Re: [PATCH v4 4/4] KVM: TDX: Validate userspace CPUID input for KVM_TDX_INIT_VM

["Edgecombe, Rick P" <rick.p.edgecombe@intel.com>]

On Thu, 2026-09-17 at 15:25 +0800, Binbin Wu wrote:
> Validate the CPUID configuration provided by userspace through
> KVM_TDX_INIT_VM against KVM's TDX allowlist, and drop the hardcoded
> denylist based check.
> 
> The TDX module lets the VMM configure certain CPUID features for a TD at
> initialization time, but KVM must strictly govern which of them userspace
> can actually enable, otherwise a host state clobbering feature could be
> enabled behind KVM's back.  The existing check only rejects TSX and
> WAITPKG, i.e. it is not fail-safe, as any bit that a future TDX module
> makes configurable would be accepted even if KVM has no idea about the
> feature.
> 
> Add tdx_has_unsupported_cpuid_cfg_bit() and reject KVM_TDX_INIT_VM if
> userspace sets any bit outside the mask returned by
> tdx_get_cpuid_cfg_mask().  There is no need to first mask the userspace
> input with the bits the TDX module reports as directly configurable, as
> anything outside that set is rejected by the TDX module itself.
> 
> Also reject CPUID entries whose index differs from the value expected by
> the TDX module, as kvm_find_cpuid_entry2() ignores the index when
> KVM_CPUID_FLAG_SIGNIFCANT_INDEX is cleared, i.e. a mismatching entry could
> otherwise be applied to the wrong subleaf.
> 
> Update the comments for KVM_TDX_INIT_VM in the uapi header and the TDX
> documentation accordingly.

Same comment on this one as patch 3, this removes some previously configurable
features right? And you checked qemu and reasoned on the rest that this won't
break anything. We don't need the full bit by bit detail here, but if someone
bisects this patch it would be good to have some info about what the ABI change
was.