RE: [RFC PATCH 06/15] virt: tdx-guest: Support TDI bind and unbind operations

[Duan, Zhenzhong]

>> > > I want to discuss this further.
>> > >
>> > > If the TSM driver successfully locks a device but later fails to
>unlock
>> > it,
>> >
>> > Can you explain some concrete scenarios where this would happen? We can
>> > think
>> > about whether it is required for an initial minimal set that does
>something
>> > useful.
>>
>> I can think of some rare cases: the TDCM hypercall may return an
>error(e.g., a messing VMM or TDI device firmware),
>>
>
>I'm not clear whose fault this is.

Host side fault, e.g., a malicious VMM does nothing in UNBIND TDCM hypercall.

>
>>  or TDCM hypercall polling timeout(e.g., heavy load in host).
>
>Heavy load in the host leads to broken flag being set? This is pretty
>similar to
>the issues around the BUSY errors. You really need to think through how
>this is
>all going to work.

Hmm, yes, my timeout example was too vague to justify a broken state, it's recoverable with retry in this case.