From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id AA5B2C433DF for ; Mon, 25 May 2020 15:34:37 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 5B72A207CB for ; Mon, 25 May 2020 15:34:37 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=shutemov-name.20150623.gappssmtp.com header.i=@shutemov-name.20150623.gappssmtp.com header.b="S5/2tK2O" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 5B72A207CB Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=shutemov.name Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id E9A798004D; Mon, 25 May 2020 11:34:36 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id E233B8E0008; Mon, 25 May 2020 11:34:36 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id CEB2D8004D; Mon, 25 May 2020 11:34:36 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0210.hostedemail.com [216.40.44.210]) by kanga.kvack.org (Postfix) with ESMTP id B0B1D8E0008 for ; Mon, 25 May 2020 11:34:36 -0400 (EDT) Received: from smtpin20.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id 717B9180AD820 for ; Mon, 25 May 2020 15:34:36 +0000 (UTC) X-FDA: 76855638552.20.girl45_7f7b95fa5dc3c X-HE-Tag: girl45_7f7b95fa5dc3c X-Filterd-Recvd-Size: 10692 Received: from mail-lj1-f196.google.com (mail-lj1-f196.google.com [209.85.208.196]) by imf17.hostedemail.com (Postfix) with ESMTP for ; Mon, 25 May 2020 15:34:35 +0000 (UTC) Received: by mail-lj1-f196.google.com with SMTP id m18so21178880ljo.5 for ; Mon, 25 May 2020 08:34:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=shutemov-name.20150623.gappssmtp.com; s=20150623; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=olnoNQxuknVW4bQuL5l9tebXpdimIfOj9TqotW4cTeA=; b=S5/2tK2OydDqOOPz92GXiwHcWA5BpMIaQdb6yJEiIONflcVtdqNyt15Npm9Ejh/Yib jqdHyq3ZArOPYiiaPcNQtpFA2tbSL6MsvhagZVCcgbzp7/4BWge00aJx/DScLdxmgVGz agEtZukX8gi/P9gkH/lOCz+74fS62K7kSH57gAyHOj+xqfjlqEAL3ZnAGv/DOweDoBrF wPSyOn/pvGQi1v0fMnCKoiZzqEoLV/3lIfn+vnjyP24ZOwvR806MoLSm53KcI47Vs6W8 xkKXLcYCAZVWf41kjTVWjQmJtWfFK/2Z0DTutZbICKnnpsaSRo7EtowkAjR5G3TCnzO3 VrIQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=olnoNQxuknVW4bQuL5l9tebXpdimIfOj9TqotW4cTeA=; b=Fu9w9cx3/gNiUuy5/pEiam05U5hWBjr1BGPSQiDw6QVywMkLH/98xfXapTEpARPjQO ZnRfHS0tnNqIrww8C0o4s+URkRje+hduAztpwcIz+kFIhZC6BDBdT6n78t2wb0mUlCFY 6eqgJO1+eQpC2DCjhGdYsdIpOSarp53H+MZj5gjZhf+I0ESbkTEKQeo82Xp0fpMe/grm LyTbsknSfn27p5HpH1AJNFQBE6qYIu2dCv18MVFvanU0sislhims6UKjb5I2FgVqTj9+ BzeBngEyZglZAsHFdNlXY5WSPEZLc4Vg7xWSL7V9G2Q4tkogsRoniSlqW1LPvbuJIBU8 2CAw== X-Gm-Message-State: AOAM533PJSiCkfCkpsD+q3uIeOlWX3tGMa975liFTpKTFmTY6CmShViX Ic11rSPEYn2+zEbA4l+bZN5ouw== X-Google-Smtp-Source: ABdhPJwx1Dck3qKU28qGLJSfQYnOWshmUttRmy/DfNjZQo9rEFN1phiSf4LGY2ZslMm4HFfBhPyrPg== X-Received: by 2002:a2e:701a:: with SMTP id l26mr14906546ljc.50.1590420874530; Mon, 25 May 2020 08:34:34 -0700 (PDT) Received: from box.localdomain ([86.57.175.117]) by smtp.gmail.com with ESMTPSA id r7sm5036541lfc.79.2020.05.25.08.34.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 25 May 2020 08:34:33 -0700 (PDT) Received: by box.localdomain (Postfix, from userid 1000) id 23ECA10230F; Mon, 25 May 2020 18:34:35 +0300 (+03) Date: Mon, 25 May 2020 18:34:35 +0300 From: "Kirill A. Shutemov" To: Vitaly Kuznetsov Cc: David Rientjes , Andrea Arcangeli , Kees Cook , Will Drewry , "Edgecombe, Rick P" , "Kleen, Andi" , x86@kernel.org, kvm@vger.kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, "Kirill A. Shutemov" , Dave Hansen , Andy Lutomirski , Peter Zijlstra , Paolo Bonzini , Sean Christopherson , Wanpeng Li , Jim Mattson , Joerg Roedel Subject: Re: [RFC 09/16] KVM: Protected memory extension Message-ID: <20200525153435.c6mx3pjryyk4j4go@box> References: <20200522125214.31348-1-kirill.shutemov@linux.intel.com> <20200522125214.31348-10-kirill.shutemov@linux.intel.com> <87367o828i.fsf@vitty.brq.redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <87367o828i.fsf@vitty.brq.redhat.com> X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Mon, May 25, 2020 at 05:26:37PM +0200, Vitaly Kuznetsov wrote: > "Kirill A. Shutemov" writes: > > > Add infrastructure that handles protected memory extension. > > > > Arch-specific code has to provide hypercalls and define non-zero > > VM_KVM_PROTECTED. > > > > Signed-off-by: Kirill A. Shutemov > > --- > > include/linux/kvm_host.h | 4 ++ > > mm/mprotect.c | 1 + > > virt/kvm/kvm_main.c | 131 +++++++++++++++++++++++++++++++++++++++ > > 3 files changed, 136 insertions(+) > > > > diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h > > index bd0bb600f610..d7072f6d6aa0 100644 > > --- a/include/linux/kvm_host.h > > +++ b/include/linux/kvm_host.h > > @@ -700,6 +700,10 @@ void kvm_arch_flush_shadow_all(struct kvm *kvm); > > void kvm_arch_flush_shadow_memslot(struct kvm *kvm, > > struct kvm_memory_slot *slot); > > > > +int kvm_protect_all_memory(struct kvm *kvm); > > +int kvm_protect_memory(struct kvm *kvm, > > + unsigned long gfn, unsigned long npages, bool protect); > > + > > int gfn_to_page_many_atomic(struct kvm_memory_slot *slot, gfn_t gfn, > > struct page **pages, int nr_pages); > > > > diff --git a/mm/mprotect.c b/mm/mprotect.c > > index 494192ca954b..552be3b4c80a 100644 > > --- a/mm/mprotect.c > > +++ b/mm/mprotect.c > > @@ -505,6 +505,7 @@ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev, > > vm_unacct_memory(charged); > > return error; > > } > > +EXPORT_SYMBOL_GPL(mprotect_fixup); > > > > /* > > * pkey==-1 when doing a legacy mprotect() > > diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c > > index 530af95efdf3..07d45da5d2aa 100644 > > --- a/virt/kvm/kvm_main.c > > +++ b/virt/kvm/kvm_main.c > > @@ -155,6 +155,8 @@ static void kvm_uevent_notify_change(unsigned int type, struct kvm *kvm); > > static unsigned long long kvm_createvm_count; > > static unsigned long long kvm_active_vms; > > > > +static int protect_memory(unsigned long start, unsigned long end, bool protect); > > + > > __weak int kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm, > > unsigned long start, unsigned long end, bool blockable) > > { > > @@ -1309,6 +1311,14 @@ int __kvm_set_memory_region(struct kvm *kvm, > > if (r) > > goto out_bitmap; > > > > + if (mem->memory_size && kvm->mem_protected) { > > + r = protect_memory(new.userspace_addr, > > + new.userspace_addr + new.npages * PAGE_SIZE, > > + true); > > + if (r) > > + goto out_bitmap; > > + } > > + > > if (old.dirty_bitmap && !new.dirty_bitmap) > > kvm_destroy_dirty_bitmap(&old); > > return 0; > > @@ -2652,6 +2662,127 @@ void kvm_vcpu_mark_page_dirty(struct kvm_vcpu *vcpu, gfn_t gfn) > > } > > EXPORT_SYMBOL_GPL(kvm_vcpu_mark_page_dirty); > > > > +static int protect_memory(unsigned long start, unsigned long end, bool protect) > > +{ > > + struct mm_struct *mm = current->mm; > > + struct vm_area_struct *vma, *prev; > > + int ret; > > + > > + if (down_write_killable(&mm->mmap_sem)) > > + return -EINTR; > > + > > + ret = -ENOMEM; > > + vma = find_vma(current->mm, start); > > + if (!vma) > > + goto