Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 90ca51d1 authored by Maxim Levitsky's avatar Maxim Levitsky Committed by Greg Kroah-Hartman
Browse files

KVM: x86: emulator: update the emulation mode after CR0 write 



commit ad8f9e69942c7db90758d9d774157e53bce94840 upstream.

Update the emulation mode when handling writes to CR0, because
toggling CR0.PE switches between Real and Protected Mode, and toggling
CR0.PG when EFER.LME=1 switches between Long and Protected Mode.

This is likely a benign bug because there is no writeback of state,
other than the RIP increment, and when toggling CR0.PE, the CPU has
to execute code from a very low memory address.

Signed-off-by: default avatarMaxim Levitsky <mlevitsk@redhat.com>
Message-Id: <20221025124741.228045-14-mlevitsk@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent ed7ae7cc

arch/x86/kvm/emulate.c

+15 −1
Original line number Diff line number Diff line
@@ -3668,11 +3668,25 @@ static int em_movbe(struct x86_emulate_ctxt *ctxt) 


static int em_cr_write(struct x86_emulate_ctxt *ctxt)

{

	if (ctxt->ops->set_cr(ctxt, ctxt->modrm_reg, ctxt->src.val))

	int cr_num = ctxt->modrm_reg;

	int r;



	if (ctxt->ops->set_cr(ctxt, cr_num, ctxt->src.val))

		return emulate_gp(ctxt, 0);



	/* Disable writeback. */

	ctxt->dst.type = OP_NONE;



	if (cr_num == 0) {

		/*

		 * CR0 write might have updated CR0.PE and/or CR0.PG

		 * which can affect the cpu's execution mode.

		 */

		r = emulator_recalc_and_set_mode(ctxt);

		if (r != X86EMUL_CONTINUE)

			return r;

	}



	return X86EMUL_CONTINUE;

}