From: Brijesh Singh <brijesh.singh@amd.com>
To: simon.guinot@sequanux.org, linux-efi@vger.kernel.org,
brijesh.singh@amd.com, kvm@vger.kernel.org, rkrcmar@redhat.com,
matt@codeblueprint.co.uk, linus.walleij@linaro.org,
linux-mm@kvack.org, paul.gortmaker@windriver.com, hpa@zytor.com,
dan.j.williams@intel.com, aarcange@redhat.com,
sfr@canb.auug.org.au, andriy.shevchenko@linux.intel.com,
herbert@gondor.apana.org.au, bhe@redhat.com, xemul@parallels.com,
joro@8bytes.org, x86@kernel.org, mingo@redhat.com,
msalter@redhat.com, ross.zwisler@linux.intel.com, bp@suse.de,
dyoung@redhat.com, thomas.lendacky@amd.com, jroedel@suse.de,
keescook@chromium.org, toshi.kani@hpe.com,
mathieu.desnoyers@efficios.com, devel@linuxdriverproject.org,
tglx@linutronix.de, mchehab@kernel.org, iamjoonsoo.kim@lge.com,
labbott@fedoraproject.org, tony.luck@intel.com,
alexandre.bounine@idt.com, kuleshovmail@gmail.com,
linux-kernel@vger.kernel.org, mcgrof@kernel.org,
linux-crypto@vger.kernel.org, pbonzini@redhat.com,
akpm@linux-foundation.org, davem@davemloft.net
Subject: [RFC PATCH v1 27/28] KVM: SVM: add KVM_SEV_DEBUG_ENCRYPT command
Date: Mon, 22 Aug 2016 19:29:35 -0400 [thread overview]
Message-ID: <147190857531.9523.10196506226671736370.stgit@brijesh-build-machine> (raw)
In-Reply-To: <147190820782.9523.4967724730957229273.stgit@brijesh-build-machine>
The command encrypts a region of guest memory for debugging purposes.
For more information see [1], section 7.2
[1] http://support.amd.com/TechDocs/55766_SEV-KM%20API_Spec.pdf
Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
---
arch/x86/kvm/svm.c | 100 ++++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 100 insertions(+)
diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
index b383bc7..4af195d 100644
--- a/arch/x86/kvm/svm.c
+++ b/arch/x86/kvm/svm.c
@@ -5684,6 +5684,101 @@ err_1:
return ret;
}
+static int sev_dbg_encrypt(struct kvm *kvm,
+ struct kvm_sev_dbg_encrypt __user *argp,
+ int *psp_ret)
+{
+ void *data;
+ int len, ret, d_off;
+ struct page **inpages;
+ struct psp_data_dbg *encrypt;
+ struct kvm_sev_dbg_encrypt debug;
+ unsigned long src_addr, dst_addr;
+
+ if (!kvm_sev_guest())
+ return -ENOTTY;
+
+ if (copy_from_user(&debug, argp, sizeof(*argp)))
+ return -EFAULT;
+
+ if (debug.length > PAGE_SIZE)
+ return -EINVAL;
+
+ len = debug.length;
+ src_addr = debug.src_addr;
+ dst_addr = debug.dst_addr;
+
+ inpages = kzalloc(1 * sizeof(struct page *), GFP_KERNEL);
+ if (!inpages)
+ return -ENOMEM;
+
+ /* pin the guest destination virtual address */
+ down_read(¤t->mm->mmap_sem);
+ ret = get_user_pages(dst_addr, 1, 1, 0, inpages, NULL);
+ up_read(¤t->mm->mmap_sem);
+ if (ret < 0)
+ goto err_1;
+
+ encrypt = kzalloc(sizeof(*encrypt), GFP_KERNEL);
+ if (!encrypt)
+ goto err_2;
+
+ data = (void *) get_zeroed_page(GFP_KERNEL);
+ if (!data)
+ goto err_3;
+
+ encrypt->hdr.buffer_len = sizeof(*encrypt);
+ encrypt->handle = kvm_sev_handle();
+
+ if ((len & 15) || (dst_addr & 15)) {
+ /* if destination address and length are not 16-byte
+ * aligned then:
+ * a) decrypt destination page into temporary buffer
+ * b) copy source data into temporary buffer at correct offset
+ * c) encrypt temporary buffer
+ */
+ ret = __sev_dbg_decrypt_page(kvm, dst_addr, data, psp_ret);
+ if (ret)
+ goto err_4;
+
+ d_off = dst_addr & (PAGE_SIZE - 1);
+ ret = -EFAULT;
+ if (copy_from_user(data + d_off,
+ (uint8_t *)debug.src_addr, len))
+ goto err_4;
+
