Re: [PATCH v2 3/3] KVM: TDX: Reject KVM_TDX_INIT_VM if indexed CPUID functions don't match

[Xiaoyao Li]

On 10/23/2026 11:05 AM, Binbin Wu wrote:
> On 10/23/2026 5:01 AM, Sean Christopherson wrote:
>> Reject KVM_TDX_INIT_VM if userspace doesn't configure the canonical CPUID
>> entries correctly with respect to KVM_CPUID_FLAG_SIGNIFCANT_INDEX to fix a
>> bug where userspace could bypass the TSX and WAITPKG checks by simply not
>> marking a CPUID.0x7 entry as being indexed.  This also sets the stage for
>> more in-depth validation of the incoming CPUID configuration.
>>
>> This is obviously an ABI change and diverges from KVM's general approach of
>> "let userspace do what it wants".  In practice, no "real" VMM that supports
>> TDX misconfigures a TD's CPUID entries in this way, i.e. the probability of
>> actually breaking userspace is basically nil.  And unlike normal VMs, where
>> KVM has full control and thus can deal with bizarre CPUID input without too
>> much fuss, TDX VMs require extra care due to the TDX Module also reacting
>> to the CPUID configuration, i.e. KVM_TDX_INIT_VM needs to be more strict
>> than KVM_SET_CPUID{,2} to avoid creating potentially dangerous-to-the-host
>> setups.
>>
>> Opportunistically rename the helper to make it more obvious that it's
>> checking if the passed in @entry is unsupported, as opposed to returning a
>> set of unsupported entries or something.
>>
>> Fixes: 6d415778f106 ("KVM: TDX: Disable support for TSX and WAITPKG")
>> Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
>> Closes: https://lore.kernel.org/kvm/20260604024927.E22311F00893@xxxxxxxxxxxxxxx
>> Cc: stable@xxxxxxxxxxxxxxx
>> Signed-off-by: Sean Christopherson <seanjc@xxxxxxxxxx>
>> ---
>>  arch/x86/kvm/vmx/tdx.c | 8 ++++++--
>>  1 file changed, 6 insertions(+), 2 deletions(-)
>>
>> diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
>> index 37d088f6f7a8..6abf92ffec24 100644
>> --- a/arch/x86/kvm/vmx/tdx.c
>> +++ b/arch/x86/kvm/vmx/tdx.c
>> @@ -151,8 +151,12 @@ static void tdx_clear_unsupported_cpuid(struct kvm_cpuid_entry2 *entry)
>>  		clear_waitpkg(entry);
>>  }
>>  
>> -static bool tdx_unsupported_cpuid(const struct kvm_cpuid_entry2 *entry)
>> +static bool tdx_is_unsupported_cpuid_entry(const struct kvm_cpuid_entry2 *entry)
>>  {
>> +	if (cpuid_function_is_indexed(entry->function) !=
>> +	    !!(entry->flags & KVM_CPUID_FLAG_SIGNIFCANT_INDEX))
>> +		return true;
> 
> Similar to patch 2, if cpuid_function_is_indexed(entry->function) misses some function,
> the value of cpuid_function_is_indexed(entry->function) is not accurate.
> 
> For current code, it's OK, since all unsupported bits are in leaf 7.
> In the future, with the TDX CPUID validation patch set
> https://lore.kernel.org/all/20261016091422.3182216-6-binbin.wu@xxxxxxxxxxxxxxx/
> It still allow userspace to by pass some check in theory.
some idea.

If we decide to honor TDX module's report over KVM's cpuid_function_is_indexed()
in patch2, then how about something below:

diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
index 6abf92ffec24..1456f4c5c6b3 100644
--- a/arch/x86/kvm/vmx/tdx.c
+++ b/arch/x86/kvm/vmx/tdx.c
@@ -151,10 +151,10 @@ static void tdx_clear_unsupported_cpuid(struct
kvm_cpuid_entry2 *entry)
                clear_waitpkg(entry);
 }

-static bool tdx_is_unsupported_cpuid_entry(const struct kvm_cpuid_entry2 *entry)
+static bool tdx_is_unsupported_cpuid_entry(const struct kvm_cpuid_entry2 *entry,
+                                          bool significant_index)
 {
-       if (cpuid_function_is_indexed(entry->function) !=
-           !!(entry->flags & KVM_CPUID_FLAG_SIGNIFCANT_INDEX))
+       if (significant_index && !(entry->flags & KVM_CPUID_FLAG_SIGNIFCANT_INDEX))
                return true;

        return has_tsx(entry) || has_waitpkg(entry);
@@ -2397,7 +2397,8 @@ static int setup_tdparams_cpuids(struct kvm_cpuid2 *cpuid,
                if (!entry)
                        continue;

-               if (tdx_is_unsupported_cpuid_entry(entry))
+               if (tdx_is_unsupported_cpuid_entry(entry,
+                       tmp->flags |= KVM_CPUID_FLAG_SIGNIFCANT_INDEX))
                        return -EINVAL;

                copy_cnt++;