Re: [PATCH v6 4/4] KVM: TDX: Validate userspace CPUID input for KVM_TDX_INIT_VM

[Nikolay Borisov]

On 28.10.26 г. 10:16 ч., Binbin Wu wrote:
> Validate the CPUID configuration provided by userspace through
> KVM_TDX_INIT_VM against KVM's TDX allowlist, and drop the hardcoded
> denylist-based check.
>
> The TDX module lets the VMM directly configure certain CPUID bits for a TD
> at initialization time, but KVM must strictly govern which of those bits
> userspace can set, otherwise a feature that clobbers host state could be
> enabled behind KVM's back.  The existing denylist rejects only TSX and
> WAITPKG, and thus would accept any bit that a future TDX module makes
> configurable, even if KVM knows nothing about the associated feature.
>
> Rewrite tdx_is_unsupported_cpuid_entry() to reject KVM_TDX_INIT_VM if
> userspace sets any bit outside of the mask returned by
> tdx_get_cpuid_cfg_mask(), i.e. the same mask used to filter
> KVM_TDX_CAPABILITIES.  Don't bother intersecting the userspace input with
> the bits that the TDX module reports as directly configurable, as the TDX
> module itself rejects any bit outside that set.
>
> Ignore the index for non-indexed functions when walking reverse_cpuid[],
> as userspace isn't required to zero it.
>
> Note, this is an ABI change, as KVM_TDX_INIT_VM now rejects some input
> that was previously accepted.  However, the semantics of KVM_TDX_INIT_VM
> are unchanged: KVM already rejected unsupported CPUID bits, albeit via a
> denylist, and userspace has always been required to consult
> KVM_TDX_CAPABILITIES and set only the bits reported as configurable.
>
> The change isn't expected to break userspace or guests:
>   - The newly rejected bits are no longer reported as configurable by
>     KVM_TDX_CAPABILITIES, so userspace that honors KVM_TDX_CAPABILITIES
>     won't set them.
>   - CORE_CAPABILITIES, which older TDX module specs defined as fixed-1, is
>     still allowed.
>   - The newly rejected features are either obsolete or unsupported by KVM,
>     and in the latter case, a guest relying on them would already have run
>     into problems.
>
> Signed-off-by: Binbin Wu <binbin.wu@xxxxxxxxxxxxxxx>
> Reviewed-by: Tony Lindgren <tony.lindgren@xxxxxxxxxxxxxxx>
> Reviewed-by: Rick Edgecombe <rick.p.edgecombe@xxxxxxxxx>
> Reviewed-by: Chao Gao <chao.gao@xxxxxxxxx>
> Reviewed-by: Xiaoyao Li <xiaoyao.li@xxxxxxxxx>

Reviewed-by: Nikolay Borisov <nik.borisov@xxxxxxxx>