| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20230422111834.00003689@gmail.com>
Date: Sat, 22 Apr 2023 11:18:34 +0300
From: Zhi Wang <zhi.wang.linux@...il.com>
To: isaku.yamahata@...el.com
Cc: kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
isaku.yamahata@...il.com, Paolo Bonzini <pbonzini@...hat.com>,
erdemaktas@...gle.com, Sean Christopherson <seanjc@...gle.com>,
Sagi Shahar <sagis@...gle.com>,
David Matlack <dmatlack@...gle.com>,
Kai Huang <kai.huang@...el.com>,
Sean Christopherson <sean.j.christopherson@...el.com>,
Michael Roth <michael.roth@....com>
Subject: Re: [PATCH v13 048/113] KVM: x86/mmu: Disallow dirty logging for
x86 TDX
On Sun, 12 Mar 2023 10:56:12 -0700
isaku.yamahata@...el.com wrote:
> From: Isaku Yamahata <isaku.yamahata@...el.com>
>
> TDX doesn't support dirty logging. Report dirty logging isn't supported so
> that device model, for example qemu, can properly handle it. Silently
> ignore on dirty logging on private GFNs of TDX.
>
> Signed-off-by: Sean Christopherson <sean.j.christopherson@...el.com>
> Signed-off-by: Isaku Yamahata <isaku.yamahata@...el.com>
> ---
> arch/x86/kvm/mmu/mmu.c | 3 +++
> arch/x86/kvm/mmu/tdp_mmu.c | 36 +++++++++++++++++++++++++++++++++++-
> arch/x86/kvm/x86.c | 8 ++++++++
> include/linux/kvm_host.h | 1 +
> virt/kvm/kvm_main.c | 10 +++++++++-
> 5 files changed, 56 insertions(+), 2 deletions(-)
>
> diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
> index 3d68da838f94..1f250fa8ce36 100644
> --- a/arch/x86/kvm/mmu/mmu.c
> +++ b/arch/x86/kvm/mmu/mmu.c
> @@ -6706,6 +6706,9 @@ static bool kvm_mmu_zap_collapsible_spte(struct kvm *kvm,
> for_each_rmap_spte(rmap_head, &iter, sptep) {
> sp = sptep_to_sp(sptep);
>
> + /* Private page dirty logging is not supported yet. */
> + KVM_BUG_ON(is_private_sptep(sptep), kvm);
> +
> /*
> * We cannot do huge page mapping for indirect shadow pages,
> * which are found on the last rmap (level = 1) when not using
> diff --git a/arch/x86/kvm/mmu/tdp_mmu.c b/arch/x86/kvm/mmu/tdp_mmu.c
> index a3402b33fa5d..58a236a69ec7 100644
> --- a/arch/x86/kvm/mmu/tdp_mmu.c
> +++ b/arch/x86/kvm/mmu/tdp_mmu.c
> @@ -1474,9 +1474,27 @@ static __always_inline bool kvm_tdp_mmu_handle_gfn(struct kvm *kvm,
> * into this helper allow blocking; it'd be dead, wasteful code.
> */
> for_each_tdp_mmu_root(kvm, root, range->slot->as_id) {
> + gfn_t start;
> + gfn_t end;
> +
> + /*
> + * For now, operation on private GPA, e.g. dirty page logging,
> + * isn't supported yet.
> + */
> + if (is_private_sp(root))
> + continue;
> +
> rcu_read_lock();
>
> - tdp_root_for_each_leaf_pte(iter, root, range->start, range->end)
> + /*
> + * For TDX shared mapping, set GFN shared bit to the range,
> + * so the handler() doesn't need to set it, to avoid duplicated
> + * code in multiple handler()s.
> + */
> + start = kvm_gfn_to_shared(kvm, range->start);
> + end = kvm_gfn_to_shared(kvm, range->end);
> +
> + tdp_root_for_each_leaf_pte(iter, root, start, end)
> ret |= handler(kvm, &iter, range);
>
> rcu_read_unlock();
> @@ -1959,6 +1977,13 @@ void kvm_tdp_mmu_clear_dirty_pt_masked(struct kvm *kvm,
> struct kvm_mmu_page *root;
>
> lockdep_assert_held_write(&kvm->mmu_lock);
> + /*
> + * First TDX generation doesn't support clearing dirty bit,
> + * since there's no secure EPT API to support it. For now silently
> + * ignore KVM_CLEAR_DIRTY_LOG.
