From mboxrd@z Thu Jan 1 00:00:00 1970 From: Sean Christopherson Date: Fri, 15 Sep 2023 07:26:16 -0700 Subject: [RFC PATCH v12 18/33] KVM: x86/mmu: Handle page fault for private memory In-Reply-To: References: <20230914015531.1419405-1-seanjc@google.com> <20230914015531.1419405-19-seanjc@google.com> Message-ID: List-Id: To: kvm-riscv@lists.infradead.org MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit On Fri, Sep 15, 2023, Yan Zhao wrote: > On Wed, Sep 13, 2023 at 06:55:16PM -0700, Sean Christopherson wrote: > .... > > +static void kvm_mmu_prepare_memory_fault_exit(struct kvm_vcpu *vcpu, > > + struct kvm_page_fault *fault) > > +{ > > + kvm_prepare_memory_fault_exit(vcpu, fault->gfn << PAGE_SHIFT, > > + PAGE_SIZE, fault->write, fault->exec, > > + fault->is_private); > > +} > > + > > +static int kvm_faultin_pfn_private(struct kvm_vcpu *vcpu, > > + struct kvm_page_fault *fault) > > +{ > > + int max_order, r; > > + > > + if (!kvm_slot_can_be_private(fault->slot)) { > > + kvm_mmu_prepare_memory_fault_exit(vcpu, fault); > > + return -EFAULT; > > + } > > + > > + r = kvm_gmem_get_pfn(vcpu->kvm, fault->slot, fault->gfn, &fault->pfn, > > + &max_order); > > + if (r) { > > + kvm_mmu_prepare_memory_fault_exit(vcpu, fault); > > + return r; > > + } > > + > > + fault->max_level = min(kvm_max_level_for_order(max_order), > > + fault->max_level); > > + fault->map_writable = !(fault->slot->flags & KVM_MEM_READONLY); > > + > > + return RET_PF_CONTINUE; > > +} > > + > > static int __kvm_faultin_pfn(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault) > > { > > struct kvm_memory_slot *slot = fault->slot; > > @@ -4293,6 +4356,14 @@ static int __kvm_faultin_pfn(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault > > return RET_PF_EMULATE; > > } > > > > + if (fault->is_private != kvm_mem_is_private(vcpu->kvm, fault->gfn)) { > In patch 21, > fault->is_private is set as: > ".is_private = kvm_mem_is_private(vcpu->kvm, cr2_or_gpa >> PAGE_SHIFT)", > then, the inequality here means memory attribute has been updated after > last check. > So, why an exit to user space for converting is required instead of a mere retry? > > Or, is it because how .is_private is assigned in patch 21 is subjected to change > in future? This. Retrying on SNP or TDX would hang the guest. I suppose we could special case VMs where .is_private is derived from the memory attributes, but the SW_PROTECTED_VM type is primary a development vehicle at this point. I'd like to have it mimic SNP/TDX as much as possible; performance is a secondary concern. E.g. userspace needs to be prepared for "spurious" exits due to races on SNP and TDX, which this can theoretically exercise. Though the window is quite small so I doubt that'll actually happen in practice; which of course also makes it less important to retry instead of exiting. From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-yb1-f202.google.com (mail-yb1-f202.google.com [209.85.219.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B21E4101EB for ; Fri, 15 Sep 2023 14:26:19 +0000 (UTC) Received: by mail-yb1-f202.google.com with SMTP id 3f1490d57ef6-d814634fe4bso2702152276.1 for ; Fri, 15 Sep 2023 07:26:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1694787978; x=1695392778; darn=lists.linux.dev; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=n3wwM0IxTv36mTuzbjanMwII1EwyeoxiFmog5O5ddM4=; b=qo5w/PK6cIxXG4gfQPQgTxWdUYvqutoxUC1b8+PIy1++IR3QN2HKboQfCGOuot5DYh S6NFWUPGjDEu3rmNsU4ZMZxTnpXCRWNcb4R/+GeYmu1IS0Ui/Y2Z9cnSXvQh3gvlfsv9 