From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752086AbdISUuC (ORCPT ); Tue, 19 Sep 2017 16:50:02 -0400 Received: from mail-by2nam01on0056.outbound.protection.outlook.com ([104.47.34.56]:55572 "EHLO NAM01-BY2-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751905AbdISUrU (ORCPT ); Tue, 19 Sep 2017 16:47:20 -0400 Authentication-Results: spf=none (sender IP is ) smtp.mailfrom=brijesh.singh@amd.com; From: Brijesh Singh To: linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: Brijesh Singh , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , Paolo Bonzini , =?UTF-8?q?Radim=20Kr=C4=8Dm=C3=A1=C5=99?= , Joerg Roedel , Borislav Petkov , Tom Lendacky , x86@kernel.org Subject: [Part2 PATCH v4 23/29] KVM: SVM: Add support for SEV LAUNCH_SECRET command Date: Tue, 19 Sep 2017 15:46:21 -0500 Message-Id: <20170919204627.3875-24-brijesh.singh@amd.com> X-Mailer: git-send-email 2.9.5 In-Reply-To: <20170919204627.3875-1-brijesh.singh@amd.com> References: <20170919204627.3875-1-brijesh.singh@amd.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Originating-IP: [165.204.78.1] X-ClientProxiedBy: CY4PR04CA0071.namprd04.prod.outlook.com (10.171.243.164) To SN1PR12MB0158.namprd12.prod.outlook.com (10.162.3.145) X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: 2f9fc02f-0206-4c1c-8ce0-08d4ff9f9b6a X-MS-Office365-Filtering-HT: Tenant X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:(300000500095)(300135000095)(300000501095)(300135300095)(22001)(300000502095)(300135100095)(2017030254152)(48565401081)(300000503095)(300135400095)(2017052603199)(201703131423075)(201703031133081)(201702281549075)(300000504095)(300135200095)(300000505095)(300135600095)(300000506095)(300135500095);SRVR:SN1PR12MB0158; X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0158;3:RlQeVLhQFYh816bOZnJ1tjjUwIFeTLd/5RYvSCUyOSUm0VVfkKCzB1eYAqPiXJSKYJ8hCuQAo1OtdRwCgmV/0xXYbdLSPoCoF+hozUu8ZHoTdIFvE5fy8U1rHryGcd7MVbFwN/enVxlbUdE1cx7yaj5ZbSaKduddO0dPFMVVtF1Z5qzBCh8PpGD1sgBAS/PN+be6K/wSYSep2reo6gUlH9VwpHalce7m9q9X0rk1I0elAughwfQeSVFpFh2Okn+w;25:ScpAZN8S/P4Mr6ZmUqLbZpBnFNKNT+saVFm5BZBum21aYdJmRsWIwTdHPn8CZq+CZ96iq79IRptfwGyrbEcndr0jsFefOnc48S3OU51P2YQHMnHGpvNwBnaR/dDmRdtHoDHuswQhJgywSBINLM7nkaYiJlFcx9idYaAZsFdmzrmnTF1EK/XAaHtcTl2KQrGJaSF6rJ95Kx5dfuyHJsvOTv+J+bBbresAlihV/kvL2toZUIlk0zYIfisEeYFMiooOodY3suW3MVm7pJowahB80Zb6ii27AeC2S9e0vIrnD09eI8HvoJhEe+FSFct6ljPxVxZVB+yAsGvhXxdptpk7DA==;31:Y4RZJ5fj5P34pslAIhuTTIUWM3+wNS2a7dd1DYeQQOs27sejdnxlfW/JBvhUL3CIKhe6T/HFI/NhcI3o4AA+EuROi2Qro4crQHm8D91Iu5zZHXa6DtxcGY0NQtZkNN5hf8cYxd1DUXK5NQHtkb23U1WY+mCMK5xIiwgzNJKen9/dq2/11JgOy3gmXeKHET4GubjViR+4V/nWkjsb7oo1xtXyTNx3l/r9gOtKYeTXFYs= X-MS-TrafficTypeDiagnostic: SN1PR12MB0158: