| Message ID | 1572902923-8096-2-git-send-email-linuxram@us.ibm.com (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | Enable IOMMU support for pseries Secure VMs | expand |
| Context | Check | Description |
|---|---|---|
| snowpatch_ozlabs/apply_patch | success | Successfully applied on branch powerpc/merge (b9ba205b97bda75388e4014914ae0bdc0022464c) |
| snowpatch_ozlabs/checkpatch | success | total: 0 errors, 0 warnings, 0 checks, 50 lines checked |
On 05/11/2019 08:28, Ram Pai wrote: > The hypervisor needs to access the contents of the page holding the TCE > entries while setting up the TCE entries in the IOMMU's TCE table. For > SecureVMs, since this page is encrypted, the hypervisor cannot access > valid entries. Share the page with the hypervisor. This ensures that the > hypervisor sees the valid entries. > > Signed-off-by: Ram Pai <linuxram@us.ibm.com> > --- > arch/powerpc/platforms/pseries/iommu.c | 20 +++++++++++++++++--- > 1 file changed, 17 insertions(+), 3 deletions(-) > > diff --git a/arch/powerpc/platforms/pseries/iommu.c b/arch/powerpc/platforms/pseries/iommu.c > index 8d9c2b1..07f0847 100644 > --- a/arch/powerpc/platforms/pseries/iommu.c > +++ b/arch/powerpc/platforms/pseries/iommu.c > @@ -37,6 +37,7 @@ > #include <asm/mmzone.h> > #include <asm/plpar_wrappers.h> > #include <asm/svm.h> > +#include <asm/ultravisor.h> > > #include "pseries.h" > > @@ -179,6 +180,19 @@ static int tce_build_pSeriesLP(struct iommu_table *tbl, long tcenum, > > static DEFINE_PER_CPU(__be64 *, tce_page); > > +/* > + * Allocate a tce page. If secure VM, share the page with the hypervisor. > + */ > +static __be64 *alloc_tce_page(void) > +{ > + __be64 *tcep = (__be64 *)__get_free_page(GFP_ATOMIC); > + > + if (tcep && is_secure_guest()) > + uv_share_page(PHYS_PFN(__pa(tcep)), 1); There is no matching unshare in this patch. > + > + return tcep; > +} > + > static int tce_buildmulti_pSeriesLP(struct iommu_table *tbl, long tcenum, > long npages, unsigned long uaddr, > enum dma_data_direction direction, > @@ -206,8 +220,7 @@ static int tce_buildmulti_pSeriesLP(struct iommu_table *tbl, long tcenum, > * from iommu_alloc{,_sg}() > */ > if (!tcep) { > - tcep = (__be64 *)__get_free_page(GFP_ATOMIC); > - /* If allocation fails, fall back to the loop implementation */ > + tcep = alloc_tce_page(); > if (!tcep) { > local_irq_restore(flags); > return tce_build_pSeriesLP(tbl, tcenum, npages, uaddr, > @@ -391,6 +404,7 @@ static int tce_clearrange_multi_pSeriesLP(unsigned long start_pfn, > return rc; > } > > + Unrelated. > static int tce_setrange_multi_pSeriesLP(unsigned long start_pfn, > unsigned long num_pfn, const void *arg) > { > @@ -405,7 +419,7 @@ static int tce_setrange_multi_pSeriesLP(unsigned long start_pfn, > tcep = __this_cpu_read(tce_page); > > if (!tcep) { > - tcep = (__be64 *)__get_free_page(GFP_ATOMIC); > + tcep = alloc_tce_page(); > if (!tcep) { > local_irq_enable(); > return -ENOMEM; >
On Wed, Nov 06, 2019 at 12:58:50PM +1100, Alexey Kardashevskiy wrote: > > > On 05/11/2019 08:28, Ram Pai wrote: > > The hypervisor needs to access the contents of the page holding the TCE > > entries while setting up the TCE entries in the IOMMU's TCE table. For > > SecureVMs, since this page is encrypted, the hypervisor cannot access > > valid entries. Share the page with the hypervisor. This ensures that the > > hypervisor sees the valid entries. > > > > Signed-off-by: Ram Pai <linuxram@us.ibm.com> > > --- > > arch/powerpc/platforms/pseries/iommu.c | 20 +++++++++++++++++--- > > 1 file changed, 17 insertions(+), 3 deletions(-) > > > > diff --git a/arch/powerpc/platforms/pseries/iommu.c b/arch/powerpc/platforms/pseries/iommu.c > > index 8d9c2b1..07f0847 100644 > > --- a/arch/powerpc/platforms/pseries/iommu.c > > +++ b/arch/powerpc/platforms/pseries/iommu.c > > @@ -37,6 +37,7 @@ > > #include <asm/mmzone.h> > > #include <asm/plpar_wrappers.h> > > #include <asm/svm.h> > > +#include <asm/ultravisor.h> > > > > #include "pseries.h" > > > > @@ -179,6 +180,19 @@ static int tce_build_pSeriesLP(struct iommu_table *tbl, long tcenum, > > > > static DEFINE_PER_CPU(__be64 *, tce_page); > > > > +/* > > + * Allocate a tce page. If secure VM, share the page with the hypervisor. > > + */ > > +static __be64 *alloc_tce_page(void) > > +{ > > + __be64 *tcep = (__be64 *)__get_free_page(GFP_ATOMIC); > > + > > + if (tcep && is_secure_guest()) > > + uv_share_page(PHYS_PFN(__pa(tcep)), 1); > > > There is no matching unshare in this patch. The page is allocated and shared, and stays that way for the life of the kernel. It is not explicitly unshared or freed. It is however implicitly unshared by the guest kernel, through a UV_UNSHARE_ALL_PAGES ucall when the guest kernel reboots. And it also gets implicitly unshared by the Ultravisor/Hypervisor, if the SVM abruptly terminates. > > > > + > > + return tcep; > > +} > > + > > static int tce_buildmulti_pSeriesLP(struct iommu_table *tbl, long tcenum, > > long npages, unsigned long uaddr, > > enum dma_data_direction direction, > > @@ -206,8 +220,7 @@ static int tce_buildmulti_pSeriesLP(struct iommu_table *tbl, long tcenum, > > * from iommu_alloc{,_sg}() > > */ > > if (!tcep) { > > - tcep = (__be64 *)__get_free_page(GFP_ATOMIC); > > - /* If allocation fails, fall back to the loop implementation */ > > + tcep = alloc_tce_page(); > > if (!tcep) { > > local_irq_restore(flags); > > return tce_build_pSeriesLP(tbl, tcenum, npages, uaddr, > > @@ -391,6 +404,7 @@ static int tce_clearrange_multi_pSeriesLP(unsigned long start_pfn, > > return rc; > > } > > > > + > > Unrelated. yes. will fix it. Thanks, RP
On 07/11/2019 04:01, Ram Pai wrote: > On Wed, Nov 06, 2019 at 12:58:50PM +1100, Alexey Kardashevskiy wrote: >> >> >> On 05/11/2019 08:28, Ram Pai wrote: >>> The hypervisor needs to access the contents of the page holding the TCE >>> entries while setting up the TCE entries in the IOMMU's TCE table. For >>> SecureVMs, since this page is encrypted, the hypervisor cannot access >>> valid entries. Share the page with the hypervisor. This ensures that the >>> hypervisor sees the valid entries. >>> >>> Signed-off-by: Ram Pai <linuxram@us.ibm.com> >>> --- >>> arch/powerpc/platforms/pseries/iommu.c | 20 +++++++++++++++++--- >>> 1 file changed, 17 insertions(+), 3 deletions(-) >>> >>> diff --git a/arch/powerpc/platforms/pseries/iommu.c b/arch/powerpc/platforms/pseries/iommu.c >>> index 8d9c2b1..07f0847 100644 >>> --- a/arch/powerpc/platforms/pseries/iommu.c >>> +++ b/arch/powerpc/platforms/pseries/iommu.c >>> @@ -37,6 +37,7 @@ >>> #include <asm/mmzone.h> >>> #include <asm/plpar_wrappers.h> >>> #include <asm/svm.h> >>> +#include <asm/ultravisor.h> >>> >>> #include "pseries.h" >>> >>> @@ -179,6 +180,19 @@ static int tce_build_pSeriesLP(struct iommu_table *tbl, long tcenum, >>> >>> static DEFINE_PER_CPU(__be64 *, tce_page); >>> >>> +/* >>> + * Allocate a tce page. If secure VM, share the page with the hypervisor. >>> + */ >>> +static __be64 *alloc_tce_page(void) >>> +{ >>> + __be64 *tcep = (__be64 *)__get_free_page(GFP_ATOMIC); >>> + >>> + if (tcep && is_secure_guest()) >>> + uv_share_page(PHYS_PFN(__pa(tcep)), 1); >> >> >> There is no matching unshare in this patch. > > The page is allocated and shared, and stays