linux-kernel - Re: [PATCH v3 07/25] KVM: TDX: Drop superfluous page pinning in S-EPT management

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <8717e83c9c8fe0b30e1fdc0a3439bf0e1718a142.camel@intel.com>
Date: Tue, 21 Oct 2025 00:10:34 +0000
From: "Edgecombe, Rick P" <rick.p.edgecombe@...el.com>
To: "chenhuacai@...nel.org" <chenhuacai@...nel.org>, "frankja@...ux.ibm.com"
	<frankja@...ux.ibm.com>, "maz@...nel.org" <maz@...nel.org>,
	"borntraeger@...ux.ibm.com" <borntraeger@...ux.ibm.com>, "pjw@...nel.org"
	<pjw@...nel.org>, "aou@...s.berkeley.edu" <aou@...s.berkeley.edu>,
	"kas@...nel.org" <kas@...nel.org>, "seanjc@...gle.com" <seanjc@...gle.com>,
	"maobibo@...ngson.cn" <maobibo@...ngson.cn>, "pbonzini@...hat.com"
	<pbonzini@...hat.com>, "maddy@...ux.ibm.com" <maddy@...ux.ibm.com>,
	"palmer@...belt.com" <palmer@...belt.com>, "imbrenda@...ux.ibm.com"
	<imbrenda@...ux.ibm.com>, "zhaotianrui@...ngson.cn"
	<zhaotianrui@...ngson.cn>, "anup@...infault.org" <anup@...infault.org>,
	"oliver.upton@...ux.dev" <oliver.upton@...ux.dev>
CC: "kvm@...r.kernel.org" <kvm@...r.kernel.org>, "linux-coco@...ts.linux.dev"
	<linux-coco@...ts.linux.dev>, "Huang, Kai" <kai.huang@...el.com>, "Zhao, Yan
 Y" <yan.y.zhao@...el.com>, "michael.roth@....com" <michael.roth@....com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, "Weiny, Ira"
	<ira.weiny@...el.com>, "loongarch@...ts.linux.dev"
	<loongarch@...ts.linux.dev>, "binbin.wu@...ux.intel.com"
	<binbin.wu@...ux.intel.com>, "ackerleytng@...gle.com"
	<ackerleytng@...gle.com>, "kvmarm@...ts.linux.dev" <kvmarm@...ts.linux.dev>,
	"Annapurve, Vishal" <vannapurve@...gle.com>, "kvm-riscv@...ts.infradead.org"
	<kvm-riscv@...ts.infradead.org>, "linuxppc-dev@...ts.ozlabs.org"
	<linuxppc-dev@...ts.ozlabs.org>, "linux-arm-kernel@...ts.infradead.org"
	<linux-arm-kernel@...ts.infradead.org>, "linux-mips@...r.kernel.org"
	<linux-mips@...r.kernel.org>, "linux-riscv@...ts.infradead.org"
	<linux-riscv@...ts.infradead.org>, "x86@...nel.org" <x86@...nel.org>
Subject: Re: [PATCH v3 07/25] KVM: TDX: Drop superfluous page pinning in S-EPT
 management

On Thu, 2025-10-16 at 17:32 -0700, Sean Christopherson wrote:
> From: Yan Zhao <yan.y.zhao@...el.com>
> 
> Don't explicitly pin pages when mapping pages into the S-EPT, guest_memfd
> doesn't support page migration in any capacity, i.e. there are no migrate
> callbacks because guest_memfd pages *can't* be migrated.  See the WARN in
> kvm_gmem_migrate_folio().
> 
> Eliminating TDX's explicit pinning will also enable guest_memfd to support
> in-place conversion between shared and private memory[1][2].  Because KVM
> cannot distinguish between speculative/transient refcounts and the
> intentional refcount for TDX on private pages[3], failing to release
> private page refcount in TDX could cause guest_memfd to indefinitely wait
> on decreasing the refcount for the splitting.
> 
> Under normal conditions, not holding an extra page refcount in TDX is safe
> because guest_memfd ensures pages are retained until its invalidation
> notification to KVM MMU is completed. However, if there're bugs in KVM/TDX
> module, not holding an extra refcount when a page is mapped in S-EPT could
> result in a page being released from guest_memfd while still mapped in the
> S-EPT.  But, doing work to make a fatal error slightly less fatal is a net
> negative when that extra work adds complexity and confusion.
> 
> Several approaches were considered to address the refcount issue, including
>   - Attempting to modify the KVM unmap operation to return a failure,
>     which was deemed too complex and potentially incorrect[4].
>  - Increasing the folio reference count only upon S-EPT zapping failure[5].
>  - Use page flags or page_ext to indicate a page is still used by TDX[6],
>    which does not work for HVO (HugeTLB Vmemmap Optimization).
>   - Setting HWPOISON bit or leveraging folio_set_hugetlb_hwpoison()[7].

Some white space issues above. But in any case:

Reviewed-by: Rick Edgecombe <rick.p.edgecombe@...el.com>