linux-kernel - Re: [RFC PATCH 3/4] KVM: x86/tdx: Do VMXON and TDX-Module initialization during tdx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <c67feb590e3d7027c618f5a725a94a9c73a295b6.camel@intel.com>
Date: Tue, 14 Oct 2025 19:44:57 +0000
From: "Edgecombe, Rick P" <rick.p.edgecombe@...el.com>
To: "seanjc@...gle.com" <seanjc@...gle.com>, "Gao, Chao" <chao.gao@...el.com>
CC: "kvm@...r.kernel.org" <kvm@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>, "bp@...en8.de"
	<bp@...en8.de>, "kas@...nel.org" <kas@...nel.org>, "Huang, Kai"
	<kai.huang@...el.com>, "mingo@...hat.com" <mingo@...hat.com>,
	"tglx@...utronix.de" <tglx@...utronix.de>, "x86@...nel.org" <x86@...nel.org>,
	"pbonzini@...hat.com" <pbonzini@...hat.com>, "Williams, Dan J"
	<dan.j.williams@...el.com>, "linux-coco@...ts.linux.dev"
	<linux-coco@...ts.linux.dev>, "dave.hansen@...ux.intel.com"
	<dave.hansen@...ux.intel.com>, "Hunter, Adrian" <adrian.hunter@...el.com>,
	"xin@...or.com" <xin@...or.com>
Subject: Re: [RFC PATCH 3/4] KVM: x86/tdx: Do VMXON and TDX-Module
 initialization during tdx_init()

On Tue, 2025-10-14 at 16:35 +0800, Chao Gao wrote:
> Is it a good idea to consolidate the two tdx_offline_cpu() functions, i.e.,
> integrate KVM's version into x86 core?

+1

It fixes a bug too. Currently in __tdx_td_init() if misc_cg_try_charge() fails,
it will decrement nr_configured_hkid in the error path before it got
incremented.

And the cgroups stuff that got plucked from the past seems to have the same
problem. Ideally we could move MISC_CG_RES_TDX accounting too with this change
because it also fits, and it would fix that too.