X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0158;20:ql1kN7pgZyg+CD2iLyQhtCkqAcs+lS0oKAvJY06aWAGEA99GZuvgJbCkVcM7dWyTyk+WcBGwpqv7/jpb2tInASsyT7cueU6YJrIjwCU4dIdZnE4+A0VA/dfGHJ5m+cI2IzdjQ7yyKGr4ofWfjWcFZFGpt0wDNO0YcGIBvkUmR59f1XsGPUiazKRWA0ghlHSkP4YHziX8IxZeYP65uBijo9RHiWRQgy9hLKMEowmBeruFX6gA7k+Skr+DfGEiLjTu2EytRpM8hwPhl6GzdEJZq3pcdw8J1DoXRvkGusx5Jozvs2qwYShUnfsZNVBp28pwUCx4yKsSYZmGl8xl4voTbRgZpleFKFAbjWu3R/KGl3Ci90cYKkBR3IhD0PW2hmyi5jWB75aprYlTMohv4QAW9X23UPAiNX5uZM0KGAX9pntsY4fO0FxRtAO2L6yNQI6vlRm3/NMHEk4mW8uIlEhbhPxEHLn45SQCbmOT6QFIvBQyYP5WE6OFVswMe3VQgkeg;4:9wiHDOGSEapWBBWW+OU/BZBR/ZN/Ckexmh0hutbF1I6vXxBQ1wjW2Rzvy3Y5JmhLJNS+D6z/CXVyLoLmIHsH89SleCe8pL73X7cxQsO8tflXOpqlA1byob3AbucY5lQ2iKtVM03mbi/IAQl6QBC5TInW+2ouqUBWjWlfCtkcI0XsUIZG/5PUkBonS8VmeiQ82bfj/RmbvUUEI+osd77+WPjNa9IaL2NBXVEebd3UxtdqnOuRnD1uIJeo8L1gmteNN92Fu/3ZVE+lqllpLcyu8YMtBANaR09LERHw5sEuUdJ4W8nrjh8habuIMYe6SpwrA2nr97Rz6W15n8zr4d1tTw== X-Exchange-Antispam-Report-Test: UriScan:(9452136761055)(767451399110); X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(100000700101)(100105000095)(100000701101)(100105300095)(100000702101)(100105100095)(6040450)(2401047)(8121501046)(5005006)(93006095)(93001095)(100000703101)(100105400095)(3002001)(10201501046)(6055026)(6041248)(20161123560025)(20161123558100)(201703131423075)(201702281528075)(201703061421075)(201703061406153)(20161123555025)(20161123562025)(20161123564025)(6072148)(201708071742011)(100000704101)(100105200095)(100000705101)(100105500095);SRVR:SN1PR12MB0158;BCL:0;PCL:0;RULEID:(100000800101)(100110000095)(100000801101)(100110300095)(100000802101)(100110100095)(100000803101)(100110400095)(100000804101)(100110200095)(100000805101)(100110500095);SRVR:SN1PR12MB0158; X-Forefront-PRVS: 04359FAD81 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10009020)(6009001)(346002)(376002)(39860400002)(199003)(189002)(86362001)(50466002)(8936002)(97736004)(6116002)(3846002)(7416002)(81156014)(8676002)(50226002)(2950100002)(81166006)(316002)(478600001)(16526017)(6666003)(7736002)(66066001)(305945005)(47776003)(6486002)(189998001)(53416004)(25786009)(101416001)(2870700001)(50986999)(76176999)(53936002)(2906002)(68736007)(36756003)(106356001)(1076002)(4326008)(5660300001)(105586002)(33646002)(23676002)(54906003)(219293001);DIR:OUT;SFP:1101;SCL:1;SRVR:SN1PR12MB0158;H:ubuntu-010236106000.amd.com;FPR:;SPF:None;PTR:InfoNoRecords;A:1;MX:1;LANG:en; X-Microsoft-Exchange-Diagnostics: =?utf-8?B?MTtTTjFQUjEyTUIwMTU4OzIzOldaTG1pUldvS2tQVEIrMzYrcXJEbE4yb0Zv?= =?utf-8?B?bmdWNm10NjBGdFJPTTFzamNqc0Y1WUlHaFZ2b1BoNTN2VDl5NzRmY1d3UWJr?= =?utf-8?B?TldLa2thQ2hwUFlLWDJYdDlFREFtR05zbUdXL3hPR1BhQzI5NGxUclZlU2Yv?= =?utf-8?B?RStWeVI4UmRicllOMTJtRCsrL3FYQnhEMjJEU01oL3psZ0dGcmZlV3RrRDdJ?= =?utf-8?B?UHI5YTZ3eUxLcFpRcTRzb3ZSeWUxc3o1TWJ6OEE2YTdhdS9mcFNxWlRtbnd4?= =?utf-8?B?bFI3YkJCZFI4K3BTZkgrYmdseXNqVVRVQkVlVkhoNmZaMHNLUmQza3ZSVFhk?= =?utf-8?B?Uy9jdG4zeTByWFpNSm1laWlNUkVPbHJGM2h1WXcyZ3gzNlZ5WTRUdWJ1MzFH?= =?utf-8?B?OVVveDF5UlFkWVZjbTlLNjVuMlJSZFV3Q2txT0xuU2xjb0VXdUZsOGpyZXRD?