Re: [PATCH v15 17/23] KVM: selftests: Set entry point for TDX guest code

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] selftests/tdx: out-of-bounds write via unvalidated vcpu->id in boot parameters
--

commit 5aefdec609eb9d20918c0aee05259719b0c3c0d2
Author: Sagi Shahar <sagis@google.com>

KVM: selftests: Set entry point for TDX guest code

This commit introduces a mechanism to set the guest entry point for TDX VMs, as
the rip register is inaccessible. It accomplishes this by writing the guest
code address to a predefined location in the guest memory, which is then loaded
into rip during the TDX boot process.

> diff --git a/tools/testing/selftests/kvm/lib/x86/tdx/tdx_util.c b/tools/testing/selftests/kvm/lib/x86/tdx/tdx_util.c
> index 270a4ee1b7ebc..5f10a7c1455d8 100644
> --- a/tools/testing/selftests/kvm/lib/x86/tdx/tdx_util.c
> +++ b/tools/testing/selftests/kvm/lib/x86/tdx/tdx_util.c
> @@ -102,6 +102,16 @@ void tdx_vcpu_load_boot_parameters(struct kvm_vm *vm, struct kvm_vcpu *vcpu)
>  		    "ESP GVA must be within 32-bit address space for 32-bit boot code");
>  }
>  
> +void tdx_vcpu_set_entry_point(struct kvm_vcpu *vcpu, void *guest_code)
> +{
> +	struct td_boot_parameters *params =
> +		addr_gpa2hva(vcpu->vm, TD_BOOT_PARAMETERS_GPA);
> +	struct td_per_vcpu_parameters *vcpu_params =
> +		&params->per_vcpu[vcpu->id];

[Severity: Medium]
Does this out-of-bounds array access risk memory corruption?

If a test creates a TDX VM with a sparse or high vcpu->id (which is common for
topology testing), could this index into params->per_vcpu exceed the memory
allocated by tdx_vm_setup_boot_parameters_region()?

For context, tdx_vm_setup_boot_parameters_region() allocates memory strictly
bounded by nr_runnable_vcpus rather than KVM_MAX_VCPUS:

tools/testing/selftests/kvm/lib/x86/tdx/tdx_util.c:tdx_vm_setup_boot_parameters_region() {
    ...
	size_t boot_params_size = sizeof(struct td_boot_parameters) +
		nr_runnable_vcpus * sizeof(struct td_per_vcpu_parameters);
    ...
}

> +
> +	vcpu_params->guest_code = (u64)guest_code;
> +}
> +

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261001-tdx-selftests-v15-0-7c62a5d8a992@google.com?part=17