Unmapped Guest Memory

### Overview In this presentation, Eugene from Intel's virtualization team discusses unmapped guest memory, focusing on why it is required for confidential computing technologies like Intel TDX (Trust Domain Extensions) and AMD SEV. Traditionally, KVM maps all guest memory into host user space (such as QEMU's virtual address space) to facilitate emulation, virtio operations, and GPA-to-HPA translation via HVA. However, with hardware security features like Intel TDX, KVM and the host reside outside the Trusted Computing Base (TCB) and must not access private guest memory. Mapping guest private memory into host user space introduces security risks, including potential machine check exceptions or unrecoverable system crashes if poisoned data is consumed. Eugene outlines the requirements for unmapping guest memory while preserving GPA-to-HPA translation and contrasts two architectural proposals discussed in the Linux kernel community.

### Key Topics - **Intel TDX Memory Protection**: Intel TDX utilizes an enhanced MKTME engine to provide encryption and integrity checking. Each memory cache line includes a 28-bit Message Authentication Code (MAC) and a TD owner bit stored in ECC metadata. If the host incorrectly writes to guest private pages using shared Key ID 0, an integrity check failure marks the line as poisoned. Subsequent consumption of this poisoned data can trigger machine check exceptions or non-recoverable system shutdowns. - **Need for Unmapped Memory**: The host only requires access to very limited shared memory pages (e.g., PV clock, bounce buffers, SWIOTLB, and direct DMA buffers). Because instruction decoding occurs inside the TD guest, KVM does not need guest page tables or private pages mapped in host user space. - **Design Goals**: Ensure guest private pages map to only one TD (preventing multi-host/multi-guest mappings), allow the guest kernel and virtual firmware (TDVF) to notify the host of shared pages, maintain GPA-to-HPA translation, manage host page tables through the Linux MM subsystem rather than KVM directly, and maintain support for non-TDX environments and standard VMs.

### Technical Details Eugene details two primary design proposals from community discussions: 1. **struct page-Based Guest Unmapping (Kirill Shutemov's proposal)**: - Memory is initially mapped at VM creation, but host access via HVA is revoked (e.g., clearing the present bit in the host PTE), returning SIGBUS on unauthorized host user-space access. - GPA-to-HPA translation is maintained via new flags in `get_user_pages` for the KVM MMU page fault handler. - Divided into two versions: the first used a fake swap entry with the hardware poison flag in `struct page`; the second introduced a dedicated `PAGE_GUEST` flag along with `mprotect`/VMA flags to avoid overriding poison flags. - Drawbacks: Cannot enforce 1:1 GPA-to-HPA mapping without relying on the TDX module (due to memory overhead in `struct page`), lacks support for memory not backed by `struct page`, and still maintains host PTE entries. 2. **Enlightened File Descriptor-Based Solution (Sean Christopherson's proposal, referencing earlier concepts by Isaku Yamahata)**: - Guest private memory is backed by a dedicated, unshareable, unmappable file descriptor (FD), completely decoupling guest private translation from host virtual address mappings. - KVM introduces a new private `memslot` (potentially in a new address space) where backing store operations translate GFN to PFN using file offsets and coordinate with Linux MM for invalidation, swapping, or migration. - Advantages: Provides a strictly enforced 1:1 mapping between guest and physical pages without relying on the TDX module, reduces host page table footprint, avoids fake swap entries or `struct page` modifications, and facilitates future support for memory not backed by `struct page`. - Challenges: Requires substantial architectural changes in KVM (e.g., new ioctls to handle transitions between private and shared memory, backing store support in Linux, and new VFIO interfaces for DMA pinning without HVAs).

### Takeaways Unmapping guest private memory is both possible and necessary to ensure confidential computing security and system stability under TDX. Sean Christopherson's enlightened file descriptor approach offers substantial architectural advantages over `struct page` flag manipulation, though it requires significant development across KVM, Linux MM, and VFIO. Community collaboration remains ongoing to refine and finalize the implementation.