* KVM guest-kernel panics double fault @ 2011-12-29 1:59 Stephan Bärwolf 2011-12-29 10:04 ` Avi Kivity 0 siblings, 1 reply; 9+ messages in thread From: Stephan Bärwolf @ 2011-12-29 1:59 UTC (permalink / raw) To: linux-kernel; +Cc: Avi Kivity, Linus Torvalds [-- Attachment #1: Type: text/plain, Size: 2315 bytes --] Hello guys, I am sorry to disturb you this short before New Year, but I think this shouldn't wait until next year. After experiencing crashes in virtual maschines and considering kernel / qemu / kvm / cpu -bugs, I discovered the following (see patch) issue. Because unpriviledged users can crash VMs, I think it is a serious one and needs short-term attention. The patch I wrote is against 3.2-rc7 but I always tested with linux 3.1.6. Hopfully it solve the problems to your satisfaction. regards and a happy new year, Stephan Bärwolf Subject: [PATCH] KVM: fix missing "illegal instruction"-trap in guests within non-64bit protected modes On hosts without this patch, 32bit guests will crash for example by simply executing following nasm-demo-application: [bits 32] global _start SECTION .text _start: syscall (I am not sure if this can be exploited in more worse ways, like breaking out of VMs in more complex szenarios? But I tested it with win32 and linux - both always crashed) Disassembly of section .text: 00000000 <_start>: 0: 0f 05 syscall The reason seems a missing "invalid opcode"-trap (int6) for the syscall opcode "0f05", which is not available on 32bit cpus. Intel's "Intel 64 and IA-32 Architecture Software Developers Manual" (http://www.intel.com/content/dam/doc/manual/ 64-ia-32-architectures-software-developer-manual-325462.pdf) documents on page 1804 (4-586) "syscall" is only available in 64bit longmode. So "syscall" must trap in real- and virtual 8086 -mode, as also in all non-64bit protected-modes. The last ones (16 & 32bit protected mode) are not beeing checked by kvm and so causing a missing trap as an double-fault-panic on 32bit guests. Also an initially not observed problem can be explained with this bug: On 64bit guests (x86_64) 32bit compat-programs are able to syscall their kernel via "0f05" correctly, althought native (not virtualized) systems would also trap! This patch solves the described problem by extending the checking of cpu's operational mode. Screenshots of a i686 testing VM before and after applying this patch are available under: http://matrixstorm.com/software/linux/kvm/20111229/before.jpg http://matrixstorm.com/software/linux/kvm/20111229/after.jpg [-- Attachment #2: 0001-KVM-fix-missing-illegal-instruction-trap-in-guests-w.patch --] [-- Type: text/x-patch, Size: 2713 bytes --] >From 4de09b4bdba4927b8e248daa1bbfacaf3752fb6e Mon Sep 17 00:00:00 2001 From: Stephan Baerwolf <stephan.baerwolf@tu-ilmenau.de> Date: Thu, 29 Dec 2011 00:50:46 +0000 Subject: [PATCH] KVM: fix missing "illegal instruction"-trap in guests within non-64bit protected modes On hosts without this patch, 32bit guests will crash for example by simply executing following nasm-demo-application: [bits 32] global _start SECTION .text _start: syscall (I am not sure if this can be exploited in more worse ways, like breaking out of VMs in more complex szenarios? But I tested it with win32 and linux - both always crashed) Disassembly of section .text: 00000000 <_start>: 0: 0f 05 syscall The reason seems a missing "invalid opcode"-trap (int6) for the syscall opcode "0f05", which is not available on 32bit cpus. Intel's "Intel 64 and IA-32 Architecture Software Developers Manual" (http://www.intel.com/content/dam/doc/manual/ 64-ia-32-architectures-software-developer-manual-325462.pdf) documents on page 1804 (4-586) "syscall" is only available in 64bit longmode. So "syscall" must trap in real- and virtual 8086 -mode, as also in all non-64bit protected-modes. The last ones (16 & 32bit protected mode) are not beeing checked by kvm and so causing a missing trap as an double-fault-panic on 32bit guests. Also an initially not observed problem can be explained with this bug: On 64bit guests (x86_64) 32bit compat-programs are able to syscall their kernel via "0f05" correctly, althought native (not virtualized) systems would also trap! This patch solves the described problem