Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1750981AbdLGIcF (ORCPT ); Thu, 7 Dec 2017 03:32:05 -0500 Received: from mail-oi0-f68.google.com ([209.85.218.68]:42660 "EHLO mail-oi0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750779AbdLGIcD (ORCPT ); Thu, 7 Dec 2017 03:32:03 -0500 X-Google-Smtp-Source: AGs4zMYAowm4DE0UqSBJv0K7cQP5YHRVOz6Ib6A+ldt/nhCAXyDx7vpmL68u2AKLG4wLR/zBjTpG0UPC3gWa2448/BY= MIME-Version: 1.0 In-Reply-To: References: <1512561558-15470-1-git-send-email-wanpeng.li@hotmail.com> From: Wanpeng Li Date: Thu, 7 Dec 2017 16:32:02 +0800 Message-ID: Subject: Re: [PATCH v2] KVM: X86: Fix load RFLAGS w/o the fixed bit To: David Hildenbrand Cc: "linux-kernel@vger.kernel.org" , kvm , Paolo Bonzini , =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , Wanpeng Li , Jim Mattson Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by nfs id vB78WAKP002597 Content-Length: 2668 Lines: 86 2017-12-07 1:28 GMT+08:00 David Hildenbrand : > On 06.12.2017 15:40, David Hildenbrand wrote: >> On 06.12.2017 12:59, Wanpeng Li wrote: >>> From: Wanpeng Li >>> >>> *** Guest State *** >>> CR0: actual=0x0000000000000030, shadow=0x0000000060000010, gh_mask=fffffffffffffff7 >>> CR4: actual=0x0000000000002050, shadow=0x0000000000000000, gh_mask=ffffffffffffe871 >>> CR3 = 0x00000000fffbc000 >>> RSP = 0x0000000000000000 RIP = 0x0000000000000000 >>> RFLAGS=0x00000000 DR7 = 0x0000000000000400 >>> ^^^^^^^^^^ >>> >>> The failed vmentry is triggered by the following testcase when ept=Y: >>> >>> #include >>> #include >>> #include >>> #include >>> #include >>> #include >>> #include >>> >>> long r[5]; >>> int main() >>> { >>> r[2] = open("/dev/kvm", O_RDONLY); >>> r[3] = ioctl(r[2], KVM_CREATE_VM, 0); >>> r[4] = ioctl(r[3], KVM_CREATE_VCPU, 7); >>> struct kvm_regs regs = { >>> .rflags = 0, >>> }; >>> ioctl(r[4], KVM_SET_REGS, ®s); >>> ioctl(r[4], KVM_RUN, 0); >>> } >>> >>> X86 RFLAGS bit 1 is fixed set, userspace can simply clearing bit 1 >>> of RFLAGS with KVM_SET_REGS ioctl which results in vmentry fails. >>> This patch fixes it by oring X86_EFLAGS_FIXED during ioctl. >>> >>> Suggested-by: Jim Mattson >>> Cc: Paolo Bonzini >>> Cc: Radim Krčmář >>> Cc: Jim Mattson >>> Signed-off-by: Wanpeng Li >>> --- >>> v1 -> v2: >>> * Oring X86_EFLAGS_FIXED >>> >>> virt/kvm/kvm_main.c | 1 + >>> 1 file changed, 1 insertion(+) >>> >>> diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c >>> index b55bad3..0f3f283 100644 >>> --- a/virt/kvm/kvm_main.c >>> +++ b/virt/kvm/kvm_main.c >>> @@ -2602,6 +2602,7 @@ static long kvm_vcpu_ioctl(struct file *filp, >>> r = PTR_ERR(kvm_regs); >>> goto out; >>> } >>> + kvm_regs->rflags |= X86_EFLAGS_FIXED; > > Just realized that this should go into kvm_arch_vcpu_ioctl_set_regs(). Do it in v3, thanks for your review. :) Regards, Wanpeng Li > > >>> r = kvm_arch_vcpu_ioctl_set_regs(vcpu, kvm_regs); >>> kfree(kvm_regs); >>> break; >>> >> >> Not sure if failing KVM_SET_REGS would be nicer, but maybe this has >> already been discussed. So this should be fine. >> >> Reviewed-by: David Hildenbrand >> > -- > > Thanks, > > David / dhildenb