Re: [PATCH v2 2/3] KVM: TDX: Set SIGNIFCANT_INDEX flag as appropriate when filling CPUID entries

[Binbin Wu]

On 10/24/2026 10:03 AM, Sean Christopherson wrote:
> On Fri, Oct 23, 2026, Binbin Wu wrote:
>> On 10/23/2026 5:01 AM, Sean Christopherson wrote:
>>> diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
>>> index 271c2f94b8dd..37d088f6f7a8 100644
>>> --- a/arch/x86/kvm/vmx/tdx.c
>>> +++ b/arch/x86/kvm/vmx/tdx.c
>>> @@ -2,6 +2,7 @@
>>>  #include <linux/cleanup.h>
>>>  #include <linux/cpu.h>
>>>  #include <asm/cpufeature.h>
>>> +#include <asm/cpuid/api.h>
>>>  #include <asm/fpu/xcr.h>
>>>  #include <linux/misc_cgroup.h>
>>>  #include <linux/mmu_context.h>
>>> @@ -163,12 +164,23 @@ static void td_init_cpuid_entry2(struct kvm_cpuid_entry2 *entry, unsigned char i
>>>  
>>>  	entry->function = (u32)td_conf->cpuid_config_leaves[idx];
>>>  	entry->index = td_conf->cpuid_config_leaves[idx] >> 32;
>>> +	entry->flags = 0;
>>>  	entry->eax = (u32)td_conf->cpuid_config_values[idx][0];
>>>  	entry->ebx = td_conf->cpuid_config_values[idx][0] >> 32;
>>>  	entry->ecx = (u32)td_conf->cpuid_config_values[idx][1];
>>>  	entry->edx = td_conf->cpuid_config_values[idx][1] >> 32;
>>>  
>>> -	if (entry->index == KVM_TDX_CPUID_NO_SUBLEAF)
>>> +	WARN_ON_ONCE(cpuid_function_is_indexed(entry->function) !=
>>> +		     (entry->index != KVM_TDX_CPUID_NO_SUBLEAF));
>>> +
>>> +	/*
>>> +	 * Explicitly zero the index when it's not significant, even though it
>>> +	 * _should_ be meaningless.  Userspace relies on the index being zero
>>> +	 * (the ABI was inherited from KVM_GET_SUPPORTED_CPUID).
>>> +	 */
>>> +	if (cpuid_function_is_indexed(entry->function))
>>
>> If the information about whether the entry is indexed mismatched, i.e. the
>> warning above fired, should we use the information from the TDX module as the
>> standard?
> 
> IMO, no.  All of this information is available at module load.  If we want to
> harden KVM (and we probably should), then we should apply these sanity checks
> (or equivalents) during tdx_hardware_setup() and disable TDX if any of them fail.

OK.

In practice, I don't think it is a problem unless cpuid_function_is_indexed() is
missing an indexed leaf that KVM cares about.  If it isn't missing one, unknown
CPUID leafs will still be rejected later by the allowlist-based TDX CPUID
validation.

There is also a false-positive risk: a new TDX module could report an indexed
leaf that KVM doesn't know about. One way to avoid that is for KVM to fail TDX
module initialization only when there is a mismatch *and* the leaf is listed in
reverse_cpuid[]. I think that can be handled separately.

I'll rebase my TDX CPUID validation patch series on top of this series.

> 
> Anything else is a hope and a prayer.