lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Sun, 2 Aug 2020 22:00:13 -0500
From:   Eric van Tassell <>
To:     Sean Christopherson <>,
        Paolo Bonzini <>
Cc:     Vitaly Kuznetsov <>,
        Wanpeng Li <>,
        Jim Mattson <>,
        Joerg Roedel <>,,,
        eric van tassell <>,
        Tom Lendacky <>
Subject: Re: [RFC PATCH 0/8] KVM: x86/mmu: Introduce pinned SPTEs framework

	What commit did you base your series  on?

-evt(Eric van Tassell)

On 7/31/20 4:23 PM, Sean Christopherson wrote:
> SEV currently needs to pin guest memory as it doesn't support migrating
> encrypted pages.  Introduce a framework in KVM's MMU to support pinning
> pages on demand without requiring additional memory allocations, and with
> (somewhat hazy) line of sight toward supporting more advanced features for
> encrypted guest memory, e.g. host page migration.
> The idea is to use a software available bit in the SPTE to track that a
> page has been pinned.  The decision to pin a page and the actual pinning
> managment is handled by vendor code via kvm_x86_ops hooks.  There are
> intentionally two hooks (zap and unzap) introduced that are not needed for
> SEV.  I included them to again show how the flag (probably renamed?) could
> be used for more than just pin/unpin.
> Bugs in the core implementation are pretty much guaranteed.  The basic
> concept has been tested, but in a fairly different incarnation.  Most
> notably, tagging PRESENT SPTEs as PINNED has not been tested, although
> using the PINNED flag to track zapped (and known to be pinned) SPTEs has
> been tested.  I cobbled this variation together fairly quickly to get the
> code out there for discussion.
> The last patch to pin SEV pages during sev_launch_update_data() is
> incomplete; it's there to show how we might leverage MMU-based pinning to
> support pinning pages before the guest is live.
> Sean Christopherson (8):
>    KVM: x86/mmu: Return old SPTE from mmu_spte_clear_track_bits()
>    KVM: x86/mmu: Use bits 2:0 to check for present SPTEs
>    KVM: x86/mmu: Refactor handling of not-present SPTEs in mmu_set_spte()
>    KVM: x86/mmu: Add infrastructure for pinning PFNs on demand
>    KVM: SVM: Use the KVM MMU SPTE pinning hooks to pin pages on demand
>    KVM: x86/mmu: Move 'pfn' variable to caller of direct_page_fault()
>    KVM: x86/mmu: Introduce kvm_mmu_map_tdp_page() for use by SEV
>    KVM: SVM: Pin SEV pages in MMU during sev_launch_update_data()
>   arch/x86/include/asm/kvm_host.h |   7 ++
>   arch/x86/kvm/mmu.h              |   3 +
>   arch/x86/kvm/mmu/mmu.c          | 186 +++++++++++++++++++++++++-------
>   arch/x86/kvm/mmu/paging_tmpl.h  |   3 +-
>   arch/x86/kvm/svm/sev.c          | 141 +++++++++++++++++++++++-
>   arch/x86/kvm/svm/svm.c          |   3 +
>   arch/x86/kvm/svm/svm.h          |   3 +
>   7 files changed, 302 insertions(+), 44 deletions(-)

Powered by blists - more mailing lists