Re: [PATCH 1/2] KVM: TDX: Enable Notify VM exit

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Userspace can trigger a host-side KVM_BUG_ON (which includes a WARN_ON_ONCE) by enabling KVM_CAP_X86_NOTIFY_VMEXIT on a TDX VM when the underlying TDX module does not support the feature.
--

--- Patch [1]: [PATCH 1/2] KVM: TDX: Enable Notify VM exit ---
commit c9d2769fa5b2847408c7817858612eb62b0c8346
Author: Xiaoyao Li <xiaoyao.li@intel.com>

KVM: TDX: Enable Notify VM exit

This commit enables Notify VM exit functionality for TDX guests by configuring
the NOTIFY_VM_EXITING and Notify Window in the TD VMCS during vCPU
initialization. It also adds an exit handler to process TDX Notify VM Exits
and delegates NMI blocking state handling to the TDX module.

> diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
> index 545b03d9d10b8..cdc0d24657acb 100644
> --- a/arch/x86/kvm/vmx/tdx.c
> +++ b/arch/x86/kvm/vmx/tdx.c
[ ... ]
> @@ -3157,6 +3160,13 @@ static int tdx_vcpu_init(struct kvm_vcpu *vcpu, struct kvm_tdx_cmd *cmd)
>  	td_vmcs_write64(tdx, POSTED_INTR_DESC_ADDR, __pa(&tdx->vt.pi_desc));
>  	td_vmcs_setbit32(tdx, PIN_BASED_VM_EXEC_CONTROL, PIN_BASED_POSTED_INTR);
>  
> +	if (kvm_notify_vmexit_enabled(vcpu->kvm)) {
> +		td_vmcs_setbit32(tdx, SECONDARY_VM_EXEC_CONTROL,
> +				 SECONDARY_EXEC_NOTIFY_VM_EXITING);

[Severity: High]
Does this allow an unprivileged userspace process to trigger a host-side
KVM_BUG_ON() and crash the host if panic_on_warn is enabled?

If KVM advertises KVM_CAP_X86_NOTIFY_VMEXIT globally based solely on CPU
hardware support, userspace can enable it for a TDX VM. If the underlying
TDX module (e.g., v1.0) does not support Notify VM Exiting, this write
will fail.

When the TDX module write operation fails, the macro backing
td_vmcs_setbit32() calls tdh_vp_wr_failed(), which triggers a KVM_BUG_ON():

arch/x86/kvm/vmx/tdx.c:tdh_vp_wr_failed() {
	KVM_BUG_ON(1, tdx->vcpu.kvm);
	pr_err("TDH_VP_WR[%s.0x%x]%s0x%llx failed: 0x%llx\n", ...);
}

Should we verify that the loaded TDX module actually supports the Notify VM
Exit feature before attempting to program these TD VMCS fields?

> +		td_vmcs_write32(tdx, NOTIFY_WINDOW,
> +				vcpu->kvm->arch.notify_window);
> +	}
> +
>  	tdx->state = VCPU_TD_STATE_INITIALIZED;
>  
>  	return 0;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260805031257.1844914-1-xiaoyao.li@intel.com?part=1