Received-SPF: pass (google.com: domain of linux-kernel+bounces-94660-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
Message-ID: <0a05d5ec-5352-4bab-96ae-2fa35235477c@intel.com>
Date: Thu, 7 Mar 2024 11:35:00 +1300
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH 11/16] KVM: x86/mmu: Explicitly disallow private accesses
 to emulated MMIO
Content-Language: en-US
To: Sean Christopherson <seanjc@google.com>, Paolo Bonzini
	<pbonzini@redhat.com>
CC: <kvm@vger.kernel.org>, <linux-kernel@vger.kernel.org>, Yan Zhao
	<yan.y.zhao@intel.com>, Isaku Yamahata <isaku.yamahata@intel.com>, "Michael
 Roth" <michael.roth@amd.com>, Yu Zhang <yu.c.zhang@linux.intel.com>, Chao
 Peng <chao.p.peng@linux.intel.com>, Fuad Tabba <tabba@google.com>, David
 Matlack <dmatlack@google.com>
References: <20240228024147.41573-1-seanjc@google.com>
 <20240228024147.41573-12-seanjc@google.com>
From: "Huang, Kai" <kai.huang@intel.com>
In-Reply-To: <20240228024147.41573-12-seanjc@google.com>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?NjVNL3owdmlnaUZodkFGZ1BSNVpzQ1B6eHZyK2JTWG85d0lRdHNNRGRZVlYx?=
 =?utf-8?B?Skg4NDMxNm04OEt0VmswVlh3VWtWYlh2TmsxMldCMVZnc2V1Q0tvMmFGVkds?=
 =?utf-8?B?VDExU3ptdXVtQzVUUVYzVU5FVXRLWG5iMDlWTEhzNG5oSkhETUFaVzVSMGRi?=
 =?utf-8?B?cFI4NldiVlZGVXRlK291T0wvb2UvMGozaXV0anRqaElGL2ROSitJMCtrWnJB?=
 =?utf-8?B?TUFPOWN0YmkyejByQkQ4aXBlVHhHaGxuSDltK1ViWDFkZVlTSnZvU3BHZ0Vh?=
 =?utf-8?B?ZmsrR253UTN6a2FNVWVCT0s5NW0vV1IzTVkwejN0R1pSSGJmNVJCS3BJd0tk?=
 =?utf-8?B?alhUZStQZExESEtUUkNKVEl3dkt5WVB4RmpaMjJkcXh4NDlocjhqSWlMZ2hi?=
 =?utf-8?B?ckdOSlU2cGIvZm5wRjlDaWZwbk1FdHJtbW1RSnc3WUpUN2g1NWUvWVZuNGI0?=
 =?utf-8?B?UVNaSnZFV2JkNGExa1ZGbUNpSnJLbkZ2VkhqUGdoTmhsd1FiTkl6SkdkT1lG?=
 =?utf-8?B?WXc2blBlWWJER0JmYW8zUlMzVC9JQWJ3TDkvZEc2S1ltVFBUeWJadmdSb0Fj?=
 =?utf-8?B?K3VqU3BDTWFqb2VyUGt3TlNFZ2EzOGNsM2VueXByd1dHQlQzeEhxSWJ6eFY3?=
 =?utf-8?B?RFdNZnZ0aElnaHMvQ2U5TlZFaldRVzZRSnFwWXVXUnFwTlVUdHgrMm1zVkd6?=
 =?utf-8?B?M0Fua2xQSklVUHdKTWkwVWhQaU9SOEtuVU01bzFaRlNaV3AyZ1ZKazZ3U3J0?=
 =?utf-8?B?WHRFOUJhM1Jqdk92V1JpUDdQRkdtZDZjQ1IyYWJER3prZFlnbW5UUVZKUmtr?=
 =?utf-8?B?cGl2VHRVQlkyc1NVYjNVSlM1R1AycU84cVRoSHlMM2tJZUhadEEvTVhWRURk?=
 =?utf-8?B?eFFleXFUNVJLS3dKUHczWVErMXhKbnFreEh2UHpIcGZoWUlXVU1qbjQ1MkxK?=
 =?utf-8?B?SW9DZUJka1dwclFybGZjT0NpTk5KYitscVArUUhWMWlqaDFGTDJmT0RURysy?=
 =?utf-8?B?RGlxL1piQ2I4eTgrWVVYQWRGaGhlNUY5aWZFc0QzejJCSER5dEFTdnRvMkUx?=
 =?utf-8?B?aTFsajBVSWJybHIrR3hWZ0FYSFlBeGdPRk41OGFTUG5RMk4rOERaSUFLN1BM?=
 =?utf-8?B?WHdFT0RaUXpQOFBiUnd2UFUzNjJzRW9PN1NMemFaWGtQK3VkaEliZ0VCN1Y1?=
 =?utf-8?B?Wk0yQ09ncDVrYmFnZExhRk55OXNCL0Ixa3lmTG84ZHg0VkhMM0dLbVlaV2JN?=
 =?utf-8?B?U3FMczJsYzBwcTN5cDZKanNHM3N6QkZXMHN6amtTbXl6dG1Uc3lUQ0xCYTBv?=
 =?utf-8?B?Y3lWNkxpanJuYUFiM1NWUFJ2aUc1L3NSQTBIOWlOb1BQMWJkb0tmSnJULzFy?=
 =?utf-8?B?K24zOEJFZlVkZVkyaXVMYmhKQldUWWUwU1h1TW51WUUvYmtBUERlaXNrRUhU?=
 =?utf-8?B?WThPZ3RCYXNYMVMrYTV4aC9EeEpjMkhZd2RCQWU5UG5tL01hR3F5Nnl6aEhR?=
 =?utf-8?B?czhhYUlEQTdmTmRxOXduQWEyTkhqT2YwVjdzTmVNUEhFcVJXcmNHamVKSWgw?=
 =?utf-8?B?am9SeGg5aTVLc3ZWbnQyRVdrZTVEMlN6M1B3YUpCZlNHSFR5Z2lGYXl4ZDM2?=
 =?utf-8?B?V1k5TWVVS2lCN0FXWjBUbkFQLytmd0ZiWlJVaDQyRVdkSElvWU5vQ0lvUVJy?=
 =?utf-8?B?SFNKUWlaSFR0bEhkTUhGZFJSc0pSL2xLSUhFR3R1QXYwSW1Bc0ZsWmorc1Ar?=
 =?utf-8?B?dmk3OERLRnpkTWY2OEdPQmNFRDRGbFVpK0JUdWNQSHhwNG95cU96dWI5UVpq?=
 =?utf-8?B?aUcwdjVid1gveWhXKzRwNGxzdExZdHVkWWpjUU9CcmljdDRDbThKVERaR0F6?=
 =?utf-8?B?akpacDh3d2VOZllzSlpRMTdGT1crem50MW1SRE81c0VqcHFLM2dXOWpIQUVH?=
 =?utf-8?B?VjJSeWFEdGxRTHF4VURRYitUZGpMcTJXWXZvb3RoNnRKenJzd2hnUlJtRnpG?=
 =?utf-8?B?MUN2NWlXdG4waEh3dWZNWnJwTDhCd1Yza2RRMDBmWFRUK3UxK1dnWDlFcERw?=
 =?utf-8?B?cis4UU10NVBmaUVYNmFlMjdHR2EyeHZ0NC9sYndWTzJudnRnU2xaRlR3S1RB?=
 =?utf-8?Q?pcfnYimGCk3PhVjDspkbtd1GI?=
X-MS-Exchange-CrossTenant-Network-Message-Id: 6e04aa84-bcfb-498e-4c1f-08dc3e2dadd0
X-MS-Exchange-CrossTenant-AuthSource: BL1PR11MB5978.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 Mar 2024 22:35:09.2119
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 6TuRVMzVufHxOQTbZX59xzSc9gH7Cj+ye7boc6xKPErs/dav23cLWlVevHAQlLYZPXfrVx75jpQTWUVfpDwFBg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH8PR11MB6563
X-OriginatorOrg: intel.com


