When handling an exception in usermode.c the exception handler #GPs when
executing 'iret' to return from the exception handler. This happens
because the stack segment selector does not have the same privilege
level as the return code segment selector. Set the stack segment
selector to match the code segment selector's privilege level to fix the
issue.
This problem has been disguised in kvm-unit-tests because a #GP
exception handler has been registered with run_in_user() for the tests
that are currently using this feature. With a #GP exception handler
registered, the first exception will be processed then #GP on the
return. Then, because the exception handlers run at CPL0, SS:RSP for
CPL0 will be pushed onto the stack matching KERNEL_CS, which is set in
ex_regs.cs in the exception handler.
This is only a problem in 64-bit mode because 64-bit mode
unconditionally pops SS:RSP (SDM vol 3, 6.14.3 "IRET in IA-32e Mode").
In 32-bit mode SS:RSP is not popped because there is no privilege level
change when returning from the #GP.
Signed-off-by: Aaron Lewis <aaronlewis@xxxxxxxxxx>
---
lib/x86/desc.h | 4 ++++
lib/x86/usermode.c | 3 +++
2 files changed, 7 insertions(+)
diff --git a/lib/x86/desc.h b/lib/x86/desc.h
index b65539e..9b81da0 100644
--- a/lib/x86/desc.h
+++ b/lib/x86/desc.h
@@ -18,6 +18,10 @@ struct ex_regs {
unsigned long rip;
unsigned long cs;
unsigned long rflags;
+#ifdef __x86_64__
+ unsigned long rsp;
+ unsigned long ss;
+#endif
};
typedef void (*handler)(struct ex_regs *regs);
diff --git a/lib/x86/usermode.c b/lib/x86/usermode.c
index 2e77831..57a017d 100644
--- a/lib/x86/usermode.c
+++ b/lib/x86/usermode.c
@@ -26,6 +26,9 @@ static void restore_exec_to_jmpbuf_exception_handler(struct ex_regs *regs)
/* longjmp must happen after iret, so do not do it now. */
regs->rip = (unsigned long)&restore_exec_to_jmpbuf;
regs->cs = KERNEL_CS;
+#ifdef __x86_64__
+ regs->ss = KERNEL_DS;
+#endif
}
uint64_t run_in_user(usermode_func func, unsigned int fault_vector,
--
2.34.1.173.g76aa8bc2d0-goog
