Sean Christopherson
66155de93b
KVM: x86: Disallow read-only memslots for SEV-ES and SEV-SNP (and TDX)
...
Disallow read-only memslots for SEV-{ES,SNP} VM types, as KVM can't
directly emulate instructions for ES/SNP, and instead the guest must
explicitly request emulation. Unless the guest explicitly requests
emulation without accessing memory, ES/SNP relies on KVM creating an MMIO
SPTE, with the subsequent #NPF being reflected into the guest as a #VC.
But for read-only memslots, KVM deliberately doesn't create MMIO SPTEs,
because except for ES/SNP, doing so requires setting reserved bits in the
SPTE, i.e. the SPTE can't be readable while also generating a #VC on
writes. Because KVM never creates MMIO SPTEs and jumps directly to
emulation, the guest never gets a #VC. And since KVM simply resumes the
guest if ES/SNP guests trigger emulation, KVM effectively puts the vCPU
into an infinite #NPF loop if the vCPU attempts to write read-only memory.
Disallow read-only memory for all VMs with protected state, i.e. for
upcoming TDX VMs as well as ES/SNP VMs. For TDX, it's actually possible
to support read-only memory, as TDX uses EPT Violation #VE to reflect the
fault into the guest, e.g. KVM could configure read-only SPTEs with RX
protections and SUPPRESS_VE=0. But there is no strong use case for
supporting read-only memslots on TDX, e.g. the main historical usage is
to emulate option ROMs, but TDX disallows executing from shared memory.
And if someone comes along with a legitimate, strong use case, the
restriction can always be lifted for TDX.
Don't bother trying to retroactively apply the restriction to SEV-ES
VMs that are created as type KVM_X86_DEFAULT_VM. Read-only memslots can't
possibly work for SEV-ES, i.e. disallowing such memslots is really just
means reporting an error to userspace instead of silently hanging vCPUs.
Trying to deal with the ordering between KVM_SEV_INIT and memslot creation
isn't worth the marginal benefit it would provide userspace.
Fixes: 26c44aa9e0 ("KVM: SEV: define VM types for SEV and SEV-ES")
Fixes: 1dfe571c12 ("KVM: SEV: Add initial SEV-SNP support")
Cc: Peter Gonda <pgonda@google.com >
Cc: Michael Roth <michael.roth@amd.com >
Cc: Vishal Annapurve <vannapurve@google.com >
Cc: Ackerly Tng <ackerleytng@google.com >
Signed-off-by: Sean Christopherson <seanjc@google.com >
Message-ID: <20240809190319.1710470-2-seanjc@google.com >
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com >
2024-08-14 12:28:24 -04:00
..
2024-04-29 11:15:31 +02:00
2024-05-19 14:36:17 -07:00
2023-12-08 09:12:18 -08:00
2021-10-20 22:35:04 +02:00
2024-01-03 11:46:22 +01:00
2024-07-24 10:29:50 -07:00
2024-07-25 13:11:08 +02:00
2022-04-07 08:27:54 -07:00
2024-06-17 17:46:25 +02:00
2022-08-04 11:11:59 +02:00
2023-02-13 22:13:12 +01:00
2024-07-01 12:41:11 +02:00
2022-03-02 11:42:36 +01:00
2024-06-12 11:38:58 +02:00
2022-09-29 12:20:54 +02:00
2024-05-14 10:01:29 -07:00
2023-11-21 17:23:35 +01:00
