From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 6B37680777 for ; Tue, 6 Oct 2026 20:46:09 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 696Kiv4I027851; Tue, 6 Oct 2026 23:44:58 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 696Kiv4I027851 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="qWqb6Wn7" Received: from mail-wr1-f72.google.com (mail-wr1-f72.google.com [209.85.221.72]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 696Kicp7027807 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Tue, 6 Oct 2026 23:44:38 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 696Kicp7027807 Received: by mail-wr1-f72.google.com with SMTP id ffacd0b85a97d-48c50ed05abso2484869f8f.0 for ; Tue, 06 Oct 2026 13:44:38 -0700 (PDT) X-Forwarded-Encrypted: i=2; AKwUvByiBcV76O/JkXXooZQjWBpiMYjzvNjwwW51L0Nex/STQIL0Rk69ifHpgYwFrbHOUwafddEYaQ==@openvz.org X-Gm-Message-State: AFq9FYI/Tpu/pDhzeBIbvCYxyUCynDHKEgB7wbN0Yv6s5KuOcuAjJw0z QmOyZbeftuqPwhBo4gJ2rSmBZsLc6FfvJtI/P9IoXS1/UPp3RK3Nguf0gm6J8Je5jIZko0fAlRv Txl5qFABahKYoPxKZs/NVucHlRlBIos8ylJ4sXWRVbDgpqXhnej3mgQ== X-Gm-Gg: AYBFou2j6osqh0cCydcjaUzoZwgE8VSTq3d1j8BrC8fE0oBhyQ5Cj4jmALND9qQu4b5 efSSG0tby5lP1iD5oQh846xcKft0DCUpc202aYL9Ey4ToB0m5B28iE1pt9ERRxJzxABP9vNPPtC 5neAQqWSZrIpLoO1go1mxQ7u7+qIwN1B9GwuGz6jX1vePmP+Nm6+MDrRr1smwAzsaNq5jfqR7lh 4rnuAApGYJRZPdm0KS8pVPczLPxuasYYJ+h8z51/h1YYVcaCYHt24e0i3MIBRU7BJBnGJ6vLLxc GHUl1h1Z59Boa59kTpS3GTuMLz+vF4CTW48Kg24H1cgHRYLg2csCTOdHeYOdahQCuEObWQEaYBz MF+DZsQOLs/LAwHyG+Q== X-Received: by 2002:a05:6000:288e:b0:488:7bdc:6032 with SMTP id ffacd0b85a97d-48c7288a085mr837954f8f.43.1791319478590; Tue, 06 Oct 2026 13:44:38 -0700 (PDT) X-Received: by 2002:a05:6000:288e:b0:488:7bdc:6032 with SMTP id ffacd0b85a97d-48c7288a085mr837936f8f.43.1791319478029; Tue, 06 Oct 2026 13:44:38 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1791319478; cv=none; d=google.com; s=arc-20260327; b=ZYKn4dwAKvfdKK1yTvos2L9gpb2+b3xvt5ILvGiC7ouCLXKg/Ny3sAqRDJ+ZVK9gyi PDW5C+bRg5+wh1P4XxcdAaQOSyO76ZkDX/JMnrRsmK4B9DWdhurQmMYM1AVlOh7Zgd3y M6CrYHMOvVWNBzrNqXnf5IREGrvHIGULFheCUDgbRO5SsDkFkMbHF4rq9+n1pP2hXVTx 8kMgLwez1zYBaiF6YcVVCyqfJa4gQEL7lZ0wAKFWZAA+07CVBQEqpBueiYehx2M7WD0S o0frXK0mMtpsZsEoyAc0d5tKOcD/7HWjDm3QVRRw7qyuHVngzZmopHh/anCWi39+8/5l xjXg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:dkim-signature; bh=qEJlbM096ShfP6uQScu2MizNSIShoW7x81TUmuyGOBs=; fh=bRkZfFa6377EgOVW8zBDri2gGIQqe/ZeiH+ijEM/ROI=; b=LG4OJ7vM1err4Ggdj1ZL6cPeiIFkcfH9AOs0ArKx1xLnY4ePugGjfDy86A0f/s3yBT Mux8xA7QNCVS1CBbYwKdPkwZg4BjwfvIOIhmkSe4L8gBrMGNk/fExFsriFBwQNvHaiGj kHJQIAgXX+NSbi0Iw2oYiSJluNzbLZfVY/lMi+UHLqw9jDD+kFr/lx6UgOWI8JdV7UU/ +iIfeM2Azt7FCk3cqv2aiQ79CDJx9mVecycj/h/xAMA38yEQyReL+MEEAEV+NAaEy+WS