From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6D360C001E0 for ; Mon, 24 Jul 2023 04:45:55 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 6DF688D0001; Mon, 24 Jul 2023 00:45:54 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 643896B0074; Mon, 24 Jul 2023 00:45:54 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 494658D0001; Mon, 24 Jul 2023 00:45:54 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0014.hostedemail.com [216.40.44.14]) by kanga.kvack.org (Postfix) with ESMTP id 31AED6B0071 for ; Mon, 24 Jul 2023 00:45:54 -0400 (EDT) Received: from smtpin04.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id 01B7716091A for ; Mon, 24 Jul 2023 04:45:53 +0000 (UTC) X-FDA: 81045267828.04.67C4337 Received: from mga18.intel.com (mga18.intel.com [134.134.136.126]) by imf24.hostedemail.com (Postfix) with ESMTP id 6D838180002 for ; Mon, 24 Jul 2023 04:45:51 +0000 (UTC) Authentication-Results: imf24.hostedemail.com; dkim=pass header.d=intel.com header.s=Intel header.b=KGtj+EHr; spf=pass (imf24.hostedemail.com: domain of yilun.xu@intel.com designates 134.134.136.126 as permitted sender) smtp.mailfrom=yilun.xu@intel.com; dmarc=pass (policy=none) header.from=intel.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1690173952; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=ABqWGqgrqaXNLB7krIWsJ7qG31V949kzE6IfQVbXDeM=; b=FcX4ce8OdkKpyWnQv+/W/OPV4nceDIMGKJLTXAb4ucwSpIVfX6fNtmoOaxUEybFKZixvAq q1w/Hbm4Czfp6fcynWbw65fo3Non0SIcqHSPWkqSJGL1zquziDC6pS7K5c0DzRaS9Kbd+d aY3TIg9PqmgvCQIxlSk7IJlV01f9GsY= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1690173952; a=rsa-sha256; cv=none; b=dhFxONDKnqOTD2MBSFd7rJCUuVMWcNpmnUvNHDXqsBI3UydZ60cDVuPVG/5fMxCx++LMxh Ibq9LKDCpZHsrOeWure2EEwCZ28nzqXdE8/spkoGQSndGPg+F4PsqcbtS65a0Xj7Op+vdq rZs/W1/EeEeNR/NFt663Q3+E4hO9qFQ= ARC-Authentication-Results: i=1; imf24.hostedemail.com; dkim=pass header.d=intel.com header.s=Intel header.b=KGtj+EHr; spf=pass (imf24.hostedemail.com: domain of yilun.xu@intel.com designates 134.134.136.126 as permitted sender) smtp.mailfrom=yilun.xu@intel.com; dmarc=pass (policy=none) header.from=intel.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1690173951; x=1721709951; h=date:from:to:cc:subject:message-id:references: mime-version:in-reply-to; bh=q9qzwcL7N7viHeki30qyeMCUuWnJ87fuGcM4hbUg7Mg=; b=KGtj+EHr3JfhpdV199LQ5SQewVH7gbTjwGmx8OYbqabQazsJDXdYK5sB xr9dAWDo0JqDC306wG28VXUz4ALEt7YqDzcb1ysqIhTREa9qXMFoMzwsl phLOQ0lW0N6zAzlb+rZDjk5G0jO4rneNV1SEdiRzjoDNE9AJyV+cmFTBv ni8T2lOShsg0C32LSEGclScOlez2ydlO4u6lFLZB6kcRz0rJ5QGI+x6Um 8Eh/vkrnq/EDQgNG7U2PwHSIw2s0ymUurx8E4o8sPA8MpMNZHbBzrdiqZ VL5jyxgaBkqSYr8kFyTakBhXFIGBO+BgySRkx9vhSeGyQBmUwRA0ejLpT A==; X-IronPort-AV: E=McAfee;i="6600,9927,10780"; a="352240341" X-IronPort-AV: E=Sophos;i="6.01,228,1684825200"; d="scan'208";a="352240341" Received: from fmsmga006.fm.intel.com ([10.253.24.20]) by orsmga106.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 23 Jul 2023 21:45:49 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=McAfee;i="6600,9927,10780"; a="972119310" X-IronPort-AV: E=Sophos;i="6.01,228,1684825200"; d="scan'208";a="972119310" Received: from yilunxu-optiplex-7050.sh.intel.com (HELO localhost) ([10.239.159.165]) by fmsmga006.fm.intel.com with ESMTP; 23 Jul 2023 21:45:40 -0700 Date: Mon, 24 Jul 2023 12:43:53 +0800 From: Xu Yilun To: Sean Christopherson Cc: Paolo Bonzini , Marc Zyngier , Oliver Upton , Huacai Chen , Michael Ellerman , Anup Patel , Paul Walmsley , Palmer Dabbelt , Albert Ou , "Matthew Wilcox (Oracle)" , Andrew Morton , Paul Moore , James Morris , "Serge E. Hallyn" , kvm@vger.kernel.org, linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev, linux-mips@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, kvm-riscv@lists.infradead.org, linux-riscv@lists.infradead.