On 6/21/22 01:08, Ashish Kalra wrote: > From: Brijesh Singh <brijesh.singh@xxxxxxx> > > When SEV-SNP is enabled, the guest private pages are added in the RMP > table; while adding the pages, the rmp_make_private() unmaps the pages > from the direct map. If KSM attempts to access those unmapped pages then > it will trigger #PF (page-not-present). > > Encrypted guest pages cannot be shared between the process, so an > userspace should not mark the region mergeable but to be safe, mark the > process vma unmerable before adding the pages in the RMP table. > > Signed-off-by: Brijesh Singh <brijesh.singh@xxxxxxx> Note this doesn't really mark the vma unmergeable, rather it unmarks it as mergeable, and unmerges any already merged pages. Which seems like a good idea. Is snp_launch_update() the only place that needs it or can private pages be added elsewhere too? However, AFAICS nothing stops userspace to do another madvise(MADV_MERGEABLE) afterwards, so we should make somehow sure that ksm will still be prevented, as we should protect the kernel even from a buggy userspace. So either we stop it with a flag at vma level (see ksm_madvise() for which flags currently stop it), or page level - currently only PageAnon() pages are handled. The vma level is probably easier/cheaper. It's also possible that this will solve itself with the switch to UPM as those vma's or pages might be incompatible with ksm naturally (didn't check closely), and then this patch can be just dropped. But we should double-check.
