[lkml]   [2021]   [Feb]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [RFC v1 05/26] x86/traps: Add #VE support for TDX guest
On Fri, Feb 12, 2021, Dave Hansen wrote:
> On 2/12/21 12:06 PM, Sean Christopherson wrote:
> >> What happens if the guest attempts to access a secure GPA that is not
> >> ACCEPTed? For example, suppose the VMM does THH.MEM.PAGE.REMOVE on a secure
> >> address and the guest accesses it, via instruction fetch or data access.
> >> What happens?
> > Well, as currently written in the spec, it will generate an EPT violation and
> > the host will have no choice but to kill the guest.
> That's actually perfect behavior from my perspective. Host does
> something stupid. Host gets left holding the pieces. No enabling to do
> in the guest.
> This doesn't *preclude* the possibility that the VMM and guest could
> establish a protocol to remove guest pages. It just means that the host
> can't go it alone and that if they guest and host get out of sync, the
> guest dies.
> In other words, I think I'm rooting for the docs, as written. :)

I tentatively agree that the host should not be able to remove pages without
guest approval, but that's not the only use case for #VE on EPT violations.
It's not even really an intended use case.

There needs to be a mechanism for lazy/deferred/on-demand acceptance of pages.
E.g. pre-accepting every page in a VM with hundreds of GB of memory will be
ridiculously slow.

#VE is the best option to do that:

- Relatively sane re-entrancy semantics.
- Hardware accelerated.
- Doesn't require stealing an IRQ from the guest.

 \ /
  Last update: 2021-02-12 21:40    [W:0.125 / U:33.200 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site