From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 27A2A3A381B for ; Thu, 26 Mar 2026 18:25:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=170.10.129.124 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774549536; cv=pass; b=ZEKNlzPQwp7KGXrsdXGS1mXeFmnUCQQJ0XLL+MttpHAz2nrKdQu+7utUmR1IAgni2Cr5CPp68gnyp8+b/28bChpG9hyJTZT/7O14CmtFM/6TC/3vFUzlsFuEGAolB8JqFtCyWbeU5hfto1t8PsyYqs66o5lDWUhkrx3oWZjdDUQ= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774549536; c=relaxed/simple; bh=Ju4GuypyYdw0ImWV7ufhXgfThhO1xwtog0FALkHkh7Q=; h=MIME-Version:References:In-Reply-To:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=qe1WmQNn90O3NwjoGYLY9cWCtS7JLHQlmE3OaBglqNmpLLPhGpwWFzV8KzV5SBFu96Ery3d54iPHeQepZp7Q8EtRMD9oH5FssD7vHiW0T8LwXeDesuEqSomwqa4d428OhmH4x1kdd9UVcF8RYi+AKIhmhHxFtV2yGeHi+/6n3uo= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=WAY0gTdh; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=ddG6tUSB; arc=pass smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="WAY0gTdh"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="ddG6tUSB" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1774549534; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=Ju4GuypyYdw0ImWV7ufhXgfThhO1xwtog0FALkHkh7Q=; b=WAY0gTdh6Yf7pUGionykx23jVOQ44COTnkmAwdg5AGmWt58YgvEaIlJzPE/bx2HzrbZtot EygbusRXg5DmmTFDnOFUyHYOO3TF/yeEO4LeU/3bcsKuM+0hT0ANoWSDELCqkIxcKqtPmx TpHkOxbBTtLKkndinzqxmViJj1cmpRw= Received: from mail-wm1-f69.google.com (mail-wm1-f69.google.com [209.85.128.69]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-241-cPzFsRdTO7mg2CC2UtIe8A-1; Thu, 26 Mar 2026 14:25:32 -0400 X-MC-Unique: cPzFsRdTO7mg2CC2UtIe8A-1 X-Mimecast-MFC-AGG-ID: cPzFsRdTO7mg2CC2UtIe8A_1774549532 Received: by mail-wm1-f69.google.com with SMTP id 5b1f17b1804b1-48534941525so18360745e9.2 for ; Thu, 26 Mar 2026 11:25:32 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1774549532; cv=none; d=google.com; s=arc-20240605; b=Xxq7scXKz7PR0+xJYD4BVs8eOd1vMq9HOHwpOSUMXEv175WvduhXMt+AxnD3JAQjp2 T1+29cc793Q7EBhF/aIQJD0fCt02rT6g4KOHu457SWFZcRgediMxZuSDE7gfNxiV0vc/ vHUnTGiGdxqsZDty6L/w0XV4NIf9inA473XS0z8AfSUltxGOTvJ3PgFzeWZcxRGeiGl5 6153drShfXS2mebc3W2tMBqsCZvwu7mzSF3QnAUamSwnsNxBE5Zqyc+8a+Vxn92vhWiD r98YelbV3L9oXnf00ajZ5BxfhZESFU8rnixiAJB2/t1ItILMg6bE4ygnWGyLZBrkCTdG VNBA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:dkim-signature; bh=Ju4GuypyYdw0ImWV7ufhXgfThhO1xwtog0FALkHkh7Q=; fh=6mXjoZngSSnO0v/tt9n4a36HdBM0kDQ/XzgWmAde6Xs=; b=TLpZ/O963RaJT/iH65fpSbbi6KWfRjwEVYmrrc3852gthmX4R/7IQkQYducgIgSoJy +/s3ZNl6J3trYOHAM9hB7zKSuCE1ahbi3dQZ2vcZbAO3DAq2NYAfeFAUU2WlYVuahoaK jitFlhBsZvHF7UIlhxc2fiO5hehK2fKwil56eaTTG7kpk7ujeAevDpPexEL39TMdirII yZqcEcgGmtU/T7fUlNujtL5NUtUHpvTLKvfSrHOs077zMQWvIz9vsIcXWpASdLJeg/g8 tvyFTs+zmxeh0/wOaln4Ft+VcOMn1lar89oqsS7JCJp7jMblCYQPCDjKTTB07ROyCX3e h++Q==; darn=vger.kernel.org ARC-Authentication-Results: i=1; mx.google.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1774549532; x=1775154332; darn=vger.kernel.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=Ju4GuypyYdw0ImWV7ufhXgfThhO1xwtog0FALkHkh7Q=; b=ddG6tUSBnKyXWs5EYuBWPXhkHCNk3qiwgnXZcbCx8mjpMFq+FqNvkbu8qJOVz18Fhy dM68NIAd5aRzC6tOEMgS069TrCm6g0/YXYn+5fszylQOoULw/BUvVekmSW0V3/7ayMKK +yAxWUH2nF3ZfrGp3OnI/N2ASuA9ildmSlfRYUITkXDZolE0fGL9w/VFf2GCXtQ8J51G IKL5TQTm2w3hFhrrKYJEznF7dYOcOoY7sUgGPW/JN1i6l4E6NE3DhUfBdOVZSYEJgFMX vf9/Xau8ePAdzVdLTFTgqc3/P1cBrGGSaIjnJ+F7L65Zpq0+rNAVBaPxKYTI0iWCHz6U uT9Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1774549532; x=1775154332; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=Ju4GuypyYdw0ImWV7ufhXgfThhO1xwtog0FALkHkh7Q=; b=pVMRoNB3OakKmn9/WV3SnNl5se4H8tfg35SiH28RyiFjXT7QuHjYqFpFW6IYvMl8XO 5CMVk0flk4seUiR9TOaC7mEglneDoiJoikNCqn2ZBayC5VyCK8L4VISpiKhMrEzXLZpI HTvAsw/FH3TY+Mkgj8Xb06tGzJOy6TA2QVbqfCHhqFcmD7gPOmkqLC5C5g8SnEPPlrO3 hD9Usa+5xYAUUsbRhYft9Z3yiGMJ0Ws7zOre8lUvmaVfm15m4SJc2wxYyk79NASKHi23 3/CSU55yJvCt+C87lwmO6l5iirP5Ud/8HC76VhTSG1BCOMrITqTzIW0aHX9DI9AHHlyG QJcA== X-Forwarded-Encrypted: i=1; AJvYcCUSV9GFue0iR8GzBSmmRmENbk1IwOMzddAckDr1DUaQJzaw6qWGzna6KP8TCKSiS5GycpI+tqJym+peL8k=@vger.kernel.org X-Gm-Message-State: AOJu0YzTTIkPEOqWHEl9EoZ8CMlgffyAs3nhJ1KEAekYBqZUafrRXQpy X4ZiBuogm8JhXP8k0D98X+5OuOW0xiJuiwh3Yw618UwUihJV8ApoOoIQhCc25LI7pVQN/vBlCVd MATgJ2tNqVgD0v3nhBVe/OLd3jmDNVQX2A9r7nm7PRiAqhoqA/fClxGDz2ZU3xAHohfHvQ1P6dA hg5x4LgSXE4Qt1ZL1HPZuhuv81EFyz8viHSWYXF1p+ X-Gm-Gg: ATEYQzy9VyydQH3VJph6hNHKCJ0mwrDs41Tsl1pvaGystZJTJOj44oTIJI79yUmCNIu 2hErWnyZgJ3thxjtShjKA1P538hqnWtKRRS8mFXjlNNpd+AjmTm1q8qNiy3X0FPcFcDbXtFO9ek MHai0VScFkiBKgzK7aoCL83CZr28GbE1bnoFpusFG63l9iDV3g87Q1yiXQjKf6tRYf25vpNdPYr BJ27LtRS0dSYgku5rY1ay8ac6nMQrndRh5bfVvUr5u9swsw0tlY0GylaCvsxkRUVTG3jcFqBJDm /BFN X-Received: by 2002:a05:600c:1f12:b0:47e:e48b:506d with SMTP id 5b1f17b1804b1-487160564abmr131776445e9.16.1774549531554; Thu, 26 Mar 2026 11:25:31 -0700 (PDT) X-Received: by 2002:a05:600c:1f12:b0:47e:e48b:506d with SMTP id 5b1f17b1804b1-487160564abmr131776075e9.16.1774549531118; Thu, 26 Mar 2026 11:25:31 -0700 (PDT) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 References: <20260324-tdx-hotplug-fixes-v1-0-8f29f2c17278@redhat.com> <20260324-tdx-hotplug-fixes-v1-2-8f29f2c17278@redhat.com> <56190adc345148396ba6b3e52672e662145f7dc7.camel@intel.com> <7802b50589c80a7276a50cc473c1aa579750a30c.camel@intel.com> In-Reply-To: <7802b50589c80a7276a50cc473c1aa579750a30c.camel@intel.com> From: Paolo Bonzini Date: Thu, 26 Mar 2026 19:25:19 +0100 X-Gm-Features: AQROBzA4Xxa8YCmGcRxu79Svr4HUz2dOQ6f5ejBx1X38OfhAGi0MWHQBY_m3IsA Message-ID: Subject: Re: [PATCH 2/2] x86/tdx: Accept hotplugged memory before online To: "Edgecombe, Rick P" Cc: =?UTF-8?B?TWFyYy1BbmRyw6kgTHVyZWF1?= , Borislav Petkov , kas@kernel.org, "Qiang, Chenyi" , "Anvin, H. Peter" , Ingo Molnar , "Kernel Mailing List, Linux" , Dave Hansen , Thomas Gleixner , kvm , linux-coco@lists.linux.dev, "the arch/x86 maintainers" Content-Type: text/plain; charset="UTF-8" Il mer 25 mar 2026, 18:21 Edgecombe, Rick P ha scritto: > > Ah, I see now! So the problem is not that the kernel is accidentally > re-accepting the memory. It's that host userspace is not actually > removing the memory during unplug. Hmm. Why not fix userspace then? If > the memory is unplugged it should not be usable anymore by the guest. > If it is still accessible then it seems kind of like a bug, no? > > And! This totally justifies the warning. If the error is ignored, the > guest would think the memory is zeroed, but it could have old data in > it. It's exactly the kind of tricks a VMM could play to attack the > guest. > > Another option could be to perform a TDG.MEM.PAGE.RELEASE TDCALL from > the guest when it unplugs the memory, to put it in an unaccepted state. > This would be more robust to buggy VMM behavior. But working around > buggy VM behavior would need a high bar. Wouldn't it actually be a very low bar? Just from these two paragraphs of yours, it's clear that the line between buggy and malicious is fine, in fact I think userspace should not care at all about removing the memory. Only the guest cares about acceptance state. Doing a RELEASE TDCALL seems more robust and not hard. Paolo