From mboxrd@z Thu Jan 1 00:00:00 1970 From: Paolo Bonzini Subject: Re: [PATCH] KVM: nVMX: VMX instructions: fix segment checks when L1 is in long mode. Date: Fri, 24 Jun 2016 15:10:03 +0200 Message-ID: References: <1466240465-19318-1-git-send-email-quentin.casasnovas@oracle.com> <24080992-801c-4606-c801-65ee68cf8779@redhat.com> <20160624130453.GA32026@chrystal.uk.oracle.com> Mime-Version: 1.0 Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 8bit Cc: x86 , kvm , lkml , Eugene Korenevsky , =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , Thomas Gleixner , Ingo Molnar , "H . Peter Anvin" , linux-stable To: Quentin Casasnovas Return-path: In-Reply-To: <20160624130453.GA32026@chrystal.uk.oracle.com> Sender: stable-owner@vger.kernel.org List-Id: kvm.vger.kernel.org On 24/06/2016 15:04, Quentin Casasnovas wrote: > On Thu, Jun 23, 2016 at 06:03:01PM +0200, Paolo Bonzini wrote: >> >> >> On 18/06/2016 11:01, Quentin Casasnovas wrote: >>> Cross-checking the KVM/VMX VMREAD emulation code with the Intel Software >>> Developper Manual Volume 3C - "VMREAD - Read Field from Virtual-Machine >>> Control Structure", I found that we're enforcing that the destination >>> operand is NOT located in a read-only data segment or any code segment when >>> the L1 is in long mode - BUT that check should only happen when it is in >>> protected mode. >>> >>> Shuffling the code a bit to make our emulation follow the specification >>> allows me to boot a Xen dom0 in a nested KVM and start HVM L2 guests >>> without problems. >> >> That's great, and I'm applying the patch, but it's also pretty weird. :) >> Do you have a pointer to Xen source code that does a VMREAD into a >> read-only data segment or a code segment? > > It is indeed pretty weird. Looking at the Xen stack trace, it looks like > the vmread is writing to an on-stack buffer, and surely it must be writable > so I wonder if Xen might not be using an executable stack for some reason? > That would be a bit scary so I'm surely missing something. > > Is there an easy way to know from my KVM host the different segment > permission setup by the guest? Remove your patch, call dump_vmcs() where the #GP is injected, and you'll find the VMCS (including segment permissions, but not the instruction info field---you probably should add it) in dmesg. Thanks, Paolo