From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id D52908017D for ; Tue, 6 Oct 2026 22:14:27 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 696MDDr8028368; Wed, 7 Oct 2026 01:13:14 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 696MDDr8028368 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="vBVwHtcb" Received: from mail-wr1-f72.google.com (mail-wr1-f72.google.com [209.85.221.72]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 696MCxxO028324 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Wed, 7 Oct 2026 01:13:00 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 696MCxxO028324 Received: by mail-wr1-f72.google.com with SMTP id ffacd0b85a97d-48c437ae7dbso1147400f8f.1 for ; Tue, 06 Oct 2026 15:12:59 -0700 (PDT) X-Forwarded-Encrypted: i=2; AKwUvBxCAYoh998APmlsTN13yU/IFflbjM92Ths/kJMYSr/JcMxN1vPr8sHMjUBIVNLgJsXLqElcmg==@openvz.org X-Gm-Message-State: AFq9FYLHb/EEnp1ZrI6WFWACAimb8GPzS4wIqi6z6zgxSzNKds8DvWW6 rrG0WGnZR+nJ5bZ/dVYGxbRn2Q9bE/XrC8lsQF9/NSU4xScoyCYEjhDVLzahR4mzmrtjcpWX835 ujCAbgaJ1WzWQAsFCzlThiADBRIXvVWPUY+S10r7h1Rd889aYFlYEBw== X-Gm-Gg: AYBFou0CbRR5DxdSQ9EnhLzwGFuxQwDfhRN+hJPfHZKKha5dmV4/Fd3ct2K1iUGnPQQ +ByzhYIvVD4VcrcGqnYpvXBPmF/QSMaGXuB7so9jw0xo5juggw5SCGRz8B43Lpm6cxpqob8MIjo iMnPfEnM0pfytIr6kBG5Zw5bfxEmvFJzjNe4+1eny0h7NVerdbxN0E9zsZxVpqEllXYqHQb7L5H V/JlzfmWwqfXI+Hu9QxBD3bclUwOUXVj9gYs2C5VE1zBFYDjG1CA+sngc81J4LELqaiirrKemCr 1kmbf/UYEsfc9kgS4MNuGvRbnnvrjM1Wlh6YmwaxBQa2Y7sGpLcAeuYH7INzcsR9qDUiOB4yLVG /Six+3htyhFtEoq1b X-Received: by 2002:a05:6000:bd0:b0:48c:5a7b:7573 with SMTP id ffacd0b85a97d-48c688fbfa7mr5401646f8f.29.1791324779665; Tue, 06 Oct 2026 15:12:59 -0700 (PDT) X-Received: by 2002:a05:6000:bd0:b0:48c:5a7b:7573 with SMTP id ffacd0b85a97d-48c688fbfa7mr5401630f8f.29.1791324779164; Tue, 06 Oct 2026 15:12:59 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1791324779; cv=none; d=google.com; s=arc-20260327; b=KZS7XTJ8GANU9+zj7iWk0qDFnrOPEiXByVfP/EyhrQZrMzvJCjuzRYhbwOHvICGa/f qUbCJf/hipQnR5ZEsyrW0cp6xVWyb67vDfyoOg6yyveCDggRBK9AMjNAIAvHygDwr7DH xkL+26N2tWqcoA+fAsurqkUKWHb21u3O3zSMOYL5sJLWYaIiGJ2Qfhu1Bu+5F0QpVLjc St1x0wzvyPMBvUNtoF2w9GqiaAe4FPm/zk+ZvR0Hxx9oGbPZryjuMauDvzUhAMFK10s/ vw/sZ0n9ts1fnR2ZlqjI3JR15m3G56ScUx8Oivb4vgYs5d+7K606A0ZBbd2/v2Pv95as lqrQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:dkim-signature; bh=qEJlbM096ShfP6uQScu2MizNSIShoW7x81TUmuyGOBs=; fh=bRkZfFa6377EgOVW8zBDri2gGIQqe/ZeiH+ijEM/ROI=; b=RK1AN0mRzQNIvqLTtKA66TdJ0eHcdbUoFuNdvAjC0BEh1U6A4WvRWQRD3XuTzLWCrE 4m5KcjiKJ9TfkKzoCIRZLVqkj27aLHj2MUShAj/z4mDgZ4HEQlf0flQEKFou/qdaLUxR mnJR/bcVuY8mEb3LhaHsklR5nkqWQl/DPJQuDfi/TXWg6z9hISQe/WJh6x5Cm4Ou+ZWZ bpYejZFR6D1nC+F0PNeBa+c9Jsq9TSUnkdHViaaCXTHMIln0//TY6bs+yP4uRcpksWbH Wt5OsofzqbKdA+SSrt30v6q/nw+BzDuBzefo2jcEeXqCU1qmZzOcJMztPMXFG5v/A3yk bLmw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=vBVwHtcb; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-48c72466d4asi1381699f8f.63.2026.10.06.15.12.59 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 06 Oct 2026 15:12:59 -0700 (PDT) Received-SPF: pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=vBVwHtcb; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=Message-Id:Content-Type:MIME-Version:Subject:Date :From; bh=qEJlbM096ShfP6uQScu2MizNSIShoW7x81TUmuyGOBs=; b=vBVwHtcbt5wOSywHhWy XfuDCbNAEIewnGgPh2t9UFkARgXxvKz4UoZ2zevABUgyIlYxy+4O+CK3hUEt2kw1Hev958OcMihMV y0j14pNXfbVqWKZW1X8YgH/zNSMsNrKDGJsANYyoyy6Ei+pTSQK3993xF19nDZfcNLujQ2X668jLV ri4dMT0UFq2/qGSkqQPbIvUf+to586/x7zIqtEf7Y6xi71+cv9W/J9HkAWylnPBqtfOKxPHkFkgMf hMQajWb3oZIenjrF+DQqQhLF1lzCpcGuhpxh/ySw0MGxm+4GZFtZzfSeOiV90DW/CUebKG+MoskRh 8bGczh93z9Fn9kw==; Received: from ch-demo-asa.virtuozzo.com ([130.117.225.8] helo=f0.sw.ru) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1xEDLt-004aGG-1q; Wed, 07 Oct 2026 00:12:48 +0200 From: Konstantin Khorenko Date: Wed, 07 Oct 2026 00:12:54 +0200 MIME-Version: 1.0 Message-Id: <20261007-b4-prep-khorenko-vstor-148656-cpuid-v4-4-bf16c29bea24@virtuozzo.com> References: <20261007-b4-prep-khorenko-vstor-148656-cpuid-v4-0-bf16c29bea24@virtuozzo.com> In-Reply-To: <20261007-b4-prep-khorenko-vstor-148656-cpuid-v4-0-bf16c29bea24@virtuozzo.com> To: Pavel Tikhomirov , Vasileios Almpanis X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2740; i=khorenko@virtuozzo.com; h=from:subject:message-id; bh=6m/g5pNf/ipAkqDG11BqXp81XqDDJtv6EHkd+2i5fHM=; b=owEBbQKS/ZANAwAKAVGWCkf5YVwqAcsmYgBqxXJoatTfrn8KCAy5EMO14+ZvTrb6F9puOyX2m cwYIRSZeoSJAjMEAAEKAB0WIQRWD23IPcXT0GO9CCxRlgpH+WFcKgUCasVyaAAKCRBRlgpH+WFc KiLyD/9Q7RDAUwn6sc4m2LmkUuvNKfW551/LJuDXIVCVl3qlGlbw6bRe9X4dvx5HtcKS5uZHnI7 U9a/4ch3UKfBL8ABxUUnd7Da3cPwHgsFwmN9TMC00KjidcVuLuSnqh5L4MfK2bZdsXAScM31qUC orlcQA4VOztZLJx2b7QF54IFZZfMzqwm09/vz41Cky9IzrHSYHCJpUMbzkSdGXJ4G3UdWmaDq2W ZnlQM5QLyktCrWfZNbU2VBlcdCyodkiWgS8c0/AY1/Bxokw5g3CODE4TwZBPiP+aVTbWZplxhRK U0b9RUyX8kI+GL2HDA42rnTM1ZcuZkm0gVMPDtiFdabt3afT00fPtckEfcpvWd38yOpqavhqyO5 u+f8J5AOA4SDJawYGUpA5IQ4nBbYcoYVL2mZ/v/X9FjOLPalGAKdpdQRwNaNJmvlr3DmWijtcxt lCcOQVkB1Xdrqvt6Mcnj152eWpYKQTwVEqDu79Oh2+LCALqbb5cd4jEGuIOFy6JZCGFZcAGUw3A WVGSVTj8dAZnBDCJfPgwRlhFMXOH8Ull/TKYQE+sW1yivCFQ1UtSMsFuKAGy0FLfqO6+XFPy1t8 V7Eyd7AlY3MJeuWiHCLdLa1jEfuakkH3DQ5gd9GkX3snrmXfwxLZVhEjI6xC75K4HKlhON5Y29b Wqla5lufwMCyMiQ== X-Developer-Key: i=khorenko@virtuozzo.com; a=openpgp; fpr=560F6DC83DC5D3D063BD082C51960A47F9615C2A