Re: KVM guest-kernel panics double fault
From: Avi Kivity
Date: Thu Dec 29 2011 - 05:04:25 EST
On 12/29/2011 03:59 AM, Stephan Bärwolf wrote:
> Hello guys,
> I am sorry to disturb you this short before New Year, but I think this
> shouldn't wait until next year.
> After experiencing crashes in virtual maschines and considering kernel /
> qemu / kvm / cpu -bugs, I discovered the following (see patch) issue.
> Because unpriviledged users can crash VMs, I think it is a serious one
> and needs short-term attention.
> The patch I wrote is against 3.2-rc7 but I always tested with linux 3.1.6.
> Hopfully it solve the problems to your satisfaction.
Thanks for the report and patch.
> Subject: [PATCH] KVM: fix missing "illegal instruction"-trap in guests
> within non-64bit protected modes
> On hosts without this patch, 32bit guests will crash for
> example by simply executing following nasm-demo-application:
> [bits 32]
> global _start
> SECTION .text
> _start: syscall
> (I am not sure if this can be exploited in more worse ways,
> like breaking out of VMs in more complex szenarios?
> But I tested it with win32 and linux - both always crashed)
> Disassembly of section .text:
> 00000000 <_start>:
> 0: 0f 05 syscall
> The reason seems a missing "invalid opcode"-trap (int6) for the
> syscall opcode "0f05", which is not available on 32bit cpus.
> Intel's "Intel 64 and IA-32 Architecture Software Developers
> Manual" (http://www.intel.com/content/dam/doc/manual/
> documents on page 1804 (4-586) "syscall" is only available
> in 64bit longmode. So "syscall" must trap in real- and
> virtual 8086 -mode, as also in all non-64bit protected-modes.
However, 'syscall' is available in compatibility mode on 32-bit cpus.
> /* syscall is not available in real mode */
> + /*
> + "0f05" is also not available in
> + all non-64-bit protected modes (16&
> + 32bit) or virtual 8086 mode
> + Only 64bit longmode supports this opcode
> + */
> if (ctxt->mode == X86EMUL_MODE_REAL ||
> + ctxt->mode == X86EMUL_MODE_PROT16 ||
> + ctxt->mode == X86EMUL_MODE_PROT32 ||
> ctxt->mode == X86EMUL_MODE_VM86)
> return emulate_ud(ctxt);
The PROT32 check should be qualifed by a checking the the guest cpuid
vendor is not AMD. Otherwise a guest that was migrated from an AMD host
to an Intel host (this is what this emulation was written for in the
first place) will #UD unexpectedly.
error compiling committee.c: too many arguments to function
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/