= =?utf-8?B?VDQyTGR5dlhIUGFNT2xLd2tzY0FZUld6ME1FSEpvMVBTTmIyb2J1WnBBb0M3?= =?utf-8?B?WWdkT014R3NZWDUxd093T0Z3SUQzaGE1bG8wRjc4Sy90Ni84aG9GTUVDYjJw?= =?utf-8?B?Mlo0ZTZtaHMvL05GQVBxQnFlSU00TlRsb3k1L3VxR1ZVQUIySHRYdXJyRGpZ?= =?utf-8?B?aGZXeTdjMEQ3NnJpaGFjWFNsdlFUTDBsRVpQK0NydXFLTXV6L1lBelRUbmNJ?= =?utf-8?B?djNQUmVHWmdaNXorYUlGVkY5RzQ1YUxFWVNOU1lTblhoL2pOZllsSmNwWnU0?= =?utf-8?B?VU11aWdrNDJzNjhVaEpOTWVacEYxZzBRSEdTSHM1WHYrY0hVWk5GSXYvd2ZS?= =?utf-8?B?RlBwandpWnovS2dISHhSTGZHUHBKVWxIK0taeTBlZm8vYlZjd2lCR25HekJv?= =?utf-8?B?RDdUVno2QWxseWd1bktHa2NmTGVKS3pIMDd0Q3NCdzQva3NrS3g2VTdnZE5s?= =?utf-8?B?VmpvTDhOL2w2QlBHQnFRK1plK29aTmV3by9IRVlDOTlvQ1JrQzdQeitZWFpQ?= =?utf-8?B?OHdoMHo3ZXVMdnlLcmk2bmgraGFVYlVmbHg0bm1oQTF0c3d6ZElwSm9XTUdI?= =?utf-8?B?RkUwT0VCdElLd2EvVDV3UGozTEc4YytNVEwvZklEcklSUjNwcEdLMFFiK0J3?= =?utf-8?B?Vkp0alhHM3NLaFVjakFtMXVlVVJ3RjY0RGcxZFduNVIyZ2ZJQmZNZU8rbFBv?= =?utf-8?B?L202OHdXby9GY3RmdHRCUCt6bXlMUDhweFJQc0NuTFlNSkx0eGJiZVNKakhu?= =?utf-8?B?TC9wdnNCTktST21QdUhvUitqVFpoVFRacXZiRjhtNXlQWmxVWUI1L3lQNjho?= =?utf-8?B?NFlPaHEyNEhDdWlOSkd1RWJuY1ZVOE5xRlVWRkhCSjd4NUdmYkJueXZsRGN0?= =?utf-8?B?a24zaEQ2YkxXaU9Wd2FmVitsVUlXN2tDQ3NiV0lrOW9jTTRvQWtmRVZFcEEx?= =?utf-8?B?KzRWd3VCNkdMdnhNVDhGVlFGMG1yNEFVdlZIcHVSMUpqemdRdGRiUVZ5d2Na?= =?utf-8?B?YTlldz09?= X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0158;6:3seAkxVFa9Sa3l37j7oZFDBbkHpbhKaaxCqiY67tMWHOIDQ9iQ+VTFG6gUSgOfXwVnzXP/HCedS48VqsGNDvvDPibdvilaVkS2L/OJykIf3DxoKO4MujIqwxREM4XylrkfOdO2nW2ibWuHzZvRCDURanRPCw6lqDbmIwPdhfCIg+YRmud0lItMwNFayuSr1ytSmUycMmBa8nESWyoZMW5PIKCIzBchRWh8A9rRwFv+aFdsvL/InJY2IBuZLpRgzkKODsxn3OscXE4P23vqn5esgZMbpx6A51qECPXZL9gq6MX4sfcgFoKkXCVFUiTwVVaVPiyFjvBJ1VaQhzgHAsIw==;5:WmBFEwjmcvr0ZkPIb8UqJomNvPdVzs9rgCApf1ECdCuituAPWDc34+7/sSInZpQReDpfG3YpMPBQdXBSCPQTBiatXzVnfc4H4cmwAoCnpdN2YJsyJoV163hBNa46C82q9mfN9+LOOHkLi5Kt3N6Scw==;24:7C+SaqBZVzDX3L29fH8hDlFbY3RgtgypttbEA7K2a2MsyT8AxVlrdZ8h/FHCSeUqRE5Lo29GYfoxXYnkVEOG2ww5ALk/z751fWeA46mIIRc=;7:I595MZgr5oe93LbHw31o/hbd7ycTqxYplDuYOiFyOYlSLqZl4U5yohJW48tUv4BvkBS6VOc97pI189kLGXOBpbxuHFmkygPe2iQSVtTB9+7/6K88cfpmeRjX176AjBP3uwNv1CCK5DOmXyjUJHOxHkFxbITdynGYkQFQzbEM5kGyLebphViBnyV4ZS7Zr33GyqsTHoln58llSCS7dQrewha2rRmTKyEkZW6dVpYlCd0= SpamDiagnosticOutput: 1:99 SpamDiagnosticMetadata: NSPM X-Microsoft-Exchange-Diagnostics: 1;SN1PR12MB0158;20:qWYkE2fCn6zN3euM1s/C8/RmF4xUbAt1d4AUbFop/fBRNwXLaIxkg/k0e/bpZA7wv1tqbM0UNHXC+uaY+STSc0/FlZ3IaJdb8EAAkNXN5WBEDINszR8bgQjxjO8i976he12Fdc7bAKTosileH0zkankbAeRYPp6a6SdOIHiRhYmSx6nw1Kxyvr8qODBUGrBqYS7XMFAxySywkdy9gTdmxRm36F5vD2PDFaGlJArTB3g1wBg+DpMidR+k6KH8mguB X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Sep 2017 20:47:12.9512 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN1PR12MB0158 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The command is used for injecting a secret into a guest memory region. Cc: Thomas Gleixner Cc: Ingo Molnar