2018-07-16 17:59:57 +02:00
2019-05-13 11:07:33 +02:00
2022-07-25 13:26:14 +02:00
2024-03-29 12:13:12 -07:00
2024-04-04 17:01:40 +02:00
2024-05-13 17:36:32 -07:00
2024-04-10 15:04:55 +02:00
2024-04-10 15:04:55 +02:00
2023-08-30 10:11:16 +02:00
2024-05-22 14:12:11 -07:00
2017-11-02 11:10:55 +01:00
2024-05-22 14:12:11 -07:00
2024-05-13 18:05:08 -07:00
2023-03-30 12:58:51 -06:00
2022-05-23 18:42:07 -07:00
2023-06-16 10:15:59 +02:00
2020-10-25 14:51:49 -07:00
2020-06-08 11:05:57 -07:00
2023-10-10 14:38:18 +02:00
2017-11-02 11:10:55 +01:00
2024-06-19 12:41:08 -07:00
2020-08-20 15:45:18 -04:00
2023-01-27 11:19:46 +00:00
2022-10-03 14:03:24 -07:00
2020-03-21 15:23:54 +01:00
2024-07-31 21:46:35 +02:00
2024-06-30 09:21:29 -07:00
2024-04-14 22:40:54 +02:00
2023-10-09 18:14:25 +02:00
2024-04-24 08:11:43 -07:00
2022-05-31 14:10:54 -07:00
2024-05-28 10:59:03 -07:00
2022-12-15 10:37:26 -08:00
2024-02-15 22:07:43 +01:00
2024-05-14 08:51:37 -07:00
2024-07-16 15:54:03 -07:00
2024-02-15 22:07:36 +01:00
2019-09-03 09:36:36 +02:00
2023-05-15 13:44:52 +02:00
2024-03-26 11:14:12 -07:00
2021-06-07 12:14:45 +02:00
2024-02-14 10:49:37 +01:00
2024-03-04 12:01:39 +01:00
2020-05-07 16:06:20 +02:00
2023-12-20 10:57:51 +01:00
2024-03-12 09:55:57 +01:00
2020-06-30 11:59:48 +02:00
2024-03-25 11:16:54 +01:00
2023-08-03 12:08:35 +02:00
2023-02-15 12:35:20 +01:00
2022-07-22 17:24:47 -05:00
2018-08-05 09:53:13 +02:00
2023-05-18 11:56:18 -07:00
2020-04-09 00:01:59 +09:00
2017-11-02 11:10:55 +01:00
2024-07-08 10:17:44 +02:00
2024-02-27 00:23:55 +01:00
2021-01-06 08:40:56 -05:00
2017-11-02 11:10:55 +01:00
2019-10-17 21:31:57 +02:00
2020-11-18 18:02:50 +01:00
2024-06-28 08:54:56 -07:00
2017-12-22 20:13:05 +01:00
2024-04-04 17:01:40 +02:00
2022-05-27 12:34:45 +02:00
2021-02-09 15:28:37 +01:00
2021-04-20 08:59:03 -06:00
2024-05-19 14:36:19 -07:00
2020-09-18 09:59:40 +02:00
2024-01-31 22:03:32 +01:00
2024-03-04 12:01:39 +01:00
2024-06-11 11:18:24 -04:00
2021-12-11 09:09:47 +01:00
2022-04-18 07:21:10 +02:00
2021-10-28 23:25:26 +02:00
2019-05-30 11:29:53 -07:00
2023-01-13 10:07:27 +01:00
2024-04-30 00:54:42 +02:00
2022-04-13 12:15:50 -07:00
2020-10-28 20:26:25 +01:00
2020-06-03 20:09:46 -07:00
2022-08-30 10:56:22 +02:00
2024-02-23 10:18:44 +01:00
2022-11-17 13:58:32 +01:00
2024-03-04 06:59:18 +00:00
2019-07-17 08:09:59 +02:00
2023-10-27 20:36:49 +02:00
2024-04-02 15:01:40 +02:00
2023-07-10 09:52:23 +02:00
2024-04-30 00:54:42 +02:00
2019-06-05 17:37:17 +02:00
2019-05-30 11:26:35 -07:00
2024-05-02 13:13:45 +02:00
2024-06-17 17:46:22 +02:00
2023-01-03 18:46:06 +01:00
2024-05-02 13:13:45 +02:00
2020-11-26 12:58:56 +01:00
2024-07-04 16:00:36 +02:00
2022-02-15 17:47:11 +01:00
2017-11-02 11:10:55 +01:00
2021-02-15 20:10:30 +01:00
2020-04-24 11:18:44 +01:00
2024-04-22 11:44:00 +02:00
2023-03-22 11:08:40 -07:00
2020-05-12 16:05:30 +02:00
2024-02-15 22:07:39 +01:00
2020-07-18 12:31:49 +02:00
2024-05-19 09:21:03 -07:00
