From 31ed024faf4516f0d774fd66926f7747ac384ce7 Mon Sep 17 00:00:00 2001 From: Yan Zhao Date: Thu, 23 Jan 2025 17:52:28 -0800 Subject: [PATCH] KVM: TDX: Add a method to ignore updating CPU dirty logging request for TDs Add a method to ignore requests to update CPU dirty logging for TDs, as basic TDX does not support the PML feature, and KVM TDX does not allocate or flush PML buffers for TDs. Do not invoke vmx_update_cpu_dirty_logging() for TDs, and doing so would cause a NULL pointer access error. This is to fix the issue first reported in [1], where QEMU attaches an emulated VGA device to a TD, resulting in a "kernel NULL pointer dereference" in the host. In QEMU, vga_common_init() sets the vram memory region to have a dirty_log_mask with bit DIRTY_MEMORY_VGA. pci_cirrus_vga_realize vga_common_init vga_dirty_log_start memory_region_set_log mr->dirty_log_mask = 1 << DIRTY_MEMORY_VGA; QEMU's KVM acceleration code checks if mr->dirty_log_mask is non-zero before setting the KVM_MEM_LOG_DIRTY_PAGES flag for the corresponding memslot (which has no flag KVM_MEM_GUEST_MEMFD) in KVM. This causes KVM to detect that a memslot has the KVM_MEM_LOG_DIRTY_PAGES flag and invoke kvm_mmu_update_cpu_dirty_logging() --> vmx_update_cpu_dirty_logging() to turn on PML, leading to the NULL pointer access error. Reported-by: ANAND NARSHINHA PATIL Reported-by: Pedro Principeza Reported-by: Farrah Chen Closes: https://github.com/canonical/tdx/issues/202 Link: https://github.com/canonical/tdx/issues/202 [1] Signed-off-by: Yan Zhao --- arch/x86/kvm/vmx/main.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/arch/x86/kvm/vmx/main.c b/arch/x86/kvm/vmx/main.c index bac946b535ff..5620f62cb6f9 100644 --- a/arch/x86/kvm/vmx/main.c +++ b/arch/x86/kvm/vmx/main.c @@ -182,6 +182,18 @@ static int vt_handle_exit(struct kvm_vcpu *vcpu, return vmx_handle_exit(vcpu, fastpath); } +static void vt_update_cpu_dirty_logging(struct kvm_vcpu *vcpu) +{ + /* + * Basic TDX does not support feature PML. KVM does not enable PML in + * TD's VMCS, nor does it allocate or flush PML buffer for TDX. + */ + if (WARN_ON_ONCE(is_td_vcpu(vcpu))) + return; + + vmx_update_cpu_dirty_logging(vcpu); +} + static int vt_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) { if (unlikely(is_td_vcpu(vcpu))) @@ -993,7 +1005,7 @@ struct kvm_x86_ops vt_x86_ops __initdata = { .handle_exit_irqoff = vmx_handle_exit_irqoff, .cpu_dirty_log_size = PML_LOG_NR_ENTRIES, - .update_cpu_dirty_logging = vmx_update_cpu_dirty_logging, + .update_cpu_dirty_logging = vt_update_cpu_dirty_logging, .nested_ops = &vmx_nested_ops,