[Qemu-devel] [PATCH 0/5] target-i386: kvm: Increase MSR entry array limits, check for array overrun

[Eduardo Habkost]

We are dangerously close to the array limits in kvm_put_msrs()
and kvm_get_msrs(): with the default mcg_cap configuration, we
can set up to 148 MSRs in kvm_put_msrs(), and if we allow mcg_cap
to be changed, we can write up to 236 MSRs[1].

This series changes the code to allocate a buffer once per VCPU,
increase buffer size to 4096 bytes (that can hold up to 255 MSR
entries), and check array limits before appending new entries.

[1] I have checked the limits by copying and pasting the
    kvm_put_msrs() code to a new file, replacing the "if" lines,
    copying the macro definitions, and adding a helper macro to
    keep track of the kvm_msr_entry_set() calls. The code can be
    seen at:
    https://gist.github.com/ehabkost/08d4177a33b8648a71ef

Eduardo Habkost (5):
  target-i386: kvm: Allocate kvm_msrs struct once per VCPU
  target-i386: kvm: Increase MSR_BUF_SIZE
  target-i386: kvm: Simplify MSR array construction
  target-i386: kvm: Simplify MSR setting functions
  target-i386: kvm: Eliminate kvm_msr_entry_set()

 target-i386/cpu-qom.h |   4 +
 target-i386/kvm.c     | 322 +++++++++++++++++++++++---------------------------
 2 files changed, 149 insertions(+), 177 deletions(-)

-- 
2.1.0