Cc:     brijesh.singh@amd.com, Dave Hansen <dave.hansen@intel.com>,
        Peter Gonda <pgonda@google.com>, x86@kernel.org,
        linux-kernel@vger.kernel.org, kvm@vger.kernel.org,
        linux-coco@lists.linux.dev, linux-mm@kvack.org,
        linux-crypto@vger.kernel.org, Thomas Gleixner <tglx@linutronix.de>,
        Ingo Molnar <mingo@redhat.com>, Joerg Roedel <jroedel@suse.de>,
        Tom Lendacky <Thomas.Lendacky@amd.com>,
        "H. Peter Anvin" <hpa@zytor.com>, Ard Biesheuvel <ardb@kernel.org>,
        Paolo Bonzini <pbonzini@redhat.com>,
        Vitaly Kuznetsov <vkuznets@redhat.com>,
        Wanpeng Li <wanpengli@tencent.com>,
        Jim Mattson <jmattson@google.com>,
        Andy Lutomirski <luto@kernel.org>,
        Dave Hansen <dave.hansen@linux.intel.com>,
        Sergio Lopez <slp@redhat.com>,
        Peter Zijlstra <peterz@infradead.org>,
        Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>,
        David Rientjes <rientjes@google.com>,
        Dov Murik <dovmurik@linux.ibm.com>,
        Tobin Feldman-Fitzthum <tobin@ibm.com>,
        Michael Roth <michael.roth@amd.com>,
        Vlastimil Babka <vbabka@suse.cz>,
        "Kirill A . Shutemov" <kirill@shutemov.name>,
        Andi Kleen <ak@linux.intel.com>, tony.luck@intel.com,
        marcorr@google.com, sathyanarayanan.kuppuswamy@linux.intel.com
Subject: Re: [PATCH Part2 v5 00/45] Add AMD Secure Nested Paging (SEV-SNP)
 Hypervisor Support
To:     Sean Christopherson <seanjc@google.com>,
        Borislav Petkov <bp@alien8.de>
References: <20210820155918.7518-1-brijesh.singh@amd.com>
 <CAMkAt6o0ySn1=iLYsH0LCnNARrUbfaS0cvtxB__y_d+Q6DUzfA@mail.gmail.com>
 <061ccd49-3b9f-d603-bafd-61a067c3f6fa@intel.com> <YY6z5/0uGJmlMuM6@zn.tnic>
 <YY7FAW5ti7YMeejj@google.com> <YY7I6sgqIPubTrtA@zn.tnic>
 <YY7Qp8c/gTD1rT86@google.com>
From:   Brijesh Singh <brijesh.singh@amd.com>
Message-ID: <f2edf71e-f3b5-f8e3-a75e-e0f811fe6a14@amd.com>
Date:   Mon, 15 Nov 2021 10:18:16 -0600
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.13.0
In-Reply-To: <YY7Qp8c/gTD1rT86@google.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?Y3hsT1ZYTnRQRXFSUFpPY25mT1pNQmQrVldpdHZic0xWK05FL25NdFpGcnpm?=
 =?utf-8?B?NlJyaFdCa2hycWpnWUtFdjI0MlhkQXJLSmxkTElDeitoU04zZEYxR2pKTzBS?=
 =?utf-8?B?NG1YYm52L1kvRGNIK0tlMVc5TzZRMFJiT0VSNmRpdFJ2Nis2NDFHcGFGdXE4?=
 =?utf-8?B?c0FvYnV2ajBrbUF6MGsvcE1XakRqaWdVQlFzZnVKaWFMd2lTK2Ywei9odEJ4?=
 =?utf-8?B?dlJCTXlYOGtuRTNkb0dZb1ZkMkFPMFFCZkhxUlFaV0NzR0dGWEdhYTY4UTdi?=
 =?utf-8?B?dVl4eEdrWVp3dWtBUU9yS09RdmZ1NGI2akpUbmNhQ3VBaG0xY3lrSnU3L2ho?=
 =?utf-8?B?ZmhtQ0xjY2dSMkhXMW5XUFIxMDRsU2kwK09SUi9Ra3NRRk1nZ0F6bU14aUE1?=
 =?utf-8?B?ODFsZ2txMnE3ZWd0VlAxYW1hS0ZRaTl2TXcyU2FZYUlhS1QrWXpNZ0dTR2lo?=