J+0J3cpIhBhpv+inEWAG3eKQSXHHcv/CtbcrBTuKqIWO56yAEwCNwQA/e1Cbc5CceUke eAnocuMvhUWTayoIFBz/BORJ7PJ2ShOHgM0DE2O6z/p45ZSotylq7AVb1O32Er+io8EI 3SiFyZB8n6d/ERbCOIHku9xoAu/inFTgGcPOAuL5wnBx+g7rG59S8kczemsx4MXmaK+6 w4BQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1694787978; x=1695392778; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=n3wwM0IxTv36mTuzbjanMwII1EwyeoxiFmog5O5ddM4=; b=lYtLQ4WOsF+Ymj0h0EpMHFeE37jwSXN/3ZTc19D/3PndQd6Sz8cE8kr3ukXJ1rSFfz sG/2tjFP1j0z6VL/62IYjGKp288n2DkvnX+5j6vwsX7RJizxTyphXsax769ilXaBEHdd Hmlv14VWzD3449p1DDvkFh4gb1VVlnvXPbZgWAJwBcGgtEgztHMVUmOQW4pQ8io5zE7t UgM/Mx0Q1SyppWGp1NJL+NZq90ERrIMRn4Sl0aubPoHNQkkjqCUYeUpiwhOz6AxVs5xO hTmnACGnDPpBmYE2li6MA0uzYsdHf/Vm4BqwSLn/7BBo814TdC2s5iiox9GHl8FkgUdN 8yfQ== X-Gm-Message-State: AOJu0Yw2VqN7pswU3g1scbZY6l+ALC1Ckq+bz/95pRg2FLcjr1chETeR iH1I7Jztp8Z7OaVXk0dEZtScJ9FELFo= X-Google-Smtp-Source: AGHT+IEtd+ZFiwjGOxGj1IwoYm6uY+zMlhHeo3LWWwltDCF+cgsfqNfOOXS7Bflkew1pSHX6ZJTGM/96YR0= X-Received: from zagreus.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:5c37]) (user=seanjc job=sendgmr) by 2002:a25:bc8:0:b0:d80:eb4:9ca with SMTP id 191-20020a250bc8000000b00d800eb409camr37310ybl.0.1694787978719; Fri, 15 Sep 2023 07:26:18 -0700 (PDT) Date: Fri, 15 Sep 2023 07:26:16 -0700 In-Reply-To: Precedence: bulk X-Mailing-List: kvmarm@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20230914015531.1419405-1-seanjc@google.com> <20230914015531.1419405-19-seanjc@google.com> Message-ID: Subject: Re: [RFC PATCH v12 18/33] KVM: x86/mmu: Handle page fault for private memory From: Sean Christopherson To: Yan Zhao Cc: Paolo Bonzini , Marc Zyngier , Oliver Upton , Huacai Chen , Michael Ellerman , Anup Patel , Paul Walmsley , Palmer Dabbelt , Albert Ou , "Matthew Wilcox (Oracle)" , Andrew Morton , Paul Moore , James Morris , "Serge E. Hallyn" , kvm@vger.kernel.org, linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev, linux-mips@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, kvm-riscv@lists.infradead.org, linux-riscv@lists.infradead.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, Chao Peng , Fuad Tabba , Jarkko Sakkinen , Anish Moorthy , Yu Zhang , Isaku Yamahata , Xu Yilun , Vlastimil Babka , Vishal Annapurve , Ackerley Tng , Maciej Szmigiero , David Hildenbrand , Quentin Perret , Michael Roth , Wang , Liam Merwick , Isaku Yamahata , "Kirill A . Shutemov" Content-Type: text/plain; charset="us-ascii" On Fri, Sep 15, 2023, Yan Zhao wrote: > On Wed, Sep 13, 2023 at 06:55:16PM -0700, Sean Christopherson wrote: > .... > > +static void kvm_mmu_prepare_memory_fault_exit(struct kvm_vcpu *vcpu, > > + struct kvm_page_fault *fault) > > +{ > > + kvm_prepare_memory_fault_exit(vcpu, fault->gfn << PAGE_SHIFT, > > + PAGE_SIZE, fault->write, fault->exec, > > + fault->is_private); > > +} > > + > > +static int kvm_faultin_pfn_private(struct kvm_vcpu *vcpu, > > + struct kvm_page_fault *fault) > > +{ > > + int max_order, r; > > + > > + if (!kvm_slot_can_be_private(fault->slot)) { > > + kvm_mmu_prepare_memory_fault_exit(vcpu, fault); > > + return -EFAULT; > > + } > > + > > + r = kvm_gmem_get_pfn(vcpu->kvm, fault->slot, fault->gfn, &fault->pfn, > > + &max_order); > > + if (r) { > > + kvm_mmu_prepare_memory_fault_exit(vcpu, fault); > > + return r; > > + } > > + > > + fault->max_level = min(kvm_max_level_for_order(max_order), > > + fault->max_level); > > + fault->map_writable = !