> + */
> + if (!kvm_arch_dirty_log_supported(kvm))
> + return;
> for_each_tdp_mmu_root(kvm, root, slot->as_id)
> clear_dirty_pt_masked(kvm, root, gfn, mask, wrprot);
> }
> @@ -2078,6 +2103,15 @@ bool kvm_tdp_mmu_write_protect_gfn(struct kvm *kvm,
> bool spte_set = false;
>
> lockdep_assert_held_write(&kvm->mmu_lock);
> +
> + /*
> + * First TDX generation doesn't support write protecting private
> + * mappings, silently ignore the request. KVM_GET_DIRTY_LOG etc
> + * can reach here, no warning.
> + */
> + if (!kvm_arch_dirty_log_supported(kvm))
> + return false;
> +
> for_each_tdp_mmu_root(kvm, root, slot->as_id)
> spte_set |= write_protect_gfn(kvm, root, gfn, min_level);
>
> diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
> index a0960b468c74..6d7ca694e1c9 100644
> --- a/arch/x86/kvm/x86.c
> +++ b/arch/x86/kvm/x86.c
> @@ -12589,6 +12589,9 @@ static void kvm_mmu_slot_apply_flags(struct kvm *kvm,
> u32 new_flags = new ? new->flags : 0;
> bool log_dirty_pages = new_flags & KVM_MEM_LOG_DIRTY_PAGES;
>
> + if (!kvm_arch_dirty_log_supported(kvm) && log_dirty_pages)
> + return;
> +
> /*
> * Update CPU dirty logging if dirty logging is being toggled. This
> * applies to all operations.
> @@ -13561,6 +13564,11 @@ int kvm_sev_es_string_io(struct kvm_vcpu *vcpu, unsigned int size,
> }
> EXPORT_SYMBOL_GPL(kvm_sev_es_string_io);
>
> +bool kvm_arch_dirty_log_supported(struct kvm *kvm)
> +{
> + return kvm->arch.vm_type != KVM_X86_PROTECTED_VM;
> +}
> +
Maybe introduce a new x86 ops for SNP/TDX to check this separately as SNP
might still support it? With the current approach, I think both SNP/TDX
will be affected. So does the later patch about page-tracking.
Michael, can you confirm this?
> EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_entry);
> EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_exit);
> EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_fast_mmio);
> diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
> index 5a144497c930..3cd537f4b38b 100644
> --- a/include/linux/kvm_host.h
> +++ b/include/linux/kvm_host.h
> @@ -1495,6 +1495,7 @@ bool kvm_arch_dy_has_pending_interrupt(struct kvm_vcpu *vcpu);
> int kvm_arch_post_init_vm(struct kvm *kvm);
> void kvm_arch_pre_destroy_vm(struct kvm *kvm);
> int kvm_arch_create_vm_debugfs(struct kvm *kvm);
> +bool kvm_arch_dirty_log_supported(struct kvm *kvm);
>
> #ifndef __KVM_HAVE_ARCH_VM_ALLOC
> /*
> diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> index 42f01d0d6a49..e9f8225f3406 100644
> --- a/virt/kvm/kvm_main.c
> +++ b/virt/kvm/kvm_main.c
> @@ -1700,10 +1700,18 @@ static void kvm_replace_memslot(struct kvm *kvm,
> }
> }
>
> +bool __weak kvm_arch_dirty_log_supported(struct kvm *kvm)
> +{
> + return true;
> +}
> +
> static int check_memory_region_flags(struct kvm *kvm,
> const struct kvm_userspace_memory_region2 *mem)
> {
> - u32 valid_flags = KVM_MEM_LOG_DIRTY_PAGES;
> + u32 valid_flags = 0;
> +
> + if (kvm_arch_dirty_log_supported(kvm))
> + valid_flags |= KVM_MEM_LOG_DIRTY_PAGES;
>
> if (kvm_arch_has_private_mem(kvm))
> valid_flags |= KVM_MEM_PRIVATE;
Powered by blists - more mailing lists