Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Fri, 30 Sep 2022 04:33:32 +0000
From:   Sean Christopherson <seanjc@google.com>
To:     Vitaly Kuznetsov <vkuznets@redhat.com>
Cc:     Paolo Bonzini <pbonzini@redhat.com>, kvm@vger.kernel.org,
        linux-kernel@vger.kernel.org, David Matlack <dmatlack@google.com>,
        Mingwei Zhang <mizhang@google.com>,
        Yan Zhao <yan.y.zhao@intel.com>,
        Ben Gardon <bgardon@google.com>
Subject: Re: [PATCH v4 1/9] KVM: x86/mmu: Bug the VM if KVM attempts to
 double count an NX huge page
Message-ID: <YzZxnJNj+/Xb+rRd@google.com>
References: <20220830235537.4004585-1-seanjc@google.com>
 <20220830235537.4004585-2-seanjc@google.com>
 <87tu50oohn.fsf@redhat.com>
 <YysjGNtYJbbPuxSN@google.com>
 <YyswlLykptcOciOS@google.com>
 <87leqcoglp.fsf@redhat.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <87leqcoglp.fsf@redhat.com>
Precedence: bulk

On Wed, Sep 21, 2022, Vitaly Kuznetsov wrote:
> Sean Christopherson <seanjc@google.com> writes:
> 
> > On Wed, Sep 21, 2022, Sean Christopherson wrote:
> >> On Wed, Sep 21, 2022, Vitaly Kuznetsov wrote:
> >> > [  962.257992]  ept_fetch+0x504/0x5a0 [kvm]
> >> > [  962.261959]  ept_page_fault+0x2d7/0x300 [kvm]
> >> > [  962.287701]  kvm_mmu_page_fault+0x258/0x290 [kvm]
> >> > [  962.292451]  vmx_handle_exit+0xe/0x40 [kvm_intel]
> >> > [  962.297173]  vcpu_enter_guest+0x665/0xfc0 [kvm]
> >> > [  962.307580]  vcpu_run+0x33/0x250 [kvm]
> >> > [  962.311367]  kvm_arch_vcpu_ioctl_run+0xf7/0x460 [kvm]
> >> > [  962.316456]  kvm_vcpu_ioctl+0x271/0x670 [kvm]
> >> > [  962.320843]  __x64_sys_ioctl+0x87/0xc0
> >> > [  962.324602]  do_syscall_64+0x38/0x90
> >> > [  962.328192]  entry_SYSCALL_64_after_hwframe+0x63/0xcd
> >> 
> >> Ugh, past me completely forgot the basics of shadow paging[*].  The shadow MMU
> >> can reuse existing shadow pages, whereas the TDP MMU always links in new pages.
> >> 
> >> I got turned around by the "doesn't exist" check, which only means "is there
> >> already a _SPTE_ here", not "is there an existing SP for the target gfn+role that
> >> can be used".
> >> 
> >> I'll drop the series from the queue, send a new pull request, and spin a v5
> >> targeting 6.2, which amusing will look a lot like v1...
> >
> > Huh.  I was expecting more churn, but dropping the offending patch and then
> > "reworking" the series yields a very trivial overall diff.  
> >
> > Vitaly, can you easily re-test with the below, i.e. simply delete the
> > KVM_BUG_ON()?
> 
> This seems to work! At least, I haven't noticed anything weird when
> booting my beloved Win11 + WSL2 guest.

I finally figured out why I didn't see this in testing.  It _should_ have fired
during kernel boot when testing legacy shadow paging, i.e. ept=0, as the bug requires
nothing more than executing from two GVAs pointing at the same huge 2mb GPA.

I did test ept=0, but all of my normal test systems aren't susceptible to L1TF
(KVM guest, all AMD, and ICX), i.e. don't enable the mitigation by default.  I
also tested those systems with the mitigation forced on and ept=0, but never
booted a VM with that combination, and neither KUT nor selftests does the requisite
aliasing with huge pages.

Death was instantaneous once I forced the mitigation on with ept=0 and booted a VM.

*sigh*