Commit 83af5e65 authored by Tom Lendacky's avatar Tom Lendacky Committed by Paolo Bonzini

KVM: SVM: Guard against DEACTIVATE when performing WBINVD/DF_FLUSH

The SEV firmware DEACTIVATE command disassociates an SEV guest from an
ASID, clears the WBINVD indicator on all threads and indicates that the
SEV firmware DF_FLUSH command must be issued before the ASID can be
re-used. The SEV firmware DF_FLUSH command will return an error if a
WBINVD has not been performed on every thread before it has been invoked.
A window exists between the WBINVD and the invocation of the DF_FLUSH
command where an SEV firmware DEACTIVATE command could be invoked on
another thread, clearing the WBINVD indicator. This will cause the
subsequent SEV firmware DF_FLUSH command to fail which, in turn, results
in the SEV firmware ACTIVATE command failing for the reclaimed ASID.
This results in the SEV guest failing to start.

Use a mutex to close the WBINVD/DF_FLUSH window by obtaining the mutex
before the DEACTIVATE and releasing it after the DF_FLUSH. This ensures
that any DEACTIVATE cannot run before a DF_FLUSH has completed.

Fixes: 59414c98 ("KVM: SVM: Add support for KVM_SEV_LAUNCH_START command")
Tested-by: default avatarDavid Rientjes <rientjes@google.com>
Signed-off-by: default avatarTom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
parent e3b9a9e1
...@@ -418,6 +418,7 @@ enum { ...@@ -418,6 +418,7 @@ enum {
#define VMCB_AVIC_APIC_BAR_MASK 0xFFFFFFFFFF000ULL #define VMCB_AVIC_APIC_BAR_MASK 0xFFFFFFFFFF000ULL
static DEFINE_MUTEX(sev_deactivate_lock);
static DEFINE_MUTEX(sev_bitmap_lock); static DEFINE_MUTEX(sev_bitmap_lock);
static unsigned int max_sev_asid; static unsigned int max_sev_asid;
static unsigned int min_sev_asid; static unsigned int min_sev_asid;
...@@ -1756,10 +1757,20 @@ static void sev_unbind_asid(struct kvm *kvm, unsigned int handle) ...@@ -1756,10 +1757,20 @@ static void sev_unbind_asid(struct kvm *kvm, unsigned int handle)
/* deactivate handle */ /* deactivate handle */
data->handle = handle; data->handle = handle;
/*
* Guard against a parallel DEACTIVATE command before the DF_FLUSH
* command has completed.
*/
mutex_lock(&sev_deactivate_lock);
sev_guest_deactivate(data, NULL); sev_guest_deactivate(data, NULL);
wbinvd_on_all_cpus(); wbinvd_on_all_cpus();
sev_guest_df_flush(NULL); sev_guest_df_flush(NULL);
mutex_unlock(&sev_deactivate_lock);
kfree(data); kfree(data);
decommission = kzalloc(sizeof(*decommission), GFP_KERNEL); decommission = kzalloc(sizeof(*decommission), GFP_KERNEL);
...@@ -6318,9 +6329,18 @@ static int sev_bind_asid(struct kvm *kvm, unsigned int handle, int *error) ...@@ -6318,9 +6329,18 @@ static int sev_bind_asid(struct kvm *kvm, unsigned int handle, int *error)
int asid = sev_get_asid(kvm); int asid = sev_get_asid(kvm);
int ret; int ret;
/*
* Guard against a DEACTIVATE command before the DF_FLUSH command
* has completed.
*/
mutex_lock(&sev_deactivate_lock);
wbinvd_on_all_cpus(); wbinvd_on_all_cpus();
ret = sev_guest_df_flush(error); ret = sev_guest_df_flush(error);
mutex_unlock(&sev_deactivate_lock);
if (ret) if (ret)
return ret; return ret;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment