When handling an exception in usermode.c the exception handler #GPs when
executing IRET to return from the exception handler. This happens
because the stack segment selector does not have the same privilege
level as the return code segment selector. Set the stack segment
selector to match the code segment selector's privilege level to fix the
issue.
This problem has been disguised in kvm-unit-tests because a #GP
exception handler has been registered with run_in_user() for the tests
that are currently using this feature. With a #GP exception handler
registered, the first exception will be processed then #GP on the
IRET. The IRET from the second #GP will then succeed, and the subsequent
lngjmp() will restore RSP to a sane value. But if no #GP handler is
installed, e.g. if a test wants to handle only #ACs, the #GP on the
initial IRET will be fatal.
This is only a problem in 64-bit mode because 64-bit mode
unconditionally pops SS:RSP (SDM vol 3, 6.14.3 "IRET in IA-32e Mode").
In 32-bit mode SS:RSP is not popped because there is no privilege level
change when executing IRET at the end of the #GP handler.
Signed-off-by: Aaron Lewis <aaronlewis@xxxxxxxxxx>
Reviewed-by: Sean Christopherson <seanjc@xxxxxxxxxx>
---
lib/x86/desc.h | 4 ++++
lib/x86/usermode.c | 3 +++
2 files changed, 7 insertions(+)
diff --git a/lib/x86/desc.h b/lib/x86/desc.h
index b65539e..9b81da0 100644
--- a/lib/x86/desc.h
+++ b/lib/x86/desc.h
@@ -18,6 +18,10 @@ struct ex_regs {
unsigned long rip;
unsigned long cs;
unsigned long rflags;
+#ifdef __x86_64__
+ unsigned long rsp;
+ unsigned long ss;
+#endif
};
typedef void (*handler)(struct ex_regs *regs);
diff --git a/lib/x86/usermode.c b/lib/x86/usermode.c
index 2e77831..57a017d 100644
--- a/lib/x86/usermode.c
+++ b/lib/x86/usermode.c
@@ -26,6 +26,9 @@ static void restore_exec_to_jmpbuf_exception_handler(struct ex_regs *regs)
/* longjmp must happen after iret, so do not do it now. */
regs->rip = (unsigned long)&restore_exec_to_jmpbuf;
regs->cs = KERNEL_CS;
+#ifdef __x86_64__
+ regs->ss = KERNEL_DS;
+#endif
}
uint64_t run_in_user(usermode_func func, unsigned int fault_vector,
--
2.34.1.173.g76aa8bc2d0-goog
