From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 20618C433E0 for ; Mon, 25 May 2020 15:26:45 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id C68812071A for ; Mon, 25 May 2020 15:26:44 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="THfCDMr6" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org C68812071A Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 724438004A; Mon, 25 May 2020 11:26:44 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 6D23B8E0008; Mon, 25 May 2020 11:26:44 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 5C1C28004A; Mon, 25 May 2020 11:26:44 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0209.hostedemail.com [216.40.44.209]) by kanga.kvack.org (Postfix) with ESMTP id 419E48E0008 for ; Mon, 25 May 2020 11:26:44 -0400 (EDT) Received: from smtpin11.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay02.hostedemail.com (Postfix) with ESMTP id 0A72F2470 for ; Mon, 25 May 2020 15:26:44 +0000 (UTC) X-FDA: 76855618728.11.house40_3a9d9edfe4f2d X-HE-Tag: house40_3a9d9edfe4f2d X-Filterd-Recvd-Size: 9898 Received: from us-smtp-1.mimecast.com (us-smtp-delivery-1.mimecast.com [205.139.110.120]) by imf41.hostedemail.com (Postfix) with ESMTP for ; Mon, 25 May 2020 15:26:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1590420401; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=yHBg6PnKp6Y7ewCGnEB0X1+EHg5beHaOZcwWTbgUPq8=; b=THfCDMr618lBMB0T/iHrBLKkZG293w76vm5X+HJJEWNE5++7wn+vbBnSL0RzSjfDfccD8q LFPs4JfWrQW8ZGKHJzcom7ZSrXNjq/6TbzfNmJ6yyAZzJ5UX4E3EVdfgdRKZFF+NjysQOP QXtAKTnB9gfz9C19ehUKVYe9weCUvGA= Received: from mail-ed1-f72.google.com (mail-ed1-f72.google.com [209.85.208.72]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-362-L-L11gPpPPmxFXqQL7RN9g-1; Mon, 25 May 2020 11:26:40 -0400 X-MC-Unique: L-L11gPpPPmxFXqQL7RN9g-1 Received: by mail-ed1-f72.google.com with SMTP id bo26so7568722edb.22 for ; Mon, 25 May 2020 08:26:40 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:in-reply-to:references:date :message-id:mime-version; bh=yHBg6PnKp6Y7ewCGnEB0X1+EHg5beHaOZcwWTbgUPq8=; b=l7bI2pWmHmoarrlfkWZIPf1GQbgN9lUNDhDJtNmzFv+IqGCfz2pj5NPPvSktmVPjJE m8g8lfP+fQ90lR4fdDjsI6soy3R0bhIlpPuoTtpXqLVQRA2fepE7mN0SybLOEjFjusza M2XQqlfuRE2zc7CS6BbK0ErMA3AyZchrrKqdLU0HKY0E6y9LI+371+JJDTbccwfgwg1c KaUUtPZKVfP4SAWC3HbdzT8ZxIOwQNREubpUhbQauUVYmN1CaqAcZAPxZs5TkAzU0sGU 48YfxSiYrpDGRY48KYnz1+5vl5utlU+yhMtDTCsTolNxwmfDcGFyJ25CC7DMTxpy43nQ H3/A== X-Gm-Message-State: AOAM533m4BhYLLtRjd3LeZnEjQCMNpFSlciBC/qg/NI/iN3U9ue9BfEi e1E2Y8d5a5IFzb/W2xH/VCaxdywSG3IGz16jo3Q5phpH5O2+RNImSfKdKCS9y5H9GauJiS/jCIN zagManlnD7Jc= X-Received: by 2002:a05:6402:3128:: with SMTP id dd8mr16160575edb.156.1590420399249; Mon, 25 May 2020 08:26:39 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxMIBGAc1SAeKf2++4kxqc7BH4t4BCDYHtSX1TDVqPtr5J+1qipzK2jRTRUwbqNP6YFuh1ftg== X-Received: by 2002:a05:6402:3128:: with SMTP id dd8mr16160552edb.156.1590420398965; Mon, 25 May 2020 08:26:38 -0700 (PDT) Received: from vitty.brq.redhat.com (g-server-2.ign.cz. [91.219.240.2]) by smtp.gmail.com with ESMTPSA id p5sm16523979edi.82.2020.05.25.08.26.37 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 25 May 2020 08:26:38 -0700 (PDT) From: Vitaly Kuznetsov To: "Kirill A. Shutemov" Cc: David Rientjes , Andrea Arcangeli , Kees Cook , Will Drewry , "Edgecombe\, Rick P" , "Kleen\, Andi" , x86@kernel.org, kvm@vger.kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, "Kirill A. Shutemov" , Dave Hansen , Andy Lutomirski , Peter Zijlstra , Paolo Bonzini , Sean Christopherson , Wanpeng Li , Jim Mattson , Joerg Roedel Subject: Re: [RFC 09/16] KVM: Protected memory extension In-Reply-To: <20200522125214.31348-10-kirill.shutemov@linux.intel.com> References: <20200522125214.31348-1-kirill.shutemov@linux.intel.com> <20200522125214.31348-10-kirill.shutemov@linux.intel.com> Date: Mon, 25 May 2020 17:26:37 +0200 Message-ID: <87367o828i.fsf@vitty.brq.redhat.com> MIME-Version: 1.0 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: "Kirill A. Shutemov" writes: > Add infrastructure that handles protected memory extension. > > Arch-specific code has to provide hypercalls and define non-zero > VM_KVM_PROTECTED. > > Signed-off-by: Kirill A. Shutemov > --- > include/linux/kvm_host.h | 4 ++ > mm/mprotect.c | 1 + > virt/kvm/kvm_main.c | 131 +++++++++++++++++++++++++++++++++++++++ > 3 files changed, 136 insertions(+) > > diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h > index bd0bb600f610..d7072f6d6aa0 100644 > --- a/include/linux/kvm_host.h > +++ b/include/linux/kvm_host.h > @@ -700,6 +700,10 @@ void kvm_arch_flush_shadow_all(struct kvm *kvm); > void kvm_arch_flush_shadow_memslot(struct kvm *kvm, > struct kvm_memory_slot *slot); > > +int kvm_protect_all_memory(struct kvm *kvm); > +int kvm_protect_memory(struct kvm *kvm, > + unsigned long gfn, unsigned long npages, bool protect); > + > int gfn_to_page_many_atomic(struct kvm_memory_slot *slot, gfn_t gfn, > struct page **pages, int nr_pages); > > diff --git a/mm/mprotect.c b/mm/mprotect.c > index 494192ca954b..552be3b4c80a 100644 > --- a/mm/mprotect.c > +++ b/mm/mprotect.c > @@ -505,6 +505,7 @@ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev, > vm_unacct_memory(charged); > return error; > } > +EXPORT_SYMBOL_GPL(mprotect_fixup); > > /* > * pkey==-1 when doing a legacy mprotect() > diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c > index 530af95efdf3..07d45da5d2aa 100644 > --- a/virt/kvm/kvm_main.c > +++ b/virt/kvm/kvm_main.c > @@ -155,6 +155,8 @@ static void kvm_uevent_notify_change(unsigned int type, struct kvm *kvm); > static unsigned long long kvm_createvm_count; > static unsigned long long kvm_active_vms; > > +static int protect_memory(unsigned long start, unsigned long end, bool protect); > + > __weak int kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm, > unsigned long start, unsigned long end, bool blockable) > { > @@ -1309,6 +1311,14 @@ int __kvm_set_memory_region(struct kvm *kvm, > if (r) > goto out_bitmap; > > + if (mem->memory_size && kvm->mem_protected) { > + r = protect_memory(new.userspace_addr, > + new.userspace_addr + new.npages * PAGE_SIZE, > + true); > + if (r) > + goto out_bitmap; > + } > + > if (old.dirty_bitmap && !new.dirty_bitmap) > kvm_destroy_dirty_bitmap(&old); > return 0; > @@ -2652,6 +2662,127 @@ void kvm_vcpu_mark_page_dirty(struct kvm_vcpu *vcpu, gfn_t