From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.7 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,NICE_REPLY_A,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 84BE3C432BE for ; Wed, 1 Sep 2021 07:49:31 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 33ACD61075 for ; Wed, 1 Sep 2021 07:49:31 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 33ACD61075 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kvack.org Received: by kanga.kvack.org (Postfix) id CE7A96B0071; Wed, 1 Sep 2021 03:49:30 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id C97236B0072; Wed, 1 Sep 2021 03:49:30 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id B60178D0001; Wed, 1 Sep 2021 03:49:30 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0030.hostedemail.com [216.40.44.30]) by kanga.kvack.org (Postfix) with ESMTP id A88156B0071 for ; Wed, 1 Sep 2021 03:49:30 -0400 (EDT) Received: from smtpin27.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay01.hostedemail.com (Postfix) with ESMTP id 69D5E180DC496 for ; Wed, 1 Sep 2021 07:49:30 +0000 (UTC) X-FDA: 78538229700.27.6E260A3 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by imf19.hostedemail.com (Postfix) with ESMTP id E3DE5B000093 for ; Wed, 1 Sep 2021 07:49:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1630482569; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=QVyzY7plwjcHWFuBExDhEE+9lobSCXwllAQa8rm7VKg=; b=cMQqSNYWSfMIN0pWDgqb7WYYr9Dm1ifhyJ1/k4Lb01Z6oRyL1EBvVS5Gyi3GBbPYlH2vpD k1edxDVk3NfpO0ZmMLBqy6/tnlb5r3XEItMQP25TV9NWpz1kycWmZmkId9YmqgbF5W2C7u VxNrxptGjXecn8BsdEQgyaZII/QBhz4= Received: from mail-wm1-f71.google.com (mail-wm1-f71.google.com [209.85.128.71]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-594-hlGlk3xmPcGZjNKqpf606w-1; Wed, 01 Sep 2021 03:49:27 -0400 X-MC-Unique: hlGlk3xmPcGZjNKqpf606w-1 Received: by mail-wm1-f71.google.com with SMTP id k5-20020a7bc3050000b02901e081f69d80so679654wmj.8 for ; Wed, 01 Sep 2021 00:49:27 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:organization :message-id:date:user-agent:mime-version:in-reply-to :content-language:content-transfer-encoding; bh=QVyzY7plwjcHWFuBExDhEE+9lobSCXwllAQa8rm7VKg=; b=kJjQwflnp6zbAE5E0oKGePrzhGAZXe0vPCQZ9bAVYvOczIYHjru0lnysAdSd2E5vK4 bl69jjbfA/drkAdGtymFhHo5MbAZ5s1ks/vfaqeBFi4Sjbg5q/lyvDqekN+EmwPAKRUI A/8xaiGp9vNVsMewXS554Lk4K+MyjkUGCZnCbFc4e1W6ffCLJc7EgcuOGTOPISYe/zts ynAX/Dg1nwbcNGWh+fJwjva3aNjo02UXmKxmDGsz78DddKjUCHO1Fa12b0o+sL+jtAXt /djRM+//FyC050dNKds5eHBpboXyPO90GTiDTh46PRoks9jVxGkNmSViNJhevVTmqZTO p/Yw== X-Gm-Message-State: AOAM53253dQ9ii0EWPHXJ9D3TEmUJ16XKw1ThlVJoSlIRbBEV9XGBf78 wQrhVfV5VhcIrrl/Mex5rOU1YAND9XuMIF/KnO4c1uanAG8vXVAXxxUTZ7/s+rs6snXXQVi8IgJ hG4b0cJqAgPw= X-Received: by 2002:adf:e702:: with SMTP id c2mr35401833wrm.397.1630482566712; Wed, 01 Sep 2021 00:49:26 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwcDFTNqPQv4PA+mv40IOil7uYNBfULQ1hV01psnoZhed1wBFZsx6IbJrJ8es3otfAeEglN1A== X-Received: by 2002:adf:e702:: with SMTP id c2mr35401803wrm.397.1630482566458; Wed, 01 Sep 2021 00:49:26 -0700 (PDT) Received: from [192.168.3.132] (p4ff23f71.dip0.t-ipconnect.de. [79.242.63.113]) by smtp.gmail.com with ESMTPSA id e26sm21532884wrc.6.2021.09.01.00.49.24 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 01 Sep 2021 00:49:26 -0700 (PDT) Subject: Re: [RFC] KVM: mm: fd-based approach for supporting KVM guest private memory To: Andy Lutomirski , Sean Christopherson Cc: Paolo Bonzini , Vitaly Kuznetsov , Wanpeng Li , Jim Mattson , Joerg Roedel , kvm list , Linux Kernel Mailing List , Borislav Petkov , Andrew Morton , Joerg Roedel , Andi Kleen , David Rientjes , Vlastimil Babka , Tom Lendacky , Thomas Gleixner , "Peter Zijlstra (Intel)" , Ingo Molnar , Varad Gautam , Dario Faggioli , the arch/x86 maintainers , linux-mm@kvack.org, linux-coco@lists.linux.dev, "Kirill A. Shutemov" , "Kirill A . Shutemov" , Sathyanarayanan Kuppuswamy , Dave Hansen , Yu Zhang References: <20210824005248.200037-1-seanjc@google.com> <307d385a-a263-276f-28eb-4bc8dd287e32@redhat.com> <61ea53ce-2ba7-70cc-950d-ca128bcb29c5@redhat.com> From: David Hildenbrand Organization: Red Hat Message-ID: Date: Wed, 1 Sep 2021 09:49:24 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.11.0 MIME-Version: 1.0 In-Reply-To: X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-US Content-Transfer-Encoding: 7bit Authentication-Results: imf19.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b=cMQqSNYW; dmarc=pass (policy=none) header.from=redhat.com; spf=none (imf19.hostedemail.com: domain of david@redhat.com has no SPF policy when checking 170.10.133.124) smtp.mailfrom=david@redhat.com X-Rspamd-Server: rspam03 X-Rspamd-Queue-Id: E3DE5B000093 X-Stat-Signature: 5zuyczczfywgde4tz9jh9mjerchhfino X-HE-Tag: 1630482569-82422 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On 01.09.21 06:58, Andy Lutomirski wrote: > On Tue, Aug 31, 2021, at 12:07 PM, David Hildenbrand wrote: >> On 28.08.21 00:18, Sean Christopherson wrote: >>> On Thu, Aug 26, 2021, David Hildenbrand wrote: >>>> You'll end up with a VMA that corresponds to the whole file in a single >>>> process only, and that cannot vanish, not even in parts. >>> >>> How would userspace tell the kernel to free parts of memory that it doesn't want >>> assigned to the guest, e.g. to free memory that the guest has converted to >>> not-private? >> >> I'd guess one possibility could be fallocate(FALLOC_FL_PUNCH_HOLE). >> >> Questions are: when would it actually be allowed to perform such a >> destructive operation? Do we have to protect from that? How would KVM >> protect from user space replacing private pages by shared pages in any >> of the models we discuss? >> > > What do you mean? If userspace maliciously replaces a shared page by a private page, then the guest crashes. Assume we have private pages in a fd and fallocate(FALLOC_FL_PUNCH_HOLE) random pages the guest is still using. If we "only" crash the guest, everything is fine. > > (The actual meaning here is a bit different on SNP-ES vs TDX. In SNP-ES, a given GPA can be shared, private, or nonexistent. A guest accesses it with a special bit set in the guest page tables to indicate whether it expects shared or private, and the CPU will produce an appropriate error if the bit doesn't match the page. Rings a bell, thanks for reminding me. In TDX, there is actually an entirely separate shared vs private address space, and, in theory, a given "GPA" can exist as shared and as private at once. The full guest n-bit GPA plus the shared/private bit is logically an N+1 bit address, and it's possible to map all of it at once, half shared, and half private. In practice, the defined guest->host APIs don't really support that usage. Thanks, that explains a lot. -- Thanks, David / dhildenb