+ encrypt->length = PAGE_SIZE;
+ encrypt->src_addr = __pa(data) | sme_me_mask;
+ encrypt->dst_addr = __sev_page_pa(inpages[0]);
+ } else {
+ if (copy_from_user(data, (uint8_t *)debug.src_addr, len))
+ goto err_4;
+
+ d_off = dst_addr & (PAGE_SIZE - 1);
+ encrypt->length = len;
+ encrypt->src_addr = __pa(data) | sme_me_mask;
+ encrypt->dst_addr = __sev_page_pa(inpages[0]);
+ encrypt->dst_addr += d_off;
+ }
+
+ ret = psp_dbg_encrypt(encrypt, psp_ret);
+ if (ret)
+ printk(KERN_ERR "SEV: DEBUG_ENCRYPT: [%#lx=>%#lx+%#x] "
+ "%d (%#010x)\n",src_addr, dst_addr, len,
+ ret, *psp_ret);
+
+err_4:
+ free_page((unsigned long)data);
+err_3:
+ kfree(encrypt);
+err_2:
+ release_pages(inpages, 1, 0);
+err_1:
+ kfree(inpages);
+
+ return ret;
+}
+
static int amd_sev_issue_cmd(struct kvm *kvm,
struct kvm_sev_issue_cmd __user *user_data)
{
@@ -5719,6 +5814,11 @@ static int amd_sev_issue_cmd(struct kvm *kvm,
&arg.ret_code);
break;
}
+ case KVM_SEV_DBG_ENCRYPT: {
+ r = sev_dbg_encrypt(kvm, (void *)arg.opaque,
+ &arg.ret_code);
+ break;
+ }
default:
break;
}
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
next prev parent reply other threads:[~2016-08-22 23:29 UTC|newest]
Thread overview: 67+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-08-22 23:23 [RFC PATCH v1 00/28] x86: Secure Encrypted Virtualization (AMD) Brijesh Singh
2016-08-22 23:23 ` [RFC PATCH v1 01/28] kvm: svm: Add support for additional SVM NPF error codes Brijesh Singh
2016-09-13 9:56 ` Borislav Petkov
2016-08-22 23:23 ` [RFC PATCH v1 02/28] kvm: svm: Add kvm_fast_pio_in support Brijesh Singh
2016-09-21 10:58 ` Borislav Petkov
2016-08-22 23:24 ` [RFC PATCH v1 03/28] kvm: svm: Use the hardware provided GPA instead of page walk Brijesh Singh
2016-09-21 17:16 ` Borislav Petkov
2016-08-22 23:24 ` [RFC PATCH v1 04/28] x86: Secure Encrypted Virtualization (SEV) support Brijesh Singh
2016-09-22 15:00 ` Borislav Petkov
2016-08-22 23:24 ` [RFC PATCH v1 05/28] KVM: SVM: prepare for new bit definition in nested_ctl Brijesh Singh
2016-09-22 14:17 ` Borislav Petkov
2016-08-22 23:24 ` [RFC PATCH v1 06/28] KVM: SVM: Add SEV feature definitions to KVM Brijesh Singh
2016-08-22 23:24 ` [RFC PATCH v1 07/28] x86: Do not encrypt memory areas if SEV is enabled Brijesh Singh
2016-08-22 23:25 ` [RFC PATCH v1 08/28] Access BOOT related data encrypted with SEV active Brijesh Singh
2016-08-22 23:25 ` [RFC PATCH v1 09/28] x86/efi: Access EFI data as encrypted when SEV is active Brijesh Singh
2016-09-22 14:35 ` Borislav Petkov
2016-09-22 14:45 ` Paolo Bonzini
2016-09-22 14:59 ` Borislav Petkov
2016-09-22 15:05 ` Paolo Bonzini
2016-09-22 17:07 ` Borislav Petkov
2016-09-22 17:08 ` Paolo Bonzini
2016-09-22 17:27 ` Borislav Petkov
2016-09-22 19:04 ` Tom Lendacky
2016-09-22 19:11 ` Borislav Petkov
2016-09-22 19:49 ` Tom Lendacky
2016-09-22 20:10 ` Borislav Petkov
2016-09-22 18:59 ` Tom Lendacky
2016-09-22 18:47 ` Tom Lendacky
2016-09-22 18:50 ` Paolo Bonzini
2016-09-22 17:46 ` Tom Lendacky
2016-09-22 18:23 ` Paolo Bonzini
2016-09-22 18:37 ` Borislav Petkov
2016-09-22 18:44 ` Paolo Bonzini
2016-09-23 9:33 ` Kai Huang
2016-09-23 9:50 ` Borislav Petkov
2016-08-22 23:25 ` [RFC PATCH v1 10/28] x86: Change early_ioremap to early_memremap for BOOT data Brijesh Singh
2016-08-22 23:25 ` [RFC PATCH v1 11/28] x86: Don't decrypt trampoline area if SEV is active Brijesh Singh
2016-08-22 23:26 ` [RFC PATCH v1 12/28] x86: DMA support for SEV memory encryption Brijesh Singh
