Received-SPF: pass (google.com: domain of linux-kernel+bounces-96511-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
Date: Fri, 8 Mar 2024 12:22:53 +0800
From: Yan Zhao <yan.y.zhao@intel.com>
To: Sean Christopherson <seanjc@google.com>
CC: Paolo Bonzini <pbonzini@redhat.com>, <kvm@vger.kernel.org>,
	<linux-kernel@vger.kernel.org>, Isaku Yamahata <isaku.yamahata@intel.com>,
	Michael Roth <michael.roth@amd.com>, Yu Zhang <yu.c.zhang@linux.intel.com>,
	Chao Peng <chao.p.peng@linux.intel.com>, Fuad Tabba <tabba@google.com>,
	"David Matlack" <dmatlack@google.com>
Subject: Re: [PATCH 01/16] KVM: x86/mmu: Exit to userspace with -EFAULT if
 private fault hits emulation
Message-ID: <ZeqSncClqOQqCO41@yzhao56-desk.sh.intel.com>
Reply-To: Yan Zhao <yan.y.zhao@intel.com>
References: <20240228024147.41573-1-seanjc@google.com>
 <20240228024147.41573-2-seanjc@google.com>
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <20240228024147.41573-2-seanjc@google.com>
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?W8Fub0NOgjsXVygcGaSWTJE/EFfsxoSppAddjvJzyHMjvuuEo4ozMib5/4z3?=
 =?us-ascii?Q?Erzq2T2Epnmx8b8zAkU64ktv/THycR4fMO/SzDDsjEi45wm4caSzbeUVw7+E?=
 =?us-ascii?Q?MsffbqdY75KjVSUMrkbKulChG2H51VCitLgZUrdBpRSSJyhs29XYo966jcC4?=
 =?us-ascii?Q?iWBZ8Dgwmar0JzAro4VPMUCiZtfPbUE6s49eKgJVYeEMFkB56G5Jd63MPuca?=
 =?us-ascii?Q?GnZrdzDIDS8AJcYPfY4zTyNkOg8jCmfW9Z8sPD/eue/Sbj33/LGllsccDjbv?=
 =?us-ascii?Q?2noi1A/HDTtJY+1gu9pouUxyylCmKlgEfPgmQYn0vinIOAVCS59E3KgzDBuk?=
 =?us-ascii?Q?MpVPQksoM5kvAbz0CoQ/9L5hwzpscV7IgEDovLA7hJyqE+I1zzPKnm/H39ki?=
 =?us-ascii?Q?yYWdniAQct+1Oot7ng9gjMgD6zoOgYD5HwadZIoHKh2zAKJXQ/s/+uA3re66?=
 =?us-ascii?Q?2BfK/HhXQDq3n3yitwmN6Oj9AUjyLrKgEQ+TOZdLDeB6As9IV2/q5DNvRfjb?=
 =?us-ascii?Q?+8oxTv+MqVz5iREmDDv/Y48+3KEC8Lh8duZg5b9OJIjsDPPpgXttf5c0UtZa?=
 =?us-ascii?Q?PmieO9XrfjciBJgD/pawB5MLW0S01bvglO9cpLdMOq8NY4XI9CbS+aQ2TRhs?=
 =?us-ascii?Q?PlPawEi3fy8its7xkl5iSL6b/ZrbLqACy4FMyYnX66Ed9GUWr+FX0pFd9BwG?=
 =?us-ascii?Q?pvzJjyyWp0bgqxq9qn1QR41MfeTFmXJZ7iQR7xtTxb563jT1F/C4Wuq2vqIb?=
 =?us-ascii?Q?5Vx/pN/3hl+tx93LyynheNpa6Ydq9q6ysy1ryAMd7GnInPkAK06MqCA19gJx?=
 =?us-ascii?Q?42PPMMzJsjxTjj5xW+2eYjQmW5vAjFKu90yT+YtlRanoRoj1MOJp7yRbxsSA?=
 =?us-ascii?Q?o9ENNAgDozi7CCtLXfk4WCzeUykCTgnVLqgHmgfYp/e1yYshGa2whpO71j7M?=
 =?us-ascii?Q?fKQvHG7ylUdkzSaNULXTp0VkL59ctou4Kv8YS85v9QKjCFv8C5EX2mydk7Ff?=
 =?us-ascii?Q?XrEZ4dB2w13VzyzjWRP/Z3GiWSzj0WyXPn6q9/kT+0AeYNV+0U1Pl9wXbkLo?=
 =?us-ascii?Q?Ri6Blo8E1b+3KaRi3i5TuBxZgxlEfNE4c8K+/aAj/XriwTCY0dSsn2X+tf+6?=
 =?us-ascii?Q?vVh1qSd9V94gW/eAMObDdcQMrful6TNknErPq6NTILfHuMTUcn2hQceMefjq?=
 =?us-ascii?Q?+AHkUpx3M42Gpzs5NgvFhr0731rs7/BSg/WyJtYVcKQazTeEaVRxQXKQeP2q?=
 =?us-ascii?Q?W+zQGQGvcqEg170pvgYR/28D1pFIqeUy/FnRWE/v0WH1UmODNHIUrqooAjH8?=
 =?us-ascii?Q?c7MQe/c9WDARLAvbPqYimCPBPGVSKBPMuaYYvZgQqbTy5i+X+69qMcLX792L?=
 =?us-ascii?Q?Pi50O1nnsZAw2ooHDWFJkmG91xf/HB+YJNGInGzw5vuQsXIOmCXa4vKHzvZX?=
 =?us-ascii?Q?N+NYJhoWxesfHI2tTH+l4oHGt2hDFdkETscsbm6GSKc8Ki2tgmyDRiQEPzWw?=
 =?us-ascii?Q?WgJXcnjUVMY6lsNCcB328LBwCWhdAz4v59Yw2biHKe8qAfrcnomEeZaaQFaw?=
 =?us-ascii?Q?bnHgLJNGLQHzKosacihIJTAYhu5njEDO5s1BO8/T?=
X-MS-Exchange-CrossTenant-Network-Message-Id: 58345414-2d89-45f5-0fd9-08dc3f2b9726
X-MS-Exchange-CrossTenant-AuthSource: DS7PR11MB5966.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 08 Mar 2024 04:52:43.2825
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: KJHooAemVunuxvjecVK17K0bjCuHEaqvXozPSJOfTXb+84tT+g5DGxH173BsrfESJJqHd6M6v0CpEqUdsCxgXQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR11MB4757
X-OriginatorOrg: intel.com

On Tue, Feb 27, 2024 at 06:41:32PM -0800, Sean Christopherson wrote:
> Exit to userspace with -EFAULT / KVM_EXIT_MEMORY_FAULT if a private fault
> triggers emulation of any kind, as KVM doesn't currently support emulating
> access to guest private memory.  Practically speaking, private faults and
> emulation are already mutually exclusive, but there are edge cases upon
> edge cases where KVM can return RET_PF_EMULATE, and adding one last check
> to harden against weird, unexpected combinations is inexpensive.
> 
> Suggested-by: Yan Zhao <yan.y.zhao@intel.com>
> Signed-off-by: Sean Christopherson <seanjc@google.com>
> ---
>  arch/x86/kvm/mmu/mmu.c          |  8 --------
>  arch/x86/kvm/mmu/mmu_internal.h | 13 +++++++++++++
>  2 files changed, 13 insertions(+), 8 deletions(-)
> 
> diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
> index e4cc7f764980..e2fd74e06ff8 100644
> --- a/arch/x86/kvm/mmu/mmu.c
> +++ b/arch/x86/kvm/mmu/mmu.c
> @@ -4309,14 +4309,6 @@ static inline u8 kvm_max_level_for_order(int order)
>  	return PG_LEVEL_4K;
>  }
>  
> -static void kvm_mmu_prepare_memory_fault_exit(struct kvm_vcpu *vcpu,
> -					      struct kvm_page_fault *fault)
> -{
> -	kvm_prepare_memory_fault_exit(vcpu, fault->gfn << PAGE_SHIFT,
> -				      PAGE_SIZE, fault->write, fault->exec,
> -				      fault->is_private);
> -}
> -
>  static int kvm_faultin_pfn_private(struct kvm_vcpu *vcpu,
>  				   struct kvm_page_fault *fault)
>  {
> diff --git a/arch/x86/kvm/mmu/mmu_internal.h b/arch/x86/kvm/mmu/mmu_internal.h
> index 0669a8a668ca..0eea6c5a824d 100644
> --- a/arch/x86/kvm/mmu/mmu_internal.h
> +++ b/arch/x86/kvm/mmu/mmu_internal.h
> @@ -279,6 +279,14 @@ enum {
>  	RET_PF_SPURIOUS,
>  };
>  
> +static inline void kvm_mmu_prepare_memory_fault_exit(struct kvm_vcpu *vcpu,
> +						     struct kvm_page_fault *fault)
> +{
> +	kvm_prepare_memory_fault_exit(vcpu, fault->gfn << PAGE_SHIFT,
> +				      PAGE_SIZE, fault->write, fault->exec,
> +				      fault->is_private);
> +}
> +
>  static inline int kvm_mmu_do_page_fault(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa,
>  					u32 err, bool prefetch, int *emulation_type)
>  {
> @@ -320,6 +328,11 @@ static inline int kvm_mmu_do_page_fault(struct kvm_vcpu *vcpu, gpa_t cr2_or_gpa,
>  	else
>  		r = vcpu->arch.mmu->page_fault(vcpu, &fault);
>  
> +	if (r == RET_PF_EMULATE && fault.is_private) {
Should we just check VM type + RET_PF_EMULATE, and abort?
If r is RET_PF_EMULATE, and fault is caused by accesing a shared address,
the emulation code could still meet error if guest page table pages are in
private memory, right?

> +		kvm_mmu_prepare_memory_fault_exit(vcpu, &fault);
> +		return -EFAULT;
> +	}
> +
>  	if (fault.write_fault_to_shadow_pgtable && emulation_type)
>  		*emulation_type |= EMULTYPE_WRITE_PF_TO_SP;
>  
> -- 
> 2.44.0.278.ge034bb2e1d-goog
>