Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752886AbdIRIl2 (ORCPT ); Mon, 18 Sep 2017 04:41:28 -0400 Received: from mx1.redhat.com ([209.132.183.28]:33888 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752194AbdIRIl0 (ORCPT ); Mon, 18 Sep 2017 04:41:26 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 2BAF68553F Authentication-Results: ext-mx04.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx04.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=pbonzini@redhat.com Subject: Re: [PATCH v3 2/5] KVM: MMU: check guest CR3 reserved bits based on its physical address width. To: Yu Zhang , Jim Mattson Cc: kvm list , LKML , =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , Thomas Gleixner , Ingo Molnar , "H . Peter Anvin" , xiaoguangrong@tencent.com, Joerg Roedel References: <1503577676-12345-1-git-send-email-yu.c.zhang@linux.intel.com> <1503577676-12345-3-git-send-email-yu.c.zhang@linux.intel.com> From: Paolo Bonzini Message-ID: <6b811eb0-1204-08b1-61c2-0030fa450ad4@redhat.com> Date: Mon, 18 Sep 2017 10:41:21 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.2.1 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.28]); Mon, 18 Sep 2017 08:41:26 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1305 Lines: 39 On 18/09/2017 10:15, Yu Zhang wrote: >> >> static bool emulator_get_cpuid(struct x86_emulate_ctxt *ctxt, >> u32 *eax, u32 *ebx, u32 *ecx, u32 *edx, bool >> check_limit) >> { >> return kvm_cpuid(emul_to_vcpu(ctxt), eax, ebx, ecx, edx, >> check_limit); >> } >> >> And: >> >> bool kvm_cpuid(struct kvm_vcpu *vcpu, u32 *eax, u32 *ebx, >> u32 *ecx, u32 *edx, bool check_limit) >> { >> u32 function = *eax, index = *ecx; >> struct kvm_cpuid_entry2 *best; >> bool entry_found = true; >> ... >> >> Doesn't this immediately try to dereference a NULL pointer? How much >> testing have you done of this code? > > Thanks Jim. > I have tested this code in a simulator to successfully boot a VM in > shadow mode. Seems this code is not covered(but I am now still > perplexed why this is not covered). Any possibility that the > check_cr_write() is not triggered when emulating the cr operations? CR moves usually don't go through the emulator (the main exception is emulation of invalid guest state when the processor doesn't support unrestricted_guest=1, but even that is unlikely to happen with EFER.LMA=1). This explains why you didn't see the failure. > Anyway, this should be a bug and thanks for pointing this out, and > I'll send out the fix later. Thanks, Paolo