kvm.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Laszlo Ersek <lersek@redhat.com>
To: Xiaoyao Li <xiaoyao.li@intel.com>,
	Gerd Hoffmann <kraxel@redhat.com>,
	isaku.yamahata@gmail.com
Cc: qemu-devel@nongnu.org, pbonzini@redhat.com,
	alistair@alistair23.me, ehabkost@redhat.com,
	marcel.apfelbaum@gmail.com, mst@redhat.com, cohuck@redhat.com,
	mtosatti@redhat.com, seanjc@google.com, erdemaktas@google.com,
	kvm@vger.kernel.org, isaku.yamahata@intel.com,
	"Min M . Xu" <min.m.xu@intel.com>
Subject: Re: [RFC PATCH v2 20/44] i386/tdx: Parse tdx metadata and store the result into TdxGuestState
Date: Thu, 6 Jan 2022 17:06:50 +0100	[thread overview]
Message-ID: <4eb6a628-0af6-409b-7e42-52787ee3e69d@redhat.com> (raw)
In-Reply-To: <a97a75ad-9d1c-a09f-281b-d6b0a7652e78@intel.com>

On 01/04/22 14:08, Xiaoyao Li wrote:

> + Laszlo,
> 
> Regarding laoding TDVF as pflash, I have some questions:
> 
> - pflash requires KVM to support readonly mmeory. However, for TDX, it
> doesn't support readonly memory. Is it a must? or we can make an
> exception for TDX?
> 
> - I saw from
> https://lists.gnu.org/archive/html/qemu-discuss/2018-04/msg00045.html,
> you said when load OVMF as pflash, it's MMIO. But for TDVF, it's treated
> as private memory. I'm not sure whether it will cause some potential
> problem if loading TDVF with pflash.
> 
> Anyway I tried changing the existing pflash approach to load TDVF. It
> can boot a TDX VM and no issue.

I have no comments on whether TDX should or should not use pflash.

If you go without pflash, then you likely will not have a
standards-conformant UEFI variable store. (Unless you reimplement the
variable arch protocols in edk2 on top of something else than the Fault
Tolerant Write and Firmware Volume Block protocols.) Whether a
conformant UEFI varstore matters to you (or to TDX in general) is
something I can't comment on.

(I've generally stopped commenting on confidential computing topics, but
this message allows for comments on just pflash, and how it impacts OVMF.)

Regarding pflash itself, the read-only KVM memslot is required for it.
Otherwise pflash cannot work as a "ROMD device" (= you can't flip it
back and forth between ROM mode and programming (MMIO) mode).

Thanks
Laszlo


  reply	other threads:[~2022-01-06 16:07 UTC|newest]

Thread overview: 91+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-07-08  0:54 [RFC PATCH v2 00/44] TDX support isaku.yamahata
2021-07-08  0:54 ` [RFC PATCH v2 01/44] target/i386: Expose x86_cpu_get_supported_feature_word() for TDX isaku.yamahata
2021-07-22 17:52   ` Connor Kuehl
2021-07-08  0:54 ` [RFC PATCH v2 02/44] kvm: Switch KVM_CAP_READONLY_MEM to a per-VM ioctl() isaku.yamahata
2021-07-22 17:52   ` Connor Kuehl
2021-07-08  0:54 ` [RFC PATCH v2 03/44] i386/kvm: Move architectural CPUID leaf generation to separarte helper isaku.yamahata
2021-07-08  0:54 ` [RFC PATCH v2 04/44] vl: Introduce machine_init_done_late notifier isaku.yamahata
2021-07-22 17:52   ` Connor Kuehl
2021-08-26 10:13   ` Gerd Hoffmann
2021-07-08  0:54 ` [RFC PATCH v2 05/44] linux-headers: Update headers to pull in TDX API changes isaku.yamahata
2021-07-08  0:54 ` [RFC PATCH v2 06/44] hw/i386: Introduce kvm-type for TDX guest isaku.yamahata
2021-07-22 17:53   ` Connor Kuehl
2021-08-26 10:22   ` Gerd Hoffmann
2021-11-24  7:31     ` Xiaoyao Li
2022-01-10 11:18       ` Daniel P. Berrangé
2022-01-10 12:01         ` Xiaoyao Li
2022-01-10 12:05           ` Daniel P. Berrangé
2021-07-08  0:54 ` [RFC PATCH v2 07/44] i386/kvm: Squash getting/putting guest state for TDX VMs isaku.yamahata
2021-08-26 10:24   ` Gerd Hoffmann
2021-12-09  3:33     ` Xiaoyao Li
2021-07-08  0:54 ` [RFC PATCH v2 08/44] i386/kvm: Skip KVM_X86_SETUP_MCE for TDX guests isaku.yamahata
2021-07-08  0:54 ` [RFC PATCH v2 09/44] target/i386: kvm: don't synchronize guest tsc for TD guest isaku.yamahata
2021-07-22 17:53   ` Connor Kuehl
2021-07-08  0:54 ` [RFC PATCH v2 10/44] hw/i386: Initialize TDX via KVM ioctl() when kvm_type is TDX isaku.yamahata
2021-08-26 10:27   ` Gerd Hoffmann
2021-08-26 15:06   ` Eric Blake
2021-07-08  0:54 ` [RFC PATCH v2 11/44] i386/tdx: Implement user specified tsc frequency isaku.yamahata
2021-07-22 17:53   ` Connor Kuehl
2021-12-02  8:56     ` Xiaoyao Li
2021-07-08  0:54 ` [RFC PATCH v2 12/44] target/i386/tdx: Finalize the TD's measurement when machine is done isaku.yamahata
2021-07-22 17:53   ` Connor Kuehl
2021-07-08  0:54 ` [RFC PATCH v2 13/44] i386/tdx: Frame in tdx_get_supported_cpuid with KVM_TDX_CAPABILITIES isaku.yamahata
2021-07-08  0:54 ` [RFC PATCH v2 14/44] i386/tdx: Frame in the call for KVM_TDX_INIT_VCPU isaku.yamahata
2021-07-08  0:54 ` [RFC PATCH v2 15/44] i386/tdx: Add hook to require generic device loader isaku.yamahata
2021-08-26 10:41   ` Gerd Hoffmann
2021-07-08  0:54 ` [RFC PATCH v2 16/44] hw/i386: Add definitions from UEFI spec for volumes, resources, etc isaku.yamahata
2021-08-26 10:46   ` Gerd Hoffmann
2021-07-08  0:54 ` [RFC PATCH v2 17/44] i386/tdx: Add definitions for TDVF metadata isaku.yamahata
2021-07-08  0:54 ` [RFC PATCH v2 18/44] hw/i386: refactor e820_add_entry() isaku.yamahata
2021-08-26 10:49   ` Gerd Hoffmann
2021-07-08  0:54 ` [RFC PATCH v2 19/44] hw/i386/e820: introduce a helper function to change type of e820 isaku.yamahata
2021-08-26 11:22   ` Gerd Hoffmann
2021-07-08  0:54 ` [RFC PATCH v2 20/44] i386/tdx: Parse tdx metadata and store the result into TdxGuestState isaku.yamahata
2021-08-26 11:18   ` Gerd Hoffmann
2022-01-04 13:08     ` Xiaoyao Li
2022-01-06 16:06       ` Laszlo Ersek [this message]
2022-01-07  7:05         ` Xiaoyao Li
2022-01-10 11:01           ` Gerd Hoffmann
2022-01-10 12:09             ` Xiaoyao Li
2022-01-11  8:19               ` Laszlo Ersek
2022-01-24  6:22             ` Xiaoyao Li
2022-01-25  7:42               ` Gerd Hoffmann
2022-01-25  8:22                 ` Xiaoyao Li
2021-07-08  0:54 ` [RFC PATCH v2 21/44] i386/tdx: Create the TD HOB list upon machine init done isaku.yamahata
2021-08-26 11:29   ` Gerd Hoffmann
2021-07-08  0:54 ` [RFC PATCH v2 22/44] i386/tdx: Add TDVF memory via INIT_MEM_REGION isaku.yamahata
2021-07-08  0:54 ` [RFC PATCH v2 23/44] i386/tdx: Use KVM_TDX_INIT_VCPU to pass HOB to TDVF isaku.yamahata
2021-07-08  0:54 ` [RFC PATCH v2 24/44] i386/tdx: Add MMIO HOB entries isaku.yamahata
2021-08-26 12:17   ` Gerd Hoffmann
2021-07-08  0:54 ` [RFC PATCH v2 25/44] q35: Move PCIe BAR check above PAM check in mch_write_config() isaku.yamahata
2021-07-08  0:54 ` [RFC PATCH v2 26/44] pci-host/q35: Move PAM initialization above SMRAM initialization isaku.yamahata
2021-07-08  0:54 ` [RFC PATCH v2 27/44] q35: Introduce smm_ranges property for q35-pci-host isaku.yamahata
2021-08-26 11:38   ` Gerd Hoffmann
2021-07-08  0:54 ` [RFC PATCH v2 28/44] i386/tdx: Force x2apic mode and routing for TDs isaku.yamahata
2021-08-26 11:42   ` Gerd Hoffmann
2021-07-08  0:54 ` [RFC PATCH v2 29/44] target/i386: Add machine option to disable PIC/8259 isaku.yamahata
2021-08-26 11:50   ` Gerd Hoffmann
2021-07-08  0:55 ` [RFC PATCH v2 30/44] qom: implement property helper for sha384 isaku.yamahata
2021-07-08  0:55 ` [RFC PATCH v2 31/44] target/i386/tdx: Allows mrconfigid/mrowner/mrownerconfig for TDX_INIT_VM isaku.yamahata
2021-08-26 15:13   ` Eric Blake
2021-07-08  0:55 ` [RFC PATCH v2 32/44] tdx: add kvm_tdx_enabled() accessor for later use isaku.yamahata
2021-07-22 17:53   ` Connor Kuehl
2021-12-09 14:31     ` Xiaoyao Li
2021-07-08  0:55 ` [RFC PATCH v2 33/44] qmp: add query-tdx-capabilities query-tdx command isaku.yamahata
2021-08-26 11:59   ` Gerd Hoffmann
2021-08-26 15:21   ` Eric Blake
2021-07-08  0:55 ` [RFC PATCH v2 34/44] target/i386/tdx: set reboot action to shutdown when tdx isaku.yamahata
2021-07-22 17:54   ` Connor Kuehl
2021-12-10  9:54     ` Xiaoyao Li
2021-08-26 12:01   ` Gerd Hoffmann
2021-07-08  0:55 ` [RFC PATCH v2 35/44] ioapic: add property to disable level interrupt isaku.yamahata
2021-07-08  0:55 ` [RFC PATCH v2 36/44] hw/i386: add eoi_intercept_unsupported member to X86MachineState isaku.yamahata
2021-07-08  0:55 ` [RFC PATCH v2 37/44] hw/i386: add option to forcibly report edge trigger in acpi tables isaku.yamahata
2021-07-08  0:55 ` [RFC PATCH v2 38/44] hw/i386: plug eoi_intercept_unsupported to ioapic isaku.yamahata
2021-07-08  0:55 ` [RFC PATCH v2 39/44] ioapic: add property to disallow SMI delivery mode isaku.yamahata
2021-07-08  0:55 ` [RFC PATCH v2 40/44] hw/i386: add a flag to disallow SMI isaku.yamahata
2021-07-08  0:55 ` [RFC PATCH v2 41/44] ioapic: add property to disallow INIT/SIPI delivery mode isaku.yamahata
2021-07-08  0:55 ` [RFC PATCH v2 42/44] hw/i386: add a flag to disable init/sipi delivery mode of interrupt isaku.yamahata
2021-08-26 12:15   ` Gerd Hoffmann
2021-07-08  0:55 ` [RFC PATCH v2 43/44] i386/tdx: disallow level interrupt and SMI/INIT/SIPI delivery mode isaku.yamahata
2021-07-08  0:55 ` [RFC PATCH v2 44/44] i386/tdx: disable S3/S4 unconditionally isaku.yamahata

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=4eb6a628-0af6-409b-7e42-52787ee3e69d@redhat.com \
    --to=lersek@redhat.com \
    --cc=alistair@alistair23.me \
    --cc=cohuck@redhat.com \
    --cc=ehabkost@redhat.com \
    --cc=erdemaktas@google.com \
    --cc=isaku.yamahata@gmail.com \
    --cc=isaku.yamahata@intel.com \
    --cc=kraxel@redhat.com \
    --cc=kvm@vger.kernel.org \
    --cc=marcel.apfelbaum@gmail.com \
    --cc=min.m.xu@intel.com \
    --cc=mst@redhat.com \
    --cc=mtosatti@redhat.com \
    --cc=pbonzini@redhat.com \
    --cc=qemu-devel@nongnu.org \
    --cc=seanjc@google.com \
    --cc=xiaoyao.li@intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).