From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4C3C4C77B78 for ; Tue, 25 Apr 2023 19:51:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236185AbjDYTvS (ORCPT ); Tue, 25 Apr 2023 15:51:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57666 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235087AbjDYTvR (ORCPT ); Tue, 25 Apr 2023 15:51:17 -0400 Received: from galois.linutronix.de (Galois.linutronix.de [193.142.43.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B79BC122; Tue, 25 Apr 2023 12:51:15 -0700 (PDT) From: Thomas Gleixner DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020; t=1682452273; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=epqrrIP9XVMR1rQYOgUv6OMHFSXsoKyAhdvov9JTG3c=; b=hcfCyrdfQ/+yHnKF3T+I49mLvnN7Y7S69gBRQL7PhhKJcZIQM6dUY5pvAbw4x5UtKBksj5 +gNdAWyqbtppxTS6xk/OOGkQEgCKZ50daZMUpYiSsjHUolnRQ63od8fRIwCIy22iqsL7Jz ptuYgLF2Vyi6TxSoYJlRddHoLRBh0aBb/2ut263viqoCn4L8IM34OuGeUFz0vHjf3uDsn9 kzIwMYp79iEd+cDm0M3l/TvJoQ8Ebljb98ttQPEip+uioS6jdgokPZm34PxDLgh8kTLkX7 Tk0Brm7tWOMbl31MYKpF+X1fNVmxtHUKna8IUJdeJdt+TiqryaL2tjxt/WxUaA== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=linutronix.de; s=2020e; t=1682452273; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=epqrrIP9XVMR1rQYOgUv6OMHFSXsoKyAhdvov9JTG3c=; b=mlbSRhNUu/9kpluKPqwDbDiOM+hdImwLPmR+/CiZOtx2CU7HgipiQ7bg9V2pgBimVEqMmi qqHiWR0zzWYsg/Bg== To: Mark Rutland Cc: LKML , x86@kernel.org, David Woodhouse , Andrew Cooper , Brian Gerst , Arjan van de Veen , Paolo Bonzini , Paul McKenney , Tom Lendacky , Sean Christopherson , Oleksandr Natalenko , Paul Menzel , "Guilherme G. Piccoli" , Piotr Gorski , Catalin Marinas , Will Deacon , linux-arm-kernel@lists.infradead.org, David Woodhouse , Usama Arif , Juergen Gross , Boris Ostrovsky , xen-devel@lists.xenproject.org, Russell King , Arnd Bergmann , Guo Ren , linux-csky@vger.kernel.org, Thomas Bogendoerfer , linux-mips@vger.kernel.org, "James E.J. Bottomley" , Helge Deller , linux-parisc@vger.kernel.org, Paul Walmsley , Palmer Dabbelt , linux-riscv@lists.infradead.org, Sabin Rapan Subject: Re: [patch 22/37] arm64: smp: Switch to hotplug core state synchronization In-Reply-To: References: <20230414225551.858160935@linutronix.de> <20230414232310.569498144@linutronix.de> Date: Tue, 25 Apr 2023 21:51:12 +0200 Message-ID: <87ttx3zqof.ffs@tglx> MIME-Version: 1.0 Content-Type: text/plain Precedence: bulk List-ID: X-Mailing-List: linux-mips@vger.kernel.org On Mon, Apr 17 2023 at 16:50, Mark Rutland wrote: > On Sat, Apr 15, 2023 at 01:44:49AM +0200, Thomas Gleixner wrote: > I gave this a spin on arm64 (in a 64-vCPU VM on an M1 host), and it seems to > work fine with a bunch of vCPUs being hotplugged off and on again randomly. > > FWIW: > > Tested-by: Mark Rutland > > I also hacked the code to have the dying CPU spin forever before the call to > cpuhp_ap_report_dead(). In that case I see a warning, and that we don't call > arch_cpuhp_cleanup_dead_cpu(), and that the CPU is marked as offline (per > /sys/devices/system/cpu/$N/online). Nice! > As a tangent/aside, we might need to improve that for confidential compute > architectures, and we might want to generically track cpus which might still be > using kernel text/data. On arm64 we ensure that via our cpu_kill() callback > (which'll use PSCI CPU_AFFINITY_INFO), but I'm not sure if TDX and/or SEV-SNP > have a similar mechanism. > > Otherwise, a malicious hypervisor can pause a vCPU just before it leaves the > kernel (e.g. immediately after the arch_cpuhp_cleanup_dead_cpu() call), wait > for a kexec (or resuse of stack memroy), and unpause the vCPU to cause things > to blow up. There are a gazillion ways for a malicious hypervisor to blow up a 'squint enough to be confident' guest. The real question is whether it can utilize such a blow up to extract confidential information from the guest. If not then it's just yet another way of DoS which is an "acceptable" attack as it only affects availability but not confidentiality. Thanks, tglx