gfn) > } > EXPORT_SYMBOL_GPL(kvm_vcpu_mark_page_dirty); > > +static int protect_memory(unsigned long start, unsigned long end, bool protect) > +{ > + struct mm_struct *mm = current->mm; > + struct vm_area_struct *vma, *prev; > + int ret; > + > + if (down_write_killable(&mm->mmap_sem)) > + return -EINTR; > + > + ret = -ENOMEM; > + vma = find_vma(current->mm, start); > + if (!vma) > + goto out; > + > + ret = -EINVAL; > + if (vma->vm_start > start) > + goto out; > + > + if (start > vma->vm_start) > + prev = vma; > + else > + prev = vma->vm_prev; > + > + ret = 0; > + while (true) { > + unsigned long newflags, tmp; > + > + tmp = vma->vm_end; > + if (tmp > end) > + tmp = end; > + > + newflags = vma->vm_flags; > + if (protect) > + newflags |= VM_KVM_PROTECTED; > + else > + newflags &= ~VM_KVM_PROTECTED; > + > + /* The VMA has been handled as part of other memslot */ > + if (newflags == vma->vm_flags) > + goto next; > + > + ret = mprotect_fixup(vma, &prev, start, tmp, newflags); > + if (ret) > + goto out; > + > +next: > + start = tmp; > + if (start < prev->vm_end) > + start = prev->vm_end; > + > + if (start >= end) > + goto out; > + > + vma = prev->vm_next; > + if (!vma || vma->vm_start != start) { > + ret = -ENOMEM; > + goto out; > + } > + } > +out: > + up_write(&mm->mmap_sem); > + return ret; > +} > + > +int kvm_protect_memory(struct kvm *kvm, > + unsigned long gfn, unsigned long npages, bool protect) > +{ > + struct kvm_memory_slot *memslot; > + unsigned long start, end; > + gfn_t numpages; > + > + if (!VM_KVM_PROTECTED) > + return -KVM_ENOSYS; > + > + if (!npages) > + return 0; > + > + memslot = gfn_to_memslot(kvm, gfn); > + /* Not backed by memory. It's okay. */ > + if (!memslot) > + return 0; > + > + start = gfn_to_hva_many(memslot, gfn, &numpages); > + end = start + npages * PAGE_SIZE; > + > + /* XXX: Share range across memory slots? */ > + if (WARN_ON(numpages < npages)) > + return -EINVAL; > + > + return protect_memory(start, end, protect); > +} > +EXPORT_SYMBOL_GPL(kvm_protect_memory); > + > +int kvm_protect_all_memory(struct kvm *kvm) > +{ > + struct kvm_memslots *slots; > + struct kvm_memory_slot *memslot; > + unsigned long start, end; > + int i, ret = 0;; > + > + if (!VM_KVM_PROTECTED) > + return -KVM_ENOSYS; > + > + mutex_lock(&kvm->slots_lock); > + kvm->mem_protected = true; What will happen upon guest reboot? Do we need to unprotect everything to make sure we'll be able to boot? Also, after the reboot how will the guest know that it is protected and needs to unprotect things? -> see my idea about converting KVM_HC_ENABLE_MEM_PROTECTED to a stateful MSR (but we'll likely have to reset it upon reboot anyway). > + for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++) { > + slots = __kvm_memslots(kvm, i); > + kvm_for_each_memslot(memslot, slots) { > + start = memslot->userspace_addr; > + end = start + memslot->npages * PAGE_SIZE; > + ret = protect_memory(start, end, true); > + if (ret) > + goto out; > + } > + } > +out: > + mutex_unlock(&kvm->slots_lock); > + return ret; > +} > +EXPORT_SYMBOL_GPL(kvm_protect_all_memory); > + > void kvm_sigset_activate(struct kvm_vcpu *vcpu) > { > if (!vcpu->sigset_active) -- Vitaly