From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 26418C61DA4 for ; Wed, 22 Feb 2023 21:53:22 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 7D3B86B0071; Wed, 22 Feb 2023 16:53:22 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 75BF46B0072; Wed, 22 Feb 2023 16:53:22 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 5D5C56B0073; Wed, 22 Feb 2023 16:53:22 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0012.hostedemail.com [216.40.44.12]) by kanga.kvack.org (Postfix) with ESMTP id 495806B0071 for ; Wed, 22 Feb 2023 16:53:22 -0500 (EST) Received: from smtpin06.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay03.hostedemail.com (Postfix) with ESMTP id 15152A0537 for ; Wed, 22 Feb 2023 21:53:22 +0000 (UTC) X-FDA: 80496279444.06.9F46E32 Received: from mail-yw1-f202.google.com (mail-yw1-f202.google.com [209.85.128.202]) by imf14.hostedemail.com (Postfix) with ESMTP id 52B84100011 for ; Wed, 22 Feb 2023 21:53:20 +0000 (UTC) Authentication-Results: imf14.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=lxoHUtiZ; spf=pass (imf14.hostedemail.com: domain of 3z472YwYKCOwgSObXQUccUZS.QcaZWbil-aaYjOQY.cfU@flex--seanjc.bounces.google.com designates 209.85.128.202 as permitted sender) smtp.mailfrom=3z472YwYKCOwgSObXQUccUZS.QcaZWbil-aaYjOQY.cfU@flex--seanjc.bounces.google.com; dmarc=pass (policy=reject) header.from=google.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1677102800; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=vw/kaBZELDn3iRLryB4mmdN5p7w2c/XEDF0NvAc29OA=; b=JUhIoPgS3Z80PAk1tUNFcinxigHhDQD3giG/nmnlGsIy4K6mZ85CaYiy7FXjcsjABRZ1IU YPFO7MQ+hkfrzgvGr/R97QvuOJl3Jy2yZUjBoaKbY1SLRECNp4Z2w8yEHfPwQTu352XtzJ 40sOJt3Fd7F6bTBLzKJlJ9L3DDPHvpE= ARC-Authentication-Results: i=1; imf14.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=lxoHUtiZ; spf=pass (imf14.hostedemail.com: domain of 3z472YwYKCOwgSObXQUccUZS.QcaZWbil-aaYjOQY.cfU@flex--seanjc.bounces.google.com designates 209.85.128.202 as permitted sender) smtp.mailfrom=3z472YwYKCOwgSObXQUccUZS.QcaZWbil-aaYjOQY.cfU@flex--seanjc.bounces.google.com; dmarc=pass (policy=reject) header.from=google.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1677102800; a=rsa-sha256; cv=none; b=GD6uNfey2I/8J+WYbc925Ulc6qKZvfqcQ01wURFdPzYzxg2zo4gR1hevYxOVE/hk1t4cLX lDshqllEYOmQhJkCSIwfHkbTdssMPSdd0pX4/w08hcvFydczh1p6xomZLwK0uFIS/benTU ICFpP55fajKC4wdXl5OzxU9QF3mb6NE= Received: by mail-yw1-f202.google.com with SMTP id 00721157ae682-536cad819c7so82407667b3.6 for ; Wed, 22 Feb 2023 13:53:20 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=vw/kaBZELDn3iRLryB4mmdN5p7w2c/XEDF0NvAc29OA=; b=lxoHUtiZD2a0lkFM1BjQCq6yxSLFOIYuWQzolUrNyKa2FSIrxH8LVVfQtq9f5R/afK LHQpddlnFrOzOB60DXpCwlJJw63AzRfX5jLu5Id0pSE95MxYIsHOiRMLmY5+eU+D3dNu ISieEqZtTt7V23yoxD/xPf7/3fga5CcMm+ewnI7GoqsPeiEDxyu5fgTeEv68la2saMCH djvTvh7dGkVnNbuuTGqlzh9NJbQdVF3quszT4E0e+TCktqOo19NSlqE9gEsehIyDyrqF 4K9oJAEiTWIdzJKlakhzoBeyFOaEj14vWK7iNd4k7zj5V9qLb9MFJbOpw5pQ3v+f49KY Vb8w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=vw/kaBZELDn3iRLryB4mmdN5p7w2c/XEDF0NvAc29OA=; b=zkYDXJFLPl1rj0bqLtRaB6y1MqhOH9XEoZhYEAlFIcTlpdUBgnZ5K5owEXepzJEAvc