On Fri, Nov 12, 2021, Peter Gonda wrote: > On Fri, Nov 12, 2021 at 1:55 PM Borislav Petkov <bp@xxxxxxxxx> wrote: > > > > On Fri, Nov 12, 2021 at 08:37:59PM +0000, Sean Christopherson wrote: > > > Let userspace decide what is mapped shared and what is mapped private. > > > > With "userspace", you mean the *host* userspace? Yep. > > > The kernel and KVM provide the APIs/infrastructure to do the actual > > > conversions in a thread-safe fashion and also to enforce the current > > > state, but userspace is the control plane. > > > > > > It would require non-trivial changes in userspace if there are multiple processes > > > accessing guest memory, e.g. Peter's networking daemon example, but it _is_ fully > > > solvable. The exit to userspace means all three components (guest, kernel, > > > and userspace) have full knowledge of what is shared and what is private. There > > > is zero ambiguity: > > > > > > - if userspace accesses guest private memory, it gets SIGSEGV or whatever. > > > > That SIGSEGV is generated by the host kernel, I presume, after it checks > > whether the memory belongs to the guest? Yep. > > > - if kernel accesses guest private memory, it does BUG/panic/oops[*] > > > > If *it* is the host kernel, then you probably shouldn't do that - > > otherwise you just killed the host kernel on which all those guests are > > running. > > I agree, it seems better to terminate the single guest with an issue. > Rather than killing the host (and therefore all guests). So I'd > suggest even in this case we do the 'convert to shared' approach or > just outright terminate the guest. > > Are there already examples in KVM of a KVM bug in servicing a VM's > request results in a BUG/panic/oops? That seems not ideal ever. Plenty of examples. kvm_spurious_fault() is the obvious one. Any NULL pointer deref will lead to a BUG, etc... And it's not just KVM, e.g. it's possible, if unlikely, for the core kernel to run into guest private memory (e.g. if the kernel botches an RMP change), and if that happens there's no guarantee that the kernel can recover. I fully agree that ideally KVM would have a better sense of self-preservation, but IMO that's an orthogonal discussion.
