Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752627AbdLFRPA (ORCPT ); Wed, 6 Dec 2017 12:15:00 -0500 Received: from mail-it0-f66.google.com ([209.85.214.66]:43781 "EHLO mail-it0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752303AbdLFRO4 (ORCPT ); Wed, 6 Dec 2017 12:14:56 -0500 X-Google-Smtp-Source: AGs4zMb2JVA4qxUPNXBxl3m53TvRjDqkZtLdsRohwGVU/RtrzQiMVddVOMpxm6odk+zZKHAXIMdOZfBd4XJPUCXqY74= MIME-Version: 1.0 In-Reply-To: References: <1512561558-15470-1-git-send-email-wanpeng.li@hotmail.com> From: Jim Mattson Date: Wed, 6 Dec 2017 09:14:55 -0800 Message-ID: Subject: Re: [PATCH v2] KVM: X86: Fix load RFLAGS w/o the fixed bit To: David Hildenbrand Cc: Wanpeng Li , LKML , kvm list , Paolo Bonzini , =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , Wanpeng Li Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by nfs id vB6HF40N016042 Content-Length: 2515 Lines: 77 What if I change the testcase so that regs.rflags is initialized to (1 << 3)? On Wed, Dec 6, 2017 at 6:40 AM, David Hildenbrand wrote: > On 06.12.2017 12:59, Wanpeng Li wrote: >> From: Wanpeng Li >> >> *** Guest State *** >> CR0: actual=0x0000000000000030, shadow=0x0000000060000010, gh_mask=fffffffffffffff7 >> CR4: actual=0x0000000000002050, shadow=0x0000000000000000, gh_mask=ffffffffffffe871 >> CR3 = 0x00000000fffbc000 >> RSP = 0x0000000000000000 RIP = 0x0000000000000000 >> RFLAGS=0x00000000 DR7 = 0x0000000000000400 >> ^^^^^^^^^^ >> >> The failed vmentry is triggered by the following testcase when ept=Y: >> >> #include >> #include >> #include >> #include >> #include >> #include >> #include >> >> long r[5]; >> int main() >> { >> r[2] = open("/dev/kvm", O_RDONLY); >> r[3] = ioctl(r[2], KVM_CREATE_VM, 0); >> r[4] = ioctl(r[3], KVM_CREATE_VCPU, 7); >> struct kvm_regs regs = { >> .rflags = 0, >> }; >> ioctl(r[4], KVM_SET_REGS, ®s); >> ioctl(r[4], KVM_RUN, 0); >> } >> >> X86 RFLAGS bit 1 is fixed set, userspace can simply clearing bit 1 >> of RFLAGS with KVM_SET_REGS ioctl which results in vmentry fails. >> This patch fixes it by oring X86_EFLAGS_FIXED during ioctl. >> >> Suggested-by: Jim Mattson >> Cc: Paolo Bonzini >> Cc: Radim Krčmář >> Cc: Jim Mattson >> Signed-off-by: Wanpeng Li >> --- >> v1 -> v2: >> * Oring X86_EFLAGS_FIXED >> >> virt/kvm/kvm_main.c | 1 + >> 1 file changed, 1 insertion(+) >> >> diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c >> index b55bad3..0f3f283 100644 >> --- a/virt/kvm/kvm_main.c >> +++ b/virt/kvm/kvm_main.c >> @@ -2602,6 +2602,7 @@ static long kvm_vcpu_ioctl(struct file *filp, >> r = PTR_ERR(kvm_regs); >> goto out; >> } >> + kvm_regs->rflags |= X86_EFLAGS_FIXED; >> r = kvm_arch_vcpu_ioctl_set_regs(vcpu, kvm_regs); >> kfree(kvm_regs); >> break; >> > > Not sure if failing KVM_SET_REGS would be nicer, but maybe this has > already been discussed. So this should be fine. > > Reviewed-by: David Hildenbrand > > -- > > Thanks, > > David / dhildenb