From: "裴辰举 " <pcj3195161583@163.com>
To: seanjc@google.com, pbonzini@redhat.com, kvm@vger.kernel.org,
linux-kernel@vger.kernel.org, xiaoyao.li@intel.com
Subject: TDX/non-ACT: failed TDH.PHYMEM.PAGE.WBINVD after successful page remove can leave a page unreset
Date: Wed, 1 Apr 2026 19:51:30 +0800 (CST) [thread overview]
Message-ID: <5a73e445.aca5.19d48e268dd.Coremail.pcj3195161583@163.com> (raw)
On non-ACT platforms, TDH.MEM.PAGE.REMOVE does not flush cachelines or initialize the removed page. KVM handles that by calling TDH.PHYMEM.PAGE.WBINVD
after a private page is removed.
The problem is the failure path after a successful remove:
KVM drops a private page.
TDH.MEM.PAGE.REMOVE succeeds, so the page is no longer assigned to the TD.
KVM then calls TDH.PHYMEM.PAGE.WBINVD.
If TDH.PHYMEM.PAGE.WBINVD fails, KVM marks the VM/TD dead and teardown follows.
At that point, TDH.PHYMEM.PAGE.RECLAIM will not process the page that hit the WBINVD failure, because that page has already been removed from the TD. Normally TDH.PHYMEM.PAGE.RECLAIM clears/reinitializes TD pages during teardown, but this page is no longer in that set. This seems to create a state hole: the page has been
removed from the TD, but it may never be fully reset/cleared for safe host reuse if the WBINVD step failed. Depending on later host-side handling, this can become
either a leaked page or an unsafe page reuse issue.
next reply other threads:[~2026-04-01 11:51 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-01 11:51 裴辰举 [this message]
2026-04-01 13:59 ` Edgecombe, Rick P
2026-04-01 16:59 ` Sean Christopherson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5a73e445.aca5.19d48e268dd.Coremail.pcj3195161583@163.com \
--to=pcj3195161583@163.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=pbonzini@redhat.com \
--cc=seanjc@google.com \
--cc=xiaoyao.li@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®