[PATCH v3 09/14] KVM: s390: pv: add export before import
From: Claudio Imbrenda <imbrenda@linux.ibm.com>
Date: 2021-08-04 15:41:23
Also in:
linux-s390, lkml
Subsystem:
kernel virtual machine for s390 (kvm/s390), s390 architecture, the rest · Maintainers:
Christian Borntraeger, Janosch Frank, Claudio Imbrenda, Heiko Carstens, Vasily Gorbik, Alexander Gordeev, Linus Torvalds
Due to upcoming changes, it will be possible to temporarily have multiple protected VMs in the same address space, although only one will be actually active. In that scenario, it is necessary to perform an export of every page that is to be imported, since the hardware does not allow a page belonging to a protected guest to be imported into a different protected guest. This also applies to pages that are shared, and thus accessible by the host. Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Reviewed-by: Janosch Frank <frankja@linux.ibm.com> --- arch/s390/kernel/uv.c | 8 ++++++++ 1 file changed, 8 insertions(+)
diff --git a/arch/s390/kernel/uv.c b/arch/s390/kernel/uv.c
index 89ba36a5b4bb..bc79085d7152 100644
--- a/arch/s390/kernel/uv.c
+++ b/arch/s390/kernel/uv.c@@ -249,6 +249,12 @@ static int make_secure_pte(pte_t *ptep, unsigned long addr, return uvcb->rc == 0x10a ? -ENXIO : -EINVAL; } +static bool should_export_before_import(struct uv_cb_header *uvcb, struct mm_struct *mm) +{ + return uvcb->cmd != UVC_CMD_UNPIN_PAGE_SHARED && + atomic_read(&mm->context.is_protected) > 1; +} + /* * Requests the Ultravisor to make a page accessible to a guest. * If it's brought in the first time, it will be cleared. If
@@ -292,6 +298,8 @@ int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb) lock_page(page); ptep = get_locked_pte(gmap->mm, uaddr, &ptelock); + if (should_export_before_import(uvcb, gmap->mm)) + uv_convert_from_secure(page_to_phys(page)); rc = make_secure_pte(ptep, uaddr, page, uvcb); pte_unmap_unlock(ptep, ptelock); unlock_page(page);
--
2.31.1