[PATCH v5 1/5] KVM: TDX: Check unsupported CPUID bits against the TDX module's subleaf

[Binbin Wu <binbin.wu@linux.intel.com>]

Check for unsupported CPUID bits using the subleaf reported by the TDX
module instead of the index of the matching userspace entry, so that KVM
validates the same subleaf that the values are copied into.

setup_tdparams_cpuids() walks the directly configurable CPUID leaves
reported by the TDX module and looks up the corresponding userspace entry
via kvm_find_cpuid_entry2().  If userspace doesn't set
KVM_CPUID_FLAG_SIGNIFCANT_INDEX on an entry, kvm_find_cpuid_entry2()
ignores the entry's index, i.e. the matched entry's index can differ from
the TDX module's subleaf.  tdx_unsupported_cpuid() checks HLE, RTM and
WAITPKG based on the userspace entry's index, while the register values
are applied to the TDX module's subleaf, which allows userspace to bypass
the check.

E.g. if userspace provides a CPUID.0x7 entry with index 3, WAITPKG set,
and KVM_CPUID_FLAG_SIGNIFCANT_INDEX cleared, the entry is matched for the
TDX module's subleaf 0.  The check sees index 3 and passes, while ECX is
copied into td_params for CPUID.0x7.0, where WAITPKG is directly
configurable.  The TDX module accepts the value, and the TD ends up with
WAITPKG enumerated despite KVM not supporting it.  The same applies to RTM
and HLE.

Don't reject the mismatch outright, as the ABI allows userspace to provide
an arbitrary index when KVM_CPUID_FLAG_SIGNIFCANT_INDEX is cleared.  It's
userspace's responsibility to provide the intended entries; KVM only needs
to ensure that the values it validates are the values it applies.

Fixes: 6d415778f106 ("KVM: TDX: Disable support for TSX and WAITPKG")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/kvm/20260604024927.E22311F00893@smtp.kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Binbin Wu <binbin.wu@linux.intel.com>
---
v5:
- Split out from "KVM: TDX: Validate userspace CPUID input for
  KVM_TDX_INIT_VM" as a standalone fix.  Sashiko reported the issue
  against the TDX CPUID validation patch, but it also applies to the
  existing code, so split it out to allow backporting to stable
  independently of the rest of the series.
- Check the userspace values against the subleaf reported by the TDX
  module instead of rejecting the request when there is a mismatch.

  A simpler alternative would be to require a zero index when
  KVM_CPUID_FLAG_SIGNIFCANT_INDEX is cleared, but that would be an ABI
  change.
---
 arch/x86/kvm/vmx/tdx.c | 24 +++++++++++++++---------
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
index ee1d412b0ee6..ae7135784878 100644
--- a/arch/x86/kvm/vmx/tdx.c
+++ b/arch/x86/kvm/vmx/tdx.c
@@ -119,9 +119,9 @@ static u32 tdx_set_guest_phys_addr_bits(const u32 eax, int addr_bits)
 
 #define TDX_FEATURE_TSX (__feature_bit(X86_FEATURE_HLE) | __feature_bit(X86_FEATURE_RTM))
 
-static bool has_tsx(const struct kvm_cpuid_entry2 *entry)
+static bool has_tsx(const struct kvm_cpuid_entry2 *entry, u32 index)
 {
-	return entry->function == 7 && entry->index == 0 &&
+	return entry->function == 7 && index == 0 &&
 	       (entry->ebx & TDX_FEATURE_TSX);
 }
 
@@ -130,9 +130,9 @@ static void clear_tsx(struct kvm_cpuid_entry2 *entry)
 	entry->ebx &= ~TDX_FEATURE_TSX;
 }
 
-static bool has_waitpkg(const struct kvm_cpuid_entry2 *entry)
+static bool has_waitpkg(const struct kvm_cpuid_entry2 *entry, u32 index)
 {
-	return entry->function == 7 && entry->index == 0 &&
+	return entry->function == 7 && index == 0 &&
 	       (entry->ecx & __feature_bit(X86_FEATURE_WAITPKG));
 }
 
@@ -143,16 +143,16 @@ static void clear_waitpkg(struct kvm_cpuid_entry2 *entry)
 
 static void tdx_clear_unsupported_cpuid(struct kvm_cpuid_entry2 *entry)
 {
-	if (has_tsx(entry))
+	if (has_tsx(entry, entry->index))
 		clear_tsx(entry);
 
-	if (has_waitpkg(entry))
+	if (has_waitpkg(entry, entry->index))
 		clear_waitpkg(entry);
 }
 
-static bool tdx_unsupported_cpuid(const struct kvm_cpuid_entry2 *entry)
+static bool tdx_unsupported_cpuid(const struct kvm_cpuid_entry2 *entry, u32 index)
 {
-	return has_tsx(entry) || has_waitpkg(entry);
+	return has_tsx(entry, index) || has_waitpkg(entry, index);
 }
 
 #define KVM_TDX_CPUID_NO_SUBLEAF	((__u32)-1)
@@ -2381,7 +2381,13 @@ static int setup_tdparams_cpuids(struct kvm_cpuid2 *cpuid,
 		if (!entry)
 			continue;
 
-		if (tdx_unsupported_cpuid(entry))
+		/*
+		 * Check the userspace values against the subleaf reported by
+		 * the TDX module, i.e. the subleaf the values are applied to,
+		 * not the index of the userspace entry, which may differ if
+		 * KVM_CPUID_FLAG_SIGNIFCANT_INDEX isn't set.
+		 */
+		if (tdx_unsupported_cpuid(entry, tmp.index))
 			return -EINVAL;
 
 		copy_cnt++;
-- 
2.46.0