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, Chao Peng , Fuad Tabba , Jarkko Sakkinen , Yu Zhang , Vishal Annapurve , Ackerley Tng , Maciej Szmigiero , Vlastimil Babka , David Hildenbrand , Quentin Perret , Michael Roth , Wang , Liam Merwick , Isaku Yamahata , "Kirill A . Shutemov" Subject: Re: [RFC PATCH v11 08/29] KVM: Introduce per-page memory attributes Message-ID: References: <20230718234512.1690985-1-seanjc@google.com> <20230718234512.1690985-9-seanjc@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20230718234512.1690985-9-seanjc@google.com> X-Rspamd-Queue-Id: 6D838180002 X-Rspam-User: X-Stat-Signature: 6trruhb66h67t85dyde8hp5y8nm9irub X-Rspamd-Server: rspam03 X-HE-Tag: 1690173951-13586 X-HE-Meta: U2FsdGVkX19mIT3KlcndNP+MeU5tnFpJZKp/M+3bgjSbwPgOH9R8yjwa5mRXe0+GKoU5E09v0xUUglDA+SXEireaNCkfGorqLgSZc0I/ys1I9JKDF3qooZEhV6iUsgUsGsdauOOCdV2rExQ9u/lEfbyOshvcg2QuN7l7cFd8CIyh+/5lv6T1qyQ6CDpF7LRAmYVUmHrZwkul8d5Ns+GtU/v54jZfngEP1zb5piEYODeyGyBJySGuONNxac6j46oziMeMeAWeSas/TFPwi8UothwKzDZUaAJ5PwaN1jMHR73rNnpDYwo0FUcv4fXKpa8OMTt4FVm0nY1ywWlTfIf/YT8i3NK/GRZQDIbXQbbVtvxAWnlW2dMs7A675tVvpW3Bg+P7Q9DFD/RcS2a7tt/hzilxJNHsVzrFiWA9CHFbf3AqroVNFcs7rZJXTe4bqMxuR4OzJfcW/ebSWkd8O32xcRJTKn6O6nDx4du/Kz+KUYM5a9IFoH0WV4X/te6KfvnkHCy6vSyNua0odxNNC220o7Xhg3ICkKDkj58TinfXA6deUTA0RUmO9EuuRjpt9LUuzAV6rrXgZnMAzWyBv5LFTAeRvdlwMYyriwhErqIIK8XueC8hpVYSuCzjLYZlIC/x9JK78w/usEerOmyPzmo/AXDakVXY/T+HJjChpYEXV9UdQM1MJmohn32Z/HjdH+JRtzi5vz4DXnkc8K0gno3RP4S+OFYLPlNLWwCfeEmsc9J7WHEqfWsa9viAJJBAfbdpwVYrunHff2FJDinu//Vi7l5vN3Zb9YtKIN/NFcw7+vrYsvkv6NtrbwLlo2kAYbruccXnKGkgovTDEXZhxjExaP2ka9+lCyq50Mvqy2eJDYYEhHUsVW5Ol8jDCZU9qxCpTeXnHsYFLO5gcWIaDwjYdllxp3lF4w2D5kqFkE9cLCDmbSEVGQ6MCncXkzgELfBTZ/G8MUMnutiVZfi27Cd kf9NpC4n gNUcK1OeeiszN/G74mdPj7saG4Pawojg+PzA6CByz7fLJlb5qkXy9styPOWd7sMAnmMPAXxRQL8bSbI+IAsPwo/lJRaOq8xDIrDLdWmYJMuRJse2Qla67h0uyMFfFhRkYQrHFOiQTqn++mTvjd3gl23YBLNVWsrBA1+pEbitdPuV1b80z/ZnNKybeB3qmvrQUFX1+AVU51fulVK8RkOmMJp6BFEYCqMdpBXhQnEhchDpbQDm53QQtNa94x542AexFAqjsiwOz5miTryS1W6KfVzF8rVVN0aBTmxrO36Ps2KBbFvbA8KRuN6VUYJ0gqXPrYkafIQ7xBnrO94Np3RiiHMku3DCjKMjjbNUjMtiz7jRrwE4= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On 2023-07-18 at 16:44:51 -0700, Sean Christopherson wrote: > From: Chao Peng > > In confidential computing usages, whether a page is private or shared is > necessary information for KVM to perform operations like page fault > handling, page zapping etc. There are other potential use cases for > per-page memory attributes, e.g. to make memory read-only (or no-exec, > or exec-only, etc.) without having to modify memslots. > > Introduce two ioctls (advertised by KVM_CAP_MEMORY_ATTRIBUTES) to allow > userspace to operate on the per-page memory attributes. > - KVM_SET_MEMORY_ATTRIBUTES to set the per-page memory attributes to > a guest memory range. > - KVM_GET_SUPPORTED_MEMORY_ATTRIBUTES to return the KVM supported > memory attributes. > > Use an xarray to store the per-page attributes internally, with a naive, > not fully optimized implementation, i.e. prioritize correctness over > performance for the initial implementation. > > Because setting memory attributes is roughly analogous to mprotect() on > memory that is mapped into the guest, zap existing mappings prior to > updating the memory attributes. Opportunistically provide an arch hook > for the post-set path (needed to complete invalidation anyways) in > anticipation of x86 needing the hook to update metadata related to > determining whether or not a given gfn can be backed with various sizes > of hugepages. > > It's possible that future usages may not require an invalidation, e.g. > if KVM ends up supporting RWX protections and userspace grants _more_ > protections, but again opt for simplicity and punt optimizations to > if/when they are needed. > > Suggested-by: Sean Christopherson > Link: https://lore.kernel.org/all/Y2WB48kD0J4VGynX@google.com > Cc: Fuad Tabba > Signed-off-by: Chao Peng > Co-developed-by: Sean Christopherson > Signed-off-by: Sean Christopherson > --- > Documentation/virt/kvm/api.rst | 60 ++++++++++++ > include/linux/kvm_host.h | 14 +++ > include/uapi/linux/kvm.h | 14 +++ > virt/kvm/Kconfig | 4 + > virt/kvm/kvm_main.c | 170 +++++++++++++++++++++++++++++++++ > 5 files changed, 262 insertions(+) > Only some trivial concerns below. [...] > @@ -1175,6 +1176,9 @@ static struct kvm *kvm_create_vm(unsigned long type, const char *fdname) > spin_lock_init(&kvm->mn_invalidate_lock); > rcuwait_init(&kvm->mn_memslots_update_rcuwait); > xa_init(&kvm->vcpu_array); > +#ifdef CONFIG_KVM_GENERIC_MEMORY_ATTRIBUTES > + xa_init(&kvm->mem_attr_array); > +#endif > > INIT_LIST_HEAD(&kvm->gpc_list); > spin_lock_init(&kvm->gpc_lock); > @@ -1346,6 +1350,9 @@ static void kvm_destroy_vm(struct kvm *kvm) > kvm_free_memslots(kvm, &kvm->__memslots[i][0]); > kvm_free_memslots(kvm, &kvm->__memslots[i][1]); > } > +#ifdef CONFIG_KVM_GENERIC_MEMORY_ATTRIBUTES > + xa_destroy(&kvm->mem_attr_array); > +#endif Is it better to make the destruction in reverse order from the creation? To put xa_destroy(&kvm->mem_attr_array) after cleanup_srcu_struct(&kvm->srcu), or put xa_init(&kvm->mem_attr_array) after init_srcu_struct(&kvm->irq_srcu). > cleanup_srcu_struct(&kvm->irq_srcu); > cleanup_srcu_struct(&kvm->srcu); > kvm_arch_free_vm(kvm); > @@ -2346,6 +2353,145 @@ static int kvm_vm_ioctl_clear_dirty_log(struct kvm *kvm, > } > #endif /* CONFIG_KVM_GENERIC_DIRTYLOG_READ_PROTECT */ [...] > +static int kvm_vm_ioctl_set_mem_attributes(struct kvm *kvm, > + struct kvm_memory_attributes *attrs) > +{ > + gfn_t start, end; > + > + /* flags is currently not used. */ > + if (attrs->flags) > + return -EINVAL; > + if (attrs->attributes & ~kvm_supported_mem_attributes(kvm)) > + return -EINVAL; > + if (attrs->size == 0 || attrs->address + attrs->size < attrs->address) > + return -EINVAL; > + if (!PAGE_ALIGNED(attrs->address) || !PAGE_ALIGNED(attrs->size)) > + return -EINVAL; > + > + start = attrs->address >> PAGE_SHIFT; > + end = (attrs->address + attrs->size - 1 + PAGE_SIZE) >> PAGE_SHIFT; As the attrs->address/size are both garanteed to be non-zero, non-wrap and page aligned in prevous check. Is it OK to simplify the calculation, like: end = (attrs->address + attrs->size) >> PAGE_SHIFT; > + > + if (WARN_ON_ONCE(start == end)) > + return -EINVAL; Also, is this check possible to be hit? Maybe remove it? Thanks, Yilun > + > + /* > + * xarray tracks data using "unsigned long", and as a result so does > + * KVM. For simplicity, supports generic attributes only on 64-bit > + * architectures. > + */ > + BUILD_BUG_ON(sizeof(attrs->attributes) != sizeof(unsigned long)); > + > + return kvm_vm_set_mem_attributes(kvm, attrs->attributes, start, end); > +} > +#endif /* CONFIG_KVM_GENERIC_MEMORY_ATTRIBUTES */