N/95xa0R83KOloYjwJzsDV6kpoYXVVZP3kfbWKMq7P4vZmt/zs4LpHqgLhwyqRznTf2H TeDMJkmALURTjTYScxuAKaZlr0AXSjixGvZnVonuOuu/49L/8stLfvmTEYtkxmQ67zHC triNyzK0CGsUzfOd6hrJCKkaEqK+cUl/Mr33UragQRcLCvwsG6tBxGp5kZVKh3fD8P2W /klqUIg/tsZh1E20tUU7K0Lx1bg0HzzxjfgORomsYRn/ONGijrfG0M+QWv0BEOYXJuRK Bf0g== X-Gm-Message-State: AO0yUKUEh0uxZESVZ4FZPauUHPZ3PnufA0Rf3kO5E0DgvNRh1GTJtWar +VVay82xZ8+OyX/4rzRPH4AhOiMKG40= X-Google-Smtp-Source: AK7set94YqDAGISpJ88nU9GpVOq8HahVScAJcl3isAOv812VxstdjXukBVCA+QkJjTDNRjuqp0jo+ZxoQ0w= X-Received: from zagreus.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:5c37]) (user=seanjc job=sendgmr) by 2002:a05:6902:1183:b0:a27:3ecc:ffe7 with SMTP id m3-20020a056902118300b00a273eccffe7mr460686ybu.3.1677102799291; Wed, 22 Feb 2023 13:53:19 -0800 (PST) Date: Wed, 22 Feb 2023 13:53:17 -0800 In-Reply-To: <62c84fa8-d7c4-5163-fe1e-f2c7e5a2c7aa@redhat.com> Mime-Version: 1.0 References: <20221202061347.1070246-1-chao.p.peng@linux.intel.com> <62c84fa8-d7c4-5163-fe1e-f2c7e5a2c7aa@redhat.com> Message-ID: Subject: Re: [PATCH v10 0/9] KVM: mm: fd-based approach for supporting KVM From: Sean Christopherson To: David Hildenbrand Cc: Mike Rapoport , Chao Peng , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, linux-fsdevel@vger.kernel.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, linux-doc@vger.kernel.org, qemu-devel@nongnu.org, Paolo Bonzini , Jonathan Corbet , Vitaly Kuznetsov , Wanpeng Li , Jim Mattson , Joerg Roedel , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Arnd Bergmann , Naoya Horiguchi , Miaohe Lin , x86@kernel.org, "H . Peter Anvin" , Hugh Dickins , Jeff Layton , "J . Bruce Fields" , Andrew Morton , Shuah Khan , Steven Price , "Maciej S . Szmigiero" , Vlastimil Babka , Vishal Annapurve , Yu Zhang , "Kirill A . Shutemov" , luto@kernel.org, jun.nakajima@intel.com, dave.hansen@intel.com, ak@linux.intel.com, aarcange@redhat.com, ddutile@redhat.com, dhildenb@redhat.com, Quentin Perret , tabba@google.com, Michael Roth , mhocko@suse.com, wei.w.wang@intel.com Content-Type: text/plain; charset="us-ascii" X-Rspam-User: X-Rspamd-Server: rspam04 X-Rspamd-Queue-Id: 52B84100011 X-Stat-Signature: kyb694ibntc8i7u5baioumaay3wqacnt X-HE-Tag: 1677102800-934456 X-HE-Meta: U2FsdGVkX1/QOYLmWq1SF5etEoIfMtf4LkTcCxQPkHnZtcNVrbseaZyqmG/ulka2as/GmUuaTkqjDgm3BNk/ida15nqYHde0g1K44GAWt9o9qECWR0V6YrKNXhEAuyDlEz1SJp3izllmvpjDpxbLtkt6NZY1nELFvvQKUESlCgLLVuCfYBaOI0o4bljo+i0/+38E2Iz7Y6tVsFcoqTrHpNtg7hrnFD6cmMRN0oeOnzUuToXaKFsYJ2SCvtLvwI1KRNt7G4KtBFV18VgkoRLAC8QXWW1PunN7Hik2dP2eXdqloenNPQOn3mjoZA2s7JpmLFbVutdey/90Hssg9G2O7ISccZc5UxU7BrBfXKsn6szwvmEXfXjud7EhP+F9aaxSjCCv7PtpG9n2JcRSs2PjeR9fiZwbO5iYWm3qmd259+c++k8AkNJ8zyuHXDo9aEnzEN8DT9lqggvu849DgpnNlQJ4veoXEvbgljed4wu7S1w1/PPVV82OVwhpAJltkcp71f7ad4S67I8OYAIRvYOi1j0PpPq6KhKU+6+hjCv9KANoxzuuSqKWUr9rtLk/CreWgSHLHBKxXbLjKJ7/l0+1E/jp+G1xYuzD68GxkW0iHE6UjR0mg2SSEHRFVEqT+CnXHGRiq84VVmddsxAm2aVZ0HKCqQm21o/KjjX8RPaiC74jE3IYKFb45AuH+3lm1BQePOfgABvI362tTUTImFtMwBFAcmxd7vHp6Z3uqDbem6fnRMzAUBSEILMMHL+u6YUuknamq0OVO4+xLQKSFVbAIw5VKcB/PKm937QYYGT/+gIWvujlz2/vKQ+eP+See9lVYROxPtidDWQlgiFwrXYgy/Q0tVxKdqGzm7dqDpAzm1Q9ZdEjZ/7J6MHvhftxeV2y5qtAjGfES6wjXmxQT+XIhWWsBukeeQatocQgmJ/CLgSTJFwqSAz5L54YaOhsuyoB4I3ndFUJkWW6+rDLFqd