[Devel] [PATCH hci-8.1 4/5] x86/traps: decode the faulting CPUID with the instruction decoder

[Konstantin Khorenko]

check_cpuid_fault() reads two bytes at the faulting ip and emulates
only when they are 0f a2, the bare CPUID encoding.

CPUID has no operands, so the CPU accepts and ignores every legacy
and REX prefix in front of it. All of these are valid CPUID and raise
the same #GP(0) when CPUID faulting is on:

  0f a2           cpuid
  66 0f a2        data16 cpuid       (operand-size override)
  f3 0f a2        repz cpuid
  2e 0f a2        cs cpuid           (segment override)
  48 0f a2        rex.W cpuid

Only the first one is recognised. For the others the handler reads
the prefix byte instead of the opcode, declines, and the task is
killed with SIGSEGV although the instruction is legal and the host
would have executed it.
Such encodings could come from hand-written and generated assembly, from
binary translators and JITs that emit prefixes for alignment or as
padding, and from any binary that disassembles as "data16 cpuid" rather
than "cpuid".

Fetch and decode the instruction with insn_fetch_from_user() and
insn_decode_from_regs(), as fixup_umip_exception() does, match the
opcode bytes and advance ip by the decoded length. The decoder derives
the linear ip from the code segment itself, so convert_ip_to_linear()
is not needed any more.

Fixes: 1033fe455434 ("arch/x86: introduce cpuid override")
https://virtuozzo.atlassian.net/browse/VSTOR-148843

Feature: x86: cpu pools (cpuid override)
Signed-off-by: Konstantin Khorenko <khorenko at virtuozzo.com>
---
 arch/x86/kernel/traps.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 8074387bf4f43..fa12da67adbf0 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -633,8 +633,9 @@ static enum kernel_gp_hint get_kernel_gp_address(struct pt_regs *regs,
 
 static int check_cpuid_fault(struct pt_regs *regs, long error_code)
 {
-	unsigned long addr;
-	unsigned short opcode;
+	unsigned char buf[MAX_INSN_SIZE];
+	struct insn insn;
+	int nr_copied;
 
 	if (error_code != 0)
 		return 0;
@@ -642,16 +643,19 @@ static int check_cpuid_fault(struct pt_regs *regs, long error_code)
 	if (test_thread_flag(TIF_NOCPUID))
 		return 0;
 
-	addr = convert_ip_to_linear(current, regs);
-	if (get_user(opcode, (unsigned short __user *)addr))
+	nr_copied = insn_fetch_from_user(regs, buf);
+	if (nr_copied <= 0)
+		return 0;
+
+	if (!insn_decode_from_regs(&insn, regs, buf, nr_copied))
 		return 0;
 
-	if (opcode != 0xa20f)
+	if (insn.opcode.bytes[0] != 0x0f || insn.opcode.bytes[1] != 0xa2)
 		return 0;
 
 	do_cpuid_fault(regs);
 
-	regs->ip += 2;
+	regs->ip += insn.length;
 	return 1;
 }
 

-- 
2.43.0