by extending the checking of cpu's operational mode. Screenshots of a i686 testing VM before and after applying this patch are available under: http://matrixstorm.com/software/linux/kvm/20111229/before.jpg http://matrixstorm.com/software/linux/kvm/20111229/after.jpg Signed-off-by: Stephan Baerwolf <stephan.baerwolf@tu-ilmenau.de> --- arch/x86/kvm/emulate.c | 8 ++++++++ 1 files changed, 8 insertions(+), 0 deletions(-) diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c index f1e3be1..60f6ffc 100644 --- a/arch/x86/kvm/emulate.c +++ b/arch/x86/kvm/emulate.c @@ -1886,7 +1886,15 @@ static int em_syscall(struct x86_emulate_ctxt *ctxt) u64 efer = 0; /* syscall is not available in real mode */ + /* + "0f05" is also not available in + all non-64-bit protected modes (16& + 32bit) or virtual 8086 mode + Only 64bit longmode supports this opcode + */ if (ctxt->mode == X86EMUL_MODE_REAL || + ctxt->mode == X86EMUL_MODE_PROT16 || + ctxt->mode == X86EMUL_MODE_PROT32 || ctxt->mode == X86EMUL_MODE_VM86) return emulate_ud(ctxt); -- 1.7.3.4 ^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: KVM guest-kernel panics double fault 2011-12-29 1:59 KVM guest-kernel panics double fault Stephan Bärwolf @ 2011-12-29 10:04 ` Avi Kivity 2012-01-08 2:31 ` Stephan Bärwolf 0 siblings, 1 reply; 9+ messages in thread From: Avi Kivity @ 2011-12-29 10:04 UTC (permalink / raw) To: Stephan Bärwolf; +Cc: linux-kernel, Linus Torvalds On 12/29/2011 03:59 AM, Stephan Bärwolf wrote: > Hello guys, > > I am sorry to disturb you this short before New Year, but I think this > shouldn't wait until next year. > > After experiencing crashes in virtual maschines and considering kernel / > qemu / kvm / cpu -bugs, I discovered the following (see patch) issue. > Because unpriviledged users can crash VMs, I think it is a serious one > and needs short-term attention. > > The patch I wrote is against 3.2-rc7 but I always tested with linux 3.1.6. > Hopfully it solve the problems to your satisfaction. Thanks for the report and patch. > Subject: [PATCH] KVM: fix missing "illegal instruction"-trap in guests > within non-64bit protected modes > > On hosts without this patch, 32bit guests will crash for > example by simply executing following nasm-demo-application: > > [bits 32] > global _start > SECTION .text > _start: syscall > > (I am not sure if this can be exploited in more worse ways, > like breaking out of VMs in more complex szenarios? > But I tested it with win32 and linux - both always crashed) > > Disassembly of section .text: > > 00000000 <_start>: > 0: 0f 05 syscall > > The reason seems a missing "invalid opcode"-trap (int6) for the > syscall opcode "0f05", which is not available on 32bit cpus. > Intel's "Intel 64 and IA-32 Architecture Software Developers > Manual" (http://www.intel.com/content/dam/doc/manual/ > 64-ia-32-architectures-software-developer-manual-325462.pdf) > documents on page 1804 (4-586) "syscall" is only available > in 64bit longmode. So "syscall" must trap in real- and > virtual 8086 -mode, as also in all non-64bit protected-modes. However, 'syscall' is available in compatibility mode on 32-bit cpus. > 0001-KVM-fix-missing-illegal-instruction-trap-in-guests-w.patch > /* syscall is not available in real mode */ > + /* > + "0f05" is also not available in > + all non-64-bit protected modes (16& > + 32bit) or virtual 8086 mode > + Only 64bit longmode supports this opcode > + */ > if (ctxt->mode == X86EMUL_MODE_REAL || > + ctxt->mode == X86EMUL_MODE_PROT16 || > + ctxt->mode == X86EMUL_MODE_PROT32 || > ctxt->mode == X86EMUL_MODE_VM86) > return emulate_ud(ctxt); > > The PROT32 check should be qualifed by a checking the the guest cpuid vendor is not AMD. Otherwise a guest that was migrated from an AMD host to an Intel host (this is what this emulation was written for in the first place) will #UD unexpectedly. -- error compiling committee.c: too many arguments to function ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: KVM guest-kernel panics double fault 2011-12-29 10:04 ` Avi Kivity @ 2012-01-08 2:31 ` Stephan Bärwolf 2012-01-08 10:21 ` Avi Kivity 0 siblings, 1 reply; 9+ messages in thread From: Stephan Bärwolf @ 2012-01-08 2:31 UTC (permalink / raw) To: Avi Kivity; +Cc: linux-kernel, Linus Torvalds [-- Attachment #1: Type: text/plain, Size: 1101 bytes --] Hello, it is me again... I improved the patch, so it is now working on bases of guest's pretends. (For AMD and INTEL CPUs) If anybody needs it, I can also publish my test-VM - just ask me... On 12/29/11 11:04, Avi Kivity wrote: > The PROT32 check should be qualifed by a checking the the guest cpuid > vendor is not AMD. Otherwise a guest that was migrated from an AMD host > to an Intel host (this is what this emulation was written for in the > first place) will #UD unexpectedly. > There are strange AMDs out there, where also again legacy-mode syscalls are not available - or even syscall at all is not available. The implemented (according to doku) tests should now cover all cases. I also think I ovserved some strange behaviour according to cpuid after migration (change from Intel to AMD - see picture: http://matrixstorm.com/software/linux/kvm/20111229/cpuidmagic.jpg ) But it is possible it is "only" an qemu-kvm (0.14.1-r2) bug ... The patch I wrote is against 3.2, but I always tested with linux 3.1.7. Hopfully it solve the problems to your satisfaction this time. regards Stephan [-- Attachment #2: 0001-KVM-move-emul_to_vcpu-makro-to-headerfile.patch --] [-- Type: text/x-patch, Size: 1403 bytes --] >From 904c45acea67d5b18796a2d97bce54097bd440fe Mon Sep 17 00:00:00 2001 From: Stephan Baerwolf <stephan.baerwolf@tu-ilmenau.de> Date: Sat, 7 Jan 2012 20:20:43 +0000 Subject: [PATCH 1/2] KVM: move "emul_to_vcpu"-makro to headerfile In order to take advantage of "emul_to_vpu" in other C-files, this makro has been moved to the headerfile. Signed-off-by: Stephan Baerwolf <stephan.baerwolf@tu-ilmenau.de> --- arch/x86/kvm/x86.c | 3 --- arch/x86/kvm/x86.h | 3 +++ 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 4c938da..ac949ba 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -64,9 +64,6 @@ #define KVM_MAX_MCE_BANKS 32 #define KVM_MCE_CAP_SUPPORTED (MCG_CTL_P | MCG_SER_P) -#define emul_to_vcpu(ctxt) \ - container_of(ctxt, struct kvm_vcpu, arch.emulate_ctxt) - /* EFER defaults: * - enable syscall per default because its emulated by KVM * - enable LME and LMA per default on 64 bit KVM diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h index d36fe23..644c843 100644 --- a/arch/x86/kvm/x86.h +++ b/arch/x86/kvm/x86.h @@ -4,6 +4,9 @@ #include <linux/kvm_host.h> #include "kvm_cache_regs.h" +#define emul_to_vcpu(ctxt) \ + container_of(ctxt, struct kvm_vcpu, arch.emulate_ctxt) + static inline void kvm_clear_exception_queue(struct kvm_vcpu *vcpu) { vcpu->arch.exception.pending = false; -- 1.7.3.4 [-- Attachment #3: 0002-KVM-fix-missing-illegal-instruction-trap-in-protecte.patch --] [-- Type: text/x-patch, Size: 6093 bytes --] >From 027d609f885c1f7d46afc0f68eab33c006fa57c6 Mon Sep 17 00:00:00 2001 From: Stephan Baerwolf <stephan.baerwolf@tu-ilmenau.de> Date: Sun, 8 Jan 2012 02:03:47 +0000 Subject: [PATCH 2/2] KVM: fix missing "illegal instruction"-trap in protected modes On hosts without this patch, 32bit guests will crash (and 64bit guests may behave in a wrong way) for example by simply executing following nasm-demo-application: [bits 32] global _start SECTION .text _start: syscall (I tested it with winxp and linux - both always crashed) Disassembly of section .text: 00000000 <_start>: 0: 0f 05 syscall The reason seems a missing "invalid opcode"-trap (int6) for the syscall opcode "0f05", which is not available on Intel CPUs within non-longmodes, as also on some AMD CPUs within legacy-mode. (depending on CPU vendor, MSR_EFER and cpuid) Because previous mentioned OSs may not engage corresponding syscall target-registers (STAR, LSTAR, CSTAR), they remain NULL and (non trapping) syscalls are leading to multiple faults and finally crashs. Depending on the architecture (AMD or Intel) pretended by guests, various checks according to vendor's documentation are implemented to overcome the current issue and behave like the CPUs physical counterparts. (Therefore using Intel's "Intel 64 and IA-32 Architecture Software Developers Manual" http://www.intel.com/content/dam/doc/manual/ 64-ia-32-architectures-software-developer-manual-325462.pdf and AMD's "AMD64 Architecture Programmer's Manual Volume 3: