On Fri, Nov 12, 2021 at 07:48:17PM +0000, Sean Christopherson wrote: > Yes, but IMO inducing a fault in the guest because of _host_ bug is wrong. And what is the plan with handling this host bug? Can it be handled in a way that keeps the guest running? IMO the best way to handle this is to do it the way Peter proposed: * Convert the page from private to shared on host write access and log this event on the host side (e.g. via a trace event) * The guest will notice what happened and can decide on its own what to do, either poison the page or panic with doing a kdump that can be used for bug analysis by guest and host owner At the time the fault happens we can not reliably find the reason. It can be a host bug, a guest bug (or attack), or whatnot. So the best that can be done is collecting debug data without impacting other guests. This also saves lots of code for avoiding these faults when the outcome would be the same: A dead VM. > I disagree, this would require "new" ABI in the sense that it commits KVM to > supporting SNP without requiring userspace to initiate any and all conversions > between shared and private. Which in my mind is the big elephant in the room: > do we want to require new KVM (and kernel?) ABI to allow/force userspace to > explicitly declare guest private memory for TDX _and_ SNP, or just TDX? No, not for SNP. User-space has no say in what guest memory is private and shared, that should fundamentally be the guests decision. The host has no idea about the guests workload and how much shared memory it needs. It might be that the guest temporarily needs to share more memory. I see no reason to cut this flexibility out for SNP guests. Regards, -- Jörg Rödel jroedel@xxxxxxx SUSE Software Solutions Germany GmbH Maxfeldstr. 5 90409 Nürnberg Germany (HRB 36809, AG Nürnberg) Geschäftsführer: Ivo Totev
