Ackerley Tng via B4 Relay <[email protected]> writes:
> From: Ackerley Tng <[email protected]> > > Add a new ioctl (and matching struct), KVM_SET_MEMORY_ATTRIBUTES2, using > the same base ioctl number (0xd2), but with R/W semantics for the kernel > instead of just read semantics. "Officially" documenting that KVM writes > to the payload will allow KVM to support partial/incremental conversions, > instead of all-or-nothing updates (which requires complex unwinding), by > recording the failing offset if an error occurs. > > Opportunistically add a new struct as well, even though KVM could squeeze > the error offset into "struct kvm_memory_attributes", as there's no cost to > doing so in practice. Pad the struct with a pile of extra space to try and > avoid ending up with "struct kvm_memory_attributes3" in the future. Use > the same layout for the fields that common to version 1 of the struct, > e.g. to ease upgrading userspace, and to provide flexibility if KVM ever > adds support for KVM_SET_MEMORY_ATTRIBUTES2 at VM scope. > > Introduce KVM_CAP_GUEST_MEMFD_MEMORY_ATTRIBUTES to advertise the > availability of the KVM_SET_MEMORY_ATTRIBUTES2 ioctl. > > Update the KVM API documentation to define the new ioctl and its behavior, > and add the necessary UAPI definitions and capability checks. > > The process of setting memory attributes has a clear point of no return > because, for CoCo VMs, zapping stage 2 page tables is a destructive > operation. Unlike regular VMs, where re-faulting pages into the stage 2 > page tables merely incurs a performance penalty, CoCo guests must > (re-):accept pages after every fault. To preserve CoCo security guarantees, > guests will not accept pages they did not explicitly request faults > for. Consequently, during memory conversions, any operation that could > cause the process to abort must be completed before the stage 2 page tables > are zapped. > > Zap only the ranges that are not already in the requested state to avoid > inadvertently destroying (CoCo) data. ARM CCA guests will try to mark the > entire DRAM as private at boot. If there are no shared pages at all, the > to-private conversion can be skipped, but the existence of a single shared > page would require the conversion process to proceed, and if it proceeds, > zapping both shared and private pages would destroy data and break the > guest. > > Co-developed-by: Vishal Annapurve <[email protected]> > Signed-off-by: Vishal Annapurve <[email protected]> > Co-developed-by: Sean Christopherson <[email protected]> > Signed-off-by: Sean Christopherson <[email protected]> > Reviewed-by: Fuad Tabba <[email protected]> > Reviewed-by: Binbin Wu <[email protected]> > Suggested-by: Michael Roth <[email protected]> > Tested-by: Shivank Garg <[email protected]> > Signed-off-by: Ackerley Tng <[email protected]> > > tmpo tmpo is a stray addition from my rebasing/squashing. > --- > Documentation/virt/kvm/api.rst | 63 +++++++++++++++++++++- > include/uapi/linux/kvm.h | 15 ++++++ > virt/kvm/guest_memfd.c | 119 > +++++++++++++++++++++++++++++++++++++++++ > virt/kvm/kvm_main.c | 23 +++++--- > 4 files changed, 212 insertions(+), 8 deletions(-) > > diff --git a/Documentation/virt/kvm/api.rst b/Documentation/virt/kvm/api.rst > > [...snip...] >