Cc: "H. Peter Anvin" Cc: Paolo Bonzini Cc: "Radim Krčmář" Cc: Joerg Roedel Cc: Borislav Petkov Cc: Tom Lendacky Cc: x86@kernel.org Cc: kvm@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Brijesh Singh --- arch/x86/kvm/svm.c | 79 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 79 insertions(+) diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c index 16b338d9dc87..dadfb8e15db9 100644 --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -6392,6 +6392,81 @@ static int sev_dbg_encrypt(struct kvm *kvm, struct kvm_sev_cmd *argp) return sev_dbg_crypt(kvm, argp, false); } +static int sev_launch_secret(struct kvm *kvm, struct kvm_sev_cmd *argp) +{ + struct kvm_sev_info *sev = &kvm->arch.sev_info; + struct sev_data_launch_secret *data; + struct kvm_sev_launch_secret params; + struct page **pages; + void *blob, *hdr; + unsigned long n; + int ret; + + if (!sev_guest(kvm)) + return -ENOTTY; + + if (copy_from_user(¶ms, (void __user *)(uintptr_t)argp->data, + sizeof(struct kvm_sev_launch_secret))) + return -EFAULT; + + /* verify that request has a valid guest memory region and length */ + if (!params.guest_uaddr || + !params.guest_len || + (params.guest_len > SEV_FW_BLOB_MAX_SIZE)) + return -EINVAL; + + /* pin the guest memory region */ + pages = sev_pin_memory(kvm, params.guest_uaddr, params.guest_len, &n, 1); + if (!pages) + return -ENOMEM; + + /* + * The secret must be copied into contiguous memory region, lets verify + * that pinned memory pages are contiguous otherwise fail the command. + */ + if (get_num_contig_pages(0, pages, n) != n) { + ret = -EINVAL; + goto e_unpin_memory; + } + + ret = -ENOMEM; + data = kzalloc(sizeof(*data), GFP_KERNEL); + if (!data) + goto e_unpin_memory; + + /* copy the secret from userspace into a kernel buffer */ + blob = copy_user_blob(params.trans_uaddr, params.trans_len); + if (IS_ERR(blob)) { + ret = PTR_ERR(blob); + goto e_free; + } + + data->trans_address = __psp_pa(blob); + data->trans_len = params.trans_len; + + /* copy the packet header from userspace into a kernel buffer */ + hdr = copy_user_blob(params.hdr_uaddr, params.hdr_len); + if (IS_ERR(hdr)) { + ret = PTR_ERR(hdr); + goto e_free_blob; + } + data->trans_address = __psp_pa(blob); + data->trans_len = params.trans_len; + + data->handle = sev->handle; + ret = sev_issue_cmd(kvm, SEV_CMD_LAUNCH_UPDATE_SECRET, data, &argp->error); + + kfree(hdr); +e_free_blob: + kfree(blob); +e_free: + kfree(data); +e_unpin_memory: + sev_unpin_memory(kvm, pages, n); + + return ret; +} + static int svm_mem_enc_op(struct kvm *kvm, void __user *argp) { struct kvm_sev_cmd sev_cmd; @@ -6435,6 +6510,10 @@ static int svm_mem_enc_op(struct kvm *kvm, void __user *argp) r = sev_dbg_encrypt(kvm, &sev_cmd); break; } + case KVM_SEV_LAUNCH_SECRET: { + r = sev_launch_secret(kvm, &sev_cmd); + break; + } default: break; } -- 2.9.5