From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id C749CE68973 for ; Thu, 31 Oct 2024 10:42:26 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 4DCD56B0082; Thu, 31 Oct 2024 06:42:26 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 48BFC6B0083; Thu, 31 Oct 2024 06:42:26 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 353EF6B0088; Thu, 31 Oct 2024 06:42:26 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 1416C6B0082 for ; Thu, 31 Oct 2024 06:42:26 -0400 (EDT) Received: from smtpin16.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay01.hostedemail.com (Postfix) with ESMTP id BE22F1C720E for ; Thu, 31 Oct 2024 10:42:25 +0000 (UTC) X-FDA: 82733557704.16.A6CAD14 Received: from smtp-fw-52003.amazon.com (smtp-fw-52003.amazon.com [52.119.213.152]) by imf13.hostedemail.com (Postfix) with ESMTP id F3AF820021 for ; Thu, 31 Oct 2024 10:41:55 +0000 (UTC) Authentication-Results: imf13.hostedemail.com; dkim=pass header.d=amazon.co.uk header.s=amazon201209 header.b=oh0JRvKF; dmarc=pass (policy=quarantine) header.from=amazon.co.uk; spf=pass (imf13.hostedemail.com: domain of "prvs=0272810de=roypat@amazon.co.uk" designates 52.119.213.152 as permitted sender) smtp.mailfrom="prvs=0272810de=roypat@amazon.co.uk" ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1730371182; a=rsa-sha256; cv=none; b=V/8z1cxpgFiFNyVqeLi5xM3r0ubD3ty+ZfaD50OquSflm5AupCENVCN4SthbtObXJYz8rx +fWiCAd/G12I6Lzt2pZaLH5RLF2/Ykp/At3gw6kW2PS2JTsGQDuD15uOzG/ukSnadf24O/ sQumYZCepsggA183+qWqvVyMonAn/P0= ARC-Authentication-Results: i=1; imf13.hostedemail.com; dkim=pass header.d=amazon.co.uk header.s=amazon201209 header.b=oh0JRvKF; dmarc=pass (policy=quarantine) header.from=amazon.co.uk; spf=pass (imf13.hostedemail.com: domain of "prvs=0272810de=roypat@amazon.co.uk" designates 52.119.213.152 as permitted sender) smtp.mailfrom="prvs=0272810de=roypat@amazon.co.uk" ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1730371182; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=2XSQmg9XPL/tUl5Uy9X9cqzqndsoHfM/nyIda+DnmYs=; b=EyxyJ6FT/LvZz9vEHfl8p6oWz68q+CXDMziFJdekAomaSTjk87TjsumNRhAoPU4oaje1FF bvrJw+clu5wvIAdtKqqXkp/5Bx+IE+kmdXVitr4QkPz8PuQ76p7DeZVy7KnDum+SEJ0n9V g92HtytqHxHqawVQkXh1kALoEbEi/Vc= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.co.uk; i=@amazon.co.uk; q=dns/txt; s=amazon201209; t=1730371344; x=1761907344; h=message-id:date:mime-version:subject:to:cc:references: from:in-reply-to:content-transfer-encoding; bh=2XSQmg9XPL/tUl5Uy9X9cqzqndsoHfM/nyIda+DnmYs=; b=oh0JRvKFEKLA4dx1nPLVIOyBc82nF+K78/HXAlJQqBjqJB//zW02e8dJ GkEhH3b4mvZPttyXiSyAUUYWDfezK3l8ARfdHGTC0lGHsH5P/VE0wIGhC vpOP8UBWDokM6lDG+N4KJolcfpUC/JX9UZQBzzeWfvWzpVi9ienhIYxMn Y=; X-IronPort-AV: E=Sophos;i="6.11,247,1725321600"; d="scan'208";a="37873631" Received: from iad12-co-svc-p1-lb1-vlan3.amazon.com (HELO smtpout.prod.us-west-2.prod.farcaster.email.amazon.dev) ([10.43.8.6]) by smtp-border-fw-52003.iad7.amazon.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 31 Oct 2024 10:42:19 +0000 Received: from EX19MTAUWA001.ant.amazon.com [10.0.38.20:53488] by smtpin.naws.us-west-2.prod.farcaster.email.amazon.dev [10.0.22.121:2525] with esmtp (Farcaster) id f575b9e2-c87c-4dc7-9ccf-8641a67b176b; Thu, 31 Oct 2024 10:42:18 +0000 (UTC) X-Farcaster-Flow-ID: f575b9e2-c87c-4dc7-9ccf-8641a67b176b Received: from EX19D003UWB002.ant.amazon.com (10.13.138.11) by EX19MTAUWA001.ant.amazon.com (10.250.64.217) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.1258.34; Thu, 31 Oct 2024 10:42:09 +0000 Received: from EX19MTAUWA001.ant.amazon.com (10.250.64.204) by EX19D003UWB002.ant.amazon.com (10.13.138.11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.1258.35; Thu, 31 Oct 2024 10:42:09 +0000 Received: from email-imr-corp-prod-iad-all-1b-a03c1db8.us-east-1.amazon.com (10.25.36.214) by mail-relay.amazon.com (10.250.64.204) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.1258.34 via Frontend Transport; Thu, 31 Oct 2024 10:42:08 +0000 Received: from [127.0.0.1] (dev-dsk-roypat-1c-dbe2a224.eu-west-1.amazon.com [172.19.88.180]) by email-imr-corp-prod-iad-all-1b-a03c1db8.us-east-1.amazon.com (Postfix) with ESMTPS id 524C0804C3; Thu, 31 Oct 2024 10:42:02 +0000 (UTC) Message-ID: <27646c08-f724-49f7-9f45-d03bad500219@amazon.co.uk> Date: Thu, 31 Oct 2024 10:42:00 +0000 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [RFC PATCH v3 0/6] Direct Map Removal for guest_memfd To: David Hildenbrand , , , , , , , , CC: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , References: <20241030134912.515725-1-roypat@amazon.co.uk> <4aa0ccf4-ebbe-4244-bc85-8bc8dcd14e74@redhat.com> From: Patrick Roy Content-Language: en-US Autocrypt: addr=roypat@amazon.co.uk; keydata= xjMEY0UgYhYJKwYBBAHaRw8BAQdA7lj+ADr5b96qBcdINFVJSOg8RGtKthL5x77F2ABMh4PN NVBhdHJpY2sgUm95IChHaXRodWIga2V5IGFtYXpvbikgPHJveXBhdEBhbWF6b24uY28udWs+ wpMEExYKADsWIQQ5DAcjaM+IvmZPLohVg4tqeAbEAgUCY0UgYgIbAwULCQgHAgIiAgYVCgkI CwIEFgIDAQIeBwIXgAAKCRBVg4tqeAbEAmQKAQC1jMl/KT9pQHEdALF7SA1iJ9tpA5ppl1J9 AOIP7Nr9SwD/fvIWkq0QDnq69eK7HqW14CA7AToCF6NBqZ8r7ksi+QLOOARjRSBiEgorBgEE AZdVAQUBAQdAqoMhGmiXJ3DMGeXrlaDA+v/aF/ah7ARbFV4ukHyz+CkDAQgHwngEGBYKACAW IQQ5DAcjaM+IvmZPLohVg4tqeAbEAgUCY0UgYgIbDAAKCRBVg4tqeAbEAtjHAQDkh5jZRIsZ 7JMNkPMSCd5PuSy0/Gdx8LGgsxxPMZwePgEAn5Tnh4fVbf00esnoK588bYQgJBioXtuXhtom 8hlxFQM= In-Reply-To: <4aa0ccf4-ebbe-4244-bc85-8bc8dcd14e74@redhat.com> Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 7bit X-Stat-Signature: hbto8mafcet3wxyw4yei5k35367nxnrw X-Rspamd-Queue-Id: F3AF820021 X-Rspamd-Server: rspam08 X-Rspam-User: X-HE-Tag: 1730371315-803820 X-HE-Meta: U2FsdGVkX18Jj7R/G3IP8MgCWO5Iowog/VQfgI/2byFyNvSGO382B5PT6LBxJDnIcr06MGHL8F5H+luSDccwfFDqGdA4Qi3NntGMepzExNqm/Pm6f9suQAotYo5IsLgUilzU6P3ne/zUZYVQweEzkYoPiZyyPewv6ByDmucFHf4lvsaUJ65BzYdH7kitXj+fz5zYCr6yLy4ZG22FTKMHIoJicyvbdG7c6k9j73B/qx8lyJupmCGyqTKX70+wBjvnwf/xI50CBd7Y4Bp5SeAGKYA23fn7w6fo5V5SoPhtnNnskLt46FtNMBxRe+HupBAo6e9asLNoInD1zpsQscmrAYDBOcg94lA7mFVGfLfFsMF+A5eu7ZEFsJKD0y2VQyMiQb/haI21l3xRmgupQWrrh5aJm8QzI+xMx/d2iMFcq69XFuzCTG4YmLEQ711S9C2fFXr0rV0BZCRduKoA2x9fT8Ltmpg+O45yGMgljQJjPk9PPVKL/idNZnPS2NrJF8rTn4WiorUGqfenTehNAMPJ5CP6xCsq27XzzF5fiKv5By/4YxzU06TcpxWVeZnO6Fu+GX14vxlo1iLYHt/0cj3/sn3Cc6uqC9/V4YOPN9vkJo2HPtEpMcVKFvr/7yDvGlVrp+OC1YbU/sq+xjhDOIrsCt++LXHFjvQC3jiXY5fSD9AtyQzH4k8THhFp++XGE66Z3qeGqyZMWbtkcDOCkqGGFcSAjZg6kA17T/Mk7mXeImMcclsHSUeflFL985+m7AXOMs5V1T6sFQGlGRyhduv0mW88GaLx/yAtfSKpTXy8DqGHlzCwS9SYSix2N9MmPVHNfbfI7dNTSc0VGjZqGMPAndeopETxM5LmiQxpEkPK5fIUOX+oU0vmpLk8WPdTWOqjHbvlTmd1WHGmUQIfm/rlFoKpySGBxs9dcSm6rksiqfrQ1h2g2Xv5z1QHOwoxiOoQ9i2SMFp14/D7eKvDJd6 C2xFy24f s4bC4yeVBzZxgoS+mACQXeECDTgZWPHOefQeVFiBQntYcWZE9CTJ/02gEALmmWhOIJ1OMoyuYaJ9D2BNMdCmaiPBlgEGVMsPFotNwkqaLQKz1mqwwG5hEwvuwFMmLVua1usTFkm0tIqjmKjCedFg1TE8ra50UfSSrBMnnkyPs0SNf6bs9/VF2mmyuBVdl7o/7C8HnZbIjg0opQG2zqosEMZQcZNFndLO/x2m1lhCiHQuKIIR8yu43rmTOtQ69DaHaly/dxgPF69g+NzPtRMT41sWxc9NM/ybLLB2JbR4yY2XivTWKdKk2L0Udq9scsj/zWELGxUTKQhCL8mmnikYdLSu07M3XInUpAXCpsG5zj/h26cJf35y7wH4VPwh94WFGNMNhzWplHYwHj6lzb4TnwkEpeaoO52hPxmR/mEs+KHEfEOso6P+TX4k/A5uc9QNPkXRGySbDzuT+ztEn9ERjRk0jkS86Q7uEhv7iz8tBfuGOFOEjw3KO4kQZbaxmdzGaNSz1 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000322, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Thu, 2024-10-31 at 09:50 +0000, David Hildenbrand wrote: > On 30.10.24 14:49, Patrick Roy wrote: >> Unmapping virtual machine guest memory from the host kernel's direct map >> is a successful mitigation against Spectre-style transient execution >> issues: If the kernel page tables do not contain entries pointing to >> guest memory, then any attempted speculative read through the direct map >> will necessarily be blocked by the MMU before any observable >> microarchitectural side-effects happen. This means that Spectre-gadgets >> and similar cannot be used to target virtual machine memory. Roughly 60% >> of speculative execution issues fall into this category [1, Table 1]. >> >> This patch series extends guest_memfd with the ability to remove its >> memory from the host kernel's direct map, to be able to attain the above >> protection for KVM guests running inside guest_memfd. >> >> === Changes to v2 === >> >> - Handle direct map removal for physically contiguous pages in arch code >> (Mike R.) >> - Track the direct map state in guest_memfd itself instead of at the >> folio level, to prepare for huge pages support (Sean C.) >> - Allow configuring direct map state of not-yet faulted in memory >> (Vishal A.) >> - Pay attention to alignment in ftrace structs (Steven R.) >> >> Most significantly, I've reduced the patch series to focus only on >> direct map removal for guest_memfd for now, leaving the whole "how to do >> non-CoCo VMs in guest_memfd" for later. If this separation is >> acceptable, then I think I can drop the RFC tag in the next revision >> (I've mainly kept it here because I'm not entirely sure what to do with >> patches 3 and 4). > > Hi, > > keeping upcoming "shared and private memory in guest_memfd" in mind, I > assume the focus would be to only remove the direct map for private memory? > > So in the current upstream state, you would only be removing the direct > map for private memory, currently translating to "encrypted"/"protected" > memory that is inaccessible either way already. > > Correct? Yea, with the upcomming "shared and private" stuff, I would expect the the shared<->private conversions would call the routines from patch 3 to restore direct map entries on private->shared, and zap them on shared->private. But as you said, the current upstream state has no notion of "shared" memory in guest_memfd, so everything is private and thus everything is direct map removed (although it is indeed already inaccessible anyway for TDX and friends. That's what makes this patch series a bit awkward :( ) > -- > Cheers, > > David / dhildenb > Best, Patrick