Re: [PATCH v8 08/11] KVM: TDX: Get/put PAMT pages when (un)mapping private memory

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] PAMT and KVM MMU memory caches are depleted during transient hardware contention in KVM_TDX_INIT_MEM_REGION, leading to a fatal VM crash.
--

--- Patch [8]: [PATCH v8 08/11] KVM: TDX: Get/put PAMT pages when (un)mapping private memory ---
commit 204266ade892e48bf35565ec0b69b39fdcfacf67
Author: Kiryl Shutsemau <kas@kernel.org>

KVM: TDX: Get/put PAMT pages when (un)mapping private memory

This commit adds Dynamic PAMT support to KVM's S-EPT MMU. It allocates PAMT
pages on demand when adding guest memory and releases them when removing
memory. It also introduces per-vCPU PAMT caches which are topped up and used
during page faults.

> diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
> index 528ebb3cb0389..b3a8af8cd4335 100644
> --- a/arch/x86/kvm/vmx/tdx.c
> +++ b/arch/x86/kvm/vmx/tdx.c

[ ... ]

> @@ -1679,16 +1694,28 @@ static struct page *tdx_spte_to_sept_pt(struct kvm *kvm, gfn_t gfn,
>  static int tdx_sept_map_nonleaf_spte(struct kvm *kvm, gfn_t gfn,
>  				     enum pg_level level, u64 new_spte)
>  {
> +	struct kvm_vcpu *vcpu = kvm_get_running_vcpu();
>  	gpa_t gpa = gfn_to_gpa(gfn);
>  	u64 err, entry, level_state;
>  	struct page *sept_pt;
> +	int ret;
> +
> +	if (KVM_BUG_ON(!vcpu, kvm))
> +		return -EIO;
>  
>  	sept_pt = tdx_spte_to_sept_pt(kvm, gfn, new_spte, level);
>  	if (!sept_pt)
>  		return -EIO;
>  
> +	ret = tdx_pamt_get(page_to_pfn(sept_pt), &to_tdx(vcpu)->pamt_cache);
> +	if (KVM_BUG_ON(ret, kvm))
> +		return ret;
> +
>  	err = tdh_mem_sept_add(&to_kvm_tdx(kvm)->td, gpa, level, sept_pt,
>  			       &entry, &level_state);
> +	if (err)
> +		tdx_pamt_put(page_to_pfn(sept_pt));
> +
>  	if (unlikely(tdx_operand_busy(err)))
>  		return -EBUSY;

[Severity: High]
Can transient hardware contention crash the VM here by exhausting the
pamt_cache?

If tdh_mem_sept_add() fails with TDX_OPERAND_BUSY, this function returns -EBUSY
and the fault is retried. However, tdx_pamt_put() frees the PAMT page to the
system allocator instead of returning it to the per-vCPU pamt_cache.

Because the page fault retry loops do not call mmu_topup_memory_caches()
on every iteration, retrying a few times will drain the pamt_cache:

	do {
		...
		r = kvm_tdp_mmu_map(vcpu, &fault);
	} while (r == RET_PF_RETRY);

Once the cache is empty, the next tdx_pamt_get() will return -ENOMEM, causing
the KVM_BUG_ON() to evaluate to true and fatally crash the VM.

Should the cache be replenished during these retry loops, or should the put
operation return the page back to the cache to avoid depletion?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260725002302.3337017-1-rick.p.edgecombe@intel.com?part=8