Received: by 2002:a05:6358:489b:b0:bb:da1:e618 with SMTP id x27csp8157245rwn; Wed, 14 Sep 2022 09:45:45 -0700 (PDT) X-Google-Smtp-Source: AA6agR5JMSlEnCWL5OXKyoJSO2O5ZWjq9CQmqVO1vK9SgTPX/uqPEkovZrA0J29TcbUIyxTLAfZg X-Received: by 2002:a05:6402:194e:b0:452:5f30:7b03 with SMTP id f14-20020a056402194e00b004525f307b03mr7692056edz.124.1663173945189; Wed, 14 Sep 2022 09:45:45 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1663173945; cv=none; d=google.com; s=arc-20160816; b=bLI4mY1h8Bpg6fpOcAZhztVceN34+Olio8wEwy8DjPueaEqSKS+LrQ589as64wmoD+ XteCBmJjHopVnH7ZSBF7Gf9sTjrHQuRPkBxWEdMzLh+eCs/NpOlLgzphMHmFU0iF+SRk bHsoC/omMfrobBcQdf4TxOUfzlBfaWfC/Xafl0muCsYqwQobHwpiHysNXnj/AalCVFIn Bg2z8kWU4QoDQK/xnNuwwmUeA4v/PBR6MDL5kBsoXAQk5ICaKflrsahlMXIoCH6buLcB acyQOK4GWMNqC4UvCtqFct1RsbC+pEfDqauKTUBF/kvcv4xZhzbP5O5n1xbMbH5iWG/5 ly9g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:cc:to:subject:message-id:date:from:in-reply-to :references:mime-version:dkim-signature; bh=qw5c1rQO9auXlb1weto/2p+w4wwBPYYtzhiHNjVL//I=; b=flw9Xbbzv1mFbTFLPJHZyrCzmVRkvaaTjCv5OGvitA/qWkhwkfs2TTvXVwVG5aGp9f jrBoLMiOyRcXlPaVLk/Vz0hZNtCa1F5diFKtEr43usFkl17M2TUUyBkpt9WJ5cvvAMXy U78YBDNABA6+yRsXaJWN/W/rnFDFXCfAJUenmGJJmhL2XSM9yyJk+sCki8sIlDUdCe0O sBatShSCcugq0/X4hJtaYEPHiW4rDvf7romBcUmfXSBzo/luYUr8GtSQ3KOQhU99wrzu Li+cuzHd14jiUIxun86N2v92fp+c/eyrFSjLW/vYOzc+GJcymD2BIg0OxVTx1Hywav/+ YYJw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@google.com header.s=20210112 header.b=OAZPO49R; spf=pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-crypto-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id gs12-20020a1709072d0c00b0073d6276b00fsi13638672ejc.704.2022.09.14.09.45.20; Wed, 14 Sep 2022 09:45:45 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@google.com header.s=20210112 header.b=OAZPO49R; spf=pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-crypto-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=google.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229748AbiINQje (ORCPT + 99 others); Wed, 14 Sep 2022 12:39:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35190 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229523AbiINQjc (ORCPT ); Wed, 14 Sep 2022 12:39:32 -0400 Received: from mail-yw1-x1134.google.com (mail-yw1-x1134.google.com [IPv6:2607:f8b0:4864:20::1134]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BFDA7D87 for ; Wed, 14 Sep 2022 09:39:29 -0700 (PDT) Received: by mail-yw1-x1134.google.com with SMTP id 00721157ae682-346cd4c3d7aso187262817b3.8 for ; Wed, 14 Sep 2022 09:39:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date; bh=qw5c1rQO9auXlb1weto/2p+w4wwBPYYtzhiHNjVL//I=; b=OAZPO49RrJRJ1iDc42pcPY8eoQOr9U6LI/jzWl/t/qHJGAwMcmrdHEHcTpZAoEhple vmC5s4DomwuO1+aqLB8TMmpmXa4+GKx8HHg3AY/pPl/n26W8L7+GLOtWsIv2AVaWwP4Z ZQNaQeralnxC2np7lvsaONpxNi6tvum3IDZggIXPXTJp9vOigUhfQMvo1WFRSQ0ovgeY ysF+7Rn8+Te/7o66UPvqNQsZr8wJVkRGpZa/Wk186u5fYhn8lQ0jDLw/f7B7H6UMAQRs exEGbIfuANJwGK8IU+YFusPFqhFGXGudweKXCFkCPqfbQuIl49QspG/wobLqsnBjfOE1 UjPA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date; bh=qw5c1rQO9auXlb1weto/2p+w4wwBPYYtzhiHNjVL//I=; b=lOkzP34NtPTeLDrgvO8hBPXXwuW5da+7eppb7SDxbrwcFFb/4L3Vo3sOdpRjXn12KA wD5gL7JtAqfgB1STC3LA6pCGbT7MvnTig29bzj2p5o4mfx++L7LZP0WIzIbQ13TDeMVo Nk3gN9z7vmSGZTnOe/0e/o8lfZ6aphrSzxD7GOzZcO9rcCidQBZyXqrq3w2mtQwFcyJM aAzB6dEHg9Zl1ixwFA5GwQLsUgUWA+oIJlHJQ5hVQhznjdGK8BKYcqTX+XK1IB6Tprbf ALOSWkoV3JhWwvWihibOfmHGHX2FzQ/twGf+aaHKdEsPD6ZpJ9Bq6T+cvIHzJ2QbTBWP kFWw== X-Gm-Message-State: ACgBeo1AJhh6EmfP4QJDbs5PwcwR/okZeovipBjNAlIqPHKRsy3yWVKS bTdSgnFnpfRqW9zmkL00Aghqy9TOW8ln70FiUlpy6g== X-Received: by 2002:a81:c30a:0:b0:328:4a6c:bc89 with SMTP id r10-20020a81c30a000000b003284a6cbc89mr31170890ywk.29.1663173568737; Wed, 14 Sep 2022 09:39:28 -0700 (PDT) MIME-Version: 1.0 References: <20210820155918.7518-1-brijesh.singh@amd.com> <20210820155918.7518-40-brijesh.singh@amd.com> <4e41dcff-7c7b-cf36-434a-c7732e7e8ff2@amd.com> <20220908212114.sqne7awimfwfztq7@amd.com> In-Reply-To: From: Marc Orr Date: Wed, 14 Sep 2022 17:39:18 +0100 Message-ID: Subject: Re: [PATCH Part2 v5 39/45] KVM: SVM: Introduce ops for the post gfn map and unmap To: Sean Christopherson Cc: Michael Roth , Brijesh Singh , x86 , LKML , kvm list , linux-coco@lists.linux.dev, Linux Memory Management List , Linux Crypto Mailing List , Thomas Gleixner , Ingo Molnar , Joerg Roedel , Tom Lendacky , "H. Peter Anvin" , Ard Biesheuvel , Paolo Bonzini , Vitaly Kuznetsov , Wanpeng Li , Jim Mattson , Andy Lutomirski , Dave Hansen , Sergio Lopez , Peter Gonda , Peter Zijlstra , Srinivas Pandruvada , David Rientjes , Dov Murik , Tobin Feldman-Fitzthum , Borislav Petkov , Vlastimil Babka , "Kirill A . Shutemov" , Andi Kleen , Tony Luck , Sathyanarayanan Kuppuswamy , jarkko@profian.com Content-Type: text/plain; charset="UTF-8" X-Spam-Status: No, score=-17.6 required=5.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF, ENV_AND_HDR_SPF_MATCH,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS, T_SCC_BODY_TEXT_LINE,USER_IN_DEF_DKIM_WL,USER_IN_DEF_SPF_WL autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org On Wed, Sep 14, 2022 at 5:32 PM Marc Orr wrote: > > On Wed, Sep 14, 2022 at 5:15 PM Sean Christopherson wrote: > > > > On Wed, Sep 14, 2022, Marc Orr wrote: > > > On Wed, Sep 14, 2022 at 9:05 AM Sean Christopherson wrote: > > > > > > > > On Thu, Sep 08, 2022, Michael Roth wrote: > > > > > On Fri, Oct 15, 2021 at 05:16:28PM +0000, Sean Christopherson wrote: > > > > > So in the context of this interim solution, we're trying to look for a > > > > > solution that's simple enough that it can be used reliably, without > > > > > introducing too much additional complexity into KVM. There is one > > > > > approach that seems to fit that bill, that Brijesh attempted in an > > > > > earlier version of this series (I'm not sure what exactly was the > > > > > catalyst to changing the approach, as I wasn't really in the loop at > > > > > the time, but AIUI there weren't any showstoppers there, but please > > > > > correct me if I'm missing anything): > > > > > > > > > > - if the host is writing to a page that it thinks is supposed to be > > > > > shared, and the guest switches it to private, we get an RMP fault > > > > > (actually, we will get a !PRESENT fault, since as of v5 we now > > > > > remove the mapping from the directmap as part of conversion) > > > > > - in the host #PF handler, if we see that the page is marked private > > > > > in the RMP table, simply switch it back to shared > > > > > - if this was a bug on the part of the host, then the guest will see > > > > > > > > As discussed off-list, attempting to fix up RMP violations in the host #PF handler > > > > is not a viable approach. There was also extensive discussion on-list a while back: > > > > > > > > https://lore.kernel.org/all/8a244d34-2b10-4cf8-894a-1bf12b59cf92@www.fastmail.com > > > > > > I mentioned this during Mike's talk at the micro-conference: For pages > > > mapped in by the kernel can we disallow them to be converted to > > > private? > > > > In theory, yes. Do we want to do something like this? No. kmap() does something > > vaguely similar for 32-bit PAE/PSE kernels, but that's a lot of complexity and > > overhead to take on. And this issue goes far beyond a kmap(); when the kernel gup()s > > a page, the kernel expects the pfn to be available, no exceptions (pun intended). > > > > > Note, userspace accesses are already handled by UPM. > > > > I'm confused by the UPM comment. Isn't the gist of this thread about the ability > > to merge SNP _without_ UPM? Or am I out in left field? > > I think that was the overall gist: yes. But it's not what I was trying > to comment on :-). > > HOWEVER, thinking about this more: I was confused when I wrote out my > last reply. I had thought that the issue that Michael brought up > applied even with UPM. That is, I was thinking it was still possibly > for a guest to maliciously convert a page to private mapped in by the > kernel and assumed to be shared. > > But I now realize that is not what will actually happen. To be > concrete, let's assume the GHCB page. What will happen is: > - KVM has GHCB page mapped in. GHCB is always assumed to be shared. So > far so good. > - Malicious guest converts GHCB page to private (e.g., via Page State > Change request) > - Guest exits to KVM > - KVM exits to userspace VMM > - Userspace VM allocates page in private FD. > > Now, what happens here depends on how UPM works. If we allow double > allocation then our host kernel is safe. However, now we have the > "double allocation problem". > > If on the other hand, we deallocate the page in the shared FD, the > host kernel can segfault. And now we actually do have essentially the > same problem Michael was describing that we have without UPM. Because > we'll end up in fault.c in the kernel context and likely panic the > host. Thinking about this even more... Even if we deallocate in the userspace VMM's shared FD, the kernel has its own page tables -- right? So maybe we are actually 100% OK under UPM then regardless of the userspace VMM's policy around managing the private and shared FDs.