• Sean Christopherson's avatar
    KVM: x86: Return -E2BIG when KVM_GET_SUPPORTED_CPUID hits max entries · 68c9a46e
    Sean Christopherson authored
    Fix a long-standing bug that causes KVM to return 0 instead of -E2BIG
    when userspace's array is insufficiently sized.
    
    This technically breaks backwards compatibility, e.g. a userspace with a
    hardcoded cpuid->nent could theoretically be broken as it would see an
    error instead of success if cpuid->nent is less than the number of
    entries required to fully enumerate the host CPU.  But, the lowest known
    cpuid->nent hardcoded by a VMM is 100 (lkvm and selftests), and the
    limit for current processors on Intel and AMD is well under a 100.  E.g.
    Intel's Icelake server with all the bells and whistles tops out at ~60
    entries (variable due to SGX sub-leafs), and AMD's CPUID documentation
    allows for less than 50.  CPUID 0xD sub-leaves on current kernels are
    capped by the value of KVM_SUPPORTED_XCR0, and therefore so many subleaves
    cannot have appeared on current kernels.
    
    Note, while the Fixes: tag is accurate with respect to the immediate
    bug, it's likely that similar bugs in KVM_GET_SUPPORTED_CPUID existed
    prior to the refactoring, e.g. Qemu contains a workaround for the broken
    KVM_GET_SUPPORTED_CPUID behavior that predates the buggy commit by over
    two years.  The Qemu workaround is also likely the main reason the bug
    has gone unreported for so long.
    
    Qemu hack:
      commit 76ae317f7c16aec6b469604b1764094870a75470
      Author: Mark McLoughlin <markmc@redhat.com>
      Date:   Tue May 19 18:55:21 2009 +0100
    
        kvm: work around supported cpuid ioctl() brokenness
    
        KVM_GET_SUPPORTED_CPUID has been known to fail to return -E2BIG
        when it runs out of entries. Detect this by always trying again
        with a bigger table if the ioctl() fills the table.
    
    Fixes: 831bf664 ("KVM: Refactor and simplify kvm_dev_ioctl_get_supported_cpuid")
    Reviewed-by: default avatarVitaly Kuznetsov <vkuznets@redhat.com>
    Signed-off-by: default avatarSean Christopherson <sean.j.christopherson@intel.com>
    Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
    68c9a46e
cpuid.c 27.7 KB