From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f52.google.com (mail-pj1-f52.google.com [209.85.216.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 561A52C86 for ; Sat, 13 Nov 2021 00:00:44 +0000 (UTC) Received: by mail-pj1-f52.google.com with SMTP id gt5so7996442pjb.1 for ; Fri, 12 Nov 2021 16:00:44 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20210112; h=date:from:to:cc:subject:message-id:references:mime-version :content-disposition:in-reply-to; bh=/T22u9uiXYSbjw4vUr/c0mCt/SzIILWdyE5tNdh2BGw=; b=VhQZsgvI1uZu/qRt1rBhl5uQ6ruHuXkwfFJUbOu/8oflm8Y8IjTfdrFpF5l4XDHMfw hNujv6cx9lgJ/C687c0csRkaZMgbMie5C4wI4UJn+h3SunYyBWEiUavPrYnyyBmgmypl U1v0ayQcKxxOxnWtaehUJOJ94L9U6hqLQBpJ1UKCUvsSfWv4j7QA2BzyLC2R76HJhpCp jH8Y7lsynNB8tRXk59LIf6m0nHpYJWaX7L/79Et5TybhPnccFu33hBQUB2JKrxjsWxoh hUaykcrY5mFgXt/znGHUGIqrt8hSXn/SZ318s9vC+/0BLbMS9RCdUVDk542SlhCeEoey k3xQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to; bh=/T22u9uiXYSbjw4vUr/c0mCt/SzIILWdyE5tNdh2BGw=; b=CAji6u0dzlHOPMKMaUlVkLFR/vfXsaZ22yi2G9na71mF9vx70btjqRYIhy3/Z3HtPv hcchTn0rRkCQQi9baxqiiwtHhZd3fPU4sdVCFsMpGDR27eMXgknKIapsQ1+zKEFVNdL1 ouMOLXGdh3DL7EKVhZhOW8IJXrRUYTxcUX73Fbd+3IfnUJS/ZEkcCYL5XyHnMn548nGE OAVqxf/pkfnNrbW53+fJVgPiHWMWN2+DjQWkmo6j6wyBNrcmzzCvLw2/ijbyGSyzQfAs pJnEVYKN4GHkdUgAYV1n6pFc3mwK4XtCIUTyzY9gVbTPFtVhLtNZ9vn5ukdskDHnLRV/ M8NA== X-Gm-Message-State: AOAM532QhrRotgVpUblKYbWpQyGnttvSDZGGSR0juoO9FQtBaIe38WbW aXj+4t0dFf96irMPqGeWMtplCg== X-Google-Smtp-Source: ABdhPJw0L5nRV7A2TEQulq2d+qnpOxthRLSY8VdwXH4zCv0Xvd9k+FIidmAI6gWHtGbettKqVbDWxQ== X-Received: by 2002:a17:90b:1bcf:: with SMTP id oa15mr41527726pjb.161.1636761643547; Fri, 12 Nov 2021 16:00:43 -0800 (PST) Received: from google.com (157.214.185.35.bc.googleusercontent.com. [35.185.214.157]) by smtp.gmail.com with ESMTPSA id l6sm8544982pfc.126.2021.11.12.16.00.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 12 Nov 2021 16:00:42 -0800 (PST) Date: Sat, 13 Nov 2021 00:00:38 +0000 From: Sean Christopherson To: Peter Gonda Cc: Borislav Petkov , Dave Hansen , Brijesh Singh , x86@kernel.org, linux-kernel@vger.kernel.org, kvm@vger.kernel.org, linux-coco@lists.linux.dev, linux-mm@kvack.org, linux-crypto@vger.kernel.org, Thomas Gleixner , Ingo Molnar , Joerg Roedel , Tom Lendacky , "H. Peter Anvin" , Ard Biesheuvel , Paolo Bonzini , Vitaly Kuznetsov , Wanpeng Li , Jim Mattson , Andy Lutomirski , Dave Hansen , Sergio Lopez , Peter Zijlstra , Srinivas Pandruvada , David Rientjes , Dov Murik , Tobin Feldman-Fitzthum , Michael Roth , Vlastimil Babka , "Kirill A . Shutemov" , Andi Kleen , tony.luck@intel.com, marcorr@google.com, sathyanarayanan.kuppuswamy@linux.intel.com Subject: Re: [PATCH Part2 v5 00/45] Add AMD Secure Nested Paging (SEV-SNP) Hypervisor Support Message-ID: References: <20210820155918.7518-1-brijesh.singh@amd.com> <061ccd49-3b9f-d603-bafd-61a067c3f6fa@intel.com> Precedence: bulk X-Mailing-List: linux-coco@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: On Fri, Nov 12, 2021, Peter Gonda wrote: > On Fri, Nov 12, 2021 at 1:55 PM Borislav Petkov wrote: > > > > On Fri, Nov 12, 2021 at 08:37:59PM +0000, Sean Christopherson wrote: > > > Let userspace decide what is mapped shared and what is mapped private. > > > > With "userspace", you mean the *host* userspace? Yep. > > > The kernel and KVM provide the APIs/infrastructure to do the actual > > > conversions in a thread-safe fashion and also to enforce the current > > > state, but userspace is the control plane. > > > > > > It would require non-trivial changes in userspace if there are multiple processes > > > accessing guest memory, e.g. Peter's networking daemon example, but it _is_ fully > > > solvable. The exit to userspace means all three components (guest, kernel, > > > and userspace) have full knowledge of what is shared and what is private. There > > > is zero ambiguity: > > > > > > - if userspace accesses guest private memory, it gets SIGSEGV or whatever. > > > > That SIGSEGV is generated by the host kernel, I presume, after it checks > > whether the memory belongs to the guest? Yep. > > > - if kernel accesses guest private memory, it does BUG/panic/oops[*] > > > > If *it* is the host kernel, then you probably shouldn't do that - > > otherwise you just killed the host kernel on which all those guests are > > running. > > I agree, it seems better to terminate the single guest with an issue. > Rather than killing the host (and therefore all guests). So I'd > suggest even in this case we do the 'convert to shared' approach or > just outright terminate the guest. > > Are there already examples in KVM of a KVM bug in servicing a VM's > request results in a BUG/panic/oops? That seems not ideal ever. Plenty of examples. kvm_spurious_fault() is the obvious one. Any NULL pointer deref will lead to a BUG, etc... And it's not just KVM, e.g. it's possible, if unlikely, for the core kernel to run into guest private memory (e.g. if the kernel botches an RMP change), and if that happens there's no guarantee that the kernel can recover. I fully agree that ideally KVM would have a better sense of self-preservation, but IMO that's an orthogonal discussion.