Messages in this thread | | | Date | Tue, 18 May 2021 18:36:22 +0000 | From | Sean Christopherson <> | Subject | Re: [RFC v2-fix 1/1] x86/tdx: Handle in-kernel MMIO |
| |
On Tue, May 18, 2021, Dave Hansen wrote: > On 5/18/21 10:21 AM, Andi Kleen wrote: > > Besides instruction decoding works fine for all the existing > > hypervisors. All we really want to do is to do the same thing as KVM > > would do. > > Dumb question of the day: If you want to do the same thing that KVM > does, why don't you share more code with KVM? Wouldn't you, for > instance, need to crack the same instruction opcodes?
Pulling in all pf KVM's emulator is a bad idea from a security perspective. That could be mitigated to some extent by teaching the emulator to emulate only select instructions, but it'd still be much higher risk than a barebones guest-specific implementations. Because old Intel CPUs don't support unrestricted guest, the set of instructions that KVM _can_ emulate in total is far, far larger than what is needed for MMIO.
Allowed instructions aside, KVM needs to handle a large number things a TDX/SEV guest does not, e.g. segmentation, CPUID model, A/D bit updates, and so on and so forth.
Refactoring KVM's emulator would also be a monumental task.
| |