[PATCH v3 0/3] KVM: VMX: Explicitly track TDX VMs' root level

Sean Christopherson posted 3 patches 3 weeks, 2 days ago
arch/x86/include/asm/kvm_host.h |  1 +
arch/x86/kvm/cpuid.c            | 14 --------------
arch/x86/kvm/cpuid.h            |  1 -
arch/x86/kvm/mmu/mmu.c          | 21 ++++++++++++---------
arch/x86/kvm/vmx/tdx.c          | 20 +++++++++++---------
5 files changed, 24 insertions(+), 33 deletions(-)
[PATCH v3 0/3] KVM: VMX: Explicitly track TDX VMs' root level
Posted by Sean Christopherson 3 weeks, 2 days ago
Fix a bug where a misbehaving (or niave?) userspace can configure guest CPUID
such that KVM will use the "wrong" root level for its mirror EPTs and trip the
KVM_BUG_ON() in tdx_load_mmu_pgd().

v3:
 - Use kvm_mmu_get_max_tdp_level() in __kvm_mmu_create() to avoid what is
   effectively a false positive WARN. [Sashiko]

v2:
 - https://lore.kernel.org/all/20260826215258.937210-1-seanjc@google.com
 - Rewrite the comment in kvm_mmu_get_tdp_level(). [Rick]
 - Check for kvm_has_mirrored_tdp() in kvm_mmu_get_tdp_level(), and yell if
   arch.mirror_root_level isn't also set. [Rick]
 - Separate the removal of TDX_SHARED_BIT_PWL_{4,5} from the bug fix. [Rick]
 - Fix a buring => buried typo. [Binbin]
 - Collect Tested/Reviewed-by. [Binbin, Rick, Yan] (I applied 'em only to
   patch 1, please  holler if that doesn't seem right).

v1: https://lore.kernel.org/all/20260814224509.2342760-1-seanjc@google.com

Sean Christopherson (3):
  KVM: x86/mmu: Use KVM's max TDP level to determine need for 32-bit TDP
    root
  KVM: VMX: Explicitly track TDX VMs' root level instead of guessing it
    from CPUID
  KVM: VMX: Drop TDX_SHARED_BIT_PWL_{4,5} and dedup related code

 arch/x86/include/asm/kvm_host.h |  1 +
 arch/x86/kvm/cpuid.c            | 14 --------------
 arch/x86/kvm/cpuid.h            |  1 -
 arch/x86/kvm/mmu/mmu.c          | 21 ++++++++++++---------
 arch/x86/kvm/vmx/tdx.c          | 20 +++++++++++---------
 5 files changed, 24 insertions(+), 33 deletions(-)


base-commit: 76671054f9a1ff6abb976583cd8da37650acdc97
-- 
2.55.0.970.g62bdec98f9-goog
Re: [PATCH v3 0/3] KVM: VMX: Explicitly track TDX VMs' root level
Posted by Sean Christopherson 4 days, 18 hours ago
On Wed, 02 Sep 2026 16:09:29 -0700, Sean Christopherson wrote:
> Fix a bug where a misbehaving (or niave?) userspace can configure guest CPUID
> such that KVM will use the "wrong" root level for its mirror EPTs and trip the
> KVM_BUG_ON() in tdx_load_mmu_pgd().
> 
> v3:
>  - Use kvm_mmu_get_max_tdp_level() in __kvm_mmu_create() to avoid what is
>    effectively a false positive WARN. [Sashiko]
> 
> [...]

Applied to kvm-x86 misc, thanks!

[1/3] KVM: x86/mmu: Use KVM's max TDP level to determine need for 32-bit TDP root
      https://github.com/kvm-x86/linux/commit/7ed619909773
[2/3] KVM: VMX: Explicitly track TDX VMs' root level instead of guessing it from CPUID
      https://github.com/kvm-x86/linux/commit/cc8a8f2a90b4
[3/3] KVM: VMX: Drop TDX_SHARED_BIT_PWL_{4,5} and dedup related code
      https://github.com/kvm-x86/linux/commit/37e3197c50c8

--
https://github.com/kvm-x86/linux/tree/next