Re: [PATCH v3 3/6] x86/virt/tdx: Add extra memory to TDX module for the extensions

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] x86/virt/tdx: kzalloc() breaks page alignment for hardware-facing struct under debug
--

commit b27e647d007dabaa3a6b0eda05701af51bffc99e
Author: Xu Yilun <yilun.xu@linux.intel.com>

x86/virt/tdx: Add extra memory to TDX module for the extensions

This commit introduces a new SEAMCALL leaf TDH.EXT.MEM.ADD to allocate and
add execution environment memory to the TDX module for extensions. It allocates
a page-sized structure tdx_hpa_list to pass the physical addresses of the
allocated memory to the hardware.

> diff --git a/arch/x86/virt/vmx/tdx/tdx.c b/arch/x86/virt/vmx/tdx/tdx.c
> index f08278a47affc..c445359335516 100644
> --- a/arch/x86/virt/vmx/tdx/tdx.c
> +++ b/arch/x86/virt/vmx/tdx/tdx.c

[ ... ]

> +static __init u64 to_hpa_list_info(struct tdx_hpa_list *hpa_list,
> +				   unsigned int nr_pages)
> +{
> +	return FIELD_PREP(HPA_LIST_INFO_FIRST_ENTRY, 0) |
> +	       FIELD_PREP(HPA_LIST_INFO_PFN, PFN_DOWN(__pa(hpa_list))) |

[Severity: High]
If the hpa_list pointer is unaligned due to slab redzones, does this
PFN_DOWN() truncation cause the TDX module to read the redzone metadata
instead of the actual array?

> +	       FIELD_PREP(HPA_LIST_INFO_LAST_ENTRY, nr_pages - 1);
> +}

[ ... ]

> +static __init int tdx_ext_mem_setup(void)
> +{
> +	unsigned int required_pages, added_pages;
> +	struct tdx_sys_info_ext sysinfo_ext;
> +	struct tdx_hpa_list *hpa_list;
> +	struct page *page;
> +	int ret;

[ ... ]

> +	/*
> +	 * Allocate the container page for the HPA_LIST. tdx_hpa_list is
> +	 * guaranteed to be page-sized by static_assert(), so kzalloc()
> +	 * guarantees the page alignment.
> +	 */
> +	hpa_list = kzalloc_obj(*hpa_list);

[Severity: High]
Does kzalloc_obj() actually guarantee page alignment when CONFIG_KASAN or
CONFIG_SLUB_DEBUG are enabled?

Since slab redzones offset the object within the page, a PAGE_SIZE allocation
through the slab allocator might not return a page-aligned address under
these debug configurations.

Would it be safer to use the page allocator (e.g. alloc_page() or
get_zeroed_page()) instead of the slab allocator for a structure that requires
strict page alignment when passed to hardware?

> +	if (!hpa_list)
> +		return -ENOMEM;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261006-tdx-module-ext-v3-0-db52cb05b918@linux.intel.com?part=3