2016-08-22 23:26 ` [RFC PATCH v1 13/28] iommu/amd: AMD IOMMU support for SEV Brijesh Singh
2016-08-22 23:26 ` [RFC PATCH v1 14/28] x86: Don't set the SME MSR bit when SEV is active Brijesh Singh
2016-08-22 23:26 ` [RFC PATCH v1 15/28] x86: Unroll string I/O " Brijesh Singh
2016-08-22 23:26 ` [RFC PATCH v1 16/28] x86: Add support to determine if running with SEV enabled Brijesh Singh
2016-08-22 23:27 ` [RFC PATCH v1 17/28] KVM: SVM: Enable SEV by setting the SEV_ENABLE cpu feature Brijesh Singh
2016-08-22 23:27 ` [RFC PATCH v1 18/28] crypto: add AMD Platform Security Processor driver Brijesh Singh
2016-08-23 7:14 ` Herbert Xu
2016-08-24 12:02 ` Tom Lendacky
2016-08-22 23:27 ` [RFC PATCH v1 19/28] KVM: SVM: prepare to reserve asid for SEV guest Brijesh Singh
2016-10-13 10:17 ` Paolo Bonzini
2016-08-22 23:28 ` [RFC PATCH v1 20/28] KVM: SVM: prepare for SEV guest management API support Brijesh Singh
2016-10-13 10:41 ` Paolo Bonzini
2016-08-22 23:28 ` [RFC PATCH v1 21/28] KVM: introduce KVM_SEV_ISSUE_CMD ioctl Brijesh Singh
2016-10-13 10:45 ` Paolo Bonzini
2016-10-17 17:57 ` Brijesh Singh
2016-10-17 20:14 ` Paolo Bonzini
2016-10-18 19:32 ` Brijesh Singh
2016-10-18 21:44 ` Paolo Bonzini
2016-08-22 23:28 ` [RFC PATCH v1 22/28] KVM: SVM: add SEV launch start command Brijesh Singh
2016-10-13 11:12 ` Paolo Bonzini
2016-08-22 23:28 ` [RFC PATCH v1 23/28] KVM: SVM: add SEV launch update command Brijesh Singh
2016-08-22 23:28 ` [RFC PATCH v1 24/28] KVM: SVM: add SEV_LAUNCH_FINISH command Brijesh Singh
2016-10-13 11:16 ` Paolo Bonzini
2016-08-22 23:29 ` [RFC PATCH v1 25/28] KVM: SVM: add KVM_SEV_GUEST_STATUS command Brijesh Singh
2016-08-22 23:29 ` [RFC PATCH v1 26/28] KVM: SVM: add KVM_SEV_DEBUG_DECRYPT command Brijesh Singh
2016-08-22 23:29 ` Brijesh Singh [this message]
2016-08-22 23:29 ` [RFC PATCH v1 28/28] KVM: SVM: add command to query SEV API version Brijesh Singh
2016-10-13 11:19 ` [RFC PATCH v1 00/28] x86: Secure Encrypted Virtualization (AMD) Paolo Bonzini
2016-10-17 13:51 ` Brijesh Singh
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=147190857531.9523.10196506226671736370.stgit@brijesh-build-machine \
--to=brijesh.singh@amd.com \
--cc=aarcange@redhat.com \
--cc=akpm@linux-foundation.org \
--cc=alexandre.bounine@idt.com \
--cc=andriy.shevchenko@linux.intel.com \
--cc=bhe@redhat.com \
--cc=bp@suse.de \
--cc=dan.j.williams@intel.com \
--cc=davem@davemloft.net \
--cc=devel@linuxdriverproject.org \
--cc=dyoung@redhat.com \
--cc=herbert@gondor.apana.org.au \
--cc=hpa@zytor.com \
--cc=iamjoonsoo.kim@lge.com \
--cc=joro@8bytes.org \
--cc=jroedel@suse.de \
--cc=keescook@chromium.org \
--cc=kuleshovmail@gmail.com \
--cc=kvm@vger.kernel.org \
--cc=labbott@fedoraproject.org \
--cc=linus.walleij@linaro.org \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-efi@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=mathieu.desnoyers@efficios.com \
--cc=matt@codeblueprint.co.uk \
--cc=mcgrof@kernel.org \
--cc=mchehab@kernel.org \
--cc=mingo@redhat.com \
--cc=msalter@redhat.com \
--cc=paul.gortmaker@windriver.com \
--cc=pbonzini@redhat.com \
--cc=rkrcmar@redhat.com \
--cc=ross.zwisler@linux.intel.com \
--cc=sfr@canb.auug.org.au \
--cc=simon.guinot@sequanux.org \
--cc=tglx@linutronix.de \
--cc=thomas.lendacky@amd.com \
--cc=tony.luck@intel.com \
--cc=toshi.kani@hpe.com \
--cc=x86@kernel.org \
--cc=xemul@parallels.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).