linux-kernel - Re: [RFC PATCH v2 10/23] KVM: TDX: Enable huge page splitting under write kvm->mmu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aRVyYdBlnS7DD1SS@yzhao56-desk.sh.intel.com>
Date: Thu, 13 Nov 2025 13:53:37 +0800
From: Yan Zhao <yan.y.zhao@...el.com>
To: "Huang, Kai" <kai.huang@...el.com>
CC: "pbonzini@...hat.com" <pbonzini@...hat.com>, "seanjc@...gle.com"
	<seanjc@...gle.com>, "kvm@...r.kernel.org" <kvm@...r.kernel.org>, "Li,
 Xiaoyao" <xiaoyao.li@...el.com>, "Du, Fan" <fan.du@...el.com>, "Hansen, Dave"
	<dave.hansen@...el.com>, "david@...hat.com" <david@...hat.com>,
	"thomas.lendacky@....com" <thomas.lendacky@....com>, "vbabka@...e.cz"
	<vbabka@...e.cz>, "tabba@...gle.com" <tabba@...gle.com>, "kas@...nel.org"
	<kas@...nel.org>, "michael.roth@....com" <michael.roth@....com>, "Weiny, Ira"
	<ira.weiny@...el.com>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>, "binbin.wu@...ux.intel.com"
	<binbin.wu@...ux.intel.com>, "ackerleytng@...gle.com"
	<ackerleytng@...gle.com>, "Yamahata, Isaku" <isaku.yamahata@...el.com>,
	"Peng, Chao P" <chao.p.peng@...el.com>, "Annapurve, Vishal"
	<vannapurve@...gle.com>, "Edgecombe, Rick P" <rick.p.edgecombe@...el.com>,
	"Miao, Jun" <jun.miao@...el.com>, "x86@...nel.org" <x86@...nel.org>,
	"pgonda@...gle.com" <pgonda@...gle.com>
Subject: Re: [RFC PATCH v2 10/23] KVM: TDX: Enable huge page splitting under
 write kvm->mmu_lock

On Tue, Nov 11, 2025 at 06:20:40PM +0800, Huang, Kai wrote:
> On Thu, 2025-08-07 at 17:43 +0800, Yan Zhao wrote:
> > Implement the split_external_spt hook to enable huge page splitting for
> > TDX when kvm->mmu_lock is held for writing.
> > 
> > Invoke tdh_mem_range_block(), tdh_mem_track(), kicking off vCPUs,
> > tdh_mem_page_demote() in sequence. All operations are performed under
> > kvm->mmu_lock held for writing, similar to those in page removal.
> > 
> > Even with kvm->mmu_lock held for writing, tdh_mem_page_demote() may still
> > contend with tdh_vp_enter() and potentially with the guest's S-EPT entry
> > operations. Therefore, kick off other vCPUs and prevent tdh_vp_enter()
> > from being called on them to ensure success on the second attempt. Use
> > KVM_BUG_ON() for any other unexpected errors.
> 
> I thought we also need to do UNBLOCK after DEMOTE, but it turns out we don't
> need to.
Yes, the BLOCK operates on PG_LEVEL_2M, and a successful DEMOTE updates the SEPT
non-leaf 2MB entry to point to the newly added page table page with RWX
permission, so there's no need to do UNBLOCK on success.

The purpose of BLOCK + TRACK + kick off vCPUs is to ensure all vCPUs must find
the old huge guest page is no longer mapped in the SEPT.

> Maybe we can call this out.
Will do.

> > +static int tdx_spte_demote_private_spte(struct kvm *kvm, gfn_t gfn,
> > +					enum pg_level level, struct page *page)
> > +{
> > +	int tdx_level = pg_level_to_tdx_sept_level(level);
> > +	struct kvm_tdx *kvm_tdx = to_kvm_tdx(kvm);
> > +	gpa_t gpa = gfn_to_gpa(gfn);
> > +	u64 err, entry, level_state;
> > +
> > +	err = tdh_mem_page_demote(&kvm_tdx->td, gpa, tdx_level, page,
> > +				  &entry, &level_state);
> > +
> > +	if (unlikely(tdx_operand_busy(err))) {
> > +		tdx_no_vcpus_enter_start(kvm);
> > +		err = tdh_mem_page_demote(&kvm_tdx->td, gpa, tdx_level, page,
> > +					  &entry, &level_state);
> > +		tdx_no_vcpus_enter_stop(kvm);
> > +	}
> > +
> > +	if (KVM_BUG_ON(err, kvm)) {
> > +		pr_tdx_error_2(TDH_MEM_PAGE_DEMOTE, err, entry, level_state);
> > +		return -EIO;
> > +	}
> > +	return 0;
> > +}
> > +
> > +static int tdx_sept_split_private_spt(struct kvm *kvm, gfn_t gfn, enum pg_level level,
> > +				      void *private_spt)
> > +{
> > +	struct page *page = virt_to_page(private_spt);
> > +	int ret;
> > +
> > +	if (KVM_BUG_ON(to_kvm_tdx(kvm)->state != TD_STATE_RUNNABLE ||
> > +		       level != PG_LEVEL_2M, kvm))
> > +		return -EINVAL;
> > +
> > +	ret = tdx_sept_zap_private_spte(kvm, gfn, level, page);
> 
> I don't quite follow why you pass 'private_spt' to
> tdx_sept_zap_private_spte(),
Simply because tdx_sept_zap_private_spte() requires a "page", which is actually
not used by tdx_sept_zap_private_spte() in the split path.

> but it doesn't matter anymore since it's gone
> in Sean's latest tree.
Right.