Re: [PATCH] KVM: x86: TDX: Use validated CPUID entry count for TD init

[Binbin Wu]

On 7/9/2026 9:41 PM, Sean Christopherson wrote:
> On Thu, Jul 09, 2026, Binbin Wu wrote:
>> On 7/9/2026 12:20 AM, Edgecombe, Rick P wrote:
>>> On Wed, 2026-07-08 at 17:04 +0800, Binbin Wu wrote:
>>>>> Maybe it would be better to check for a mismatch and return -EINVAL?
>>>>>
>>>>>  	if (init_vm->cpuid.nent != nr_user_entries) {
>>>>>  		ret = -EINVAL;
>>>>>  		goto out;
>>>>>  	}
>>>>>
>>>>> That would make the mismatch explicit instead of silently accepting an
>>>>> inconsistent userspace snapshot.
>>>>
>>>> I chose to use the snapshot value to follow KVM_SET_CPUID2's style.
>>>> KVM_SET_CPUID2 kind of uses the snapshot value of entry count.
>>>>
>>>> But returning a error code is OK for me.
>>>> Let's wait and see what others prefer.
>>>
>>> It does seem safer to reject input than have some implicit behavior.
>>
>> Yea, had a second thought.
>> If there is a mismatch, the userspace is probably malicious.
>> It's safer to reject the request when the userspace is suspicious.
>>
>> Will send v2 to reject the request for the case.
> 
> Rather than add a separate if-statement, I saw lump it into the existing sanity
> check on the cpuid field:
> 
> diff --git a/arch/x86/kvm/vmx/tdx.c b/arch/x86/kvm/vmx/tdx.c
> index 6ff1469e91cc..10b4db17fbd5 100644
> --- a/arch/x86/kvm/vmx/tdx.c
> +++ b/arch/x86/kvm/vmx/tdx.c
> @@ -2797,7 +2797,7 @@ static int tdx_td_init(struct kvm *kvm, struct kvm_tdx_cmd *cmd)
>                 goto out;
>         }
>  
> -       if (init_vm->cpuid.padding) {
> +       if (init_vm->cpuid.padding || init_vm->cpuid.nent != nr_user_entries) {
>                 ret = -EINVAL;
>                 goto out;
>         }
Yeah, thanks for the suggestion.