private
- * memory for gpa ranges. This function is useful to setup initial boot private
- * memory and then convert memory during runtime.
- */
-void vm_update_private_mem(struct kvm_vm *vm, uint64_t gpa, uint64_t size,
- enum mem_op op)
+static void vm_update_private_mem_internal(struct kvm_vm *vm, uint64_t gpa,
+ uint64_t size, enum mem_op op, bool encrypt)
{
int priv_memfd;
uint64_t priv_offset, guest_phys_base, fd_offset;
@@ -142,6 +167,10 @@ void vm_update_private_mem(struct kvm_vm *vm, uint64_t gpa, uint64_t size,
TEST_ASSERT(ret == 0, "fallocate failed\n");
enc_region.addr = gpa;
enc_region.size = size;
+
+ if (!encrypt)
+ return;
+
if (op == ALLOCATE_MEM) {
printf("doing encryption for gpa 0x%lx size 0x%lx\n", gpa, size);
vm_ioctl(vm, KVM_MEMORY_ENCRYPT_REG_REGION, &enc_region);
@@ -151,6 +180,30 @@ void vm_update_private_mem(struct kvm_vm *vm, uint64_t gpa, uint64_t size,
}
}
+/*
+ * Execute KVM ioctl to back/unback private memory for given gpa range.
+ *
+ * Input Args:
+ * vm - kvm_vm handle
+ * gpa - starting gpa address
+ * size - size of the gpa range
+ * op - mem_op indicating whether private memory needs to be allocated or
+ * unbacked
+ *
+ * Output Args: None
+ *
+ * Return: None
+ *
+ * Function called by host userspace logic in selftests to back/unback private
+ * memory for gpa ranges. This function is useful to setup initial boot private
+ * memory and then convert memory during runtime.
+ */
+void vm_update_private_mem(struct kvm_vm *vm, uint64_t gpa, uint64_t size,
+ enum mem_op op)
+{
+ vm_update_private_mem_internal(vm, gpa, size, op, true /* encrypt */);
+}
+
static void handle_vm_exit_map_gpa_hypercall(struct kvm_vm *vm,
volatile struct kvm_run *run)
{
--
2.37.2.672.g94769d06f0-goog
Powered by blists - more mailing lists