From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.210.197 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1792702905; b=Jpa9QxJPfBVuVItZlUD7Qmgbt4vwwOhW4pQNj8RvAyK7C2Rg3cnC+DZNBNmFe1L4qI3j nd0rFSjhkqQutNAsVszN/e9SkyORB7trFcRnYcVLv4a9ULyovUw5aVGs21g6K+uXrf0NT TBDO/rBXQZqJI9C6PNDQD6/DBIJ8jH3wE8TcBm8HPIbX2nBpkzwXCxXeOBip4GblyQ23w bDoy6hF6QXfHWT9vR04yFSFn8aVkwVqSHKYwy3PLzd/6NEeASymuSgWRe6m749/eKJSk2 BTT8aHlg0idz+MMbFxfKgAKVp5JI8EJmS1xiuGK4PpffHBspcQlPMwtKwqERFkFt2iw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1792702905; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Received:Reply-To:Date: In-Reply-To:Mime-Version:References:X-Mailer:Message-ID:Subject:From: To:Cc:Content-Type; bh=XC+w9Viu2qvKH/AbWhn/9WyIQrAbEorvKdSI99G+qIU=; b=KAx5crsiTPuq6DRsy8YAdj2ESG5Qx8vS+iSeo5pdLB6OKzO8UJuR2z0zYWaPHUroMoHC DyBlaD5HGITdhjGxRF8zI5D+Pwr8RWQ3+xr+euuA9neNSPVxvD0GjV83xxQ030AyN1mLr pnU5/37UHv+mz0kakf3K6T3FgEJ38QXEpHR7hxtOoymkjte5aW0UB3GS1XdDq2xyLQsG8 BsfxTZdS8c5PHLNKgISIJ3GGJb/wdJNh1yL4lADho7kXy3fSiD0Cfe5qwY4XIoYvE9/wS M2gCpGk9f6ESGUDCaTTTl07ism4rQQO1FqNde1nrMskDRBjKY37IPkpACD+BJSAnMcA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=google.com; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com; dkim=pass header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20251104 header.b=OAGQh1ep; arc=none smtp.remote-ip=209.85.210.197 Received: from mail-pf1-f197.google.com (mail-pf1-f197.google.com [209.85.210.197]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BBA9B606A31F for ; Thu, 22 Oct 2026 21:01:44 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org BBA9B606A31F Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--seanjc.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20251104 header.b=OAGQh1ep Received: by mail-pf1-f197.google.com with SMTP id d2e1a72fcca58-8a08e315b5cso103711b3a.2 for ; Thu, 22 Oct 2026 14:01:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1792702904; x=1793307704; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:reply-to:from:to:cc:subject:date:message-id :reply-to:content-type; bh=XC+w9Viu2qvKH/AbWhn/9WyIQrAbEorvKdSI99G+qIU=; b=OAGQh1epfJHTzzkKC00Rc02e3G6EADCMR1FYg+BFxSqKf7JqEO72l8z/xtsW2NRzE7 aIMn4ykNCXab6KyYeT9x+YM0b8B38SpGzPk40vfJAOWh2biVnNMwEVYIZYJW1UfnsdLw ophwiDmt+QVDlVsFElirdkHjMPIXT17TbpP1rVMvDyVkD1ZLutR9YvjOUc7/T5ArKrXH 54vt5JFStsOEfUGnH1LGwfFy+b5PjdBCQZaGKVlVckuiSLZ/V9PRnWTtxZeU9dxZO4zU G1yGgWWmeZrySWveyYqZ62FczeIx/zAe7ZiilLp0JEIdF1Et4fsaKR9xg19g2XZcVyda b3oQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792702904; x=1793307704; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:reply-to:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to:content-type; bh=XC+w9Viu2qvKH/AbWhn/9WyIQrAbEorvKdSI99G+qIU=; b=LijdVd7e1K2BZtjG7J43xf5PPRLAwQNTvXC2ffWF+sYK/iEMfv2+kqGW0wsGY3ssRa AS0/Acueup2RlaYnsCgKlyY4y+l1JWzTV4u09awi6i67dKaqUIcZMybct0a/oboS13h4 2FlGKh6teg6zKgnTuMUBtj2NpFOB0EA7GMhoEW2ZJyOGub+3h5m/cvrd3HzExDU+afPc brFwYacd1pB3YMd/pCLHfYLIynJ1GSwfPb1qOZ8HeGU2FNPVJBWkKa/P/EqQVD4UDic3 x5pl3Xwmq+Bjrr6E5pL3X3WLUHxH85LugyMJT4/R4cBz4kCeyIPvsdPC+f+7exb3ya4J JLFg== X-Forwarded-Encrypted: i=1; AKwUvBzNMlB53/wBFbc5Tq188r/cQQavcN1HEG9q9uDVWds6WzHCwz0uOGEHbFKNgrsPniqPajRgIyvOVd65mJc=@vger.kernel.org X-Gm-Message-State: AFq9FYJdRLWOOy61BeMvAfgqV3LL8CZ8uWhsE+PoOdhUPkfzIfJg95jn uC6mRTGGxH0JM6KlzzHC9Fwy6FK7bM0F1YfdZrL2MSWKax1cbaGW+df1IOcw0h13yPUWNUpQSq1 