On 28/02/2024 3:41 pm, Sean Christopherson wrote:
> Explicitly detect and disallow private accesses to emulated MMIO in
> kvm_handle_noslot_fault() instead of relying on kvm_faultin_pfn_private()
> to perform the check.  This will allow the page fault path to go straight
> to kvm_handle_noslot_fault() without bouncing through __kvm_faultin_pfn().
> 
> Signed-off-by: Sean Christopherson <seanjc@google.com>
> ---
>   arch/x86/kvm/mmu/mmu.c | 5 +++++
>   1 file changed, 5 insertions(+)
> 
> diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
> index 5c8caab64ba2..ebdb3fcce3dc 100644
> --- a/arch/x86/kvm/mmu/mmu.c
> +++ b/arch/x86/kvm/mmu/mmu.c
> @@ -3314,6 +3314,11 @@ static int kvm_handle_noslot_fault(struct kvm_vcpu *vcpu,
>   {
>   	gva_t gva = fault->is_tdp ? 0 : fault->addr;
>   
> +	if (fault->is_private) {
> +		kvm_mmu_prepare_memory_fault_exit(vcpu, fault);
> +		return -EFAULT;
> +	}
> +

As mentioned in another reply in this series, unless I am mistaken, for 
TDX guest the _first_ MMIO access would still cause EPT violation with 
MMIO GFN being private.

Returning to userspace cannot really help here because the MMIO mapping 
is inside the guest.

I am hoping I am missing something here?