Commit 50085bee authored by Cfir Cohen's avatar Cfir Cohen Committed by Paolo Bonzini
Browse files

KVM: SVM: Mark SEV launch secret pages as dirty.



The LAUNCH_SECRET command performs encryption of the
launch secret memory contents. Mark pinned pages as
dirty, before unpinning them.
This matches the logic in sev_launch_update_data().

Signed-off-by: default avatarCfir Cohen <cfir@google.com>
Message-Id: <20200808003746.66687-1-cfir@google.com>
Reviewed-by: default avatarBrijesh Singh <brijesh.singh@amd.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent fc595f35
Loading
Loading
Loading
Loading
+14 −1
Original line number Diff line number Diff line
@@ -856,7 +856,7 @@ static int sev_launch_secret(struct kvm *kvm, struct kvm_sev_cmd *argp)
	struct kvm_sev_launch_secret params;
	struct page **pages;
	void *blob, *hdr;
	unsigned long n;
	unsigned long n, i;
	int ret, offset;

	if (!sev_guest(kvm))
@@ -869,6 +869,14 @@ static int sev_launch_secret(struct kvm *kvm, struct kvm_sev_cmd *argp)
	if (IS_ERR(pages))
		return PTR_ERR(pages);

	/*
	 * The LAUNCH_SECRET command will perform in-place encryption of the
	 * memory content (i.e it will write the same memory region with C=1).
	 * It's possible that the cache may contain the data with C=0, i.e.,
	 * unencrypted so invalidate it first.
	 */
	sev_clflush_pages(pages, n);

	/*
	 * The secret must be copied into contiguous memory region, lets verify
	 * that userspace memory pages are contiguous before we issue command.
@@ -914,6 +922,11 @@ e_free_blob:
e_free:
	kfree(data);
e_unpin_memory:
	/* content of memory is updated, mark pages dirty */
	for (i = 0; i < n; i++) {
		set_page_dirty_lock(pages[i]);
		mark_page_accessed(pages[i]);
	}
	sev_unpin_memory(kvm, pages, n);
	return ret;
}