Re: [RFC 16/16] KVM: Unmap protected pages from direct mapping
On Tue, May 26, 2020 at 09:16:38AM +0300, Mike Rapoport wrote:
> On Fri, May 22, 2020 at 03:52:14PM +0300, Kirill A. Shutemov wrote:
> > If the protected memory feature enabled, unmap guest memory from
> > kernel's direct mappings.
> >
> > Migration and KSM is disabled for protected memory as it would require a
> > special treatment.
> >
> > Signed-off-by: Kirill A. Shutemov
> > ---
> > arch/x86/mm/pat/set_memory.c | 1 +
> > include/linux/kvm_host.h | 3 ++
> > mm/huge_memory.c | 9 +
> > mm/ksm.c | 3 ++
> > mm/memory.c | 13 +++
> > mm/rmap.c| 4 ++
> > virt/kvm/kvm_main.c | 74
> > 7 files changed, 107 insertions(+)
> >
> > diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c
> > index 6f075766bb94..13988413af40 100644
> > --- a/arch/x86/mm/pat/set_memory.c
> > +++ b/arch/x86/mm/pat/set_memory.c
> > @@ -2227,6 +2227,7 @@ void __kernel_map_pages(struct page *page, int
> > numpages, int enable)
> >
> > arch_flush_lazy_mmu_mode();
> > }
> > +EXPORT_SYMBOL_GPL(__kernel_map_pages);
> >
> > #ifdef CONFIG_HIBERNATION
> > bool kernel_page_present(struct page *page)
> > diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
> > index b6944f88033d..e1d7762b615c 100644
> > --- a/include/linux/kvm_host.h
> > +++ b/include/linux/kvm_host.h
> > @@ -705,6 +705,9 @@ int kvm_protect_all_memory(struct kvm *kvm);
> > int kvm_protect_memory(struct kvm *kvm,
> >unsigned long gfn, unsigned long npages, bool protect);
> >
> > +void kvm_map_page(struct page *page, int nr_pages);
> > +void kvm_unmap_page(struct page *page, int nr_pages);
> > +
> > int gfn_to_page_many_atomic(struct kvm_memory_slot *slot, gfn_t gfn,
> > struct page **pages, int nr_pages);
> >
> > diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> > index c3562648a4ef..d8a444a401cc 100644
> > --- a/mm/huge_memory.c
> > +++ b/mm/huge_memory.c
> > @@ -33,6 +33,7 @@
> > #include
> > #include
> > #include
> > +#include
>
> This does not seem right...
I agree. I try to find a more clean way to deal with it.
> > #include
> > #include
> > @@ -650,6 +651,10 @@ static vm_fault_t __do_huge_pmd_anonymous_page(struct
> > vm_fault *vmf,
> > spin_unlock(vmf->ptl);
> > count_vm_event(THP_FAULT_ALLOC);
> > count_memcg_events(memcg, THP_FAULT_ALLOC, 1);
> > +
> > + /* Unmap page from direct mapping */
> > + if (vma_is_kvm_protected(vma))
> > + kvm_unmap_page(page, HPAGE_PMD_NR);
>
> ... and neither does this.
>
> I think the map/unmap primitives shoud be a part of the generic mm and
> not burried inside KVM.
Well, yes. Except, kvm_map_page() also clears the page before bringing it
back to direct mappings. Not sure yet how to deal with it.
> > return 0;
> > @@ -1886,6 +1891,10 @@ int zap_huge_pmd(struct mmu_gather *tlb, struct
> > vm_area_struct *vma,
> > page_remove_rmap(page, true);
> > VM_BUG_ON_PAGE(page_mapcount(page) < 0, page);
> > VM_BUG_ON_PAGE(!PageHead(page), page);
> > +
> > + /* Map the page back to the direct mapping */
> > + if (vma_is_kvm_protected(vma))
> > + kvm_map_page(page, HPAGE_PMD_NR);
> > } else if (thp_migration_supported()) {
> > swp_entry_t entry;
> >
> > diff --git a/mm/ksm.c b/mm/ksm.c
> > index 281c00129a2e..942b88782ac2 100644
> > --- a/mm/ksm.c
> > +++ b/mm/ksm.c
> > @@ -527,6 +527,9 @@ static struct vm_area_struct *find_mergeable_vma(struct
> > mm_struct *mm,
> > return NULL;
> > if (!(vma->vm_flags & VM_MERGEABLE) || !vma->anon_vma)
> > return NULL;
> > + /* TODO */
>
> Probably this is not something that should be done. For a security
> sensitive environment that wants protected memory, KSM woudn't be
> relevant anyway...
Hm. True.
> > diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> > index 71aac117357f..defc33d3a124 100644
> > --- a/virt/kvm/kvm_main.c
> > +++ b/virt/kvm/kvm_main.c
> > @@ -51,6 +51,7 @@
> > #include
> > #include
> > #include
> > +#include
> >
> > #include
> > #include
> > @@ -2718,6 +2719,72 @@ void kvm_vcpu_mark_page_dirty(struct kvm_vcpu *vcpu,
> > gfn_t gfn)
> > }
> > EXPORT_SYMBOL_GPL(kvm_vcpu_mark_page_dirty);
> >
> > +void kvm_map_page(struct page *page, int nr_pages)
> > +{
> > + int i;
> > +
> > + /* Clear page before returning it to the direct mapping */
> > + for (i = 0; i < nr_pages; i++) {
> > + void *p = map_page_atomic(page + i);
> > + memset(p, 0, PAGE_SIZE);
> > + unmap_page_atomic(p);
> > + }
> > +
> > + kernel_map_pages(page, nr_pages, 1);
> > +}
> > +EXPORT_SYMBOL_GPL(kvm_map_page);
> > +
> > +void kvm_unmap_page(struct page *page,
Re: [RFC 16/16] KVM: Unmap protected pages from direct mapping
On Fri, May 22, 2020 at 03:52:14PM +0300, Kirill A. Shutemov wrote:
> If the protected memory feature enabled, unmap guest memory from
> kernel's direct mappings.
