Re: [RFC PATCH 09/27] KVM: x86: Use overlays of KVM CPU capabilities

[Binbin Wu <binbin.wu@linux.intel.com>]

Below are responses to issues reported by sashiko. [1]

[1] https://sashiko.dev/#/patchset/20260417073610.3246316-1-binbin.wu%40linux.intel.com?part=9

>  
>  /*
> @@ -1414,6 +1415,10 @@ static int cpuid_func_emulated(struct kvm *kvm, struct kvm_cpuid_entry2 *entry,
>  	entry->index = 0;
>  	entry->flags = 0;
>  
> +	/* KVM can't do the following emulations for TDX guests. */
> +	if (get_cpuid_overlay(kvm) == CPUID_OL_TDX)
> +		return 0;

Issue:
"
Could this early return cause an out-of-bounds array read and a potential
CPU hang?
When userspace calls KVM_GET_EMULATED_CPUID as a VM scope ioctl on a TDX VM,
kvm_vm_ioctl_get_cpuid() initializes array.nent = 0 and calls
get_cpuid_func() for function 0.
With this change, cpuid_func_emulated() unconditionally returns 0 for TDX
without adding any entries, leaving array.nent at 0.
After do_cpuid_func() returns success, get_cpuid_func() executes:
    limit = array->entries[array->nent - 1].eax;
Since array->nent is 0, does this result in an out-of-bounds read at index
-1? 
This out-of-bounds access might trigger a panic if it faults into an
unmapped page guard. If it instead reads garbage memory into limit, the
subsequent loop:
    for (func = func + 1; func <= limit; ++func)
could spin up to 4 billion times per base function, resulting in a CPU hang.
"

This is a valid concern.
KVM_GET_EMULATED_CPUID assumes that function 0 should always be valid.
For TDX overly, function 0 should return 1 while eax is zeroed out.

diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c
index 2c4e64aa14c4..c2fde2fa1be3 100644
--- a/arch/x86/kvm/cpuid.c
+++ b/arch/x86/kvm/cpuid.c
@@ -1417,7 +1417,7 @@ static int cpuid_func_emulated(struct kvm *kvm, struct kvm_cpuid_entry2 *entry,
 
        /* KVM can't do the following emulations for TDX guests. */
        if (get_cpuid_overlay(kvm) == CPUID_OL_TDX)
-               return 0;
+               return func == 0 ? 1 : 0;
 
        switch (func) {
        case 0:


> +
>  	switch (func) {
>  	case 0:
>  		entry->eax = 7;