2020-11-06 23:14:58 +01:00
2024-01-29 17:19:28 +01:00
2024-01-03 11:46:22 +01:00
2024-04-30 00:54:43 +02:00
2024-03-19 13:15:35 +01:00
2024-04-30 00:54:42 +02:00
2023-11-23 11:32:29 +01:00
2024-02-08 08:45:35 -05:00
2022-11-17 15:15:22 +01:00
2024-06-11 07:22:46 +02:00
2019-05-24 17:39:02 +02:00
2018-04-23 10:17:28 +02:00
2024-02-09 15:57:48 -08:00
2022-12-15 10:37:26 -08:00
2020-06-09 09:39:13 -07:00
2017-11-02 11:10:55 +01:00
2023-10-03 10:38:08 +02:00
2020-07-22 23:56:53 +02:00
2018-04-13 17:10:27 -07:00
2024-04-23 14:59:01 +10:00
2021-07-30 17:09:01 +02:00
2017-11-02 11:10:55 +01:00
2024-01-25 23:52:21 -08:00
2023-11-10 19:59:05 +09:00
2024-08-14 12:28:24 -04:00
2023-08-31 14:08:19 -04:00
2022-04-07 08:27:52 -07:00
2020-07-09 13:29:42 -04:00
2019-02-20 22:47:38 +01:00
2024-07-16 12:14:11 -04:00
2024-07-16 12:14:11 -04:00
2024-02-07 17:05:21 +01:00
2024-01-10 10:52:29 +01:00
2024-03-01 12:54:25 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2022-08-14 11:24:29 +02:00
2024-05-27 10:49:25 +02:00
2024-03-04 18:12:33 +01:00
2022-11-10 13:12:45 +01:00
2023-10-24 15:05:55 +02:00
2017-11-02 11:10:55 +01:00
2023-09-06 23:50:46 +02:00
2017-11-02 11:10:55 +01:00
2023-09-19 09:18:34 -07:00
2024-02-22 10:24:41 -08:00
2020-05-28 18:34:30 +02:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2020-04-23 10:50:26 +09:00
2018-01-14 21:11:54 +01:00
2024-05-06 17:39:09 +02:00
2024-03-04 06:59:18 +00:00
2022-12-05 22:22:34 +01:00
2024-07-16 17:13:31 -07:00
2017-11-02 11:10:55 +01:00
2024-03-11 19:37:56 -07:00
2023-06-01 15:04:33 +02:00
2023-11-29 15:44:01 +01:00
2024-03-06 10:13:33 +01:00
2023-05-31 10:21:21 +02:00
2024-04-08 19:27:06 +02:00
2017-11-02 11:10:55 +01:00
2023-10-20 10:40:22 +02:00
2017-11-02 11:10:55 +01:00
2019-05-20 17:27:08 +03:00
2023-06-16 17:17:42 +02:00
2019-05-21 11:28:45 +02:00
2023-03-23 23:18:58 +01:00
2020-10-29 21:54:35 +01:00
2023-02-09 16:51:41 -08:00
2023-03-30 12:58:51 -06:00
2024-07-01 12:41:11 +02:00
2024-05-13 18:05:08 -07:00
2023-11-23 11:13:21 +01:00
2022-02-23 10:58:28 +01:00
2024-01-10 16:43:55 -08:00
2024-01-10 16:43:55 -08:00
2017-11-02 11:10:55 +01:00
2021-08-10 23:31:43 +02:00
2022-06-17 14:24:14 -05:00
2018-06-29 20:06:07 -05:00
2017-11-02 11:10:55 +01:00
2024-01-30 15:17:12 +01:00
2024-05-20 10:56:25 +02:00
2024-02-15 22:07:45 +01:00
2024-07-04 16:00:40 +02:00
2024-01-10 10:52:28 +01:00
2019-12-10 10:12:55 +01:00
2019-12-10 10:12:55 +01:00
2022-11-08 17:37:18 -08:00
2024-03-04 18:12:06 +01:00
2024-04-25 20:56:28 -07:00
2022-12-15 10:37:26 -08:00
2024-06-17 17:45:57 +02:00
2020-06-02 10:59:11 -07:00
2023-02-02 22:33:10 -08:00
2022-12-15 10:37:27 -08:00
2024-01-10 10:52:28 +01:00
2018-08-17 10:27:36 -07:00
2024-06-17 17:46:05 +02:00
2022-04-04 15:58:24 -07:00
2021-12-19 22:44:34 +01:00
2021-02-15 20:09:46 +01:00
2017-11-02 11:10:55 +01:00
2017-11-02 11:10:55 +01:00
2024-04-30 00:54:43 +02:00
2024-02-14 10:45:07 +01:00
2017-11-02 11:10:55 +01:00
