From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B9F7BC43461 for ; Tue, 6 Apr 2021 10:50:26 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 11FDC613CB for ; Tue, 6 Apr 2021 10:50:25 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 11FDC613CB Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linux.intel.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 46FE26B007E; Tue, 6 Apr 2021 06:50:25 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 41E436B0080; Tue, 6 Apr 2021 06:50:25 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 2BF2D6B0081; Tue, 6 Apr 2021 06:50:25 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0183.hostedemail.com [216.40.44.183]) by kanga.kvack.org (Postfix) with ESMTP id 111F66B007E for ; Tue, 6 Apr 2021 06:50:25 -0400 (EDT) Received: from smtpin37.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay04.hostedemail.com (Postfix) with ESMTP id C6F5512CA for ; Tue, 6 Apr 2021 10:50:24 +0000 (UTC) X-FDA: 78001623168.37.7ED5096 Received: from mga07.intel.com (mga07.intel.com [134.134.136.100]) by imf08.hostedemail.com (Postfix) with ESMTP id 5BEB480192E5 for ; Tue, 6 Apr 2021 10:50:17 +0000 (UTC) IronPort-SDR: /HkZT/1u9LtUZ+Ud3ya4AyNscai7x/7jUkjKfRjp2NOczCkFHLiDlYDRqHty3v624KpIVmm618 OrkaF+Zro1Mw== X-IronPort-AV: E=McAfee;i="6000,8403,9945"; a="257025866" X-IronPort-AV: E=Sophos;i="5.81,309,1610438400"; d="scan'208";a="257025866" Received: from fmsmga007.fm.intel.com ([10.253.24.52]) by orsmga105.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 06 Apr 2021 03:50:21 -0700 IronPort-SDR: 8/Y2cr+OADla4TLlnAo6H5OCCTBNzsA8FTkB09gdeAgSuSL4k7U5bXGW5oOw1M/hz7Yw5EhgYD Y9x0mvzOWZuw== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.81,309,1610438400"; d="scan'208";a="386530847" Received: from black.fi.intel.com ([10.237.72.28]) by fmsmga007.fm.intel.com with ESMTP; 06 Apr 2021 03:50:10 -0700 Received: by black.fi.intel.com (Postfix, from userid 1000) id A3A4629D; Tue, 6 Apr 2021 13:50:24 +0300 (EEST) Date: Tue, 6 Apr 2021 13:50:24 +0300 From: "Kirill A. Shutemov" To: David Hildenbrand Cc: "Kirill A. Shutemov" , Dave Hansen , Andy Lutomirski , Peter Zijlstra , Sean Christopherson , Jim Mattson , David Rientjes , "Edgecombe, Rick P" , "Kleen, Andi" , "Yamahata, Isaku" , x86@kernel.org, kvm@vger.kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: Re: [RFCv1 7/7] KVM: unmap guest memory using poisoned pages Message-ID: <20210406105024.ikz5fbozwu476yba@black.fi.intel.com> References: <20210402152645.26680-1-kirill.shutemov@linux.intel.com> <20210402152645.26680-8-kirill.shutemov@linux.intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Rspamd-Server: rspam03 X-Rspamd-Queue-Id: 5BEB480192E5 X-Stat-Signature: byq4qd6bw1grdysk8kktq7majb4hcbwx Received-SPF: none (linux.intel.com>: No applicable sender policy available) receiver=imf08; identity=mailfrom; envelope-from=""; helo=mga07.intel.com; client-ip=134.134.136.100 X-HE-DKIM-Result: none/none X-HE-Tag: 1617706217-743473 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Tue, Apr 06, 2021 at 09:44:07AM +0200, David Hildenbrand wrote: > On 02.04.21 17:26, Kirill A. Shutemov wrote: > > TDX architecture aims to provide resiliency against confidentiality and > > integrity attacks. Towards this goal, the TDX architecture helps enforce > > the enabling of memory integrity for all TD-private memory. > > > > The CPU memory controller computes the integrity check value (MAC) for > > the data (cache line) during writes, and it stores the MAC with the > > memory as meta-data. A 28-bit MAC is stored in the ECC bits. > > > > Checking of memory integrity is performed during memory reads. If > > integrity check fails, CPU poisones cache line. > > > > On a subsequent consumption (read) of the poisoned data by software, > > there are two possible scenarios: > > > > - Core determines that the execution can continue and it treats > > poison with exception semantics signaled as a #MCE > > > > - Core determines execution cannot continue,and it does an unbreakable > > shutdown > > > > For more details, see Chapter 14 of Intel TDX Module EAS[1] > > > > As some of integrity check failures may lead to system shutdown host > > kernel must not allow any writes to TD-private memory. This requirment > > clashes with KVM design: KVM expects the guest memory to be mapped into > > host userspace (e.g. QEMU). > > So what you are saying is that if QEMU would write to such memory, it could > crash the kernel? What a broken design. Cannot disagree. #MCE for integrity check is very questionable. But I'm not CPU engineer. > "As some of integrity check failures may lead to system shutdown host" -- > usually we expect to recover from an MCE by killing the affected process, > which would be the right thing to do here. In the most cases that's what happen. > How can it happen that "Core determines execution cannot continue,and it > does an unbreakable shutdown". Who is "Core"? CPU "core", MM "core" ? CPU core. > And why would it decide to do a shutdown instead of just killing the > process? If the CPU handles long flow instruction (involves microcode and doing multiple memory accesses), consuming poison somewhere in the middle leads to CPU not being able to get back into sane state and the only option is system shutdown. -- Kirill A. Shutemov