| Message ID | 20230905161048.3178838-1-pgonda@google.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | KVM: SEV: Update SEV-ES shutdown intercepts with more metadata | expand |
On Tue, Sep 05, 2023, Peter Gonda wrote: > Currently if an SEV-ES VM shuts down userspace sees KVM_RUN struct with > only the INVALID_ARGUMENT. This is a very limited amount of information > to debug the situation. Instead KVM can return a > KVM_SYSTEM_EVENT_SEV_TERM to alert userspace the VM is shutting down and > is not usable any further. This latter point can be enforced using the > kvm_vm_dead() functionality. Add the kvm_vm_dead() thing in a separate patch. If we want to actually harden KVM against consuming a garbage VMSA then we do need to mark the VM dead, but on the other hand that will block _all_ KVM ioctls(), which will make debug even harder. > Signed-off-by: Peter Gonda <pgonda@google.com> > Cc: Paolo Bonzini <pbonzini@redhat.com> > Cc: Sean Christopherson <seanjc@google.com> > Cc: Tom Lendacky <thomas.lendacky@amd.com> > Cc: Joerg Roedel <joro@8bytes.org> > Cc: Borislav Petkov <bp@alien8.de> > Cc: x86@kernel.org > Cc: kvm@vger.kernel.org > Cc: linux-kernel@vger.kernel.org > > --- > > I am not sure if this is the right path forward maybe just returning > KVM_EXIT_SHUTDOWN is better. But the current behavior is very unhelpful. Ya, KVM_EXIT_SHUTDOWN is better, we should leave KVM_SYSTEM_EVENT_SEV_TERM to explicit "requests" from the guest.
On Tue, Sep 5, 2023 at 2:58 PM Sean Christopherson <seanjc@google.com> wrote: > > On Tue, Sep 05, 2023, Peter Gonda wrote: > > Currently if an SEV-ES VM shuts down userspace sees KVM_RUN struct with > > only the INVALID_ARGUMENT. This is a very limited amount of information > > to debug the situation. Instead KVM can return a > > KVM_SYSTEM_EVENT_SEV_TERM to alert userspace the VM is shutting down and > > is not usable any further. This latter point can be enforced using the > > kvm_vm_dead() functionality. > > Add the kvm_vm_dead() thing in a separate patch. If we want to actually harden > KVM against consuming a garbage VMSA then we do need to mark the VM dead, but on > the other hand that will block _all_ KVM ioctls(), which will make debug even > harder. Will do. Do we have better functionality for just blocking running the vCPU? > > > Signed-off-by: Peter Gonda <pgonda@google.com> > > Cc: Paolo Bonzini <pbonzini@redhat.com> > > Cc: Sean Christopherson <seanjc@google.com> > > Cc: Tom Lendacky <thomas.lendacky@amd.com> > > Cc: Joerg Roedel <joro@8bytes.org> > > Cc: Borislav Petkov <bp@alien8.de> > > Cc: x86@kernel.org > > Cc: kvm@vger.kernel.org > > Cc: linux-kernel@vger.kernel.org > > > > --- > > > > I am not sure if this is the right path forward maybe just returning > > KVM_EXIT_SHUTDOWN is better. But the current behavior is very unhelpful. > > Ya, KVM_EXIT_SHUTDOWN is better, we should leave KVM_SYSTEM_EVENT_SEV_TERM to > explicit "requests" from the guest. Sounds good to me. I'll send a V2 that just updates to KVM_EXIT_SHUTDOWN.
diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index 956726d867aa..547526616d60 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -2131,12 +2131,16 @@ static int shutdown_interception(struct kvm_vcpu *vcpu) * The VM save area has already been encrypted so it * cannot be reinitialized - just terminate. */ - if (sev_es_guest(vcpu->kvm)) - return -EINVAL; + if (sev_es_guest(vcpu->kvm)) { + vcpu->run->exit_reason = KVM_EXIT_SYSTEM_EVENT; + vcpu->run->system_event.type = KVM_SYSTEM_EVENT_SEV_TERM; + kvm_vm_dead(vcpu->kvm); + return 0; + } /* * VMCB is undefined after a SHUTDOWN intercept. INIT the vCPU to put - * the VMCB in a known good state. Unfortuately, KVM doesn't have + * the VMCB in a known good state. Unfortunately, KVM doesn't have * KVM_MP_STATE_SHUTDOWN and can't add it without potentially breaking * userspace. At a platform view, INIT is acceptable behavior as * there exist bare metal platforms that automatically INIT the CPU
Currently if an SEV-ES VM shuts down userspace sees KVM_RUN struct with only the INVALID_ARGUMENT. This is a very limited amount of information to debug the situation. Instead KVM can return a KVM_SYSTEM_EVENT_SEV_TERM to alert userspace the VM is shutting down and is not usable any further. This latter point can be enforced using the kvm_vm_dead() functionality. Signed-off-by: Peter Gonda <pgonda@google.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Sean Christopherson <seanjc@google.com> Cc: Tom Lendacky <thomas.lendacky@amd.com> Cc: Joerg Roedel <joro@8bytes.org> Cc: Borislav Petkov <bp@alien8.de> Cc: x86@kernel.org Cc: kvm@vger.kernel.org Cc: linux-kernel@vger.kernel.org --- I am not sure if this is the right path forward maybe just returning KVM_EXIT_SHUTDOWN is better. But the current behavior is very unhelpful. --- arch/x86/kvm/svm/svm.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)