Received-SPF: pass (google.com: domain of linux-kernel+bounces-93189-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
Message-ID: <a8dbea9d-cca7-4720-9193-6dbeaa62bb67@intel.com>
Date: Wed, 6 Mar 2024 14:22:17 +1300
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH 09/16] KVM: x86/mmu: Move private vs. shared check above
 slot validity checks
Content-Language: en-US
To: Sean Christopherson <seanjc@google.com>
CC: Paolo Bonzini <pbonzini@redhat.com>, <kvm@vger.kernel.org>,
	<linux-kernel@vger.kernel.org>, Yan Zhao <yan.y.zhao@intel.com>, "Isaku
 Yamahata" <isaku.yamahata@intel.com>, Michael Roth <michael.roth@amd.com>, Yu
 Zhang <yu.c.zhang@linux.intel.com>, Chao Peng <chao.p.peng@linux.intel.com>,
	Fuad Tabba <tabba@google.com>, David Matlack <dmatlack@google.com>
References: <20240228024147.41573-1-seanjc@google.com>
 <20240228024147.41573-10-seanjc@google.com>
 <adbcdeaa-a780-49cb-823c-3980a4dfea12@intel.com>
 <Zee7IhqAU_UZFToW@google.com>
From: "Huang, Kai" <kai.huang@intel.com>
In-Reply-To: <Zee7IhqAU_UZFToW@google.com>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?Tm5iYmt5TkhuQXUrK1krdGtkV0tkcDErQ3F6UUkxeXpTejNIekloNnhVRXh5?=
 =?utf-8?B?VkVxVEVBMHAwVmNueU4wdzVFNEcvMUZiandrRlVqbWJtS1ZnMlYvNU52UGtJ?=
 =?utf-8?B?S0E0ODlqU1lJdC9VVWhpTTErc1JIc1ZkNWVEN1pHQnVVY2ljVjNPeWMrWnpC?=
 =?utf-8?B?a3V3UzEzNHYzNXY0NWRUb0k1RjlPakhsamlIclozaHA5cFFTdkZjQjZ6YzEy?=
 =?utf-8?B?cmRiQjBRQ1Y4SnhsNG5ra2ZlWkpWL2dSb2RXbUdQaVd0SGIrMStmb0hjVkJ3?=
 =?utf-8?B?bS8wb3RlZG9oeEs0eTIxMU9kMDNtL21HOEE0dXplZ1dPWG84MStTYTJBZ1hE?=
 =?utf-8?B?eFNyQnNjMkg4YkdKQXh3ZkFxMGV1bENRays5V25kekJYaWdNelpkRWZaK1Iy?=
 =?utf-8?B?KzJzU1N6WElUTERXY1g4RmloRFdRRzh6OVpSSVRtUGQ0MEtoTCswSVY2NFZL?=
 =?utf-8?B?VHZBNTJOSGM5c2hiSDFTeGg2Wnc5SWZsK1UzdzhvWmc1V25Nb25RZ1p6MTJC?=
 =?utf-8?B?UERiMXozNkx4Y2o1VWhweHdxQ3lhY2pIUzJiQ2lhWlViZjh2bHQycDJFQ1J6?=
 =?utf-8?B?Wm0rVnF6WHZ2bk9zSlNsbTcrZ0pjZTlmbG9RMzhQdWh1SnhDdnA5dGxIRkgv?=
 =?utf-8?B?VUh0cnpEV2lUajREV0wvRHJiNktHVDVJamhlWXhTUFkxeElaRUtBVytlZ1JW?=
 =?utf-8?B?eXFFMVRvV3VVdCtEdGFUTUltZ3lvS0FpRXU0bnhmaUx0U0xJMmxVNTVVU3Nk?=
 =?utf-8?B?aHNvbmJ5OEsyN0pFeE4yMDZNdVBwbll6cXFRemVuVFJRS09jVG1tUWs4MGk3?=
 =?utf-8?B?OTJVekN1UmpmN3VWeW5DaEFWQUdSTHpNdkZSdE50QzhkenllN05LbUhUQWRE?=
 =?utf-8?B?QWxMZHovdnhjeVZ6aWhqRjdxRXladU9ERnhxdmhYRWF0aTAyUnBMNE5lKzht?=
 =?utf-8?B?VDRJeXlFeXdSNzNkQi9hcm1MdVR5NGFMNTNmSVVCbnpyT3hFaFJoQ3RmQVNH?=
 =?utf-8?B?VXdvYlR4RG00NDlud1g2cTR2OXA4RmRLSFgreG05OWZyV0hNSzZQUTNiaFdw?=
 =?utf-8?B?NXZkcDg5ZDlrZUo3cHlqbFViWjU3NDZiOUU0U0hEdkU5QVZWakRScE1QWGVV?=
 =?utf-8?B?MnhBV2ZQUG0rSmVqckNVMDZ6TjNtWDdiQXhVQVRCV29zSUdpOW1kSzNaTFc4?=
 =?utf-8?B?OFBWWFR4bjRZNloyOWQ0dEVxL09ESVl5TkZqbm5DR2YwUmZCVjZwaVE2Uk9R?=
 =?utf-8?B?ZkIxT1pjUmlNN2w4WGtFc2gyMDdzYmZXajFJdUtyc3lIa1BwZEI0OGVOUHBW?=
 =?utf-8?B?SVduaUNyaU83WmVpNkxYa3NtSEEzc2EwWlRQU2RKbUZPSGtlK2pOQkF4S0Nh?=
 =?utf-8?B?MUswTUhzV2ZUNk1KdnZMdXl2bzN1UEgyZVNuNFBoNWJ0UXR1S29TQzRDU0x5?=
 =?utf-8?B?NmlOZkxTelJuaE5hUXFkRll3WGpHZmlJWWdTeFpyaExPTFk1bWMxeTdENkhr?=
 =?utf-8?B?aXFBZnJYTkNBN1RaMWpLMCtJWThFT3FiWm44SlNaSXJGNUp6Nkh2NGRHTWda?=
 =?utf-8?B?MHo2WlBNRFQ0RnhJdEt6Ty9MM3UxUCttVEFnK0QxOWt3S0NvQytJMjl0RlJa?=
 =?utf-8?B?Q1ZrYzlkOU52RGkyM3FkR1IzMUk1cllIV1owYkhFOXo3eEFpV21WY1Z2ODhI?=
 =?utf-8?B?bUduUnh5YnF6YjhRVit1YXlNbFdvTEFyVTlnUlNlRldFRU1iNEZBQUwxUEEz?=
 =?utf-8?B?ZU15c0tMK2RuRi9RWjdQaUNVL1JnanFXa1ZvZEhWS0RuODh0K1R2Mnk2bVFl?=
 =?utf-8?B?a0N3c3l3eEpUMWFHaHNubm5UWmtCVGRGNGJoMVVqbVgvS0F4blRxbWFYdE53?=
 =?utf-8?B?TWNpUjVtWndNZW4vMk54ZnFSTXlmZTVPSDg4V3Fwb05GMkUvOExpUHhpc1RE?=
 =?utf-8?B?TVpmVVpndkNHK2t3bFhwZVRDK2NnczN1V0xzZ3VWM1lxMlQ5Wlp6QTR0VEpL?=
 =?utf-8?B?OEJIemJURUhBdFZzdVR4MmZSU3RCYmJHRlRGYXZOVkFPbFA2cWNpUFFjMFY1?=
 =?utf-8?B?OFFTUnB4a1BESm1ERHViQVhKUWNMdmhBQUdOazViTUJTZzlVVWg4d0ppMXFv?=
 =?utf-8?Q?hAnkZOfjVQC2eCukOyPEG9b/T?=
X-MS-Exchange-CrossTenant-Network-Message-Id: e85ca6ef-294b-4cbc-77a2-08dc3d7be29c
X-MS-Exchange-CrossTenant-AuthSource: BL1PR11MB5978.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 06 Mar 2024 01:22:27.3736
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: p6OVmipGxPLWxe60x7BHhREfgRThRku8LNc+1umpLRsCGKcCecdsvRpiDj2SCt4uOYWy/d/T4j4DXQGgu3LZvQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MW4PR11MB6617
X-OriginatorOrg: intel.com


On 6/03/2024 1:38 pm, Sean Christopherson wrote:
> On Wed, Mar 06, 2024, Kai Huang wrote:
>>
>>
>> On 28/02/2024 3:41 pm, Sean Christopherson wrote:
>>> Prioritize private vs. shared gfn attribute checks above slot validity
>>> checks to ensure a consistent userspace ABI.  E.g. as is, KVM will exit to
>>> userspace if there is no memslot, but emulate accesses to the APIC access
>>> page even if the attributes mismatch.
>>
>> IMHO, it would be helpful to explicitly say that, in the later case (emulate
>> APIC access page) we still want to report MEMORY_FAULT error first (so that
>> userspace can have chance to fixup, IIUC) instead of emulating directly,
>> which will unlikely work.
> 
> Hmm, it's not so much that emulating directly won't work, it's that KVM would be
> violating its ABI.  Emulating APIC accesses after userspace converted the APIC
> gfn to private would still work (I think), but KVM's ABI is that emulated MMIO
> is shared-only.

But for (at least) TDX guest I recall we _CAN_ allow guest's MMIO to be 
mapped as private, right?  The guest is supposed to get a #VE anyway?

Perhaps I am missing something -- I apologize if this has already been 
discussed.

> 
> FWIW, I doubt there's a legitmate use case for converting the APIC gfn to private,
> this is purely to ensure KVM has simple, consistent rules for how private vs.
> shared access work.

Again I _think_ for TDX APIC gfn can be private?  IIUC virtualizing APIC 
is done by the TDX module, which injects #VE to guest when emulation is 
required.