Re: [PATCH v2 2/3] KVM: TDX: Set SIGNIFCANT_INDEX flag as appropriate when filling CPUID entries

[Sean Christopherson]

On Tue, Oct 27, 2026, Xiaoyao Li wrote:
> On 10/27/2026 10:05 PM, Sean Christopherson wrote:
> > On Tue, Oct 27, 2026, Xiaoyao Li wrote:
> >> On 10/23/2026 5:01 AM, Sean Christopherson wrote:
> >>> diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
> >>> index 271c2f94b8dd..37d088f6f7a8 100644
> >>> --- a/arch/x86/kvm/vmx/tdx.c
> >>> +++ b/arch/x86/kvm/vmx/tdx.c
> >>> @@ -2,6 +2,7 @@
> >>>  #include <linux/cleanup.h>
> >>>  #include <linux/cpu.h>
> >>>  #include <asm/cpufeature.h>
> >>> +#include <asm/cpuid/api.h>
> >>>  #include <asm/fpu/xcr.h>
> >>>  #include <linux/misc_cgroup.h>
> >>>  #include <linux/mmu_context.h>
> >>> @@ -163,12 +164,23 @@ static void td_init_cpuid_entry2(struct kvm_cpuid_entry2 *entry, unsigned char i
> >>>  
> >>>  	entry->function = (u32)td_conf->cpuid_config_leaves[idx];
> >>>  	entry->index = td_conf->cpuid_config_leaves[idx] >> 32;
> >>> +	entry->flags = 0;
> >>>  	entry->eax = (u32)td_conf->cpuid_config_values[idx][0];
> >>>  	entry->ebx = td_conf->cpuid_config_values[idx][0] >> 32;
> >>>  	entry->ecx = (u32)td_conf->cpuid_config_values[idx][1];
> >>>  	entry->edx = td_conf->cpuid_config_values[idx][1] >> 32;
> >>>  
> >>> -	if (entry->index == KVM_TDX_CPUID_NO_SUBLEAF)
> >>> +	WARN_ON_ONCE(cpuid_function_is_indexed(entry->function) !=
> >>> +		     (entry->index != KVM_TDX_CPUID_NO_SUBLEAF));
> >>
> >> I think the WARN_ON_ONCE() is very likely to be triggered in the future when
> >> people run old kernel with new TDX modules.
> > 
> > Then upstream patches to make that not happen.  Intel insists on treating the TDX
> > Module like hardware.  So, treat new TDX Modules like new hardware.  Upstream
> > support for the new "hardware" before it ships, cc'd to stable@xxxxxxxxxxxxxxx
> > if necessary.
> > 
> > Because IMO, the WARN is doing exactly what it's intended to do: alerting the
> > admin that they are running a potentially dangerous setup.
> 
> For this specific case, does it mean every later patch to add a new leaf in
> cpuid_function_is_indexed() needs to be backported to stable?

If you want to ship a new TDX Module that enumerates features in those leaves and
works as-is on older kernels, yes.  Again, this isn't really any different than
enabling new hardware.  E.g. a kernel from 2024 generally doesn't work flawlessly
on a CPU being released in 2026.