linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Andrew Jones <drjones@redhat.com>
To: Marc Zyngier <maz@kernel.org>
Cc: linux-arm-kernel@lists.infradead.org,
	kvmarm@lists.cs.columbia.edu, kvm@vger.kernel.org,
	linux-kernel@vger.kernel.org, kernel-team@android.com,
	Srivatsa Vaddagiri <vatsa@codeaurora.org>,
	Shanker R Donthineni <sdonthineni@nvidia.com>,
	will@kernel.org
Subject: Re: [PATCH 00/16] KVM: arm64: MMIO guard PV services
Date: Wed, 21 Jul 2021 23:42:43 +0200	[thread overview]
Message-ID: <20210721214243.dy6d644yznuopuqx@gator> (raw)
In-Reply-To: <20210715163159.1480168-1-maz@kernel.org>

On Thu, Jul 15, 2021 at 05:31:43PM +0100, Marc Zyngier wrote:
> KVM/arm64 currently considers that any memory access outside of a
> memslot is a MMIO access. This so far has served us very well, but
> obviously relies on the guest trusting the host, and especially
> userspace to do the right thing.
> 
> As we keep on hacking away at pKVM, it becomes obvious that this trust
> model is not really fit for a confidential computing environment, and
> that the guest would require some guarantees that emulation only
> occurs on portions of the address space that have clearly been
> identified for this purpose.

This trust model is hard for me to reason about. userspace is trusted to
control the life cycle of the VM, to prepare the memslots for the VM,
and [presumably] identify what MMIO ranges are valid, yet it's not
trusted to handle invalid MMIO accesses. I'd like to learn more about
this model and the userspace involved.

> 
> This series aims at providing the two sides of the above coin:
> 
> - a set of PV services (collectively called 'MMIO guard' -- better
>   name required!) where the guest can flag portion of its address
>   space that it considers as MMIO, with map/unmap semantics. Any
>   attempt to access a MMIO range outside of these regions will result
>   in an external abort being injected.
> 
> - a set of hooks into the ioremap code allowing a Linux guest to tell
>   KVM about things it want to consider as MMIO. I definitely hate this
>   part of the series, as it feels clumsy and brittle.
> 
> For now, the enrolment in this scheme is controlled by a guest kernel
> command-line parameters, but it is expected that KVM will enforce this
> for protected VMs.
> 
> Note that this crucially misses a save/restore interface for non
> protected VMs, and I currently don't have a good solution for
> that. Ideas welcome.
> 
> I also plan to use this series as a base for some other purposes,
> namely to trick the guest in telling us how it maps things like
> prefetchable BARs (see the discussion at [1]). That part is not
> implemented yet, but there is already some provision to pass the MAIR
> index across.
> 
> Patches on top of 5.14-rc1, branch pushed at the usual location.
> 
> [1] 20210429162906.32742-1-sdonthineni@nvidia.com

The fun never stops.

Thanks,
drew


  parent reply	other threads:[~2021-07-21 21:42 UTC|newest]

Thread overview: 62+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-07-15 16:31 [PATCH 00/16] KVM: arm64: MMIO guard PV services Marc Zyngier
2021-07-15 16:31 ` [PATCH 01/16] KVM: arm64: Generalise VM features into a set of flags Marc Zyngier
2021-07-27 18:10   ` Will Deacon
2021-07-28  9:41     ` Marc Zyngier
2021-07-28 14:51       ` Steven Price
2021-07-15 16:31 ` [PATCH 02/16] KVM: arm64: Don't issue CMOs when the physical address is invalid Marc Zyngier
2021-07-19 17:18   ` Quentin Perret
2021-07-20  8:04     ` Marc Zyngier
2021-07-27 18:10   ` Will Deacon
2021-07-28  9:45     ` Marc Zyngier
2021-07-15 16:31 ` [PATCH 03/16] KVM: arm64: Turn kvm_pgtable_stage2_set_owner into kvm_pgtable_stage2_annotate Marc Zyngier
2021-07-20 10:09   ` Quentin Perret
2021-07-20 10:21     ` Marc Zyngier
2021-07-20 10:38       ` Quentin Perret
2021-07-20 11:20         ` Marc Zyngier
2021-07-20 11:36           ` Quentin Perret
2021-07-20 13:13             ` Marc Zyngier
2021-07-15 16:31 ` [PATCH 04/16] KVM: arm64: Add MMIO checking infrastructure Marc Zyngier
2021-07-20 11:13   ` Quentin Perret
2021-07-20 13:15     ` Marc Zyngier
2021-07-20 15:49       ` Quentin Perret
2021-07-22 18:04         ` Marc Zyngier
2021-07-23 10:16           ` Quentin Perret
2021-07-27 18:11   ` Will Deacon
2021-07-28  9:57     ` Marc Zyngier
2021-07-30 12:26       ` Will Deacon
2021-07-30 13:04         ` Marc Zyngier
2021-07-30 12:58     ` Quentin Perret
2021-07-15 16:31 ` [PATCH 05/16] KVM: arm64: Plumb MMIO checking into the fault handling Marc Zyngier
2021-07-27 18:11   ` Will Deacon
2021-07-28 10:21     ` Marc Zyngier
2021-07-30 12:38       ` Will Deacon
2021-07-15 16:31 ` [PATCH 06/16] KVM: arm64: Force a full unmap on vpcu reinit Marc Zyngier
2021-07-27 18:11   ` Will Deacon
2021-07-28 10:38     ` Marc Zyngier
2021-07-30 12:50       ` Will Deacon
2021-07-15 16:31 ` [PATCH 07/16] KVM: arm64: Wire MMIO guard hypercalls Marc Zyngier
2021-07-27 18:11   ` Will Deacon
2021-07-28 10:47     ` Marc Zyngier
2021-07-30 13:11       ` Will Deacon
2021-08-01 11:20         ` Marc Zyngier
2021-07-15 16:31 ` [PATCH 08/16] KVM: arm64: Add tracepoint for failed MMIO guard check Marc Zyngier
2021-07-15 16:31 ` [PATCH 09/16] KVM: arm64: Advertise a capability for MMIO guard Marc Zyngier
2021-07-15 16:31 ` [PATCH 10/16] KVM: arm64: Add some documentation for the MMIO guard feature Marc Zyngier
2021-07-21 21:17   ` Andrew Jones
2021-07-23 13:30     ` Marc Zyngier
2021-07-23 13:38       ` Andrew Jones
2021-07-23 13:52         ` Marc Zyngier
2021-07-15 16:31 ` [PATCH 11/16] firmware/smccc: Call arch-specific hook on discovering KVM services Marc Zyngier
2021-07-15 16:31 ` [PATCH 12/16] mm/ioremap: Add arch-specific callbacks on ioremap/iounmap calls Marc Zyngier
2021-07-27 18:12   ` Will Deacon
2021-07-28 11:01     ` Marc Zyngier
2021-07-30 14:07       ` Will Deacon
2021-07-15 16:31 ` [PATCH 13/16] arm64: Implement ioremap/iounmap hooks calling into KVM's MMIO guard Marc Zyngier
2021-07-15 16:31 ` [PATCH 14/16] arm64: Enroll into KVM's MMIO guard if required Marc Zyngier
2021-07-15 16:31 ` [PATCH 15/16] arm64: Add a helper to retrieve the PTE of a fixmap Marc Zyngier
2021-07-20 11:16   ` Quentin Perret
2021-07-15 16:31 ` [PATCH 16/16] arm64: Register earlycon fixmap with the MMIO guard Marc Zyngier
2021-07-21 21:42 ` Andrew Jones [this message]
2021-07-22 10:00   ` [PATCH 00/16] KVM: arm64: MMIO guard PV services Marc Zyngier
2021-07-22 13:25     ` Andrew Jones
2021-07-22 15:30       ` Marc Zyngier

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210721214243.dy6d644yznuopuqx@gator \
    --to=drjones@redhat.com \
    --cc=kernel-team@android.com \
    --cc=kvm@vger.kernel.org \
    --cc=kvmarm@lists.cs.columbia.edu \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=maz@kernel.org \
    --cc=sdonthineni@nvidia.com \
    --cc=vatsa@codeaurora.org \
    --cc=will@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).