General-Purpose and System Instructions" http://support.amd.com/us/Processor_TechDocs/APM_V3_24594.pdf ) Screenshots of an i686 testing VM (CORE i5 host) before and after applying this patch are available under: http://matrixstorm.com/software/linux/kvm/20111229/before.jpg http://matrixstorm.com/software/linux/kvm/20111229/after.jpg Signed-off-by: Stephan Baerwolf <stephan.baerwolf@tu-ilmenau.de> --- arch/x86/include/asm/kvm_emulate.h | 15 +++++++++ arch/x86/kvm/emulate.c | 57 ++++++++++++++++++++++++++++++++++++ 2 files changed, 72 insertions(+), 0 deletions(-) diff --git a/arch/x86/include/asm/kvm_emulate.h b/arch/x86/include/asm/kvm_emulate.h index a026507..2a86ff9 100644 --- a/arch/x86/include/asm/kvm_emulate.h +++ b/arch/x86/include/asm/kvm_emulate.h @@ -297,6 +297,21 @@ struct x86_emulate_ctxt { #define X86EMUL_MODE_PROT (X86EMUL_MODE_PROT16|X86EMUL_MODE_PROT32| \ X86EMUL_MODE_PROT64) +/* CPUID vendors */ +#define X86EMUL_CPUID_VENDOR_AuthenticAMD_ebx 0x68747541 +#define X86EMUL_CPUID_VENDOR_AuthenticAMD_ecx 0x444d4163 +#define X86EMUL_CPUID_VENDOR_AuthenticAMD_edx 0x69746e65 + +#define X86EMUL_CPUID_VENDOR_AMDisbetter_ebx 0x69444d41 +#define X86EMUL_CPUID_VENDOR_AMDisbetter_ecx 0x21726574 +#define X86EMUL_CPUID_VENDOR_AMDisbetter_edx 0x74656273 + +#define X86EMUL_CPUID_VENDOR_GenuineIntel_ebx 0x756e6547 +#define X86EMUL_CPUID_VENDOR_GenuineIntel_ecx 0x6c65746e +#define X86EMUL_CPUID_VENDOR_GenuineIntel_edx 0x49656e69 + + + enum x86_intercept_stage { X86_ICTP_NONE = 0, /* Allow zero-init to not match anything */ X86_ICPT_PRE_EXCEPT, diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c index f1e3be1..78edb66 100644 --- a/arch/x86/kvm/emulate.c +++ b/arch/x86/kvm/emulate.c @@ -1891,6 +1891,63 @@ static int em_syscall(struct x86_emulate_ctxt *ctxt) return emulate_ud(ctxt); ops->get_msr(ctxt, MSR_EFER, &efer); + // check - if guestOS is aware of syscall (0x0f05) + if ((efer & EFER_SCE) == 0) return emulate_ud(ctxt); + else { + // ok, at this point it becomes vendor-specific + // so first get us an cpuid + struct kvm_cpuid_entry2 *vendor; + + // eax = 0x00000000, ebx = 0x00000000 ==> cpu-vendor + vendor = kvm_find_cpuid_entry(emul_to_vcpu(ctxt), 0, 0); + + if (likely(vendor)) { + // AMD (AuthenticAMD)/(AMDisbetter!) + if ((vendor->ebx==X86EMUL_CPUID_VENDOR_AuthenticAMD_ebx && + vendor->ecx==X86EMUL_CPUID_VENDOR_AuthenticAMD_ecx && + vendor->edx==X86EMUL_CPUID_VENDOR_AuthenticAMD_edx) || + (vendor->ebx==X86EMUL_CPUID_VENDOR_AMDisbetter_ebx && + vendor->ecx==X86EMUL_CPUID_VENDOR_AMDisbetter_ecx && + vendor->edx==X86EMUL_CPUID_VENDOR_AMDisbetter_edx)) { + + // if cpu is not in longmode... + // ...check edx bit11 of cpuid 0x80000001 + if (ctxt->mode != X86EMUL_MODE_PROT64) { + vendor= kvm_find_cpuid_entry(emul_to_vcpu(ctxt), 0x80000001, 0); + if (likely(vendor)) { + if (unlikely(((vendor->edx >> 11) & 0x1) == 0)) return emulate_ud(ctxt); + } else return emulate_ud(ctxt); // assuming there is no bit 11 + } + goto __em_syscall_vendor_processed; + } // end "AMD" + + // Intel (GenuineIntel) + // remarks: Intel CPUs only support "syscall" in 64bit longmode + // Also an 64bit guest within an 32bit compat-app running + // will #UD !! + // While this behaviour can be fixed (by emulating) into + // an AMD response - CPUs of AMD can't behave like Intel + // because without an hardware-raised #UD there is no + // call into emulation-mode (see x86_emulate_instruction(...)) ! + // TODO: make AMD-behaviour configurable + if (vendor->ebx==X86EMUL_CPUID_VENDOR_GenuineIntel_ebx && + vendor->ecx==X86EMUL_CPUID_VENDOR_GenuineIntel_ecx && + vendor->edx==X86EMUL_CPUID_VENDOR_GenuineIntel_edx) { + if (ctxt->mode != X86EMUL_MODE_PROT64) return emulate_ud(ctxt); + goto __em_syscall_vendor_processed; + } // end "Intel" + } //end "likely(vendor)" + + // default: + // this code wasn't able to process vendor + // so apply Intels stricter rules... + pr_unimpl(emul_to_vcpu(ctxt), "unknown vendor of cpu - assuming intel\n"); + if (ctxt->mode != X86EMUL_MODE_PROT64) return emulate_ud(ctxt); + + __em_syscall_vendor_processed: + vendor=NULL; + } + setup_syscalls_segments(ctxt, &cs, &ss); ops->get_msr(ctxt, MSR_STAR, &msr_data); -- 1.7.3.4 ^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: KVM guest-kernel panics double fault 2012-01-08 2:31 ` Stephan Bärwolf @ 2012-01-08 10:21 ` Avi Kivity 2012-01-10 10:11 ` Stephan Bärwolf 0 siblings, 1 reply; 9+ messages in thread From: Avi Kivity @ 2012-01-08 10:21 UTC (permalink / raw) To: stephan.baerwolf; +Cc: linux-kernel, Linus Torvalds On 01/08/2012 04:31 AM, Stephan Bärwolf wrote: > Hello, it is me again... > > I improved the patch, so it is now working on bases of guest's pretends. > (For AMD and INTEL CPUs) > If anybody needs it, I can also publish my test-VM - just ask me... Please post patches separately, not as attachments to a single email. See Documentation/SubmittingPatches. > On 12/29/11 11:04, Avi Kivity wrote: >> > The PROT32 check should be qualifed by a checking the the guest cpuid >> > vendor is not AMD. Otherwise a guest that was migrated from an AMD host >> > to an Intel host (this is what this emulation was written for in the >> > first place) will #UD unexpectedly. >> > > There are strange AMDs out there, where also again legacy-mode > syscalls are not available - or even syscall at all is not available. > The implemented (according to doku) tests should now cover all > cases. > > I also think I ovserved some strange behaviour according to cpuid after > migration (change from Intel to AMD - see picture: > http://matrixstorm.com/software/linux/kvm/20111229/cpuidmagic.jpg ) > But it is possible it is "only" an qemu-kvm (0.14.1-r2) bug ... You need to start qemu with -cpu ...,vendor=blah to preserve the vendor ID after live migration. > > The patch I wrote is against 3.2, but I always tested with linux 3.1.7. > Hopfully it solve the problems to your satisfaction this time. > > > regards Stephan > > > In order to take advantage of "emul_to_vpu" in other > C-files, this makro has been moved to the headerfile. > > > diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c > index 4c938da..ac949ba 100644 > --- a/arch/x86/kvm/x86.c > +++ b/arch/x86/kvm/x86.c > @@ -64,9 +64,6 @@ > #define KVM_MAX_MCE_BANKS 32 > #define KVM_MCE_CAP_SUPPORTED (MCG_CTL_P | MCG_SER_P) > > -#define emul_to_vcpu(ctxt) \ > - container_of(ctxt, struct kvm_vcpu, arch.emulate_ctxt) > - > /* EFER defaults: > * - enable syscall per default because its emulated by KVM > * - enable LME and LMA per default on 64 bit KVM > diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h > index d36fe23..644c843 100644 > --- a/arch/x86/kvm/x86.h > +++ b/arch/x86/kvm/x86.h > @@ -4,6 +4,9 @@ > #include <linux/kvm_host.h> > #include "kvm_cache_regs.h" > > +#define emul_to_vcpu(ctxt) \ > + container_of(ctxt, struct kvm_vcpu, arch.emulate_ctxt) > + > static inline void kvm_clear_exception_queue(struct kvm_vcpu *vcpu) > { > vcpu->arch.exception.pending = false; The emulator is written to be independent of the rest of kvm, using emul_to_vcpu() undoes that. If you need access to more vpcu internals, add more function pointers to struct x86_emulate_ops. > > > From 027d609f885c1f7d46afc0f68eab33c006fa57c6 Mon Sep 17 00:00:00 2001 > From: Stephan Baerwolf <stephan.baerwolf@tu-ilmenau.de> > Date: Sun, 8 Jan 2012 02:03:47 +0000 > Subject: [PATCH 2/2] KVM: fix missing "illegal instruction"-trap in protected modes > > On hosts without this patch, 32bit guests will crash > (and 64bit guests may behave in a wrong way) for > example by simply executing following nasm-demo-application: > > [bits 32] > global _start > SECTION .text > _start: syscall > > (I tested it with winxp and linux - both always crashed) > > Disassembly of section .text: > > 00000000 <_start>: > 0: 0f 05 syscall > > The reason seems a missing "invalid opcode"-trap (int6) for the > syscall opcode "0f05", which is not available on Intel CPUs > within non-longmodes, as also on some AMD CPUs within legacy-mode. > (depending on CPU vendor, MSR_EFER and cpuid) > > Because previous mentioned OSs may not engage corresponding > syscall target-registers (STAR, LSTAR, CSTAR), they remain > NULL and (non trapping) syscalls are leading to multiple > faults and finally crashs. > > Depending on the architecture (AMD or Intel) pretended by > guests, various checks according to vendor's documentation > are implemented to overcome the current issue and behave > like the CPUs physical