From: Krish Sadhukhan <krish.sadhukhan@oracle.com>
To: Cfir Cohen <cfir@google.com>,
"kvm @ vger . kernel . org" <kvm@vger.kernel.org>,
Lendacky Thomas <thomas.lendacky@amd.com>,
Singh Brijesh <brijesh.singh@amd.com>
Cc: Grimm Jon <Jon.Grimm@amd.com>,
David Rientjes <rientjes@google.com>,
Paolo Bonzini <pbonzini@redhat.com>,
Sean Christopherson <sean.j.christopherson@intel.com>,
Vitaly Kuznetsov <vkuznets@redhat.com>,
Wanpeng Li <wanpengli@tencent.com>,
Jim Mattson <jmattson@google.com>, Joerg Roedel <joro@8bytes.org>,
Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
"H . Peter Anvin" <hpa@zytor.com>,
x86@kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] KVM: SVM: Mark SEV launch secret pages as dirty.
Date: Fri, 7 Aug 2020 17:02:20 -0700 [thread overview]
Message-ID: <dc4f24b2-2b7f-f7a2-eef9-6e40dc6f3797@oracle.com> (raw)
In-Reply-To: <20200807012303.3769170-1-cfir@google.com>
On 8/6/20 6:23 PM, Cfir Cohen wrote:
> The LAUNCH_SECRET command performs encryption of the
> launch secret memory contents. Mark pinned pages as
> dirty, before unpinning them.
> This matches the logic in sev_launch_update().
sev_launch_update_data() instead of sev_launch_update() ?
>
> Signed-off-by: Cfir Cohen <cfir@google.com>
> ---
> arch/x86/kvm/svm/sev.c | 15 ++++++++++++++-
> 1 file changed, 14 insertions(+), 1 deletion(-)
>
> diff --git a/arch/x86/kvm/svm/sev.c b/arch/x86/kvm/svm/sev.c
> index 5573a97f1520..37c47d26b9f7 100644
> --- a/arch/x86/kvm/svm/sev.c
> +++ b/arch/x86/kvm/svm/sev.c
> @@ -850,7 +850,7 @@ static int sev_launch_secret(struct kvm *kvm, struct kvm_sev_cmd *argp)
> struct kvm_sev_launch_secret params;
> struct page **pages;
> void *blob, *hdr;
> - unsigned long n;
> + unsigned long n, i;
> int ret, offset;
>
> if (!sev_guest(kvm))
> @@ -863,6 +863,14 @@ static int sev_launch_secret(struct kvm *kvm, struct kvm_sev_cmd *argp)
> if (!pages)
> return -ENOMEM;
>
> + /*
> + * The LAUNCH_SECRET command will perform in-place encryption of the
> + * memory content (i.e it will write the same memory region with C=1).
> + * It's possible that the cache may contain the data with C=0, i.e.,
> + * unencrypted so invalidate it first.
> + */
> + sev_clflush_pages(pages, n);
> +
> /*
> * The secret must be copied into contiguous memory region, lets verify
> * that userspace memory pages are contiguous before we issue command.
> @@ -908,6 +916,11 @@ static int sev_launch_secret(struct kvm *kvm, struct kvm_sev_cmd *argp)
> e_free:
> kfree(data);
> e_unpin_memory:
> + /* content of memory is updated, mark pages dirty */
> + for (i = 0; i < n; i++) {
> + set_page_dirty_lock(pages[i]);
> + mark_page_accessed(pages[i]);
> + }
> sev_unpin_memory(kvm, pages, n);
> return ret;
> }
Reviewed-by: Krish Sadhukhan <krish.sadhukhan@oracle.com>
next prev parent reply other threads:[~2020-08-08 2:53 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-08-07 1:23 [PATCH] KVM: SVM: Mark SEV launch secret pages as dirty Cfir Cohen
2020-08-07 17:55 ` David Rientjes
2020-08-08 0:02 ` Krish Sadhukhan [this message]
2020-08-08 0:37 ` [PATCH v2] " Cfir Cohen
2020-08-10 11:05 ` Brijesh Singh
[not found] ` <20200919045505.GC21189@sjchrist-ice>
2020-09-23 16:59 ` [PATCH] " Paolo Bonzini
[not found] ` <20200923170444.GA20076@linux.intel.com>
2020-09-23 17:16 ` Paolo Bonzini
2020-09-23 17:26 ` Sean Christopherson
2020-09-23 17:27 ` Paolo Bonzini
2020-09-25 2:00 ` Cfir Cohen
2020-09-25 4:54 ` Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=dc4f24b2-2b7f-f7a2-eef9-6e40dc6f3797@oracle.com \
--to=krish.sadhukhan@oracle.com \
--cc=Jon.Grimm@amd.com \
--cc=bp@alien8.de \
--cc=brijesh.singh@amd.com \
--cc=cfir@google.com \
--cc=hpa@zytor.com \
--cc=jmattson@google.com \
--cc=joro@8bytes.org \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=pbonzini@redhat.com \
--cc=rientjes@google.com \
--cc=sean.j.christopherson@intel.com \
--cc=tglx@linutronix.de \
--cc=thomas.lendacky@amd.com \
--cc=vkuznets@redhat.com \
--cc=wanpengli@tencent.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).