Re: [PATCH v5 1/5] KVM: TDX: Check unsupported CPUID bits against the TDX module's subleaf

[Sean Christopherson]

 On Fri, Oct 16, 2026, Binbin Wu wrote:
> Don't reject the mismatch outright, as the ABI allows userspace to provide
> an arbitrary index when KVM_CPUID_FLAG_SIGNIFCANT_INDEX is cleared.  It's
> userspace's responsibility to provide the intended entries; KVM only needs
> to ensure that the values it validates are the values it applies.
> 
> Fixes: 6d415778f106 ("KVM: TDX: Disable support for TSX and WAITPKG")
> Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
> Closes: https://lore.kernel.org/kvm/20260604024927.E22311F00893@xxxxxxxxxxxxxxx
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Binbin Wu <binbin.wu@xxxxxxxxxxxxxxx>
> ---
> v5:
> - Split out from "KVM: TDX: Validate userspace CPUID input for
>   KVM_TDX_INIT_VM" as a standalone fix.  Sashiko reported the issue
>   against the TDX CPUID validation patch, but it also applies to the
>   existing code, so split it out to allow backporting to stable
>   independently of the rest of the series.
> - Check the userspace values against the subleaf reported by the TDX
>   module instead of rejecting the request when there is a mismatch.
> 
>   A simpler alternative would be to require a zero index when
>   KVM_CPUID_FLAG_SIGNIFCANT_INDEX is cleared, but that would be an ABI
>   change.

The even simpler change is to reject the incoming CPUID if userspace doesn't set
KVM_CPUID_FLAG_SIGNIFCANT_INDEX as expected.  Yes, that's an ABI change.  No, we
don't care.  The rule isn't "never change the ABI", it's "don't break userspace",
and there's basically zero chance a TDX guest can function properly if userspace
doesn't set KVM_CPUID_FLAG_SIGNIFCANT_INDEX as appropriate.

diff --git arch/x86/kvm/vmx/tdx.c arch/x86/kvm/vmx/tdx.c
index 75a86d64892a..7e0d81066420 100644
--- arch/x86/kvm/vmx/tdx.c
+++ arch/x86/kvm/vmx/tdx.c
@@ -151,8 +151,12 @@ static void tdx_clear_unsupported_cpuid(struct kvm_cpuid_entry2 *entry)
                clear_waitpkg(entry);
 }
 
-static bool tdx_unsupported_cpuid(const struct kvm_cpuid_entry2 *entry)
+static bool tdx_is_unsupported_cpuid_entry(const struct kvm_cpuid_entry2 *entry)
 {
+       if (cpuid_function_is_indexed(entry->function) !=
+           !!(entry->flags & KVM_CPUID_FLAG_SIGNIFCANT_INDEX))
+               return true;
+
        return has_tsx(entry) || has_waitpkg(entry);
 }
 
@@ -2386,7 +2390,7 @@ static int setup_tdparams_cpuids(struct kvm_cpuid2 *cpuid,
                if (!entry)
                        continue;
 
-               if (tdx_unsupported_cpuid(entry))
+               if (tdx_is_unsupported_cpuid_entry(entry))
                        return -EINVAL;
 
                copy_cnt++;

Can you test the attached patches?  If they boot TDX with QEMU, I'll go ahead
and post.