On 6/8/26 12:18, Andrey Polivoda wrote:
Intel and AMD CPUs implement SYSRETQ instruction differently.
One of these differences is whether a canonicality check of the address that
will be loaded to RIP is performed: Intel CPUs do this check, AMD CPUs don't.
Currently, QEMU does not perform this check when emulating Intel CPUs.
This patch corrects this by implementing the canonlicality check on a new RIP
value from RCX and performing it only when emulating Intel CPUs.
Flags and segment registers' caches are updated only after checking the new RIP
value to ensure that CPU state is not modified in case the #GP(0) exception
is raised due to the check failure.
Cc: [email protected]
Cc: Paolo Bonzini <[email protected]>
Cc: Richard Henderson <[email protected]>
Fixes: 14ce26e75513 ("x86_64 target support")
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3223
Signed-off-by: Andrey Polivoda <[email protected]>
I'm picking it up for the stable series. This issue has been with us since
the day one, but since there's a bug/issue filed about it, it bothers
people.
Please let me know if I shouldn't pick it up.
Thanks,
/mjt
