From: Vlastimil Babka <vbabka@suse.cz>
To: Michael Roth <michael.roth@amd.com>, kvm@vger.kernel.org
Cc: linux-coco@lists.linux.dev, Paolo Bonzini <pbonzini@redhat.com>,
Sean Christopherson <seanjc@google.com>,
Isaku Yamahata <isaku.yamahata@linux.intel.com>,
Xu Yilun <yilun.xu@linux.intel.com>,
Binbin Wu <binbin.wu@linux.intel.com>,
Xiaoyao Li <xiaoyao.li@intel.com>
Subject: Re: [PATCH gmem 6/6] KVM: guest_memfd: Add interface for populating gmem pages with user data
Date: Mon, 15 Apr 2024 15:36:29 +0200 [thread overview]
Message-ID: <a97d6ed3-f4f8-4d3e-9306-da93bf7c6b26@suse.cz> (raw)
In-Reply-To: <20240329212444.395559-7-michael.roth@amd.com>
On 3/29/24 10:24 PM, Michael Roth wrote:
> During guest run-time, kvm_arch_gmem_prepare() is issued as needed to
> prepare newly-allocated gmem pages prior to mapping them into the guest.
> In the case of SEV-SNP, this mainly involves setting the pages to
> private in the RMP table.
>
> However, for the GPA ranges comprising the initial guest payload, which
> are encrypted/measured prior to starting the guest, the gmem pages need
> to be accessed prior to setting them to private in the RMP table so they
> can be initialized with the userspace-provided data. Additionally, an
> SNP firmware call is needed afterward to encrypt them in-place and
> measure the contents into the guest's launch digest.
>
> While it is possible to bypass the kvm_arch_gmem_prepare() hooks so that
> this handling can be done in an open-coded/vendor-specific manner, this
> may expose more gmem-internal state/dependencies to external callers
> than necessary. Try to avoid this by implementing an interface that
> tries to handle as much of the common functionality inside gmem as
> possible, while also making it generic enough to potentially be
> usable/extensible for use-cases beyond just SEV-SNP.
>
> Suggested-by: Sean Christopherson <seanjc@google.com>
> Signed-off-by: Michael Roth <michael.roth@amd.com>
> ---
> include/linux/kvm_host.h | 40 ++++++++++++++++++++++++++++++++++++++++
> virt/kvm/guest_memfd.c | 40 ++++++++++++++++++++++++++++++++++++++++
> 2 files changed, 80 insertions(+)
>
> diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
> index 5b8308b5e4af..8a75787090f3 100644
> --- a/include/linux/kvm_host.h
> +++ b/include/linux/kvm_host.h
> @@ -2473,4 +2473,44 @@ bool kvm_arch_gmem_prepare_needed(struct kvm *kvm);
> void kvm_arch_gmem_invalidate(kvm_pfn_t start, kvm_pfn_t end);
> #endif
>
> +/**
> + * kvm_gmem_populate_args - kvm_gmem_populate() argument structure
> + *
> + * @gfn: starting GFN to be populated
> + * @src: userspace-provided buffer containing data to copy into GFN range
> + * @npages: number of pages to copy from userspace-buffer
> + * @do_memcpy: whether to do a direct memcpy of the data prior to issuing
> + * the post-populate callback
> + * @post_populate: callback to issue for each gmem page that backs the GPA
> + * range (which will be filled with corresponding contents from
> + * @src if @do_memcpy was set)
> + * @opaque: opaque data to pass to @post_populate callback
> + */
> +struct kvm_gmem_populate_args {
> + gfn_t gfn;
> + void __user *src;
> + int npages;
> + bool do_memcpy;
> + int (*post_populate)(struct kvm *kvm, struct kvm_memory_slot *slot,
> + gfn_t gfn, kvm_pfn_t pfn, void __user *src, int order,
> + void *opaque);
> + void *opaque;
> +};
> +
> +/**
> + * kvm_gmem_populate() - Populate/prepare a GPA range with guest data
> + *
> + * @kvm: KVM instance
> + * @slot: slot containing the GPA range being prepared
> + * @args: argument structure
> + *
> + * This is primarily intended for cases where a gmem-backed GPA range needs
> + * to be initialized with userspace-provided data prior to being mapped into
> + * the guest as a private page. This should be called with the slots->lock
> + * held so that caller-enforced invariants regarding the expected memory
> + * attributes of the GPA range do not race with KVM_SET_MEMORY_ATTRIBUTES.
> + */
> +int kvm_gmem_populate(struct kvm *kvm, struct kvm_memory_slot *slot,
> + struct kvm_gmem_populate_args *args);
> +
> #endif
> diff --git a/virt/kvm/guest_memfd.c b/virt/kvm/guest_memfd.c
> index 3668a5f1d82b..3e3c4b7fff3b 100644
> --- a/virt/kvm/guest_memfd.c
> +++ b/virt/kvm/guest_memfd.c
> @@ -643,3 +643,43 @@ int kvm_gmem_undo_get_pfn(struct kvm *kvm, struct kvm_memory_slot *slot,
> return r;
> }
> EXPORT_SYMBOL_GPL(kvm_gmem_undo_get_pfn);
> +
> +int kvm_gmem_populate(struct kvm *kvm, struct kvm_memory_slot *slot,
> + struct kvm_gmem_populate_args *args)
> +{
> + int ret, max_order, i;
> +
> + for (i = 0; i < args->npages; i += (1 << max_order)) {
> + void __user *src = args->src + i * PAGE_SIZE;
> + gfn_t gfn = args->gfn + i;
> + kvm_pfn_t pfn;
> +
> + ret = __kvm_gmem_get_pfn(kvm, slot, gfn, &pfn, &max_order, false);
> + if (ret)
> + break;
> +
> + if (!IS_ALIGNED(gfn, (1 << max_order)) ||
> + (args->npages - i) < (1 << max_order))
> + max_order = 0;
> +
> + if (args->do_memcpy && args->src) {
> + ret = copy_from_user(pfn_to_kaddr(pfn), src, (1 << max_order) * PAGE_SIZE);
> + if (ret)
> + goto e_release;> + }
> +
> + if (args->post_populate) {
> + ret = args->post_populate(kvm, slot, gfn, pfn, src, max_order,
> + args->opaque);
> + if (ret)
> + goto e_release;
This if (ret) goto seems unnecessary, was there more code before the label
in a previous version?
With that we could also change this block to "if (!ret &&
args->post_populate)" and remove the first goto and the label.
> + }
> +e_release:
> + put_page(pfn_to_page(pfn));
> + if (ret)
> + break;
> + }
> +
> + return ret;
> +}
> +EXPORT_SYMBOL_GPL(kvm_gmem_populate);
prev parent reply other threads:[~2024-04-15 13:36 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-29 21:24 [PATCH gmem 0/6] gmem fix-ups and interfaces for populating gmem pages Michael Roth
2024-03-29 21:24 ` [PATCH gmem 1/6] KVM: guest_memfd: Fix stub for kvm_gmem_get_uninit_pfn() Michael Roth
2024-03-29 21:24 ` [PATCH gmem 2/6] KVM: guest_memfd: Only call kvm_arch_gmem_prepare hook if necessary Michael Roth
2024-04-01 5:06 ` Binbin Wu
2024-04-02 21:50 ` Isaku Yamahata
2024-03-29 21:24 ` [PATCH gmem 3/6] KVM: x86: Pass private/shared fault indicator to gmem_validate_fault Michael Roth
2024-03-29 21:24 ` [PATCH gmem 4/6] mm: Introduce AS_INACCESSIBLE for encrypted/confidential memory Michael Roth
2024-04-15 13:19 ` Vlastimil Babka
2024-03-29 21:24 ` [PATCH gmem 5/6] KVM: guest_memfd: Use AS_INACCESSIBLE when creating guest_memfd inode Michael Roth
2024-04-15 13:21 ` Vlastimil Babka
2024-03-29 21:24 ` [PATCH gmem 6/6] KVM: guest_memfd: Add interface for populating gmem pages with user data Michael Roth
2024-04-15 13:36 ` Vlastimil Babka [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=a97d6ed3-f4f8-4d3e-9306-da93bf7c6b26@suse.cz \
--to=vbabka@suse.cz \
--cc=binbin.wu@linux.intel.com \
--cc=isaku.yamahata@linux.intel.com \
--cc=kvm@vger.kernel.org \
--cc=linux-coco@lists.linux.dev \
--cc=michael.roth@amd.com \
--cc=pbonzini@redhat.com \
--cc=seanjc@google.com \
--cc=xiaoyao.li@intel.com \
--cc=yilun.xu@linux.intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).