Re: [RFC PATCH v2 0/4] Add KVM API for confidential guest live migration

[Tony Lindgren <tony.lindgren@linux.intel.com>]

On Thu, Oct 08, 2026 at 10:31:24AM -0400, Peter Xu wrote:
> On Thu, Oct 08, 2026 at 09:23:57AM +0300, Tony Lindgren wrote:
> > Yes GPAs are part of the MAC generated by tdh_export_mem() so cannot change
> > for import. This can be seen at the TDX module source at [0] below.
> > 
> > What if we add a flag for the memory functions to describe the type of
> > addressing used?
> > 
> > [0] https://github.com/intel/confidential-computing.tdx.tdx-module/blob/tdx_1.5/src/vmm_dispatcher/migration_api_calls/tdh_export_mem.c#L1083
> 
> Could you elaborate some more?

Sorry if I was a bit unclear. I meant TDX needs GPA but also other
type of addressing could be added.

We could specify the addressing type in struct kvm_memory_transfer flags:

KVM_MEM_TRANSFER_GPA	0
KVM_MEM_TRANSFER_GMEM	1

Kishen suggested adding gmem_fd to struct kvm_memory_transfer and then
for KVM_MEM_TRANSFER_GMEM the addresses would be an offsets.
 
> IIUC if the stream is encrypted with GPA info, then the gmem offset is a
> no-go, because I believe in that case we need the ability to apply a stream
> of encrypted data to one guest memfd.  It means even if gmemfd can be
> attached to a VM before hand, it doesn't describe GPA address space, so I
> don't see how to verify the encrypted GPA.

Yes that's my understanding as well.