X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1 v4 4/5] x86/traps: decode the faulting CPUID with the instruction decoder X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org check_cpuid_fault() reads two bytes at the faulting ip and emulates only when they are 0f a2, the bare CPUID encoding. CPUID has no operands, so the CPU accepts and ignores every legacy and REX prefix in front of it. All of these are valid CPUID and raise the same #GP(0) when CPUID faulting is on: 0f a2 cpuid 66 0f a2 data16 cpuid (operand-size override) f3 0f a2 repz cpuid 2e 0f a2 cs cpuid (segment override) 48 0f a2 rex.W cpuid Only the first one is recognised. For the others the handler reads the prefix byte instead of the opcode, declines, and the task is killed with SIGSEGV although the instruction is legal and the host would have executed it. Such encodings could come from hand-written and generated assembly, from binary translators and JITs that emit prefixes for alignment or as padding, and from any binary that disassembles as "data16 cpuid" rather than "cpuid". Fetch and decode the instruction with insn_fetch_from_user() and insn_decode_from_regs(), as fixup_umip_exception() does, match the opcode bytes and advance ip by the decoded length. The decoder derives the linear ip from the code segment itself, so convert_ip_to_linear() is not needed any more. Fixes: 1033fe455434 ("arch/x86: introduce cpuid override") https://virtuozzo.atlassian.net/browse/VSTOR-148843 Feature: x86: cpu pools (cpuid override) Signed-off-by: Konstantin Khorenko --- arch/x86/kernel/traps.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c index 8074387bf4f43..fa12da67adbf0 100644 --- a/arch/x86/kernel/traps.c +++ b/arch/x86/kernel/traps.c @@ -633,8 +633,9 @@ static enum kernel_gp_hint get_kernel_gp_address(struct pt_regs *regs, static int check_cpuid_fault(struct pt_regs *regs, long error_code) { - unsigned long addr; - unsigned short opcode; + unsigned char buf[MAX_INSN_SIZE]; + struct insn insn; + int nr_copied; if (error_code != 0) return 0; @@ -642,16 +643,19 @@ static int check_cpuid_fault(struct pt_regs *regs, long error_code) if (test_thread_flag(TIF_NOCPUID)) return 0; - addr = convert_ip_to_linear(current, regs); - if (get_user(opcode, (unsigned short __user *)addr)) + nr_copied = insn_fetch_from_user(regs, buf); + if (nr_copied <= 0) + return 0; + + if (!insn_decode_from_regs(&insn, regs, buf, nr_copied)) return 0; - if (opcode != 0xa20f) + if (insn.opcode.bytes[0] != 0x0f || insn.opcode.bytes[1] != 0xa2) return 0; do_cpuid_fault(regs); - regs->ip += 2; + regs->ip += insn.length; return 1; } -- 2.43.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel