Re: [PATCH 02/10] target/i386/tcg: Allow IRET from user mode to user mode with SMAP

[Richard Henderson <richard.henderson@linaro.org>]

On 7/9/24 23:29, Paolo Bonzini wrote:
> This fixes a bug wherein i386/tcg assumed an interrupt return using
> the IRET instruction was always returning from kernel mode to either
> kernel mode or user mode. This assumption is violated when IRET is used
> as a clever way to restore thread state, as for example in the dotnet
> runtime. There, IRET returns from user mode to user mode.
> 
> This bug is that stack accesses from IRET and RETF, as well as accesses
> to the parameters in a call gate, are normal data accesses using the
> current CPL.  This manifested itself as a page fault in the guest Linux
> kernel due to SMAP preventing the access.
> 
> This bug appears to have been in QEMU since the beginning.
> 
> Analyzed-by: Robert R. Henry<rrh.henry@gmail.com>
> Co-developed-by: Robert R. Henry<rrh.henry@gmail.com>
> Signed-off-by: Robert R. Henry<rrh.henry@gmail.com>
> Signed-off-by: Paolo Bonzini<pbonzini@redhat.com>
> ---
>   target/i386/tcg/seg_helper.c | 18 +++++++++---------
>   1 file changed, 9 insertions(+), 9 deletions(-)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>


r~