Messages in this thread | | | Subject | Re: UBSAN: shift-out-of-bounds in kvm_vcpu_after_set_cpuid | From | Paolo Bonzini <> | Date | Wed, 13 Jan 2021 15:20:56 +0100 |
| |
On 12/01/21 17:53, Sean Christopherson wrote: > On Tue, Jan 12, 2021, Paolo Bonzini wrote: >> On 12/01/21 00:01, Sean Christopherson wrote: >>>> Perhaps cpuid_query_maxphyaddr() should just look at the low 5 bits of >>>> CPUID.80000008H:EAX? >> >> The low 6 bits I guess---yes, that would make sense and it would have also >> fixed the bug. > > No, that wouldn't have fixed this specific bug. In this case, the issue was > CPUID.80000008H:AL == 0; masking off bits 7:6 wouldn't have changed anything.
Right.
> And, masking bits 7:6 is architecturally wrong. Both the SDM and APM state that > bits 7:0 contain the number of PA bits.
They cannot be higher than 52, therefore bits 7:6 are (architecturally) always zero. In other words, I interpret "bit 7:0 contain the number of PA bits" as "you need not do an '& 63' yourself", which is basically the opposite of "bit 7:6 might be nonzero". If masking made any difference, it would be outside the spec already.
In fact another possibility to avoid UB is to do "& 63" of both s and e in rsvd_bits. This would also be masking bits 7:6 of the CPUID leaf, just done differently.
Paolo
> KVM could reject guest.MAXPA > host.MAXPA, but arbitrarily dropping bits would > be wrong. >
| |