Re: [PATCH v8 23/46] KVM: TDX: Make source page optional for KVM_TDX_INIT_MEM_REGION

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] In-place memory conversion for TDX uses the same physical page for source and destination, which violates the `TDH.MEM.PAGE.ADD` operand constraints.
--

commit 9c726fd29e9655323e0c5ac003966956b5c8273c
Author: Ackerley Tng <ackerleytng@google.com>

KVM: TDX: Make source page optional for KVM_TDX_INIT_MEM_REGION

This commit updates tdx_gmem_post_populate() to allow a NULL source
page by defaulting to the page associated with the destination PFN.
This allows for in-place memory conversion where data is already present
in the target PFN.

> diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
> index ffe9d0db58c59..56d10333c61a7 100644
> --- a/arch/x86/kvm/vmx/tdx.c
> +++ b/arch/x86/kvm/vmx/tdx.c
> @@ -3198,8 +3198,12 @@ static int tdx_gmem_post_populate(struct kvm *kvm, gfn_t gfn, kvm_pfn_t pfn,
>  	if (KVM_BUG_ON(kvm_tdx->page_add_src, kvm))
>  		return -EIO;
>  
> -	if (!src_page)
> -		return -EOPNOTSUPP;
> +	if (!src_page) {
> +		if (!gmem_in_place_conversion)
> +			return -EOPNOTSUPP;
> +
> +		src_page = pfn_to_page(pfn);

[Severity: High]
Will this assignment cause the TDH.MEM.PAGE.ADD SEAMCALL to be executed with
identical physical addresses for both the destination and the source?

The Intel TDX module ABI and MKTME architectural constraints prohibit
overlapping source and destination pages. Reading with the host KeyID and
writing with the TD private KeyID to the identical physical address
simultaneously causes cache aliasing and potential machine check exceptions.

Because of this, the TDX module rejects identical addresses with
TDX_OPERAND_INVALID.

Since KVM verifies the SEAMCALL result with TDX_BUG_ON_2, does this
deterministic hardware rejection introduce a regression where KVM will bug
and crash the VM during initialization when in-place conversion is utilized?

> +	}
>  
>  	kvm_tdx->page_add_src = src_page;
>  	ret = kvm_tdp_mmu_map_private_pfn(arg->vcpu, gfn, pfn);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260618-gmem-inplace-conversion-v8-0-9d2959357853@google.com?part=23