This is a note to let you know that I've just added the patch titled

KVM: X86: Fix operand/address-size during instruction decoding

to the 4.14-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git%3Ba=su...

The filename of the patch is: kvm-x86-fix-operand-address-size-during-instruction-decoding.patch and it can be found in the queue-4.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let stable@vger.kernel.org know about it.

From foo@baz Thu Feb 1 13:45:42 CET 2018

From: Wanpeng Li wanpeng.li@hotmail.com Date: Sun, 5 Nov 2017 16:54:47 -0800 Subject: KVM: X86: Fix operand/address-size during instruction decoding

From: Wanpeng Li wanpeng.li@hotmail.com

[ Upstream commit 3853be2603191829b442b64dac6ae8ba0c027bf9 ]

Pedro reported: During tests that we conducted on KVM, we noticed that executing a "PUSH %ES" instruction under KVM produces different results on both memory and the SP register depending on whether EPT support is enabled. With EPT the SP is reduced by 4 bytes (and the written value is 0-padded) but without EPT support it is only reduced by 2 bytes. The difference can be observed when the CS.DB field is 1 (32-bit) but not when it's 0 (16-bit).

The internal segment descriptor cache exist even in real/vm8096 mode. The CS.D also should be respected instead of just default operand/address-size/66H prefix/67H prefix during instruction decoding. This patch fixes it by also adjusting operand/address-size according to CS.D.

Reported-by: Pedro Fonseca pfonseca@cs.washington.edu Tested-by: Pedro Fonseca pfonseca@cs.washington.edu Cc: Paolo Bonzini pbonzini@redhat.com Cc: Radim Krčmář rkrcmar@redhat.com Cc: Nadav Amit nadav.amit@gmail.com Cc: Pedro Fonseca pfonseca@cs.washington.edu Signed-off-by: Wanpeng Li wanpeng.li@hotmail.com Reviewed-by: Paolo Bonzini pbonzini@redhat.com Signed-off-by: Radim Krčmář rkrcmar@redhat.com Signed-off-by: Sasha Levin alexander.levin@verizon.com Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- arch/x86/kvm/emulate.c | 7 +++++++ 1 file changed, 7 insertions(+)

--- a/arch/x86/kvm/emulate.c +++ b/arch/x86/kvm/emulate.c @@ -5009,6 +5009,8 @@ int x86_decode_insn(struct x86_emulate_c bool op_prefix = false; bool has_seg_override = false; struct opcode opcode; + u16 dummy; + struct desc_struct desc;

ctxt->memop.type = OP_NONE; ctxt->memopp = NULL; @@ -5027,6 +5029,11 @@ int x86_decode_insn(struct x86_emulate_c switch (mode) { case X86EMUL_MODE_REAL: case X86EMUL_MODE_VM86: + def_op_bytes = def_ad_bytes = 2; + ctxt->ops->get_segment(ctxt, &dummy, &desc, NULL, VCPU_SREG_CS); + if (desc.d) + def_op_bytes = def_ad_bytes = 4; + break; case X86EMUL_MODE_PROT16: def_op_bytes = def_ad_bytes = 2; break;

Patches currently in stable-queue which might be from wanpeng.li@hotmail.com are

queue-4.14/kvm-x86-don-t-re-execute-instruction-when-not-passing-cr2-value.patch queue-4.14/kvm-x86-ioapic-preserve-read-only-values-in-the-redirection-table.patch queue-4.14/kvm-nvmx-fix-mmu-context-after-vmlaunch-vmresume-failure.patch queue-4.14/kvm-vmx-fix-rflags-cache-during-vcpu-reset.patch queue-4.14/kvm-x86-fix-operand-address-size-during-instruction-decoding.patch queue-4.14/kvm-x86-emulator-return-to-user-mode-on-l1-cpl-0-emulation-failure.patch queue-4.14/kvm-nvmx-nsvm-don-t-intercept-ud-when-running-l2.patch queue-4.14/kvm-x86-fix-softlockup-when-get-the-current-kvmclock.patch queue-4.14/kvm-x86-ioapic-clear-remote-irr-when-entry-is-switched-to-edge-triggered.patch