Re: [PATCH v6 06/11] x86/traps: Add #VE support for TDX guest

From: Dave Hansen <dave.hansen@intel.com>
To: Joerg Roedel <joro@8bytes.org>,
	Kuppuswamy Sathyanarayanan 
	<sathyanarayanan.kuppuswamy@linux.intel.com>
Cc: Thomas Gleixner <tglx@linutronix.de>,
	Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
	x86@kernel.org, Paolo Bonzini <pbonzini@redhat.com>,
	Juergen Gross <jgross@suse.com>, Deep Shah <sdeep@vmware.com>,
	VMware Inc <pv-drivers@vmware.com>,
	Vitaly Kuznetsov <vkuznets@redhat.com>,
	Wanpeng Li <wanpengli@tencent.com>,
	Jim Mattson <jmattson@google.com>, Peter H Anvin <hpa@zytor.com>,
	Tony Luck <tony.luck@intel.com>,
	Dan Williams <dan.j.williams@intel.com>,
	Andi Kleen <ak@linux.intel.com>,
	Kirill Shutemov <kirill.shutemov@linux.intel.com>,
	Sean Christopherson <seanjc@google.com>,
	Kuppuswamy Sathyanarayanan <knsathya@kernel.org>,
	linux-kernel@vger.kernel.org
Subject: Re: [PATCH v6 06/11] x86/traps: Add #VE support for TDX guest
Date: Tue, 28 Sep 2021 07:05:40 -0700	[thread overview]
Message-ID: <63e59789-ce23-6b2b-5ef4-3782e7ddffd6@intel.com> (raw)
In-Reply-To: <YVMHmt/cf63w93A+@8bytes.org>

On 9/28/21 5:16 AM, Joerg Roedel wrote:
> On Fri, Sep 03, 2021 at 10:28:07AM -0700, Kuppuswamy Sathyanarayanan wrote:
>> In the settings that Linux will run in, virtual exceptions are never
>> generated on accesses to normal, TD-private memory that has been
>> accepted.
> 
> Does this also hold true when the Hypervisor does unexpected things that
> cause previously accepted pages to become unaccepted again? This means
> pages like the entry code pages or other memory that is touched before
> the syscall entry path switched stacks.
> 
> Can you sched some light on what happens in such a situation?

"Shared" pages can cause #VE's.  The guest must be careful not to touch
them in the syscall entry path, for example.  But, shared pages are
untrusted so they're not use for stacks.

"Private" pages can cause #VE's.  But, only *some* of them.  Before a
page is accepted, it is in the SEPT_PENDING and a reference would cause
a #VE.  But, after acceptance, page references either succeed or a TD
Exit and the hypervisor gets to handle the situation.

Basically, if the hypervisor does unexpected things, the hypervisor gets
to handle it.

The "Intel® TDX Module 1.0 Specification" from

https://software.intel.com/content/www/us/en/develop/articles/intel-trust-domain-extensions.html

has more details:

> 10.10.2. #VE Injection by the CPU due to EPT Violations
> #VE is enabled unconditionally for TDX non-root operation. The Intel TDX module sets the TD VMCS EPT-violation #VE
> VM-execution control to 1.
> For shared memory accesses (i.e., when GPA.SHARED == 1), as with legacy VMX, the VMM can choose which pages are
> eligible for #VE mutation based on the value of the Shared EPTE bit 63.
> For private memory accesses (GPA.SHARED == 0), an EPT Violation causes a TD Exit in most cases, except when the Secure
> EPT entry state is SEPT_PENDING (an exception to this is described in 10.11.1 below). The Intel TDX module sets the
> Secure EPT entry’s Suppress VE bit (63) to 0 if the entry’s state is SEPT_PENDING. It sets that bit to 1 for all other entry
> states.