2021-08-10 23:31:43 +02:00
2024-01-10 10:52:28 +01:00
2024-06-13 14:40:29 +02:00
2024-04-03 08:49:56 +02:00
2023-12-07 09:51:29 -08:00
2024-01-10 10:52:28 +01:00
2024-01-31 22:01:20 +01:00
2019-11-14 18:24:43 +01:00
2017-11-02 11:10:55 +01:00
2023-01-31 15:01:47 +01:00
2017-11-02 11:10:55 +01:00
2024-04-24 11:48:08 +02:00
2024-08-07 20:04:38 +02:00
2023-05-15 13:45:03 +02:00
2017-11-02 11:10:55 +01:00
2023-08-03 15:37:14 -07:00
2024-03-25 11:16:54 +01:00
2024-02-16 19:18:33 +01:00
2024-02-09 15:57:48 -08:00
2024-06-19 12:34:34 -07:00
2024-03-22 09:37:09 +01:00
2023-08-21 13:46:24 -07:00
2023-08-08 09:31:43 +02:00
2017-11-02 11:10:55 +01:00
2024-06-17 17:46:05 +02:00
2024-01-30 15:17:12 +01:00
2024-05-27 18:54:45 +02:00
2024-07-20 12:41:03 -07:00
2024-07-20 12:41:03 -07:00
2022-11-04 15:33:30 -07:00
2017-11-02 11:10:55 +01:00
2024-06-12 08:44:28 +09:00
2017-11-02 11:10:55 +01:00
2023-06-16 10:16:00 +02:00
2022-10-19 09:58:49 +02:00
2022-10-19 09:58:48 +02:00
2017-11-02 11:10:55 +01:00
2022-04-04 10:16:57 +02:00
2024-06-17 17:46:20 +02:00
2021-02-10 23:34:17 +01:00
2024-05-07 13:47:15 +02:00
2024-03-04 12:09:13 +01:00
2024-03-20 12:04:38 +01:00
2020-05-28 21:18:40 +02:00
2017-11-07 10:32:44 +01:00
2017-11-02 11:10:55 +01:00
2022-11-18 02:18:10 +01:00
2021-09-21 13:57:43 +02:00
2024-01-10 10:52:29 +01:00
2021-12-11 09:09:45 +01:00
2024-03-22 11:47:34 +01:00
2017-11-02 11:10:55 +01:00
2024-03-22 11:01:31 +01:00
2022-04-27 13:55:19 +02:00
2018-10-03 11:56:34 +02:00
2024-05-12 04:09:32 -04:00
2024-01-31 22:01:36 +01:00
2019-04-10 09:53:31 +02:00
2020-12-09 09:37:42 +01:00
2024-01-24 11:49:19 +01:00
2024-04-08 19:27:05 +02:00
2020-03-21 16:03:25 +01:00
2023-12-12 08:46:46 -08:00
2024-04-09 18:08:11 +02:00
2021-05-31 22:32:26 +02:00
2024-01-31 22:01:31 +01:00
2023-06-09 17:44:16 -07:00
2017-11-13 19:07:38 -08:00
2022-05-13 23:59:23 +02:00
2022-07-21 10:50:13 -07:00
2017-11-02 11:10:55 +01:00
2023-08-31 12:20:12 -07:00
2024-03-11 18:14:06 -07:00
2017-11-02 11:10:55 +01:00
2024-01-29 17:26:56 +01:00
2024-01-25 19:10:29 +01:00
2023-11-23 11:32:31 +01:00
2024-06-03 11:18:51 +02:00
2023-05-03 10:37:22 -07:00
2024-03-11 19:53:15 -07:00
2024-06-11 16:08:43 -07:00
2019-11-07 11:07:29 +01:00
2023-06-06 18:31:37 +02:00
2024-07-10 14:23:38 +02:00
2023-06-07 10:03:12 -07:00
2022-03-28 19:38:51 -07:00
2019-05-30 11:26:35 -07:00
2017-11-02 11:10:55 +01:00
2022-01-30 21:17:00 -05:00
2022-01-30 21:17:00 -05:00
2017-11-02 11:10:55 +01:00
2023-01-25 12:33:40 +01:00
2020-04-23 10:50:26 +09:00
2017-11-02 11:10:55 +01:00
2024-07-03 21:27:04 +02:00
2024-05-03 17:07:50 +02:00
2024-03-29 14:24:50 +01:00
2021-04-30 11:20:40 -07:00
2024-06-25 17:15:48 +02:00
2024-04-19 12:15:20 -04:00
2024-07-15 20:25:16 -07:00
2024-02-15 19:21:39 -08:00
2024-07-19 20:22:12 +02:00
2024-06-19 12:35:18 -07:00
2024-06-17 17:46:02 +02:00
2022-02-11 20:39:39 +11:00
2017-11-02 11:10:55 +01:00
2022-02-11 20:39:39 +11:00
2022-02-11 20:39:39 +11:00