Unmapped Guest Memory
summary
Mapping entire guest memory into host user space breaks Intel TDX guarantees by exposing private pages that carry a 28‑bit MAC and TD owner bit whose verification can mark lines poison and cause unrecoverable CPU failure, so host-visible mappings must be avoided. Two concrete designs are compared: struct-bit mapping (keep host PTEs with special flags and trap accesses) and a new enlightened fd / private memslot (dedicated file descriptor plus memslot ops and TDP-only translation). Both need KVM and Linux MM changes; community discussion and prototypes are ongoing.
AI-written summary · about
chapters (9)
- 0:00Intro
- 0:30Agenda
- 1:27Background
- 7:36Unmapping Requirement
- 9:20Design Target
- 11:11Option 1 - struct page based
- 15:01Option 2 - fd based
- 19:32Conclusion
- 20:08Acknowledgement
related talks
27mIntel Trusted Domain Extensions (TDX) Host Kernel Support
20mHypervisor-managed Linear Address Translation
50mProtected KVM on Arm64: A Technical Deep Dive
07mLightning Talk: Confidential VMs in Kubevirt: Securing VMs With Kube...
20mKVM-devirt: Extending KVM to a Zero-Overhead Partition Hypervisor
19mPASID Management in KVM
37mEfficient and Flexible Virtual Machine Networking Through eBPF
27mTrust No One: Bringing Confidential Computing to Containers