Re: [PATCH 1/2] KVM: TDX: Enable Notify VM exit

On 8/5/2026 11:38 AM, [email protected] wrote:
>> diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
>> index 545b03d9d10b8..cdc0d24657acb 100644
>> --- a/arch/x86/kvm/vmx/tdx.c
>> +++ b/arch/x86/kvm/vmx/tdx.c
> [ ... ]
>> @@ -3157,6 +3160,13 @@ static int tdx_vcpu_init(struct kvm_vcpu *vcpu, struct kvm_tdx_cmd *cmd)
>>   	td_vmcs_write64(tdx, POSTED_INTR_DESC_ADDR, __pa(&tdx->vt.pi_desc));
>>   	td_vmcs_setbit32(tdx, PIN_BASED_VM_EXEC_CONTROL, PIN_BASED_POSTED_INTR);
>>   
>> +	if (kvm_notify_vmexit_enabled(vcpu->kvm)) {
>> +		td_vmcs_setbit32(tdx, SECONDARY_VM_EXEC_CONTROL,
>> +				 SECONDARY_EXEC_NOTIFY_VM_EXITING);
> [Severity: High]
> Does this allow an unprivileged userspace process to trigger a host-side
> KVM_BUG_ON() and crash the host if panic_on_warn is enabled?
> 
> If KVM advertises KVM_CAP_X86_NOTIFY_VMEXIT globally based solely on CPU
> hardware support, userspace can enable it for a TDX VM. If the underlying
> TDX module (e.g., v1.0) does not support Notify VM Exiting, this write
> will fail.
> 
> When the TDX module write operation fails, the macro backing
> td_vmcs_setbit32() calls tdh_vp_wr_failed(), which triggers a KVM_BUG_ON():
> 
> arch/x86/kvm/vmx/tdx.c:tdh_vp_wr_failed() {
> 	KVM_BUG_ON(1, tdx->vcpu.kvm);
> 	pr_err("TDH_VP_WR[%s.0x%x]%s0x%llx failed: 0x%llx\n", ...);
> }
> 
> Should we verify that the loaded TDX module actually supports the Notify VM
> Exit feature before attempting to program these TD VMCS fields?

Every TDX module should support this feature and SEAMCALLs to set the TD 
VMCS will not fail as long as the hardware supports the feature. The 
hardware support is checked by KVM and reflected in 
kvm_caps.has_notify_vmexit.

If any TDX module doesn't allow to program the TD VMCS fields of Notify 
VM exit, it's just a bug of TDX module.