hquxHlg== X-Received: from pfoa26.prod.google.com ([2002:aa7:865a:0:b0:890:3943:6267]) (user=seanjc job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a00:330b:b0:87d:ee98:606 with SMTP id d2e1a72fcca58-8a2c604340cmr293927b3a.23.1792702903840; Thu, 22 Oct 2026 14:01:43 -0700 (PDT) Reply-To: Sean Christopherson Date: Thu, 22 Oct 2026 14:01:34 -0700 In-Reply-To: <20261022210134.612848-1-seanjc@google.com> X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list Mime-Version: 1.0 References: <20261022210134.612848-1-seanjc@google.com> X-Mailer: git-send-email 2.56.0.257.gf7497c7d27-goog Message-ID: <20261022210134.612848-4-seanjc@google.com> Subject: [PATCH v2 3/3] KVM: TDX: Reject KVM_TDX_INIT_VM if indexed CPUID functions don't match From: Sean Christopherson To: Sean Christopherson , Paolo Bonzini , Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, Kiryl Shutsemau , Rick Edgecombe Cc: "H. Peter Anvin" , kvm@vger.kernel.org, linux-kernel@vger.kernel.org, linux-coco@lists.linux.dev, Binbin Wu , Changyuan Lyu , Sashiko Content-Type: text/plain; charset="UTF-8" Reject KVM_TDX_INIT_VM if userspace doesn't configure the canonical CPUID entries correctly with respect to KVM_CPUID_FLAG_SIGNIFCANT_INDEX to fix a bug where userspace could bypass the TSX and WAITPKG checks by simply not marking a CPUID.0x7 entry as being indexed. This also sets the stage for more in-depth validation of the incoming CPUID configuration. This is obviously an ABI change and diverges from KVM's general approach of "let userspace do what it wants". In practice, no "real" VMM that supports TDX misconfigures a TD's CPUID entries in this way, i.e. the probability of actually breaking userspace is basically nil. And unlike normal VMs, where KVM has full control and thus can deal with bizarre CPUID input without too much fuss, TDX VMs require extra care due to the TDX Module also reacting to the CPUID configuration, i.e. KVM_TDX_INIT_VM needs to be more strict than KVM_SET_CPUID{,2} to avoid creating potentially dangerous-to-the-host setups. Opportunistically rename the helper to make it more obvious that it's checking if the passed in @entry is unsupported, as opposed to returning a set of unsupported entries or something. Fixes: 6d415778f106 ("KVM: TDX: Disable support for TSX and WAITPKG") Reported-by: Sashiko Closes: https://lore.kernel.org/kvm/20260604024927.E22311F00893@smtp.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson --- arch/x86/kvm/vmx/tdx.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c index 37d088f6f7a8..6abf92ffec24 100644 --- a/arch/x86/kvm/vmx/tdx.c +++ b/arch/x86/kvm/vmx/tdx.c @@ -151,8 +151,12 @@ static void tdx_clear_unsupported_cpuid(struct kvm_cpuid_entry2 *entry) clear_waitpkg(entry); } -static bool tdx_unsupported_cpuid(const struct kvm_cpuid_entry2 *entry) +static bool tdx_is_unsupported_cpuid_entry(const struct kvm_cpuid_entry2 *entry) { + if (cpuid_function_is_indexed(entry->function) != + !!(entry->flags & KVM_CPUID_FLAG_SIGNIFCANT_INDEX)) + return true; + return has_tsx(entry) || has_waitpkg(entry); } @@ -2393,7 +2397,7 @@ static int setup_tdparams_cpuids(struct kvm_cpuid2 *cpuid, if (!entry) continue; - if (tdx_unsupported_cpuid(entry)) + if (tdx_is_unsupported_cpuid_entry(entry)) return -EINVAL; copy_cnt++; -- 2.56.0.257.gf7497c7d27-goog