counterparts. > > (Therefore using Intel's "Intel 64 and IA-32 Architecture Software > Developers Manual" http://www.intel.com/content/dam/doc/manual/ > 64-ia-32-architectures-software-developer-manual-325462.pdf > and AMD's "AMD64 Architecture Programmer's Manual Volume 3: > General-Purpose and System Instructions" > http://support.amd.com/us/Processor_TechDocs/APM_V3_24594.pdf ) > > Screenshots of an i686 testing VM (CORE i5 host) before > and after applying this patch are available under: > > http://matrixstorm.com/software/linux/kvm/20111229/before.jpg > http://matrixstorm.com/software/linux/kvm/20111229/after.jpg > > Signed-off-by: Stephan Baerwolf <stephan.baerwolf@tu-ilmenau.de> > --- > arch/x86/include/asm/kvm_emulate.h | 15 +++++++++ > arch/x86/kvm/emulate.c | 57 ++++++++++++++++++++++++++++++++++++ > 2 files changed, 72 insertions(+), 0 deletions(-) > > diff --git a/arch/x86/include/asm/kvm_emulate.h b/arch/x86/include/asm/kvm_emulate.h > index a026507..2a86ff9 100644 > --- a/arch/x86/include/asm/kvm_emulate.h > +++ b/arch/x86/include/asm/kvm_emulate.h > @@ -297,6 +297,21 @@ struct x86_emulate_ctxt { > #define X86EMUL_MODE_PROT (X86EMUL_MODE_PROT16|X86EMUL_MODE_PROT32| \ > X86EMUL_MODE_PROT64) > > +/* CPUID vendors */ > +#define X86EMUL_CPUID_VENDOR_AuthenticAMD_ebx 0x68747541 > +#define X86EMUL_CPUID_VENDOR_AuthenticAMD_ecx 0x444d4163 > +#define X86EMUL_CPUID_VENDOR_AuthenticAMD_edx 0x69746e65 > + > +#define X86EMUL_CPUID_VENDOR_AMDisbetter_ebx 0x69444d41 > +#define X86EMUL_CPUID_VENDOR_AMDisbetter_ecx 0x21726574 > +#define X86EMUL_CPUID_VENDOR_AMDisbetter_edx 0x74656273 > + > +#define X86EMUL_CPUID_VENDOR_GenuineIntel_ebx 0x756e6547 > +#define X86EMUL_CPUID_VENDOR_GenuineIntel_ecx 0x6c65746e > +#define X86EMUL_CPUID_VENDOR_GenuineIntel_edx 0x49656e69 > + > + > + > enum x86_intercept_stage { > X86_ICTP_NONE = 0, /* Allow zero-init to not match anything */ > X86_ICPT_PRE_EXCEPT, > diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c > index f1e3be1..78edb66 100644 > --- a/arch/x86/kvm/emulate.c > +++ b/arch/x86/kvm/emulate.c > @@ -1891,6 +1891,63 @@ static int em_syscall(struct x86_emulate_ctxt *ctxt) > return emulate_ud(ctxt); > > ops->get_msr(ctxt, MSR_EFER, &efer); > + // check - if guestOS is aware of syscall (0x0f05) > + if ((efer & EFER_SCE) == 0) return emulate_ud(ctxt); 'return' on its own line; don't use C++ style comments. Use tabs for indents. Please read Documentation/CodingStyle. > + else { > + // ok, at this point it becomes vendor-specific > + // so first get us an cpuid > + struct kvm_cpuid_entry2 *vendor; > + > + // eax = 0x00000000, ebx = 0x00000000 ==> cpu-vendor > + vendor = kvm_find_cpuid_entry(emul_to_vcpu(ctxt), 0, 0); The third parameter is actually ecx > + > + if (likely(vendor)) { > + // AMD (AuthenticAMD)/(AMDisbetter!) > + if ((vendor->ebx==X86EMUL_CPUID_VENDOR_AuthenticAMD_ebx && spaces around == > + vendor->ecx==X86EMUL_CPUID_VENDOR_AuthenticAMD_ecx && > + vendor->edx==X86EMUL_CPUID_VENDOR_AuthenticAMD_edx) || > + (vendor->ebx==X86EMUL_CPUID_VENDOR_AMDisbetter_ebx && > + vendor->ecx==X86EMUL_CPUID_VENDOR_AMDisbetter_ecx && > + vendor->edx==X86EMUL_CPUID_VENDOR_AMDisbetter_edx)) { > + > + // if cpu is not in longmode... > + // ...check edx bit11 of cpuid 0x80000001 > + if (ctxt->mode != X86EMUL_MODE_PROT64) { > + vendor= kvm_find_cpuid_entry(emul_to_vcpu(ctxt), 0x80000001, 0); > + if (likely(vendor)) { > + if (unlikely(((vendor->edx >> 11) & 0x1) == 0)) return emulate_ud(ctxt); > + } else return emulate_ud(ctxt); // assuming there is no bit 11 > + } > + goto __em_syscall_vendor_processed; > + } // end "AMD" > + > + // Intel (GenuineIntel) > + // remarks: Intel CPUs only support "syscall" in 64bit longmode > + // Also an 64bit guest within an 32bit compat-app running > + // will #UD !! > + // While this behaviour can be fixed (by emulating) into > + // an AMD response - CPUs of AMD can't behave like Intel > + // because without an hardware-raised #UD there is no > + // call into emulation-mode (see x86_emulate_instruction(...)) ! > + // TODO: make AMD-behaviour configurable > + if (vendor->ebx==X86EMUL_CPUID_VENDOR_GenuineIntel_ebx && > + vendor->ecx==X86EMUL_CPUID_VENDOR_GenuineIntel_ecx && > + vendor->edx==X86EMUL_CPUID_VENDOR_GenuineIntel_edx) { > + if (ctxt->mode != X86EMUL_MODE_PROT64) return emulate_ud(ctxt); > + goto __em_syscall_vendor_processed; > + } // end "Intel" > + } //end "likely(vendor)" > + > + // default: > + // this code wasn't able to process vendor > + // so apply Intels stricter rules... > + pr_unimpl(emul_to_vcpu(ctxt), "unknown vendor of cpu - assuming intel\n"); > + if (ctxt->mode != X86EMUL_MODE_PROT64) return emulate_ud(ctxt); > + > + __em_syscall_vendor_processed: > + vendor=NULL; > + } Please move all these checks into a separate function, returning whether to allow emulation or #UD. -- error compiling committee.c: too many arguments to function ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: KVM guest-kernel panics double fault 2012-01-08 10:21 ` Avi Kivity @ 2012-01-10 10:11 ` Stephan Bärwolf 2012-01-10 10:31 ` Avi Kivity 0 siblings, 1 reply; 9+ messages in thread From: Stephan Bärwolf @ 2012-01-10 10:11 UTC (permalink / raw) To: Avi Kivity; +Cc: linux-kernel, Linus Torvalds Hello. Thank you for your lots of information, they helped very much - especially debugging... > The third parameter is actually ecx (ebx was actually a typing... ...of course ecx!) > The emulator is written to be independent of the rest of kvm, using > emul_to_vcpu() undoes that. If you need access to more vpcu internals, > add more function pointers to struct x86_emulate_ops. I prepare/adapt everything to the mentioned styles/policy. (I'll insert 2 additional ops for getting "cpuid" and "id of vcpu"...) > Please post patches separately, not as attachments to a single email. > See Documentation/SubmittingPatches. One thing, which is not fully clear to me: Where exactly should I post the patches? Also to/in this mail/group as an empty mail (containing the patch as text-body) per patch? Or all (3 patches) at once? Do you prefer them in a git-repo for example at github? Again, thank you a lot regards Stephan ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: KVM guest-kernel panics double fault 2012-01-10 10:11 ` Stephan Bärwolf @ 2012-01-10 10:31 ` Avi Kivity 2012-01-10 12:17 ` Stephan Bärwolf 0 siblings, 1 reply; 9+ messages in thread From: Avi Kivity @ 2012-01-10 10:31 UTC (permalink / raw) To: stephan.baerwolf; +Cc: linux-kernel, Linus Torvalds On 01/10/2012 12:11 PM, Stephan Bärwolf wrote: > Hello. > > Thank you for your lots of information, they helped very much - > especially debugging... > > > The third parameter is actually ecx > (ebx was actually a typing... ...of course ecx!) > > > The emulator is written to be independent of the rest of kvm, using > > emul_to_vcpu() undoes that. If you need access to more vpcu internals, > > add more function pointers to struct x86_emulate_ops. > I prepare/adapt everything to the mentioned styles/policy. > (I'll insert 2 additional ops for getting "cpuid" and "id of vcpu"...) What do you mean by "id of vcpu"? > > > Please post patches separately, not as attachments to a single email. > > See Documentation/SubmittingPatches. > One thing, which is not fully clear to me: Where exactly should I post > the patches? > Also to/in this mail/group as an empty mail (containing the patch as > text-body) per patch? > Or all (3 patches) at once? One patch per email, with a cover letter. Git can help you format and send them: # format three patches, with a cover letter: $ git format-patch -3 --cover-letter -n -o patches # edit the cover letter: $ vi patches/0000-cover-letter-patch # post them: $ git send-email --to kvm@vger.kernel.org patches/*.patch -- I have a truly marvellous patch that fixes the bug which this signature is too narrow to contain. ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: KVM guest-kernel panics double fault 2012-01-10 10:31 ` Avi Kivity @ 2012-01-10 12:17 ` Stephan Bärwolf 2012-01-10 12:34 ` Avi Kivity 0 siblings, 1 reply; 9+ messages in thread From: Stephan Bärwolf @ 2012-01-10 12:17 UTC (permalink / raw) To: Avi Kivity; +Cc: linux-kernel, Linus Torvalds Hi, me again. Thank you for your instructions, I will send the patch right after this mail. On 01/10/12 11:31, Avi Kivity wrote: >> I prepare/adapt everything to the mentioned styles/policy. >> (I'll insert 2 additional ops for getting "cpuid" and "id of vcpu"...) > What do you mean by "id of vcpu"? I mean the number of the corresponding vcpu. (So mostly "vcpu->vcpu_id" ...) It is necessary for "pr_err_ratelimited"-complains, if cpuid-vendor is unknown ... ("Jan 10 12:14:55 thinkrat kernel: [ 4476.484359] kvm: 15680: cpu0 unknown vendor - assuming intel") >>> Please post patches separately, not as attachments to a single email. >>> See Documentation/SubmittingPatches. >> One thing, which is not fully clear to me: Where exactly should I post >> the patches? >> Also to/in this mail/group as an empty mail (containing the patch as >> text-body) per patch? >> Or all (3 patches) at once? > One patch per email, with a cover letter. Git can help you format and > send them: > > # format three patches, with a cover letter: > $ git format-patch -3 --cover-letter -n -o patches > # edit the cover letter: > $ vi patches/0000-cover-letter-patch > # post them: > $ git send-email --to kvm@vger.kernel.org patches/*.patch > Thx, I'll do it this way... regards Stephan ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: KVM guest-kernel panics double fault 2012-01-10 12:17 ` Stephan Bärwolf @ 2012-01-10 12:34 ` Avi Kivity 2012-01-10 12:48 ` Stephan Bärwolf 0 siblings, 1 reply; 9+ messages in thread From: Avi Kivity @ 2012-01-10 12:34 UTC (permalink / raw) To: stephan.baerwolf; +Cc: linux-kernel, Linus Torvalds On 01/10/2012 02:17 PM, Stephan Bärwolf wrote: > Hi, me again. > > Thank you for your instructions, I will send the patch right after this > mail. > > On 01/10/12 11:31, Avi Kivity wrote: > >> I prepare/adapt everything to the mentioned styles/policy. > >> (I'll insert 2 additional ops for getting "cpuid" and "id of vcpu"...) > > What do you mean by "id of vcpu"? > I mean the number of the corresponding vcpu. > (So mostly "vcpu->vcpu_id" ...) > It is necessary for "pr_err_ratelimited"-complains, if cpuid-vendor is > unknown ... > ("Jan 10 12:14:55 thinkrat kernel: [ 4476.484359] kvm: 15680: cpu0 > unknown vendor - assuming intel") It isn't worthwhile - just don't print the vcpu number (the task ID contains enough information, and anyway this should be rare to the point of never ever happening) -- I have a truly marvellous patch that fixes the bug which this signature is too narrow to contain. ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: KVM guest-kernel panics double fault 2012-01-10 12:34 ` Avi Kivity @ 2012-01-10 12:48 ` Stephan Bärwolf 0 siblings, 0 replies; 9+ messages in thread From: Stephan Bärwolf @ 2012-01-10 12:48 UTC (permalink / raw) To: Avi Kivity; +Cc: linux-kernel, Linus Torvalds On 01/10/12 13:34, Avi Kivity wrote: > I prepare/adapt everything to the mentioned styles/policy. > (I'll insert 2 additional ops for getting "cpuid" and "id of vcpu"...) >>> What do you mean by "id of vcpu"? >> I mean the number of the corresponding vcpu. >> (So mostly "vcpu->vcpu_id" ...) >> It is necessary for "pr_err_ratelimited"-complains, if cpuid-vendor is >> unknown ... >> ("Jan 10 12:14:55 thinkrat kernel: [ 4476.484359] kvm: 15680: cpu0 >> unknown vendor - assuming intel") > It isn't worthwhile - just don't print the vcpu number (the task ID > contains enough information, and anyway this should be rare to the point > of never ever happening) > The message itself can be user-triggered ("-cpu core2duo,vendor=StephansQemu"), but you are right. Normally all cpus got the same cpuid, so it shouln't interest which one had the unknown vendor... ...fixing it and then sending... regards Stephan -- Dipl.-Inf. Stephan Bärwolf Ilmenau University of Technology, Integrated Communication Systems Group Phone: +49 (0)3677 69 4130 Email: stephan.baerwolf@tu-ilmenau.de, Web: http://www.tu-ilmenau.de/iks ^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2012-01-10 12:50 UTC | newest] Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2011-12-29 1:59 KVM guest-kernel panics double fault Stephan Bärwolf 2011-12-29 10:04 ` Avi Kivity 2012-01-08 2:31 ` Stephan Bärwolf 2012-01-08 10:21 ` Avi Kivity 2012-01-10 10:11 ` Stephan Bärwolf 2012-01-10 10:31 ` Avi Kivity 2012-01-10 12:17 ` Stephan Bärwolf 2012-01-10 12:34 ` Avi Kivity 2012-01-10 12:48 ` Stephan Bärwolf
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).