From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-0.8 required=3.0 tests=DKIM_INVALID,DKIM_SIGNED, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5F1B8C433E0 for ; Thu, 4 Jun 2020 16:27:41 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 248D220835 for ; Thu, 4 Jun 2020 16:27:41 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=kernel.org header.i=@kernel.org header.b="MxtQ4iIJ" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 248D220835 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=kernel.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id A83DB80007; Thu, 4 Jun 2020 12:27:40 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id A35568E0006; Thu, 4 Jun 2020 12:27:40 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 94A5280007; Thu, 4 Jun 2020 12:27:40 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0133.hostedemail.com [216.40.44.133]) by kanga.kvack.org (Postfix) with ESMTP id 7D4C98E0006 for ; Thu, 4 Jun 2020 12:27:40 -0400 (EDT) Received: from smtpin25.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id AF0ABCA429 for ; Thu, 4 Jun 2020 16:27:39 +0000 (UTC) X-FDA: 76892060238.25.spark56_88d0f9249f50 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin25.hostedemail.com (Postfix) with ESMTP id 83DFA1804E940 for ; Thu, 4 Jun 2020 16:27:39 +0000 (UTC) X-HE-Tag: spark56_88d0f9249f50 X-Filterd-Recvd-Size: 5914 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by imf48.hostedemail.com (Postfix) with ESMTP for ; Thu, 4 Jun 2020 16:27:37 +0000 (UTC) Received: from disco-boy.misterjones.org (disco-boy.misterjones.org [51.254.78.96]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 8494B206E6; Thu, 4 Jun 2020 16:27:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591288056; bh=S/InZdO6ZGDXoUUOdS8+reiil89ywTIZT3qwWyRGzdA=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=MxtQ4iIJUJQsEL4elLYGFqRxB2hbDMaW0p6AfFk7rmu5mLrBe+x17urAdIhyJe7XR dZ6pMY78PGmOHv7ZBPgDOY7IhlTHSPZGZ+jc3dmu2mDG9esPXot2mFXcP6Ga2usK/5 ZSNMQtXae0NVKUtMJm+rQ+sK3U4tFOnxhRw12fHA= Received: from disco-boy.misterjones.org ([51.254.78.96] helo=www.loen.fr) by disco-boy.misterjones.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.92) (envelope-from ) id 1jgsiM-000IWN-U1; Thu, 04 Jun 2020 17:27:35 +0100 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; format=flowed Date: Thu, 04 Jun 2020 17:27:34 +0100 From: Marc Zyngier To: Sean Christopherson Cc: "Kirill A. Shutemov" , Dave Hansen , Andy Lutomirski , Peter Zijlstra , Paolo Bonzini , Vitaly Kuznetsov , Wanpeng Li , Jim Mattson , Joerg Roedel , David Rientjes , Andrea Arcangeli , Kees Cook , Will Drewry , "Edgecombe, Rick P" , "Kleen, Andi" , x86@kernel.org, kvm@vger.kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, "Kirill A. Shutemov" , kernel-team@android.com, will@kernel.org, Jun Nakajima Subject: Re: [RFC 00/16] KVM protected memory extension In-Reply-To: <20200604154835.GE30223@linux.intel.com> References: <20200522125214.31348-1-kirill.shutemov@linux.intel.com> <20200604161523.39962919@why> <20200604154835.GE30223@linux.intel.com> User-Agent: Roundcube Webmail/1.4.4 Message-ID: X-Sender: maz@kernel.org X-SA-Exim-Connect-IP: 51.254.78.96 X-SA-Exim-Rcpt-To: sean.j.christopherson@intel.com, kirill@shutemov.name, dave.hansen@linux.intel.com, luto@kernel.org, peterz@infradead.org, pbonzini@redhat.com, vkuznets@redhat.com, wanpengli@tencent.com, jmattson@google.com, joro@8bytes.org, rientjes@google.com, aarcange@redhat.com, keescook@chromium.org, wad@chromium.org, rick.p.edgecombe@intel.com, andi.kleen@intel.com, x86@kernel.org, kvm@vger.kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, kirill.shutemov@linux.intel.com, kernel-team@android.com, will@kernel.org, jun.nakajima@intel.com X-SA-Exim-Mail-From: maz@kernel.org X-SA-Exim-Scanned: No (on disco-boy.misterjones.org); SAEximRunCond expanded to false X-Rspamd-Queue-Id: 83DFA1804E940 X-Spamd-Result: default: False [0.00 / 100.00] X-Rspamd-Server: rspam04 Content-Transfer-Encoding: quoted-printable X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: Hi Sean, On 2020-06-04 16:48, Sean Christopherson wrote: > +Jun >=20 > On Thu, Jun 04, 2020 at 04:15:23PM +0100, Marc Zyngier wrote: >> Hi Kirill, >>=20 >> Thanks for this. >>=20 >> On Fri, 22 May 2020 15:51:58 +0300 >> "Kirill A. Shutemov" wrote: >>=20 >> > =3D=3D Background / Problem =3D=3D >> > >> > There are a number of hardware features (MKTME, SEV) which protect g= uest >> > memory from some unauthorized host access. The patchset proposes a p= urely >> > software feature that mitigates some of the same host-side read-only >> > attacks. >> > >> > >> > =3D=3D What does this set mitigate? =3D=3D >> > >> > - Host kernel =E2=80=9Daccidental=E2=80=9D access to guest data (th= ink speculation) >> > >> > - Host kernel induced access to guest data (write(fd, &guest_data_p= tr, len)) >> > >> > - Host userspace access to guest data (compromised qemu) >> > >> > =3D=3D What does this set NOT mitigate? =3D=3D >> > >> > - Full host kernel compromise. Kernel will just map the pages agai= n. >> > >> > - Hardware attacks >>=20 >> Just as a heads up, we (the Android kernel team) are currently >> involved in something pretty similar for KVM/arm64 in order to bring >> some level of confidentiality to guests. >>=20 >> The main idea is to de-privilege the host kernel by wrapping it in its >> own nested set of page tables which allows us to remove memory >> allocated to guests on a per-page basis. The core hypervisor runs more >> or less independently at its own privilege level. It still is KVM >> though, as we don't intend to reinvent the wheel. >>=20 >> Will has written a much more lingo-heavy description here: >> https://lore.kernel.org/kvmarm/20200327165935.GA8048@willie-the-truck/ >=20 > Pardon my arm64 ignorance... >=20 > IIUC, in this mode, the host kernel runs at EL1? And to switch to a=20 > guest > it has to bounce through EL2, which is KVM, or at least a chunk of KVM? > I assume the EL1->EL2->EL1 switch is done by trapping an exception of=20 > some > form? >=20 > If all of the above are "yes", does KVM already have the necessary=20 > logic to > perform the EL1->EL2->EL1 switches, or is that being added as part of=20 > the > de-privileging effort? KVM already handles the EL1->EL2->EL1 madness, meaning that from an exception level perspective, the host kernel is already a guest. It's just that this guest can directly change the hypervisor's text, its page tables, and muck with about everything else. De-privileging the memory access to non host EL1 memory is where the ongoing effort is. M. --=20 Jazz is not dead. It just smells funny...