lkml.org 
[lkml]   [2017]   [Dec]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: WARNING in x86_emulate_insn
    2017-12-08 16:28 GMT+08:00 Tianyu Lan <lantianyu1986@gmail.com>:
    > Hi Jim&Wanpeng:
    > Thanks for your help.
    >
    > 2017-12-08 5:25 GMT+08:00 Jim Mattson <jmattson@google.com>:
    >> Try disabling the module parameter, "unrestricted_guest." Make sure
    >> that the module parameter, "emulate_invalid_guest_state" is enabled.
    >> This combination allows userspace to feed invalid guest state into the
    >> in-kernel emulator.
    >
    > Yes, you are right. I need to disable unrestricted_guest to reproduce the issue.

    I can observe ctxt->exception.vector == 0xff which triggers Dmitry's
    report. Do you figure out the reason?

    Regards,
    Wanpeng Li

    >
    > I find this is pop instruction emulation issue. According "SDM VOL2,
    > chapter INSTRUCTION
    > SET REFERENCE. POP—Pop a Value from the Stack"
    >
    > Protected Mode Exceptions
    > #GP(0) If attempt is made to load SS register with NULL segment selector.
    >
    > This test case hits it but current code doesn't check such case.
    > The following patch can fix the issue.
    >
    > diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
    > index abe74f7..e2ac5cc 100644
    > --- a/arch/x86/kvm/emulate.c
    > +++ b/arch/x86/kvm/emulate.c
    > @@ -1844,6 +1844,9 @@ static int emulate_pop(struct x86_emulate_ctxt *ctxt,
    > int rc;
    > struct segmented_address addr;
    >
    > + if ( !get_segment_selector(ctxt, VCPU_SREG_SS))
    > + return emulate_gp(ctxt, 0);
    > +
    > addr.ea = reg_read(ctxt, VCPU_REGS_RSP) & stack_mask(ctxt);
    > addr.seg = VCPU_SREG_SS;
    > rc = segmented_read(ctxt, addr, dest, len);

    \
     
     \ /
      Last update: 2017-12-08 10:28    [W:2.978 / U:0.216 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site