From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f202.google.com (mail-pf1-f202.google.com [209.85.210.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D1BC32E88A9 for ; Fri, 27 Jun 2025 17:59:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.202 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1751047191; cv=none; b=ILSdTnsb3cJzdLSqQBXK9v+UHF5TuU2mbQhSZ/ss8F4sT3RUGoNkh7xL3UsiXsW2I68dIdSDxX4u3A5ZLBFvkW4ZqHXFZ/Av38WmhcZf+jkTvhl/LN6+jRJaOL/JOs9lEagT+mRMeLA4ABr/FYDhQrIpFNEBlKSkZNLKbpq3riU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1751047191; c=relaxed/simple; bh=d2OwBuoaVJe5rQ0Zhn56lxg3ii/D/3hwyLERPbl2/O8=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=nGxlKl0XEdBaLOK+h2HUcMjmddDsC1RsSp+vnEIfEbSU4U2LF1FJvbLSBKMda5JXvjNCHRDBSGrRI7yQwAgXLMyuKP5/XuxzKqCLA6O6lTi4a+0z1btYWRu8e/XAjO5f2fs1lc67QbQB7DkDzkz75pcF22l65osjk1S+yRp5re8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--ackerleytng.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=soeC9Nr5; arc=none smtp.client-ip=209.85.210.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--ackerleytng.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="soeC9Nr5" Received: by mail-pf1-f202.google.com with SMTP id d2e1a72fcca58-748f3613e6aso71557b3a.0 for ; Fri, 27 Jun 2025 10:59:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1751047189; x=1751651989; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=SRtvMJ21kZsL1YOacYg4JvIxFtgWxwLC8XLslq9FYAM=; b=soeC9Nr5cjLY2CX3KACn0flfOZozAbem0wmlpNkSf0zrs+qlKdUdR08sIGmHMFEv0W EUrAvCEmbtUwDhrR3KfW3P0ZWVxX3NbDpIglG6OT1IP3KExp4BpBJ8ce8HXNGH8LRMoE DLQtX9vXzAcFGQ1RSWz94arM7RWkrxEB74umCNJlQ2Xr1lc+MV2L0nBxUi2GzDEI+pxJ 9g8LDPq/clN5YMEyFU2UEFrD7bnX8CPRAFOGG9URmlu80YI4uA7P/mP0h2OdkZQd6+vS 0XY1+qdNG3jhCWHFiX1Kep10icPnNVSZSBB5I4ipzYAPeQ//+5M6jz7SM4vgDtpo32Uu lg+A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1751047189; x=1751651989; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=SRtvMJ21kZsL1YOacYg4JvIxFtgWxwLC8XLslq9FYAM=; b=HIm8huCnrpuT7qQZ/8rKvdLcXKECcsPAFQJ0OyDtbdKLJbjE/jFlDCR7xDozSk0gd5 08B1kHGtaypZ8bVtRGTh/pQYsZkWAoY1b/S5x6JgJFHw2PogAoEf8m+O84KopQw7cVN5 IcL7yZOEt6jFQo+rIfm12lqPRg0KdTJKN1987H7OSVUEdVpbn2WxJ31YrM3K3JG746gJ FR7wOtvrFplJv2lPy888Oc8Wnw3ygfxB5DixDr7+atmIz7n7zANnL/2YatceQunzYRPh sxsl1lZW2XlOz4aA7OCBuGweUsnHWEk3injCZO9NILmcwlCHRyqGbYzzCXfAXaVADwaV K09Q== X-Forwarded-Encrypted: i=1; AJvYcCWBAERp1RxkeIlh+uXnyc2Aulj/J310Vj4apinRk9plHynUsqCY7ekOqmr/gAHbShDUIuk=@vger.kernel.org X-Gm-Message-State: AOJu0Yz54Z5xMpld3iGnKr+YcbFZkKJt6zAdB9D4vETMz3leJz2aBSUm fB4JYojnU2OvwAO+7/a8aOBaoxCgHlO7B+6Z5Hgn1SkUqILJ2t3YB5VZjK/aMxt0KMjB9XOFNZM gfDzPqNYu4gEzxtpH5Ej2ZzTqPw== X-Google-Smtp-Source: AGHT+IGHzx0jys4ZhUUXxRoNLQVTrBfRYdepSd18LQuziEpvvfy/c9PGS4BmVIi497ELX8Rztn76ytniDfu9D31iVQ== X-Received: from plpb14.prod.google.com ([2002:a17:902:d60e:b0:236:91fa:131a]) (user=ackerleytng job=prod-delivery.src-stubby-dispatcher) by 2002:a17:902:da8d:b0:234:cb4a:bc1b with SMTP id d9443c01a7336-23ac488584amr70876905ad.49.1751047189093; Fri, 27 Jun 2025 10:59:49 -0700 (PDT) Date: Fri, 27 Jun 2025 10:59:47 -0700 In-Reply-To: <4cbdfd3128a6dcc67df41b47336a4479a07bf1bd.camel@intel.com> Precedence: bulk X-Mailing-List: kvm@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <0072a5c0cf289b3ba4d209c9c36f54728041e12d.camel@intel.com> <447bae3b7f5f2439b0cb4eb77976d9be843f689b.camel@intel.com> <4cbdfd3128a6dcc67df41b47336a4479a07bf1bd.camel@intel.com> Message-ID: Subject: Re: [RFC PATCH 08/21] KVM: TDX: Increase/decrease folio ref for huge pages From: Ackerley Tng To: "Edgecombe, Rick P" , "Shutemov, Kirill" Cc: "quic_eberman@quicinc.com" , "Li, Xiaoyao" , "Du, Fan" , "Hansen, Dave" , "david@redhat.com" , "thomas.lendacky@amd.com" , "Zhao, Yan Y" , "tabba@google.com" , "kvm@vger.kernel.org" , "linux-kernel@vger.kernel.org" , "seanjc@google.com" , "binbin.wu@linux.intel.com" , "Peng, Chao P" , "pbonzini@redhat.com" , "michael.roth@amd.com" , "vbabka@suse.cz" , "Yamahata, Isaku" , "Li, Zhiquan1" , "Annapurve, Vishal" , "Weiny, Ira" , "jroedel@suse.de" , "Miao, Jun" , "pgonda@google.com" , "x86@kernel.org" Content-Type: text/plain; charset="UTF-8" "Edgecombe, Rick P" writes: > On Thu, 2025-06-26 at 18:16 +0300, Shutemov, Kirill wrote: >> > > Please see my reply to Yan, I'm hoping y'all will agree to something >> > > between option f/g instead. >> > >> > I'm not sure about the HWPoison approach, but I'm not totally against it. My >> > bias is that all the MM concepts are tightly interlinked. If may fit >> > perfectly, >> > but every new use needs to be checked for how fits in with the other MM >> > users of >> > it. Every time I've decided a page flag was the perfect solution to my >> > problem, >> > I got informed otherwise. Let me try to flag Kirill to this discussion. He >> > might >> > have some insights. >> >> We chatted with Rick about this. >> >> If I understand correctly, we are discussing the situation where the TDX >> module failed to return a page to the kernel. >> >> I think it is reasonable to use HWPoison for this case. We cannot >> guarantee that we will read back whatever we write to the page. TDX module >> has creative ways to corrupt it. >> >> The memory is no longer functioning as memory. It matches the definition >> of HWPoison quite closely. > > ok! Lets go f/g. Unless Yan objects. Follow up as I think about this more: Perhaps we don't need to check for HWpoison (or TDX unmap errors) on conversion. On a high level, we don't need to check for HWpoison because conversion is about changing memory metadata, as in memory privacy status and struct folio sizes, and not touching memory contents at all. HWpoison means the memory and its contents shouldn't be used. Specifically for private-to-shared conversions where the TDX unmap error can happen, we will 1. HWpoison the page 2. Bug the TD This falsely successful conversion means the host (guest_memfd) will think the memory is shared while it may still be mapped in Secure-EPTs. I think that is okay because the only existing user (TD) stops using that memory, and no future users can use the memory: 1. The TD will be bugged by then. A non-running TD cannot touch memory that had the error on unmapping. 2. The page was not mapped into host page tables (since it was private). Even if it were mapped, it will be unmapped from host page tables (host page table unmaps don't fail). If the host tries to touch the memory, on the next fault, core-mm would notice that the page is poisoned and not fault it in. By the way, when we "bug the TD", can we assume that ALL vCPUs, not just the one that is did the failed unmap will stop running? I guess even if the other vCPUs don't stop running, the TDs vCPUs will access the page as shared thinking the conversion succeeded and keep hitting #VEs. If the TD accesses the page as private, it's fine since the page was not unmapped from Secure-EPTs due to the unmap failure and the host cannot write to it (host will see HWpoison on next fault) and so there's no host crash and doesn't defeat the purpose of guest_memfd. If the guest_memfd with a HWpoisoned page is linked to a new, runnable TD, the new TD would need to fault in the page as private. When it tries to fault in the page to the new TD, it will hit the HWpoison and userspace will get to know about the HWpoison. Yan, Rick, let me know what you think of this!