Hi Jim&Wanpeng:
Thanks for your help.
2017-12-08 5:25 GMT+08:00 Jim Mattson <jmattson@xxxxxxxxxx>:
> Try disabling the module parameter, "unrestricted_guest." Make sure
> that the module parameter, "emulate_invalid_guest_state" is enabled.
> This combination allows userspace to feed invalid guest state into the
> in-kernel emulator.
Yes, you are right. I need to disable unrestricted_guest to reproduce the issue.
I find this is pop instruction emulation issue. According "SDM VOL2,
chapter INSTRUCTION
SET REFERENCE. POP—Pop a Value from the Stack"
Protected Mode Exceptions
#GP(0) If attempt is made to load SS register with NULL segment selector.
This test case hits it but current code doesn't check such case.
The following patch can fix the issue.
diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
index abe74f7..e2ac5cc 100644
--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
@@ -1844,6 +1844,9 @@ static int emulate_pop(struct x86_emulate_ctxt *ctxt,
int rc;
struct segmented_address addr;
+ if ( !get_segment_selector(ctxt, VCPU_SREG_SS))
+ return emulate_gp(ctxt, 0);
+
addr.ea = reg_read(ctxt, VCPU_REGS_RSP) & stack_mask(ctxt);
addr.seg = VCPU_SREG_SS;
rc = segmented_read(ctxt, addr, dest, len);
