From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 494ADECAAD3 for ; Wed, 14 Sep 2022 16:39:31 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 785868D0005; Wed, 14 Sep 2022 12:39:30 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 70EC48D0001; Wed, 14 Sep 2022 12:39:30 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 560BE8D0005; Wed, 14 Sep 2022 12:39:30 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0013.hostedemail.com [216.40.44.13]) by kanga.kvack.org (Postfix) with ESMTP id 3FE2B8D0001 for ; Wed, 14 Sep 2022 12:39:30 -0400 (EDT) Received: from smtpin15.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay08.hostedemail.com (Postfix) with ESMTP id 0AAEF1409FF for ; Wed, 14 Sep 2022 16:39:30 +0000 (UTC) X-FDA: 79911251700.15.81B5413 Received: from mail-yw1-f170.google.com (mail-yw1-f170.google.com [209.85.128.170]) by imf14.hostedemail.com (Postfix) with ESMTP id B2BCA1000A3 for ; Wed, 14 Sep 2022 16:39:29 +0000 (UTC) Received: by mail-yw1-f170.google.com with SMTP id 00721157ae682-333a4a5d495so187514237b3.10 for ; Wed, 14 Sep 2022 09:39:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date; bh=qw5c1rQO9auXlb1weto/2p+w4wwBPYYtzhiHNjVL//I=; b=OAZPO49RrJRJ1iDc42pcPY8eoQOr9U6LI/jzWl/t/qHJGAwMcmrdHEHcTpZAoEhple vmC5s4DomwuO1+aqLB8TMmpmXa4+GKx8HHg3AY/pPl/n26W8L7+GLOtWsIv2AVaWwP4Z ZQNaQeralnxC2np7lvsaONpxNi6tvum3IDZggIXPXTJp9vOigUhfQMvo1WFRSQ0ovgeY ysF+7Rn8+Te/7o66UPvqNQsZr8wJVkRGpZa/Wk186u5fYhn8lQ0jDLw/f7B7H6UMAQRs exEGbIfuANJwGK8IU+YFusPFqhFGXGudweKXCFkCPqfbQuIl49QspG/wobLqsnBjfOE1 UjPA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date; bh=qw5c1rQO9auXlb1weto/2p+w4wwBPYYtzhiHNjVL//I=; b=QKr3RJq57z9oCXGPpIabQTvTPo+6jCpN6jNtKL8fbwZcngOk4CNNqQJGjaHqOvzt/V oQtr44Ma+Dx0n42Kt5c4NQ75Fq1kOf2G610cTr1AOJ1G/U79x4kE3uYcgJy6zey+orzU Hm1lEtGMbjtbFY/42RZDfZYlRWtU7P04S5/yu6h+fL3Mfv3oBg41ihRM7SzD9k8DIi7d vljUD+/wIbPrGpJDZwwCj2WVceCUR+aqrbUDDoBTNKgOi1T51bH/QIhRTLCuW40TUieu JpFOfbApB0RumuXmPnVoX9xcD1r1EdUlpuIvqtZGNsbu9gT/DivXPa7eQsgi9ZsnnP2k 9i7w== X-Gm-Message-State: ACgBeo3280+Lelww6LFUcRiSQHvRg9q+hSX+8m9OS2v3z9ooahfEOzL6 RdsYjeBvbUGwNOY99x1OXqE3X2/Hh9iXJlmivUpNBw== X-Google-Smtp-Source: AA6agR4ZwapujsKhSGBJ8nLTDmAGCZkhuO0sc3uJlAZUs5ydbGgLq/Slr/TreGV6Rcw8FLrJapUcRgU+ddTrKrUYAUQ= X-Received: by 2002:a81:c30a:0:b0:328:4a6c:bc89 with SMTP id r10-20020a81c30a000000b003284a6cbc89mr31170890ywk.29.1663173568737; Wed, 14 Sep 2022 09:39:28 -0700 (PDT) MIME-Version: 1.0 References: <20210820155918.7518-1-brijesh.singh@amd.com> <20210820155918.7518-40-brijesh.singh@amd.com> <4e41dcff-7c7b-cf36-434a-c7732e7e8ff2@amd.com> <20220908212114.sqne7awimfwfztq7@amd.com> In-Reply-To: From: Marc Orr Date: Wed, 14 Sep 2022 17:39:18 +0100 Message-ID: Subject: Re: [PATCH Part2 v5 39/45] KVM: SVM: Introduce ops for the post gfn map and unmap To: Sean Christopherson Cc: Michael Roth , Brijesh Singh , x86 , LKML , kvm list , linux-coco@lists.linux.dev, Linux Memory Management List , Linux Crypto Mailing List , Thomas Gleixner , Ingo Molnar , Joerg Roedel , Tom Lendacky , "H. Peter Anvin" , Ard Biesheuvel , Paolo Bonzini , Vitaly Kuznetsov , Wanpeng Li , Jim Mattson , Andy Lutomirski , Dave Hansen , Sergio Lopez , Peter Gonda , Peter Zijlstra , Srinivas Pandruvada , David Rientjes , Dov Murik , Tobin Feldman-Fitzthum , Borislav Petkov , Vlastimil Babka , "Kirill A . Shutemov" , Andi Kleen , Tony Luck , Sathyanarayanan Kuppuswamy , jarkko@profian.com Content-Type: text/plain; charset="UTF-8" ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1663173569; a=rsa-sha256; cv=none; b=U4KVof9hU6TzRy0SRwHqk3VzOruwosNNDnzQD0AnNe9yAKSgi2ljDH0KD5HW6DdFO6YyVm IS36olQ42Mg9AY3onnOoQPIChVP/WnpwyMpezRKTSUXsqxbyLI9uVmiROLwiU4bimSV5fN Nm50oBXP872vLt2KFuZrVod9PDMjrxY= ARC-Authentication-Results: i=1; imf14.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=OAZPO49R; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf14.hostedemail.com: domain of marcorr@google.com designates 209.85.128.170 as permitted sender) smtp.mailfrom=marcorr@google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1663173569; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=qw5c1rQO9auXlb1weto/2p+w4wwBPYYtzhiHNjVL//I=; b=GG2cwjUzJP7QpMda+GEFen1AdBPn8LDjeg5RjySLDcHG85LnhPWlAbSozCOpqBcsllB1PZ jEx8nTj4pMUk7QdZ2Go+vHTqQA9I8gCHT1F5I9KkMjP1njvqzBBjpJfklMswhhkbBTsJCt YAcvYLLKQUr3NPtqKjlWTweqVOuT/KQ= Authentication-Results: imf14.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=OAZPO49R; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf14.hostedemail.com: domain of marcorr@google.com designates 209.85.128.170 as permitted sender) smtp.mailfrom=marcorr@google.com X-Rspam-User: X-Rspamd-Server: rspam01 X-Stat-Signature: ydcqf9odgeyyy4mckf4n6uab3b7r165k X-Rspamd-Queue-Id: B2BCA1000A3 X-HE-Tag: 1663173569-440935 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Wed, Sep 14, 2022 at 5:32 PM Marc Orr wrote: > > On Wed, Sep 14, 2022 at 5:15 PM Sean Christopherson wrote: > > > > On Wed, Sep 14, 2022, Marc Orr wrote: > > > On Wed, Sep 14, 2022 at 9:05 AM Sean Christopherson wrote: > > > > > > > > On Thu, Sep 08, 2022, Michael Roth wrote: > > > > > On Fri, Oct 15, 2021 at 05:16:28PM +0000, Sean Christopherson wrote: > > > > > So in the context of this interim solution, we're trying to look for a > > > > > solution that's simple enough that it can be used reliably, without > > > > > introducing too much additional complexity into KVM. There is one > > > > > approach that seems to fit that bill, that Brijesh attempted in an > > > > > earlier version of this series (I'm not sure what exactly was the > > > > > catalyst to changing the approach, as I wasn't really in the loop at > > > > > the time, but AIUI there weren't any showstoppers there, but please > > > > > correct me if I'm missing anything): > > > > > > > > > > - if the host is writing to a page that it thinks is supposed to be > > > > > shared, and the guest switches it to private, we get an RMP fault > > > > > (actually, we will get a !PRESENT fault, since as of v5 we now > > > > > remove the mapping from the directmap as part of conversion) > > > > > - in the host #PF handler, if we see that the page is marked private > > > > > in the RMP table, simply switch it back to shared > > > > > - if this was a bug on the part of the host, then the guest will see > > > > > > > > As discussed off-list, attempting to fix up RMP violations in the host #PF handler > > > > is not a viable approach. There was also extensive discussion on-list a while back: > > > > > > > > https://lore.kernel.org/all/8a244d34-2b10-4cf8-894a-1bf12b59cf92@www.fastmail.com > > > > > > I mentioned this during Mike's talk at the micro-conference: For pages > > > mapped in by the kernel can we disallow them to be converted to > > > private? > > > > In theory, yes. Do we want to do something like this? No. kmap() does something > > vaguely similar for 32-bit PAE/PSE kernels, but that's a lot of complexity and > > overhead to take on. And this issue goes far beyond a kmap(); when the kernel gup()s > > a page, the kernel expects the pfn to be available, no exceptions (pun intended). > > > > > Note, userspace accesses are already handled by UPM. > > > > I'm confused by the UPM comment. Isn't the gist of this thread about the ability > > to merge SNP _without_ UPM? Or am I out in left field? > > I think that was the overall gist: yes. But it's not what I was trying > to comment on :-). > > HOWEVER, thinking about this more: I was confused when I wrote out my > last reply. I had thought that the issue that Michael brought up > applied even with UPM. That is, I was thinking it was still possibly > for a guest to maliciously convert a page to private mapped in by the > kernel and assumed to be shared. > > But I now realize that is not what will actually happen. To be > concrete, let's assume the GHCB page. What will happen is: > - KVM has GHCB page mapped in. GHCB is always assumed to be shared. So > far so good. > - Malicious guest converts GHCB page to private (e.g., via Page State > Change request) > - Guest exits to KVM > - KVM exits to userspace VMM > - Userspace VM allocates page in private FD. > > Now, what happens here depends on how UPM works. If we allow double > allocation then our host kernel is safe. However, now we have the > "double allocation problem". > > If on the other hand, we deallocate the page in the shared FD, the > host kernel can segfault. And now we actually do have essentially the > same problem Michael was describing that we have without UPM. Because > we'll end up in fault.c in the kernel context and likely panic the > host. Thinking about this even more... Even if we deallocate in the userspace VMM's shared FD, the kernel has its own page tables -- right? So maybe we are actually 100% OK under UPM then regardless of the userspace VMM's policy around managing the private and shared FDs.