>
> Migration and KSM is disabled for protected memory as it would require a
> special treatment.
>
> Signed-off-by: Kirill A. Shutemov
> ---
> arch/x86/mm/pat/set_memory.c | 1 +
> include/linux/kvm_host.h | 3 ++
> mm/huge_memory.c | 9 +
> mm/ksm.c | 3 ++
> mm/memory.c | 13 +++
> mm/rmap.c| 4 ++
> virt/kvm/kvm_main.c | 74
> 7 files changed, 107 insertions(+)
>
> diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c
> index 6f075766bb94..13988413af40 100644
> --- a/arch/x86/mm/pat/set_memory.c
> +++ b/arch/x86/mm/pat/set_memory.c
> @@ -2227,6 +2227,7 @@ void __kernel_map_pages(struct page *page, int
> numpages, int enable)
>
> arch_flush_lazy_mmu_mode();
> }
> +EXPORT_SYMBOL_GPL(__kernel_map_pages);
>
> #ifdef CONFIG_HIBERNATION
> bool kernel_page_present(struct page *page)
> diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
> index b6944f88033d..e1d7762b615c 100644
> --- a/include/linux/kvm_host.h
> +++ b/include/linux/kvm_host.h
> @@ -705,6 +705,9 @@ int kvm_protect_all_memory(struct kvm *kvm);
> int kvm_protect_memory(struct kvm *kvm,
> unsigned long gfn, unsigned long npages, bool protect);
>
> +void kvm_map_page(struct page *page, int nr_pages);
> +void kvm_unmap_page(struct page *page, int nr_pages);
> +
> int gfn_to_page_many_atomic(struct kvm_memory_slot *slot, gfn_t gfn,
> struct page **pages, int nr_pages);
>
> diff --git a/mm/huge_memory.c b/mm/huge_memory.c
> index c3562648a4ef..d8a444a401cc 100644
> --- a/mm/huge_memory.c
> +++ b/mm/huge_memory.c
> @@ -33,6 +33,7 @@
> #include
> #include
> #include
> +#include
This does not seem right...
> #include
> #include
> @@ -650,6 +651,10 @@ static vm_fault_t __do_huge_pmd_anonymous_page(struct
> vm_fault *vmf,
> spin_unlock(vmf->ptl);
> count_vm_event(THP_FAULT_ALLOC);
> count_memcg_events(memcg, THP_FAULT_ALLOC, 1);
> +
> + /* Unmap page from direct mapping */
> + if (vma_is_kvm_protected(vma))
> + kvm_unmap_page(page, HPAGE_PMD_NR);
... and neither does this.
I think the map/unmap primitives shoud be a part of the generic mm and
not burried inside KVM.
> }
>
> return 0;
> @@ -1886,6 +1891,10 @@ int zap_huge_pmd(struct mmu_gather *tlb, struct
> vm_area_struct *vma,
> page_remove_rmap(page, true);
> VM_BUG_ON_PAGE(page_mapcount(page) < 0, page);
> VM_BUG_ON_PAGE(!PageHead(page), page);
> +
> + /* Map the page back to the direct mapping */
> + if (vma_is_kvm_protected(vma))
> + kvm_map_page(page, HPAGE_PMD_NR);
> } else if (thp_migration_supported()) {
> swp_entry_t entry;
>
> diff --git a/mm/ksm.c b/mm/ksm.c
> index 281c00129a2e..942b88782ac2 100644
> --- a/mm/ksm.c
> +++ b/mm/ksm.c
> @@ -527,6 +527,9 @@ static struct vm_area_struct *find_mergeable_vma(struct
> mm_struct *mm,
> return NULL;
> if (!(vma->vm_flags & VM_MERGEABLE) || !vma->anon_vma)
> return NULL;
> + /* TODO */
Probably this is not something that should be done. For a security
sensitive environment that wants protected memory, KSM woudn't be
relevant anyway...
> + if (vma_is_kvm_protected(vma))
> + return NULL;
> return vma;
> }
>
> diff --git a/mm/memory.c b/mm/memory.c
> index d7228db6e4bf..74773229b854 100644
> --- a/mm/memory.c
> +++ b/mm/memory.c
> @@ -71,6 +71,7 @@
> #include
> #include
> #include
> +#include
The same comment as in mm/huge_memory.c. I don't think that generic mm
should depend on KVM.
> #include
>
> @@ -1088,6 +1089,11 @@ static unsigned long zap_pte_range(struct mmu_gather
> *tlb,
> likely(!(vma->vm_flags & VM_SEQ_READ)))
> mark_page_accessed(page);
> }
> +
> + /* Map the page back to the direct mapping */
> + if (vma_is_anonymous(vma) && vma_is_kvm_protected(vma))
> + kvm_map_page(page, 1);
> +
> rss[mm_counter(page)]--;
> page_remove_rmap(page, false);
> if (unlikely(page_mapcount(page) < 0))
> @@ -3312,6 +3318,7 @@ static vm_fault_t do_anonymous_page(struct vm_fault
> *vmf)
> struct page *page;
> vm_fault_t ret = 0;
> pte_t entry;
> + bool set = false;
>
> /* File mapping without ->vm_ops ? */
> if (vma->vm_flags & VM_SHARED)
> @@ -3397,6