 =?utf-8?B?akFaYS85MkVkWjNsTm5YYm9xcFhPTE1iYWpvZEhvbldCSUEzNEpuSjczTHZQ?=
 =?utf-8?B?SHRTUUlHS3dYME05VjJoRWFHeXhzS3VrQkp5WGhlekZlYWJLbmZRaUhibVFC?=
 =?utf-8?B?TGFIbTdocXozbHlHMnkzc0VZUHRXcnRjbHM1aHRUNzFVNmFkNHRSZmJyYVlu?=
 =?utf-8?B?ZWZha2ZDNktjK2l4akxrcjFhcHV6aGg1ZFdIa2hPNmdQblhkK09WRURvOHdm?=
 =?utf-8?B?cE1Tdi9tcmpnRnlaQzR2Q2RXTndOYmpmaHZtREdHZ2lOdS91TUVEUlVhT3ZF?=
 =?utf-8?B?MG5CTG1JZi8rUGNxZzIrMkFhek1rdmZDQnV0dzUyVDRpaXJrUXYxRHlreXhC?=
 =?utf-8?B?Qm5BTEJEeFRhcExFRm9oRDJFV2tWSkREQzJOSkFGZW1icFE0VzdrbDY4SVZt?=
 =?utf-8?B?cllNRGRrU0xQb3ZKeUdwc2J5R0cvaXFkZDBlS1pHSnZmR29mQVNwalNTSXZD?=
 =?utf-8?B?MzE3ZWNINkRaaFpETGNnZWRabFl0S0ZIWjhyNkJhNU9mdlBmNkIyRW5VcWJa?=
 =?utf-8?B?cER5ZUZKS1F2RFUxYU5KQW15UjZZNktyUU5JVnRIaCtYVUsxY0Fma2lvV283?=
 =?utf-8?B?Y2k0TmFQb2lQb1ZOVmZobGp4YmVGak1UVW1VN0E5Zytsd1I0dE8yWFFOdnBR?=
 =?utf-8?B?dERFUzdxbkVkTjNWMVErbFBoa3QwVzhVc0tnZ0Y2M0MxbGlwKzVueU5iWHJw?=
 =?utf-8?B?cURBRUxrVGxYaW1XWXNQRWZjNFZVVkhta2VSVEZDY0R4bm5EeWxaRXdBcVlL?=
 =?utf-8?B?eVBKaGNWRDNLWnA4bG1xYXExNmxHQkIyYUYweUxiY2d0eEZTUDNsVjdIa01O?=
 =?utf-8?B?SzV1bjhtUTZxaDJNVVVOVW5pOWcvendLZEh2dFVMRUZJUG5ZYXNNR3NVdllj?=
 =?utf-8?B?eC9KWDlta1dZZ2tFR25OdWsyZWIyVEs5RWloL09OSEVkb1lrUnRkajR0L2RD?=
 =?utf-8?B?K1dqend2c2twOHZBQ3pLREVHNFdBY3lvNTdlY2xpUlNaUlNuK1hxbnU5Ykx6?=
 =?utf-8?B?Z1BJNXB6emZ5cTBITXplSS92d3FIRU5hYUpFSkFNMTc4NlYvcXdVckJhK0Z6?=
 =?utf-8?B?QVFrdUdwbXNaZG05R3c2VXBPa20zYmR5ZVZzblpDa1gxWExjWTJ6NDVRWmxz?=
 =?utf-8?B?NXhibzRFeE9nTmxMRVYrblZOWXNoaFA1cWJXdEl5ZGY4ejQ3MFVtOGlZSzlN?=
 =?utf-8?B?Sm1tclhzZ1kydWFjYnRhV0NRZUZpckZXR25USWUvbVRyU3l1VzFxaFlzckY0?=
 =?utf-8?B?dExhTjJOcGZhWEZPU09qTFhQRmpDcGdqV2YyS3FGTW0zZmZUTU5ZL0VxZzNO?=
 =?utf-8?B?YnN3Nm5MRFptM0Q3dGdUREdoU00vZDZLRUlPdzVIV1JVMUtncDJheFhuN2Za?=
 =?utf-8?B?SFRORFllSm41VjlqZnlTMlR1Q0RwVWtpZy9HWDVieG1XSTRpZjlZcUJzN2pj?=
 =?utf-8?B?N0JxRjViNG5Oek1JVzlwRTVMalZmSGhQV0VXTkpVTWx6dGYzZEMwU0RyZy9I?=
 =?utf-8?B?UVdmWlRGWnljZFFkb1poTHNYb3YyeXVoOXdPMGtkSW1Pa2cySEZWemNSdWRO?=
 =?utf-8?B?dkVyNitQa0IxbGpqSFJ3dCtOUEJ1Wlgrdm9HeDRoTHlGOStSMVZJaElMcURv?=
 =?utf-8?B?QU9Mb085OWhiWjFzSE9Sd2pYYlV2VXhJVTBPMDVhY3RQSG5tN25qbFVtZDJa?=
 =?utf-8?Q?UAwOsJyjwQTaO7zTAzMigbA=3D?=
X-OriginatorOrg: amd.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 94e6f560-b357-417a-91e5-08d9a8538b09
X-MS-Exchange-CrossTenant-AuthSource: SN6PR12MB2718.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 Nov 2021 16:18:21.9826
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: vhtTEh24lBUgAlfTI9N+vqElHQYsIDpGSrVUsKqkFj5f7JQw3+92mlyV91mJgOXw4r7uoGO6iDC/6XQSUSyZ5w==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR12MB2638
Precedence: bulk
List-ID: <linux-crypto.vger.kernel.org>
X-Mailing-List: linux-crypto@vger.kernel.org


