From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id D41EA802A5 for ; Wed, 7 Oct 2026 11:58:33 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 697BvEaY004352; Wed, 7 Oct 2026 14:57:15 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 697BvEaY004352 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="KC7FTmqq" Received: from mail-wr1-f71.google.com (mail-wr1-f71.google.com [209.85.221.71]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 697Bv9FB004323 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Wed, 7 Oct 2026 14:57:09 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 697Bv9FB004323 Received: by mail-wr1-f71.google.com with SMTP id ffacd0b85a97d-48b01a74792so2773648f8f.0 for ; Wed, 07 Oct 2026 04:57:09 -0700 (PDT) X-Forwarded-Encrypted: i=2; AKwUvBw5G3t5VqbJkRoslSAh+eIbE8osNX//OmWO+AnXe5Rphg7PKod9ksqHzM8GKrI0vD5aAWW8/g==@openvz.org X-Gm-Message-State: AFq9FYJJTlFcH3d5aM3t6+3UsP6pJ4J3u6Z2bIUkwn/bG3YMzgMyMxjd lewpIa76fJ9dPJf3MqVmsuSX+V9JSnRiORZT/bqjtpFWNz6BBqXIDshYufXpNJBhmp1U9RBObED yRwew9AUnfBVgwTBuz83AyY+nwAUUWplDS24x9x15yCPtIcuh0fphSA== X-Gm-Gg: AYBFou3gaSa+RuZE6yCxOKhjy54OwCkReV2p+D4L0m5rnux7oURBr36lnnw8O7CLGuK IpikpmTKQy95NOV1x2pcEc47f7gdFR7m59A9PUhgK54JWuGJ0mis0385BRsmY/tY6t3+nNhiIxe lQrf2FHDyQ6R0qT2yNWrhnPUhiS7TtnxJTZ4NkBBy+ujzQEaxKewvfbzp8Y+B6NXEyubL3404fs Cwc/OHsmMMnMSrjc5SJeDycFTtgguPtNpmLKX7owTcIkk5DSZe8y05PKLGjiw0wAHVz02dksJ7f 0wa2YPF+6VXVi6jmtAtLryRYANTxxQ7JoEF7pgb+neU7NiGSu/XkW0aHtgtJH9P1uRMa6xRrSDW 2B3JO7V3u+xtaO2rWug== X-Received: by 2002:a05:6000:4916:b0:487:1f7:f506 with SMTP id ffacd0b85a97d-48c72754b30mr3708336f8f.11.1791374228856; Wed, 07 Oct 2026 04:57:08 -0700 (PDT) X-Received: by 2002:a05:6000:4916:b0:487:1f7:f506 with SMTP id ffacd0b85a97d-48c72754b30mr3708288f8f.11.1791374228336; Wed, 07 Oct 2026 04:57:08 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1791374228; cv=none; d=google.com; s=arc-20260327; b=EJ+ofzLJf+GRaIaX1IWwQKlGlRkft6IAg8BnWy1Jh/6WDoqMMRC2GQx5mSHJjmMLdl 05t173dVy5xLGuLXWBr2w1QCGirEylNq36iobvH4apsfeTlbpHbOZKXNN2PuwUJ0WT6N bUAbRpFlOQ+hAIgkX//667jrhtQOGroggfvwsHmfOToUwIwJ3eioVb9sQxaQwYyan2Id Zd3EBUc3bDzG80oqHBwcW4uktTQ6XjjJEBWHtoOmLsHL0Y44uN+87e1eYWS4ey0B8o7o UAKQR13ucgdi6oY47BjqLl4aYmK0QlogK78/d25qJ/A//eenFDKUdQBZMAZ/xKkyC2/5 EMGA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:dkim-signature; bh=qEJlbM096ShfP6uQScu2MizNSIShoW7x81TUmuyGOBs=; fh=bRkZfFa6377EgOVW8zBDri2gGIQqe/ZeiH+ijEM/ROI=; b=KT1dZDEN65TUvp5qzaHfeXYZL76xV0iPHj1xK6samRiEKphkrkiRKfJG+6GuMDTKoW NYW8yVzz3E5KwEgl/O69hFvPdpvrFuf1S7MqGZFE2P+LmQ4iDTxlIg736/kAY6SaGb/m T1RutxZ7Lz1Mykzxfa4QQnCi1Z6CPvMMB01zwliUfGoC1Xl+A6U3dDh+cDtnq2JUp6X1 GEGtBbqeZz8kyJaAPRqbdv9ApLVFO76XTDGBSLZfmX9Z7TL7I488WGfHWCjZv0s1xSt9 