Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Message-ID: <7f55f8cb-caac-ab81-82f2-f0d29e4a0c6a@oracle.com>
Date:   Thu, 20 Jan 2022 16:46:35 +0000
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.5.0
Subject: Re: [PATCH 9/9] KVM: SVM: Don't kill SEV guest if SMAP erratum
 triggers in usermode
Content-Language: en-GB
To:     Sean Christopherson <seanjc@google.com>,
        Paolo Bonzini <pbonzini@redhat.com>
Cc:     Vitaly Kuznetsov <vkuznets@redhat.com>,
        Wanpeng Li <wanpengli@tencent.com>,
        Jim Mattson <jmattson@google.com>,
        Joerg Roedel <joro@8bytes.org>, kvm@vger.kernel.org,
        linux-kernel@vger.kernel.org,
        Tom Lendacky <thomas.lendacky@amd.com>,
        Brijesh Singh <brijesh.singh@amd.com>,
        Liam Merwick <liam.merwick@oracle.com>
References: <20220120010719.711476-1-seanjc@google.com>
 <20220120010719.711476-10-seanjc@google.com>
From:   Liam Merwick <liam.merwick@oracle.com>
In-Reply-To: <20220120010719.711476-10-seanjc@google.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?V3BEWmFUSEowUmR6d3gySWFVSy9nUmJIM0VTWkJmZUQ0SFhnSzZGeWlqYmc5?=
 =?utf-8?B?bldWVkpGaWpEZ090Vi9XRDBCUmZZaVh0dTd1dnZVcElaTm45RDV2Mnl1Vklw?=
 =?utf-8?B?YytGWll0UFdzOXIzZm9KaXZxZVpXQUQ0OC9JNUpWcUFJenFrbDBjbnJoQVh3?=
 =?utf-8?B?VnRsc3FORk4vcy9PMDM2eUdFaXU4SmRlRmRVNlZEdkg2c0RqUElCNk9zamtq?=
 =?utf-8?B?a1hiZ01sb1JxWkVaUFJuQXpRQmR3Yzczb3dXOS9sY0RxTDJndVV6Mlpnakty?=
 =?utf-8?B?MTl6dkh1Z0xGVmVZY2sxMG5FVnZIK2JEVktkRWd6U2RycFgyTFRUemRKdzBl?=
 =?utf-8?B?ODE2aVVwVWw1V1hxWUZlNEdVTUtTeGpwbG9EU1hRNndtbnA4Rk41M2F3VmpN?=
 =?utf-8?B?eWd0bDV6Rm5pM0gyREdLbmhYTzhjUjNDRlYyRURBTVRvcXo1K1hKNFFwUDRr?=
 =?utf-8?B?VCtIQnU5S1Z4ZTIwUG1sWk8vM3dJQ3pSb210K0tkYXljYktRbTlZaUMwZHpR?=
 =?utf-8?B?V21UZTlPUGh4SmVtT2V5aU9aNmE3ck1rVktMdWUrMDU5QWRycEQ5WWl4NEI0?=
 =?utf-8?B?clh2V2VCU2hnbTNGWUVaU2xVNnJLUHgrbzlFTHA0Zk1GK3dEMVFleE11VTNz?=
 =?utf-8?B?aFZHUEhUV3hkNGFEWHZjbFpKZmx5Z1BldDdCa21vYm0xZlMweWt3TTdTRXJy?=
 =?utf-8?B?UmdqQWhVU2kzZjd5bXo1RURVNjBwVE9pd3FTR2xtMEJKOEJFYjJzUTVVN0xn?=
 =?utf-8?B?QlZQemluUmJUVS9LZDJDdEtZSGV1Sm0rZFdaRTlGVFdrNVJVYnRkSEgvQkg3?=
 =?utf-8?B?OTk4MEtxVjJEUW54M0FxS1krUGFndU5QT1U5TjZRQzkyM2ZQWmVoWlJNVHEy?=
 =?utf-8?B?TmVXQ1FmYjNRMnhrMGhkZXFUUTdneEo1U202S3lRQmRSUy9nbzM1YXh2bTE2?=
 =?utf-8?B?WWVIUXJyc1R6NzdkZkI1OVZBSVE5UnZzWU1EVzZUZHBjeG4vWkZvL2M5VTZQ?=
 =?utf-8?B?YVBXTU9tUllHK0k4VE0zTkhKUkdkdmlCRnZWL1Jpa1ZaNGN0aEs4a0podFFu?=
 =?utf-8?B?TU4wT3BtbkhKaDBqaDNpclRkY1BQWW45YjlSQXdHbXgvY2VyM3BDRXVjdGEy?=
 =?utf-8?B?V1czNW50T1Q5ZGhFSDRHazRnS05BeDV3ZWRxUG01NnRhY3NjN09tMDk4Yk95?=
 =?utf-8?B?Qy9tZU4wVXBZbUFJWkVtOHUwbzRwL3U5UG5jZ2RFMkhYVEtITnJpanNXUGNQ?=
 =?utf-8?B?YzdlcEVVNlBsS3NGTU9Mdk8weUVVTUxyQ1JKUWZ4U2ZSZ0FJSEZiaXM2MFlu?=
 =?utf-8?B?OTFaQ00vcGg1V1JGQ2JMd1BZWlZsdTVBQ1ZwTlUwZ0dGYUl0OHlXckdLaHBR?=
 =?utf-8?B?ZE9qNUkvc3VhV3p0THZkajVuZUFOekwwM0Zyb1RVRUlXK3JmcFRxR1RRM0hp?=
 =?utf-8?B?OHhtZFhEOVgxaGZiK3JocXFZRXRvNnJReHJZMU4xd2x0akpIVlFGQkpNYmp5?=
 =?utf-8?B?eWZ1RFBHWi9MajRTVC9wS01EakprNUNlZkRXalY5ZnNBNjZ0eFZzajFsd01F?=
 =?utf-8?B?RFVtRXhLNzhlS1lLNmxSVzJCWGtKUVBUYkVHVXZCQTIxMks5WHVZeUgvK2dR?=
 =?utf-8?B?L0ZUOXVmWXVmZUljVHcrMnJBaWJrMUpHVXNNSmR3QWZxK2xpYzR0OTVpV21E?=
 =?utf-8?B?YTl4WjlIVTVBYVpPT1JpVWJzaUlyUXdyZ3FOZmhqd1c3QkhCMHRxaHdTZFJB?=
 =?utf-8?B?K2pJRWsySWNNNG5BbEFyT0JLdk1EZnBwVlJNdDlwYlBCSGs1c05oKzlSRkhk?=
 =?utf-8?B?MWczUUVIeEc4VXl2c2N4OWQyd0U5bWhPRFZxRzlVMHVKbEFsT016cC9iekhw?=
 =?utf-8?B?MkZVVDY4L2gyV2hES0NpRUQvN3FlcWdieEM5Q1l4S2pkL09zZ0ltanJDNUJO?=
 =?utf-8?B?aGdYQ2o3YUFzNDBTUDh1RWRzajkrRDkyNzBuUlJ0YkZPRkNWc3pyd1hyVDNa?=
 =?utf-8?B?aWpVT0R5SVQ4Y1AwOE9jRFVQWUY0Mlo1WjVsbmFwa0NObStPWnNSMkZPaVV5?=
 =?utf-8?B?WnVtdHU1WHJKeEFVanA4WTc4bWlUdEZrS0hpMGRpeW5PNXBiV2hYR2h4TWtX?=
 =?utf-8?B?dmJyYzV1N08zMVlSekJNQmhRRnR2YW9SL0tGbllFbklOZVFlSTgvVFcrVTQw?=
 =?utf-8?Q?1lrUks0WLgm4ByivOUE0t2c=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 98477578-f3dc-4202-bf73-08d9dc347015
X-MS-Exchange-CrossTenant-AuthSource: DS7PR10MB5038.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Jan 2022 16:46:42.8394
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: Pa2ckOEg2uLGfo3hCWWLbzXk0DqOBvoQ7SsIBf9bZl2gjGV6nEj92Nl04/zstaBKNO2i0IYPZGleLr9rTUA/6w==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR10MB3867
X-Proofpoint-Virus-Version: vendor=nai engine=6300 definitions=10233 signatures=668683
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 adultscore=0 phishscore=0
 mlxlogscore=999 malwarescore=0 bulkscore=0 suspectscore=0 spamscore=0
 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2110150000 definitions=main-2201200085
X-Proofpoint-ORIG-GUID: y0F08YyB7zA7sg34oTHQ0rN7yNfPfEWQ
X-Proofpoint-GUID: y0F08YyB7zA7sg34oTHQ0rN7yNfPfEWQ
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 20/01/2022 01:07, Sean Christopherson wrote:
> Inject a #GP instead of synthesizing triple fault to try to avoid killing
> the guest if emulation of an SEV guest fails due to encountering the SMAP
> erratum.  The injected #GP may still be fatal to the guest, e.g. if the
> userspace process is providing critical functionality, but KVM should
> make every attempt to keep the guest alive.
> 
> Signed-off-by: Sean Christopherson <seanjc@google.com>


Reviewed-by: Liam Merwick <liam.merwick@oracle.com>

> ---
>   arch/x86/kvm/svm/svm.c | 16 +++++++++++++++-
>   1 file changed, 15 insertions(+), 1 deletion(-)
> 
> diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
> index a4b02a6217fd..88f5bbb0e6a1 100644
> --- a/arch/x86/kvm/svm/svm.c
> +++ b/arch/x86/kvm/svm/svm.c
> @@ -4357,7 +4357,21 @@ static bool svm_can_emulate_instruction(struct kvm_vcpu *vcpu, int emul_type,
>   	is_user = svm_get_cpl(vcpu) == 3;
>   	if (smap && (!smep || is_user)) {
>   		pr_err_ratelimited("KVM: SEV Guest triggered AMD Erratum 1096\n");
> -		kvm_make_request(KVM_REQ_TRIPLE_FAULT, vcpu);
> +
> +		/*
> +		 * If the fault occurred in userspace, arbitrarily inject #GP
> +		 * to avoid killing the guest and to hopefully avoid confusing
> +		 * the guest kernel too much, e.g. injecting #PF would not be
> +		 * coherent with respect to the guest's page tables.  Request
> +		 * triple fault if the fault occurred in the kernel as there's
> +		 * no fault that KVM can inject without confusing the guest.
> +		 * In practice, the triple fault is moot as no sane SEV kernel
> +		 * will execute from user memory while also running with SMAP=1.
> +		 */
> +		if (is_user)
> +			kvm_inject_gp(vcpu, 0);
> +		else
> +			kvm_make_request(KVM_REQ_TRIPLE_FAULT, vcpu);
>   	}
>   
>   resume_guest: