Received-SPF: pass (google.com: domain of linux-kernel+bounces-180495-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
Message-ID: <66afc965-b3f5-41e5-8b8e-d19e7084b690@intel.com>
Date: Thu, 16 May 2024 11:38:30 +1200
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH 08/16] KVM: x86/mmu: Bug the VM if kvm_zap_gfn_range() is
 called for TDX
To: "Edgecombe, Rick P" <rick.p.edgecombe@intel.com>, "seanjc@google.com"
	<seanjc@google.com>, "Yamahata, Isaku" <isaku.yamahata@intel.com>
CC: "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	"sagis@google.com" <sagis@google.com>, "isaku.yamahata@linux.intel.com"
	<isaku.yamahata@linux.intel.com>, "isaku.yamahata@gmail.com"
	<isaku.yamahata@gmail.com>, "Aktas, Erdem" <erdemaktas@google.com>, "Zhao,
 Yan Y" <yan.y.zhao@intel.com>, "dmatlack@google.com" <dmatlack@google.com>,
	"kvm@vger.kernel.org" <kvm@vger.kernel.org>, "pbonzini@redhat.com"
	<pbonzini@redhat.com>
References: <20240515005952.3410568-1-rick.p.edgecombe@intel.com>
 <20240515005952.3410568-9-rick.p.edgecombe@intel.com>
 <ZkTWDfuYD-ThdYe6@google.com> <20240515162240.GC168153@ls.amr.corp.intel.com>
 <eab9201e-702e-46bc-9782-d6dfe3da2127@intel.com>
 <d4c96caffd2633a70a140861d91794cdb54c7655.camel@intel.com>
Content-Language: en-US
From: "Huang, Kai" <kai.huang@intel.com>
In-Reply-To: <d4c96caffd2633a70a140861d91794cdb54c7655.camel@intel.com>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 8bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?OHA3THk5T1Q2bTdoMlJtd1Jlb2w1aUxwZzY1bGhyNUp0eTZ2cGFkS2NtYVRY?=
 =?utf-8?B?MW5seVJGcUVTUHFDRzQ1dG1kVU9jU1MvZXkwR3Ftd24xcG9TWXg1bmtVT1ZC?=
 =?utf-8?B?bHNzWUVka1c5VmlKcHNwL0U3MVlheWw1TXd3UG11M2k3cndyZHBhVmxnNldr?=
 =?utf-8?B?YWQvVERVWWVORXhKaXRkb0ttRTNBclY4M2xxOWZzOHJEdDZJYnhEL1ZsSXJi?=
 =?utf-8?B?aVRodjhGTVJwQkprRHl4dE1nN2I0ZWdEb0tIMm1YM283UjBkRFVoMkJrOVVa?=
 =?utf-8?B?eGdCREVrcEFWclFEblBJeUNZMVN3cm90b3dxQTJBWDJPQkJnMGZHQ0lKOTZl?=
 =?utf-8?B?M1d4VmR0SHEvVVoyR2t4VDlHV3NjKzhGMW9UWUJYcVJPVG9IaFFzeXdPNW03?=
 =?utf-8?B?Y2NIMXQxYkkwQVd4MFE3cDA1OXJZNDA1RlpVaFN4K21hV1ZMcUZVY1c5YmNQ?=
 =?utf-8?B?YzdidFMwSGFqNGpMN0VjSVdLOWlSNlVteGRVOFFyK0VhS1IwVlpYWTAyRmFQ?=
 =?utf-8?B?eHdjNyttaE5rY1RUWWJkMDkwTmlzaGFRem5yKzRNY1FRNk9hUzdHcGdPd2tQ?=
 =?utf-8?B?UDNXZXFySDZsUlh1R1pBanVMZ1RNVG5Halh5SVRKazNxTXgxYVU4T2Qza29J?=
 =?utf-8?B?d2FDbTJKNUtrZDlxbTc1Mm9zMkcwcHVsbkJYRUVKZDVZT0E5RTFyUVNjeDRP?=
 =?utf-8?B?WG9vZlYzaEhVWnNVZkg3blF1NElQdlA2U1FQdXBNM2RlNWJQSTk3S2ZYa1k2?=
 =?utf-8?B?Y0YyVzBZVUtjSmhVWHhvTXBjK0hmWHVhamVTTTg4RlJYa2libi9ralF0NWIy?=
 =?utf-8?B?Z0RvdHMwR2pONkZZaTBoL3hJbThqVG5VOWpuTEtQTWo0UHJGVDhGcUxmMmx1?=
 =?utf-8?B?UGtEUUcrcU96UEZDcWNQS205MGgwSFQzL0lKK0sreEpNS0RHc2p3aloxTisz?=
 =?utf-8?B?b3dwYmZWMlNVd3hna2xQMDdwTGpzdHBXZVM2R3p6djRQYWhqZGtyL0VORnZZ?=
 =?utf-8?B?bVV0ZU05aGRrT3ZoUzVGamFiOCtrWDBtd3JzMTRXN2VJVzFUMkV5TGFsSWtD?=
 =?utf-8?B?ZG83YkdoOWFEaCtOUlV3S1NFcU10U1Frdm1RWXhIRVRsaC9La1NSeGZidXFP?=
 =?utf-8?B?aEg0b1psM3BxbWV0YWExbkpPRUJlMjJpUVlVZHhPMDlQSlM5Z1U1YllDVCsv?=
 =?utf-8?B?aVZJUlZYbnZ2UGxrQytscmFKVzlOeU5qOFlHV21vRTYzQkwvbTAwYWJrcjcy?=
 =?utf-8?B?UmxHSkg4dmN0aFBXclVMQVpjYUlxYmtmTThzUENvbm5Ga1NrR3VWRzNxLzAr?=
 =?utf-8?B?Q01SYnhsdGNNcE5JNXhxMEUrNXVqRkh1NHU5NldGVHk1SUtRUFh0L3RiMGJ4?=
 =?utf-8?B?NWVOMnNNSUV4bFF2VlIrWmhtbHNTTkJWZG5IbTlkdks5QUduWmlBbXRQdEgw?=
 =?utf-8?B?c1JHOUJBVmlaSklIQXRrMWZVNXRoY1I0V3B0V3R3SWlheEp1SzUzdGsxR0xH?=
 =?utf-8?B?UXhyYjZVVzNlUVg2NFRrbk5DM3h6dThZNk1hOHVmT2R2enk0RnU5L2UrQ3A4?=
 =?utf-8?B?UUZ5MnNuQXg2ak5zTXg1dFJ4Y0dOckwvUjNRQ1NUckdsVGEyL2lUVVIxWVhR?=
 =?utf-8?B?YUtERWRadk05M1J1YWNEY0h1TjlTV3JMYWRzenpzSGUyUDhqdVNZeklOKzlw?=
 =?utf-8?B?TVcrTXdPL2tjWFRENGJRZXg5eFV2aURYWDRsTmo5R2N4a3B4Z081U0tZaTE1?=
 =?utf-8?B?d1d5aTM4cDl4UHprRXFzM05peHNyZ1FnamoydCttU3BwK0VkV090UTc2a3dQ?=
 =?utf-8?B?S2Z6cTZiUzBLbzRaK2tYNnVUdm56ajZvY284SFhZcC9HOWlIVENwRHM4bEEw?=
 =?utf-8?B?UDdpU09hTitzMUJEak13M1ZKQnI0SGR5Nno3dE5QNHVjNWNweG0vSnFZWndK?=
 =?utf-8?B?LzJjaGtMdzFRa2VlSEo4dm1FZ2NVT3pVRmNGem5HcExaRndQZmRtNnR2TUVr?=
 =?utf-8?B?UEpPN2ZMRFlEd3R4UDVFdGVNeGlDSXcweTlRYnYvU2haSWl3a2h5bitsc0dX?=
 =?utf-8?B?bXJXSlJmc1E2R0d4b1pKSXZyVG9RTGoxQTBMWkl4b3VPQWt5dXIvMlRJbFFL?=
 =?utf-8?Q?ARnNR0XRfDK/p405BWc/fi+Ck?=
X-MS-Exchange-CrossTenant-Network-Message-Id: 5b2e01a3-c9ea-4b5d-b9ec-08dc7538253b
X-MS-Exchange-CrossTenant-AuthSource: BL1PR11MB5978.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 15 May 2024 23:38:38.4592
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 4HHdt0lEYuGtjrrdxLBbWA4y2Qd96Jg7Dp3FrFOx7JMlJ3obhO8r0P6nYww4CDk2ErCnwSUWYjyaUkyn63RQSA==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH0PR11MB7562
X-OriginatorOrg: intel.com


On 16/05/2024 11:14 am, Edgecombe, Rick P wrote:
> On Thu, 2024-05-16 at 10:17 +1200, Huang, Kai wrote:
>>> TDX has several aspects related to the TDP MMU.
>>> 1) Based on the faulting GPA, determine which KVM page table to walk.
>>>       (private-vs-shared)
>>> 2) Need to call TDX SEAMCALL to operate on Secure-EPT instead of direct
>>> memory
>>>       load/store.  TDP MMU needs hooks for it.
>>> 3) The tables must be zapped from the leaf. not the root or the middle.
>>>
>>> For 1) and 2), what about something like this?  TDX backend code will set
>>> kvm->arch.has_mirrored_pt = true; I think we will use kvm_gfn_shared_mask()
>>> only
>>> for address conversion (shared<->private).
> 
> 1 and 2 are not the same as "mirrored" though. You could have a design that
> mirrors half of the EPT and doesn't track it with separate roots. In fact, 1
> might be just a KVM design choice, even for TDX.

I am not sure whether I understand this correctly.  If they are not 
tracked with separate roots, it means they use the same page table (root).

So IIUC what you said is to support "mirror PT" at any sub-tree of the 
page table?

That will only complicate things.  I don't think we should consider 
this.  In reality, we only have TDX and SEV-SNP.  We should have a 
simple solution to cover both of them.

> 
> What we are really trying to do here is not put "is tdx" logic in the generic
> code. We could rely on the fact that TDX is the only one with mirrored TDP, but
> that is kind of what we are already doing with kvm_gfn_shared_mask().
> 
> How about we do helpers for each of your bullets, and they all just check:
> vm_type == KVM_X86_TDX_VM
> 
> So like:
> diff --git a/arch/x86/kvm/mmu.h b/arch/x86/kvm/mmu.h
> index a578ea09dfb3..c0beed5b090a 100644
> --- a/arch/x86/kvm/mmu.h
> +++ b/arch/x86/kvm/mmu.h
> @@ -355,4 +355,19 @@ static inline bool kvm_is_private_gpa(const struct kvm
> *kvm, gpa_t gpa)
>          return mask && !(gpa_to_gfn(gpa) & mask);
>   }
>   
> +static inline bool kvm_has_mirrored_tdp(struct kvm *kvm)
> +{
> +       return kvm->arch.vm_type == KVM_X86_TDX_VM;
> +}
> +
> +static inline bool kvm_has_private_root(struct kvm *kvm)
> +{
> +       return kvm->arch.vm_type == KVM_X86_TDX_VM;
> +}

I don't think we need to distinguish the two.

Even we do this, if I understand your saying correctly, 
kvm_has_private_root() isn't just enough -- theoretically we can have a 
mirror pt at a sub-tree at any level.