UvgzWvOr S6L+5+l3Y0M56PFElUBSr70x7blgzjIus21wL9VnFK9/ZJBSqmRoHaMn0bSzkcvxBSjLzWC6Bj+Q+1OxrcY9HxBpr2xKYFx8X7nrtMHcqP1UCmKWRKdjCUTMlXaSgoLDiMKcWiFKREo72mWt9hk2ujfSztLOqFq4Cfart4kSKqZv2dnHAAPQQit7KZcR5l9znrDnleTdV1keC8baoPLPK0bJ4PF+CqNOanJnPZRYyx6hbayaMv0OSe+v8dcDyRb++zz2x0sKlQ2eXFGeJi/yZxQjWnD08jiEnBOReWB+4HXU39P2YAvrVXDj1wkOUyp+NxzYryGjx1vE8xoBFb0vifER9fGdfeGZGuONvpMYXG/AxyW7K/uMhY+6KFQfau6bYjfUrUVOuujejAMD8aUmr2JAB9PwDSmecp5SvsuNLFe9Cs4+aQNuDWKZI2ZzSVWL1sqfGJ3/SMqfxzctFPn2tUvHi41Dyr9hOd4hRq8bqFV20eN+wXJWplj5n7hmFZ73IS86OQdbJaJYBvSYiDN7FSWZ+gIT7Y72OVwZaJCgpzwUAo8Rk//RIU6K7XvDwq2Z+XZONl7IGV+Q+53a51q7JkuVAgVQB8PYBN70b X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Thu, Feb 16, 2023, David Hildenbrand wrote: > On 16.02.23 06:13, Mike Rapoport wrote: > > Hi, > > > > On Fri, Dec 02, 2022 at 02:13:38PM +0800, Chao Peng wrote: > > > This patch series implements KVM guest private memory for confidential > > > computing scenarios like Intel TDX[1]. If a TDX host accesses > > > TDX-protected guest memory, machine check can happen which can further > > > crash the running host system, this is terrible for multi-tenant > > > configurations. The host accesses include those from KVM userspace like > > > QEMU. This series addresses KVM userspace induced crash by introducing > > > new mm and KVM interfaces so KVM userspace can still manage guest memory > > > via a fd-based approach, but it can never access the guest memory > > > content. > > > > Sorry for jumping late. > > > > Unless I'm missing something, hibernation will also cause an machine check > > when there is TDX-protected memory in the system. When the hibernation > > creates memory snapshot it essentially walks all physical pages and saves > > their contents, so for TDX memory this will trigger machine check, right? For hibernation specifically, I think that should be handled elsewhere as hibernation is simply incompatible with TDX, SNP, pKVM, etc. without paravirtualizing the guest, as none of those technologies support auto-export a la s390. I suspect the right approach is to disallow hibernation if KVM is running any protected guests. > I recall bringing that up in the past (also memory access due to kdump, > /prov/kcore) and was told that the main focus for now is preventing > unprivileged users from crashing the system, that is, not mapping such > memory into user space (e.g., QEMU). In the long run, we'll want to handle > such pages also properly in the other events where the kernel might access > them. Ya, unless someone strongly objects, the plan is to essentially treat "attacks" from privileged users as out of to scope for initial support, and then iterate as needed to fix/enable more features. FWIW, read accesses, e.g. kdump, should be ok for TDX and SNP as they both play nice with "bad" reads. pKVM is a different beast though as I believe any access to guest private memory will fault. But my understanding is that this series would be a big step forward for pKVM, which currently doesn't have any safeguards.