out; > > + > > + ret = -EINVAL; > > + if (vma->vm_start > start) > > + goto out; > > + > > + if (start > vma->vm_start) > > + prev = vma; > > + else > > + prev = vma->vm_prev; > > + > > + ret = 0; > > + while (true) { > > + unsigned long newflags, tmp; > > + > > + tmp = vma->vm_end; > > + if (tmp > end) > > + tmp = end; > > + > > + newflags = vma->vm_flags; > > + if (protect) > > + newflags |= VM_KVM_PROTECTED; > > + else > > + newflags &= ~VM_KVM_PROTECTED; > > + > > + /* The VMA has been handled as part of other memslot */ > > + if (newflags == vma->vm_flags) > > + goto next; > > + > > + ret = mprotect_fixup(vma, &prev, start, tmp, newflags); > > + if (ret) > > + goto out; > > + > > +next: > > + start = tmp; > > + if (start < prev->vm_end) > > + start = prev->vm_end; > > + > > + if (start >= end) > > + goto out; > > + > > + vma = prev->vm_next; > > + if (!vma || vma->vm_start != start) { > > + ret = -ENOMEM; > > + goto out; > > + } > > + } > > +out: > > + up_write(&mm->mmap_sem); > > + return ret; > > +} > > + > > +int kvm_protect_memory(struct kvm *kvm, > > + unsigned long gfn, unsigned long npages, bool protect) > > +{ > > + struct kvm_memory_slot *memslot; > > + unsigned long start, end; > > + gfn_t numpages; > > + > > + if (!VM_KVM_PROTECTED) > > + return -KVM_ENOSYS; > > + > > + if (!npages) > > + return 0; > > + > > + memslot = gfn_to_memslot(kvm, gfn); > > + /* Not backed by memory. It's okay. */ > > + if (!memslot) > > + return 0; > > + > > + start = gfn_to_hva_many(memslot, gfn, &numpages); > > + end = start + npages * PAGE_SIZE; > > + > > + /* XXX: Share range across memory slots? */ > > + if (WARN_ON(numpages < npages)) > > + return -EINVAL; > > + > > + return protect_memory(start, end, protect); > > +} > > +EXPORT_SYMBOL_GPL(kvm_protect_memory); > > + > > +int kvm_protect_all_memory(struct kvm *kvm) > > +{ > > + struct kvm_memslots *slots; > > + struct kvm_memory_slot *memslot; > > + unsigned long start, end; > > + int i, ret = 0;; > > + > > + if (!VM_KVM_PROTECTED) > > + return -KVM_ENOSYS; > > + > > + mutex_lock(&kvm->slots_lock); > > + kvm->mem_protected = true; > > What will happen upon guest reboot? Do we need to unprotect everything > to make sure we'll be able to boot? Also, after the reboot how will the > guest know that it is protected and needs to unprotect things? -> see my > idea about converting KVM_HC_ENABLE_MEM_PROTECTED to a stateful MSR (but > we'll likely have to reset it upon reboot anyway). That's extremely good question. I have not considered reboot. I tend to use -no-reboot in my setup. I'll think how to deal with reboot. I don't know how it works now to give a good answer. The may not be a good solution: unprotecting memory on reboot means we expose user data. We can wipe the data before unprotecting, but we should not wipe BIOS and anything else that is required on reboot. I donno. > > + for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++) { > > + slots = __kvm_memslots(kvm, i); > > + kvm_for_each_memslot(memslot, slots) { > > + start = memslot->userspace_addr; > > + end = start + memslot->npages * PAGE_SIZE; > > + ret = protect_memory(start, end, true); > > + if (ret) > > + goto out; > > + } > > + } > > +out: > > + mutex_unlock(&kvm->slots_lock); > > + return ret; > > +} > > +EXPORT_SYMBOL_GPL(kvm_protect_all_memory); > > + > > void kvm_sigset_activate(struct kvm_vcpu *vcpu) > > { > > if (!vcpu->sigset_active) > > -- > Vitaly > > -- Kirill A. Shutemov