From: "Edgecombe, Rick P" <rick.p.edgecombe@intel.com>
To: "Hansen, Dave" <dave.hansen@intel.com>, "Gao, Chao" <chao.gao@intel.com>
Cc: "kvm@vger.kernel.org" <kvm@vger.kernel.org>,
"Li, Xiaoyao" <xiaoyao.li@intel.com>,
"Huang, Kai" <kai.huang@intel.com>,
"Luck, Tony" <tony.luck@intel.com>,
"dave.hansen@linux.intel.com" <dave.hansen@linux.intel.com>,
"Zhao, Yan Y" <yan.y.zhao@intel.com>,
"Hunter, Adrian" <adrian.hunter@intel.com>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"Chatre, Reinette" <reinette.chatre@intel.com>,
"seanjc@google.com" <seanjc@google.com>,
"pbonzini@redhat.com" <pbonzini@redhat.com>,
"mingo@redhat.com" <mingo@redhat.com>,
"tglx@linutronix.de" <tglx@linutronix.de>,
"kirill.shutemov@linux.intel.com"
<kirill.shutemov@linux.intel.com>,
"binbin.wu@linux.intel.com" <binbin.wu@linux.intel.com>,
"Yamahata, Isaku" <isaku.yamahata@intel.com>,
"hpa@zytor.com" <hpa@zytor.com>,
"Annapurve, Vishal" <vannapurve@google.com>,
"bp@alien8.de" <bp@alien8.de>,
"tony.lindgren@linux.intel.com" <tony.lindgren@linux.intel.com>,
"x86@kernel.org" <x86@kernel.org>
Subject: Re: [PATCH V2 2/2] x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present
Date: Mon, 7 Jul 2025 18:15:36 +0000 [thread overview]
Message-ID: <5705fff914dec6f34cf5e1053e4802ee3dff9edb.camel@intel.com> (raw)
In-Reply-To: <a8d517f5-80fc-4225-969d-1191564aceb3@intel.com>
On Mon, 2025-07-07 at 07:32 -0700, Dave Hansen wrote:
> On 7/7/25 00:15, Chao Gao wrote:
> > > Why should this specific kind of freeing (TDX private memory being freed
> > > back to the host) operation be different from any other kind of free?
> > To limit the impact of software bugs (e.g., TDX module bugs) to TDX guests
> > rather than affecting the entire kernel.
>
> It's one thing if the TDX module is so constantly buggy that we're
> getting tons of kernel crash reports that we track back to the TDX module.
Even if this happens, I think it would be good to limit kernel-side safety code
to finding TDX module bugs. Not working around them.
>
> It's quite another thing to add kernel complexity to preemptively lessen
> the chance of a theoretical TDX bug.
And lessen the chance of catching the bug and fixing it in the TDX module.
Otherwise we develop a "works by accident" solution that causes crashes for
unknown reasons if anyone removes code.
This pattern of adding defensive protections against TDX module bugs came up in
the TDX huge pages patches as well. Let's make the type of reasoning here the
norm.
prev parent reply other threads:[~2025-07-07 18:15 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-07-03 15:37 [PATCH V2 0/2] x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present Adrian Hunter
2025-07-03 15:37 ` [PATCH V2 1/2] x86/tdx: Eliminate duplicate code in tdx_clear_page() Adrian Hunter
2025-07-03 16:34 ` Kirill A. Shutemov
2025-07-04 6:44 ` Binbin Wu
2025-07-04 15:33 ` Xiaoyao Li
2025-07-07 2:08 ` Huang, Kai
2025-07-07 17:31 ` Edgecombe, Rick P
2025-07-03 15:37 ` [PATCH V2 2/2] x86/tdx: Skip clearing reclaimed pages unless X86_BUG_TDX_PW_MCE is present Adrian Hunter
2025-07-03 16:44 ` Kirill A. Shutemov
2025-07-03 17:06 ` Vishal Annapurve
2025-07-04 5:37 ` Adrian Hunter
2025-07-07 23:31 ` Vishal Annapurve
2025-07-04 1:32 ` Xiaoyao Li
2025-07-04 6:44 ` Binbin Wu
2025-07-07 2:09 ` Huang, Kai
2025-07-07 3:16 ` Chao Gao
2025-07-07 4:23 ` Dave Hansen
2025-07-07 7:15 ` Chao Gao
2025-07-07 11:39 ` Huang, Kai
2025-07-07 14:32 ` Dave Hansen
2025-07-07 18:15 ` Edgecombe, Rick P [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=5705fff914dec6f34cf5e1053e4802ee3dff9edb.camel@intel.com \
--to=rick.p.edgecombe@intel.com \
--cc=adrian.hunter@intel.com \
--cc=binbin.wu@linux.intel.com \
--cc=bp@alien8.de \
--cc=chao.gao@intel.com \
--cc=dave.hansen@intel.com \
--cc=dave.hansen@linux.intel.com \
--cc=hpa@zytor.com \
--cc=isaku.yamahata@intel.com \
--cc=kai.huang@intel.com \
--cc=kirill.shutemov@linux.intel.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=pbonzini@redhat.com \
--cc=reinette.chatre@intel.com \
--cc=seanjc@google.com \
--cc=tglx@linutronix.de \
--cc=tony.lindgren@linux.intel.com \
--cc=tony.luck@intel.com \
--cc=vannapurve@google.com \
--cc=x86@kernel.org \
--cc=xiaoyao.li@intel.com \
--cc=yan.y.zhao@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).