From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751760AbcFXNKL (ORCPT ); Fri, 24 Jun 2016 09:10:11 -0400 Received: from mx1.redhat.com ([209.132.183.28]:38719 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751315AbcFXNKI (ORCPT ); Fri, 24 Jun 2016 09:10:08 -0400 Subject: Re: [PATCH] KVM: nVMX: VMX instructions: fix segment checks when L1 is in long mode. To: Quentin Casasnovas References: <1466240465-19318-1-git-send-email-quentin.casasnovas@oracle.com> <24080992-801c-4606-c801-65ee68cf8779@redhat.com> <20160624130453.GA32026@chrystal.uk.oracle.com> Cc: x86 , kvm , lkml , Eugene Korenevsky , =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , Thomas Gleixner , Ingo Molnar , "H . Peter Anvin" , linux-stable From: Paolo Bonzini Message-ID: Date: Fri, 24 Jun 2016 15:10:03 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.1.1 MIME-Version: 1.0 In-Reply-To: <20160624130453.GA32026@chrystal.uk.oracle.com> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 8bit X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.27]); Fri, 24 Jun 2016 13:10:08 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 24/06/2016 15:04, Quentin Casasnovas wrote: > On Thu, Jun 23, 2016 at 06:03:01PM +0200, Paolo Bonzini wrote: >> >> >> On 18/06/2016 11:01, Quentin Casasnovas wrote: >>> Cross-checking the KVM/VMX VMREAD emulation code with the Intel Software >>> Developper Manual Volume 3C - "VMREAD - Read Field from Virtual-Machine >>> Control Structure", I found that we're enforcing that the destination >>> operand is NOT located in a read-only data segment or any code segment when >>> the L1 is in long mode - BUT that check should only happen when it is in >>> protected mode. >>> >>> Shuffling the code a bit to make our emulation follow the specification >>> allows me to boot a Xen dom0 in a nested KVM and start HVM L2 guests >>> without problems. >> >> That's great, and I'm applying the patch, but it's also pretty weird. :) >> Do you have a pointer to Xen source code that does a VMREAD into a >> read-only data segment or a code segment? > > It is indeed pretty weird. Looking at the Xen stack trace, it looks like > the vmread is writing to an on-stack buffer, and surely it must be writable > so I wonder if Xen might not be using an executable stack for some reason? > That would be a bit scary so I'm surely missing something. > > Is there an easy way to know from my KVM host the different segment > permission setup by the guest? Remove your patch, call dump_vmcs() where the #GP is injected, and you'll find the VMCS (including segment permissions, but not the instruction info field---you probably should add it) in dmesg. Thanks, Paolo