| Message ID | 20211209182624.2316453-2-aaronlewis@google.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Add additional testing for routing L2 exceptions | expand |
Nit on the subject, "usermode's exception handlers" reads like KUT is handling exceptions in usermode. Maybe "usermode library's exception handlers"? On Thu, Dec 09, 2021, Aaron Lewis wrote: > When handling an exception in usermode.c the exception handler #GPs when > executing 'iret' to return from the exception handler. This happens > because the stack segment selector does not have the same privilege > level as the return code segment selector. Set the stack segment > selector to match the code segment selector's privilege level to fix the > issue. > > This problem has been disguised in kvm-unit-tests because a #GP > exception handler has been registered with run_in_user() for the tests > that are currently using this feature. With a #GP exception handler > registered, the first exception will be processed then #GP on the > return. Then, because the exception handlers run at CPL0, SS:RSP for s/return/IRET for clarity > CPL0 will be pushed onto the stack matching KERNEL_CS, which is set in > ex_regs.cs in the exception handler. The IRET from the second #GP will then succeed, and the subsequent lngjmp() will restore RSP to a sane value. But if no #GP handler is installed, e.g. if a test wants to handle only #ACs, the #GP on the initial IRET will be fatal. > This is only a problem in 64-bit mode because 64-bit mode > unconditionally pops SS:RSP (SDM vol 3, 6.14.3 "IRET in IA-32e Mode"). > In 32-bit mode SS:RSP is not popped because there is no privilege level > change when returning from the #GP. > > Signed-off-by: Aaron Lewis <aaronlewis@google.com> Reviewed-by: Sean Christopherson <seanjc@google.com>
diff --git a/lib/x86/desc.h b/lib/x86/desc.h index b65539e..9b81da0 100644 --- a/lib/x86/desc.h +++ b/lib/x86/desc.h @@ -18,6 +18,10 @@ struct ex_regs { unsigned long rip; unsigned long cs; unsigned long rflags; +#ifdef __x86_64__ + unsigned long rsp; + unsigned long ss; +#endif }; typedef void (*handler)(struct ex_regs *regs); diff --git a/lib/x86/usermode.c b/lib/x86/usermode.c index 2e77831..57a017d 100644 --- a/lib/x86/usermode.c +++ b/lib/x86/usermode.c @@ -26,6 +26,9 @@ static void restore_exec_to_jmpbuf_exception_handler(struct ex_regs *regs) /* longjmp must happen after iret, so do not do it now. */ regs->rip = (unsigned long)&restore_exec_to_jmpbuf; regs->cs = KERNEL_CS; +#ifdef __x86_64__ + regs->ss = KERNEL_DS; +#endif } uint64_t run_in_user(usermode_func func, unsigned int fault_vector,
When handling an exception in usermode.c the exception handler #GPs when executing 'iret' to return from the exception handler. This happens because the stack segment selector does not have the same privilege level as the return code segment selector. Set the stack segment selector to match the code segment selector's privilege level to fix the issue. This problem has been disguised in kvm-unit-tests because a #GP exception handler has been registered with run_in_user() for the tests that are currently using this feature. With a #GP exception handler registered, the first exception will be processed then #GP on the return. Then, because the exception handlers run at CPL0, SS:RSP for CPL0 will be pushed onto the stack matching KERNEL_CS, which is set in ex_regs.cs in the exception handler. This is only a problem in 64-bit mode because 64-bit mode unconditionally pops SS:RSP (SDM vol 3, 6.14.3 "IRET in IA-32e Mode"). In 32-bit mode SS:RSP is not popped because there is no privilege level change when returning from the #GP. Signed-off-by: Aaron Lewis <aaronlewis@google.com> --- lib/x86/desc.h | 4 ++++ lib/x86/usermode.c | 3 +++ 2 files changed, 7 insertions(+)