From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 40B4B8017D for ; Tue, 6 Oct 2026 22:56:04 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 696Msr7d028709; Wed, 7 Oct 2026 01:54:54 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 696Msr7d028709 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="m7wNDO1t" Received: from mail-wr1-f72.google.com (mail-wr1-f72.google.com [209.85.221.72]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 696Mscl2028671 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Wed, 7 Oct 2026 01:54:38 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 696Mscl2028671 Received: by mail-wr1-f72.google.com with SMTP id ffacd0b85a97d-48c54e690c5so2788216f8f.0 for ; Tue, 06 Oct 2026 15:54:38 -0700 (PDT) X-Forwarded-Encrypted: i=2; AKwUvBzXHHMvuLPv5dPzXSWuibcp+eeWKWEyUA56AxL+uLAlz9XPdtpbaQmY8LPdIZ4kZPOg3oHgqA==@openvz.org X-Gm-Message-State: AFq9FYLaArxxohy8sGHRz9sShqkHBXeETS8ZlcWCX4YK2cPeyx5FQdia Mxvf2aOsSrikrNZ/hcfIllT8wtPdttCObUW0dmzhtdkDjv62BcwP2C79FSDs3aLCEOhTxphA4CY xTriyVFHFd4RmKsQNdHmCFxh6G8D9MI8/Z31KSRvzZT9YCgOHz5DYyA== X-Gm-Gg: AYBFou1I6YYOSExRnDr0R/jkaRmvhdja33C52MyisKMikeW46MAfbFHAaZsIPPJAjrI g37CrGe1gNgtrgimqgXfxQOOMN7AT8CFIedGZDqOkRkl2oaGLhaCASFElw6+j0Kw+s5wExcbOGI VISp/SUCoIvfUcHmvg2+bUG6Pk8Jm0MeiDJtaXa8qp4piyyIi24z7ZSa4V0CQx/Ys/SkVle7qD1 b8fxxVBOtbz8EnVxmJmUOr47yqO5c3h3DB/rqFd5NtoU+FUmXUEAF2uXjlYCBEv/BiyHTgu5rN1 WmktqSY/sglpJIQ7+n/qpo90RCr6XLymxGC6lYJuW6ZnCZBGmWkdqtMTO45TXpj2xuRSMYKcfpe uoBWsCcDEesQgCiaX X-Received: by 2002:a05:6000:240c:b0:48c:6a4d:3b67 with SMTP id ffacd0b85a97d-48c72771461mr1149313f8f.19.1791327278556; Tue, 06 Oct 2026 15:54:38 -0700 (PDT) X-Received: by 2002:a05:6000:240c:b0:48c:6a4d:3b67 with SMTP id ffacd0b85a97d-48c72771461mr1149292f8f.19.1791327278048; Tue, 06 Oct 2026 15:54:38 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1791327278; cv=none; d=google.com; s=arc-20260327; b=NmN5Elh7p+jdQvUx5MTDYSzz/piZtPdYQWAojS/U+xOlQU3cFpCBY5yXc1tPZefEvP gZQt/VQdApCDcMaJN1HnueCv1/VxGt6asFgSJVuCOjZZ6kKF8rhqbhbEo+v0m4qmNsoy Km6FmX+2zEomJZP37OJZZmKuVG5EQ34dchjv7iynrAlBxLN1fNjmJo+WEbWH3RoP8JB3 muYP65rBn1QKjo4++WK8TcT91H7Ow3kRFO1BbrlC5dr0DryZqP3k3bNpVHqjVdWBLD7R aCgeK1CsAxXi0XTIFxQYbYhvQ/Wdhdp2x8jFJsIwr5Lo0OCEWv+gA/UoxYTHTuXlZEaz DdYg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:dkim-signature; bh=qEJlbM096ShfP6uQScu2MizNSIShoW7x81TUmuyGOBs=; fh=bRkZfFa6377EgOVW8zBDri2gGIQqe/ZeiH+ijEM/ROI=; b=pS3ZX+8gw9irbDnWp93I8NKbxUIVqieDhKSmokpp9vnmzJkLAw1bMNW2KyKgyw0x7b VNHltSzzz+wux0icNLxLc8c6s5fpxv49b2g/p5LNzeQEcgcIH9qEh0TsR2YYUOmgWCs3 KXMXf26CR7CQda1hZdiczqDyNwBiZ/MqEIP9vr5pxakFfSdjjYnp2ztOVY4pZwl0Y6Vz ttsgAXxH7o2MwYz8GrsWUFjePYNUw/J1uRAT6o/EKNtm1W2Rqy0v0txW4MLinHLZfLjZ NbpH41EQlxXKNqe/jl77lm5Ia4aB6HW5Ak4mOD7NqUhc8ES2bp6O5405QEy1u1sZIyTg PP/A==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=m7wNDO1t; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-48c72471cf4si1429421f8f.168.2026.10.06.15.54.37 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 06 Oct 2026 15:54:38 -0700 (PDT) Received-SPF: pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=m7wNDO1t; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=Message-Id:Content-Type:MIME-Version:Subject:Date :From; bh=qEJlbM096ShfP6uQScu2MizNSIShoW7x81TUmuyGOBs=; b=m7wNDO1tIqQ2L7un7Bc UT8HAdSTGaqnHpyaredt2cCRYcz1D8YhrVGPJKV1QPi0b4pB8aFJKDoKfb1CdhHRZCLSnK4GSjL6b tPT7H8QV8JhRLTgZ2848LxH2q0By8WhCJ73ghfGNCgbRekhAOAVagRwFgirgjJWYCcaevITiSXlgo m6P1zWNRGFyoJxpSHf6xFURD/2pE2mb2RMrYMDotjneWyTu6FqtYUv7EOmRKmz1260tKG2dAFz7mT Vq2IioLx+F4NX9c+MY/J8I0bYb3w69Bax8TkcmPUj2RUmjHH9UlnO3fDRS3OTAzLT3OZuV9wGuVtL Ygsl4aCcYk7+jhA==; Received: from ch-demo-asa.virtuozzo.com ([130.117.225.8] helo=f0.sw.ru) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1xEE0C-005OA8-1J; Wed, 07 Oct 2026 00:54:27 +0200 From: Konstantin Khorenko Date: Wed, 07 Oct 2026 00:54:34 +0200 MIME-Version: 1.0 Message-Id: <20261007-b4-prep-khorenko-vstor-148656-cpuid-v5-4-652c5c9e56da@virtuozzo.com> References: <20261007-b4-prep-khorenko-vstor-148656-cpuid-v5-0-652c5c9e56da@virtuozzo.com> In-Reply-To: <20261007-b4-prep-khorenko-vstor-148656-cpuid-v5-0-652c5c9e56da@virtuozzo.com> To: Pavel Tikhomirov , Vasileios Almpanis X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2740; i=khorenko@virtuozzo.com; h=from:subject:message-id; bh=6m/g5pNf/ipAkqDG11BqXp81XqDDJtv6EHkd+2i5fHM=; b=owEBbQKS/ZANAwAKAVGWCkf5YVwqAcsmYgBqxXwrcPXtpnTr8nbSitKBbgryszzS9YyA5SYoF 3KnfzOahECJAjMEAAEKAB0WIQRWD23IPcXT0GO9CCxRlgpH+WFcKgUCasV8KwAKCRBRlgpH+WFc KkWxEACMTJQl8HErohQQEkAuNhYNRrCZOCJD6myAk5Ta9v3A6ZNYzqxgY5UR6N9br0Opkp9LQqt B0txG/hkKly5bAqH4l45l+OE1iS1ygb110Goy2cEKS460y3KIUuj0Mi7ZrKqWlAsJHFeW8lOIjg gTDIx4gWSJnxKl4kKmVYOUtLoqZe2eX2XJeRVL5fqhWZYxaLVNQBRiVEIB4TxKhW+eYqYUVq297 /ic+jep3QGvmrLdEC1IEcszvzszKT8rp9MXOSVUhbUwHu/TEneuG6810jZ5Ff4ZDE5/7SBJJGpI u8ausJGkFTqqqja3DUTRtY/MaEWBIQKOeCiH1kMdGyXMR5FHebmpUp6cYoHp3olBSb07cRWh3Op Xj1YKQNUle1kO+yyY6cCNBtXrOIFPCUrHkmkUVPf7J35hxJKLXmWQS76NyZ2PscatsTNDP9+RYO ydVUwqJyllUGKKSIsbz0lWbQxRe7ZSlzZXYcXaqpG7lrfTN0GC5Qq9Qp6YckfrGF3I5LS/cxD5Z txR40Vrcs7r9ivRbnrL2gCsBVOE8VPoi05t7CZAKrwn9mGDRuvBF/4H4GK28pIjrtJwmDV5Cpdz U6UUVV1W3940dE3ufOi4Tfo4fx3cPc5y7jocIunQvARj3MGP99U0oVl2B0EYj/N2OQp3P7jK/ei JVAFqxFvcabwX0Q== X-Developer-Key: i=khorenko@virtuozzo.com; a=openpgp; fpr=560F6DC83DC5D3D063BD082C51960A47F9615C2A X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1 v5 4/5] x86/traps: decode the faulting CPUID with the instruction decoder X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org check_cpuid_fault() reads two bytes at the faulting ip and emulates only when they are 0f a2, the bare CPUID encoding. CPUID has no operands, so the CPU accepts and ignores every legacy and REX prefix in front of it. All of these are valid CPUID and raise the same #GP(0) when CPUID faulting is on: 0f a2 cpuid 66 0f a2 data16 cpuid (operand-size override) f3 0f a2 repz cpuid 2e 0f a2 cs cpuid (segment override) 48 0f a2 rex.W cpuid Only the first one is recognised. For the others the handler reads the prefix byte instead of the opcode, declines, and the task is killed with SIGSEGV although the instruction is legal and the host would have executed it. Such encodings could come from hand-written and generated assembly, from binary translators and JITs that emit prefixes for alignment or as padding, and from any binary that disassembles as "data16 cpuid" rather than "cpuid". Fetch and decode the instruction with insn_fetch_from_user() and insn_decode_from_regs(), as fixup_umip_exception() does, match the opcode bytes and advance ip by the decoded length. The decoder derives the linear ip from the code segment itself, so convert_ip_to_linear() is not needed any more. Fixes: 1033fe455434 ("arch/x86: introduce cpuid override") https://virtuozzo.atlassian.net/browse/VSTOR-148843 Feature: x86: cpu pools (cpuid override) Signed-off-by: Konstantin Khorenko --- arch/x86/kernel/traps.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c index 8074387bf4f43..fa12da67adbf0 100644 --- a/arch/x86/kernel/traps.c +++ b/arch/x86/kernel/traps.c @@ -633,8 +633,9 @@ static enum kernel_gp_hint get_kernel_gp_address(struct pt_regs *regs, static int check_cpuid_fault(struct pt_regs *regs, long error_code) { - unsigned long addr; - unsigned short opcode; + unsigned char buf[MAX_INSN_SIZE]; + struct insn insn; + int nr_copied; if (error_code != 0) return 0; @@ -642,16 +643,19 @@ static int check_cpuid_fault(struct pt_regs *regs, long error_code) if (test_thread_flag(TIF_NOCPUID)) return 0; - addr = convert_ip_to_linear(current, regs); - if (get_user(opcode, (unsigned short __user *)addr)) + nr_copied = insn_fetch_from_user(regs, buf); + if (nr_copied <= 0) + return 0; + + if (!insn_decode_from_regs(&insn, regs, buf, nr_copied)) return 0; - if (opcode != 0xa20f) + if (insn.opcode.bytes[0] != 0x0f || insn.opcode.bytes[1] != 0xa2) return 0; do_cpuid_fault(regs); - regs->ip += 2; + regs->ip += insn.length; return 1; } -- 2.43.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel