Re: [PATCH v2 2/3] KVM: TDX: Set SIGNIFCANT_INDEX flag as appropriate when filling CPUID entries

[Xiaoyao Li]

On 10/27/2026 10:55 PM, Sean Christopherson wrote:
> On Tue, Oct 27, 2026, Xiaoyao Li wrote:
>> On 10/27/2026 10:05 PM, Sean Christopherson wrote:
>>> On Tue, Oct 27, 2026, Xiaoyao Li wrote:
>>>> On 10/23/2026 5:01 AM, Sean Christopherson wrote:
>>>>> diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
>>>>> index 271c2f94b8dd..37d088f6f7a8 100644
>>>>> --- a/arch/x86/kvm/vmx/tdx.c
>>>>> +++ b/arch/x86/kvm/vmx/tdx.c
>>>>> @@ -2,6 +2,7 @@
>>>>>  #include <linux/cleanup.h>
>>>>>  #include <linux/cpu.h>
>>>>>  #include <asm/cpufeature.h>
>>>>> +#include <asm/cpuid/api.h>
>>>>>  #include <asm/fpu/xcr.h>
>>>>>  #include <linux/misc_cgroup.h>
>>>>>  #include <linux/mmu_context.h>
>>>>> @@ -163,12 +164,23 @@ static void td_init_cpuid_entry2(struct kvm_cpuid_entry2 *entry, unsigned char i
>>>>>  
>>>>>  	entry->function = (u32)td_conf->cpuid_config_leaves[idx];
>>>>>  	entry->index = td_conf->cpuid_config_leaves[idx] >> 32;
>>>>> +	entry->flags = 0;
>>>>>  	entry->eax = (u32)td_conf->cpuid_config_values[idx][0];
>>>>>  	entry->ebx = td_conf->cpuid_config_values[idx][0] >> 32;
>>>>>  	entry->ecx = (u32)td_conf->cpuid_config_values[idx][1];
>>>>>  	entry->edx = td_conf->cpuid_config_values[idx][1] >> 32;
>>>>>  
>>>>> -	if (entry->index == KVM_TDX_CPUID_NO_SUBLEAF)
>>>>> +	WARN_ON_ONCE(cpuid_function_is_indexed(entry->function) !=
>>>>> +		     (entry->index != KVM_TDX_CPUID_NO_SUBLEAF));
>>>>
>>>> I think the WARN_ON_ONCE() is very likely to be triggered in the future when
>>>> people run old kernel with new TDX modules.
>>>
>>> Then upstream patches to make that not happen.  Intel insists on treating the TDX
>>> Module like hardware.  So, treat new TDX Modules like new hardware.  Upstream
>>> support for the new "hardware" before it ships, cc'd to stable@xxxxxxxxxxxxxxx
>>> if necessary.
>>>
>>> Because IMO, the WARN is doing exactly what it's intended to do: alerting the
>>> admin that they are running a potentially dangerous setup.
>>
>> For this specific case, does it mean every later patch to add a new leaf in
>> cpuid_function_is_indexed() needs to be backported to stable?
> 
> If you want to ship a new TDX Module that enumerates features in those leaves and
> works as-is on older kernels, yes.  Again, this isn't really any different than
> enabling new hardware.  E.g. a kernel from 2024 generally doesn't work flawlessly
> on a CPU being released in 2026.

OK. Fair enough.