Re: Runtime Memory Validation in Intel-TDX and AMD-SNP
From: Joerg Roedel <joro@8bytes.org>
Date: 2021-07-26 19:13:21
Also in:
linux-coco
Hi Kirill, On Thu, Jul 22, 2021 at 10:51:30PM +0300, Kirill A. Shutemov wrote:
Okay, below is my first take on the topic.
Thanks, I havn't looked deeply into the patch yet, but will do so tomorrow and reply separatly.
I ended up combing your idea with bitmap with PageOffline(): early boot code uses bitmap, but on page allocator init I mark unaccepted pages with PageOffline(). This way page allocator need to touch the bitmap only when it steps on PageOffline() which shouldn't be often once things settle after boot.
I still need to understand the benefit of having this information in the memmap, but I also don't object to it. For AMD-SNP the bitmap needs to stay around at least, unless there is another way to implement kexec/kdump.
One bit in the bitmap represents 2M region. Any unaligned chunks gets accepted when we construct the bitmap. This way one 4K page can represent 64 GiB of physical address space.
Yeah, a 2MB chunk size makes sense when it comes to how much we validate at once. I think it will be good choice for AMD too. On the other side there is a need for SNP to track shared pages on a 4k granularity. There are a couple of shared (or at least not valid) pages (GHCB, #HV shared page, VMSA page) per vCPU which are 4k in size. Oh, and then there is the .bss_decrypted section, which is also not 2M aligend. In case of kexec/kdump this information needs to be passed on to the next kernel. Regards, Jörg