This is a note to let you know that I've just added the patch titled
KVM: x86: emulator: update the emulation mode after CR0 write
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
kvm-x86-emulator-update-the-emulation-mode-after-cr0-write.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From ad8f9e69942c7db90758d9d774157e53bce94840 Mon Sep 17 00:00:00 2001
From: Maxim Levitsky <mlevitsk@xxxxxxxxxx>
Date: Tue, 25 Oct 2022 15:47:31 +0300
Subject: KVM: x86: emulator: update the emulation mode after CR0 write
From: Maxim Levitsky <mlevitsk@xxxxxxxxxx>
commit ad8f9e69942c7db90758d9d774157e53bce94840 upstream.
Update the emulation mode when handling writes to CR0, because
toggling CR0.PE switches between Real and Protected Mode, and toggling
CR0.PG when EFER.LME=1 switches between Long and Protected Mode.
This is likely a benign bug because there is no writeback of state,
other than the RIP increment, and when toggling CR0.PE, the CPU has
to execute code from a very low memory address.
Signed-off-by: Maxim Levitsky <mlevitsk@xxxxxxxxxx>
Message-Id: <20221025124741.228045-14-mlevitsk@xxxxxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Paolo Bonzini <pbonzini@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
arch/x86/kvm/emulate.c | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -3629,11 +3629,25 @@ static int em_movbe(struct x86_emulate_c
static int em_cr_write(struct x86_emulate_ctxt *ctxt)
{
- if (ctxt->ops->set_cr(ctxt, ctxt->modrm_reg, ctxt->src.val))
+ int cr_num = ctxt->modrm_reg;
+ int r;
+
+ if (ctxt->ops->set_cr(ctxt, cr_num, ctxt->src.val))
return emulate_gp(ctxt, 0);
/* Disable writeback. */
ctxt->dst.type = OP_NONE;
+
+ if (cr_num == 0) {
+ /*
+ * CR0 write might have updated CR0.PE and/or CR0.PG
+ * which can affect the cpu's execution mode.
+ */
+ r = emulator_recalc_and_set_mode(ctxt);
+ if (r != X86EMUL_CONTINUE)
+ return r;
+ }
+
return X86EMUL_CONTINUE;
}
Patches currently in stable-queue which might be from mlevitsk@xxxxxxxxxx are
queue-5.15/kvm-x86-emulator-update-the-emulation-mode-after-cr0-write.patch
queue-5.15/kvm-x86-treat-dbs-from-the-emulator-as-fault-like-co.patch
queue-5.15/kvm-x86-emulator-update-the-emulation-mode-after-rsm.patch
queue-5.15/kvm-x86-emulator-introduce-emulator_recalc_and_set_mode.patch
queue-5.15/kvm-x86-emulator-em_sysexit-should-update-ctxt-mode.patch
queue-5.15/kvm-x86-trace-re-injected-exceptions.patch
