From: "Huang, Kai" <kai.huang@intel.com>
To: "seanjc@google.com" <seanjc@google.com>
Cc: "dmatlack@google.com" <dmatlack@google.com>,
"federico.parola@polito.it" <federico.parola@polito.it>,
"isaku.yamahata@gmail.com" <isaku.yamahata@gmail.com>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"kvm@vger.kernel.org" <kvm@vger.kernel.org>,
"michael.roth@amd.com" <michael.roth@amd.com>,
"Yamahata, Isaku" <isaku.yamahata@intel.com>,
"pbonzini@redhat.com" <pbonzini@redhat.com>
Subject: Re: [RFC PATCH 6/8] KVM: x86: Implement kvm_arch_{, pre_}vcpu_map_memory()
Date: Tue, 12 Mar 2024 21:41:11 +0000 [thread overview]
Message-ID: <3c840ebd9b14d7a9abe0a563e2b6847273369dcd.camel@intel.com> (raw)
In-Reply-To: <ZfBkle1eZFfjPI8l@google.com>
On Tue, 2024-03-12 at 07:20 -0700, Sean Christopherson wrote:
> On Tue, Mar 12, 2024, Kai Huang wrote:
> > > Wait. KVM doesn't *need* to do PAGE.ADD from deep in the MMU. The only inputs to
> > > PAGE.ADD are the gfn, pfn, tdr (vm), and source. The S-EPT structures need to be
> > > pre-built, but when they are built is irrelevant, so long as they are in place
> > > before PAGE.ADD.
> > >
> > > Crazy idea. For TDX S-EPT, what if KVM_MAP_MEMORY does all of the SEPT.ADD stuff,
> > > which doesn't affect the measurement, and even fills in KVM's copy of the leaf EPTE,
> > > but tdx_sept_set_private_spte() doesn't do anything if the TD isn't finalized?
> > >
> > > Then KVM provides a dedicated TDX ioctl(), i.e. what is/was KVM_TDX_INIT_MEM_REGION,
> > > to do PAGE.ADD. KVM_TDX_INIT_MEM_REGION wouldn't need to map anything, it would
> > > simply need to verify that the pfn from guest_memfd() is the same as what's in
> > > the TDP MMU.
> >
> > One small question:
> >
> > What if the memory region passed to KVM_TDX_INIT_MEM_REGION hasn't been pre-
> > populated? If we want to make KVM_TDX_INIT_MEM_REGION work with these regions,
> > then we still need to do the real map. Or we can make KVM_TDX_INIT_MEM_REGION
> > return error when it finds the region hasn't been pre-populated?
>
> Return an error. I don't love the idea of bleeding so many TDX details into
> userspace, but I'm pretty sure that ship sailed a long, long time ago.
In this case, IIUC the KVM_MAP_MEMORY ioctl() will be mandatory for TDX
(presumbly also SNP) guests, but _optional_ for other VMs. Not sure whether
this is ideal.
And just want to make sure I understand the background correctly:
The KVM_MAP_MEMORY ioctl() is supposed to be generic, and it should be able to
be used by any VM but not just CoCo VMs (including SW_PROTECTED ones)?
But it is only supposed to be used by the VMs which use guest_memfd()? Because
IIUC for normal VMs using mmap() we already have MAP_POPULATE for this purpose.
Looking at [*], it doesn't say what kind of VM the sender was trying to use.
Therefore can we interpret KVM_MAP_MEMORY ioctl() is effectively for CoCo VMs?
SW_PROTECTED VMs can also use guest_memfd(), but I believe nobody is going to
use it seriously.
[*] https://lore.kernel.org/all/65262e67-7885-971a-896d-ad9c0a760907@polito.it/
next prev parent reply other threads:[~2024-03-12 21:41 UTC|newest]
Thread overview: 54+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-01 17:28 [RFC PATCH 0/8] KVM: Prepopulate guest memory API isaku.yamahata
2024-03-01 17:28 ` [RFC PATCH 1/8] KVM: Document KVM_MAP_MEMORY ioctl isaku.yamahata
2024-03-07 0:43 ` David Matlack
2024-03-07 1:29 ` Isaku Yamahata
2024-03-07 12:30 ` Huang, Kai
2024-03-07 20:33 ` Isaku Yamahata
2024-03-08 0:20 ` Huang, Kai
2024-03-08 0:56 ` David Matlack
2024-03-08 1:28 ` Sean Christopherson
2024-03-08 2:19 ` Isaku Yamahata
2024-03-10 23:12 ` Michael Roth
2024-03-11 1:05 ` Huang, Kai
2024-03-11 1:08 ` Huang, Kai
2024-03-12 1:34 ` Isaku Yamahata
2024-03-01 17:28 ` [RFC PATCH 2/8] KVM: Add KVM_MAP_MEMORY vcpu ioctl to pre-populate guest memory isaku.yamahata
2024-03-07 0:49 ` David Matlack
2024-03-07 2:52 ` Isaku Yamahata
2024-03-07 12:45 ` Huang, Kai
2024-03-07 20:41 ` Isaku Yamahata
2024-03-11 17:23 ` Sean Christopherson
2024-03-11 22:19 ` Isaku Yamahata
2024-03-01 17:28 ` [RFC PATCH 3/8] KVM: x86/mmu: Introduce initialier macro for struct kvm_page_fault isaku.yamahata
2024-03-11 17:24 ` Sean Christopherson
2024-03-11 22:56 ` Isaku Yamahata
2024-03-01 17:28 ` [RFC PATCH 4/8] KVM: x86/mmu: Factor out kvm_mmu_do_page_fault() isaku.yamahata
2024-03-01 17:28 ` [RFC PATCH 5/8] KVM: x86/mmu: Introduce kvm_mmu_map_page() for prepopulating guest memory isaku.yamahata
2024-03-07 0:38 ` David Matlack
2024-03-19 15:53 ` Isaku Yamahata
2024-03-11 17:29 ` Sean Christopherson
2024-03-11 22:57 ` Isaku Yamahata
2024-03-01 17:28 ` [RFC PATCH 6/8] KVM: x86: Implement kvm_arch_{, pre_}vcpu_map_memory() isaku.yamahata
2024-03-07 0:30 ` David Matlack
2024-03-07 0:36 ` David Matlack
2024-03-07 1:51 ` Isaku Yamahata
2024-03-19 16:26 ` Isaku Yamahata
2024-04-03 23:15 ` Sean Christopherson
2024-03-07 1:34 ` Isaku Yamahata
2024-03-11 23:26 ` Sean Christopherson
2024-03-12 12:38 ` Huang, Kai
2024-03-12 14:20 ` Sean Christopherson
2024-03-12 21:41 ` Huang, Kai [this message]
2024-03-12 21:46 ` Huang, Kai
2024-03-12 23:03 ` Sean Christopherson
2024-03-01 17:28 ` [RFC PATCH 7/8] KVM: x86: Add hooks in kvm_arch_vcpu_map_memory() isaku.yamahata
2024-03-01 17:28 ` [RFC PATCH 8/8] KVM: selftests: x86: Add test for KVM_MAP_MEMORY isaku.yamahata
2024-03-07 0:53 ` [RFC PATCH 0/8] KVM: Prepopulate guest memory API David Matlack
2024-03-07 2:09 ` Isaku Yamahata
2024-03-19 16:33 ` Isaku Yamahata
2024-04-03 18:30 ` Sean Christopherson
2024-04-03 22:00 ` Isaku Yamahata
2024-04-03 22:42 ` Sean Christopherson
2024-03-11 3:20 ` Michael Roth
2024-03-11 23:44 ` Sean Christopherson
2024-03-12 1:32 ` Isaku Yamahata
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=3c840ebd9b14d7a9abe0a563e2b6847273369dcd.camel@intel.com \
--to=kai.huang@intel.com \
--cc=dmatlack@google.com \
--cc=federico.parola@polito.it \
--cc=isaku.yamahata@gmail.com \
--cc=isaku.yamahata@intel.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=michael.roth@amd.com \
--cc=pbonzini@redhat.com \
--cc=seanjc@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).