NetBSD Problem Report #54847

From www@netbsd.org  Thu Jan  9 15:43:27 2020
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id A2C237A13E
	for <gnats-bugs@gnats.NetBSD.org>; Thu,  9 Jan 2020 15:43:27 +0000 (UTC)
Message-Id: <20200109154325.83AD27A1C7@mollari.NetBSD.org>
Date: Thu,  9 Jan 2020 15:43:25 +0000 (UTC)
From: nevilad@yahoo.com
Reply-To: nevilad@yahoo.com
To: gnats-bugs@NetBSD.org
Subject: xsetbv value has uint16_t type instead of uint64_t
X-Send-Pr-Version: www-1.0

>Number:         54847
>Category:       kern
>Synopsis:       xsetbv value has uint16_t type instead of uint64_t
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    kern-bug-people
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Jan 09 15:45:00 +0000 2020
>Closed-Date:    Thu Jan 09 16:30:56 +0000 2020
>Last-Modified:  Mon Feb 10 19:10:01 +0000 2020
>Originator:     Alexey
>Release:        Found by reading the code
>Organization:
>Environment:
Found by reading the code
>Description:
vmx_exit_xsetbv in nvmm_x86_vmx.c is called when a guest executes xsetbv instruction. It sets the value from EDX:EAX to xcr0 register. The value 
is 64 bit long, but in the handler it has uint16_t type:

   1691 	uint16_t val;

The value is used as if it were 64 bits (that's right):
   1694 
   1695 	val = (cpudata->gprs[NVMM_X64_GPR_RDX] << 32) |
   1696 	    (cpudata->gprs[NVMM_X64_GPR_RAX] & 0xFFFFFFFF);

>How-To-Repeat:
Found by reading the code
>Fix:
Change the declaration of val to
   1691 	uint64_t val;

>Release-Note:

>Audit-Trail:
From: "Maxime Villard" <maxv@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/54847 CVS commit: src/sys/dev/nvmm/x86
Date: Thu, 9 Jan 2020 16:20:12 +0000

 Module Name:	src
 Committed By:	maxv
 Date:		Thu Jan  9 16:20:12 UTC 2020

 Modified Files:
 	src/sys/dev/nvmm/x86: nvmm_x86_vmx.c

 Log Message:
 Mmh, as noted in PR/54847, this should be uint64_t, not uint16_t. Harmless
 because we use only the two lowest bits anyway.

 I believe this could be caught by KUBSAN; time to do another round of
 NVMM+K_SAN testing.


 To generate a diff of this commit:
 cvs rdiff -u -r1.46 -r1.47 src/sys/dev/nvmm/x86/nvmm_x86_vmx.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->closed
State-Changed-By: maxv@NetBSD.org
State-Changed-When: Thu, 09 Jan 2020 16:30:56 +0000
State-Changed-Why:
Why did I do this? I don't know, in SVM the code is correct but not in VMX.
This issue is harmless, but fixed now. Thanks for the report!


From: "Martin Husemann" <martin@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/54847 CVS commit: [netbsd-9] src
Date: Mon, 10 Feb 2020 19:05:05 +0000

 Module Name:	src
 Committed By:	martin
 Date:		Mon Feb 10 19:05:05 UTC 2020

 Modified Files:
 	src/lib/libnvmm [netbsd-9]: libnvmm.3
 	src/share/man/man4 [netbsd-9]: nvmm.4
 	src/sys/dev/nvmm/x86 [netbsd-9]: nvmm_x86_vmx.c

 Log Message:
 Pull up following revision(s) (requested by maxv in ticket #688):

 	share/man/man4/nvmm.4: revision 1.5
 	lib/libnvmm/libnvmm.3: revision 1.26
 	sys/dev/nvmm/x86/nvmm_x86_vmx.c: revision 1.47

 Mmh, as noted in PR/54847, this should be uint64_t, not uint16_t. Harmless
 because we use only the two lowest bits anyway.

 I believe this could be caught by KUBSAN; time to do another round of
 NVMM+K_SAN testing.

 Reference nvmmctl(8).


 To generate a diff of this commit:
 cvs rdiff -u -r1.19.4.1 -r1.19.4.2 src/lib/libnvmm/libnvmm.3
 cvs rdiff -u -r1.4 -r1.4.4.1 src/share/man/man4/nvmm.4
 cvs rdiff -u -r1.36.2.4 -r1.36.2.5 src/sys/dev/nvmm/x86/nvmm_x86_vmx.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

>Unformatted:

Home	PR Database Search