Re: [kvm-unit-tests PATCH 1/3] x86: Fix a #GP from occurring in usermode's exception handlers

Sean Christopherson
2021-12-09T20:04:35Z

Nit on the subject, "usermode's exception handlers" reads like KUT is handling
exceptions in usermode. Maybe "usermode library's exception handlers"?

On Thu, Dec 09, 2021, Aaron Lewis wrote:
> When handling an exception in usermode.c the exception handler #GPs when
> executing 'iret' to return from the exception handler. This happens
> because the stack segment selector does not have the same privilege
> level as the return code segment selector. Set the stack segment
> selector to match the code segment selector's privilege level to fix the
> issue.
>
> This problem has been disguised in kvm-unit-tests because a #GP
> exception handler has been registered with run_in_user() for the tests
> that are currently using this feature. With a #GP exception handler
> registered, the first exception will be processed then #GP on the
> return. Then, because the exception handlers run at CPL0, SS:RSP for

s/return/IRET for clarity

> CPL0 will be pushed onto the stack matching KERNEL_CS, which is set in
> ex_regs.cs in the exception handler.

The IRET from the second #GP will then succeed, and the subsequent lngjmp() will
restore RSP to a sane value. But if no #GP handler is installed, e.g. if a test
wants to handle only #ACs, the #GP on the initial IRET will be fatal.

> This is only a problem in 64-bit mode because 64-bit mode
> unconditionally pops SS:RSP (SDM vol 3, 6.14.3 "IRET in IA-32e Mode").
> In 32-bit mode SS:RSP is not popped because there is no privilege level
> change when returning from the #GP.
>
> Signed-off-by: Aaron Lewis <aaronlewis@google.com>

Reviewed-by: Sean Christopherson <seanjc@google.com>