linux-kernel - Re: [PATCH 00/44] KVM: Rework kvm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <bf29fe1ac84cae8ddb06e566b56c653600a1901c.camel@intel.com>
Date:   Tue, 8 Nov 2022 01:09:27 +0000
From:   "Huang, Kai" <kai.huang@...el.com>
To:     "Christopherson,, Sean" <seanjc@...gle.com>,
        "isaku.yamahata@...il.com" <isaku.yamahata@...il.com>
CC:     "borntraeger@...ux.ibm.com" <borntraeger@...ux.ibm.com>,
        "kvm-riscv@...ts.infradead.org" <kvm-riscv@...ts.infradead.org>,
        "tglx@...utronix.de" <tglx@...utronix.de>,
        "Yao, Yuan" <yuan.yao@...el.com>,
        "kvm@...r.kernel.org" <kvm@...r.kernel.org>,
        "Yamahata, Isaku" <isaku.yamahata@...el.com>,
        "suzuki.poulose@....com" <suzuki.poulose@....com>,
        "pbonzini@...hat.com" <pbonzini@...hat.com>,
        "david@...hat.com" <david@...hat.com>,
        "linux-mips@...r.kernel.org" <linux-mips@...r.kernel.org>,
        "linuxppc-dev@...ts.ozlabs.org" <linuxppc-dev@...ts.ozlabs.org>,
        "linux-riscv@...ts.infradead.org" <linux-riscv@...ts.infradead.org>,
        "kvmarm@...ts.linux.dev" <kvmarm@...ts.linux.dev>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "mjrosato@...ux.ibm.com" <mjrosato@...ux.ibm.com>,
        "oliver.upton@...ux.dev" <oliver.upton@...ux.dev>,
        "farosas@...ux.ibm.com" <farosas@...ux.ibm.com>,
        "palmer@...belt.com" <palmer@...belt.com>,
        "linux-s390@...r.kernel.org" <linux-s390@...r.kernel.org>,
        "chenhuacai@...nel.org" <chenhuacai@...nel.org>,
        "aou@...s.berkeley.edu" <aou@...s.berkeley.edu>,
        "alexandru.elisei@....com" <alexandru.elisei@....com>,
        "mpe@...erman.id.au" <mpe@...erman.id.au>,
        "vkuznets@...hat.com" <vkuznets@...hat.com>,
        "maz@...nel.org" <maz@...nel.org>,
        "anup@...infault.org" <anup@...infault.org>,
        "frankja@...ux.ibm.com" <frankja@...ux.ibm.com>,
        "farman@...ux.ibm.com" <farman@...ux.ibm.com>,
        "james.morse@....com" <james.morse@....com>,
        "kvmarm@...ts.cs.columbia.edu" <kvmarm@...ts.cs.columbia.edu>,
        "aleksandar.qemu.devel@...il.com" <aleksandar.qemu.devel@...il.com>,
        "paul.walmsley@...ive.com" <paul.walmsley@...ive.com>,
        "linux-arm-kernel@...ts.infradead.org" 
        <linux-arm-kernel@...ts.infradead.org>,
        "atishp@...shpatra.org" <atishp@...shpatra.org>,
        "imbrenda@...ux.ibm.com" <imbrenda@...ux.ibm.com>,
        "Gao, Chao" <chao.gao@...el.com>
Subject: Re: [PATCH 00/44] KVM: Rework kvm_init() and hardware enabling

On Mon, 2022-11-07 at 13:46 -0800, Isaku Yamahata wrote:
> > On Fri, Nov 04, 2022, Isaku Yamahata wrote:
> > > Thanks for the patch series. I the rebased TDX KVM patch series and it
> > > worked.
> > > Since cpu offline needs to be rejected in some cases(To keep at least one
> > > cpu
> > > on a package), arch hook for cpu offline is needed.
> > 
> > I hate to bring this up because I doubt there's a real use case for SUSPEND
> > with
> > TDX, but the CPU offline path isn't just for true offlining of CPUs.  When
> > the
> > system enters SUSPEND, only the initiating CPU goes through
> > kvm_suspend()+kvm_resume(),
> > all responding CPUs go through CPU offline+online.  I.e. disallowing all
> > CPUs from
> > going "offline" will prevent suspending the system.
> 
> The current TDX KVM implementation disallows CPU package from offline only
> when
> TDs are running.  If no TD is running, CPU offline is allowed.  So before
> SUSPEND, TDs need to be killed via systemd or something.  After killing TDs,
> the
> system can enter into SUSPEND state.

This seems not correct.  You need one cpu for each to be online in order to
create TD as well, as TDH.MNG.KEY.CONFIG needs to be called on all packages,
correct?