lkml.org 
[lkml]   [2023]   [Jan]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH v11 018/113] KVM: TDX: create/destroy VM structure
On Thu, Jan 26, 2023, Huang, Kai wrote:
> On Thu, 2023-01-26 at 17:28 +0000, Sean Christopherson wrote:
> > In other words, once the PTE is zapped/blocked (branch is pruned), it's completely
> > removed from the paging tree and no other tasks can access the branch (page table
> > and its children). I.e. the only remaining reference to the branch is the pointer
> > handed to the RCU callback. That means the RCU callback has exclusive access to the
> > branch, i.e. can operate as if it were holding mmu_lock for write. Furthermore, the
> > RCU callback also doesn't need to flush TLBs because that was again done when
> > pruning the branch.
> >
> > It's the same idea that KVM already uses for root SPs, the only difference is how
> > KVM determines that there is exactly one entity that holds a reference to the SP.
>
> Right. This works fine for normal non-TDX case. However for TDX unfortunately
> the access to the removed branch (or the removed sub-page-table) isn't that
> "exclusive" as the SEAMCALL to truly zap that branch still needs to hold the
> write lock of the entire Secure EPT tree, so it can still conflict with other
> threads handling new faults.

I thought TDX was smart enough to read-lock only the part of the tree that it's
actually consuming, and write-lock only the part of the tree that it's actually
modifying?

Hrm, but even if TDX takes a read-lock, there's still the problem of it needing
to walk the upper levels, i.e. KVM needs to keep mid-level page tables reachable
until they're fully removed. Blech. That should be a non-issue at this time
though, as I don't think KVM will ever REMOVE a page table of a live guest. I
need to look at the PROMOTE/DEMOTE flows...

\
 
 \ /
  Last update: 2023-03-26 23:57    [W:0.710 / U:1.480 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site