Received: by 2002:a05:6a10:1d13:0:0:0:0 with SMTP id pp19csp291273pxb; Tue, 31 Aug 2021 22:02:57 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzjmd23n1Sct67pKX4xCVbg4aKWF1HwDI2CIcQOSHbegfk1MZ9sTm0YjYL1BUGwdXdTkeq6 X-Received: by 2002:a17:906:84d0:: with SMTP id f16mr34249266ejy.6.1630472577591; Tue, 31 Aug 2021 22:02:57 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1630472577; cv=none; d=google.com; s=arc-20160816; b=xbbWl80gtB6LXPAw2ndRazeH8IuUZetiYasPL5Zb40Sl196Bs9uZyocMSuqjYSRmaY 32wUrCzJJ6kmU3xB4XLyEDUKr8c8qxoGPCDq9upkzYNB3rUv0L995qkqZI68iH6IHjDL NBF0s+hbQvIsgipOikDEwJvphm40N7rLBk+Vna8r1+BMB4NIH/60eAmlv9/f56XIGrmn w+yqdAFKrJ7yNkCNeGfo2xcwLcJC7oCR79iv6iv9hKSfZBZ2r3LpTVT5686PDH8qGQOQ kG97Zf7+EXbLo6eYrrolUCdjPgLgKCAycryd9v3QtR85vPkjsvaal8QaWhEi/KUlQqfa 5DxQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:subject:cc:to:from:date:references:in-reply-to :message-id:mime-version:user-agent:dkim-signature; bh=818nWDmIorQ2UTcxTf67EmGzLmFclT9KAIhVN6ri//I=; b=wBP6mJ1ZYjrxQce3BogsqvIc6KEWIUyYVz8kSaih83yUb54bq4QLOl/U0H50xi7YFD PcooSBRjaGMms97sCDhwYwOn41MVa96PzlUGTkV41isw9u7KmUf7CJAKaeWm869BTLIu /0ibfO7WscGzSHIz2IrRzo+N1Rn5plvcJqHEmvSDW9zZli7OZm21WatW/D50+YC9XRSj TAVEci/VOLGBYNWC9NhK8j1PjHMQE3kK0SomIRCTVOc/qSNZTmFMDuOy4XHyJ9nW2Haq YgOUXk4RkrvY5Mg6bqc4JqpYS3u0JBv6KDMwp4PsHcjXlH5SeJvaoB12ShS4sWokcdzu I8kw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=aGjJdeyH; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id d19si19654164edy.10.2021.08.31.22.02.18; Tue, 31 Aug 2021 22:02:57 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=k20201202 header.b=aGjJdeyH; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241894AbhIAFAP (ORCPT + 99 others); Wed, 1 Sep 2021 01:00:15 -0400 Received: from mail.kernel.org ([198.145.29.99]:59734 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230483AbhIAFAO (ORCPT ); Wed, 1 Sep 2021 01:00:14 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id B8A6F60232; Wed, 1 Sep 2021 04:59:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1630472357; bh=Q2FwKGKWoZWfAPBVP99Q/ekB3fP6VqumPb1wzqe6Qqg=; h=In-Reply-To:References:Date:From:To:Cc:Subject:From; b=aGjJdeyHej8wH/ivFp9q5d3pewYxLqHCVEY0OxeiCITPPfEuLUvgTAEYE65yriA6w +7r9UpoxP6eTD7lmhpsMCWe+1D8F4pltXzK09fsYFKEKminqOjvZijoiyC7pRxFAOV VlFR6OSBb8J1xQiM4FZaw6nXDCH2rnAkZkPvDUqKnpbueY6Fo7IRVkdOSR/Nj+IYDk OHijHdmeqBfKGtCb8uPq1OZgAAsQEc/iGgOBdtEkVr3x/czkbWpIe1CyD0Hq41Xth/ 5HQdqa2gB16hSlCxLCQIXWlT3dO1wO6UPRrK2JhFmK6GpqKFa2A6my2yz90VOLZm+t otkKZOo5bCuWA== Received: from compute6.internal (compute6.nyi.internal [10.202.2.46]) by mailauth.nyi.internal (Postfix) with ESMTP id D4F6C27C0054; Wed, 1 Sep 2021 00:59:14 -0400 (EDT) Received: from imap2 ([10.202.2.52]) by compute6.internal (MEProxy); Wed, 01 Sep 2021 00:59:14 -0400 X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedvtddruddvvddgkeelucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmne cujfgurhepofgfggfkjghffffhvffutgesthdtredtreerjeenucfhrhhomhepfdetnhgu hicunfhuthhomhhirhhskhhifdcuoehluhhtoheskhgvrhhnvghlrdhorhhgqeenucggtf frrghtthgvrhhnpeegjefghfdtledvfeegfeelvedtgfevkeeugfekffdvveeffeetieeh ueetveekfeenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhroh hmpegrnhguhidomhgvshhmthhprghuthhhphgvrhhsohhnrghlihhthidqudduiedukeeh ieefvddqvdeifeduieeitdekqdhluhhtoheppehkvghrnhgvlhdrohhrgheslhhinhhugi drlhhuthhordhush X-ME-Proxy: Received: by mailuser.nyi.internal (Postfix, from userid 501) id B3238A002E4; Wed, 1 Sep 2021 00:59:11 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface User-Agent: Cyrus-JMAP/3.5.0-alpha0-1126-g6962059b07-fm-20210901.001-g6962059b Mime-Version: 1.0 Message-Id: In-Reply-To: <61ea53ce-2ba7-70cc-950d-ca128bcb29c5@redhat.com> References: <20210824005248.200037-1-seanjc@google.com> <307d385a-a263-276f-28eb-4bc8dd287e32@redhat.com> <61ea53ce-2ba7-70cc-950d-ca128bcb29c5@redhat.com> Date: Tue, 31 Aug 2021 21:58:50 -0700 From: "Andy Lutomirski" To: "David Hildenbrand" , "Sean Christopherson" Cc: "Paolo Bonzini" , "Vitaly Kuznetsov" , "Wanpeng Li" , "Jim Mattson" , "Joerg Roedel" , "kvm list" , "Linux Kernel Mailing List" , "Borislav Petkov" , "Andrew Morton" , "Joerg Roedel" , "Andi Kleen" , "David Rientjes" , "Vlastimil Babka" , "Tom Lendacky" , "Thomas Gleixner" , "Peter Zijlstra (Intel)" , "Ingo Molnar" , "Varad Gautam" , "Dario Faggioli" , "the arch/x86 maintainers" , linux-mm@kvack.org, linux-coco@lists.linux.dev, "Kirill A. Shutemov" , "Kirill A . Shutemov" , "Sathyanarayanan Kuppuswamy" , "Dave Hansen" , "Yu Zhang" Subject: =?UTF-8?Q?Re:_[RFC]_KVM:_mm:_fd-based_approach_for_supporting_KVM_guest_?= =?UTF-8?Q?private_memory?= Content-Type: text/plain Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Aug 31, 2021, at 12:07 PM, David Hildenbrand wrote: > On 28.08.21 00:18, Sean Christopherson wrote: > > On Thu, Aug 26, 2021, David Hildenbrand wrote: > >> You'll end up with a VMA that corresponds to the whole file in a single > >> process only, and that cannot vanish, not even in parts. > > > > How would userspace tell the kernel to free parts of memory that it doesn't want > > assigned to the guest, e.g. to free memory that the guest has converted to > > not-private? > > I'd guess one possibility could be fallocate(FALLOC_FL_PUNCH_HOLE). > > Questions are: when would it actually be allowed to perform such a > destructive operation? Do we have to protect from that? How would KVM > protect from user space replacing private pages by shared pages in any > of the models we discuss? > What do you mean? If userspace maliciously replaces a shared page by a private page, then the guest crashes. (The actual meaning here is a bit different on SNP-ES vs TDX. In SNP-ES, a given GPA can be shared, private, or nonexistent. A guest accesses it with a special bit set in the guest page tables to indicate whether it expects shared or private, and the CPU will produce an appropriate error if the bit doesn't match the page. In TDX, there is actually an entirely separate shared vs private address space, and, in theory, a given "GPA" can exist as shared and as private at once. The full guest n-bit GPA plus the shared/private bit is logically an N+1 bit address, and it's possible to map all of it at once, half shared, and half private. In practice, the defined guest->host APIs don't really support that usage.