Re: [PATCH 07/17] KVM: x86/tdp_mmu: Centralize updates to present external PTEs

["Edgecombe, Rick P" <rick.p.edgecombe@intel.com>]

On Tue, 2026-04-07 at 16:34 +0800, Yan Zhao wrote:
> Below is the list of all handle_changed_spte()-related scenarios.
> 
> Legends:
> NP: !shadow-present SPTE
> P:  shadow-present SPTE
> X: Yes or No.
> shared: hold shared mmu_lock or not
> valid: valid scenario in TDP MMU
> mirror root allowed: could this scenario occur in the mirror root (after basic
>                       TDX huge page support)
> KVM_BUG_ON() hittable: is KVM_BUG_ON() in handle_changed_spte() hittable.
> 
> Scenarios 1-5 are for mapping,
> Scenarios 6-10 are for shadow-present to shadow-present transitions.
> Scenarios 11-14 are for zapping.
> 
>                                             |mirror root| KVM_BUG_ON()
>  # | old_spte  | new_spte  | shared | valid | allowed   | hittable
> ---|-----------|-----------|--------|-------|-----------|-----------------------
>  1 |    NP     |    leaf P |   Y    |  Y    |     Y     |    N
>  2 |    NP     |    leaf P |   N    |  Y    |     N     |    Y (a1)
>  3 |    NP     | nonleaf P |   Y    |  Y    |     Y     |    N
>  4 |    NP     | nonleaf P |   N    |  Y    |     N     |    Y (a2)
>  5 |    NP     |    NP     |   X    |  N    |     N     | warn !mmio_spte && !frozen_spte
> ---|-----------|-----------|--------|-------|-----------|-----------------------
>  6 |    leaf P |    leaf P |   X    |  N    |     X     |    N
>  7 |    leaf P | nonleaf P |   Y    |  Y    |     N     |    N
>  8 |    leaf P | nonleaf P |   N    |  Y    |     Y     |    N
>  9 | nonleaf P |    leaf P |   X    |  Y    |     N     |    Y (b)
> 10 | nonleaf P | nonleaf P |   X    |  N    |     X     | warn pfn_changed
> ---|-----------|-----------|--------|-------|-----------|-----------------------
> 11 |    leaf P |    NP     |   Y    |  Y    |     N     |    N (c)
> 12 |    leaf P |    NP     |   N    |  Y    |     Y     |    N
> 13 | nonleaf P |    NP     |   Y    |  Y    |     N     |    Y (d)
> 14 | nonleaf P |    NP     |   N    |  Y    |     Y     |    N

Wow Yan! This is amazing.

> 
> 
> Currently, only 4 scenarios (a1),(a2), (b), (d) may trigger KVM_BUG_ON() in
> handle_changed_spte(), but none of them are currently reachable by mirror root.

Great.

> 
> 
> (a1)(a2) May hit KVM_BUG_ON() in handle_changed_spte() if
>          tdx_sept_set_private_spte() fails due to contentions. e.g.,
>          tdh_mem_sept_add(), tdx_mem_page_aug(), or tdx_mem_page_add() may
>          contend with tdh_vp_enter() due to zero-step mitigation or may
>          potentially contend with TDCALLs.
> (b) Promotion case. Currently unreachable in mirror root.
>     Need more complex changes in TDP MMU if we want to support it in the future.
> (c) Will not hit KVM_BUG_ON() in TDP MMU, but will trigger warnings in
>     tdx_sept_remove_private_spte() due to lockdep_assert_held_write() or
>     TDX_BUG_ON() caused by concurrent BLOCK, TRACK, REMOVE.
> (d) May hit the KVM_BUG_ON() in handle_changed_spte() due to failure to remove
>     child S-EPT entries and will trigger warnings in
>     tdx_sept_remove_private_spte() due to lockdep_assert_held_write() or
>     TDX_BUG_ON() caused by concurrent BLOCK, TRACK, REMOVE.
>     May also trigger TDX_BUG_ON() in tdx_sept_reclaim_private_spt().

Ok! I wonder if we could (not for this series) encode this information into some
centralized helper on the TDX side. It's nice to see it all together. Not sure
on the idea.