pFDNrZKSutii7F5b/3qaG3X1pdDAvPLmzf0YM5oheuVAvAGlaaFNUmaQ1n0MKsypIXjv 8KNw==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=KC7FTmqq; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-48c724af9aasi4216615f8f.406.2026.10.07.04.57.08 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 07 Oct 2026 04:57:08 -0700 (PDT) Received-SPF: pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=KC7FTmqq; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=Message-Id:Content-Type:MIME-Version:Subject:Date :From; bh=qEJlbM096ShfP6uQScu2MizNSIShoW7x81TUmuyGOBs=; b=KC7FTmqqK4vwoqxaxX8 W8pDd75gFHUvfiMERj+UWyt4lbZkvrOvdpZWDd/M845ujVgHOr90LRgEemR6QQLrc5dmGL++oa/E3 fcoIfObR0UqJoaXWnkfvU3tPf17wA6Ru1VtxW0UuZciQYsv2feasOdsWkUlq6KqDH3/Tb2+4Jzwn4 AxvdQmXzSjZy+AXzpYyaDsv0moOcwcnPVItXUGvLKuv9F+UIYWGpvdVQlgo7Xv6wPYR5SATQvP5sl 14qlV2dAy8ilLfzEs3yOsUByHXS6EidrTn823JE8pxD4lFfE060xrFmX1gmcw0FeXvCnqFwHuQLbT LNy9ArGWn+3YaJg==; Received: from ch-demo-asa.virtuozzo.com ([130.117.225.8] helo=f0.sw.ru) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1xEQDR-002m3X-2p; Wed, 07 Oct 2026 13:57:07 +0200 From: Konstantin Khorenko Date: Wed, 07 Oct 2026 13:57:05 +0200 MIME-Version: 1.0 Message-Id: <20261007-b4-prep-khorenko-vstor-148656-cpuid-v6-4-a8eb906e69b8@virtuozzo.com> References: <20261007-b4-prep-khorenko-vstor-148656-cpuid-v6-0-a8eb906e69b8@virtuozzo.com> In-Reply-To: <20261007-b4-prep-khorenko-vstor-148656-cpuid-v6-0-a8eb906e69b8@virtuozzo.com> To: Pavel Tikhomirov , Vasileios Almpanis X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2740; i=khorenko@virtuozzo.com; h=from:subject:message-id; bh=6m/g5pNf/ipAkqDG11BqXp81XqDDJtv6EHkd+2i5fHM=; b=owEBbQKS/ZANAwAKAVGWCkf5YVwqAcsmYgBqxjOStJmCydWuIkvRTsbhQVQeE+wNBjrNTAMuV BINJ1mjNJyJAjMEAAEKAB0WIQRWD23IPcXT0GO9CCxRlgpH+WFcKgUCasYzkgAKCRBRlgpH+WFc KnfqEADCx7p4VMB5sA1XI5MyKUl4q6YsdA+KbklwbPfrDiXTx+ZyBJBsvn3w8bPljMkK3bgyGVB Lv5LfsYFI2f0bbgJvwtA/zgrrCO0S9/TNFalNCqx+ORYt04ApvVe5f0wbdGKgoddMofWe3OImt/ pJZQOUsGROAAxUoa6ezdU+S8546hnZloiYAkocFNFtgrpnfovxECQ1ZHPeKmrxnq3/4gs3wTR7/ +gJ7hgKkTNodAx1BY/YcPAtcOP83+/YNjXvPbSuSKxbm5WUzYnjOMLqV91WYJSu3eT1WqcX6WzE Au6OiNmjBgyO4XPn2QYvP5ehxVzx+2+edoLuj3iaRlhlIDuTyIcq9QzHBWkIkxH1ugS/n707rJE MXBLUH2CKvdRextT7iUKnPjwpbR0GFRLcUHoRnwy+13XmyNJPHjstbLoPpHMBpOIZGKU8QdG1T9 yNS2n6GOOpSRkK+yC4w2LLJ36vULiJ44YpPZ4Cc+cbynZEjTwB0rYLxyrDDTVKI+Q68TuUqDoql FEaUVGiz8U25kErMzq/cuXlvKvFQYgBZxUcT6nEtIoLgsn+bWAbQKJ45FqqgRcofehpmQepb7yN 8fs8e0EN+HPngQ4R9GLd/vqQX8P5f66lMDAZLqfY5Jg1vgDvzfkr2fGoVTHLEIC029jZkuv8TNo JEN0k1dJJC2HJOA== X-Developer-Key: i=khorenko@virtuozzo.com; a=openpgp; fpr=560F6DC83DC5D3D063BD082C51960A47F9615C2A