From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id C81F3C5475B for ; Fri, 1 Mar 2024 09:26:23 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 5B4CC6B00A4; Fri, 1 Mar 2024 04:26:23 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 565396B00A6; Fri, 1 Mar 2024 04:26:23 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 42D276B00A7; Fri, 1 Mar 2024 04:26:23 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id 32EFC6B00A4 for ; Fri, 1 Mar 2024 04:26:23 -0500 (EST) Received: from smtpin14.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay04.hostedemail.com (Postfix) with ESMTP id 0D2D31A0270 for ; Fri, 1 Mar 2024 09:26:23 +0000 (UTC) X-FDA: 81847939446.14.DF92667 Received: from mail-oa1-f53.google.com (mail-oa1-f53.google.com [209.85.160.53]) by imf23.hostedemail.com (Postfix) with ESMTP id 4367714000B for ; Fri, 1 Mar 2024 09:26:21 +0000 (UTC) Authentication-Results: imf23.hostedemail.com; dkim=none; spf=pass (imf23.hostedemail.com: domain of wei.liu.linux@gmail.com designates 209.85.160.53 as permitted sender) smtp.mailfrom=wei.liu.linux@gmail.com; dmarc=fail reason="SPF not aligned (relaxed), No valid DKIM" header.from=kernel.org (policy=none) ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1709285181; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=HdJCGnsr1PgomKAYNsHyEsd3dtv9l/bjbY6EGM5JJ3k=; b=psKi/E1VwMvciYt1FmPESgmJQON1XmHsMwmTA8PSVaY2AalMy2Punl64XnDMUYuGtTz7wK jcbJ7mVw0z/XN/4jVOQPEwArvB+UGNtWo+A3moU7jmOQg3PTQXpVJIOShS6ksz71iac34A PgLcSw5KQhj0yVX3E78fC/7bdQ6Bm/0= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1709285181; a=rsa-sha256; cv=none; b=Ph5cT7dhsMb7woVv5pKn92+qNYFYoNCB0DRkaEEurh1atjpw3DpT1jN7EyivuaRgz1m5lf Qb7pyD7RYAixqf5WrjZI02r+/5b3vrENU6Wt9CnWj8jYnyXkz2zJnAblLMFMW20ZJ/FnaY aQHN881LLSweYTJ7+oHRK84YF5UM7ck= ARC-Authentication-Results: i=1; imf23.hostedemail.com; dkim=none; spf=pass (imf23.hostedemail.com: domain of wei.liu.linux@gmail.com designates 209.85.160.53 as permitted sender) smtp.mailfrom=wei.liu.linux@gmail.com; dmarc=fail reason="SPF not aligned (relaxed), No valid DKIM" header.from=kernel.org (policy=none) Received: by mail-oa1-f53.google.com with SMTP id 586e51a60fabf-21fed501addso904179fac.2 for ; Fri, 01 Mar 2024 01:26:21 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1709285180; x=1709889980; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=HdJCGnsr1PgomKAYNsHyEsd3dtv9l/bjbY6EGM5JJ3k=; b=RW1RGxF8fJj7I0cCagRKAtn7IT4pYwq/US+PBruIVLqPQlDWHogdA183cQYWiKVrq5 4XGkLlxeLYVfe0wVGZi+FKKuW0HK9VP4+ttC0i+WTZdaRDfnQpKP5JM8pi6cEdSj9VE3 WyEfQswjYD4/WY50aU/TAlBTgzMdxaEEXUxB5uga8uEjJsmuocVVgtjbU9KLgjULrQTS xKnmGg/rx6DyzyoiSjiHn4C7XsGAJRg4UxIp0+dYyeLQTZdvothbEbONtCoKsx+jeD/n KcLpdka9GclD/fAiKZwroNWx2aFotTnr5pY0QxhbV0CBRae204T0hT1NE7Il9/9EXB9x Cknw== X-Forwarded-Encrypted: i=1; AJvYcCWXCm3r8QsmGh9wzOwzeEw/WqijbPJfm9MNSxwaCwvpQ3nF1Ba/IYdkeBxPgesfk9UZoAFmoetqHscXA/mQ99NVCP0= X-Gm-Message-State: AOJu0YxmyytwBXoP/GI4kxr+5vu+e7TFgW2EmaZKCfYF5MLqMz8CgMEk wOjdu1wNLDd4Sz6dHHObh3eGXctw0Xxj+Sq/RCCYHcPhRAMhIbMC X-Google-Smtp-Source: AGHT+IGQI9dLrMg4IIQbS5TRKDxZlX5ExuzhnqXLR2XHjV3/BPtjzMkzXsLqatBT2Fy0YdDZABUovw== X-Received: by 2002:a05:6870:bb06:b0:220:9f9c:2bd8 with SMTP id nw6-20020a056870bb0600b002209f9c2bd8mr1050514oab.4.1709285180319; Fri, 01 Mar 2024 01:26:20 -0800 (PST) Received: from liuwe-devbox-debian-v2 ([20.69.120.36]) by smtp.gmail.com with ESMTPSA id it2-20020a056a00458200b006e508b6a13dsm2525245pfb.58.2024.03.01.01.26.19 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 01 Mar 2024 01:26:19 -0800 (PST) Date: Fri, 1 Mar 2024 09:26:18 +0000 From: Wei Liu To: mhklinux@outlook.com Cc: tglx@linutronix.de, mingo@redhat.com, bp@alien8.de, dave.hansen@linux.intel.com, x86@kernel.org, hpa@zytor.com, kirill.shutemov@linux.intel.com, haiyangz@microsoft.com, wei.liu@kernel.org, decui@microsoft.com, luto@kernel.org, peterz@infradead.org, akpm@linux-foundation.org, urezki@gmail.com, hch@infradead.org, lstoakes@gmail.com, thomas.lendacky@amd.com, ardb@kernel.org, jroedel@suse.de, seanjc@google.com, rick.p.edgecombe@intel.com, sathyanarayanan.kuppuswamy@linux.intel.com, linux-kernel@vger.kernel.org, linux-coco@lists.linux.dev, linux-hyperv@vger.kernel.org, linux-mm@kvack.org Subject: Re: [PATCH v4 0/3] x86/hyperv: Mark CoCo VM pages not present when changing encrypted state Message-ID: References: <20240116022008.1023398-1-mhklinux@outlook.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20240116022008.1023398-1-mhklinux@outlook.com> X-Rspamd-Queue-Id: 4367714000B X-Rspam-User: X-Rspamd-Server: rspam11 X-Stat-Signature: 9wxnkjsjep6mubxkjy95q7yp7fcsapfk X-HE-Tag: 1709285181-940644 X-HE-Meta: U2FsdGVkX19UcaUajXj29IJqECXjef2enwRGl1vxlSDPSSlkpdCu5vzuABtGJCjgrMKW/VX4OBm1EtpMKfgV5Xb5DwpAUAH54Vq5ntIQniRupQZ1I7EG4FuocTY5aFi10zifg9fLbQGaAKRnbyE4KOnFk9VdCUycwAlKEYonpZHJ+P2ZTouLjuqnr9ts8i1XYt4OocADVOgrpy0FXlyPKn4F5udRI1SVQI1p7FT3+PV4jTCgnazR5dhRfLPpvSHlEgIoMrP/xwRj5cu2TTn32uiMUqE/7VbcyeKj9VKdQmLYroCjexTO5ykGSahRPGSYtG9oFyhzA6p9SlLjqJvXzkmfMIm3EvAQhcE/7NGqbacmaRpH2XPp7eHpjNvDbR6snOcWdn6ENsE3T+MRjsF7jzL5UrgZr0GB3aMjzKoOPaA5vNmnbzBHnunFDUPXER3PW29knA0t34DjB4NarvXCDeHV8TPsOiLEfantVjSF4vvYuxegy2pHL2G0CquxP9388eMAclF0EnMx8hQz2Jx3tySs9sQ0my+eKWLp4Tl07hzE5l4Qfu3ns1c1qUpE65VlV1l4o0xnyAfmf9wTlsnhSeS/UgrUJ7HdTqrrglwls4sUCgv8bTRcI0PR4/39xU5WnDwsFx7UCeExNTvgxyOXmKdEP9hmsqiqjgDr+z0BCpNcE+x8TMbtTDSNPtoBbNnB94B3GRLfTsnCMI9PjOIkgiIgb8rirQ2oGP5XzG9if0aGMSuEHd5OSNsPKnbmcXqn8b1tTBzjdRlB5IGB5GGim4nk5ZsMuOPfdGM090lpRVwQ/92b9EX5e1pa9u5qP/JHiIWICEivtt/VCPyh7l8R1hDkvL2gWF8pFpivxkC5OWF7ptZY8AkGqWjzfoIzIE5sDWTFWhdYWHInpqxCeDf5M8rdeMg8BajYJin7FosZ4NB/RTBQ+LRVnbNTPhYXOmnIGgw/d99gy/8V7FeDvZN wztiHa0v M5gkrWyen5D1k3OgZTfRUGVlMbuUdZbA6x/qsadbbqq8QnS6BLfNkeAn5vrJ5hlBGvE8W0l3SFCdA/M9ACBQ5rEWH9oPoGRnoEtumRyaPqbpd+NzuP35p3AZVe1u2DTfd/Y6zul/Xp8XKI4On5s+0J6K8Y2H12XEZ11uG8r+1czz7fti7hNSDzhpOoCg89iYAdqpTQjH1BycmTCFS8HVSwjebBeyKzJlF0QUf85Wp5BCIb3BSm2dlXh344mpzQ+93jTih0WZ4vrkeVHUVVUCYuBG4fcstvKSwrglkGPP2qidPUU3yuSFr6uf/90dBv1tVwRON7rf9bKvjW6nsQStWKEsyawHZbzb8TOs3O/1z3yrP64VdgCEESKTqCuihRtwZi57RpQrwktS34cAfHyvwDpMfnHAtN+gjI+kWnYsWjleHPGtYgjabkIz9lVEiZLo2PTf6W1h/CZKNjlVgZ87nuwfybucvVewwXY3RDF3M23yUhN/yE5QszogtH54D51BpXOYJq7GMHSoDL1EYAosEIOnEXJyP8laJIXeqTVONoUdIEyIQ69EdPMSzuCj5lxJRXLERN4MMdsNquRERymV2TfDtKSfUWF/xLe43gWykKF9HnVI= X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: List-Subscribe: List-Unsubscribe: On Mon, Jan 15, 2024 at 06:20:05PM -0800, mhkelley58@gmail.com wrote: > From: Michael Kelley > > In a CoCo VM, when transitioning memory from encrypted to decrypted, or > vice versa, the caller of set_memory_encrypted() or set_memory_decrypted() > is responsible for ensuring the memory isn't in use and isn't referenced > while the transition is in progress. The transition has multiple steps, > and the memory is in an inconsistent state until all steps are complete. > A reference while the state is inconsistent could result in an exception > that can't be cleanly fixed up. > > However, the kernel load_unaligned_zeropad() mechanism could cause a stray > reference that can't be prevented by the caller of set_memory_encrypted() > or set_memory_decrypted(), so there's specific code to handle this case. > But a CoCo VM running on Hyper-V may be configured to run with a paravisor, > with the #VC or #VE exception routed to the paravisor. There's no > architectural way to forward the exceptions back to the guest kernel, and > in such a case, the load_unaligned_zeropad() specific code doesn't work. > > To avoid this problem, mark pages as "not present" while a transition > is in progress. If load_unaligned_zeropad() causes a stray reference, a > normal page fault is generated instead of #VC or #VE, and the > page-fault-based fixup handlers for load_unaligned_zeropad() resolve the > reference. When the encrypted/decrypted transition is complete, mark the > pages as "present" again. > > This version of the patch series marks transitioning pages "not present" > only when running as a Hyper-V guest with a paravisor. Previous > versions[1] marked transitioning pages "not present" regardless of the > hypervisor and regardless of whether a paravisor is in use. That more > general use had the benefit of decoupling the load_unaligned_zeropad() > fixup from CoCo VM #VE and #VC exception handling. But the implementation > was problematic for SEV-SNP because the SEV-SNP hypervisor callbacks > require a valid virtual address, not a physical address like with TDX and > the Hyper-V paravisor. Marking the transitioning pages "not present" > causes the virtual address to not be valid, and the PVALIDATE > instruction in the SEV-SNP callback fails. Constructing a temporary > virtual address for this purpose is slower and adds complexity that > negates the benefits of the more general use. So this version narrows > the applicability of the approach to just where it is required > because of the #VC and #VE exceptions being routed to a paravisor. > > The previous version minimized the TLB flushing done during page > transitions between encrypted and decrypted. Because this version > marks the pages "not present" in hypervisor specific callbacks and > not in __set_memory_enc_pgtable(), doing such optimization is more > difficult to coordinate. But the page transitions are not a hot path, > so this version eschews optimization of TLB flushing in favor of > simplicity. > > Since this version no longer touches __set_memory_enc_pgtable(), > I've also removed patches that add comments about error handling > in that function. Rick Edgecombe has proposed patches to improve > that error handling, and I'll leave those comments to Rick's > patches. > > Patch 1 handles implications of the hypervisor callbacks needing > to do virt-to-phys translations on pages that are temporarily > marked not present. > > Patch 2 makes the existing set_memory_p() function available for > use in the hypervisor callbacks. > > Patch 3 is the core change that marks the transitioning pages > as not present. > > This patch set is based on the linux-next20240103 code tree. > > Changes in v4: > * Patch 1: Updated comment in slow_virt_to_phys() to reduce the > likelihood of the comment becoming stale. The new comment > describes the requirement to work with leaf PTE not present, > but doesn't directly reference the CoCo hypervisor callbacks. > [Rick Edgecombe] > * Patch 1: Decomposed a complex line-wrapped statement into > multiple statements for ease of understanding. No functional > change compared with v3. [Kirill Shutemov] > * Patch 3: Fixed handling of memory allocation errors. [Rick > Edgecombe] > > Changes in v3: > * Major rework and simplification per discussion above. > > Changes in v2: > * Added Patches 3 and 4 to deal with the failure on SEV-SNP > [Tom Lendacky] > * Split the main change into two separate patches (Patch 5 and > Patch 6) to improve reviewability and to offer the option of > retaining both hypervisor callbacks. > * Patch 5 moves set_memory_p() out of an #ifdef CONFIG_X86_64 > so that the code builds correctly for 32-bit, even though it > is never executed for 32-bit [reported by kernel test robot] > > [1] https://lore.kernel.org/lkml/20231121212016.1154303-1-mhklinux@outlook.com/ > > Michael Kelley (3): > x86/hyperv: Use slow_virt_to_phys() in page transition hypervisor > callback > x86/mm: Regularize set_memory_p() parameters and make non-static > x86/hyperv: Make encrypted/decrypted changes safe for > load_unaligned_zeropad() Applied. Thanks. The changes to mm code are mostly cosmetic. The changes had been pending for a while without any objections from the maintainers, so I picked them up as well. If this becomes problematic, please let me know. > > arch/x86/hyperv/ivm.c | 65 ++++++++++++++++++++++++++++--- > arch/x86/include/asm/set_memory.h | 1 + > arch/x86/mm/pat/set_memory.c | 24 +++++++----- > 3 files changed, 75 insertions(+), 15 deletions(-) > > -- > 2.25.1 >