Re: [PATCH v2 1/2] KVM: VMX: Explicitly track TDX VMs' root level instead of guessing it from CPUID

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] A malicious or buggy userspace can trigger a host-side WARN_ON_ONCE by attempting to create a vCPU for a TDX VM before successfully completing KVM_TDX_INIT_VM.
--

commit d9de404aca15fbfe936c1e65aa00fb63755a135e
Author: Sean Christopherson <seanjc@google.com>

KVM: VMX: Explicitly track TDX VMs' root level instead of guessing it from CPUID

This commit replaces guessing the root level from CPUID with explicit tracking
for TDX VMs. It sets the mirror root level based on the configuration provided
during KVM_TDX_INIT_VM.

> diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
> index 064ecc33b9267..611c78be8b411 100644
> --- a/arch/x86/kvm/mmu/mmu.c
> +++ b/arch/x86/kvm/mmu/mmu.c
[ ... ]
> @@ -5953,19 +5953,22 @@ void __kvm_mmu_refresh_passthrough_bits(struct kvm_vcpu *vcpu,
>  
>  static inline int kvm_mmu_get_tdp_level(struct kvm_vcpu *vcpu)
>  {
[ ... ]
>  	/* tdp_root_level is architecture forced level, use it if nonzero */
>  	if (tdp_root_level)
>  		return tdp_root_level;
>  
> +	/*
> +	 * If the VM has mirror roots, then the root level is predefined as the
> +	 * mirror root (and by extension the normal root) needs to match the
> +	 * root level that was configured for the external page tables that are
> +	 * being mirrored by KVM.
> +	 */
> +	if (kvm_has_mirrored_tdp(vcpu->kvm) &&
> +	    !WARN_ON_ONCE(!vcpu->kvm->arch.mirror_root_level))
> +		return vcpu->kvm->arch.mirror_root_level;

[Severity: High]
Does this regression allow a malicious or buggy userspace to trigger this
WARN_ON_ONCE and cause a host denial of service (especially with
panic_on_warn=1)?

If userspace creates a TDX VM via KVM_CREATE_VM (setting the VM type to
KVM_X86_TDX_VM) and then directly calls KVM_CREATE_VCPU without executing
KVM_TDX_INIT_VM first, it appears this warning will be reached.

During vCPU creation, the MMU context is initialized unconditionally before
the architecture-specific vCPU creation callback:

kvm_arch_vcpu_create()->kvm_mmu_create()->kvm_mmu_get_tdp_level()

Because KVM_TDX_INIT_VM was skipped, mirror_root_level remains 0, satisfying
the condition and triggering the kernel warning.

The architecture-specific callback that enforces the TD_STATE_INITIALIZED
requirement is invoked too late in the process to prevent this:

kvm_arch_vcpu_create()->kvm_x86_call(vcpu_create)()

Would it be safer to return an error or handle the uninitialized state rather
than triggering a host-side warning on user-controllable input?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260826215258.937210-1-seanjc@google.com?part=1