that way for the life of the > kernel. It is not explicitly unshared or freed. Ah, fair enough, I missed that, strange that we do not free it but ok. Thanks, > It is however > implicitly unshared by the guest kernel, through a UV_UNSHARE_ALL_PAGES ucall > when the guest kernel reboots. And it also gets implicitly unshared by > the Ultravisor/Hypervisor, if the SVM abruptly terminates. > >> >> >>> + >>> + return tcep; >>> +} >>> + >>> static int tce_buildmulti_pSeriesLP(struct iommu_table *tbl, long tcenum, >>> long npages, unsigned long uaddr, >>> enum dma_data_direction direction, >>> @@ -206,8 +220,7 @@ static int tce_buildmulti_pSeriesLP(struct iommu_table *tbl, long tcenum, >>> * from iommu_alloc{,_sg}() >>> */ >>> if (!tcep) { >>> - tcep = (__be64 *)__get_free_page(GFP_ATOMIC); >>> - /* If allocation fails, fall back to the loop implementation */ >>> + tcep = alloc_tce_page(); >>> if (!tcep) { >>> local_irq_restore(flags); >>> return tce_build_pSeriesLP(tbl, tcenum, npages, uaddr, >>> @@ -391,6 +404,7 @@ static int tce_clearrange_multi_pSeriesLP(unsigned long start_pfn, >>> return rc; >>> } >>> >>> + >> >> Unrelated. > > yes. will fix it. > > Thanks, > RP >
Ram Pai <linuxram@us.ibm.com> writes: > The hypervisor needs to access the contents of the page holding the TCE > entries while setting up the TCE entries in the IOMMU's TCE table. For > SecureVMs, since this page is encrypted, the hypervisor cannot access > valid entries. Share the page with the hypervisor. This ensures that the > hypervisor sees the valid entries. Can you please give people some explanation of why this is safe. After all the point of the Ultravisor is to protect the guest from a malicious hypervisor. Giving the hypervisor access to a page of TCEs sounds dangerous, so please explain why it's not. cheers > diff --git a/arch/powerpc/platforms/pseries/iommu.c b/arch/powerpc/platforms/pseries/iommu.c > index 8d9c2b1..07f0847 100644 > --- a/arch/powerpc/platforms/pseries/iommu.c > +++ b/arch/powerpc/platforms/pseries/iommu.c > @@ -37,6 +37,7 @@ > #include <asm/mmzone.h> > #include <asm/plpar_wrappers.h> > #include <asm/svm.h> > +#include <asm/ultravisor.h> > > #include "pseries.h" > > @@ -179,6 +180,19 @@ static int tce_build_pSeriesLP(struct iommu_table *tbl, long tcenum, > > static DEFINE_PER_CPU(__be64 *, tce_page); > > +/* > + * Allocate a tce page. If secure VM, share the page with the hypervisor. > + */ > +static __be64 *alloc_tce_page(void) > +{ > + __be64 *tcep = (__be64 *)__get_free_page(GFP_ATOMIC); > + > + if (tcep && is_secure_guest()) > + uv_share_page(PHYS_PFN(__pa(tcep)), 1); > + > + return tcep; > +} > + > static int tce_buildmulti_pSeriesLP(struct iommu_table *tbl, long tcenum, > long npages, unsigned long uaddr, > enum dma_data_direction direction, > @@ -206,8 +220,7 @@ static int tce_buildmulti_pSeriesLP(struct iommu_table *tbl, long tcenum, > * from iommu_alloc{,_sg}() > */ > if (!tcep) { > - tcep = (__be64 *)__get_free_page(GFP_ATOMIC); > - /* If allocation fails, fall back to the loop implementation */ > + tcep = alloc_tce_page(); > if (!tcep) { > local_irq_restore(flags); > return tce_build_pSeriesLP(tbl, tcenum, npages, uaddr, > @@ -391,6 +404,7 @@ static int tce_clearrange_multi_pSeriesLP(unsigned long start_pfn, > return rc; > } > > + > static int tce_setrange_multi_pSeriesLP(unsigned long start_pfn, > unsigned long num_pfn, const void *arg) > { > @@ -405,7 +419,7 @@ static int tce_setrange_multi_pSeriesLP(unsigned long start_pfn, > tcep = __this_cpu_read(tce_page); > > if (!tcep) { > - tcep = (__be64 *)__get_free_page(GFP_ATOMIC); > + tcep = alloc_tce_page(); > if (!tcep) { > local_irq_enable(); > return -ENOMEM; > -- > 1.8.3.1
