KVM: s390: pv: properly handle page flags for protected guests

Introduce variants of the convert and destroy page functions that also
clear the PG_arch_1 bit used to mark them as secure pages.

The PG_arch_1 flag is always allowed to overindicate; using the new
functions introduced here allows to reduce the extent of overindication
and thus improve performance.

These new functions can only be called on pages for which a reference
is already being held.

Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@de.ibm.com>
Link: https://lore.kernel.org/r/20210920132502.36111-7-imbrenda@linux.ibm.com
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>

diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
index b61426c..e434169 100644 (file)
--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -1074,8 +1074,9 @@ static inline pte_t ptep_get_and_clear(struct mm_struct *mm,
        pte_t res;
 
        res = ptep_xchg_lazy(mm, addr, ptep, __pte(_PAGE_INVALID));
+       /* At this point the reference through the mapping is still present */
        if (mm_is_protected(mm) && pte_present(res))
-               uv_convert_from_secure(pte_val(res) & PAGE_MASK);
+               uv_convert_owned_from_secure(pte_val(res) & PAGE_MASK);
        return res;
 }
 
@@ -1091,8 +1092,9 @@ static inline pte_t ptep_clear_flush(struct vm_area_struct *vma,
        pte_t res;
 
        res = ptep_xchg_direct(vma->vm_mm, addr, ptep, __pte(_PAGE_INVALID));
+       /* At this point the reference through the mapping is still present */
        if (mm_is_protected(vma->vm_mm) && pte_present(res))
-               uv_convert_from_secure(pte_val(res) & PAGE_MASK);
+               uv_convert_owned_from_secure(pte_val(res) & PAGE_MASK);
        return res;
 }
 
@@ -1116,8 +1118,9 @@ static inline pte_t ptep_get_and_clear_full(struct mm_struct *mm,
        } else {
                res = ptep_xchg_lazy(mm, addr, ptep, __pte(_PAGE_INVALID));
        }
+       /* At this point the reference through the mapping is still present */
        if (mm_is_protected(mm) && pte_present(res))
-               uv_convert_from_secure(pte_val(res) & PAGE_MASK);
+               uv_convert_owned_from_secure(pte_val(res) & PAGE_MASK);
        return res;
 }
 

diff --git a/arch/s390/include/asm/uv.h b/arch/s390/include/asm/uv.h
index 9ab1914..72d3e49 100644 (file)
--- a/arch/s390/include/asm/uv.h
+++ b/arch/s390/include/asm/uv.h
@@ -356,8 +356,9 @@ static inline int is_prot_virt_host(void)
 }
 
 int gmap_make_secure(struct gmap *gmap, unsigned long gaddr, void *uvcb);
-int uv_destroy_page(unsigned long paddr);
+int uv_destroy_owned_page(unsigned long paddr);
 int uv_convert_from_secure(unsigned long paddr);
+int uv_convert_owned_from_secure(unsigned long paddr);
 int gmap_convert_to_secure(struct gmap *gmap, unsigned long gaddr);
 
 void setup_uv(void);
@@ -365,7 +366,7 @@ void setup_uv(void);
 #define is_prot_virt_host() 0
 static inline void setup_uv(void) {}
 
-static inline int uv_destroy_page(unsigned long paddr)
+static inline int uv_destroy_owned_page(unsigned long paddr)
 {
        return 0;
 }
@@ -374,6 +375,11 @@ static inline int uv_convert_from_secure(unsigned long paddr)
 {
        return 0;
 }
+
+static inline int uv_convert_owned_from_secure(unsigned long paddr)
+{
+       return 0;
+}
 #endif
 
 #endif /* _ASM_S390_UV_H */

diff --git a/arch/s390/kernel/uv.c b/arch/s390/kernel/uv.c
index 09b80d3..8b0e625 100644 (file)
--- a/arch/s390/kernel/uv.c
+++ b/arch/s390/kernel/uv.c
@@ -100,7 +100,7 @@ static int uv_pin_shared(unsigned long paddr)
  *
  * @paddr: Absolute host address of page to be destroyed
  */
-int uv_destroy_page(unsigned long paddr)
+static int uv_destroy_page(unsigned long paddr)
 {
        struct uv_cb_cfs uvcb = {
                .header.cmd = UVC_CMD_DESTR_SEC_STOR,
@@ -121,6 +121,22 @@ int uv_destroy_page(unsigned long paddr)
 }
 
 /*
+ * The caller must already hold a reference to the page
+ */
+int uv_destroy_owned_page(unsigned long paddr)
+{
+       struct page *page = phys_to_page(paddr);
+       int rc;
+
+       get_page(page);
+       rc = uv_destroy_page(paddr);
+       if (!rc)
+               clear_bit(PG_arch_1, &page->flags);
+       put_page(page);
+       return rc;
+}
+
+/*
  * Requests the Ultravisor to encrypt a guest page and make it
  * accessible to the host for paging (export).
  *
@@ -140,6 +156,22 @@ int uv_convert_from_secure(unsigned long paddr)
 }
 
 /*
+ * The caller must already hold a reference to the page
+ */
+int uv_convert_owned_from_secure(unsigned long paddr)
+{
+       struct page *page = phys_to_page(paddr);
+       int rc;
+
+       get_page(page);
+       rc = uv_convert_from_secure(paddr);
+       if (!rc)
+               clear_bit(PG_arch_1, &page->flags);
+       put_page(page);
+       return rc;
+}
+
+/*
  * Calculate the expected ref_count for a page that would otherwise have no
  * further pins. This was cribbed from similar functions in other places in
  * the kernel, but with some slight modifications. We know that a secure

diff --git a/arch/s390/mm/gmap.c b/arch/s390/mm/gmap.c
index d63c0cc..dfee0eb 100644 (file)
--- a/arch/s390/mm/gmap.c
+++ b/arch/s390/mm/gmap.c
@@ -2684,8 +2684,10 @@ static int __s390_reset_acc(pte_t *ptep, unsigned long addr,
 {
        pte_t pte = READ_ONCE(*ptep);
 
+       /* There is a reference through the mapping */
        if (pte_present(pte))
-               WARN_ON_ONCE(uv_destroy_page(pte_val(pte) & PAGE_MASK));
+               WARN_ON_ONCE(uv_destroy_owned_page(pte_val(pte) & PAGE_MASK));
+
        return 0;
 }