[PATCH] KVM: SEV: Update SEV-ES shutdown intercepts with more metadata

[PATCH] KVM: SEV: Update SEV-ES shutdown intercepts with more metadata

[Peter Gonda]

Currently if an SEV-ES VM shuts down userspace sees KVM_RUN struct with
only the INVALID_ARGUMENT. This is a very limited amount of information
to debug the situation. Instead KVM can return a
KVM_SYSTEM_EVENT_SEV_TERM to alert userspace the VM is shutting down and
is not usable any further. This latter point can be enforced using the
kvm_vm_dead() functionality.

Signed-off-by: Peter Gonda <pgonda@google.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Sean Christopherson <seanjc@google.com>
Cc: Tom Lendacky <thomas.lendacky@amd.com>
Cc: Joerg Roedel <joro@8bytes.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: x86@kernel.org
Cc: kvm@vger.kernel.org
Cc: linux-kernel@vger.kernel.org

---

I am not sure if this is the right path forward maybe just returning
KVM_EXIT_SHUTDOWN is better. But the current behavior is very unhelpful.

---

 arch/x86/kvm/svm/svm.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c
index 956726d867aa..547526616d60 100644
--- a/arch/x86/kvm/svm/svm.c
+++ b/arch/x86/kvm/svm/svm.c
@@ -2131,12 +2131,16 @@ static int shutdown_interception(struct kvm_vcpu *vcpu)
 	 * The VM save area has already been encrypted so it
 	 * cannot be reinitialized - just terminate.
 	 */
-	if (sev_es_guest(vcpu->kvm))
-		return -EINVAL;
+	if (sev_es_guest(vcpu->kvm)) {
+		vcpu->run->exit_reason = KVM_EXIT_SYSTEM_EVENT;
+		vcpu->run->system_event.type = KVM_SYSTEM_EVENT_SEV_TERM;
+		kvm_vm_dead(vcpu->kvm);
+		return 0;
+	}
 
 	/*
 	 * VMCB is undefined after a SHUTDOWN intercept.  INIT the vCPU to put
-	 * the VMCB in a known good state.  Unfortuately, KVM doesn't have
+	 * the VMCB in a known good state.  Unfortunately, KVM doesn't have
 	 * KVM_MP_STATE_SHUTDOWN and can't add it without potentially breaking
 	 * userspace.  At a platform view, INIT is acceptable behavior as
 	 * there exist bare metal platforms that automatically INIT the CPU
-- 
2.42.0.283.g2d96d420d3-goog

Re: [PATCH] KVM: SEV: Update SEV-ES shutdown intercepts with more metadata

[Sean Christopherson]

On Tue, Sep 05, 2023, Peter Gonda wrote:
> Currently if an SEV-ES VM shuts down userspace sees KVM_RUN struct with
> only the INVALID_ARGUMENT. This is a very limited amount of information
> to debug the situation. Instead KVM can return a
> KVM_SYSTEM_EVENT_SEV_TERM to alert userspace the VM is shutting down and
> is not usable any further. This latter point can be enforced using the
> kvm_vm_dead() functionality.

Add the kvm_vm_dead() thing in a separate patch.  If we want to actually harden
KVM against consuming a garbage VMSA then we do need to mark the VM dead, but on
the other hand that will block _all_ KVM ioctls(), which will make debug even
harder.

> Signed-off-by: Peter Gonda <pgonda@google.com>
> Cc: Paolo Bonzini <pbonzini@redhat.com>
> Cc: Sean Christopherson <seanjc@google.com>
> Cc: Tom Lendacky <thomas.lendacky@amd.com>
> Cc: Joerg Roedel <joro@8bytes.org>
> Cc: Borislav Petkov <bp@alien8.de>
> Cc: x86@kernel.org
> Cc: kvm@vger.kernel.org
> Cc: linux-kernel@vger.kernel.org
> 
> ---
> 
> I am not sure if this is the right path forward maybe just returning
> KVM_EXIT_SHUTDOWN is better. But the current behavior is very unhelpful.

Ya, KVM_EXIT_SHUTDOWN is better, we should leave KVM_SYSTEM_EVENT_SEV_TERM to
explicit "requests" from the guest.

Re: [PATCH] KVM: SEV: Update SEV-ES shutdown intercepts with more metadata

[Peter Gonda]

On Tue, Sep 5, 2023 at 2:58 PM Sean Christopherson <seanjc@google.com> wrote:
>
> On Tue, Sep 05, 2023, Peter Gonda wrote:
> > Currently if an SEV-ES VM shuts down userspace sees KVM_RUN struct with
> > only the INVALID_ARGUMENT. This is a very limited amount of information
> > to debug the situation. Instead KVM can return a
> > KVM_SYSTEM_EVENT_SEV_TERM to alert userspace the VM is shutting down and
> > is not usable any further. This latter point can be enforced using the
> > kvm_vm_dead() functionality.
>
> Add the kvm_vm_dead() thing in a separate patch.  If we want to actually harden
> KVM against consuming a garbage VMSA then we do need to mark the VM dead, but on
> the other hand that will block _all_ KVM ioctls(), which will make debug even
> harder.

Will do. Do we have better functionality for just blocking running the vCPU?

>
> > Signed-off-by: Peter Gonda <pgonda@google.com>
> > Cc: Paolo Bonzini <pbonzini@redhat.com>
> > Cc: Sean Christopherson <seanjc@google.com>
> > Cc: Tom Lendacky <thomas.lendacky@amd.com>
> > Cc: Joerg Roedel <joro@8bytes.org>
> > Cc: Borislav Petkov <bp@alien8.de>
> > Cc: x86@kernel.org
> > Cc: kvm@vger.kernel.org
> > Cc: linux-kernel@vger.kernel.org
> >
> > ---
> >
> > I am not sure if this is the right path forward maybe just returning
> > KVM_EXIT_SHUTDOWN is better. But the current behavior is very unhelpful.
>
> Ya, KVM_EXIT_SHUTDOWN is better, we should leave KVM_SYSTEM_EVENT_SEV_TERM to
> explicit "requests" from the guest.

Sounds good to me. I'll send a V2 that just updates to KVM_EXIT_SHUTDOWN.