On Thu, Nov 07, 2019 at 09:29:54PM +1100, Michael Ellerman wrote: > Ram Pai <linuxram@us.ibm.com> writes: > > The hypervisor needs to access the contents of the page holding the TCE > > entries while setting up the TCE entries in the IOMMU's TCE table. For > > SecureVMs, since this page is encrypted, the hypervisor cannot access > > valid entries. Share the page with the hypervisor. This ensures that the > > hypervisor sees the valid entries. > > Can you please give people some explanation of why this is safe. After > all the point of the Ultravisor is to protect the guest from a malicious > hypervisor. Giving the hypervisor access to a page of TCEs sounds > dangerous, so please explain why it's not. Yes. will do, in my next version of the patch. BTW: this page, which is shareed with the hypervisor contains nothing but TCE entries. The hypervisor has a need to see those entries, so that it can update the TCE table with correct entires. Yes, a malicious hypervisor may try to update the TCE table with entries that point to incorrect memory location. But doing so will not help the hypervisor to steal any data from those memory location, because those memory location; if accessed by the hypervisor, will only fetch encrypted data. At most it can lead to denial of service, but not stolen data. RP
diff --git a/arch/powerpc/platforms/pseries/iommu.c b/arch/powerpc/platforms/pseries/iommu.c index 8d9c2b1..07f0847 100644 --- a/arch/powerpc/platforms/pseries/iommu.c +++ b/arch/powerpc/platforms/pseries/iommu.c @@ -37,6 +37,7 @@ #include <asm/mmzone.h> #include <asm/plpar_wrappers.h> #include <asm/svm.h> +#include <asm/ultravisor.h> #include "pseries.h" @@ -179,6 +180,19 @@ static int tce_build_pSeriesLP(struct iommu_table *tbl, long tcenum, static DEFINE_PER_CPU(__be64 *, tce_page); +/* + * Allocate a tce page. If secure VM, share the page with the hypervisor. + */ +static __be64 *alloc_tce_page(void) +{ + __be64 *tcep = (__be64 *)__get_free_page(GFP_ATOMIC); + + if (tcep && is_secure_guest()) + uv_share_page(PHYS_PFN(__pa(tcep)), 1); + + return tcep; +} + static int tce_buildmulti_pSeriesLP(struct iommu_table *tbl, long tcenum, long npages, unsigned long uaddr, enum dma_data_direction direction, @@ -206,8 +220,7 @@ static int tce_buildmulti_pSeriesLP(struct iommu_table *tbl, long tcenum, * from iommu_alloc{,_sg}() */ if (!tcep) { - tcep = (__be64 *)__get_free_page(GFP_ATOMIC); - /* If allocation fails, fall back to the loop implementation */ + tcep = alloc_tce_page(); if (!tcep) { local_irq_restore(flags); return tce_build_pSeriesLP(tbl, tcenum, npages, uaddr, @@ -391,6 +404,7 @@ static int tce_clearrange_multi_pSeriesLP(unsigned long start_pfn, return rc; } + static int tce_setrange_multi_pSeriesLP(unsigned long start_pfn, unsigned long num_pfn, const void *arg) { @@ -405,7 +419,7 @@ static int tce_setrange_multi_pSeriesLP(unsigned long start_pfn, tcep = __this_cpu_read(tce_page); if (!tcep) { - tcep = (__be64 *)__get_free_page(GFP_ATOMIC); + tcep = alloc_tce_page(); if (!tcep) { local_irq_enable(); return -ENOMEM;
The hypervisor needs to access the contents of the page holding the TCE entries while setting up the TCE entries in the IOMMU's TCE table. For SecureVMs, since this page is encrypted, the hypervisor cannot access valid entries. Share the page with the hypervisor. This ensures that the hypervisor sees the valid entries. Signed-off-by: Ram Pai <linuxram@us.ibm.com> --- arch/powerpc/platforms/pseries/iommu.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-)