Re: [PATCH v7 06/11] KVM: TDX: Allocate PAMT memory for TD and vCPU control structures

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] cpus_read_lock() is acquired while holding kvm->lock, violating the KVM lock ordering.
- [High] misc_cg_uncharge() is called unconditionally on the error path, underflowing the cgroup limit when misc_cg_try_charge() fails.
--

--- Patch [6]: [PATCH v7 06/11] KVM: TDX: Allocate PAMT memory for TD and vCPU control structures ---
commit 16605575e9c07ab8d7ae8c15ce1e960fccfd95db
Author: Kiryl Shutsemau <kas@kernel.org>

KVM: TDX: Allocate PAMT memory for TD and vCPU control structures

Use control page helpers for allocating and freeing TD control structures,
such that these operations can work for Dynamic PAMT.

> diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
> index d1af0a752e97e..528ebb3cb0389 100644
> --- a/arch/x86/kvm/vmx/tdx.c
> +++ b/arch/x86/kvm/vmx/tdx.c
[ ... ]
> @@ -2459,7 +2459,7 @@ static int __tdx_td_init(struct kvm *kvm, struct td_params *td_params,
>  
>  	ret = -ENOMEM;
>  
> -	tdr_page = alloc_page(GFP_KERNEL_ACCOUNT);
> +	tdr_page = tdx_alloc_control_page();
>  	if (!tdr_page)
>  		goto free_hkid;

[Severity: High]
This isn't a bug introduced by this patch, but doesn't jumping to free_hkid
when misc_cg_try_charge() fails result in an underflow?

If misc_cg_try_charge(MISC_CG_RES_TDX, kvm_tdx->misc_cg, 1) in
arch/x86/kvm/vmx/tdx.c:__tdx_td_init() fails, it jumps to free_hkid.
tdx_hkid_free() then unconditionally calls misc_cg_uncharge(), underflowing
the limit.

[Severity: High]
This is a pre-existing issue, but does calling cpus_read_lock() inside
__tdx_td_init() violate KVM lock ordering?

The KVM_TDX_INIT_VM ioctl acquires kvm->lock via tdx_vm_state_guard() in
arch/x86/kvm/vmx/tdx.c:tdx_vm_ioctl(), and then __tdx_td_init() calls
cpus_read_lock() while kvm->lock is already held. Can this create a reverse
locking dependency against CPU hotplug threads?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260718014500.2231262-1-rick.p.edgecombe@intel.com?part=6