From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id F27CEC433F5 for ; Wed, 13 Oct 2021 14:34:44 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id A2D2C610FB for ; Wed, 13 Oct 2021 14:34:44 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org A2D2C610FB Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kvack.org Received: by kanga.kvack.org (Postfix) id EF3756B006C; Wed, 13 Oct 2021 10:34:43 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id EA2AF6B0071; Wed, 13 Oct 2021 10:34:43 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id D6A776B0072; Wed, 13 Oct 2021 10:34:43 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0098.hostedemail.com [216.40.44.98]) by kanga.kvack.org (Postfix) with ESMTP id C759F6B006C for ; Wed, 13 Oct 2021 10:34:43 -0400 (EDT) Received: from smtpin10.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id 6C570181C5C43 for ; Wed, 13 Oct 2021 14:34:43 +0000 (UTC) X-FDA: 78691660446.10.31D716D Received: from mail-pj1-f52.google.com (mail-pj1-f52.google.com [209.85.216.52]) by imf11.hostedemail.com (Postfix) with ESMTP id 2DF8FF0000AA for ; Wed, 13 Oct 2021 14:34:43 +0000 (UTC) Received: by mail-pj1-f52.google.com with SMTP id q10-20020a17090a1b0a00b001a076a59640so3793743pjq.0 for ; Wed, 13 Oct 2021 07:34:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=NtWwj0vH7UOJ5LLhXdT42vgomo2Iy/QVg4NPh0ov+mc=; b=i4jHCEDMgA0MeyPQyBueIE183Ak+qcCdarKYGWRPkUbsoFRpR/IIG8+yyWU35jZA8N qt9Gsc06jQoaDSjLFsLCun/odI+PcXwZjX3t/l0tvyRGsZy5eJkHGIaoOYzvlDuYFFlN MIdgOfHGuvy0SL810seRJWQ7DYQjta/zNTMMSmK6c8FQ7aCskR3S+wHNOnfHwVBmn4nC fcO+YFvOPF2nSgSjlcYflMzl45jRp0Mnd8pwsT1TKR4l5J/m6KwuTUFFu8v1BBHaqVgS gJwIcf16TQtrx/rQbdxOOhHx35TR6YwE9FsnuZ0PLGlfrmNm1jT4+585xBMNJDVcMI2F 1Q0Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=NtWwj0vH7UOJ5LLhXdT42vgomo2Iy/QVg4NPh0ov+mc=; b=apmQUhPq4hCSJ2u8hTIfkW0VweuQeI9bRu8Pg5I46M5xlxvda+F7MB2hv5wLj3T+XV Ctf1s5aTL24FHp23iIEsE8OuX4SXqMuv1kXMC+MxGRNqVppd/bpipVZkdkLfq3lyvfao V1x9lpFXZ4ygIhgPWMoahQiLVO/a/iX7GK3T1rSPDOqjav4Lw1GPsRRIeLE8gtLN+//E dgB/oA7mSeKP9dt2SNKKzv2L2i21AGmwJu8VhfPqeQSP8faybHi3HvRpCZWAUATKKFch aQtgLuSxP+ypsmDQxZEBxq8Rixc2VteLaTB5bt69wtaCvRUGBJqVupeEiaGPM7zm+sp/ hfFA== X-Gm-Message-State: AOAM530mEWp2VrrCaCn4U1knvSsjzn941NC0vZCEA/0UTDkFj1Pjoj4/ Olv6FyR671ow7nrjlEgOVgkNYQ== X-Google-Smtp-Source: ABdhPJzXquuTdstXVSZvIV0M6MqLZDQyiQjbvZJVMnoSimk+WNvLh/HqKlBXlRLoKggQChsXsNnzHg== X-Received: by 2002:a17:902:8d8c:b0:13d:be20:e279 with SMTP id v12-20020a1709028d8c00b0013dbe20e279mr36053185plo.5.1634135681790; Wed, 13 Oct 2021 07:34:41 -0700 (PDT) Received: from google.com (157.214.185.35.bc.googleusercontent.com. [35.185.214.157]) by smtp.gmail.com with ESMTPSA id d60sm6114241pjk.49.2021.10.13.07.34.40 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 13 Oct 2021 07:34:41 -0700 (PDT) Date: Wed, 13 Oct 2021 14:34:37 +0000 From: Sean Christopherson To: Brijesh Singh Cc: x86@kernel.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org, linux-coco@lists.linux.dev, linux-mm@kvack.org, linux-crypto@vger.kernel.org, Thomas Gleixner , Ingo Molnar , Joerg Roedel , Tom Lendacky , "H. Peter Anvin" , Ard Biesheuvel , Paolo Bonzini , Vitaly Kuznetsov , Wanpeng Li , Jim Mattson , Andy Lutomirski , Dave Hansen , Sergio Lopez , Peter Gonda , Peter Zijlstra , Srinivas Pandruvada , David Rientjes , Dov Murik , Tobin Feldman-Fitzthum , Borislav Petkov , Michael Roth , Vlastimil Babka , "Kirill A . Shutemov" , Andi Kleen , tony.luck@intel.com, marcorr@google.com, sathyanarayanan.kuppuswamy@linux.intel.com Subject: Re: [PATCH Part2 v5 26/45] KVM: SVM: Mark the private vma unmerable for SEV-SNP guests Message-ID: References: <20210820155918.7518-1-brijesh.singh@amd.com> <20210820155918.7518-27-brijesh.singh@amd.com> <2a8bf18e-1413-f884-15c4-0927f34ee3b9@amd.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <2a8bf18e-1413-f884-15c4-0927f34ee3b9@amd.com> X-Rspamd-Server: rspam01 X-Rspamd-Queue-Id: 2DF8FF0000AA X-Stat-Signature: xh89k1r6q5re5u7hxwjmmqcf6653zzen Authentication-Results: imf11.hostedemail.com; dkim=pass header.d=google.com header.s=20210112 header.b=i4jHCEDM; dmarc=pass (policy=reject) header.from=google.com; spf=pass (imf11.hostedemail.com: domain of seanjc@google.com designates 209.85.216.52 as permitted sender) smtp.mailfrom=seanjc@google.com X-HE-Tag: 1634135683-720601 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000210, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Wed, Oct 13, 2021, Brijesh Singh wrote: > > On 10/12/21 11:46 AM, Sean Christopherson wrote: > > On Fri, Aug 20, 2021, Brijesh Singh wrote: > >> When SEV-SNP is enabled, the guest private pages are added in the RMP > >> table; while adding the pages, the rmp_make_private() unmaps the pages > >> from the direct map. If KSM attempts to access those unmapped pages then > >> it will trigger #PF (page-not-present). > >> > >> Encrypted guest pages cannot be shared between the process, so an > >> userspace should not mark the region mergeable but to be safe, mark the > >> process vma unmerable before adding the pages in the RMP table. > > To be safe from what? Does the !PRESENT #PF crash the kernel? > > Yes, kernel crashes when KSM attempts to access to an unmaped pfn. Is this problem unique to nuking the direct map (patch 05), or would it also be a problem (in the form of an RMP violation) if the direct map were demoted to 4k pages? > [...] > >> + mmap_write_lock(kvm->mm); > >> + ret = snp_mark_unmergable(kvm, params.uaddr, params.len); > >> + mmap_write_unlock(kvm->mm); > > This does not, and practically speaking cannot, work. There are multiple TOCTOU > > bugs, here and in __snp_handle_page_state_change(). Userspace can madvise() the > > range at any later point, munmap()/mmap() the entire range, mess with the memslots > > in the PSC case, and so on and so forth. Relying on MADV_UNMERGEABLE for functional > > correctness simply cannot work in KVM, barring mmu_notifier and a big pile of code. > > AFAICT, ksm does not exclude the unmapped pfn from its scan list. We > need to tell ksm somehow to exclude the unmapped pfn from its scan list. > I understand that if userspace is messing with us, we have an issue, but > it's a userspace bug ;) To fix it right, we need to enhance ksm to > exclude the pfn when it is getting unmapped from the direct map. I > believe that work can be done outside of the SNP series. I am okay to > drop snp_mark_unmerable(), and until then, we just run with KSM > disabled. Thoughts? > > thanks