D0OUOeUSO2pCcduImu7m2MH0Gws4dKQP8eYR9d73zOK9cJKt+Qy0xBTwy3vCZCxT9ba9 PRvw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=qWqb6Wn7; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-48c724679ebsi1107776f8f.55.2026.10.06.13.44.37 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 06 Oct 2026 13:44:38 -0700 (PDT) Received-SPF: pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=qWqb6Wn7; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=Message-Id:Content-Type:MIME-Version:Subject:Date :From; bh=qEJlbM096ShfP6uQScu2MizNSIShoW7x81TUmuyGOBs=; b=qWqb6Wn70SkKaclOcos eT6RJPpJgX46DF6rgdpZ+0H56UGvaeRoKxmrFe4+KKBOp8lmiglYgo5zhhIN8Ne24AF0DpZevU+d1 lqPOMDcaSt3lf4QNFFXNYpgXlfY7nxsHEzRMsaOaHVkSNumScY4aoAcw59AjiZZzL5Wpy5oqeW4YB 8QZ8TR4bW10J5lHpqrU9rmbFMpuMG5VkjMRcKoKlYkU7ujjER6ym1XmOdc0glf6p5eAkuAZPTFcaS hObwCE2C1lkktVJ3Tg7fF3EMDFf9Q3EovozFEHOmgwCaurgBhXCtEjG/LlIpaS4p1FIQU/sqK6fTx UcYDbh5Sb4J4Hjg==; Received: from ch-demo-asa.virtuozzo.com ([130.117.225.8] helo=f0.sw.ru) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1xEByO-002tkg-1c; Tue, 06 Oct 2026 22:44:27 +0200 From: Konstantin Khorenko Date: Tue, 06 Oct 2026 22:44:35 +0200 MIME-Version: 1.0 Message-Id: <20261006-b4-prep-khorenko-vstor-148656-cpuid-v3-4-16141b8ca07d@virtuozzo.com> References: <20261006-b4-prep-khorenko-vstor-148656-cpuid-v3-0-16141b8ca07d@virtuozzo.com> In-Reply-To: <20261006-b4-prep-khorenko-vstor-148656-cpuid-v3-0-16141b8ca07d@virtuozzo.com> To: Pavel Tikhomirov , Vasileios Almpanis X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2740; i=khorenko@virtuozzo.com; h=from:subject:message-id; bh=6m/g5pNf/ipAkqDG11BqXp81XqDDJtv6EHkd+2i5fHM=; b=owEBbQKS/ZANAwAKAVGWCkf5YVwqAcsmYgBqxV2z2KlI4bw7VnrcnaYhhOXIEUR7V8nmRW8kW nLdO1BfPfeJAjMEAAEKAB0WIQRWD23IPcXT0GO9CCxRlgpH+WFcKgUCasVdswAKCRBRlgpH+WFc KjefD/412qAScCNBJE0eXZsLS/lCXOQVz7RG98F1lntBCcx40FEbj/oqN9P8RQ9WQf4wqRCWqfX Q3kf/O5ODuD41ydW8e/Te/uG9qJUpUpjlOveKOYpBL/Wc2z9IQYVwioZBNPLTuqvgxoZB0lEfJM O7wni4qQo8l+5Vu2LOM9eQrWONbYtWJj5dC8izISdBU/0NHpPy7Z/C/BWOIl1kMCqTdal3zGxVL Y4N4g5bU6uNd40yl8c5VofQDhTmLBwCfvM9pRGUVTaB4sXiX1h8gOX5O/kMINqWCKthATO5EdWN ugBa22azHEIaMAnr7wCnBMvNbN4qoSnfZEvBmmqwTr/v6wQcqX5+pVTQ+L4eJfUavM0WJqz6XgY y+Kk7NKD4xuLVpH/XJg8m4D7l1bJJrg5GjtGN70qqrsQrBfPfIA+tfESZtkjC9F/HFE4skb7Y+6 VQ6VXZxnvGnArmj66MNMXrPpuDpjmYRbkL6TySEWVxwK0s8jPskU1PKTx4OlzY+KsYB3Z1HYpSa WDHUI3I5wgBhn4kOHnzpvs5GA4igJFrj+P1LHpSKnWyFmfNgRV351dWF18OS4E4fuk+Q5HMTe/d VnoaK1hR2JSIUfVXAU05Df2NU4ipfD5vdk6VQfohZJmCk8pLmi/eSRjycob251r/5szIIIK9f2m i2iw2CglLl7zGLg== X-Developer-Key: i=khorenko@virtuozzo.com; a=openpgp; fpr=560F6DC83DC5D3D063BD082C51960A47F9615C2A X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1 v3 4/5] x86/traps: decode the faulting CPUID with the instruction decoder X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org check_cpuid_fault() reads two bytes at the faulting ip and emulates only when they are 0f a2, the bare CPUID encoding. CPUID has no operands, so the CPU accepts and ignores every legacy and REX prefix in front of it. All of these are valid CPUID and raise the same #GP(0) when CPUID faulting is on: 0f a2 cpuid 66 0f a2 data16 cpuid (operand-size override) f3 0f a2 repz cpuid 2e 0f a2 cs cpuid (segment override) 48 0f a2 rex.W cpuid Only the first one is recognised. For the others the handler reads the prefix byte instead of the opcode, declines, and the task is killed with SIGSEGV although the instruction is legal and the host would have executed it. Such encodings could come from hand-written and generated assembly, from binary translators and JITs that emit prefixes for alignment or as padding, and from any binary that disassembles as "data16 cpuid" rather than "cpuid". Fetch and decode the instruction with insn_fetch_from_user() and insn_decode_from_regs(), as fixup_umip_exception() does, match the opcode bytes and advance ip by the decoded length. The decoder derives the linear ip from the code segment itself, so convert_ip_to_linear() is not needed any more. Fixes: 1033fe455434 ("arch/x86: introduce cpuid override") https://virtuozzo.atlassian.net/browse/VSTOR-148843 Feature: x86: cpu pools (cpuid override) Signed-off-by: Konstantin Khorenko --- arch/x86/kernel/traps.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c index 8074387bf4f43..fa12da67adbf0 100644 --- a/arch/x86/kernel/traps.c +++ b/arch/x86/kernel/traps.c @@ -633,8 +633,9 @@ static enum kernel_gp_hint get_kernel_gp_address(struct pt_regs *regs, static int check_cpuid_fault(struct pt_regs *regs, long error_code) { - unsigned long addr; - unsigned short opcode; + unsigned char buf[MAX_INSN_SIZE]; + struct insn insn; + int nr_copied; if (error_code != 0) return 0; @@ -642,16 +643,19 @@ static int check_cpuid_fault(struct pt_regs *regs, long error_code) if (test_thread_flag(TIF_NOCPUID)) return 0; - addr = convert_ip_to_linear(current, regs); - if (get_user(opcode, (unsigned short __user *)addr)) + nr_copied = insn_fetch_from_user(regs, buf); + if (nr_copied <= 0) + return 0; + + if (!insn_decode_from_regs(&insn, regs, buf, nr_copied)) return 0; - if (opcode != 0xa20f) + if (insn.opcode.bytes[0] != 0x0f || insn.opcode.bytes[1] != 0xa2) return 0; do_cpuid_fault(regs); - regs->ip += 2; + regs->ip += insn.length; return 1; } -- 2.43.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel