KVM: x86: emulator: update the emulation mode after CR0 write

commit 691365f6d0d42b2ca7698554e30bbe8333579e22 upstream.

Update the emulation mode when handling writes to CR0, because
toggling CR0.PE switches between Real and Protected Mode, and toggling
CR0.PG when EFER.LME=1 switches between Long and Protected Mode.

This is likely a benign bug because there is no writeback of state,
other than the RIP increment, and when toggling CR0.PE, the CPU has
to execute code from a very low memory address.

Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
Message-Id: <20221025124741.228045-14-mlevitsk@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index e9d47faf2fd716a2427eae191a19b946e7e50c0a..1a9fa29038526e221d48ed05b89710595be8d6c7 100644 (file)
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -3726,11 +3726,25 @@ static int em_movbe(struct x86_emulate_ctxt *ctxt)
 
 static int em_cr_write(struct x86_emulate_ctxt *ctxt)
 {
-       if (ctxt->ops->set_cr(ctxt, ctxt->modrm_reg, ctxt->src.val))
+       int cr_num = ctxt->modrm_reg;
+       int r;
+
+       if (ctxt->ops->set_cr(ctxt, cr_num, ctxt->src.val))
                return emulate_gp(ctxt, 0);
 
        /* Disable writeback. */
        ctxt->dst.type = OP_NONE;
+
+       if (cr_num == 0) {
+               /*
+                * CR0 write might have updated CR0.PE and/or CR0.PG
+                * which can affect the cpu's execution mode.
+                */
+               r = emulator_recalc_and_set_mode(ctxt);
+               if (r != X86EMUL_CONTINUE)
+                       return r;
+       }
+
        return X86EMUL_CONTINUE;
 }