(fault->slot->flags & KVM_MEM_READONLY); > > + > > + return RET_PF_CONTINUE; > > +} > > + > > static int __kvm_faultin_pfn(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault) > > { > > struct kvm_memory_slot *slot = fault->slot; > > @@ -4293,6 +4356,14 @@ static int __kvm_faultin_pfn(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault > > return RET_PF_EMULATE; > > } > > > > + if (fault->is_private != kvm_mem_is_private(vcpu->kvm, fault->gfn)) { > In patch 21, > fault->is_private is set as: > ".is_private = kvm_mem_is_private(vcpu->kvm, cr2_or_gpa >> PAGE_SHIFT)", > then, the inequality here means memory attribute has been updated after > last check. > So, why an exit to user space for converting is required instead of a mere retry? > > Or, is it because how .is_private is assigned in patch 21 is subjected to change > in future? This. Retrying on SNP or TDX would hang the guest. I suppose we could special case VMs where .is_private is derived from the memory attributes, but the SW_PROTECTED_VM type is primary a development vehicle at this point. I'd like to have it mimic SNP/TDX as much as possible; performance is a secondary concern. E.g. userspace needs to be prepared for "spurious" exits due to races on SNP and TDX, which this can theoretically exercise. Though the window is quite small so I doubt that'll actually happen in practice; which of course also makes it less important to retry instead of exiting. From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id D4240EE6457 for ; Fri, 15 Sep 2023 14:26:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:Cc:To:From:Subject:Message-ID: References:Mime-Version:In-Reply-To:Date:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Owner; bh=YukzmYWKvRmE8ii2AkRCsJxORMFj/5TefPBNsi+L0OA=; b=xcO/E1ZXoI+7Vk49e7CEd70X/H PGkZFmZpdt/Zxar8dsjJ7J1n91kqfu/RzHffzrdGcah0aoVnC1ajfG1r1lZlDvtx8G3lrcJMY4ib3 TJeAqa6zoPfxbmvDhUW87d9sl3K0wfnR83GwR0jdwV8arKww3wbXOY7QHw+buB+iKBeIVIdjr6fiq Zux40chibpY7jamm9E4Ly7sR6e/4XFt0LmwVBK4CADDOtEAKUtt+KFNUPLeUrY2KLksXZyYgsIdpV xaEZaCie+dQpD5c7U+qshHyAhPSBueSuT85xutfhJj0Tj5rvhh96FZTCmUzcwHpg0S7lgZp2pxllY YqhM2yzg==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1qh9m5-00Asl2-1m; Fri, 15 Sep 2023 14:26:25 +0000 Received: from mail-yw1-x114a.google.com ([2607:f8b0:4864:20::114a]) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1qh9m2-00AsjU-1w for linux-riscv@lists.infradead.org; Fri, 15 Sep 2023 14:26:24 +0000 Received: by mail-yw1-x114a.google.com with SMTP id 00721157ae682-59c0dd156e5so8652417b3.3 for ; Fri, 15 Sep 2023 07:26:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1694787978; x=1695392778; darn=lists.infradead.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=n3wwM0IxTv36mTuzbjanMwII1EwyeoxiFmog5O5ddM4=; b=zR2R+ZSkVaF2g3NyPF2akT0g6EfFKyrPgEz2+uuSIuO2H7yevH/SloMDdK4DAbmojE 8N5Twa/+clARRajQWBi0kkUImlsqowooiNPcgltxKFzAfuDCL+wrOUxMo76M/29twGIr 1A4jPIDs5YQr6ffHsylqPGla9qtoXTDnf3LnLwh8j+I3WM7jv+3EInSepuQNVmHXBEQs qEFzcy4UZsEloBbK3Pr+tDtvUq0gfEmf/cKh3wmNuLSZoZXwKP/sMMRd4WGgPNSLWwdY s+Whn3oJ9s+X7kgKMcOQrezrhqdsgDM818hDznlfvhw+1c+M5dVWcuGRSoTC7QTCFmv7 zPMQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1694787978; x=1695392778; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=n3wwM0IxTv36mTuzbjanMwII1EwyeoxiFmog5O5ddM4=; b=MoP/Pb22Dp6FffCZqp5fg2I4vsPI8u/bwUy2nCkHFXxpBOAETKey8UcjRROOFSuToJ 4oIE1UWFS1KraUvRepoZWiUEU3Fa4srwn4iLbkWvOO54xqgj3NT5HVGQMsQzfmUm4TyP Um1sC161/s9yBqzB9NodYmIG8Kd8xfN7vqmWChB5ufX2gdCjf65EzTQZyu5IW9n3yiou YFXKJJJByecFOyhgJJTSFT3+H0iPyZprF1WQoywMIVoFxH4H2uJtqlc9d5fY5LUqW716 CRT4zHpEB7p82GJLUK8Yns72ef6CTDYa8CHYzwIsS7ay1jBZc3nDxq7kUbmWvoADavgh POUw== X-Gm-Message-State: AOJu0YzC5VemUr+kwIPixfptjgs2Kid1/d9OzQgSeQ8xbJafp+B78xyR 6WjjrCcJzGeLsQ6cCzKgaWucFqmAf/c= X-Google-Smtp-Source: AGHT+IEtd+ZFiwjGOxGj1IwoYm6uY+zMlhHeo3LWWwltDCF+cgsfqNfOOXS7Bflkew1pSHX6ZJTGM/96YR0= X-Received: from zagreus.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:5c37]) (user=seanjc job=sendgmr) by 2002:a25:bc8:0:b0:d80:eb4:9ca with SMTP id 191-20020a250bc8000000b00d800eb409camr37310ybl.0.1694787978719; Fri, 15 Sep 2023 07:26:18 -0700 (PDT) Date: Fri, 15 Sep 2023 07:26:16 -0700 In-Reply-To: Mime-Version: 1.0 References: <20230914015531.1419405-1-seanjc@google.com> <20230914015531.1419405-19-seanjc@google.com> Message-ID: Subject: Re: [RFC PATCH v12 18/33] KVM: x86/mmu: Handle page fault for private memory From: Sean Christopherson To: Yan Zhao Cc: Paolo Bonzini , Marc Zyngier , Oliver Upton , Huacai Chen , Michael Ellerman , Anup Patel , Paul Walmsley , Palmer Dabbelt , Albert Ou , "Matthew Wilcox (Oracle)" , Andrew Morton , Paul Moore , James Morris , "Serge E. Hallyn" , kvm@vger.kernel.org, linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev, linux-mips@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, kvm-riscv@lists.infradead.org, linux-riscv@lists.infradead.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, Chao Peng , Fuad Tabba , Jarkko Sakkinen , Anish Moorthy , Yu Zhang , Isaku Yamahata , Xu Yilun , Vlastimil Babka , Vishal Annapurve , Ackerley Tng , Maciej Szmigiero , David Hildenbrand , Quentin Perret , Michael Roth , Wang , Liam Merwick , Isaku Yamahata , "Kirill A . Shutemov" X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20230915_072622_684484_6A841D57 X-CRM114-Status: GOOD ( 20.33 ) X-BeenThere: linux-riscv@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-riscv" Errors-To: linux-riscv-bounces+linux-riscv=archiver.kernel.org@lists.infradead.org On Fri, Sep 15, 2023, Yan Zhao wrote: > On Wed, Sep 13, 2023 at 06:55:16PM -0700, Sean Christopherson wrote: > .... > > +static void kvm_mmu_prepare_memory_fault_exit(struct kvm_vcpu *vcpu, > > + struct kvm_page_fault *fault) > > +{ > > + kvm_prepare_memory_fault_exit(vcpu, fault->gfn << PAGE_SHIFT, > > + PAGE_SIZE, fault->write, fault->exec, > > + fault->is_private); > > +} > > + > > +static int kvm_faultin_pfn_private(struct kvm_vcpu *vcpu, > > + struct kvm_page_fault *fault) > > +{ > > + int max_order, r; > > + > > + if (!kvm_slot_can_be_private(fault->slot)) { > > + kvm_mmu_prepare_memory_fault_exit(vcpu, fault); > > + return -EFAULT; > > + } > > + > > + r = kvm_gmem_get_pfn(vcpu->kvm, fault->slot, fault->gfn, &fault->pfn, > > + &max_order); > > + if (r) { > > + kvm_mmu_prepare_memory_fault_exit(vcpu, fault); > > + return r; > > + } > > + > > + fault->max_level = min(kvm_max_level_for_order(max_order), > > + fault->max_level); > > + fault->map_writable = !(fault->slot->flags & KVM_MEM_READONLY); > > + > > + return RET_PF_CONTINUE; > > +} > > + > > static int __kvm_faultin_pfn(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault) > > { > > struct kvm_memory_slot *slot = fault->slot; > > @@ -4293,6 +4356,14 @@ static int __kvm_faultin_pfn(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault > > return RET_PF_EMULATE; > > } > > > > + if (fault->is_private != kvm_mem_is_private(vcpu->kvm, fault->gfn)) { > In patch 21, > fault->is_private is set as: > ".is_private = kvm_mem_is_private(vcpu->kvm, cr2_or_gpa >> PAGE_SHIFT)", > then, the inequality here means memory attribute has been updated after > last check. > So, why an exit to user space for converting is required instead of a mere retry? > > Or, is it because how .is_private is assigned in patch 21 is subjected to change > in future? This. Retrying on SNP or TDX would hang the guest. I suppose we could special case VMs where .is_private is derived from the memory attributes, but the SW_PROTECTED_VM type is primary a development vehicle at this point. I'd like to have it mimic SNP/TDX as much as possible; performance is a secondary concern. E.g. userspace needs to be prepared for "spurious" exits due to races on SNP and TDX, which this can theoretically exercise. Though the window is quite small so I doubt that'll actually happen in practice; which of course also makes it less important to retry instead of exiting. _______________________________________________ linux-riscv mailing list linux-riscv@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-riscv From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.ozlabs.org (lists.ozlabs.org [112.213.38.117]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 7667DEE6457 for ; Fri, 15 Sep 2023 14:27:16 +0000 (UTC) Authentication-Results: lists.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20230601 header.b=e6bzjZ5i; dkim-atps=neutral Received: from boromir.ozlabs.org (localhost [IPv6:::1]) by lists.ozlabs.org (Postfix) with ESMTP id 4RnGjZ6GtJz3dFF for ; Sat, 16 Sep 2023 00:27:14 +1000 (AEST) Authentication-Results: lists.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20230601 header.b=e6bzjZ5i; dkim-atps=neutral Authentication-Results: lists.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=flex--seanjc.bounces.google.com (client-ip=2607:f8b0:4864:20::b4a; helo=mail-yb1-xb4a.google.com; envelope-from=3imkezqykdj0pb7kg9dlldib.9ljifkrumm9-absifpqp.lwi78p.lod@flex--seanjc.bounces.google.com; receiver=lists.ozlabs.org) Received: from mail-yb1-xb4a.google.com (mail-yb1-xb4a.google.com [IPv6:2607:f8b0:4864:20::b4a]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by lists.ozlabs.org (Postfix) with ESMTPS id 4RnGhZ5yYRz3cD5 for ; Sat, 16 Sep 2023 00:26:21 +1000 (AEST) Received: by mail-yb1-xb4a.google.com with SMTP id 3f1490d57ef6-d8153284d6eso2682114276.3 for ; Fri, 15 Sep 2023 07:26:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1694787978; x=1695392778; darn=lists.ozlabs.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=n3wwM0IxTv36mTuzbjanMwII1EwyeoxiFmog5O5ddM4=; b=e6bzjZ5ipSNEhNqHxP1U8Hj3NX3W6ehv2tDrP8IuoBqgJyyvN+gl2bHHrVswRT217e fBUfTbxL8cXXmFS/EPqDqccvGV8bQJpUDtwRjMEM75px/8pIqykm4rRqiPvB0KnPTtfw Mi5NbSk9eaSO9+TYWblZyuEmgtCYCuCpHg7iPEXoRUadcAfqrXWBhmT+x0B2rdRyNjsD Kh7cLVr+2r/iF6tDYsI9UepNf1pGRnkwni3tinnZmINd1znMOgzL1n75VePHpFqikVPB oQR2adUifnxJEjRjspmASQPIpJj4KgI6x9G7/CSnsJVAsAZ9k6r2m2jtlCO1g6qwCjM4 VKXQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1694787978; x=1695392778; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=n3wwM0IxTv36mTuzbjanMwII1EwyeoxiFmog5O5ddM4=; b=k7KzP4QnxNBmD0rzr/Q/EAR70QC3kgjEGotN9SKgGkfrM2EvJ3lznktdunkvX1bSzz GIicYr4cAvezBGzhFo/TmTv0JsFr+/+aRheGZdQTikNLBAWyfLHavCJTloFk88ydRjHy 26LiDixc+tOIajNA3RXJhPEyEpn3k+xJeNeX/LFBbT8axyOjGvC4vHWYPP1eMpAB56EF nbOe/9dnw3TCpF1xw7Db+IUUNa48QJUW8lkB1lyxK5dsNjQrztRFn/GpkeZKpyLn6w9L rz/3C7tVxfTUZkhqwpM3hWFaMN8MM0fTOBWg9saE1p6f8AvgZXxmi15ONJbVyilSMRrZ X19A== X-Gm-Message-State: AOJu0YxZXEAjeYigQNA+piRIdvE77YbaPhsu4G1Wpq4t5Mycao/IcCEV yJXoVYCzrOuVboOJBiVVde6hTAk+e2s= X-Google-Smtp-Source: AGHT+IEtd+ZFiwjGOxGj1IwoYm6uY+zMlhHeo3LWWwltDCF+cgsfqNfOOXS7Bflkew1pSHX6ZJTGM/96YR0= X-Received: from zagreus.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:5c37]) (user=seanjc job=sendgmr) by 2002:a25:bc8:0:b0:d80:eb4:9ca with SMTP id 191-20020a250bc8000000b00d800eb409camr37310ybl.0.1694787978719; Fri, 15 Sep 2023 07:26:18 -0700 (PDT) Date: Fri, 15 Sep 2023 07:26:16 -0700 In-Reply-To: Mime-Version: 1.0 References: <20230914015531.1419405-1-seanjc@google.com> <20230914015531.1419405-19-seanjc@google.com> Message-ID: Subject: Re: [RFC PATCH v12 18/33] KVM: x86/mmu: Handle page fault for private memory From: Sean Christopherson To: Yan Zhao Content-Type: text/plain; charset="us-ascii" X-BeenThere: linuxppc-dev@lists.ozlabs.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Linux on PowerPC Developers Mail List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: kvm@vger.kernel.org, David Hildenbrand , Yu Zhang , linux-kernel@vger.kernel.org, linux-mm@kvack.org, Chao Peng , linux-riscv@lists.infradead.org, Isaku Yamahata , Paul Moore , Marc Zyngier , Huacai Chen , James Morris , "Matthew Wilcox \(Oracle\)" , Wang , Fuad Tabba , Jarkko Sakkinen , "Serge E. Hallyn" , Maciej Szmigiero , Albert Ou , Vlastimil Babka , Michael Roth , Ackerley Tng , Paul Walmsley , kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org, Isaku Yamahata , Quentin Perret , Liam Merwick , linux-mips@vger.kernel.org, Oliver Upton , linux-security-module@vger.kernel.org, Palmer Dabbelt , "Kirill A . Shutemov" , kvm-riscv@lists.infradead.org, Anup Patel , linux-fsdevel@vger.kernel.org, Paolo Bonzini , Andrew Morton , Vishal Annapurve , linuxppc-dev@lists.ozlabs.org, Xu Yilun , Anish Moorthy Errors-To: linuxppc-dev-bounces+linuxppc-dev=archiver.kernel.org@lists.ozlabs.org Sender: "Linuxppc-dev" On Fri, Sep 15, 2023, Yan Zhao wrote: > On Wed, Sep 13, 2023 at 06:55:16PM -0700, Sean Christopherson wrote: > .... > > +static void kvm_mmu_prepare_memory_fault_exit(struct kvm_vcpu *vcpu, > > + struct kvm_page_fault *fault) > > +{ > > + kvm_prepare_memory_fault_exit(vcpu, fault->gfn << PAGE_SHIFT, > > + PAGE_SIZE, fault->write, fault->exec, > > + fault->is_private); > > +} > > + > > +static int kvm_faultin_pfn_private(struct kvm_vcpu *vcpu, > > + struct kvm_page_fault *fault) > > +{ > > + int max_order, r; > > + > > + if (!kvm_slot_can_be_private(fault->slot)) { > > + kvm_mmu_prepare_memory_fault_exit(vcpu, fault); > > + return -EFAULT; > > + } > > + > > + r = kvm_gmem_get_pfn(vcpu->kvm, fault->slot, fault->gfn, &fault->pfn, > > + &max_order); > > + if (r) { > > + kvm_mmu_prepare_memory_fault_exit(vcpu, fault); > > + return r; > > + } > > + > > + fault->max_level = min(kvm_max_level_for_order(max_order), > > + fault->max_level); > > + fault->map_writable = !(fault->slot->flags & KVM_MEM_READONLY); > > + > > + return RET_PF_CONTINUE; > > +} > > + > > static int __kvm_faultin_pfn(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault) > > { > > struct kvm_memory_slot *slot = fault->slot; > > @@ -4293,6 +4356,14 @@ static int __kvm_faultin_pfn(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault > > return RET_PF_EMULATE; > > } > > > > + if (fault->is_private != kvm_mem_is_private(vcpu->kvm, fault->gfn)) { > In patch 21, > fault->is_private is set as: > ".is_private = kvm_mem_is_private(vcpu->kvm, cr2_or_gpa >> PAGE_SHIFT)", > then, the inequality here means memory attribute has been updated after > last check. > So, why an exit to user space for converting is required instead of a mere retry? > > Or, is it because how .is_private is assigned in patch 21 is subjected to change > in future? This. Retrying on SNP or TDX would hang the guest. I suppose we could special case VMs where .is_private is derived from the memory attributes, but the SW_PROTECTED_VM type is primary a development vehicle at this point. I'd like to have it mimic SNP/TDX as much as possible; performance is a secondary concern. E.g. userspace needs to be prepared for "spurious" exits due to races on SNP and TDX, which this can theoretically exercise. Though the window is quite small so I doubt that'll actually happen in practice; which of course also makes it less important to retry instead of exiting. From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id A2B9EEE645E for ; Fri, 15 Sep 2023 14:26:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:Cc:To:From:Subject:Message-ID: References:Mime-Version:In-Reply-To:Date:Reply-To:Content-ID: Content-Description:Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc :Resent-Message-ID:List-Owner; bh=oBgsUWOLeIoSkVZnwVuSFkfGGxv2MGhGiY7qkmzqxYg=; b=elcTH4nfj2kbzJgA0wFvxzV0+m D/WTjWJmXCR0loCEQrtxUaDCn70CsClEOcbFcEHtd7TWW/SvWwwQNnAEhV+XRUg5EuVUe9maARBsL MFWjSlxwhVBB3YrLW8s5CFQYAdwk2tpQ6L/ZV+kePRIx24PJKxbz+ZPQ+1pGcr/s8iatlpSN2ELmt l97VmMPcCP7/JMs4zQmdQM81z+15PAMpLCndYz/FdS/Hk1GvRVoc3tHMLnj6Eg8f76xQXZOEta9pV r96khP2+cYQVYrliCRorlv8v2Q3XOVgVDdkIecInyWRhbK8PCRigttvNH/Cx9Okn9D7G1L6riBRmP j2HT/zUQ==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1qh9m6-00AslF-0P; Fri, 15 Sep 2023 14:26:26 +0000 Received: from mail-yw1-x1149.google.com ([2607:f8b0:4864:20::1149]) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1qh9m2-00AsjV-2A for linux-arm-kernel@lists.infradead.org; Fri, 15 Sep 2023 14:26:23 +0000 Received: by mail-yw1-x1149.google.com with SMTP id 00721157ae682-5925fb6087bso27656227b3.2 for ; Fri, 15 Sep 2023 07:26:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1694787978; x=1695392778; darn=lists.infradead.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=n3wwM0IxTv36mTuzbjanMwII1EwyeoxiFmog5O5ddM4=; b=zR2R+ZSkVaF2g3NyPF2akT0g6EfFKyrPgEz2+uuSIuO2H7yevH/SloMDdK4DAbmojE 8N5Twa/+clARRajQWBi0kkUImlsqowooiNPcgltxKFzAfuDCL+wrOUxMo76M/29twGIr 1A4jPIDs5YQr6ffHsylqPGla9qtoXTDnf3LnLwh8j+I3WM7jv+3EInSepuQNVmHXBEQs qEFzcy4UZsEloBbK3Pr+tDtvUq0gfEmf/cKh3wmNuLSZoZXwKP/sMMRd4WGgPNSLWwdY s+Whn3oJ9s+X7kgKMcOQrezrhqdsgDM818hDznlfvhw+1c+M5dVWcuGRSoTC7QTCFmv7 zPMQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1694787978; x=1695392778; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=n3wwM0IxTv36mTuzbjanMwII1EwyeoxiFmog5O5ddM4=; b=MK51UL/LR7ArCJIqHOo1wXPICNqxjMqyqirhoBF3NERxhosv5X0NgtmBrlPI8bakqz 4/KUTKfdkCB7jxrv8gqujQzlmO0Qp2TiPGXYh+LVujgBqEee7ySQjZbQqSWaXeXYnWRw tcAJOY8E8o9jmHsqaNgmdyiZkqkbfZBkJliiUOgq425azuzzsU6xgKQ5ktBodKozji94 t/Dfaf88/TZYGcSriQ3yObByVFxrjF+1QIVBGtWFPU3d6Fgv6eEaJxyaHU2OL4A1xz5V kX88W44XHNYY1D+zaGNLWwELEdtuUDC1BkYawXoLKJ6L/dKncgdBOw5jXvjik/T1eKVR PFZA== X-Gm-Message-State: AOJu0YwOypwELQs7aRJTetU9K+vCR0z4Pa7rWZKyrBq+17RmynYgjSb+ jGikpY4z8SgmyWAJmgzIb3iHyNCiJwE= X-Google-Smtp-Source: AGHT+IEtd+ZFiwjGOxGj1IwoYm6uY+zMlhHeo3LWWwltDCF+cgsfqNfOOXS7Bflkew1pSHX6ZJTGM/96YR0= X-Received: from zagreus.c.googlers.com ([fda3:e722:ac3:cc00:7f:e700:c0a8:5c37]) (user=seanjc job=sendgmr) by 2002:a25:bc8:0:b0:d80:eb4:9ca with SMTP id 191-20020a250bc8000000b00d800eb409camr37310ybl.0.1694787978719; Fri, 15 Sep 2023 07:26:18 -0700 (PDT) Date: Fri, 15 Sep 2023 07:26:16 -0700 In-Reply-To: Mime-Version: 1.0 References: <20230914015531.1419405-1-seanjc@google.com> <20230914015531.1419405-19-seanjc@google.com> Message-ID: Subject: Re: [RFC PATCH v12 18/33] KVM: x86/mmu: Handle page fault for private memory From: Sean Christopherson To: Yan Zhao Cc: Paolo Bonzini , Marc Zyngier , Oliver Upton , Huacai Chen , Michael Ellerman , Anup Patel , Paul Walmsley , Palmer Dabbelt , Albert Ou , "Matthew Wilcox (Oracle)" , Andrew Morton , Paul Moore , James Morris , "Serge E. Hallyn" , kvm@vger.kernel.org, linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev, linux-mips@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, kvm-riscv@lists.infradead.org, linux-riscv@lists.infradead.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, Chao Peng , Fuad Tabba , Jarkko Sakkinen , Anish Moorthy , Yu Zhang , Isaku Yamahata , Xu Yilun , Vlastimil Babka , Vishal Annapurve , Ackerley Tng , Maciej Szmigiero , David Hildenbrand , Quentin Perret , Michael Roth , Wang , Liam Merwick , Isaku Yamahata , "Kirill A . Shutemov" X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20230915_072622_713035_8EF77797 X-CRM114-Status: GOOD ( 21.96 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Fri, Sep 15, 2023, Yan Zhao wrote: > On Wed, Sep 13, 2023 at 06:55:16PM -0700, Sean Christopherson wrote: > .... > > +static void kvm_mmu_prepare_memory_fault_exit(struct kvm_vcpu *vcpu, > > + struct kvm_page_fault *fault) > > +{ > > + kvm_prepare_memory_fault_exit(vcpu, fault->gfn << PAGE_SHIFT, > > + PAGE_SIZE, fault->write, fault->exec, > > + fault->is_private); > > +} > > + > > +static int kvm_faultin_pfn_private(struct kvm_vcpu *vcpu, > > + struct kvm_page_fault *fault) > > +{ > > + int max_order, r; > > + > > + if (!kvm_slot_can_be_private(fault->slot)) { > > + kvm_mmu_prepare_memory_fault_exit(vcpu, fault); > > + return -EFAULT; > > + } > > + > > + r = kvm_gmem_get_pfn(vcpu->kvm, fault->slot, fault->gfn, &fault->pfn, > > + &max_order); > > + if (r) { > > + kvm_mmu_prepare_memory_fault_exit(vcpu, fault); > > + return r; > > + } > > + > > + fault->max_level = min(kvm_max_level_for_order(max_order), > > + fault->max_level); > > + fault->map_writable = !(fault->slot->flags & KVM_MEM_READONLY); > > + > > + return RET_PF_CONTINUE; > > +} > > + > > static int __kvm_faultin_pfn(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault) > > { > > struct kvm_memory_slot *slot = fault->slot; > > @@ -4293,6 +4356,14 @@ static int __kvm_faultin_pfn(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault > > return RET_PF_EMULATE; > > } > > > > + if (fault->is_private != kvm_mem_is_private(vcpu->kvm, fault->gfn)) { > In patch 21, > fault->is_private is set as: > ".is_private = kvm_mem_is_private(vcpu->kvm, cr2_or_gpa >> PAGE_SHIFT)", > then, the inequality here means memory attribute has been updated after > last check. > So, why an exit to user space for converting is required instead of a mere retry? > > Or, is it because how .is_private is assigned in patch 21 is subjected to change > in future? This. Retrying on SNP or TDX would hang the guest. I suppose we could special case VMs where .is_private is derived from the memory attributes, but the SW_PROTECTED_VM type is primary a development vehicle at this point. I'd like to have it mimic SNP/TDX as much as possible; performance is a secondary concern. E.g. userspace needs to be prepared for "spurious" exits due to races on SNP and TDX, which this can theoretically exercise. Though the window is quite small so I doubt that'll actually happen in practice; which of course also makes it less important to retry instead of exiting. _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel