From: Joerg Roedel <jroedel@suse.de>
To: Paolo Bonzini <pbonzini@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>,
Andi Kleen <ak@linux.intel.com>,
David Rientjes <rientjes@google.com>,
Borislav Petkov <bp@alien8.de>, Andy Lutomirski <luto@kernel.org>,
Sean Christopherson <seanjc@google.com>,
Andrew Morton <akpm@linux-foundation.org>,
"Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>,
Brijesh Singh <brijesh.singh@amd.com>,
Tom Lendacky <thomas.lendacky@amd.com>,
Jon Grimm <jon.grimm@amd.com>,
Thomas Gleixner <tglx@linutronix.de>,
Christoph Hellwig <hch@lst.de>, Ingo Molnar <mingo@redhat.com>,
x86@kernel.org, linux-mm@kvack.org
Subject: Re: AMD SEV-SNP/Intel TDX: validation of memory pages
Date: Tue, 16 Feb 2021 19:26:40 +0100 [thread overview]
Message-ID: <20210216182640.GI12716@suse.de> (raw)
In-Reply-To: <92003e9a-c532-bede-1200-ef3b8f50bc6e@redhat.com>
On Tue, Feb 16, 2021 at 05:48:29PM +0100, Paolo Bonzini wrote:
> We should minimize the number of #VEs that we get, as they are very slow.
> Could almost everything that can invoke a #VE go through pvops and be turned
> into a TDCALL? And if so the same should be true for SEV-ES #VC as well.
The problem with that is that it requires the guest to know what the
hypervisor will intercept or what instruction will cause a #VE. I
considered this paravirtualization for #VC, but stayed away from it for
that exact reason. You can't easily know which MMIO-access will cause a
#VE/#VC exception. Probing also doesn't work, as the Hypervisor can
change that at runtime. There is just no decent way to handle that
without taking the #VE/#VC. Or take 'hlt' for example, there are
hypervisor configurations which don't intercept it. How do you know that
from within the guest?
> > I guess those could all be replaced direct TDCALLs,
> > but the question remains whether this is possible with MSR accesses, means
> > that the list of MSRs which will cause #VEs is statically defined and
> > doesn't change between hypervisors. All in all this sounds hard to
> > maintain and easy to break by unrelated changes.
>
> I would expect that all MSRs except for a handful (SPEC_CTRL/PRED_CMD, the
> FS/GS/kernelGS bases, anything else?) would be redirect to TDCALL.
You never know which HV your guest runs under and what it intercepts. It
can certainly be made part of the Spec to only allow direct access to a
given set of MSRs in a TDX guest and require to intercept everything
else. But that Spec probably requires constant updating and will
certainly cause compatibility headaches in the future.
Regards,
Joerg
next prev parent reply other threads:[~2021-02-16 18:26 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-02 1:51 AMD SEV-SNP/Intel TDX: validation of memory pages David Rientjes
2021-02-02 13:17 ` Matthew Wilcox
2021-02-02 16:02 ` Kirill A. Shutemov
2021-02-03 0:16 ` Brijesh Singh
2021-02-11 17:46 ` Sean Christopherson
2021-02-02 22:37 ` Andi Kleen
2021-02-11 20:46 ` Peter Zijlstra
2021-02-12 13:19 ` Joerg Roedel
2021-02-12 14:17 ` Peter Zijlstra
2021-02-12 14:53 ` Joerg Roedel
2021-02-12 15:19 ` Peter Zijlstra
2021-02-12 15:28 ` Joerg Roedel
2021-02-12 16:12 ` Peter Zijlstra
2021-02-12 16:18 ` Joerg Roedel
2021-02-12 16:45 ` Peter Zijlstra
2021-02-12 17:48 ` Dave Hansen
2021-02-12 18:22 ` Sean Christopherson
2021-02-12 18:38 ` Andy Lutomirski
2021-02-12 18:43 ` Sean Christopherson
2021-02-12 18:46 ` Dave Hansen
2021-02-12 19:24 ` Sean Christopherson
2021-02-16 10:00 ` Joerg Roedel
2021-02-16 14:27 ` Andi Kleen
2021-02-16 14:46 ` Peter Zijlstra
2021-02-16 15:59 ` Paolo Bonzini
2021-02-16 16:25 ` Joerg Roedel
2021-02-16 16:48 ` Paolo Bonzini
2021-02-16 18:26 ` Joerg Roedel [this message]
2021-02-16 18:33 ` Paolo Bonzini
2021-02-16 16:47 ` Peter Zijlstra
2021-02-16 16:57 ` Andy Lutomirski
2021-02-16 17:05 ` Paolo Bonzini
2021-02-16 16:55 ` Andi Kleen
2021-02-12 21:42 ` Andi Kleen
2021-02-12 21:58 ` Peter Zijlstra
2021-02-12 22:39 ` Andi Kleen
2021-02-12 22:46 ` Andy Lutomirski
2021-02-13 9:38 ` Peter Zijlstra
2021-02-12 23:51 ` Paolo Bonzini
2021-03-23 9:33 ` Joerg Roedel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210216182640.GI12716@suse.de \
--to=jroedel@suse.de \
--cc=ak@linux.intel.com \
--cc=akpm@linux-foundation.org \
--cc=bp@alien8.de \
--cc=brijesh.singh@amd.com \
--cc=hch@lst.de \
--cc=jon.grimm@amd.com \
--cc=kirill.shutemov@linux.intel.com \
--cc=linux-mm@kvack.org \
--cc=luto@kernel.org \
--cc=mingo@redhat.com \
--cc=pbonzini@redhat.com \
--cc=peterz@infradead.org \
--cc=rientjes@google.com \
--cc=seanjc@google.com \
--cc=tglx@linutronix.de \
--cc=thomas.lendacky@amd.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.