From patchwork Tue Oct 25 12:47:28 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Maxim Levitsky X-Patchwork-Id: 10763 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp986160wru; Tue, 25 Oct 2022 05:52:15 -0700 (PDT) X-Google-Smtp-Source: AMsMyM7ZMN6QjzKYOaKifA1QQugOlw5EROHTWVfOHXyanhdtrmKiMCAevfif5zx41owDTM7twvMX X-Received: by 2002:aa7:9292:0:b0:56b:c4d3:a723 with SMTP id j18-20020aa79292000000b0056bc4d3a723mr11348872pfa.57.1666702335556; Tue, 25 Oct 2022 05:52:15 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1666702335; cv=none; d=google.com; s=arc-20160816; b=fM8Zlq47hEKU3B817T//+U8z77WHsdPzjkiGXv9kXsuPKBhGZzNZZMh+Vfl5pJAXXE O3D29sCNYVwwow/RdCTdkWLC6cGTXlMYLpN1X3kAJHXyPHfqeJT0D0CieQPnBU93Uy69 aM7SESXu1akOsy0BX9TA7YymUrHBoYZZfQ8cZrA9AcLMqi3TGlyghRJ9iuJYKtJ3pKXZ a4OM9Ad2ZsyknMaH0/KNL5lCfBB626PzyjtLAW75FFlqY9FlaNf5uj5ryVyhsZUol1/0 H+3eYXwuHOe58zETqol3f8lZJ0MwPHV7KQp1n3PtlydvNVKEDqT6gvD4ES1tF8OhNpJA VcJg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=Hjv4lWsvg+hFAXBQVxvDxYwhYVqBj8cP/nEGapoZ4V4=; b=k8IKS0LI7RUKlqgpNP9l06NyzAAZ1K7UngT7F2S2IXb+8DCDKrUlleZDnmh+4Mz6cy MN+ZXrTIN0IH15q1BuR264IWx8vKy8SY6GBGWu1tNosYqgYcZhdFxW9cXxShrcbDt4O7 Ign68smhjrnIFay/n/fcAbK4Cm83J6eJRDzDaENn/gjRxX5gVLjgloG8xZrgn7Z2hANv CrWRGDeCSD8xERWLHW9/C8PjAqJyb+YbbZIyoOjES414uSVqi6t4/NPzILBoqB8UTXDV AR+pUdFYmoyor/YELpOmZOA2XmSMU6a6On0ACGODvhi5WYTOgweypoIQz/5eMddUjZSw o+9w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=I1xODz7M; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id y2-20020a17090322c200b00172cb948c68si2982438plg.227.2022.10.25.05.52.01; Tue, 25 Oct 2022 05:52:15 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=I1xODz7M; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232429AbiJYMvo (ORCPT + 99 others); Tue, 25 Oct 2022 08:51:44 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33420 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232514AbiJYMvG (ORCPT ); Tue, 25 Oct 2022 08:51:06 -0400 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5C92B19B64C for ; Tue, 25 Oct 2022 05:48:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1666702114; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Hjv4lWsvg+hFAXBQVxvDxYwhYVqBj8cP/nEGapoZ4V4=; b=I1xODz7MMqUBWlDGNUd8M9JHvJB1x59gUjTqsyFAx3DhjmLmJ1GCCY9V3PF3Eh+NmzlFYj 9BahYjwCh3GD1V5bXk2lpVL4Iy5G7H1Z96SdOomejslqNmnkjpymjVleBkxLsdekVQHsgU 3BG9QH+yxghazTV0ErK5JV37RGo4ick= Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-324-aTUiDCU9MBmHNJh1D0eb3A-1; Tue, 25 Oct 2022 08:48:29 -0400 X-MC-Unique: aTUiDCU9MBmHNJh1D0eb3A-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.rdu2.redhat.com [10.11.54.2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 51CDE101246E; Tue, 25 Oct 2022 12:48:28 +0000 (UTC) Received: from amdlaptop.tlv.redhat.com (dhcp-4-238.tlv.redhat.com [10.35.4.238]) by smtp.corp.redhat.com (Postfix) with ESMTP id F274F40C6E13; Tue, 25 Oct 2022 12:48:24 +0000 (UTC) From: Maxim Levitsky To: kvm@vger.kernel.org Cc: Thomas Gleixner , Yang Zhong , x86@kernel.org, Jim Mattson , Vitaly Kuznetsov , Paolo Bonzini , Sean Christopherson , Wanpeng Li , Shuah Khan , Guang Zeng , Joerg Roedel , Maxim Levitsky , linux-kernel@vger.kernel.org, Dave Hansen , Ingo Molnar , linux-kselftest@vger.kernel.org, Kees Cook , "H. Peter Anvin" , Wei Wang , Borislav Petkov Subject: [PATCH RESEND v4 10/23] KVM: x86: emulator: em_sysexit should update ctxt->mode Date: Tue, 25 Oct 2022 15:47:28 +0300 Message-Id: <20221025124741.228045-11-mlevitsk@redhat.com> In-Reply-To: <20221025124741.228045-1-mlevitsk@redhat.com> References: <20221025124741.228045-1-mlevitsk@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.2 X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=unavailable autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1747664068212699263?= X-GMAIL-MSGID: =?utf-8?q?1747664068212699263?= SYSEXIT is one of the instructions that can change the processor mode, thus ctxt->mode should be updated after it. Note that this is likely a benign bug, because the only problematic mode change is from 32 bit to 64 bit which can lead to truncation of RIP, and it is not possible to do with sysexit, since sysexit running in 32 bit mode will be limited to 32 bit version. Signed-off-by: Maxim Levitsky --- arch/x86/kvm/emulate.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c index 671f7e5871ff70..e23c984d6aae09 100644 --- a/arch/x86/kvm/emulate.c +++ b/arch/x86/kvm/emulate.c @@ -2525,6 +2525,7 @@ static int em_sysexit(struct x86_emulate_ctxt *ctxt) ops->set_segment(ctxt, ss_sel, &ss, 0, VCPU_SREG_SS); ctxt->_eip = rdx; + ctxt->mode = usermode; *reg_write(ctxt, VCPU_REGS_RSP) = rcx; return X86EMUL_CONTINUE;