From: Steven Price <steven.price@arm.com>
To: Andrew Jones <drjones@redhat.com>
Cc: Peter Maydell <Peter.Maydell@arm.com>,
Juan Quintela <quintela@redhat.com>,
Catalin Marinas <catalin.marinas@arm.com>,
Richard Henderson <richard.henderson@linaro.org>,
qemu-devel@nongnu.org, linux-kernel@vger.kernel.org,
linux-arm-kernel@lists.infradead.org,
Marc Zyngier <maz@kernel.org>,
Thomas Gleixner <tglx@linutronix.de>,
Will Deacon <will@kernel.org>,
kvmarm@lists.cs.columbia.edu,
"Dr. David Alan Gilbert" <dgilbert@redhat.com>,
Dave Martin <Dave.Martin@arm.com>
Subject: Re: [PATCH v2 0/2] MTE support for KVM guest
Date: Thu, 10 Sep 2020 15:14:47 +0100 [thread overview]
Message-ID: <17efa848-9bda-26b2-b70f-040c9fa3f2da@arm.com> (raw)
In-Reply-To: <20200910135618.cvnlrgvhuy3amv6s@kamzik.brq.redhat.com>
On 10/09/2020 14:56, Andrew Jones wrote:
> On Thu, Sep 10, 2020 at 10:21:04AM +0100, Steven Price wrote:
>> On 10/09/2020 07:29, Andrew Jones wrote:
>>> But if userspace created the memslots with memory already set with
>>> PROT_MTE, then this wouldn't be necessary, right? And, as long as
>>> there's still a way to access the memory with tag checking disabled,
>>> then it shouldn't be a problem.
>>
>> Yes, so one option would be to attempt to validate that the VMM has provided
>> memory pages with the PG_mte_tagged bit set (e.g. by mapping with PROT_MTE).
>> The tricky part here is that we support KVM_CAP_SYNC_MMU which means that
>> the VMM can change the memory backing at any time - so we could end up in
>> user_mem_abort() discovering that a page doesn't have PG_mte_tagged set - at
>> that point there's no nice way of handling it (other than silently upgrading
>> the page) so the VM is dead.
>>
>> So since enforcing that PG_mte_tagged is set isn't easy and provides a
>> hard-to-debug foot gun to the VMM I decided the better option was to let the
>> kernel set the bit automatically.
>>
>
> The foot gun still exists when migration is considered, no? If userspace
> is telling a guest it can use MTE on its normal memory, but then doesn't
> prepare that memory correctly, or remember to migrate the tags correctly
> (which requires knowing the memory has tags and knowing how to get them),
> then I guess the VM is in trouble one way or another.
Well not all VMMs support migration, and it's only migration that is
affected by this for a simple VMM (e.g. the changes to kvmtool are
minimal for MTE). But yes fundamentally if a VMM enables MTE it needs to
know how to deal with the extra tags everywhere.
> I feel like we should trust the VMM to ensure MTE will work on any memory
> the guest could use it on, and change the action in user_mem_abort() to
> abort the guest with a big error message if it sees the flag is missing.
I'm happy to change it, if you feel this is easier to debug.
>>>>>
>>>>> If userspace needs to write to guest memory then it should be due to
>>>>> a device DMA or other specific hardware emulation. Those accesses can
>>>>> be done with tag checking disabled.
>>>>
>>>> Yes, the question is can the VMM (sensibly) wrap the accesses with a
>>>> disable/renable tag checking for the process sequence. The alternative at
>>>> the moment is to maintain a separate (untagged) mapping for the purpose
>>>> which might present it's own problems.
>>>
>>> Hmm, so there's no easy way to disable tag checking when necessary? If we
>>> don't map the guest ram with PROT_MTE and continue setting the attribute
>>> in KVM, as this series does, then we don't need to worry about it tag
>>> checking when accessing the memory, but then we can't access the tags for
>>> migration.
>>
>> There's a "TCO" (Tag Check Override) bit in PSTATE which allows disabling
>> tag checking, so if it's reasonable to wrap accesses to the memory you can
>> simply set the TCO bit, perform the memory access and then unset TCO. That
>> would mean a single mapping with MTE enabled would work fine. What I don't
>> have a clue about is whether it's practical in the VMM to wrap guest
>> accesses like this.
>>
>
> At least QEMU goes through many abstractions to get to memory already.
> There may already be a hook we could use, if not, it probably wouldn't
> be too hard to add one (famous last words).
Sounds good. My hope was that the abstractions were already in there.
Thanks,
Steve
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next prev parent reply other threads:[~2020-09-10 14:17 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-04 16:00 [PATCH v2 0/2] MTE support for KVM guest Steven Price
2020-09-04 16:00 ` [PATCH v2 1/2] arm64: kvm: Save/restore MTE registers Steven Price
2020-09-04 16:00 ` [PATCH v2 2/2] arm64: kvm: Introduce MTE VCPU feature Steven Price
2020-09-09 15:48 ` Andrew Jones
2020-09-09 15:53 ` Peter Maydell
2020-09-10 6:38 ` Andrew Jones
2020-09-10 10:01 ` Andrew Jones
2020-09-10 9:21 ` Steven Price
2020-09-10 11:49 ` Andrew Jones
2020-09-07 15:28 ` [PATCH v2 0/2] MTE support for KVM guest Dr. David Alan Gilbert
2020-09-09 9:15 ` Steven Price
2020-09-09 15:25 ` Andrew Jones
2020-09-09 16:04 ` Steven Price
2020-09-10 6:29 ` Andrew Jones
2020-09-10 9:21 ` Steven Price
2020-09-10 13:56 ` Andrew Jones
2020-09-10 14:14 ` Steven Price [this message]
2020-09-10 1:45 ` Richard Henderson
2020-09-10 5:44 ` Andrew Jones
2020-09-10 13:27 ` Dr. David Alan Gilbert
2020-09-10 13:39 ` Andrew Jones
2020-09-10 0:33 ` Richard Henderson
2020-09-10 10:24 ` Steven Price
2020-09-10 15:36 ` Richard Henderson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=17efa848-9bda-26b2-b70f-040c9fa3f2da@arm.com \
--to=steven.price@arm.com \
--cc=Dave.Martin@arm.com \
--cc=Peter.Maydell@arm.com \
--cc=catalin.marinas@arm.com \
--cc=dgilbert@redhat.com \
--cc=drjones@redhat.com \
--cc=kvmarm@lists.cs.columbia.edu \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=maz@kernel.org \
--cc=qemu-devel@nongnu.org \
--cc=quintela@redhat.com \
--cc=richard.henderson@linaro.org \
--cc=tglx@linutronix.de \
--cc=will@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).