Re: [PATCH v3 4/4] KVM: TDX: Validate userspace CPUID input for KVM_TDX_INIT_VM

[Tony Lindgren]

On Thu, Aug 27, 2026 at 11:18:37AM +0800, Binbin Wu wrote:
> Validate the CPUID configuration provided by userspace through
> KVM_TDX_INIT_VM against KVM's TDX allowlist, and drop the hardcoded
> denylist based check.
> 
> The TDX module lets the VMM configure certain CPUID features for a TD at
> initialization time, but KVM must strictly govern which of them userspace
> can actually enable, otherwise a host state clobbering feature could be
> enabled behind KVM's back.  The existing check only rejects TSX and
> WAITPKG, i.e. it is not fail-safe, as any bit that a future TDX module
> makes configurable would be accepted even if KVM has no idea about the
> feature.
> 
> Add tdx_has_unsupported_cfg_cpuid_bit() and reject KVM_TDX_INIT_VM if
> userspace sets any bit outside the mask returned by
> tdx_get_allowed_cfg_cpuid_mask().  There is no need to first mask the
> userspace input with the bits the TDX module reports as directly
> configurable, as anything outside that set is rejected by the TDX module
> itself.
> 
> Also reject CPUID entries whose index differs from the value expected by
> the TDX module, as kvm_find_cpuid_entry2() ignores the index when
> KVM_CPUID_FLAG_SIGNIFCANT_INDEX is cleared, and so a mismatching entry
> could otherwise be applied to the wrong subleaf.

This nicely cleans up the earlier handling:

Reviewed-by: Tony Lindgren <tony.lindgren@xxxxxxxxxxxxxxx>