Commit 3b332bde78 for qemu.org

commit 3b332bde78d69edca662a18037ab095ae02470cf
Author: Cédric Le Goater <clg@redhat.com>
Date:   Wed Jul 22 14:04:37 2026 +0200

    target/i386/kvm: Fix UBSAN shift error in MTRR mask computation

    On AMD EPYC processors, raw CPUID leaf 0x80000008 reports 52 physical
    address bits. When a machine type such as microvm forces
    host_phys_bits=true, the CPU ends up with phys_bits=52, causing
    MAKE_64BIT_MASK(52, 0) to shift by 64 - which is undefined behavior.

    Fix by only computing the mask when phys_bits < 52.

    Fixes: fcc35e7ccaed ("target-i386: Fill high bits of mtrr mask")
    Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com>
    Link: https://lore.kernel.org/qemu-devel/20260722120437.697986-1-clg@redhat.com
    Signed-off-by: Cédric Le Goater <clg@redhat.com>

diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index a72b6e6b74..da922f72d7 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -5064,8 +5064,7 @@ static int kvm_get_msrs(X86CPU *cpu)
      * we're migrating to.
      */

-    if (cpu->fill_mtrr_mask) {
-        assert(cpu->phys_bits <= 52);
+    if (cpu->fill_mtrr_mask && cpu->phys_bits < 52) {
         mtrr_top_bits = MAKE_64BIT_MASK(cpu->phys_bits, 52 - cpu->phys_bits);
     } else {
         mtrr_top_bits = 0;