X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1 v6 4/5] x86/traps: decode the faulting CPUID with the instruction decoder X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org check_cpuid_fault() reads two bytes at the faulting ip and emulates only when they are 0f a2, the bare CPUID encoding. CPUID has no operands, so the CPU accepts and ignores every legacy and REX prefix in front of it. All of these are valid CPUID and raise the same #GP(0) when CPUID faulting is on: 0f a2 cpuid 66 0f a2 data16 cpuid (operand-size override) f3 0f a2 repz cpuid 2e 0f a2 cs cpuid (segment override) 48 0f a2 rex.W cpuid Only the first one is recognised. For the others the handler reads the prefix byte instead of the opcode, declines, and the task is killed with SIGSEGV although the instruction is legal and the host would have executed it. Such encodings could come from hand-written and generated assembly, from binary translators and JITs that emit prefixes for alignment or as padding, and from any binary that disassembles as "data16 cpuid" rather than "cpuid". Fetch and decode the instruction with insn_fetch_from_user() and insn_decode_from_regs(), as fixup_umip_exception() does, match the opcode bytes and advance ip by the decoded length. The decoder derives the linear ip from the code segment itself, so convert_ip_to_linear() is not needed any more. Fixes: 1033fe455434 ("arch/x86: introduce cpuid override") https://virtuozzo.atlassian.net/browse/VSTOR-148843 Feature: x86: cpu pools (cpuid override) Signed-off-by: Konstantin Khorenko --- arch/x86/kernel/traps.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c index 8074387bf4f43..fa12da67adbf0 100644 --- a/arch/x86/kernel/traps.c +++ b/arch/x86/kernel/traps.c @@ -633,8 +633,9 @@ static enum kernel_gp_hint get_kernel_gp_address(struct pt_regs *regs, static int check_cpuid_fault(struct pt_regs *regs, long error_code) { - unsigned long addr; - unsigned short opcode; + unsigned char buf[MAX_INSN_SIZE]; + struct insn insn; + int nr_copied; if (error_code != 0) return 0; @@ -642,16 +643,19 @@ static int check_cpuid_fault(struct pt_regs *regs, long error_code) if (test_thread_flag(TIF_NOCPUID)) return 0; - addr = convert_ip_to_linear(current, regs); - if (get_user(opcode, (unsigned short __user *)addr)) + nr_copied = insn_fetch_from_user(regs, buf); + if (nr_copied <= 0) + return 0; + + if (!insn_decode_from_regs(&insn, regs, buf, nr_copied)) return 0; - if (opcode != 0xa20f) + if (insn.opcode.bytes[0] != 0x0f || insn.opcode.bytes[1] != 0xa2) return 0; do_cpuid_fault(regs); - regs->ip += 2; + regs->ip += insn.length; return 1; } -- 2.43.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel