| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <Z3zRSbq4Ueboq/Zv@yzhao56-desk.sh.intel.com>
Date: Tue, 7 Jan 2025 15:01:29 +0800
From: Yan Zhao <yan.y.zhao@...el.com>
To: Paolo Bonzini <pbonzini@...hat.com>
CC: <linux-kernel@...r.kernel.org>, <kvm@...r.kernel.org>,
<kai.huang@...el.com>, <rick.p.edgecombe@...el.com>,
<dave.hansen@...ux.intel.com>, Isaku Yamahata <isaku.yamahata@...el.com>,
Sean Christopherson <sean.j.christopherson@...el.com>
Subject: Re: [PATCH 11/13] x86/virt/tdx: Add SEAMCALL wrappers for TD
measurement of initial contents
Here's the KVM side fixup for patches 7-11. (attached in case you want
to take a look).
diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
index ced4d09b2673..c3a84eb4694a 100644
--- a/arch/x86/kvm/vmx/tdx.c
+++ b/arch/x86/kvm/vmx/tdx.c
@@ -1606,13 +1606,11 @@ static int tdx_mem_page_aug(struct kvm *kvm, gfn_t gfn,
enum pg_level level, kvm_pfn_t pfn)
{
struct kvm_tdx *kvm_tdx = to_kvm_tdx(kvm);
- hpa_t tdr_pa = page_to_phys(kvm_tdx->td.tdr_page);
- hpa_t hpa = pfn_to_hpa(pfn);
- gpa_t gpa = gfn_to_gpa(gfn);
+ struct page *private_page = pfn_to_page(pfn);
u64 entry, level_state;
u64 err;
- err = tdh_mem_page_aug(tdr_pa, gpa, hpa, &entry, &level_state);
+ err = tdh_mem_page_aug(&kvm_tdx->td, gfn, private_page, &entry, &level_state);
if (unlikely(err & TDX_OPERAND_BUSY)) {
tdx_unpin(kvm, pfn);
return -EBUSY;
@@ -1687,9 +1685,6 @@ static int tdx_sept_drop_private_spte(struct kvm *kvm, gfn_t gfn,
{
int tdx_level = pg_level_to_tdx_sept_level(level);
struct kvm_tdx *kvm_tdx = to_kvm_tdx(kvm);
- hpa_t tdr_pa = page_to_phys(kvm_tdx->td.tdr_page);
- gpa_t gpa = gfn_to_gpa(gfn);
- hpa_t hpa = pfn_to_hpa(pfn);
u64 err, entry, level_state;
/* TODO: handle large pages. */
@@ -1705,7 +1700,7 @@ static int tdx_sept_drop_private_spte(struct kvm *kvm, gfn_t gfn,
* condition with other vcpu sept operation. Race only with
* TDH.VP.ENTER.
*/
- err = tdh_mem_page_remove(tdr_pa, gpa, tdx_level, &entry,
+ err = tdh_mem_page_remove(&kvm_tdx->td, gfn, tdx_level, &entry,
&level_state);
} while (unlikely(err == TDX_ERROR_SEPT_BUSY));
@@ -1734,7 +1729,7 @@ static int tdx_sept_drop_private_spte(struct kvm *kvm, gfn_t gfn,
* this page was removed above, other thread shouldn't be
* repeatedly operating on this page. Just retry loop.
*/
- err = tdh_phymem_page_wbinvd_hkid(hpa, (u16)kvm_tdx->hkid);
+ err = tdh_phymem_page_wbinvd_hkid(pfn_to_page(pfn), kvm_tdx->hkid);
} while (unlikely(err == (TDX_OPERAND_BUSY | TDX_OPERAND_ID_RCX)));
if (KVM_BUG_ON(err, kvm)) {
@@ -1751,13 +1746,11 @@ int tdx_sept_link_private_spt(struct kvm *kvm, gfn_t gfn,
{
int tdx_level = pg_level_to_tdx_sept_level(level);
struct kvm_tdx *kvm_tdx = to_kvm_tdx(kvm);
- hpa_t tdr_pa = page_to_phys(kvm_tdx->td.tdr_page);
- gpa_t gpa = gfn_to_gpa(gfn);
- hpa_t hpa = __pa(private_spt);
+ struct page *sept_page = virt_to_page(private_spt);
u64 err, entry, level_state;
- err = tdh_mem_sept_add(tdr_pa, gpa, tdx_level, hpa, &entry,
- &level_state);
+ err = tdh_mem_sept_add(&kvm_tdx->td, gfn, tdx_level, sept_page,
+ &entry, &level_state);
if (unlikely(err == TDX_ERROR_SEPT_BUSY))
return -EAGAIN;
if (KVM_BUG_ON(err, kvm)) {
@@ -1773,14 +1766,13 @@ static int tdx_sept_zap_private_spte(struct kvm *kvm, gfn_t gfn,
{
int tdx_level = pg_level_to_tdx_sept_level(level);
struct kvm_tdx *kvm_tdx = to_kvm_tdx(kvm);
- hpa_t tdr_pa = page_to_phys(kvm_tdx->td.tdr_page);
- gpa_t gpa = gfn_to_gpa(gfn) & KVM_HPAGE_MASK(level);
+ gfn_t base_gfn = gfn_round_for_level(gfn, level);
u64 err, entry, level_state;
/* For now large page isn't supported yet. */
WARN_ON_ONCE(level != PG_LEVEL_4K);
- err = tdh_mem_range_block(tdr_pa, gpa, tdx_level, &entry, &level_state);
+ err = tdh_mem_range_block(&kvm_tdx->td, base_gfn, tdx_level, &entry, &level_state);
if (unlikely(err == TDX_ERROR_SEPT_BUSY))
return -EAGAIN;
if (KVM_BUG_ON(err, kvm)) {
@@ -1817,7 +1809,6 @@ static int tdx_sept_zap_private_spte(struct kvm *kvm, gfn_t gfn,
static void tdx_track(struct kvm *kvm)
{
struct kvm_tdx *kvm_tdx = to_kvm_tdx(kvm);
- hpa_t tdr_pa = page_to_phys(kvm_tdx->td.tdr_page);
u64 err;
/* If TD isn't finalized, it's before any vcpu running. */
@@ -1827,7 +1818,7 @@ static void tdx_track(struct kvm *kvm)
lockdep_assert_held_write(&kvm->mmu_lock);
do {
- err = tdh_mem_track(tdr_pa);
+ err = tdh_mem_track(&kvm_tdx->td);
} while (unlikely((err & TDX_SEAMCALL_STATUS_MASK) == TDX_OPERAND_BUSY));
if (KVM_BUG_ON(err, kvm))
@@ -2756,7 +2747,6 @@ void tdx_flush_tlb_all(struct kvm_vcpu *vcpu)
static int tdx_td_finalizemr(struct kvm *kvm, struct kvm_tdx_cmd *cmd)
{
struct kvm_tdx *kvm_tdx = to_kvm_tdx(kvm);
- hpa_t tdr_pa = page_to_phys(kvm_tdx->td.tdr_page);
guard(mutex)(&kvm->slots_lock);
@@ -2769,7 +2759,7 @@ static int tdx_td_finalizemr(struct kvm *kvm, struct kvm_tdx_cmd *cmd)
if (atomic64_read(&kvm_tdx->nr_premapped))
return -EINVAL;
- cmd->hw_error = tdh_mr_finalize(tdr_pa);
+ cmd->hw_error = tdh_mr_finalize(&kvm_tdx->td);
if ((cmd->hw_error & TDX_SEAMCALL_STATUS_MASK) == TDX_OPERAND_BUSY)
return -EAGAIN;
if (KVM_BUG_ON(cmd->hw_error, kvm)) {
@@ -3029,7 +3019,6 @@ static int tdx_gmem_post_populate(struct kvm *kvm, gfn_t gfn, kvm_pfn_t pfn,
{
u64 error_code = PFERR_GUEST_FINAL_MASK | PFERR_PRIVATE_ACCESS;
struct kvm_tdx *kvm_tdx = to_kvm_tdx(kvm);
- hpa_t tdr_pa = page_to_phys(kvm_tdx->td.tdr_page);
struct tdx_gmem_post_populate_arg *arg = _arg;
struct kvm_vcpu *vcpu = arg->vcpu;
gpa_t gpa = gfn_to_gpa(gfn);
@@ -3068,9 +3057,8 @@ static int tdx_gmem_post_populate(struct kvm *kvm, gfn_t gfn, kvm_pfn_t pfn,
ret = 0;
do {
- err = tdh_mem_page_add(tdr_pa, gpa, pfn_to_hpa(pfn),
- pfn_to_hpa(page_to_pfn(page)),
- &entry, &level_state);
+ err = tdh_mem_page_add(&kvm_tdx->td, gfn, pfn_to_page(pfn),
+ page, &entry, &level_state);
} while (err == TDX_ERROR_SEPT_BUSY);
if (err) {
ret = -EIO;
@@ -3082,7 +3070,7 @@ static int tdx_gmem_post_populate(struct kvm *kvm, gfn_t gfn, kvm_pfn_t pfn,
if (arg->flags & KVM_TDX_MEASURE_MEMORY_REGION) {
for (i = 0; i < PAGE_SIZE; i += TDX_EXTENDMR_CHUNKSIZE) {
- err = tdh_mr_extend(tdr_pa, gpa + i, &entry,
+ err = tdh_mr_extend(&kvm_tdx->td, gpa + i, &entry,
&level_state);
if (err) {
ret = -EIO;
Powered by blists - more mailing lists