On 11/12/21 2:37 PM, Sean Christopherson wrote:
> On Fri, Nov 12, 2021, Borislav Petkov wrote:
>> On Fri, Nov 12, 2021 at 07:48:17PM +0000, Sean Christopherson wrote:
>>> Yes, but IMO inducing a fault in the guest because of _host_ bug is wrong.
>>

In the automatic change proposal, both the the host and a guest bug will 
cause a guest to get the #VC and then the guest can decide whether it 
wants to proceed or terminate. If it chooses to move, it can poison the 
page and log it for future examination.

>> What do you suggest instead?
> 
> Let userspace decide what is mapped shared and what is mapped private.  The kernel
> and KVM provide the APIs/infrastructure to do the actual conversions in a thread-safe
> fashion and also to enforce the current state, but userspace is the control plane.
> 
> It would require non-trivial changes in userspace if there are multiple processes
> accessing guest memory, e.g. Peter's networking daemon example, but it _is_ fully
> solvable.  The exit to userspace means all three components (guest, kernel,
> and userspace) have full knowledge of what is shared and what is private.  There
> is zero ambiguity:
> 
>    - if userspace accesses guest private memory, it gets SIGSEGV or whatever.
>    - if kernel accesses guest private memory, it does BUG/panic/oops[*]
>    - if guest accesses memory with the incorrect C/SHARED-bit, it gets killed.
> 
> This is the direction KVM TDX support is headed, though it's obviously still a WIP.
> 

Just curious, in this approach, how do you propose handling the host 
kexec/kdump? If a kexec/kdump occurs while the VM is still active, the 
new kernel will encounter the #PF (RMP violation) because some pages are 
still marked 'private' in the RMP table.


> And ideally, to avoid implicit conversions at any level, hardware vendors' ABIs
> define that:
> 
>    a) All convertible memory, i.e. RAM, starts as private.
>    b) Conversions between private and shared must be done via explicit hypercall.
> 
> Without (b), userspace and thus KVM have to treat guest accesses to the incorrect
> type as implicit conversions.
> 
> [*] Sadly, fully preventing kernel access to guest private is not possible with
>      TDX, especially if the direct map is left intact.  But maybe in the future
>      TDX will signal a fault instead of poisoning memory and leaving a #MC mine.
> 

thanks